Aerospace and Electronic Systems Magazine March 2017 - 13

Leung and Rife
larly in certifying low-cost UAS. Although we focus on UAS, the
ideas presented in this article can be generalized to conventional
aircraft as well.

ACKNOWLEDGMENT
This research was supported by the National Science Foundation
under Grant CNS-1329341.

REFERENCES
[1]
[2]
[3]

[4]

[5]

[6]

[7]
[8]

[9]
[10]

Press Release - DOT and FAA Propose New Rules for Small Unmanned Aircraft Systems. Feb. 15, 2015. Retrieved May 25, 2015.
Vesely, W. Fault Tree Handbook with Aerospace Applications. Washington, D.C.: NASA, 2002.
Taylor, Z., and Ranganathan, S. Design failure modes and effects
analysis. Designing High Availability Systems: DFSS and Classical
Reliability, 2014.
Freeman, P., and Balas, G. J. Actuation failure modes and effects
analysis for a small UAS. In Proceedings of the American Control
Conference (ACC), June 4-6, 2014, 1292-1297.
Ren, Y., and Kong, L. Fuzzy multi-state fault tree analysis based on
fuzzy expert system. In Proceedings of the 2011 9th International
Conference on Reliability, Maintainability and Safety (ICRMS), June
12-15, 2011, 920-925.
Gan, L., Li, Y., Xiao, N.-C., Liu, Y., and Huang, H.-Z. Apply degree
of match & fuzzy rule based mode for FMECA in flight control system. In Proceedings of the 2012 International Conference on Quality,
Reliability, Risk, Maintenance, and Safety Engineering (ICQR2MSE),
June 15-18, 2012, 176-179.
FAA System Safety Handbook, 2000.
Saunders, F., Rife, J., Vaddi, V. S., and Cheng, V. Information flow
diagram analysis of a model cyber-physical system: Conflict detection
and resolution for airport surface traffic. IEEE Aerospace and Electronics Magazine, Vol. 28, 12 (2013), 26-35.
McNeill, F. M., and Thro, E. Fuzzy Logic: A Practical Approach. New
York: AP Professional, 2014.
Clothier, R. A., Walker, R. A., Fulton, N., and Campbell, D. A. A
casualty risk analysis for unmanned aerial system (UAS) operations
over inhabited areas. In Proceedings of the Twelfth Australian International Aerospace Congress, 2nd Australasian Unmanned Air Vehicles
Conference, Mar. 19-22, 2007, Melbourne. Australia.

APPENDIX
This appendix specifies values used in analyzing Figure 5. The
figure shows a network containing eleven fault events (F01-F11),
shown as red hexagons. Each fault event was specified with a baseline fault probability, as given in Table 13. The baseline fault probabilities were assigned such that the binary analysis resulted in a
total fault probability equal to 10−5.
The baseline fault probabilities were extended to multiple
consequence levels, as shown in Table 14. Our analysis considered five consequence severity levels: no failure, minor, major,
hazardous, and catastrophic. The binary analysis grouped the
severity levels into two categories, a "faulted" category conMARCH 2017

sisting of major, hazardous, and catastrophic consequences and
a complementary "fault-free" category consisting of minor and
no failure consequences. For fuzzy and CSL analyses, all five severity levels were explicitly represented. In both fuzzy and CSL
analysis, the "major" severity level was assigned the baseline fault
probability from Table 13; the "hazardous" severity level was assigned a small additional probability, equal to 100th the baseline
probability; and the "minor" severity level was assigned an additional probability m (with m = 10−3). The "no failure" level was
assigned the complementary probability C, such that the sum of
event probabilities was one.
The fault event probabilities were combined using appropriate
gates given the nature of the input states. OR gates are represented
as black dots in Figure 5. Promotion gates were used to combine
fault probabilities with promotion states (upwards pointing triangles). Mitigation gates were similarly applied to combine fault
probabilities with mitigation states (downward pointing triangles).
In addition, repeated threats were illustrated using a special type of
promotion gate illustrated as an upward pointing triangle modified
by an integer number (e.g. promotions P01 and P03).
A repeated fault is a special type of promotion, in which a particular threat occurs more than once over a finite time window. This
particular class of event seems similar in nature to a promotion (increasing severity of a threat), but is in fact better modeled as a combination of a great many independent faults (i.e. using an OR gate).
In the case of P01 (possible collisions with flying objects), an upper
bound of 100 events per hour was estimated, and in the case of P03
(possible collisions with terrain), an upper bound of 10 events per
hour was estimated. As such, for the P01 case, 100 instances of the
same distribution were combined by a sequence of OR operations.
For the P03 case, 10 instances were combined. A standard OR was
used for binary analysis, a fuzzy OR for fuzzy analysis, and a CSL
OR for CSL analysis. The number of repeated instances in each

Table 13.

Baseline Fault Probabilities
Event

Baseline Fault Probability

F01-F04, F07, F09, F11

f = 10−7

F05

f = 9*10−8

F06, F10

f = 10−4

F08

f = 5*10−7

Table 14.

Multilevel Fault Probabilities
Event

None

Min

Maj

Haz

Binary

Fuzzy

CSL

Cat

F01-F11

IEEE A&E SYSTEMS MAGAZINE

-
−2

f *10

−2

f *10

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine March 2017