Range Safety - One Question, A Million Possibilities

Transcription

1 Range Safety - One Question, A Million Possibilities Rob Baker; Duncan Fletcher; Dr Michael Jokic Defence Science and Technology Organisation (DSTO), Commonwealth of Australia rob.baker@dsto.defence.gov.au; duncan.fletcher@dsto.defence.gov.au; michael.jokic@dsto.defence.gov.au Abstract. Range safety for guided missiles is sometimes considered a black art. What is the probability of a missile suffering a failure during a training flight that will cause it to go AWOL and hit a person, or the wrong building? Traditional approaches to developing range safety templates vary in complexity and thoroughness. DSTO had been reluctant to develop range safety templates for many years, mainly because the ad-hoc nature of methods traditionally used to generate range safety templates are difficult to defend. In 2004 DSTO Weapons Systems Division (WSD) was funded by the Guided Weapons Acquisition Branch of Defence Materiel Organisation (DMO) to develop a tool to generate range safety templates, or Weapon Danger Areas (WDAs) for the ASRAAM air-to-air missile. At the same time, the Royal Australian Air Force (RAAF) were interested in DSTO studying range safety template generation in general; specifically How do we generate more effective safety templates for aerospace air and surface weapons? Test and evaluation firing trials cannot proceed without acceptable WDAs as part of a comprehensive range safety case. DSTO conceived the Range Safety Template Toolkit (RSTT) research and development project to address these needs. The solution has been further developed to cover the JASSM weapon platform and the launch of sounding rockets, as used in the HIFiRE hypersonics research program. The RSTT project has involved: gathering data and models from government and industry sources; adopting an Engineering Management System (EMS) for quality-assured development of modelling and simulation software; a diverse team of DSTO staff, contractors and University academics with a range of experience; multiple programming languages and simulation tools; and the application of portable modelling concepts. In addition to addressing the Australian Defence need, the RSTT project has contributed significantly to WSD activity planning and engineering capabilities and to training and knowledge transfer in its modelling and simulation capability. This paper outlines the story of the research and development of RSTT from concept to realization. 1. INTRODUCTION In the modern age of litigation, governments and defence forces are required to be ever more vigilant when firing their acquired or in-service weapons on ranges, for test or training purposes. The risks of a missile suffering a failure during launch or flight and causing damage, injury or death can be very real. The requirement to generate accurate and defensible range safety templates, also known as weapon danger areas (WDAs) or footprints, poses the daunting question; Where could a missile possibly go if something went wrong? Traditional approaches to developing range safety templates vary in complexity and thoroughness. The Defence Science and Technology Organisation (DSTO) had been reluctant to develop range safety templates for many years, mainly because of the imprecise nature of the ad-hoc methods traditionally used to generate them; a situation driven by practical limitations in computing power. However, in 2004 Weapons Systems Division (WSD) of DSTO began work on the Range Safety Template Toolkit (RSTT) as a result of a request from the Defence Materiel Organisation (DMO) to generate safety templates, now known as WDAs, for the ASRAAM air-to-air missile (Fletcher et al, 2005b). Subsequent requests for range safety support to the JASSM acquisition and HIFiRE hypersonics programs also followed. The decision was made to adhere to strict engineering and scientific processes in the development of a comprehensive template generation system; so that DSTO and the Commonwealth of Australia could confidently claim that it produced accurate and defensible WDAs. 1.1 Brief History of Range Safety Analysis The requirement for WDAs for test and training firings has long been acknowledged. Such WDAs are used by weapon range safety officers to identify the hazardous areas during a firing and ensure that those areas contain no people or critical infrastructure. Determining these hazardous areas has always meant balancing the imperative to keep people safe against the need to maintain a trained, effective military force, and also the need to keep the time and money spent analysing the hazards within practical limits. Traditionally, guided weapon safety templates were supplied by the weapon manufacturer or estimated using manufacturer-stated maximum range of the missile. In many cases, WDAs were accepted with minimal validation, since the engineering and quality control regulations of the time demanded little. The process used to generate some of the WDAs was often considered a black art by members of the range safety community. Estimates

2 based on best estimates, experience and rules-of-thumb were used to formulate rough WDAs around the nominal trajectory or maximum energy estimates were used to produce highly conservative WDAs. With greater complexity in on-board computing on missiles, longer range flights and greater public scrutiny, such methods were not exactly reassuring to those responsible for approving the safety case. The most concerning aspect of this to organizations like DSTO was the foundation of simple, generally untested, assumptions that the WDA generation process was built upon. For example, tradition had it that drawing a three-sigma circle around the nominal impact point was acceptable, where sigma was calculated by varying initial launch conditions by some amount. Such approaches were developed at a time when there was insufficient computing power to challenge the assumptions that underpin them, such as assuming that ground impacts always follow a circular normaldistribution. As increases in computing power made deeper analysis of where the missile might go more practical, such assumptions became increasingly harder to justify. Without a rigorous scientific process, it is difficult to assess the accuracy and credibility of such WDAs. As a scientific and technology organisation, DSTO has been in a good position to take on the problem of reforming range safety analysis, seriously and comprehensively. What was required was sufficient funding to see the ambitious project through to completion, supplied by the ASRAAM and later JASSM stand-off weapon acquisition projects. A proportion of funding also came from the HIFiRE hypersonics research program. DSTO skills in weapons, analysis, software engineering and project management were supplemented by both University and Industry. The former provided specialised applied statistics skills, while the later supplied systems engineering, quality assurance, further project management and further software development skills. This diverse team of around twenty people have worked over four years on RSTT and the guided weapon range safety problem. As with many complex problems left un-tackled for a decade or more, solving it turned out to be harder than first thought. Initial timelines and budget estimates were optimistic. Availability of the data needed to support deep range safety analysis was also over-estimated; original equipment manufacturers (OEMs) do not typically test and derive data for the operation of systems following a failure. In recent years, Australia has attended international range safety conferences to brief on Australia s capability and to draw on other countries capabilities and knowledge. While the United States and United Kingdom are leaders in range safety techniques for unguided munitions, it is evident that Australia is leading the world in range safety for guided weapons. RSTT has generated interest in many international organisations and, apart from providing Australia with an essential capability, it also serves to give Australia a seat at the table in international range safety collaborations. 1.2 What is acceptable risk? Within the international range safety community, the concept of risk and what is the level of acceptable risk are topics of great discussion. The acceptable levels of risk to the general public, military personnel, infrastructure and civilian property are based on the probability of a weapon or debris impact point corresponding to the location of a person or infrastructure. For guided weapons and sparse population demographics in areas such as Woomera, these probabilities are very small. However, are they acceptably low? In addressing this question, DSTO faced one of its greatest challenges. More specifically, the challenge has been to develop RSTT in an environment in which national and international government policies have been either lacking or mutually inconsistent regarding the level of acceptable risk and what methodologies may be employed in risk assessment. While some nations (the United Kingdom for example) have policies that define the acceptable levels of risk to the public and military personnel for trials, Australia is a nation where the guidance is fragmented and mandated legacy methodologies must be used in combination with attempts to employ best engineering practice. The level of acceptable risk is therefore a user-input into the RSTT system, but choosing that level is beyond the scope of the project. What RSTT does achieve in this respect is a capability for the assessment of different levels of risk and risk calculation methods, for trial management purposes. Putting aside the issue of acceptable risk levels, the methods approved to control risk can also be different. The calculation of risk can take the form of expected human casualty estimates, total casualty estimates, probability of impact, probability of boundary-escape, and so on. RSTT is designed to support these methodologies and be flexible enough to evolve with changing policies and accepted practice. In addition, DSTO has intended RSTT to be capable of not only assessing risk to personnel and infrastructure but also to potential sites of environmental and cultural significance. Whichever risk levels, or set of risk levels, are chosen for a particular trial, some evidence-based analysis is required to work out where, given the conditions of the exercise, the unacceptably-dangerous areas of ground are. This is the purpose of the WDA. 1.3 Deterministic or Probabilistic? Traditionally, many WDAs have been generated using deterministic techniques. A Total Energy Area (TEA), also known as a maximum energy boundary, is a kind of WDA that represents the deterministic, worst possible

3 case 1, kinematic capability of the air vehicle. This boundary is usually much larger than the operational range of the weapon. Theoretically, the risk to members of the public outside the calculated area is zero. Probabilistic WDAs are smaller than TEAs, as shown in Figure 2, and are defined as boundaries that have a finite but acceptable level of risk to anyone outside the boundary. Figure 1 shows data that may typically be used in the generation of a probabilistic WDA. Figure 2 compares that same data against an example TEA for the same firing. Figure 1: Example data from Probabilistic Ground Impact simulation ASRAAM model, it was possible to establish conditions that made the missile fly distances much greater than the originally specified maximum range. On three different occasions, a new maximum range was found. This indicates that the true TEA for a missile is difficult to find; for any given TEA there is no way to know if it is the true TEA, and therefore the notion of a deterministic safety boundary is indefensible. The TEA is also impractical for most guided weapons, due to the large distances that even short range weapons can be enticed to fly under arbitrary failure conditions. Large distances mean large TEAs, and these result in extensive and expensive range clearing exercises. TEAs for medium and long range guided weapons do not fit inside Australia s test ranges, even the bigger ranges such as Woomera. By definition of deterministic, the probability of these maximum-range events occurring is not intended to be examined, however experimentation shows them to be many orders of magnitude lower in probability than what is commonly used as a cut-off in both civilian and military risk assessment. Such extensive range clearing is therefore unwarranted. Although they are more time consuming and expensive to generate, evidence-based probabilistic WDAs are smaller, more practical and, more importantly, defensible. 2. RSTT- A COMPLEX BEAST 2.1 What is RSTT? RSTT is a system that provides quantitative risk-hazard analysis of guided weapon launches. RSTT provides range safety officers with quality assured, quantitative estimates of the risk to which the general public, operational personnel, infrastructure and facilities are exposed when important test and training firings occur. Officers use the risk assessment to determine whether a planned firing will put people at unacceptable risk, with options to either adjust the conditions of the firing or relocate people and equipment. Figure 2: Probabilistic vs deterministic boundary Apropos of the traditional approach to range safety, TEAs have two problems; one related to their defensibility, the other related to their practicality. One difficulty is TEAs are not easily established in the first place. On defensibility, the notion that there can be deterministic, black and white maximum kinematic range of a weapon has been discredited. The maximum range found by any TEA generation process is, in reality, limited only by the imagination of the analyst. And without a robust treatment of the probability of the maximum-range events occurring, there is no defensible reason not to select the most extreme range as the basis for the TEA. Through experimentation with the 1 A probabilistic qualification that has not escaped the notice of the authors. Everyone involved in the development of RSTT agrees that the development process was more challenging than initial estimates indicated. Schedules have doubled and many valuable lessons have been learned along the way. RSTT is a complex collection of software tools, processes, hardware and highly accurate 6-Degree of Freedom (DOF) air vehicle models. The expertise required to develop RSTT has been drawn from a diverse team of permanent staff from WSD and contractors with varying levels of experience and subject matter expertise. It has shown the value of both maintaining core weapons expertise in-house and of having specialised expertise in University and Industry available to supplement that core expertise for complex, finite-duration projects. Specific organisations involved in the development of RSTT include DSTO, DMO, the Royal Australian Air Force (RAAF), Aerospace

4 Concepts Pty Ltd, the University of Adelaide Centre for Defence Communications and Information Networking (CDCIN), Daintree Systems Pty Ltd and the KAZ Group. The RSTT development project has been led by DSTO, with engineering oversight from the Aircraft Stores Clearance Engineering Squadron within RAAF. It has involved applied statistics research, missile modelling and simulation, specialised software development, establishment of an endorsed engineering management framework within WSD, liaison with users in RAAF and DMO, systems engineering, data management processes, computing facility expansions, international collaboration and project management. As a complex, research and development (R&D) problem, RSTT development has progressed iteratively. Partial solutions and results from early stages guided more complete solution designs in later stages (Wilson et al, 2008). One key goal of RSTT was to generate probabilistic WDAs with as few simplifying assumptions as possible about the weapon and statistics behaviour. Simplifying assumptions, when made, needed to be justified by analysis of higher fidelity models and data. The other key goal was to produce a quality assured, traceable system (Fletcher et al, 2005b). This would ensure that the Commonwealth, if asked how it knew that the WDA was correct, would have a better answer than well, a bunch of smart people built it. 2.2 Software The software development activities carried out for RSTT have been significant. The three key software segments that make up the core RSTT capability have been in development since December 2004 and are due to be completed by June These software segments all build on a considerable body of modelling and simulation software produced by WSD over many years. Front End RSTT (FERSTT) is the front end interface and processing software that sets up the scenario profile and collates the data from the multi-million Monte- Carlo simulation runs to produce the WDAs. One of the interfaces of FERSTT is shown at Figure 3. Back End RSTT (BERSTT) is the back end software responsible for managing and executing the million-odd high fidelity Monte-Carlo simulation runs needed for each WDA and also other complex, behind-the-scene data preparation calculations. Old McDonald s Farm (OMF) Job Management System (JMS) is the software responsible for distributing the millions of simulations over a computer farm, needed to make executing the massive number of simulations required for each WDA practical. Various programming languages have been used to develop the models and tools that make up RSTT. These include C++ (for the majority of the modelling and underlying code), Simulink, Fortran, Matlab and Ruby. 2.3 Hardware Generating high quality probabilistic WDAs requires solid insight into the ground impact distributions of both whole missile and break-up debris for a range of launch conditions and possible failure modes. With the goal of making as few simplifying assumptions as possible, massive Monte Carlo simulation was chosen as the technique to characterise the ground impact distributions from the known missile behaviour data. Simulating millions of runs of a complex 6DOF model within a reasonable time (generally overnight) requires significant computing power. Hence the RSTT project procured new computing farm hardware and developed software for high-volume parallel execution of the models. Currently, this computing farm consists of 148 servers capable of performing up to 4 million simulations per day. This large-scale parallel computing has been employed Figure 3: Front End RSTT user interface example

5 to allow high-fidelity, simulation-based analysis of specific guided weapon behaviours under both nominal and failed conditions. These simulation outputs are composed into impact-databases to give trial planners unprecedented flexibility and accuracy in designing safe test and training weapon firings. 2.4 Models In order to correctly characterise an air vehicle s flight path under failure conditions such as autopilot malfunction, highly accurate 6DOF modelling is required. A vehicle s nominal trajectory, when the flight goes according to plan, is relatively easy to simulate and reconstruct. The difficult scenarios occur when something goes wrong and the missile ends up on a wayward trajectory. When a failure occurs such as a control surface freezing in position or even breaking off, or the engine fails and the thrust is reduced, the vehicle will react in a particular way. The characteristic vehicle s response to the failure mode is called a failure response mode (FRM). Many different failures may have the same FRM. In order to populate and configure the models to accurately characterize the missile, many different types of technical data were drawn upon. This data includes aerodynamic data, propulsion data, guidance system data and probabilities of occurrence of failure modes for the missile and its many components. One source of data includes data supplied by the manufacturers, which can be frustratingly difficult to obtain if terms for its release are not signed as part the contract in the acquisition process. DSTO in-house modelling and analytical expertise was an invaluable part of the completing the data sets for project, especially where the exact data is not known and estimates need to be made about the effects of a failure on the vehicle s flight. Where the exact values or tolerance are not known for a parameter, a range of possible values may be configured in the Monte-Carlo simulation, to cover the possibilities. Additional ground impact distribution post-processing is done in these cases to ensure that risks are not diluted over wider and wider areas to the point where all areas appear safe. External and on-site contractors played essential roles in the model development and data validation process for the ASRAAM, JASSM and the hypersonic RSTT projects. International relationships with Dstl (Defence Science and Technology Laboratory) in the UK were leveraged to utilise their advanced 6DOF missile modelling capability, developed in collaboration with DSTO over many years. RSTT, both models and software, evolved as more and different capability was required for the different missiles. For example, ASRAAM is a short range air to air missile and JASSM is a long range air to surface missile utilising waypoints. These are fundamentally different behaviours requiring different model features. 3. RE-USING RSTT COMPONENTS RSTT embraced the concepts of portable modelling (Fletcher et al, 2005a). By definition, the portability of a model or model component refers to the ease with which it can be integrated with other models and into simulations. WSD has been involved in developing portable modelling principles for some time (Fletcher et al, 2006), so it was natural that RSTT should follow that standard. The portability concept extends from the models core functionality through interface specification to the general principle of model encapsulation. The same 6DOF model developed for WDA generation can also be used in other simulation environments if required. Of course the 6DOF missile models developed for RSTT include the FRM behaviour and various other functions that are superfluous to most other simulation applications, but the model remains useful for other analysis such as Hardware in the Loop (HWIL). Similarly, an existing 6DOF model developed according to the same portable modelling concepts could be extended to include new features and FRM capability and then used to generate WDAs, without rewriting the entire model. 4. CONCLUSION RSTT has been a successful example of applying principles of software engineering to scientific endeavours. It has demonstrated the power of mature modelling and simulation methodologies and the benefits of a collaborative effort from contractors, DSTO staff and international partners. Addressing long-standing deficiencies in the science of range safety analysis required significant changes in culture and significant investment in R&D. A profitfirst or cost-first approach would not have positioned the ADF to meet both current and future range safety challenges. DSTOs public-service mentality was ideally suited to this project. RSTT is a novel, groundbreaking system that has achieved international recognition and interest in the area of range safety for guided weapons. It is a demonstration of the Department of Defence s commitment to keeping people safe during testing and training operations, both when things go right and when things go wrong. REFERENCES Fletcher, D., Anderson, R., Lauzon, M., Harrison, N., Halsall, G., Everatt, E., et al. (2006). MIST Interface Specification Version 1.0 (No. TR- WPN-7/1-2006). Edinburgh, Australia: TTCP. Fletcher, D., Luckman, L., & Hodson, M. (2005a). "Principles of Simulation Architecture- Independent Model Development". In: SimTecT 2005, Held in Sydney, Australia.

6 Fletcher, D., Wilson, S., Jokic, M., & Vuletich, I. (2005b). "Guided Weapon Safety Template Generation - A Probabilistic Approach". In: SETE 2005, Held in Brisbane, Australia. Wilson, S., Vuletich, I., Fletcher, D., Jokic, M., Brett, M., Boyd, C., et al. (2008). "Guided Weapon Danger Area & Safety Template Generation - A New Capability". In: AIAA Atmospheric Flight Mechanics Conference and Exhibit 2008, Held in Honolulu, Hawaii.