On the Quest to be Reasonably Informed: Recognition of Risk-Based Design in UAS

On the Quest to be Reasonably Informed: Recognition of Risk-Based Design in UAS

Joshua Vicino
Australian Defence Force

This time last year, in my first gig as a reservist, I had the pleasure of presenting to the 20th Australian International Aerospace Congress (AIAC20) on the topic of the MQ-4C Triton airworthiness program. Specifically, I spoke about how it had been structured in lieu of any formal recognition of the United States (US) Navy as a competent design organisation for Uncrewed Aerial Systems (UAS) or any formal airworthiness certification of the design basis for the Triton system itself.

Don’t worry, I won’t bore you with the details. The #avgeeks can read about it here (Vicino & Joyce, 2023). What the casual reader does need to know, however, is that the chosen approach is extensive, complicated, and labour intensive. Having born witness to the eyeball melting brainpower of some of Australia’s finest airworthiness and certification engineers, I can comfortably tell you that the application of the Triton method to future UAS programs is not scalable or sustainable.

So, my intent for this blog is as follows: (1) address the why and wherefore of the approach to the Triton aviation safety system; (2) make a statement on what it says about Air Force’s ability, as an organisation, to own and operate foreign manufactured ‘Big and Fancy (BAF)’ UAS (the BAF designator draws a clear line between systems like Triton and others, which are equally impressive but smaller scale systems); and (3) outline why it is a problem. I will close by proposing a solution.

The why and wherefore of the Triton aviation safety system

Prima facie, the answer as to why such an extensive approach to Triton initial airworthiness was undertaken is, as it turns out, quite simple. The BAF designation of Triton means that it is operationally prohibitive to lose one in the middle of nowhere, courtesy of otherwise preventable failures. As Marcus Hellyer noted in an article for Strategic Analysis Australia (SAA), the decision to add a fourth Triton to the Australian fleet is ‘likely adding $350 million to some $1 billion spent so far out of a total project budget of $2.777 billion’ (Hellyer, 2023).

The issue of price is compounded by the fact that there will only be four of these exquisite RAAF aircraft, ever. The recent decision by the Biden administration to end the production line after 2024 means that these BAF UAS are now non-replaceable.

In the context (and context is everything here) of an un-certified uncrewed system that operates via satellite communication links, beyond visual range, and above the cruising altitude of commercial aircraft, the solution to the BAF UAS aviation safety problem has heretofore been to mobilise the full weight of Defence’s aviation safety system. Whilst it has been necessary to apply such a method to Triton, in the absence of an alternative framework, replicating this approach for future capabilities is not feasible.

Allow me to explain why.

The Problem

Robust, credible, and defensible as it is, the Triton approach required the generation and sustainment of a completely bespoke compliance framework. This stems from the performance basis of the aircraft and from the UAS design approach wholesale. Whereas crewed platforms are designed against known, recognised, and accepted standards, the nature of UAS, owing to the absence of a person in the air vehicle, does not demand the same level of rigour (risks to other airspace users, critical infrastructure, and the general public notwithstanding). Hence, UAS – in the case of Triton – are produced under a US Navy framework that supports the risk-based tailoring of airworthiness codes to a more cost-effective level.

Though it sounds straightforward, it becomes an immensely challenging problem when overlayed with Defence’s risk management framework. This arises because, without a recognised design certification baseline, manufacturers of BAF UAS (e.g. Northrop Grumman, General Atomics, Boeing, et al.) seek to leverage every aspect to the risk-based tailoring of certification codes that is afforded to them in order to minimise the price point and maximise the utility of their systems. This risk-based approach, which is born out of different risk management philosophies in places like the United States, does not overlay neatly with the Australian framework and context.

As I said before, it is this question of context that is pivotal. Without it, the mapping of one framework to another is impossible. Whereas US based standard practice on System Safety refers to the ‘approach to eliminate hazards, where possible, and minimising risks where those hazards cannot be eliminated’ (US Department of Defence, 2000), the question in terms of what is possible or ‘reasonable’ in the Australian parlance, given the difference in context, yields a very different answer to that of international operators from whom we acquire our systems. The US is but one example of this.

Therefore, when faced with the decision to procure BAF UAS from vendors in places like the US, where the said systems are designed to the risk-based tailoring of recognised standards, Australian operators, in the current environment, have little to no choice in how to manage their aviation safety programs other than to apply the best fit of an un-fit system. But it doesn’t have to be that way. Instead, we - the aviation safety community - need to get smarter about how we address the risk-context duopoly of BAF UAS and aviation safety.

Solution

The DSR told us that ‘Defence’s current approach to capability acquisition is not suitable given our strategic circumstances’ (Department of Defence, 2023, par 12.1). It goes on to assert that ‘[m]echanisms put in place to manage risk in Defence acquisition do not serve us well in the current strategic environment’ (Department of Defence, 2023, par 12.13). If we are to apply this with our BAF UAS, then what we need to establish and implement is a mechanism for assessing the qualification, training, and experience levels of BAF UAS design and production engineers. We also need to establish a basis for how to assure ourselves that the organisational structure and processes in place where these people design, test, and operate, is sufficient for achieving the desired level of safety.

Sound familiar? That’s because it is. It’s an extension of the existing airworthiness recognition framework applied to type certificated platforms. However, instead of measuring design organisations against their ability to produce platforms in line with accepted design codes, we need to understand how their approach to risk management applies in our context and ensure that we put in place the appropriate overheads and measures to meet our own requirements.

We need this because the pace and development of BAF UAS is simply too rapid and too varied in nature to apply wholesale the certification frameworks for crewed platforms. The neatly structured boxes in which crewed platform standards have been built over the course of the last century do not easily apply to the spectrum of UAS design and construction. Therefore, any recognition-based framework for the application of a risk-based tailoring of design standards to BAF UAS must, in much the same way that US Navy design standards apply, allow for categories of UAS, with commensurate demands on the risk-based tailoring applied to a given system.

Our current system, in its requirement for ‘compliance with the Defence Aviation Safety Regulation (DASR) initial and continuing airworthiness requirements only to the extent they make a tangible contribution to the safety of other airspace users, or persons/critical infrastructure on the ground or water’ (Defence Aviation Safety Authority, 2021) presents a green field opportunity for the design and manufacture and UAS at scale. And the best bit is the fact that we don’t even have to do the design and manufacture ourselves, we just have to facilitate buying from people who do. Hence, instead of addressing each system in isolation, the provision of a suitable recognition framework for the application of risk management methods to the design and construction of BAF UAS and their operation in the Australian context is the next logical step in UAS regulatory development.

This approach has additional benefits. Formal recognition in this manner is directly aligned to the Defence 7-step risk management framework, which ensures compliance with the overarching Work Health and Safety Act 2011. Step two of the framework requires that Command be reasonably informed of all risks associated with their systems. This step is foundational to determining the suitability of risk control mechanisms that are to be put in place. Thus, the recognition of designers and manufacturers in their risk-based tailoring of design standards to BAF UAS will significantly reduce operator overheads associated with satisfying the need to be reasonably informed and thus allow the focus to be placed in areas where Australian-based stakeholders can exercise control in the risk management process.

Though I recognise (pun intended) that the resource outlay for achieving this represents a non-trivial start-up cost, it is amongst the more practical investments that we can make in the enabling air power functions for UAS operations. The pace of technological development does not allow for us to sit on the sidelines and wait until the quiescent state of BAF UAS design and development has been achieved. Instead, we need to look at what the next best and simplest option is to safely (as a primary mechanism for the effective generation of capability) deliver the required capabilities.

The effect of doing this will be to enable countless smart people with engineering degrees and the like to produce innovative and outcome-based solutions. It will clearly establish the guidelines for what is required and allow staff on the shop floor to get on with doing it, rather than spend their time pontificating about possible solutions. Our crewed platforms don’t suffer from this paralysis, and we need to remove this hurdle from our un-crewed platforms. As it stands, however, those very staff charged with executing against what would otherwise be a certification program are required to work from first principles to determine how to suitably demonstrate compliance with a nebulous set of airworthiness criteria. Having done this, they must then set about convincing their Chain of Command, most of whom have never worked with such UAS and are required to accept risk in the absence of experience, regulations, advisory circulars or otherwise, that the chosen approach will stack up against the amorphous criteria of So Far as Reasonably Practicable. As such, the entire undertaking acquires the characteristic of defensive engineering, which serves only to increase complexity and decrease capability.

On the contrary, if we don’t do this, then we all but guarantee that the opportunity cost associated with replicating the Triton approach will continue to percolate as a barrier to entry for all manner of game changing UAS capabilities.

Conclusion

The idea of taking the human out of the airborne platform is not new. Yet somehow, we find a way to act like it is. Despite Australian experimentation with uncrewed systems commencing in 1951 with the Jindivik (RAAF A92, RAN N11 GAF Jindivik, n.d.), followed by the Defence’s forward-looking interest in DARPA’s Global Hawk program in the 1990’s, and our immensely successful Heron operations in Afghanistan, Air Force is yet to fully realise the potential of BAF UAS.

Now, in 2024, we have recognised their importance, but it comes with a caveat. Chief of Air Force’s (CAF) comments at Avalon in 2023, whilst asserting the profound impact that uncrewed systems can have on the battlefield, noted specifically the requirement to reduce the price point of UAS to 10% of that of crewed platforms (Greene, 2023). Doing so, it is argued, will allow Air Force to acquire the mass needed for meaningful force generation and projection.

If Air Force is to do this, then the enabling air power function of aviation safety management, which have heretofore been unable to properly grapple with the very banal and yet very essential realities of what these capabilities will look like, needs to catch up. Put simply, if we – Australia – are going to own and operate BAF UAS at anything like the scale and price point that CAF demands, then we need to do things differently.

We are entirely capable. We just need to decide to do it.