IMFLAR : An Intuitive Method for Logical Avionics Reliability

ABSTRACT: The continued growth of the general aviation fleet demands the need of forever improved preventive methods of failure analysis, in order to reduce the number of incidents or accidents. It has been proved that one possible solution to avoid unsafe conditions is the installation of new avionic systems. This article presents the method named IMFLAR — an Intuitive Method For a Logical Avionics Reliability, an analysis method for avionic systems installations based on a conceptual model of human factors and an artificial neural network application, giving an overview of these installations and analyzing the involved risk factors. This is a new preventive approach that establishes a relationship between unsafe characteristics observed during the installation of avionic systems and an operational database of incidents and accidents, in order to provide a framework to make aviation safer. Additionally, this article describes the steps to obtain the necessary parameters that ought to be used to avoid unsafe conditions for a modification that installs an avionics system in the aircraft.


INTRODUCTION
Nowadays, general aviation is the category that covers the largest number of aircrafts in operation (e.g., business aircraft, charter flight and agricultural).
Aircraft accidents are responsible for innumerous losses, claiming lives and causing large material damages.The Brazilian General Aviation fleet is increasing, and there is a continuous technological advance that implies in crescent risk factors for incidents or accidents.For this reason, it is necessary the use of new prevention methods.These methods must analyze relationships among the triad man-machineenvironment: where man represents human factors; machine symbolizes aircraft, systems and ground/air facilities; and environment is related to climatic and environmental factors.The triad man-machine-environment summarizes some fundamental elements in investigation of aircraft accidents and is the theme of the Centre for Research and Prevention of Aeronautical Accidents of Brazilian Air Force (CENIPA -Centro de Investigação e Prevenção de Acidentes Aeronáuticos).
At present time, electronic systems are employed in aircraft, also known as airborne systems or avionics (term composed by aviation and electronics).Avionics are useful means of preventing unsafe situations.Installing these systems may involve mechanical and structural aspects, such as: installation and affixation of components or antennas on the fuselage and the passage of electrical cable from pressurized to non-pressurized areas; electrical aspects, for example: interference, lightning protection; software; human factors, such as changes in the pilot's panel, alerts, etc.
The main objective of this work was to select parameters that describe the installation of avionics system and the risks involved.With this approach, it is possible to enhance the flight safety, avoiding possible unsafe conditions, and, as consequence, maintenance costs can be reduced, lives and aircraft be saved.A second objective was to classify these parameters through an artificial neural network that graphically displays the data, similar to a risk matrix.
This article is organized as follows: the section "Related works and statistics" presents a literature review of related works.The avionics systems and their installation are described in section "Avionics systems".The section "Mathematical modeling of risk matrix, SCHELL and SOM" discusses models in use, the SCHELL model (acronym of Cultural, Software, Hardware, Environment and Liveware, a model of interfaces defined as follow in this work), presenting a description of a risk matrix and artificial neural network SOM (acronym of Self-Organizing Maps) (Kohonen, 1994).The section "IMFLAR Method" describes the proposed method that employs the concepts previously discussed in a practical application, in order to determine the parameters that can be used in safety analysis of an avionics system installation and in its operational use.Finally, some conclusions and comments on the IMFLAR method are presented in the "Conclusions" section.

RELATED WORKS AND STATISTICS
In order to provide a complete description of the IMFLAR: An Intuitive Method for Logical Avionics Reliability, it is worthy to describe some related works and accidents statistics that presents some concepts employed in IMFLAR method.
As defined by Federal Aviation Administration (FAA) (2010), the term 'Reliability' is […] an expression of dependability and the probability that an item, including an aircraft, engine, propeller, or component, will perform its required function under specified conditions without failure, for a specified period of time".This concept is useful for a complete analysis of avionics systems, their installation and the risks involved.In addition to this analysis, some historical and cultural aspects should be also considered.For example, with respect to the aviation history of the 20 th century, Van der Velde (1995) shows that the quantity of onboard equipment in aircraft is increasing.Regarding the cultural aspect, according to the Brazilian Association of General Aviation (ABAG -Associação Brasileira de Aviação Geral) (2011), in recent years, the General Aviation market has been growing in Brazil and, consequently, the market for avionics systems has been following this trend.This growing market may generate a great demand for avionics installations, which must be properly approved by Brazilian National Agency of Civil Aviation (ANAC -Agência Nacional de Aviação Civil).The growth in the number of installations implies the necessity of more investments in the training of pilots.Additional training is also required for installation and maintenance teams, in order to avoid unsafe conditions in these installations.
In addition to historical and cultural contexts, it is also important to emphasize aspects of flight safety.Regarding prevention and statistics on aircraft accidents, several sources can be consulted.For example, the Aircraft Crashes Record Office (ACRO) collects and records worldwide data of aircraft disasters with more than six passengers, excluding helicopters, sampled a total of 19,980 accidents, where it can be verified the preponderance of human errors over technical failures and environmental conditions (ACRO, 2011).
The National Transportation Safety Board (NTSB) has examined the impact of modern digital display panels (or Glass Cockpit) replacing the conventional analog equipment in general aviation, demonstrating that the employment of this panel configuration is increasing.This study also indicates that aircraft equipped with Glass Cockpit are more susceptible to accidents during instrument flight (NTSB, 2010).The Aircraft Owners and Pilots Association (AOPA) analyzed the historical evolution of the accident rate for General Aviation between 2001 and 2010, and their data show a tendency to decrease the total number of accidents during this period (AOPA, 2010).Despite this decreasing rate, Burin (2011) observes the fact that the CFIT, LOC and ALA types of accidents continue to dominate the statistics for turboprop aircraft.CFIT, LOC and ALA are the acronyms for Controlled Flight Into Terrain -CFIT, Loss of Control -LOC and Approach and Landing Accidents -ALA.They collectively define types of accidents, according to the taxonomy of the CAST/ ICAO Common Taxonomy Team -CICTT.CICTT is a working group composed of members of the International Civil Aviation Organization (ICAO) and the Commercial Aviation Safety Team (CAST), which includes aviation authorities and manufacturers, to develop a common taxonomy and definitions of accidents (ICAO/CAST, 2011).
From these statistics, it can be noticed that the number of accidents in General Aviation has a tendency to decrease, partly due to the adoption of avionics systems.But, with the increasing complexity of systems and information to pilots, in the near future, it will become necessary to increase the safety of the fleet.Under requirements of the aircraft, many avionics systems are introduced to increase flight safety, such as collision avoidance systems with ground, obstacles or aircraft, just to name a few of them.
Among these, this article describes the implications of using TAWS -Terrain Awareness and Warning System -at the prevention and reduction of CFIT accidents in Brazil.The Brazilian Civil Aviation Regulations (RBAC), which are gradually replacing the old Brazilian Aeronautical Regulations (RBHA), are the Brazilian requirements that involve operational aspects and certification, among others.Some requirements related to this work can be considered: the RBAC 21 provides general requirements for certification of aircraft; the RBACs 23, 25, 27 and 29 refer to the certification of airplanes and helicopters; the RBHA 43 and 145 refer to the installation and maintenance of systems; RBAC 26 and 39 refer to continued airworthiness.The main operational requirements are contained in the RBAC/RBHA 91, 119, 121 and 135 depending on the category of the aircraft and its type of operation, but other RBAC/RBHA, as applicable, can be found on the website of the ANAC.
The expression Safety Assessment defines a large field of knowledge, covering flight safety, system analysis, risk analysis, failure prediction, mitigation of unsafe conditions, etc.There is a large variety of Safety Assessment methods, according Everdij et al. (2006).For the Safety Assessment aspects of systems and human factors, there are specific requirements within the RBAC 23, 25, 27 and 29 and their equivalents 14 CFR (Code of Federal Regulations) Part 23, 25, 27 and 29 of FAA: §2x.1301-Function and installation, and §2x.1309 -Equipment, systems, and installations.These requirements should be complemented, as applicable, with requirements that include other aspects, such as: human factors; noise; mechanical analysis; structural; electrical; flightcrew evaluation; airworthiness; operational aspects, etc.The Advisory Circulars (ACs) of the FAA are one of the means of compliance with the requirement 2x.1309 for aircraft Part 23 and Part 25.Other ACs and interpretative materials, such as Policy Files, can also be found at FAA's homepage, and a great amount of documents from other authorities can also be found on the Internet, such as the Transport Canada Civil Aviation (TCCA) and European Aviation Safety Agency (EASA), among others.In particular, companies interested in certification of avionics systems in Brazil should refer to the material available on websites of ANAC, Department of Airworthiness of ANAC (SAR-Superintendência de Aeronavegabilidade), and Aircraft Modification/Supplemental Type Certification of SAR (HST -Homologação Suplementar de Tipo).
In a Safety Assessment analysis, it may also be consulted data from the accident investigation authorities, such as statistics, studies, materials and recommendations of the NTSB and CENIPA, organizations such as ICAO, AOPA, and International Air Transport Association (IATA), standardization organizations such as the Radio Technical Commission for Aeronautics (RTCA), Society of Automotive Engineers (SAE), Military Specifications and Standards (MIL), Aeronautical Radio Inc. (ARINC), manufacturers such as Boeing, Airbus and Embraer, and data from manufacturers' systems and components.
The approach presented herein differs from other Safety Assessment analysis by introducing an Artificial Neural Network to group interfaces in a model based on human factors, namely, the SCHELL model.
The approach presented herein differs from other Safety Assessment analysis by introducing an Artificial Neural Network to group interfaces in a model based on human factors, namely, the SCHELL model.The SCHELL model (Keightley, 2004 apud Perezgonzalez andPerry, 2010) is a model of interfaces based on human factors derived from the SHEL and SHELL models developed by Edwards (1972) and Hawkins (1987).
The SHEL model (Edwards, 1972) uses the concept of interfaces where the human element is surrounded by other elements, and it is an acronym for: Software -which is not part of a physical system, such as aeronautical regulations and requirements, maintenance procedures, manuals, etc.; Hardware -which represents the installation, equipment, components, cables, antennas and accessories; Environment -represents the physical factors, such as environmental conditions, weather, internal and external noise, among others; and Liveware indicates the human element: for example, the pilot that operates the equipment or the maintenance technician.
The other Liveware interface was introduced by Hawkins (1987) in the SHELL model, and it illustrates the interactions of human elements, such as the interaction between members of maintenance/installation groups with the design team.A similar model, the m-SHELL model of Kawano (Itoh et al., 2004apud Kawano 2002) includes the element management; The SCHELL model (Keightley, 2004 apud Perezgonzalez andPerry, 2010) considered the Cultural element -that encloses all elements of human culture, such as management aspects, maintenance and certification cultures of airline companies, and some others cultural aspects.
To categorize these interfaces of the SCHELL model according to the associated risk, the method presented in this work uses parameters' weighting, obtained by an Artificial Neural Network based on Self-Organizing Maps (Kohonen, 1994).The Self-Organizing Maps or SOM are an application of Artificial Neural Network, created by Professor Teuvo Kohonen (1994).Braga (2006) points out that the development of SOM networks was based on the self-organization of the human brain.The SOM networks are self-organized topographic maps of input patterns, where the spatial location of neurons is determined by their degrees of similarity.
Related to these Safety Assessment aspects, the proposed model presents a different approach from the methods cited by Everdij et al. (2006), as it improves the Risk Matrix method through a SOM network, adapted to the SCHELL model interfaces (Keightley, 2004 apud Perezgonzalez andPerry, 2010).

ACCIDENTS, HUMAN FACTORS AND AVIONICS SYSTEMS
Figure 1, known as 1:600 Rule, is the result of a research in the industrial environment in 1969 and illustrates the average percentage ratio between incidents and accidents (Bird andGermain, 1969 apud ICAO, 2005).
Figure 1 shows that small events occur at a greater frequency than accidents and its severity is inversely proportional to the possibility of occurrence.However, a major risk factor is that the majority of incidents are not reported.Thus, small incidents that were not considered can become events that, by their turn, might trigger a serious accident.
Therefore, there is a critical aspect of human factors which includes the manufacture of the avionics system, its installation, operation and maintenance, and that depends on the personnel involved in reporting problems or faults.This is not always efficient.With respect to the human factors involved, safety barriers can be created if critical parameters of the installation of each system are analyzed and procedures to reduce the unsafe conditions are elaborated.

INSTALLATION AND MAINTENANCE OF AVIONICS SYSTEMS THROUGH REPAIR STATIONS, SERVICE CENTERS AND OTHER MAINTENANCE FACILITIES IN BRAZIL
The variety of failures that may occur in the components of avionics equipment, combined with the diversity of aircraft manufacturers and suppliers, may make the categorization of unsafe situations impossible by an analysis method of internal components and their interconnections, for the existing range of avionics systems.
Except for the case of an aircraft repair, the avionics systems installation usually occurs in two ways: through direct incorporation of the aircraft's type design or by major type design change.The avionics incorporated into the project type are made by the manufacturers of the aircraft or under their supervision.However, in Brazil, the most common way to install avionics is through major changes at installer's facilities.Thus, the unsafe factors for avionics systems are closely related, besides the manufacturing, installation and maintenance.The maintenance and installation stations have a vast knowledge of unsafe factors in the field and, in addition to the aircraft's pilots, are the initial point that reports problems to manufacturers.
On one hand, some low complexity aeronautical systems, properly approved, may be developed by Brazilian facilities,  Source: adapted from Bird andGermain, 1969 apud ICAO, 2005.such as: LED lighting systems, power supplies, small control panels and supports etc.On the other hand, when an aeronautical facility are installing an avionics system that was not developed by its own means, this one does not have access to all the design parameters, being unaware of hardware and software details of the system.Consequently, various tests must be performed in a device in order to be certified for aviation usage.
Another relevant factor is the current use of Integrated Modular Avionics (IMA).With IMA, the maintenance of avionics systems is basically performed by modules substitution or by the replacement of the whole equipment, which are then sent (the IMA or complete equipment) to their respective manufacturers.Probably, the Brazilian installers do not have the necessary conditions to execute the kind of repair that is performed by the IMA system manufacturer.Thus, for a case study on maintenance of avionics in Brazil, an emphasis on systems should be adopted, avoiding a deep approach on component failures, because it is likely that most Brazilian facilities will not have access to failures analysis of IMA components.

APPROVAL OF MAJOR MODIFICATIONS TO INSTALL AVIONICS SYSTEMS IN BRAZIL
The PST group -Supplemental Type Program (Grupo PST -Programa Suplementar de Tipo) that belongs to Aeronautical Products Certification Branch (GGCP -Gerência-Geral de Certificação de Produto Aeronáutico) of SAR/ANAC is responsible for major changes certification in Brazilian registered aircraft, including the installation of avionics systems.The PST group has a database of public domain, which lists the major changes certified in Brazil, from where the data used in this work was collected.

TAWS -TERRAIN AWARENESS AND WARNING SYSTEM
For years, Controlled Flight Into or Toward Terrain (CFIT) category of accidents, dominated the global statistics of accidents.As defined by the ICAO/CAST (2011), CFIT is a collision in flight or near collision with terrain, water or obstacle without indication of loss of control.Figure 2 shows the causes of CFIT for General Aviation in Brazil, between 1999 and2008, according to CENIPA.Following the recommendations of ICAO for CFIT prevention, Brazilian regulations RBAC/RBHA 91, 135 and 121 establish requirements for the installation of Ground Proximity Warning System (GPWS) in the aircraft.
An enhanced version of the GPWS System is called Terrain Awareness and Warning System (TAWS), which uses geo-location systems like Global Navigation Satellite System (GNSS) and databases that include terrain and a large amount of man-made obstacles to generate alarms and alerts.The installation of TAWS and GPWS has contributed to a substantial reduction in the number of CFIT accidents.
There are two classes of TAWS systems: class A TAWS, which has interconnection with a display, radio altimeter and/or air data computer, and class B TAWS, where the interconnection with a display is not mandatory.Figure 3 illustrates a typical class A TAWS system, with some of its main common components, such as altimetry and positioning inputs, data processor, display and visual and aural alerts.
From direct observation of the data presented in the public database of modifications, the PST group analyzed data of the certification processes during the year 2009 and concluded that the TAWS/GNSS installations accounted for about 50% of the total number of modifications corresponding to approximately 80% of the cases of major changes in electrical and electronic systems, presented to be certified by ANAC.Due to these characteristics, it has been gathered a significant quantity of risk factors for this type of system.
In addition to this analysis, samples of processes for installations of TAWS/GNSS systems were collected from two base years: Source: ICA 3-2.CENIPA, 2009 (adapted) installation and maintenance facilities; and a maturation phase with some degree of experience of applicants and maintenance facilities.Furthermore, in these years, other researches were conducted, such as the observations on the meteorological adverse conditions.Although the years between 2005 and 2009 could also provide sample data, these data were not measured with all the examined characteristics, therefore they were not included in this analysis.Consequently, the application of the proposed method observe only the sampled data of 2005 and 2009, as it was the initial objective of this research, that is to verify the processes in relation to risk factors, climatic factors, the systems involved and the quantity of these systems.The main risk factors detected for TAWS/GNSS systems are listed in Table 3.

PRINCIPLES OF RISK ANALYSIS AND RISK MATRIX
According to Greenwell and Knight (2003), the risk can be defined as the probability of an event to occur, multiplied by the anticipated cost derived from the occurrence of the event.Equation 1 models the total risk based on this definition.In this work, the cost is considered equivalent to an indirect measure of severity (consequence) of an accident.

R=P•C
(1) where R = total risk; P = probability; C = (cost) = severity.Basically, two criteria classify a risk: the likelihood and the severity.A risk matrix is a graphic arrangement of the risk.The origin of the risk matrix comes from the definitions contained in MIL-STD-882D (Department of Defense -DOD, 2000).Consequently, the risk matrix is a combination of likelihood and severity in order to classify the different levels of risk.Figure 4 illustrates an example of risk matrix.
The Risk Matrix is usually employed in civil and military applications, because it is an easy method used in risk management; but this method has some inherent limitations, as identified by Cox (2008).These are: low resolution, error induction, inefficient reallocation of resources based on the categories provided in the matrix, and ambiguity of inputs and outputs.

APPLICATION OF THE SCHELL MODEL INTERFACES
As seen in Fig. 2, the influence of human factors is preponderant over the other CFIT factors.Due to this, the SCHELL method for human factors was adapted for the IMFLAR method in order to analyze influence of human factors during the certification process.These influences are employed as IMFLAR input parameters into a reliability model for the analysis of the involved risk in an avionics system installation during a certain period of time.
As previously described in this work, the preliminary SHEL model (Edwards, 1972), which was developed to analyze the human factors interfaces, was modified to include other additional interfaces.Itoh et al. (2004) use the concept of m-SHEL model from Kawano (Itoh et al., 2004apud Kawano, 2002) in a table format, grouping the interfaces in pairs.A practical application of this format, adapted from the work of Itoh et al. (2004), is presented in the item 3 -"SCHELL indexes block" of section "IMFLAR Method", where the interfaces used are: LC -cultural interface; LS -software interface; LH -hardware interface; LE -environmental interface; LL -interface of human relationships; L -the human element itself, such as the pilot, the certification expert, or the maintenance technician.

SOM -SELF-ORGANIZING MAPS
A Self-Organizing Map, also known as SOM neural network, consists of just a few to even thousands of artificial  neurons organized in a grid, or lattice, usually bi-dimensional.
For a competitive process of learning, the winning neurons are organized in a topographic map, as in the areas of the human brain.This map is a statistical arrangement in terms of the inputs (Castro and Castro, 2001).
The mathematical definition of SOM requires the definition of Euclidean vector.For an input signal x(t) as Euclidean vector of d dimension (Kohonen and Honkela, 2007) is defined according to Eq. 2: (2) where: x(t) = Euclidean input vector, consisting of d input signals; t = data index in a sequence; ξ(t) = input signals; d = dimension, or quantity of input signals.
Each neuron of the SOM network is represented by a weight vector, according to Eq. 3: where: m=d-dimensional weight vector; d is the dimension of the input vector.
The neurons of the network represent the input vectors in the best possible way.Each input vector is presented to all neurons of the network and the "winner" is the one with the closest weight, i.e., the neuron with more similarities to the input vector in question.In this work, the Euclidean distance is used to determine the "degree of similarity" between the input vector and weights of the neurons.The "winner" neuron c for an input vector x is the one that has its weight value m with the smallest Euclidean distance to the input vector x.The winner neuron is also called the Best Match Unit (BMU), around which the closer neurons are organized.The organization of neurons is a process of smoothing by similarity, defined by the function called Nc -neighborhood of the winner.After finding the BMU, the network is updated by an iterative process (adapted from Laurino, 2004;Kohonen and Honkela, 2007).
According to Reyes-Aldasoro (1998), the process of neurons self-organization (called nodes of the grid) on a SOM network can be described in two steps: combination of inputs and neurons; and updating around winning neurons.These processes are modeled by Eq. 4 and Eq.5: Combination: where, for a time t: x = input; m i = any node; m c = winner neuron; α = sequence of gain; and N c = neighborhood of the winner neuron (in this work, N c is defined internally in the software utilized).
Each neuron is connected to adjacent neurons by the neighborhood relation N c , which determines the topology of the SOM map.The topology has two attributes: structure and shape (Vesanto et al., 2000).Figure 5 shows the structure and shape for the SOM network used in this work.
Grouped neurons can also be presented in other graphic format, known as U-matrix (Vesanto et al., 2000apud Francisco, 2004).A U-matrix shows, through the colored units of the map, the distances between clusters.The colors of a U-matrix vary according to a distance scale, from dark blue to red, where the dark blue color represents the 66 nearest cells (neurons), or groups.The lighter colors to red represent the separation of the clusters (according to Vesanto et al., 2000apud Francisco, 2004).Figure 6 shows an example of a U-matrix, applying the data to be presented in this work to a SOM network through the tool SOM_TOOLBOX_2, for MATLAB ® .This toolbox is shortly described in step 4 of IMFLAR.

IMFLAR DESCRIPTION
IMFLAR: An Intuitive Method for Logical Avionics Reliability is a method that organizes data from the PST public database, combining them with CFIT accidents statistical data, taking into account the interfaces from the SCHELL model.These weighted data are grouped by a SOM neural network that organizes them into risk groups.These groups and the organized SCHELL data are then used for the development of a simulation model in Simulink/ MATLAB ® .This reliability model of can predict a situation of increased risk based solely on the data presented, modeling human factors, environmental and machine involved with the installation of the avionics system under analysis.
The IMFLAR overcomes each of the limitations of Risk Matrix, due to the flexibility of the SOM neural network employed and its presentation in graphical format.
As an application of the proposed method, the installations of TAWS avionics in Brazil are analyzed through a Safety Assessment analysis.This proposed analysis exemplifies the relationship between a statistical data from an accidents category (CFIT) and the installation of an avionics system that prevents this kind of accident.
An alteration of risk, during the operational life of the aircraft, with the modification that installs the avionics system under analysis can be simulated by a variation of a source block parameters in the model in the Simulink/MATLAB ® presented.Thus, the IMFLAR method can simulate the risk variation during the course of the years for an avionics system.An application of this simulation can be the creation of an alternative solution to generate other maintenance tasks for the system under analysis.
The following subsections present: the steps that show how to acquire data for the IMFLAR; and the procedures for the elaboration of a simulation model on Simulink/MATLAB ® .

STEPS OF IMFLAR -ACQUIRING DATA
Figure 7 shows a block diagram that describes the necessary steps to implement the proposed method.Each block is described by its input, processing of data by the block, and its output.
Step 1 -the block of contributing factors for accidents • Input item: equivalent to the statistical causes of real accidents related to the conditions of use of the certified system.This paper uses the statistical data of the major causes of CFIT in General Aviation -1999 to 2008, according to the CENIPA data records (CENIPA, 2009).• Data processing item: these statistics of the CFIT causes are scaled by the percentage of occurrence, according to Table 1, resulting in five risk levels (named E -Exposure).
The scaling reproduces the way levels of the risk matrix are elaborated.The proposed scaling is just an example and other subdivisions are also possible.However, for a smaller number of divisions, the method tends to be less accurate, and for the higher number of subdivisions, the number of parameters to be analyzed tends to be greater.The Level or Amplitude is defined as the amount, in percentage, of installations involved with the risk factors, and the Exposure means the exposure to risk.Table 1 shows the relationship between the Exposure (E) and the Level or Amplitude (A).Indexes A and E are determined by the application of Table 1 to the 11 contributing factors determined by the CENIPA, according to Fig. 2. For example, for the first contributing factor <Judgment (jud)>, corresponding to the Level or Amplitude A=69.2%, then 26% <A ≤80%, which corresponds, according to Table 1, to an Exposure E=4.• Output item: as output of this block, the initial four columns of Table 2 enumerate and present the 11 contributing factors described by the CENIPA, and show the respective indexes A and E for these factors, which are the inputs to the SCHELL indexes block, described by the other columns of Table 2.The SCHELL indexes block is presented in step 3.
Step 2 -the risk factors block The IMFLAR introduces a new concept in the certification of an aeronautical system: generic unsafe conditions, observed during the certification process of major change that installs this system, are considered as parameters to be analyzed, which may cause future risk events, after installation and during the operation of this system.• Input item: inputs of this block are the unsafe conditions, obtained from a sample of certification procedures relating base years of 2005 and 2009, for the TAWS system.The TAWS system was chosen because of the greater amount of processes for modifying aircraft relative to other systems.It was observed in the initial introduction of this system in Brazil ( 2005) and in a more advanced stage ( 2009), corresponding to a period in which the applicants for modification processes achieved a stage of maturation of the presented projects.
The main risk factors detected for TAWS/GNSS systems are presented according to Table 3. • Data processing item: the same scaling process adopted for the block of contributing factors for accidents.For example, if the training factor corresponded to a Level A=100% of affected processes in the base year of 2005, this implies an Exposure E=5.• Output item: Table 4 presents the indexes A and E for risk factors as inputs to the SCHELL indexes block.As the output of this block, the initial three columns of Table 4 enumerate the 11 contributing factors, as described by the CENIPA as f m (m = 1-11) and present the indexes A and E for these factors, which are inputs to the SCHELL indexes block, described by the other columns of Table 2.
The SCHELL indexes block is presented below.
Step 3 -The SCHELL indexes block • Inputs items: are the outputs of the previous two blocks, namely, contributing factors for accidents and risk factors, corresponding to the Exposure E in Tables 2 and 4. • Data processing item: as observed on the CENIPA statistics and in other studies of accidents, the influence of human factors is predominant over other risk factors of an accident.Therefore, the exposures E of Tables 2 and 4 are combined by the SCHELL method of interfaces based on human factors.For this work, these interfaces are named SCHELL indexes.
The presentation of the interfaces, in table format, uses a concept similar to m-SHEL model of Kawano (2002) adapted from SCHELL model.This model works, therefore, with six interfaces: LC, LS, LH, LS, LL, L, where L is the first influence of the human factor (pilot).The other factors of these interfaces are: LC -human /cultural interface, for example, supervision (air traffic control) or training; LS -human/ procedure interface, for example, planning; LH -man/machine interface, for example, the application of controls; LE -human/ environment interface, for example, environmental conditions; LL -man/man interface, for example, interaction between pilots; L -man, that is, the pilot and his own condition, for example, lack of experience of the pilot in the aircraft.These indexes are weighted as follows: Table 1.Relationship between Exposure (E) and Level or Range (A).(A) Each of the contributing factors of accidents in Table 2 is analyzed.For example, the factor n 1 Judgment (Jud), E=4.For each factor, only one SCHELL index is chosen as predominant to avoid problems with the possible ambiguity of data in order to make the neural network grouping of data in a more efficient way.For the Jud factor, the L index was chosen.Then, the same value of E for L is assigned, therefore, L=4.For other factors, the weight is zero, so LC=LS=LH=LE=LL=0.In this case, the same analysis is also repeated for the other factors.
(B) Similarly, each risk factor in Table 4 is analyzed.For example, for the factor f1 Weather of 2005, E=1.For the Jud Factor, the LE index was chosen.Then, the same value of E is assigned to LE, therefore LE=1.The weight of other factors are set to zero, i.e., LC=LS=LH=LL=L=0.In this case, the same analysis is also repeated for the other factors.
(C) The predominant indexes in Table 2 are multiplied by the predominant indexes of Table 4, as shown in Fig. 8, in order to obtain Table 5.
(D) For Table 5 preparation, according to the previous procedure, ten auxiliary tables are generated (five tables for five risk factors in 2005, and five tables for five risk factors in 2009).Each table has 11 rows, referring to the contributing factors, and 6 columns, related to SCHELL indexes, totalizing 66 elements.Most of the rows of the auxiliary tables contain only zeros, and only the 24 remaining lines contain significant elements that were grouped in Table 5.
• Output item: the output of the SCHELL indexes block is composed of the significant factors that are presented to the neural network SOM of the artificial neural network block.After the development of Table 5, it is verified that only 24 factors are considered significant.These significant factors, in a practical approach, represent the Vulnerability of the system.Vulnerability is defined, in this paper, as a potential factor in exposing the analyzed system to the risk of an aircraft incident or accident.Therefore, the function of the SCHELL indexes block is similar to a Vulnerability detector, according to this definition. 1 -Weather factor: indicates the percentage of processes that were, somehow, affected in the base year due to meteorological conditions.These data were obtained, indirectly, from the public database of processes of the PST, through the records of cancellations of inspections/tests and comparison with the weather on the date/place of inspection/test. 2 -Antenna factor: indicates the percentage of processes that were, somehow, structurally affected due to the installation of antennas in pressurized aircraft.These data were obtained, indirectly, from the public database of processes of the PST, through the records of processes of the prototype aircraft, which were pressurized.
3 -Processor factor: indicates the quantity per unit of TAWS equipment for each system affected by software update ("load").These data were obtained directly from the quantity of TAWS equipment to be installed in the process, which is affected by the software update ("load"), per manufacturer's service bulletin.4 -Display factor: indicates the quantity per unit of TAWS equipment for each system affected by the presentation of erroneous data.These data were obtained directly from the quantity of TAWS equipment to be installed in the process, which is affected by the manufacturer's service bulletin that corrects this erroneous data.5 -Training factor: measures the variation of the learning curve regarding to the installation/operation of the system.This factor was obtained indirectly by the number of meetings proposed by the modification process applicants, where it was observed that the value of the number of meetings (f5) decreased, in absolute value, inversely proportional to the elapsed time   Step 4 -artificial neural network block • Input item: inputs of this block are the significant factors yielded from SCHELL indexes block output and correspond to the input data of the SOM neural network.• Data processing item: in this block, the SOM tool was applied, a neural network which classifies significant factors.For this, the SOM_TOOLBOX_2 was used.This toolbox was created by the Laboratory of Computer and Information Science (CIS) of Helsinki University of Technology for MATLAB ® .The SOM_TOOLBOX_2 groups and sorts the data into a graphical format, denominated Self-Organizing Map (SOM).This toolbox consists of a series of mathematical functions and graphs, which are elaborated using the MATLAB ® functions.The SOM_TOOLBOX_2 has some specific program instructions for data collection, training the network and displaying the data.
(A) The input function item: the reading of signals is performed by the instruction "som_read_data".This function recognizes only files with extension ".data" created by the program SOM_PACK (also developed by Helsinki University of Technology), written in C language, which has no compiler for the Windows ® platform.Thus, for use in the MATLAB ® running under the Windows ® , the input data must be converted to a text file in ASCII format, as shown in Fig. 9: (B) The combination and update functions item: once data is acquired, the SOM network is created, initialized and trained by the command "som_make" which performs combination and update functions.
(C) The output function item: data grouped by the SOM are displayed through the "som_show" function in various graphical presentations, for example, by U-matrix or cellular maps, as shown in Fig. 10.
• Output item: the output of this block is the data presented in map format by the function "som_show."Data in Table 5 are grouped by the SOM tool, as shown in Fig. 10.This Figure also shows the corresponding U-matrix.Significant factors are, thus, grouped and mapped by the SOM neural network and these groups are named, in this work, as safety parameters.Therefore, the safety parameters are the critical design points that can imply in failures of the system under study and, in practice, are equivalent to the grouping of the system's Vulnerabilities.The 24 parameters in Table 5 are 4) met = contributing factor to CFIT "n5" -Adverse meteorological conditions (refer to Table 2) Silva, N. and Trabasso, L.G.
Step 5 -the safety parameters • Input item: data grouped by SOM neural network.
• Data processing and output item: significant factors grouped by neural network are organized in Table 6.This grouping is essential to an engineering analysis of these parameters, because the significant factors are grouped into common areas.At the same time, the study by areas decreases the number of parameters to be examined.This reduces the cost of man-hour analysis of which parameters significantly affect project's safety.
The procedures for elaboration of simulation model on Simulink/MATLAB ® 1.The determination of the risk variation per time Figure 11 shows pairs of significant factors from Table 5 used as the boundaries of variation of the involved risk.This risk represents the workload for pilot, actions for operational/ certification team from aviation authority, verifications for continuous airworthiness and periodic maintenance tasks, or other parameters to be investigated as appropriate.
Each IMFLAR Group B, P, O, C and E is representative of the involved risk for the analyzed system (GPS/TAWS).The risk is composed by the sum of parcels of IMFLAR Group elements and each IMFLAR Group adds a combination of the Eq. 6 and Eq. 7 as applicable.These equations are fitting the values of the T, in order to combine them with the maximum values of each significant factor from Table 5.
where: T = time variation; a n ; b n ; c n; and d n = adjustable values, in order to fit the equation with the extremes values of significant factors from the Table 5; and u n , v n = risk variation per time (u n and v n are different functions which variations are related with the IMFLAR Group as demonstrated as follow).
The values of (T 7 , u 7 ) 2005 and (T 7 , u 7 ) 2009 are used to solve the equation u 7 =a 7 T+b 7 , in order to obtain the values of a 7 and b 7.
The variable T shows the behavior of involved risk (represented by IMFLAR Groups) per elapsed time.Thus, the involved risk has three different functions per time   3 and, for this case, the Eq. 6 is fitted by Eq. 8.This represents the "man" interactions or "human factors" influence.(B) For the IMFLAR Group C the involved risk are rising with time (this is an accumulative risk which represents the software loads, deterioration of components and others aspects related to the maintenance and continuous airworthiness of system).This function was considered linear for an initial approach.This represents the "machine" factor.
(C) For IMFLAR Group E, the acquired values of met=2*env (constants for the collected data) are replaced by the average curve (f1=-0.548t+45.84)that represents the "seasonal variability of rainfall in the São José dos Campos airport fields between the years 1982 and 2009", according Corrêa et al. (2010).The site of São José dos Campos was elected because it represents the local were the most certification tests were performed for GPS/TAWS systems related to this research.The function f1 were divided by 100.This is necessary for adjusting the magnitude of the variables to a reasonable value of IMFLAR Group E. This represents the "environment" factor.
The same procedure for calculation of a n and b n for u 7 can be utilized for the determination of other u n and v n values.These calculations are summarized in Tables 7 and 8.   8 and the elements of this model are on Tables 2 to 8.This model translates the representation of IMFLAR parameters to a functional block diagram in order to simulate and foresee the variation of risk per time, including a separated analysis for "human factors", "machine" and "environment" influences as previously explained.

The elaboration of the
Figure 13 presents a graphical representation of IMFLAR Groups variations and the resulting risk R for the IMFLAR.

CONCLUSIONS
The growing of the General Aviation fleet and the development of new avionics systems demand needs to increase flight safety, which is aeronautical authorities' responsibility in partnership with manufacturers, maintenance teams and other aviation professionals.To do this, it may be necessary to develop other Safety Assessment methods using more adequate approaches to new patterns.Thus, an artificial neural network can be a viable alternative, since its effectiveness is appropriately certified.
The proposed IMFLAR, on the SOM artificial neural networks, enables simulating logical decisions and groupings, similar to the human brain.The grouping of unsafe parameters turns the application of this presented method into a practical tool for an avionics system installation project.The grouping of these parameters is also one of the main advantages of the proposed method over other project methods, mainly because the safety parameters grouped by SOM are general and do not have a direct relation to unsafe conditions for any specific equipment from any manufacturer, but these parameters relate common failures of any functionality.Thus, it can be used to verify the vulnerabilities of a functionality, such as TAWS, which can be commercially supplied by various equipment, or may be present in future systems to be designed.Thus, this method can also be predictive and may be used to foresee safety parameters, vulnerable areas of functionalities in future systems or simulate an unsafe operational condition as described in this work.Likewise, on any computational method used for Safety Assessment, an engineering analysis of the data grouped by SOM is necessary, in order to avoid errors.However, as described in this article, the application of this method is simple, the graphical grouping is easy to understand, and the presented results allows one to conclude that this method can be employed, not only as a Safety Assessment tool, but as an application for a predictive design where unsafe conditions are described by equations that are translated into the blocks of the simulation model and any safety parameters variation can be tested.
Finally, the proposed IMFLAR can be considered an upgrade of other established methods, such as the Risk Matrix and the SCHELL model, overcoming some limitations of these methods and proposing new approaches to Safety Assessment and predictive design, showing potential of using this method for aeronautical applications and other engineering areas.
Figure 2. Contributing Factors in General Aviation -CFIT.
(t) according to: f5 ≅ a | t -1 | where: f5 = number of meetings per year ≅ need of annual training; α = index for units comparison -where, to the research data: α = α [s.(units / year)]; t = elapsed time (it was considered an average time of four years between the second half of 2005 and the first half of 2009).

Factor
number (m=1 to 5); A = Level; E = Exposure; LC, LS, LH, LE, LL and L = SCHELL indexes IMFLAR: An Intuitive Method for Logical Avionics Reliability designed as the example below: 5f1met = Relationship between the risk factor (f1) from 2005 and contributing factor n5 5 = base year of data collection (2005) f1 = risk factor Weather (refer to Table

Figure 9 .Figure 11 .
Figure 9. Example of SCHELL significant factors (P1 to Pn, n=1 to 24) for the analysis of the SOM network.

Figure 12
Figure12presents a Simulink/MATLAB ® model that represents the elements of Tables 2 to 8 for the IMFLAR.The equations that model the blocks are on Table8and the elements of this model are on Tables2 to 8.This model translates the representation of IMFLAR parameters to a functional block diagram in order to simulate and foresee the variation of risk per time, including a separated analysis for "human factors", "machine" and "environment" influences as previously explained.Figure13presents a graphical representation of IMFLAR Groups variations and the resulting risk R for the IMFLAR.
Figure14represents the behavior of R related to a variation (step) on the O group signal.This variation is implemented by the block arrangement illustrated in Figure14and it might characterize an operational change.An example of this change could be the introduction of new rules for aviation in order to comply with the phases for Performance-Based Navigation (PBN) implementation in Brazil.This is a versatility example of the proposed IMFLAR.

Table 3 .
Survey of risk factors for TAWS Systems in 2005 and 2009.Data were obtained from two base years: 2005 with 313 cases sampled, and 2009 with 378 cases sampled, with the analysis of the following aspects:

Table 4 .
Risk factors and SCHELL indexes.

Table 6 .
Safety parameters and IMFLAR groups.