Safety Planning in C-17 Airdrop Flight Testing
This 2010 article introduced techniques not previously used in test safety planning. The author applied the techniques for C-17A aerial delivery flight testing on NASA projects Orion crew entry vehicle parachute assembly system (CPAS) and the Ares jumbo drop test vehicle (JDTV). This paper included a description of the test build-up and the results of recent airdrop testing (circa 2010). In addition, the paper presented proposed envelope expansion of the aerial delivery capability, including test challenges and safety planning. Of particular note is a description of the modeling and simulation used to support test readiness and contingency planning. Approved for public release; distribution is unlimited: AFFTC-PA №10150.
Introduction
In July 2008, NASA and the Air Force Flight Test Center (AFFTC) began airdrop flight testing of the Orion crew entry vehicle parachute assembly system (CPAS)and the Ares jumbo drop test vehicle (JDTV) in order to prove the design of the parachute recovery systems of both of these space vehicles. For the C-17A, the planned culmination of these tests was a high-altitude airdrop of a 90,000-pound JDTV. This represented an envelope expansion solely for flight-test purposes of 50 percent greater than the current operational airdrop envelope. The following material is a brief summary of this testing, focusing on the test build-up and the modeling and simulation used for safety planning, risk mitigation, and pilot preparation.
Background
NASA posted background information and several videos of these test airdrops at http://www.nasa.gov/ares/ and http://www.nasa.gov/mission_pages/constellation/. This includes a video fo the first airdrop test of the Orion CPAS here: http://www.nasa.gov/mission_pages/constellation/orion/pa_chute_test.html. (Note: This link does not always function, but the reader may search the Internet for “NASA Orion Parachute Test fail” and find links suitable for viewing the video in its entirety.
Orion CPAS Airdrop Test
NASA developed the Orion crew entry vehicle parachute assembly system (CPAS) to test the Orion recovery parachutes and mated the test article with a standard airdrop platform for drogue extraction from the C-17A. In this method of aerial delivery, a small drogue parachute stabilized behind the C-17A and was used to deploy an extraction parachute. The extraction parachute generated approximately 30,000 pounds of drag at 145 KCAS. This force pulled the airdrop platforms over rollers on the cargo floor and out the back of the aircraft.
Following extraction, the CPAS would separate from the platform, which would be recovered under a separate parachute system. This illustration shows the Orion CPAS test sequence after extraction from the aircraft. The test articles separates from the platform and begins free fall. A sequence of drogue chutes stabilize the test article and initiate the recovery parachute deployment. Unfortunately, the first Orion airdrop test did not go as planned, as seen below. The parachute system under test developed a streamer, and the drop test vehicle began to oscillate, which caused additional malfunctions during subsequent parachute deployments.
The end result was a catastrophic landing. It was somewhat surprising that in an age of supercomputers, high-fidelity models, and computational fluid dynamics, we could have such a result, but as we will see, humans have a difficult time interpreting “predictions” along with the outcomes of models and simulations. (The program has since completed its testing successfully.)
Ares JDTV Airdrop Test
NASA developed the Ares jumbo drop test vehicle (JDTV) to test the Ares recovery parachutes and mated the test article with a standard airdrop platform for drogue extraction from the C-17A (see title image above).
As previously stated, in this method of aerial delivery, a small drogue parachute stabilized behind the C-17A and was used to deploy an extraction parachute. However, for Ares tests, the extraction parachute generated a 1g extraction by creating drag equal to the weight of the test platform at 145 KCAS. This force pulled the airdrop platforms over rollers on the cargo floor and out the back of the aircraft. The Ares is very similar to the solid rocket booster once used to boost the space shuttle into orbit. The JDTV was rigged with the system under test (the recovery parachutes), and then the JDTV was ballasted to the weight specified for the test point. NASA and the AFFTC accomplished several build-up Ares flight tests, as shown in the table. (In 2010, when I first published this report, three test points remained, as seen in the table.)
These tests included parachute tow tests demonstrating the design of the Vectran extraction line package; 40,000- and 60,000-pound airdrops of the JDTV. For airdrop, the flight manual maximum allowable single platform weight was 60,000 pounds. This restriction was the result of several factors but primarily because of the types of parachutes and types of rigging procedures and materials. During the 60,000-pound airdrop, one of the two extraction chutes failed to inflate, resulting in a slower extraction rate. Improvements to the extraction rigging, based on analysis of high-speed chase video, resulted in a successful parachute tow test of the modified extraction package. The 72,000-pound drop was highly successful for both the JDTV and the aircraft, with nominal release, extraction, and aircraft dynamics, a stepping stone to build-up efforts (for the aircraft) at 78,000 and 85,000 pounds and the ultimate 90,000-pound airdrop test.
Modeling and Simulation for Safety Planning
Modeling and simulation were used extensively in the expansion of the airdrop operating envelope in several areas, including loads and flying qualities, but the focus of this summary is on the aircraft dynamics and contingency actions in the event of malfunctions or unusual test events. As you can imagine, when a platform that weighs more than 70,000 pounds rolls from the front to the back of the cargo compartment, the result is a significant change in the aircraft center of gravity and a dynamic aircraft response. Accurate predictions about the attitude changes enable the pilot to anticipate or diagnose developing contingencies and predict recovery actions.
From the moment the airdrop load is released at “green light” to the point at which level, unaccelerated flight conditions are regained after extraction, there are two possible scenarios (nominal or contingency) in each of three phases: release, extraction, and recovery. In the nominal case, both simulation and flight test data confirm that each of these phases requires only minor modifications from operationally representative procedures by any test aircrew member.
Release Phase
In the release phase, the primary test hazard is a platform that fails to release, whether as a result of parachute failure or any other malfunctions. If the extraction chutes do not deploy correctly or open in a reasonable amount of time, the loadmaster would declare a malfunction and immediately lock the platform to prevent it from moving during contingency actions.
One of the worst possible scenarios could occur if, after the platform was locked in place, parachutes that had only partially opened suddenly inflated. In this situation, the parachutes being towed by the aircraft could generate drag force equal to the weight of the platform, a situation that would considerably alter the handling qualities of the aircraft. It is unlikely that full chute deployment would not extract the platform. What is more likely is that the chutes would not develop fully and thus would not generate sufficient force to extract the platform. This scenario would cause far less drag.
This situation would be further exacerbated by the need to cut the extraction line in a timely manner. Two possibilities exist: 1) continuing to fly the aircraft straight ahead and thus exiting the test range protected airspace into a very crowded airway, giving time for the loadmaster to cutt away parachutes where they might cause a significant in-flight hazard to other aircraft, or 2) maneuvering (180-degree turn) an aircraft with decreased performance, due to the drag of the parachutes, within the test range to cut away the chutes in sanitized airspace.
Extraction Phase
During the extraction phase, the platform is in the process of rolling along the floor and eventually exiting the aircraft. Possible contingencies for this phase include various failures of the extraction chutes, which would result in a gravity drop of the platform. We will call this a “slow roller.” This hazard would result in unexpected pitch change caused by a slower than nominal extraction. In fact, the corrective action calls for allowing the deck angle to increase, to a given limit, to effect the gravity extraction of the platform. This could result in a rapid decrease in airspeed if this deck angle were maintained, especially when we consider that the aircraft already would be at a high thrust setting to maintain level flight and would not have much excess thrust.
Recovery Phase
This brings us to the final phase, in which the aircraft is returned to level, unaccelerated flight from the high deck angle and potentially high pitch rate that would have occurred during the extraction phase.
Each of these phases was rehearsed in high-fidelity C-17A simulators, which brings us to the problem at hand: How do we model non-standard extraction parachutes, non-standard airdrop platform weights, and non-standard rates of extraction? What about the countless permutations of partial failure states where, for example, only one parachute fails or several parachutes only partially inflate? Additionally, how we do simulate the increased drag caused by towed parachutes? Finally, what is the best method of recovery from an unknown flight attitude?
Furthermore, the extraction parachutes and airdrop platform size and weight used for the test were not operationally representative and were not included in the simulator model. This could result in extraction rates that do not represent test conditions, yet the rate of extraction is a major factor in pitch attitude and rate change.
Conclusion
What level of statistical confidence, if any, do we have in the results from the simulator? I leave this rhetorical question unanswered for your rumination, but the key insight in the planning process was this: It is almost certain that aircraft dynamic response, in almost every case, would not exceed the case of a gravity extraction at 90,000 pounds. Mathematically speaking, we would assign to this event a probability almost equal to one, and we call this valid, statistical parameter the maximum. Use of these kinds of parameters, outside of what we usually encounter (mean, standard deviation, etc.) is both mathematically rigorous and less complex in many cases, but it is something we don’t usually consider. During the safety planning, average response, standard deviation of deck angle change, median extraction times, etc., simply were not considered. The sample size required to achieve any reasonable confidence, in the purely classical statistical sense, would be insurmountable, given the modeling constraints. But the levels of certainty in our prediction on the maximum are much greater. The simulator model also gives a benchmark for nominal aircraft response. We are practically certain that nominal extractions will be “better” (as quantified, for example, by faster extraction rates) than simulator predictions. In both of these cases, we have bounded the expected response. In the former, we have demonstrated capability to safely execute the test in this worst-case scenario and subsequently developed and rehearsed techniques to recover from these unexpected aircraft attitudes. On the other side of the spectrum, any deviations from simulated nominal extractions immediately signal impending contingency to the pilot, even faster than the loadmaster or copilot can verbally announce, allowing the pilot to prepare for what follows. In essence, instead of a best-fit regression line, the aircraft response has been bounded above and below by worst cases.
