Rethinking Ejection Seat Safety: Why Traditional Risk Assessment Methods Fail

Summary

The criticality of robust escape systems in military, high-performance and prototype aircraft cannot be overstated. While significant advancements have been made in ejection seat technology, a persistent challenge remains in the accurate assessment of the risks associated with their use. This article contends that conventional aircraft safety frameworks, such as those outlined in MIL-STD-882 and ARP-4761, are inherently unsuitable for evaluating ejection systems. These frameworks, typically reliant on Hazard Risk Index (HRI) matrices, are designed to assess risks within the context of "normal" aircraft operations, failing to adequately address unique nature of ejection scenarios.

This article delves into the specific limitations of applying traditional HRI matrices to ejection systems, highlighting the discrepancies that arise from their underlying assumptions. Furthermore, a novel ejection safety HRI Matrix is proposed, offering a more accurate and transparent methodology for evaluating ejection-related risks, with a primary focus on pilot survivability.

Historic F9F-8T Cougar Ejection Test.

The Problem

Across the various organisations I have worked in, I have consistently encountered tension when discussing the risks associated with escape systems. There has been a persistent drive to assess these risks using the "standard" aircraft methodology, utilising Hazard Risk Index (HRI) matrices for the aircraft, like those laid out in MIL-STD-882 or ARP-4761. However, applying this methodology to escape systems is, in my opinion flawed for the following reasons:

1. Compound Risk: Ejections occur because of a catastrophic failure. Assessing the risk of ejection alongside the risk of the initial failure creates a "compound risk" that traditional HRIs, which primarily consider random failures, don't handle well.

2. Obscured Risk: Linking ejection risk to aircraft reliability (e.g., "1 catastrophic failure per 100,000 flight hours") obscures the risks associated with the ejection system. Humans, especially in high-pressure meetings, tend to dismiss extremely low probabilities, leading to a false sense of security.

3. Misplaced Focus: Traditional HRIs prioritize the "aircraft viewpoint", but during an ejection, the focus shifts entirely to aircrew survivability.

4. Ignoring System Purpose: Ejection seats are designed for emergencies – they are a pilot's last chance to survive a catastrophic event. Traditional HRI matrices fail to account for the uniqueness of this scenario.

   
   

A Simplified Example

One common way to assess ejection risks is to associate the chance of ejection with the desired aircraft reliability target:

"We're designing to an aircraft reliability of 1 catastrophic failure per 100,000 flight hours so our chance of ejecting is 1 in 100,000".

This "ejection chance" is then applied to any ejection risks to put them into an aircraft-level context. However, this approach can be misleading. Consider this in the context of the HRI matrix defined in ARP-4761, shown below.

An example HRI matrix sourced from ARP-4761.

Now picture the following scenario:

• The likelihood of a catastrophic failure resulting in ejection is calculated to be once in every million flight hours (1E-6).

• A risk is identified that would cause a pilot fatality during 1 in 10 ejections.

Using the HRI outlined above, this would place the risk at a "5D" level – not ideal, but potentially acceptable with review and approval from the engineering organization. However, as aircrew, would you feel comfortable sitting in an ejection seat that had a 10% chance of killing you if you needed to eject?

Furthermore, it's crucial to consider the severity definitions associated with this HRI. Aircraft loss is considered catastrophic, but in an ejection scenario, aircraft loss is almost guaranteed. This highlights the mismatch between traditional HRIs and the specific context of ejection events.

An Improved Approach: The Ejection HRI

Fortunately, the solution to these problems is relatively straightforward. Escape system risks should be assessed against a dedicated ejection HRI matrix. This matrix shifts the focus from the aircraft level to pilot survivability and adjusts the probability and severity definitions to reflect the realities of ejection.

• Probability: Instead of relying on aircraft reliability, the matrix assumes an ejection has taken place and considers the likelihood of a risk occurring during the ejection sequence.

• Severity: Severity is defined in terms of pilot rehabilitation time, focusing directly on pilot survivability and allowing the impact of risks to be considered at an operational level.

Shown below is an example ejection HRI matrix that I devised when supporting a customer with the integration of an escape system into a 5th generation fighter aircraft. Both the probability and severity definitions have been tailored to account for a change in risk acceptability during ejection. In my opinion, it is reasonable to accept a higher level of risk in an ejection scenario, considering the inherently hazardous nature of ejection and the life-threatening situations it is designed to mitigate.

Proposed Ejection Safety HRI Matrix (Green = Acceptable, Yellow = Acceptable with engineering team review, Orange = Acceptable with Chief Engineer or Operator review, Red = Unacceptable)

It's important to contextualize these probability bands within the operational life of an aircraft fleet. Not every aircraft will experience an ejection. To illustrate this, consider a simplified example:

• Fleet size: 500 aircraft

• Expected loss rate: 1 in 10 aircraft (a pessimistic estimate, but remember this is potentially over a 50-year operational life for the aircraft).

Based on these assumptions, the probability bands can be interpreted as follows:

• Expected (A): The risk will occur 25 or more times across the operational life of the fleet.

• Likely (B): The risk will occur 12 or more times across the operational life of the fleet.

• Possible (C): The risk will occur 5 or more times across the operational life of the fleet.

• Uncommon (D):  There is a 50/50 chance of the risk occurring at least once across the operational life of the fleet.

• Extraordinary (E): There is a 1 in 20 chance of the risk occurring at least once across the operational life of the fleet.

• Incredible (F): There is a 1 in 200 chance of the risk occurring at least once across the operational life of the fleet.

This methodology allows for the risks associated with ejection to be properly understood and placed into context for the aircrew, operators, and engineering team. For example, a 6D (Uncommon, Catastrophic) risk could be considered to cause a pilot fatality during ejection once across the operational life of the fleet. This methodology places the focus clearly on aircrew safety, and I have already seen the benefit of discussing ejection risks in this context across the organizations I have worked within.

Prototype Aircraft

It is worth briefly discussing how this methodology applies to prototype aircraft. It is generally accepted that a prototype aircraft has a different (and increased) risk profile compared to a production aircraft, which in turn heightens the need for an effective escape system. Associated with this is a potential shift in the acceptable level of risk associated with ejection. For a prototype aircraft, an argument can be made for adjusting the boundaries within the ejection HRI. However, this should be done cautiously and in close collaboration with the test pilots who will be flying the aircraft, as they are ultimately the ones accepting the risk.

Another benefit of this proposed methodology is that it does not make any assumptions about the reliability of the aircraft. This is especially important when the aircraft being flown or developed is at the beginning of its operational life, where risk of failure is known to be higher as per the "bathtub curve".

The "Bathtub" reliability curve.

Conclusions

When considering the risks and hazards associated with ejection, existing assessment methods can obscure critical information for stakeholders. I have developed a dedicated ejection HRI matrix to help solve these issues and maintain focus on the critical aspect of these risks: pilot safety. Considering the unique nature of ejection scenarios, it makes sense to use a bespoke methodology for assessing the associated risks and hazards.

I have successfully used this approach with multiple aircraft manufacturers to help them understand the escape systems they are integrating into their aircraft and the hazards and risks their aircraft may introduce during an ejection. This dedicated ejection HRI matrix provides a clearer and more accurate assessment of ejection risks, which I hope can ultimately contribute to improved safety for aircrew.