Modern methods of preventing aircraft overrunning the runway

: The landing of the aircraft has always been the most challenging and dangerous stage of the flight. In order to make a safe landing, the aircraft (A/C) requires reducing the vertical (at the stage of flare-out) and horizontal (prior to touchdown) components of the aircraft's flight speed vector, which in turn reduces the capabilities to increase lift and limits the crew's ability to perform maneuvers. At the same time, during landing the crew must align the aircraft with the runway (RW) and make a touchdown, subsequent A/C landing roll and stop within a rather limited area, which eventually and particularly, under the effect of contributing adverse factors (piloting errors, wind shear, icing, engine failure, aquaplaning, etc.) can cause the aircraft to overshoot and overrun the RW. Currently, as the analysis of aviation accidents statistics shows, the issue of preventing and alerting aircraft overrun is quite relevant. The search for a solution, in terms of preventing aircraft overrunning the runway (RW), is conducted as at the level of aviation authorities as among aircraft manufacturers, operators. Within the framework of this review, an attempt is made to identify and analyze the key factors affecting the dynamics of aircraft motion during landing, using information about aviation accidents that have occurred over the past few years. Notably, such aspects as a human factor and technical features of the operation of modern jet aircraft, influencing the A/C landing roll, are considered. In addition, special attention is paid to consider the methods of prevention and warning of A/C overrun with highlighting the approaches of passive and active protection. Within the framework of the analysis of active protection techniques, the principles of on-board avionic systems operation of the most major aircraft manufacturers, such as Boeing and Airbus, are considered. As an example of the passive protection, the experience of using special energy-absorbing destructible blocks installed next to the runway threshold, is analyzed.


Introduction
The analysis of aviation accidents statistics 1 points out to the fact that despite a short space of time of landing with respect to the rest flight phases (less than 5% of the entire flight time), it is the phase of flight when most of the aviation accidents (over 60%) occur [1]. A considerable part of the stated aviation events (AE) is concerned with aircraft overrunning the RW. In conformity with IATA data, 27% of AE are related with aircraft rolling-off, which is the highest indicator regarding other types of AE over 2016-2020. Among the factors stipulating A/C overrunning, let us emphasize the environment conditions, decreasing visibility and deteriorating aircraft breaking action with the RW surface (fog, RW icing, wind, etc.) 2 technical and human factors. Let us note that running off the RW is associated rather frequently with the simultaneous impact of a variety of factors. 1  A flight crew's ability to perform a goaround procedure has a great influence on preventing A/C rolling-off. Therefore, airlines focus on the development, implementation and abiding by rules and procedures to ensure the constant flight crew's readiness for go-around, provided the actual landing instruction does not comply with a safe flight completion [I]. Thus, a scheduled flight crew training is bound to include the fulfilment of a go-around procedure on a simulator. Additionally, the number of requirements and procedures, established by the state regulatory and supervisory authorities, exists [2].
A compulsory monitoring and recording of the onboard systems malfunctions, inclusive of the braking systems, the obligatory fulfilment of the MEL -prescribed procedures, are referred to them.
According to the world practice, it is not advisable to continue an approach to land beyond a designated touch down zone, also to perform a hard touchdown on a slippery RW 3 .
Apart from the stated above organization events, the technical measures aimed at overrun-ning prevention, which are implemented as at an aerodrome (ground events) as onboard A/C, are highlighted.
It is obvious that the most efficient on the ground technique to prevent running off is building longer RWs, ensuring the A/C maximum landing roll.
There are different types of aerodromes (island, shore-based, etc.), where the RW length is limited due to landscape features. Lately a specific ground-based energy-absorbing system of A/C emergency braking (EMAS) has become alternative to lengthening the RW. For the purpose of minimizing the negative impact of a human factor, the systems of modern A/C automatic control are replenished with functions, implementing braking in the automatic mode 4 .
Let us consider in detail the hazards resulting in the risk of overrunning as well as action plans to prevent A/C overrunning the RW.

Analysis of hazards resulting in the risk of overrunning
As it was noted before, quite frequently an aircraft accident (A/A) results from the impact of several causes simultaneously [3,4]. Among the causes, increasing the risk of rolling-off, let us note [1]: 1) unsteady approach to land, the incorrect technique of A/C aligning, wrong actions and/or interaction in the flight crew under adverse weather conditions or the A/C emergency technical condition. These causes are brought about by a human factor, 2) unpredictable or much worse than the expected landing instruction, as a rule, are concerned with unreliable information transmitting to the crew about the landing instructions, 3) efficiency decreasing or facilities failure to dampen a lift force, braking aids, A/C emergency configuration are usually brought about by the A/C technical condition, 4) airport features (geographical location, limiting landing direction and operation zones in the vicinity of the airport, RW gradients, RW surface condition).
We should highlight the impact of a human factor among the causes of most AE. According to the ICAO statistics, 45% of AE are namely caused by a human factor. Insufficient training, emotional tension, fatigue and a range of other factors are capable of leading to substantial deviations in a flight crew work, subsequently, disrupt a flight plan.
Among such violations we can mention the unsteady approach, i.e., approach to land, under  Interference on the part of the senior leadership caused a flight crew to descend below the decision height, piloting A/C manually in fog, attempting to find the RW lights [5].
In this respect, the same emotional subcomponent led to Utair airline A/C B737-800 overrunning in Sochi in September 2018. The A/C was approaching to land in the marginal weather conditions. On a glide path a captain made a goaround procedure after continuous alerts about wind shear. Attempting to make another hand approach, a flight crew made a series of errors. The A/C retarded to intercept signals of localizers due to the unsteady approach. As a result, the crew had to make sharp maneuvers to fly the heading, which led to air speed increase [5]. Over the RW threshold, the flight crew neglected a wind shear warning and continued the landing, substantially having overshot an aiming point of a touchdown zone. An overdue going into the reverse thrust became fatal. Let us note, that due to inertia, transition from one turbojet engine operation mode to another, especially reverse thrust activation, takes several seconds. For example, on A/C B737 maximum reverse thrust is generated not earlier than in 2…4 sec. If overdue reverse thrust is deployed in conjunction with touch down and overshooting at a greater speed than the operation manual prescribes, a risk of rolling-off increases massively [6].
Incorrect provision of information to the crew about the weather conditions and RW status presents a significant threat as well [7]. With the preliminary estimate of a landing distance prior to departure, it is impossible to take into consideration features of each airport regarding the rate of speed during approach to land, actual temperature and breaking coefficient, wind direction and intensity. For example, a damp RW, providing the good breaking action, can become slippery even under a slight variation of temperature. Incorrect provision of information to a flight crew about the RW status caused Aeroflot A/C A321 overrunning at Kaliningrad airport Khrabrovo. The reported braking coefficient proved above actual as a result of which, the A/C crew selected the insufficient breaking coefficient mode. The similar causes resulted in the incident with Red Wings airline SSJ-100 in Belgorod.
The A/C technical condition and specifics of its control much more rarely cause rolling-off because of a high reliability of aeronautical equipment and qualitative training of flight personnel [8]. Nevertheless, it is the features of the A/C control system that resulted in Red Wings airline A/C Tu-204 overrunning in Vnukovo in 2012. The matter is that an automatic extension of air speeds, interceptors and going into the reverse thrust on this A/C type are practical only on the condition of the simultaneous clenching of both landing gear (LG) struts. However, A/C motion on the RW was happening without extended interceptors with alternative clenching either left or right L/G struts. As a lift force was sufficiently great due to not extended interceptors, wheel braking was not efficient. A reverse was not also activated despite numerous crew's attempts due to the failure to clench the left and right LG struts simultaneously during the landing roll on the RW.
Furthermore, aerodrome features must be considered. There are airports where a single course landing is only possible or aerodromes with V-type RWs located with the direction variation of 15-20 degrees without a probability for the opposite course approach, which does not allow pilots to disregard the tail wind or hazardous windshear impact [9]. In the Russian Federation, an airport in Sochi has such a pattern where an approach to land is possible only from the seacoast direction due to the opposite course restrictions in the presence of mountains. In addition, in conformity with the applicable approach to land regulations in Sochi or Gelendzhik, a goaround procedure is allowable only when it is above the decision height, as a result of which, a risk of unsteady approach to land increases. The RWs state also influences substantially a proba-bility of performing a safe landing. For example, the RW at an out-of-service airport in Rostovon-Don was notorious for its "bump" among pilots -a positive gradient started approximately from the first third of a touchdown zone in the distance of about 1000 m and transferred into a negative gradient up to the RW stop end.

Methods to reduce the risk of A/C overrunning the runway
Among the methods to decrease the risk of A/C overrunning the RW, we can put an emphasis on organizational and technical ones. The latter can be classified into the methods of active and passive protection.
As an example of organizational measures, let us give FAA Advisory Circular No: 91-79A, developed by the national US regulator in collaboration with A/C company-designers and major airlines. It specifies the key areas of focus with respect to reducing the risk for A/C overrun the RW on landing.
Compliance with the standard operation rules and the use of checklists are a significant contributor to preventing AE during approach to land and landing. The actions, prescribed by the standard operation rules, are accomplished according to the proper sequence from each pilot's seat. In terms of safety, critical flight moments (involving primarily A/C configuration variation) must be crosschecked using checklists [10].
While performing a go-around procedure, a strict conformity of the rules of delegating responsibilities between pilots and the optimal use of the principles to optimize crew work in a flight deck (CRM) are of paramount importance.
However, the listed documents and procedures cannot fully solve an A/C overrun-related problem, which illustrates a rising trend of overrun frequency over 2015-2020 (IATA).
Thus, the requirement to apply additional safety barriers, as the active and passive protection, is essential. Controlling effects of crew and aeronautical equipment are ascribed to the first category. The passive methods comprise socalled emergency systems allowing pilots to minimize consequences of A/C overrun the RW.

Active methods to reduce the risk of A/C overrunning the RW
The active methods to reduce the risk of A/C overrun the RW are based on the development of crew control input on A/C flight controls based on their own perception, onboard systems advisories or on the development of stimulus commands on the flight controls by the automatic onboard system without pilot involvement. For example, A/C Airbus 320neo are fitted out with the system of automatic control that implements a three-mode braking: LOW, MEDIUM, MAX 5 . A selection of the braking mode, relevant for the current landing instruction, is conducted by the crew prior to approach to land. The system of automatic breaking on A/C Boeing 737NG operates in the similar manner.
The modified systems are installed on the latest generation A/C, which operation is, more likely, aimed at alerting the crew about the contingency of overrun (elimination of errors before landing) rather than at a direct crew intervention at the point of the landing and landing roll.
Let us analyze in detail the operation principles of the stated systems on the example of A/C B777 and A350.
In 2010 during the modification of A/C A380 and the design of A/C A350, Airbus developed a warning and overrun prevention system -Runway Overrun Prevention System (ROPS). ROPS assesses continuously a capability of an A/C safe stop on the rest of the RW ahead of the A/C.
If the system detects a risk of RW overshoot at some point, the appropriate warnings go off in a flight deck. ROPS has access to the parameters that influence the A/C landing distance, particularly to A/C coordinates, values of true and air speed [11].
ROPS incorporates two subfunctions: ROW and ROP. ROW generates signals which cause a flight crew to make a go-around procedure (alert about a contingency of rolling-off). ROP gener- ates signals which cause a flight crew to apply available deceleration facilities (overrun prevention) 6 . ROW becomes active at the altitude of 500 feet and remains active during the entire final phase of approach to land, flare-out and landing until ROP transition. On Airbus family A/C A380, A330 and A320 ROW calculates continuously two braking ways: a braking distance on a dry and wet RW. If a braking distance for a wet RW becomes longer than the available RW length, a message "IF WET: RW TOO SHORT" comes on. If a braking distance for a dry RW becomes longer than the available RW length, a system displays a red warning message on PFD: "RW TOO SHORT" (fig. 2) [11]. ROP is triggered on the ground after transition from ROW and remains active until reaching the taxiing speed. ROP uses a current value of the A/C deceleration and A/C performance to determine where the A/C can stop safely on the RW. If ROP detects the risk of overrun, the aural and visual alerts are activated. A red visual warning "MAXIMUM BREAKING, MAXI-MUM REVERSE" is displayed on PDF. If a condition of speed exceedance still exists at 70 knots (advisable speed of reverse thrust shutdown), an audible warning "MAINTAIN MAXI- 6 Quick reference hand book for Airbus A350. By Airbus Corp. Available at: https://store.pcflier.com/m/product/ view7.html (accessed: 16.11.2021).
MUM REVERSE" goes off to notify a flight crew about the necessity for maintaining reverse thrust.
On A/C A380 and A350, ROPS is integrated into the systems of flight control, A/C navigation and presents pilots a constantly updated image in the real-time mode on the Navigation Display 7 . The Boeing data system, applicable on A/C B777 and B787-Runway Awareness and Advisory System (RAAS) 8 has the similar functionality. RAAS (notification and warning system on the RW) generates the sound and verbal notifications for a flight crew about a critical A/C position on the RW. RAAS uses GPS (Global Positioning System) data and RW database to determine the A/C position regarding the RW. At the same time, the system does not virtually take into consideration the parameters and dynamics of the A/C motion in space.
Available variants of warnings issued by RAAS system are represented below ( fig. 3):  Approaching runway (in flight).  Approaching runway (taxiing).  On Runway.  Extended holding time.  Distance remaining (landing rollout).  Distance remaining (rejected take-off).  Runway end. In addition to the stated above notifications, the system can issue the following notifications:  Insufficient runway length.  Taxiway takeoff.  Approaching short runway 9 . The technology Braking Action Computation Function (BASF), which is developed collaboratively by Airbus and NAVBLUE company and designed to ensure flights and traffic control, is another approach to decrease the risk of A/C overrun the RW. In essence, BASF represents a 7  special software function, implemented by a complex of A/C airborne equipment, which is based on the Airbus-developed mathematical model. BASF uses data about braking conditions for calculation and defines the contribution into the overall braking efficiency of each of the systems (spoilers, reverse, and wheel brakes). Moreover, BASF compares the actual breaking values with data about possible RW conditions from Airbus database. Afterwards, it makes a conclusion about the braking capability and draws up a report with an assessment of breaking performance, which pilots can see on the display of the onboard digital computer 10 . BASF data are accumulated in the single database (transmitted via ACARS to the server), which allows an airline to store breaking data concerning all the flights of all A/C and to define the most efficient breaking techniques depending on the actual conditions. It enables pilots to reduce the number of A/C rolling-off [12].
Furthermore, in the real-time mode BASF data enter a special service NAVBLUE Run-waySense, compiling all the reports about the RW condition, which allows RunwaySense users to use the precise information in the real-time mode about the RW surface condition at different airports worldwide ( fig. 4) [13]. Guided by the objective data, an airport can transmit more precise data about the breaking coefficient to crews of inbound A/C and arrange work to clear the RW 11 .
Operation efficiency of the similar systems is quite high. In the process of test flights, the number of erroneous warnings was equal to less than 0.1%.
Nevertheless, new A/C from a manufacturer are basically equipped by the similar systems, more rarely, A/C in service will be retrofitted [14]. It is related both with the relatively high cost of after-production modification and the necessity of A/C putting out of a flight schedule.
Moreover, optionality of such modifications at the state level has consequences. The perspective of installing these systems on A/C, manufactured by domestic enterprise, is vague due to high costs to implement the similar functions and lack of the requirement for its availability. At the same time, in May 2021, the most major domestic airline Aeroflot-Russian Airlines announced the beginning of BASF 12 technology application [15] among the Russian operating airlines.

Passive methods to reduce the risk of A/C overruning the RW
The passive methods diminish the consequences of A/C overrunning the RW. The areas beyond the RW threshold, which are called the runway end safety area (RESA), are conventionally designed for this purpose. Until recently, the RESA length came to 60 m.
The ICAO modern standards require to have RESA not less than 90 m advising a 240 m length concurrently. However, not always feasibility exists to be consistent with the ICAO recommended practices [14]. In addition, the surfaces beyond RESA boundaries are usually grass and soil, which properties depend on weather conditions (humidity, temperature, etc.). During motion on wet soil, for example, the A/C can sink into the soil, and it can cause the landing gear to collapse. Subsequently, there may be significant damage to the A/C, which eventually increases the risk of fire, injuries and fatalities among passengers and crew members [16].
The passive emergency braking system Engineered Materials Arresting System (EMAS) can be regarded as one of the most perspective and efficient passive methods to reduce the risk of A/C overrun. EMAS was developed by the group Zodiac Aerospace and approved by the US Federal Aviation Administration (FAA). EMAS represents a construction as a flat artificial surface comprising of assembled units and located next to the RW threshold. The design of units ensures their controllable destruction during obstacle encounter, smooth A/C deceleration without its damage, the subsequent efficient restoration of EMAS by means of replacing ruined units.
In 2012 FAA issued a special circular No 150/5220-22B dedicated to the issues of the design and requirements for the EMAS material [17]. The basic requirements for the given system outline the following:  water resisting,  incombustibility,  no emission of fumes during fire,  resistance to the environment impact,  a capability of an A/C halt, overrunning at max speed 70 knots without exceeding ultimate loads, severe damage and negative impacts on passengers, Fig. 4. Example of MCDU screen with the runway status output from BACF  resistance to a jet blast during a routine aerodrome operation 13 . Currently, several airports in the USA, China, Europe and Middle East are equipped with the similar systems.
Systems of this type have not been utilized and certified so far in Russia. The requirements of regulatory and supervisory authorities for them are not available. At the same time, it is obvious that the application of these systems like EMAS would enhance flight safety, for example, at Sochi airport and allow us to avoid in future the negative scenarios which occurred in Vnukovo and Kaliningrad.

Conclusion
Nowadays the task of reducing A/C overrunrelated aviation events is crucial. The international experience, growing frequency of AE, involving A/C overrun, highlights the relevance of developing the special active (installed on board A/C) and passive (mounted at an aerodrome) systems in order to decrease the number and consequences of A/C overrun the RW in Russia. The similar systems are not available on A/C in service and domestic currently designed ones as well as at aerodromes. We should note that in order to implement these events in our country, there is no essential regulatory framework as well as research and technological groupwork. Therefore, it is vital to conduct research, development and engineering work, develop projects of regulatory-technical base with the aim of designing the active and passive systems to prevent (diminish) consequences of A/C overrun the RW, and equip domestic A/C and aerodromes with the similar facilities.