13.

SS

7.

rel

Hasbrook, A. H., Garner, J. D., Snow, C.C.,
Evacuation Pattern Ana'ysis of a Survivable Com-
mercial Aircraft Crash, FAA-AM-62-9, U. S. De-
partment of Transportation, Federal Aviation Ad-
ministration, May, 1962

Mohler, S. R., Swearingen, J. J., McFadden, E. B.,
Garner, J. D., Human Factors of Emergency Evacu-
ation, FAA-AM-65-7, \ .S. Department of Trans-
portation, Federal Avis ion Administration, 1965

Garner, J. D., Blethrow, Jj. G., Emergency Evacua-
tion of a Crashed L-1649, FAA-AM-66-42, U. S.
Departmer:t of Transportation, Federal Aviation
Administration, August, 1966

Garner, J. D., Blethrow, J. G., Evacuation Tests
From an SST Mock-Up, FAA-AM-70-19, U. S.
Department of Transportation, Federal Aviation
Administration, December, 1970

Blechrow, J. G., Garner, J. D., Lowery, D. L.,
Busby, D. E., Chandier, R. F., Emergency Escape of
Handicapped Air Travelers. FAA-AM-77-11,€.S.
Department of Transportation, Federal Aviation
Administration, July, 1977

Pollard, D. W., Garner, J. D., Blethrow, J. G.,
Lowery, D. L., Passenger Flow Rates Between Com-
partments: Straight-Segmented Stairways, Spiral
Stairways, and Passageways with Restricted Vision
and Changes of Attitude, FAA-AM-78-3, U. S. De.
partment of Transportation, Federal Aviation Ad-
ministration, January, 1978

Schroeder, J. E., Tutt, M. L., Development of an
Aircraft Evacuation (AIREVAC) Computer Model,
Phase 1: Front End Analysis and Data Collection,
Final Report to the Air Transport Association of
America, September 30, 1991, published by South-
west Research Institue, San Antonio, Texar, SwRI
Project No. 12-4099

il

18.

sey

20.

24.

24.

Boeing, AIA Evacuation System Analysis Airline
Evacuation Test Exit Type 1 ~ Passenger Evacua-
tion Rate Door Mounted Slide, Boeing Document
DG6A10742-1

. Douglas Aircraft Company, ALA Crashworthiness

Development Program Evacuation Systems Develop-
ment Accident Report Study — Emergency Evacua-
tion, 1967, Report DAC-33910

Douglas Aircraft Company, DC-10 Emergency Exit
Upgrade Program Phase I & If, 1972, Repo. MDC-
J5386

McLean G. A., George, M. H., Chittum, C. B.,
Funkhouser, G. E., “Effects of Seat Pitch and
Encroachment on Simulated Emergency Egress
from Type II] Over-wing Exits.” presentation to
the 1993 Annual Scie: Meeting of the Aero-
space Medical Association

Purser, D. A., “Modeling Time to Incapacitation
and Death From Toxic and Physical Hazards of
Aircraft Fires,” AGARD Conference Proceedings No.
467: Aircraft Fire Safety, (AGARD No. CP-467),
1989

14 Code of Federal Regulations, Parz 25, Section
803, “Emergency Evacuation,” U. S. Department
of Transportation, Federal Aviztion Administra-
tion

Gourary, B. S., “PC-Based Simulation of the Evacu-
ation of Passengers from a Tzansport Airplane.”
Proceedings of the Eleventh International Cabin Safety
Symposium, Southern California Safery Institute,
Los Angeies, California, 1994

‘RUS. GOVERNMENT PRINTING OFFICE: 1984 - SeogeavaniTy


series. This starting value is referred to as the seed. An
identical series of random numbers is generated if the
same seed is used. Some simulations allow the user to
specify a seed, or the user can specify that the simula-
tion generates a random starting value. A frequent
source for a random starting value is the current date
and time as read from the computer's clock. If differ-
ent seeds are used, differing results of a simulation
might be expected, and most aircraft cabin evacuation
simulations allow the user to run a series of simula-
tions with identical configurations, but using differ-
ent seeds. The mean value of the results of these
simulations is then studied.

We have defined a stochastic process as an event
occurring over time and following the laws of prob-
ability. The use of random number generators allows
a mechanism for introducing the laws of probability,

but a means of simulating the element of time is also
necessary. This factor is introduced through a simula-
tion clock that begins counting at time 0 in a siraula-
tion, and continues until the simulation is completed.
Each fraction ofa second that I cycle of che simulation

clock represents is referred to as 1 clock tick. Put too

few clock ticks into a second, and you miss important
details, resulting in the model being unable to accu-
rately simulate the situation. Put too many clock ticks
in, and the computational load (i.¢., speed with which
the simulation suns; size and expense of the necessary
computer) increases without any added realism. Con-
sider two extreme cases. If one clock tick is 90 seconds,
you go from everyone seated to an empty aircraft
without understanding the dynamics in between. If
one clock tick is } millisecond (one thousandth of a
second), you have to do 90,000 cycles for a 90 second
simulation, yet, the difference in movement in 1
millisecond is, at best, undetectable. Selection of an
appropriate clock speed is part of the “art” of com-
puter modeling.

A typical aircraft evacuation model is 2 stochastic
queuing model. Each passenger is represented and
governed by a set of rules for their behavior that relate
a probability generated by a random number genera-
tor to some probabiliry of taking an action. A simula-
tion clock runs the model. At each clock tick, the
actions of each passenger are determined, based on the
rules governing behavior, the probabilities generated
by the random number generator, and the environ-

ment in which the passeng*: ‘s located (e.g., locations
and actions of other adjacent simulated passengers,
presence of combustion toxins in the air, proximity
and paths to exits, and whether blockages exist in the
aisle). After each clock tick, passengers are moved to
their new location, the cabin environment is updated,
and the process is repeated until either everyone is
evacuated or dead, or the simulation is stopped by the
user.

Historical Development

The potential for a fire in a building also poses
evacuation questions. Virtualiy every local govern-
ment has an extensive set of building codes designed
to reduce er eliminate both the possibility of a fire,
and the risk of death and injury to people who might
be in a building that catches fire. A primary consider-
ation in these regulations is the safe evacuation of the
buifding, leading to regulations concerning, the num-
ber, size, marking, and distribution of exirs, and the
maximum number of people who can safely occupy a
room. Building designers have also been interested in
computerized simulations of the evacuation process,
for reasons similar to those of aircraft designers. This
paper will not review computer simulations of the
evacuation of a burning building, though the inter-
ested reader is referred to Watts (i).

One of the first efforts at computer modeling of an
evacuating aircraft was pursued by the Civil Aero-
medical Institute (CAMiI) in the 1970s (2,3). These
simulations depended an a special computer language
developed by IBM calied GPSS (General Purpose
Simulation System), and required large mainframe
computers co run. The simulations considered a num-
ber of features, such as passenger mix, seating and exit
configuration, door opening delay, time on anesc. ~e
slide, and slide capacity. The simulations were in-
tended for study of certification tests, and not neces-
sarily for accident reconstruction. As a result, the
models did not simulate life-threatening factors, such
as toxic combustion gas products, nor did they con-
sider passenger behavior in a life-threatening situa-
tion. The model was used to simulate narrow-body,
single-aisle aircraft (Boeing 720 in 124-and 234-
passenger configurations), and wide-body, dual-aisle,
aircraft (B-747, DC-10, and L-1011).



Behavior model determines an individual’s re-
sponse to the current situation based on that
passenger’s personal attributes, and then passes the
decision to the movement model. In the current
implementation, all passengers head for the neai-
est serviceable or assigned exit.

Passenger model describes an individual in terms
of 22 attributes and variables such as name, gen-
der, age, movement speed, dead/alive, etc. Some
attributes are fixed and unchanging, while othe.s
change in response to information from other sub
models.

Hazard model describes the atmospheric and
physical environment. It controls fire hazards such
as heat, and combustion product toxins, as well as
the opening and closing of exits.

Toxicity model determines the effecis on an indi-
vidual exposed to the toxins calculated and distrib-
uted by the hazard model. The toxicity mode!
communicates with the behavior model, and in.
turn the movement model, to simulate the re-
duced ability to escape the cabin fire as it progresses.

EXODUS has been demonstrated in a hypothetical
wide-body, dual-aisle aircraft under both simukted
fire, and certification demonstration types of tests(6}.
The model has also been used to reconscruct the
British Airtours B-737 aborted takeoff and fire at
Manchester Airport in !985 (9).

To demonstrate the validity of EXODUS, Galea
(6) simulated a series of controlled evacuation tests
from a Trident Three aircraft conducted by Helen
Muir at the Cranfield Institute of Technotogy (10).
Muir conducted both orderly evacuaticns, and used a
unique financial incentive to simulate panic among
passengers. Galea simulated both orderly runs, and in
some simulations, allowed the simulated passengers
to climb over seat backs in an attempt to exit more
quickly. Galea’s modeling parameters were based on
his initial “guesses” of the parameters needed, yet
predicted similar trends to those found by Muir.
While the trends predicted by the simulation matched
those found in the tests, the model predicted that the
cabin would be evacuated in less time than recorded in
the tests (i.¢., the model predicts a faster evacuation than
experienced). These results must be considered within
the context that Galea had little basis for and limited
opportunity to modify the parameters that he used.

Data Needs and Sources

Any simulation depends on parameters that de-
scribe how a system responds to some event. This is
true whether the simuiation is of a piece of steel being
bent, or a human passenger escaping an aircraft fire.
The simulation can never be any better than the
parameters that describe the system, and parameters
that characterize human response can be some of the
most difficult to obtain. All cabin evacuation model-
ing efforts (2, 3, 4, 5, 6) have identified limitations in
the sources and quality of data upen which to base
modeling parameters as a primary impediment to the
accuracy and application of the models.

While each model tends to have unique parameter
needs, there are a number of parameter needs com-
mon to all models. For example, the GA Model (4)
seeks a single parameter to quantify an individual’s
strength and ability to tolerate fire generated toxins.
The GPSS models (2,3) and AIREVAC (5) have no
such parameter, in pert because they are not, as
developed, suitable for accident reconstruction. In
contrast, all models (2-6) depend on information
about flow rates in aisles and through exits.

This section will describe some of the parameters
common to all evacuation models, and identify exist-
ing sources of information usable as a basis for mod-
eling parameters. The reader is referred to che work of
Schroeder (17) in the early stages of the development
of AIREVAC. In (17) Schroeder has an extensive
Hterarure review, including his conclusions about the
applicability to cabin evacuation modeling of the data
in the references he found. This literature review
included information relevant to accident reconstruc-
tion modeling where combustion product toxicology
and physiological responses are important.

Central co all models is the issue of passenger flow
rates, and ail models need information about how fast
people move in aisles, move through exits and onto
slides, and how quickly people wil! move from a row
into the main aisle. Related parameters include how
long i: takes people to undo their seat belt, how long
to begin to move purposefully towards an exit, and
how long it takes to open aircraft exits and inflate
slides. It can be assumed that through much of the
simulation a queue {i.c., a line) will exist either at an
exit, or at some other point in the cabin. When a


world of finite time and financial resources, the model’s
developer has made choices based on sponsor guid-
ance, which result in the simulation’s limitations.

GA Model

After the early modeling work at CAMI (2,3) an
effort was initiated to build on the strengths, and
correct some of the weaknesses identified in the pre-
vious effort. In 1987, Barry Gourary of Gourary
Associates (GA) developed a new cabin evacuaticn
model under Federal Aviation Administration (FAA)
sponsorship (4). Guidance given to GA included that
the model should run on then state-of-the-art per-
sonal computers, produce a graphical display of the
results, run in near real time, and be flexible in terms
of cabin arrangements and passenger characteristics
without requiring a programmer to rewrite the simu-
lation each time. Further, the sponsorship of this
model development occurred under a government
program known as the Small Business Innovative
Research (SBIR) program. Central to the SBIR pro-
gram is a requirement that the project produce a
commercially viable product, in this case, a computer
program that could be sold to interested users. Note
that in 1987 a state-of-the-art personal computer was
based cn an Intel 80286 processor, a now outdated
technology. The resulting model was used to recon-
struct three actual aircraft accidents. A number of
improvements were made after the initial released,
with the most recent having been completed in late
1992 (4).

The GA mode! divides an aircraft cabin into a series
of cells. Each cell is the length of one row, and the
width of one seat and/or aisle. Each passenger is
described by a number of parameters, such as their
endurance or agilitv, and each passenger is assigned an
exit to use. A cell may be occupied by at most 2
passengers, and with each tick of the simulation clock
(3 ticks per simulated second) the passengers attempt
to move to their assigned exit. Each passenger has a
defined probability of moving from one cell to the
next, and this probability is a function of their endur-
ance, agility, and surroundings. In contrast to most
other evacuation models, in the GA Model the speed
at which passengers move is not a user-defined param-
eter, bur is specified by the probability of moving

fron. one cell to the next. Thus, a faster passenger has
a higher probability of movement compared to a
slower passenger. The movement probability is influ-
enced by a factor that reduces the passenger's endur-
ance (i.e., ability to live and move) with each tick of
the clock. When the passenger's endurance drops
below a threshold value, that passenger is considered
a fatality. As the simulation runs, the user may specify
that passengers are no longer required to use their
assigned exit, rather, the passenger will use the closest
available exit. It is also possible to simulate a flight
attendant at an exit, thus, increasing che probability of
someone successfully exiting during a clock tick. Only
one exit in the aircraft at a time may have a simulated
flight attendant stationed at that exit, though Gourary
has suggested techniques to simulate flight atrendants
being stationed at several exits during a single clock
tick (24).

The program produces a graphical display showing
an overhead view of the seats. rows, exits, and occu-
pants. Color coding differentiates dead passengers
from those stili capable of escaping. Without any
specialized computer knowiedge, the user may set
characteristics of the cabin and passengers. The num-
ber of exits is fixed at 4 overwing exits, and main exit
passageways at the front and rear of the cabin. How-
ever, fewer exits may be simulated by specifving an
infinite time to open an exit. Only a single-aisle
aircraft with at most 3 seats per row on each side of the
aircraft may be simulated, i.e., wide-body. dual-aisle
aircraft cannot be studied.

A user of the GA Mode! does not require any
specialized computer knowledge. such knowledge of a
programming language. Input to the program is per-
formed with editors supplied with the model. The
input files are stored in a non-standard file format.
and only the editors supplied with the program can be
used to enter and modify data. The software was
written in MS Basic (24), though the source code for
the program is not available. Options in terms of
specifying printers, video drivers, etc., are. at best,
limited.

The model includes 2 crude toxic environment
simulation to represent the influence of combustion
products from a fire. The user may specify a maximum
of two zones with harmful fire and smoke environ-


Average
Type of Passenger Certification Simulated
Aircraft Load Time (sec) Time (sec) Redirection
B-747 527 66.2 84.0 Yes
L-1C11 356 101.1 93.5 No
L-1017 356 82.0 84.9 Yes
L-1011 411i 89.7 79.6 Yes

TABLE 1 — Comparison of Simulation and Certification Evacuation Times
(Garner, Chandler, and Cook, 1978)

Table 1 compares the evacuation times from certi-
fication trials and from the simulations conducted.
Nore the counter-intuitive result, found in both the
simulation and the certification tests, of an L-1011
with a higher passenger load recording a faster evacu-
ation time compared to an L-1011 with a lower
passenger load. A further difference between these
two tests is that the 356-passenger model used three
Type A, and one Type! exits, while the 41 J-passenger
model used four Type A exits. The last column,
labeled Redirection, refers to a feature of the iests. If
passengers are instructed to use a particular exit re-
gardless of the queue, redirection is “No.” If passen-
gers may change the exit they use in an attempt to find
the shortest line/fastest exit, then redirection is “Yes.”

Some of the potential for computerized simulation
of evacuation is revealed in Table 1. Note that with
the L-1011 simulations, potential design changes
(Type A versus Type I exits) were analyzed, as well as
differing passenger loads.

Fxamination of Table I shows that the simulations
both under- and over-predicted the times from the
evacuation trials though the simulated times are com-
parable to the certification times. It should be noted
that the certification trials represent a sizgle test,
while the simulations represent averages of as many as
20 repeats. It is unlikely that ifa certification rest were
repeated the same evacuation time would be found
again, and with only a single test the variation and
standard deviation of these zimes are indeterminate.

Garner, et. al., (3) concluded that their model could
closely simulate actual evacuation times, and recom-
mended that additional research be done to refine the
inputs needed by their medel.

This early work showed the potential of evacuation
modeis, as well as revealed the limitations. There was
very little research on which to base the modeling
parameters needed, and yet this was identified by the
study’s authors as critically needed information. In
addition, using the models required large mainframe
computers, the situations studied were not easily
changed without rewriting a GPSS program (and
GPSS is not a widely known computer language), and
the results of the simulations tended to be large
printouts with many numbers, thus, not easily under-
stood.

Review of Current Models

Today there are three different cabin evacuation
models in development and use. These models, to be
described in detail, are the Gourary Associates (GA)
Model, develaped by Batry Gourary under FAA spon-
sorship(4); AIREVAC, developed by James Schroeder
under Air Transport Association of America sponsor-
ship(5); and EXODUS (6), developed in England by
Ed Galea. In the following discussion it is important
to examine the guidance given to the model’s devel-
oper when considering limitations of a model. Given
enough time and money, virtually any model can be
modified to add any capabilities that it jacks. In a


tailed set of psycho-social parameters describing
someone's reaction to being in an evacuation. A pas-
senger is described by specifying these characteristics
(e.g. frustration index. dominance/submission, knowl-
edge of aircraft exits and routes). The number of
parameters, and their associated values represent a
prohibitive impediment to creating a data set describ-
ing all of the individuals on a full plane. To solve this
problem. Schroeder derived mean values, and the
distribution around these mean values for each pa-
rameter needed. AIREVAC features 2 randomizer
that creates as many passengers as needed for a simu-
lation. with cach passenger representing a unique.
random collection of the required parameters. While
a user can specify any of the values, the more common
situation would be ro depend on the randomizer. In
this manner. the program creates a representative
sample of the American population.

The initial goal of the AIREVAC was to simulate a
certification test. As 3 result. che model lacks capabili-
ties needed for accident recosstruction. such as sime-
lar:on of the debilitating influence of toxic smoke. [=
addition to the physiological debilitation. a mode!
such as AIREVAC with detailed psycho-social simu:
lation capability. needs additional parameters zo de-
scttbe someone's reaction to 2n emergency. For
example. parameters describing someone's panic be-
havior. bonding of families. etc.. have been suggested
as being important in an emergency. and not necessar-
ily important im a certification tess. Thus. for
ATREVAC to perform accident reconstruction :t not
only needs a means to simulate the rozic environment
found in an accident. but also to samulare people's
behavior in that situation.

Exopus

EXODUS was developed ia conjunction with com-
putational fire dynamics {CFD} modeling research
conducted ar the University of Greenwich in En-
gland. CFD attempts to siraulate the growth and
spread of a fire, and to predic: the combustion prod-
ucts and temperatures that result from a fire. In
conjunction with this research. Ed Galea developed
EXODUS (6} to simulate emergency evacuation of an
aircraft. Galea has proposed and used EXODUS to
simulate evacuations in other situations that find large

numbers of people in an enclosed space, in close
proximity to each other, with a limited number of
exits, and exposed to z fire. In addition to aircraft, the
model has been and/or can be used to simulate evacu-
ation from trains, theaters, cinemas, and lecture halls.
EXODUS isa separate program from the CFD model,
but it can accept information calculated by a CFD
model about the cabin environment. EXODUS can
also accept information empirical data co!lected from
fire tests. Because EXODUS car accept detailed cabin
environmental data it has the ability to perform acci-
deni reconstructions that feature sophisticated simu-
lation of the generation and absorption of toxic
environmental elements from the fire {such as carbon
moncide. hydrogen cyanide. heat. etc.). EXODUS
has been used to simulate both wide-body. dual-aisle
and narrow-body. single-aisle aircraft. The simula-
tion can be used for certification tests and for accident
teconstructions.

EXODUS is an expert system-based simulation.
aad was developed in a software environment devel-
. \. To run G2. and by extension EXO-
S. requires a SUN SPARC-1 workstation. though
work is in progress to place EXODUS onto an INTEL
80-486 based o7 betrer plarform. While EXODUS in
conyuncnes with 3 CFD simulanion is very detailed.
tt requires a level of computer knowledge. and a
sufficoently powerful computes that puts it out of the
reach of aif bur ine mosr sophisticated users. How-
ever. by urself, wich dara from a previously run CFD
mode! cr an expemmens. EXODUS
minutes.

EXODUS fearures an extensive graphical display
of che simulation’s progress and results. detailed in-
formation on how much of the environmental toxins
were absorbed by cach passenger during the test. and
the ume for cach passenger to exit the aircraft. or until
their death. EXODUS is composed of five interacting
components which together describe the evacuation
process of 2 cabin. These five components are:

runt in a few

Movemeat model controls the physical move-
ment of individual passengers. or supervises the
waiting period if movement is not possible.


DOT/FAA/AM-94/11

Office of Aviation Medicine
Washington, D.C. 20591

DTIC
“SCTE 2.
Ly wg 81994 ; S
& os

F

.94- 19570
EE

A289 707

oa wt ‘i EA

A Review of Computer
Evacuation Models and
Their Data Needs

Jeffrey H. Marcus

Civil Aeromedical Instivute
Federal Aviation Administration

Oklahoma City, Oklahoma 73125

May 1994

Final Report

This document is available to the public
through the National Technical Information
Service, Springfield, Virginia 22161.

@

U.S. Department wwe
of Transportation ee TM

Federal Aviation
Adminisiratios

94 6°27 094


Validation of Modeis

For any model to be used with confidence, the
accuracy of the model must be validated. Of the
models discussed in this paper, validation efforts have
canged from matching certification tests, as was done
wich the GPSS models developed at CAMI in the
1970s, to accident reconstructions, as attempted by
Gourary. The validation work of Galea with EXO-
DUS (6) may be the most extensive including an
accident reconstruction (the British Airtours Manches-
ter accident), a hypothetical case (2 wide body air-
craft), and replicating carefully controlled experimental
evacuation t-sts run by Muir. In all cases, the simula-
tion results are based on a sample of runs to introduce
the inherent variability in any stochastic process, yet
the results are compared to a single test (or accident)
from 2n equally stochastic process. That there wili be
some variation is unavoidable. The general conclu-
sion of all model development activities has been that
the models match the trends szen in the real world,
but that differences do exist. These differences are
generally attribured to limited information fer use in
describing the system to the model.

Accident reconstructions are 2 more formidable
validation exercise. In addition to the variability from
being a stochastic system, there are a great many
unknowns in an accident. Neglecting details, such as
how the fire starts, and how quickly it spreads, it is
frequently difficult or impossible te obtain such basic
information as the age, gender, weight, physical con-
dition, and/or actual seated location of the passengers
in the plane. Other critical information, such as the
time for door opening and slide inflation is even more
difficult to obtain. Thus, ifan accident reconstruction
is to be used as a validation basis, one cannot expect an
exact match. General tren”s, such as che location and
number of fatalities demonstrates the accuracy of the
model. An interesting possibility with accident recen-
structions is te study the influence of potential design
changes (e.g., moving the location of an exit, or
changing the type of exit and the resulting Sow rate)
on the number of fatalities resulting from the acci-
dent.

Data from cert::ication type tests should be more
easily available, have more available information (such
as complete subject descriptions and seating loca-

dens), and!
of a fire. While this makes them more suitable in the

<s confounding factors, such as the spread
early stages of a validation exercise, it aleo means that
the model has not been validated to study real or
potentially ree! accident sitcations. Perhaps the best
validation exercise would be a ser of careful!
trolied evacuation tests with only a few experimental
variables. Validation exercises such as these would
include detailed information fer use in the develop-

ly con-

ment ef a model’s parameter data set, and evaluation
of the sensitivity of the model’s results to various
parameters. While toxic smoke cannot ethically be
introduced into a cabin full of people, non-toxic
theatrical smoke thaz obscures vision can be used in

validation exercises.
SuMMARY

After an aircraft accident occurs, quick evacuation
of she cabin may be the most important factor influ-
encing survivability of the accident. The FAA has a
variety of regulations regarding training, operation,
and design of aircraft to ensure as fast a cabin evacu-
ation as possible. In order to Setter understand factors
that influence the evacuation process, to understand
the evacuation process in accidents, and to provide
guidance at an early stage in the design cycle of new
aircraft, computerized simulations ofan aircraft cabin's
evacuation have bren studied.

In the 1970s CAMi deveioped and used a comput-
erized cabin evacuation model that required a large
mainfr.me computer, and whose output was not
easily interpreted. While the model did not exactly
match certificatic trials of some current aircraft, the
model held the promise that if all necessary param-
eters could be defined, computerized evacuation mod-

eling could become a powerful tool in the design of

safer aircraft. Today, there are th:
various stages of development.
in the mid-1980s CAMI sought to develop a new
computer model! that could run on an inexpensive
personal computer in near real time, that would pro-
duce an easy-to-understand visual display, and tae
could be easily modified by a nen-programmer. The
GA Model. developed from this effort, is available
today. While meeting che model development's origi-

ret leading models in

1


queue exists, the model must simulate the behavior of
people in deciding who goes first. The models differ in
their approaches to this type of behavior. While the
models differ, and asa resz!: have different data needs,
there are common data needs even though the manner
in which this information is used may differ. Param-
eters affecting flow rates are not independent of pa-
rameters affecting queuing. Ifa slow moving passenger
is at the front of a line, no one in that line can move

faster than that slowest passenger. However, if a faster
passenger who is behind becomes impatient, and has
the desire and physical ability to cut the line, thar
faster passenger can get out before the slower passen-
ger.

The models vary in how they simulate strength,
agility, and resistance to the toxic effects of smoke.
Each model has a unique approach to simulating the
cabin environment, ranging from AIREVAC that
cannot simulate an environment other than clear,
clean air, to EXODUS that can be run with 2 very
sophisticated computational fire dynamics model to
accurately predict the combustion product toxins in
the atmosphere at each individual location in the
cabin, and how much of the toxins are absorbed over
time as a passenger moves through the cabin.

Research at CAMI has examined many aspects of
evacuation performance from passenger aircraft (8,
11-16). The Blethrow report (15) is particularly use-
ful for quantifying the agility of an escaping passen-
ger, and how this agility is reduced by physical
impairments such as blindness, obesity, or old age.
Data relating to evacuation rates through doors aad
down slides may also be obtained from airframe man-
ufacturer’s research (18-26). All of the evacuation
models allow for the specification of passenger age,
gender, and indications of mobility impairments.
While age and gender are stored, there is no direct
relationship in any of the models between these fac-
tors and the passenger's speed, agility. or endurance.
Many evacuation studies have identified gender as a
factor that influences a passenger's speed and agility,
but there are no widely agreed upon factors t¢ quan-
tify these influences. A recent evacuation study at
CAMI, in which age was a controlled variable (21),
found that a younger group of test subjects evacuated
the cabin over 25% faster than an older group in the

same cabin configuration. Other factors that

ay
influence a passenger’s speed, such ax bonding of
husband and wife, or parent and child, have been
identified 5y model developers, but never quantified.

Data for use in quantifying the time needed by a
Passenger to perceive thac the plane has stopped.
unfasten the seat belt, get out of the seat, and begin to
move purposefully to an exit are not generally avail-
able, but are essential parameters for any simulation.
Times to prepare and open doors, and make evacua-
tion slides ready for use, are other factors not generally
available. These parameters are particularly impor-
tant in accident reconstructions, yet are virtually
impossibie to determine from accident investigations.
If the plane is on fire, who is going to time how long
it takes to get the door epen rather than trying to assist
in the rescue?

Parameters needed to node! the toxic effects of
smoke and heat from a cabin fire are difficult to
obtain. A complicating factor is that in an aircraft fire,
time to incapacitation may be more importani than is
time to death. In general, incapacitation occurs long
before death does, but death is iikely in an aircraft fire
ifa passenger is incapacitated. EXODUS (6) uses, and
AIREVAC (17) noted for future application, the work
of Purser (22) in defining fractional doses of typical
aircraft fire toxins, and the threat ro tife that these
represent. Using data from a derailed computationa!
fire dynamics model, EXODUS can provide a very
good simulstion of the combusticn products pre-
sented over time to passengers as they
cabin. Computatienal fire dynamics modeling i:
very sophisticated, specialized, and complicated sub-
ject far beyond the scope of this paper to discuss. The
ed to (6) as a starting point

nove about the

2

interested reader is refe
for more information.

The psycho-social reaction of passengers in a fire,
for use in an accident reconstruction, may differ fom
the behavior seen in a certification test. Muir (10) has
studied differences in cabin evacuations between a
certification type of test, and evacuation tests in which
a simulated panic occurred. Schroeder (17), as part of
ig AIREVAC, considered how to
model passenger behavior in a fire.

his work develo:



ments within the cabin. For each zone, at some user
defined time in the simulation, the environment ia
each zone goes from completely non-toxic. to some
degree of life impairing. The toxicity of the cabin
the
life impairment function cannot be based on a func-

environment is different in each zone. however

tion of time, and there is no transition between zones.
The toxicity of the environment is specified by a
numeric value. This value is an additional decrement
per simulation clock tick in cach passenger's endur-
ance. Little guidance is available for determining
these values.

When the program was originally developed. prob-
lems were noted with blocked passenger flows. Two
situations in which t

is occurred were when a cell on
the path to an exit was blocked by two fatalities. and
when two groups of passengers going in opposite
directions (e.g., one group headed for the forward
exit, the second group headed for the rear exiti met at
the same cell. In the situation with two faralities in a
cell, it was no longer possible for other surviving
Passengers to pass through. While this is not an
impossible situation. there is a distinct possibility thar
in areal situation, a still surviving passenger secking to
exit would get around the fatalities blocking the path.
Since the original release, the GA model has been
modified to simulate the possibility of passage. albcit
with a reduced probability {implying a slower speed}
through a blocked cell. The problem with opposed
flows would result in the flow halting while cack side
tried te pass the other. While the question of what
would happen in 2 real situation is unresolved (would
not people in one of the two flows think that the other
people knew where they were going?). the program
has been modified to introduce a probability to each
fiow of passing the other.

As examples and validation of the GA Model.
Gourary reconstructed three accidents. and modeled
the aircraft used in some of these accidents in simu-
lated certification tests (i.c., without the environmen-
tal toxins being turned on}(4). The three accidents
reconstructed were I) United DC-8 with 114 passen-
2) United B-727,
Salt Lake City, November 1965 with 85 passengers on
board; 3) Texas international DC-9, Denver, Colo-
rado, November 1976 with 81 passengers. The first

gers, Denver, Colorado, July 1961;

two accidents were simulated because exquisitely de-

tailed accident investigations were avatlable in (8).
The third case was selected as being an caample of
where the GA Model could be apptied. In performing
these simulations Gourary (4) noted the limitations of
the data upon which to base modeling parameters,
and in the case of the Texas International DC-9, the
lack of information from the accident inve!

AIREVAC Model
AIREVAC was developed
nally of he Southwest Research Instttute. under spon

yw James Schrocder. orig:

sorship of the Air Transport Association
AIREVAC was deveiog
late a certification test. and nor for acids:
AIREVAG was developed ro

study the impact on aircraf: emergency vabrn evacua-

America (5. i

struction. In particulas

tions of transporting disabled passengers. While

was the immediate goal. Schroeder sa: to develon

2 model with potentially wid

tapphcatiens

Within the guidelines provided by ATA. Schrocde:

developed a mode! of a cerafi

1On vacua!
tie.. no simulated fire or other environm
saults} of a B-727-200 aircraft.

The medei van

late any number of passengers up to the capa.
plane, but cannor be used without reprogr

seeithera wide-hods .

simulate any other type of a

dual-

isle or a narrow-body. single-assie arrcrafi other:

than a B. - However, the mode! can be repro:
grammed to simulate other twpes ar
of aircraft. though this requires a user knowledgeable

of Simscript.
AIREVAC.

Simscript is a specialized. relarwely unknown com

the computer language used bv

puter language used for simulating systems. AIREVAC
was developed and runs on a SUN Workstatton,
though wark ts in progress ro port it to an [nicl SOL86-
based machine. The program runs much more dow iy

than real time. and to simulate 90 seconds an
evacuation of 2 full plane takes several hours. The
smaller the passenger load, the faster the simulanon
runs. The simulation clock runs at 5 ticks per second

Schroeder's mode! uses many of the parameters
commonly required by an evacuation model. such as
number of passengers, their location. and their speed

of movement. However, AIREVAC features a de-


A Review of Computer EvacuaTION MODELS
AND THEIR Data NEEDS

INTRODUCTION

The situation found in passenger carrying aircraft
may be a fire safety official’s “worst nightmare.”
Potentially hundreds of passengers are closely seated
in a long, narrow aluminum tube, surrounded by tens
of thousands of gallons of highly flammable jer fuel.
Should a fire begin as a result of some mishap, it is
essential that all of these people evacuate the aircraft
in the shortest possible time. Indeed, in most major
aircraft accidents, all of the cabin occupants are alive
at che moment that the airplane stops, but perish
while trying to escape from the fire that follows. To
ensure that passengers will survive an aircraft acci-
dent, the Federal Aviation Administration (FAA) re-
quires manufacturers and operators of airliners to
meet a number of design and performance standards
related to cabin evacuation. Among the most contro-
versial of these regulations is what is commonly called
The 90 Second Rule (23). This regulation requires
that a manufacturer demonstrate that an aircraft cabin
can be safely evacuated in less than 90 seconds with
half of the usable exits blocked, in darkness, and with
a defined mix of gender and age among the simulated
passengers. These demonstration tests are expensive
to run, and are ethically questionable because of the
very real possibility of some of the test subjects being
injured in a test.

Given that safe evacuatien is so critical to surviving
an aircraft accident, and that showing compliance
with the 90 second rule can be so burdensome, a
computer simulation of the evacuation of an aircraft
cabin is needed. A proven, validated computerized
simulation tool could address several needs. As an
accident reconstruction tool, such a simulation can
provide insight into why some passengers perish while
others survive, and how the design of the cabin might
be modified to improve survivability. Aircraft design-
ers would have a tool to make evacuation issues a
consideration early in the design cycle —when changes
are easily made. The FAA would have a tool available
to assist in analyzing evacuation issues that confront

the Agency.

Modeling Fundamentals

Evacu:ation models tend to be of two categories,
network models, and queuing models (1). Virtually
all models of aircraft evacuation are queuing models,
as are many building evacuation models. Network
models nave been used to simulate building evacua-
tions (1), a prominent example being EVACNET+,
developed by the National Institute for Standards and
Testing (NIST, formerly the Bureau of Standards).
Network models develop paths between people and
exits, and then use graph theory and combinatorial
analysis to simulate the resulting evacuation. For a
variety of reasons, aircraft evacuation simulations
have been queuing modeis, rather than network mod-
els.

‘Whenever the current demand fora service (such as
exiting an aircraft) exceeds the current capacity tc
provide a service, a queue (i.e., a line) results(1).
Queuing theory is the body of knowledge that de-
scribes the dynamics of waiting lines. Mathematically,
a queuing situation is a stochastic process in that it
develops over time, and obeys the laws of probability.
Thus, cabin evacuation models may be considered to
be simulations of the formation and processing of
lines at aircraft exits during emergencies.

Because queuing is a stochastic process, it is neces-
sary to introduce a randomizer into the simulation.
Common, non-computer related randomizers include
items such as the throw of dice, or a deck of playing
cards. With computers, mathematical routines gene --
ate a series of random numbers that are then used in
decisions in the simulation. For example, assume that
there is a 70% chance of moving from one section of
an aircraft cabin to another. A random number be-
tween 0 and 1 is generated, and if that number is less
than or equal to 0.7, then the simulated passenger
moves. If the number is greater than 0.7, the simu-
lated passenger does not move. Random number
generators may have different probzbility distribu-
tions, but for evacuation models usually generate a
uniform distribution. Random number generators
typically need a starting value to calculate the candom

{ List

lel)


Technical Report Documentation Page

1 Report No

DOT/FAA/AM-94/11

2. Government Accession No

3 Recipient's Catalog No

4 Title and Subttle

A Review of Computer Evacuation Models and Their Data Needs

5. Report Date

May 1994

6. Performing Organization Code

7. Author(s)

Jeffrey H. Marcus

8. Performing Organization Report No.

9. Performing Organization Name and Address

FAA Civil Aeromedical Institute
P.O. Box 25082
Oklahoma City, OK 73125

10. Work Unit No. (TRAIS)

11. Contract or Grant No.

12. Sponsoring Agency name and Address

Office of Aviation Medicine
Federal Aviation Ad:ainistration
800 Independence Avenue, S.W.
Washington, DC 20591

13. Type of Report and Period Covered

44. Sponsoring Agency Code

15, Supplemental Notes

16. Abstract

This document reviews the history and current status of computer models of the evacuation of an airliner
cabin. Basic concepts upon which evacuation models are based are discussed, foliowed by a review of the
Civil Aeromedical Institute’s efforts during the 1970s. A comparison is made of the three models
available today (GA Model, AIREVAC, and EXODUS). The report then reviews parameters common to
all models, and discusses literature available as a basis for these parameters. Finally, the report briefly

discusses validation exercises for evacuation models.

17. Key Words

Computer model
Evacuation
Cabin safety

18. Distribution Statement

Document is available to the public through the

National Technical Information Service,
Springfield, Virginia 22161.

19. Security Classif (of this report)

Unclassified

T
20. Secunty Classif. {of this page}

Unclassified

21 No of Pages

14

22. Price

Form DOT F 1700.7 (8-72)

Reproduction of completed page authorized


NOTICE

This document is disseminated under the sponsorship of
the U.S. Department of Transportation in the interest of
information exchange. The United States Government
assumes no liability for the contents or use thereof.


nal goals, the model is limited by 2 crude cabin
environment model, and by the inabil

'¥ to simulate
2 wide-body, dual-aisie aircraft.

The Air Transport Association sponsored the de-
velopment ofa cabin evacuation model, pri
assess the impact on evacuation perform:

ce of carry-
ing mobility-impaired passengers. The resulting model,
AIREVAC, has a detailed simulation of a passenger's
psycho-social responses to an evacuation, but as pres-
ently constructed, it can only represent a single model
of an aircraft, and cannot simulate a fire (i.c., it is not
suitable for accident reconstruction, but only for
certificatioa tests).

EXODUS offers the ability to pe-‘orm detailed
simulations of the toxic effects of an aircraft fire. The
simulation has already been used successfully to simu-
lace a wide-body aircraft, a series of evacuation tests at
the Cranfield Institme, and to reconstruct the 1985
Manchester, England, 3-737 accident.

All models depend on parameters to describe the
system being analyzed. Most evacuation model devel-
opers have noted the limitations on sources of data
upon which to base needed parameter values, and
attributed limitations in the accuracy of their models
to these shortcomings in the available data. in this
paper, many of the available sources of data were
identified, and an even more complete description
may be found in Schroeder {17). In the future when
evacuation tests are planned, consideration should be
given to obtaining data that will be useful in the
determination of modeling parameters.

The validation of evacuation models can be based
on three possible sources. The most challenging is to
reconstruct accidents. Given the formidable nature of
this method, exact agreement is not expected, only a
general agreement in the location and number of
fatalities can be expected. Simulation of certification
tests is simpler, and certification tests may have more
information available for the modeler. However, the
best validation exercises will be evacuation tests de-
signed explicitly to serve as validation tools for com-
puter models.

REFERENCES

~

10.

Watis, J. M., “Computer Models for Evacuation
Analysis,” pp. 237-245, Fire Safety journal, 12
(£987), Elsevier Sequoia, the Netherlands

Folk, £. D., Garner, J. D., Cook, E.A., Broadhurst,
J GPSS/360 Computer Models to Simulate Air-
craft Passenger Emergency Evacuation,
FAA-AM-72-30, U.S. Department of Transpor-
tation, Federal Aviation Administration, Seprem-
ber, 1972

Garner, J. D., Chandler, R. F., Cook, E. A., GPSS
Compuzer Simulation of Aircraft Passenger Emer-
gency Evacuations, FAA-AM-78-23, U.S. Depart
ment of Transportation, Federal Aviation Admin-
istration, June, 1978

Gourary, B. S., Simudation of Evacuation From a
Single-Aisle Airplane: A Comprehensive Report, drak
final report submitted to the FAA, Occober, 1992

Schroeder, J. E., Grant, T., Tuttle, M. L., “Mod-
cling Human Behavior in Aircraft Evacuations,”
in j. J. Swain and D. Goldsman (ed) Proceedings of
the 1992 Winter Simulation Conference, School of
Industrial and Systems Engineering. Georgia In-
stitute of Technology, 1992

Galea, E. R., Perez Galparsoro, J. M.. EXODUS:
An Evacuation Model for Mass Transport V-hicles,
CAA Paper 93006, published by the Civil Avia-
tion Authority of the United Kingdom, London,
March 1993

G2 Reference Manual, Gensym Corporation, 125
Cambridge Park Drive, Cambridge, Massachu-
setts

Snow, C. S., Carroll, J. J., Algood, M.A., Survival
In Emergency Escape From Passenger Aircrafs, FAA-
AM-70-16, U. S. Department of Transportation,
Federal Aviation Administration, October, 1970

King, D. F., Report on she Accidenz to Boeing 737-
236 series 1, G-BGji. at Manchester International
Ainport on 22 August 1985., Aircraft Accident Re-
por 8/88, HMSO London 1988

Muir, H., Marrison, C., Evans, A., Aircraft Evacu-
ations: The Effect of Passenger Motivation and Cabin
Configuration Adjacent to the Exis, CAA Paper
89019, ISBN 0 86039 406 9, 1989