Integrated, Sensor-Enabled Safety Zones for Airport Maintenance Repair Operations (MRO): A TRL-Guided Engineering Framework for Continuous Personnel Protection

Abstract

Airport and hangar Maintenance Repair Operations (MRO) concentrate high-energy hazards—moving aircraft, energized systems, overhead loads, jet blast, vehicle traffic, and increasingly automated equipment—into spatially constrained work areas with variable staffing, contractor turnover, and time pressure. Although Safety Management Systems (SMS) provide a robust organizational framework, many injuries still arise from proximal human–machine interactions that are difficult to control using procedural defenses alone. This paper proposes a technical engineering solution: an integrated, sensor-enabled safety system that continuously tracks personnel and visitors in real time, enforces controlled access to aircraft safety zones, and maintains safe separation distances between people and mobile or automated machinery (e.g., cranes, forklifts, robotic platforms, and automated guided vehicles). The contribution is twofold: (i) a TRL-informed analysis that identifies value-added research gaps at the intersection of industrial real-time location, machine safety, and aviation maintenance; and (ii) a reference architecture and validation methodology that can be advanced from pilot demonstrations to operational deployment. The design emphasizes dependable proximity awareness under airport constraints (metallic multipath, occlusion, mixed indoor/outdoor operation, personal protective equipment (PPE), cybersecurity, privacy, and low-latency alarms). We present requirements, a multi-sensor fusion approach, safety logic for dynamic geofencing, and a verification/validation plan aligned with authoritative aviation and machinery safety guidance. Illustrative performance and risk-reduction modeling are provided to guide experimental design and to expose the primary uncertainty drivers that future research must retire to increase Technology Readiness Levels (TRLs) for operational MRO use.

Keywords: safety, sensors, airplane safety, MRO, workplace safety, TRL

1. Introduction

1.1 Motivation: Proximal Hazards in MRO as a Systems Engineering Problem

Airport maintenance safety sits at an uncomfortable boundary: aviation inherits a mature safety culture and rigorous regulatory oversight, while MRO work environments resemble heavy industry—dense, dynamic, and reliant on coordinated movement among people, vehicles, tools, and equipment. The resulting injury modes frequently involve short-range, fast-evolving interactions (e.g., a pedestrian stepping into an active tow path; a worker under a suspended load; a visitor entering an engine-run area; a maintainer positioned near a moving flight-control surface; or a person inadvertently approaching automated machinery). These scenarios are not always well mitigated by signage, training, and spotters, especially when visibility is poor, work is time-critical, or multiple contractors are present.

Safety Management Systems (SMS) remain the foundational organizational approach for identifying hazards and managing risk in aviation operations, including ground activities. ICAO’s SMS framework emphasizes hazard identification, risk management, assurance, and promotion [1], with operational guidance in the Safety Management Manual [2]. The FAA provides SMS guidance for aviation service providers [3]. However, SMS does not prescribe specific sensor and automation capabilities for controlling near-field human–machine risk in MRO settings. In parallel, MRO work is regulated through maintenance organization requirements (e.g., EASA Part-145 and associated continuing airworthiness rules) [4] and, in the United States, through 14 CFR Part 145 [5], while workplace safety constraints also inherit industrial requirements (e.g., OSHA) [6]. The safety challenge is thus multi-regime: aviation compliance, industrial workplace safety, and—emerging rapidly—robotics and automated vehicle safety.

This paper frames airport maintenance safety as a technical system design challenge: engineering a dependable, sensor-enabled safety layer that (a) provides continuous, real-time tracking of personnel and visitors operating near aircraft and high-risk equipment; (b) enforces controlled access to aircraft safety zones; and (c) maintains safe separation distances between humans and mobile/automated machinery using credible, low-latency proximity awareness. The system is intended to be integrated with MRO procedures and airport ground vehicle operations guidance [7], as well as with industry ground operations practices (e.g., IATA procedures) [8].

1.2 Scope and Operational Design Domain (ODD)

The proposed system targets MRO environments spanning indoor hangars, ramps/aprons, and transitional areas. The ODD includes:

• Aircraft types: small and large fixed-wing aircraft; rotorcraft; and emerging unmanned aircraft operating in maintenance areas (e.g., inspection drones).
• Work contexts: line maintenance at the gate, hangar checks, engine runs, towing/pushback support, avionics/electrical troubleshooting, structural repairs, and component shop flows adjacent to aircraft movement areas.
• Actors: certified technicians, inspectors, engineers, cleaners, fueling teams, tug operators, contractors, and escorted visitors.
• Mobile hazards: tugs, forklifts, catering vehicles, de-icing trucks, cranes, scissor lifts, dollies, and—where adopted—AGVs and robotic platforms.

We explicitly exclude flight safety functions and do not propose any onboard aircraft modification that would require airborne certification pathways. The system is a ground safety system for workplace safety risk reduction. Where the system interfaces with aircraft (e.g., to detect “engine run” state), it does so through non-intrusive maintenance tooling interfaces and/or existing ground procedures rather than flight-critical connections.

1.3 Related Work and Limitations of Current Practice

Current airport ground safety controls typically combine procedural restrictions (cones, painted lines, marshaling rules), training, spotters, and vehicle operating rules [7], supported by SMS risk processes [1]-[3]. Hangar construction and fire safety standards (e.g., NFPA 409) govern major facility hazards [9]. Human factors research has repeatedly shown that procedural defenses can fail under time pressure, fatigue, workload, and organizational complexity; the “Swiss cheese” model remains a useful conceptual frame for how multiple weak defenses align to permit an accident [10]. For maintenance-specific human factors training, regulators emphasize communication, documentation, and threat and error management (e.g., FAA guidance and civil aviation authority materials) [11], [12].

Meanwhile, industrial sectors increasingly deploy sensor systems for localization, access control, and machine guarding. Real-time location systems (RTLS) and proximity detection technologies—using ultra-wideband (UWB), Bluetooth Low Energy (BLE), computer vision, LiDAR, and inertial sensors—are widely studied in indoor positioning surveys [13]-[16]. Machine safety standards define requirements and design principles for control system reliability, functional safety, and collaborative operation near robots and driverless trucks [17]-[22]. Yet, direct translation into MRO is not straightforward: airport environments involve large metallic structures, strong multipath, occlusions around aircraft bodies, mixed indoor/outdoor operation, and a complex social environment with visitors and contractors. In addition, MRO workflows impose strict constraints on PPE, electrostatic discharge (ESD), tool control, and interference with aircraft systems. These constraints create research gaps in how to engineer dependable proximity awareness that remains robust enough to support safety-critical interventions in an operational hangar or ramp.

1.4 Contribution and Value-Added Research Direction

The goal of this paper is not to duplicate existing RTLS or robotics safety research, but to identify gaps and propose value-added research that can measurably improve workplace safety in MRO. We contribute:

1. A hazard-driven requirements set tailored to airport maintenance safety, mapped to authoritative aviation and industrial safety expectations.
2. A reference architecture for an integrated, sensor-enabled safety system with dynamic geofencing, controlled access, and dependable proximity alerts.
3. A TRL-guided research plan using established TRL concepts [23] to identify which components are mature versus which require focused research and demonstration to advance readiness for operational MRO deployment.
4. A validation methodology (metrics, scenarios, and test design) to quantify safety benefit without overstating evidence where uncertainty remains.

2. Hazard Analysis and System Requirements

2.1 Hazard Taxonomy for Airport Maintenance Safety

MRO hazards can be categorized by energy source and interaction geometry. Table 1 provides a practical taxonomy for sensor-enabled mitigation. The purpose is to define what the system must detect and control, not to replace formal hazard analysis processes used by organizations under SMS.

Table 1: Hazard taxonomy for airport maintenance safety and candidate sensing/control mechanisms (author-generated).

2.2 Safety Zones as an Engineering Abstraction

MRO sites already use informal “zones” (e.g., cone boundaries, painted lines). This paper formalizes zones into machine-readable, sensor-enforced geofences whose geometry and rules are tied to hazard state. For example, a “static” aircraft exclusion zone may exist whenever an aircraft is on jacks; a “dynamic” jet blast zone expands when an engine run is active and contracts when the engine is shut down. Airport design guidance and operating procedures recognize the importance of managing such hazards, including jet blast considerations as part of airport design and operations [24].

The core engineering proposition is that zones should be: (i) explicit (defined in a digital map), (ii) stateful (change with hazard state), (iii) enforceable (access control and alarms), and (iv) auditable (logged for safety assurance under SMS).

Figure 1 provides a conceptual diagram of zone-based protection around an aircraft and nearby mobile equipment.

2.3 Requirements: Functional, Performance, and Assurance

Requirements must reflect both workplace safety expectations and practical constraints (comfort, PPE, battery life, latency, privacy). Table 2 summarizes a baseline requirement set. Numeric values should be treated as starting points for engineering trade studies rather than universal targets; different MRO sites will impose different constraints (hangar size, density, aircraft type, local procedures).

Table 2: Baseline requirements for a sensor-enabled safety system in airport MRO (author-generated).

2.4 Standards and Safety Alignment (Aviation + Machinery Safety)

Because this system intervenes in workplace safety decisions, its engineering must be aligned with credible safety expectations. For human–robot and machine proximity contexts, relevant machinery safety standards include industrial robot safety requirements [17], collaborative operation guidance [18], and driverless industrial truck/AGV safety requirements [19]. Functional safety of control systems is commonly addressed via standards such as ISO 13849-1 [20] and IEC 61508 [21]. While these standards do not map one-to-one onto aviation MRO, they offer mature patterns for redundancy, diagnostics, and safety integrity arguments—precisely the types of arguments required if a proximity system is expected to influence behavior beyond advisory alarms (e.g., controlling access gates or commanding equipment slow-down).

Aviation maintenance organizations also maintain required training and human factors practices (e.g., FAA guidance and CAA human factors publications) [11], [12]. The proposed system should therefore be designed as an augmentation to established controls, with explicit procedures for use, limitations, and degraded modes consistent with SMS expectations [1]-[3].

3. Technology Readiness Levels (TRL) and Research Gap Analysis

3.1 Why TRL Is Useful for Airport Maintenance Safety Technology

Technology Readiness Levels (TRLs) provide a structured way to evaluate maturity from concept to operational deployment. TRL is widely credited to NASA practice and was articulated for broader use by Mankins [23]. For MRO safety technology, TRL analysis helps prevent a common failure mode: integrating individually mature components (e.g., UWB tags, BLE beacons, dashboards) into a system that is not mature as an end-to-end safety function in the target environment (hangars and ramps). In other words, component TRL does not guarantee system TRL.

3.2 Component vs. System TRL

Table 3 summarizes a representative TRL assessment. The values are intentionally conservative; they assume a demanding operational environment and the need for dependable, low-latency performance. A key theme is that localization hardware may be relatively mature, but assurance (safety case, failure handling, cybersecurity, human factors integration) is often less mature for MRO-specific use.

Table 3: Illustrative TRL assessment for an integrated MRO safety system (author-generated, TRL framing informed by [23]).

3.3 Value-Added Research Gaps (What Is Not Yet “Solved”)

Based on the TRL view and constraints unique to airplane safety and MRO, high-value research gaps include:

• Dependable proximity under aircraft-induced multipath: UWB and BLE perform well in many indoor environments, yet aircraft skins, hangar trusses, and equipment can cause severe reflections. Research is needed on integrity monitoring that quantifies when the system should be trusted versus when it must degrade gracefully.
• Safety logic that is state-aware without invasive aircraft integration: Dynamic geofences require knowledge of hazard state (engine run, hydraulic energization, control-surface actuation). Non-intrusive, workflow-compatible methods for hazard-state detection remain underexplored.
• Alarm systems that reduce injuries without increasing workload: Nuisance alerts erode trust. Research must optimize alert timing, modality, and escalation policies for noisy, PPE-heavy environments.
• Human–robot safety in hangars: Standards exist for robots and driverless industrial trucks [17]-[19], but MRO introduces unusual geometries (under-wing work, engine nacelles, scaffolds) and mixed traffic patterns requiring tailored validation.
• Privacy-preserving safety analytics: Worker tracking data can improve workplace safety, but governance must ensure proportionality and transparency. Technical mechanisms (aggregation, on-device processing, retention minimization) can improve acceptance.

4. System Design and Method

4.1 Reference Architecture

Figure 2 depicts the proposed end-to-end architecture. The system is organized into four layers:

• Sensing layer: wearable tags for personnel/visitors; machine-mounted units for vehicles and mobile machinery; optional environmental sensors (cameras/LiDAR) where permitted.
• Localization and fusion layer: computes positions with uncertainty and integrity metrics using multi-sensor fusion.
• Safety logic layer: evaluates geofence rules, proximity thresholds, time-to-collision estimates, and hazard state to trigger interventions.
• Interaction and integration layer: provides alerts (haptic/audio/visual), access control (e.g., gated doors or virtual permits), and interfaces to MRO systems for audit and safety assurance.

4.2 Sensing Modalities and Engineering Trade Space

Localization and proximity detection can be implemented using multiple sensor technologies; no single modality is universally sufficient in MRO. The design therefore prioritizes complementary redundancy —using multiple imperfect sensors with integrity-aware fusion.

4.2.1 Ultra-Wideband (UWB)

UWB has become a common choice for high-accuracy RTLS because time-based ranging can provide decimeter-level performance in favorable conditions. Its performance, however, is degraded by non-line-of-sight (NLOS) and multipath, issues extensively studied in UWB ranging literature [14], [15]. UWB physical layers and interoperability are influenced by IEEE 802.15.4 and amendments such as 802.15.4z [26], [27]. In MRO, UWB is attractive because it can provide bounded-latency ranging and can be deployed indoors where GNSS is unavailable, but it requires careful anchor placement and robust NLOS handling around aircraft.

4.2.2 Bluetooth Low Energy (BLE) Direction Finding

BLE is widely deployed for presence detection and, with direction finding features introduced in newer Bluetooth specifications, can support angle-of-arrival/angle-of-departure localization [28]. BLE often has lower infrastructure costs than UWB but tends to be more sensitive to multipath for precise positioning and may require higher density of receivers for comparable accuracy.

4.2.3 Vision and LiDAR

Cameras and LiDAR can detect humans and obstacles without requiring wearables, which is attractive for visitors and transient contractors. However, hangar occlusion is frequent (aircraft bodies, stands, tool carts), and privacy constraints may limit camera deployment. From a safety engineering standpoint, vision/LiDAR can provide an independent cross-check for wearable-based systems, particularly near automated equipment, but assurance of performance under all lighting and occlusion conditions remains challenging.

4.2.4 GNSS and Inertial Sensors

Outdoor ramp operations may benefit from GNSS, but hangar interiors are GNSS-denied. Inertial measurement units (IMUs) in wearables can provide short-term dead reckoning and motion classification, which can improve alert relevance (e.g., running vs. standing) and support integrity monitoring by checking physical plausibility.

4.3 Localization With Integrity: From “Best Estimate” to “Trustworthy Estimate”

Many RTLS deployments report accuracy as average position error, but safety decisions require more: the system must know when it might be wrong. This motivates an integrity-aware estimator that outputs both a position estimate and an uncertainty bound. Indoor localization surveys emphasize the diversity of technologies and the importance of environment-dependent performance [13], [16].

We model a tracked entity’s state as position and velocity in a local frame: . A standard discrete-time motion model is:

where is the constant-velocity state transition matrix and is process noise. Measurements from UWB ranging or BLE AoA can be expressed as nonlinear observation models [14], [15], [16]. For example, for a UWB range measurement to anchor at :

with measurement noise . An Extended Kalman Filter (EKF) or factor-graph optimizer can fuse heterogeneous measurements. The critical addition for safety is integrity monitoring : estimating when measurements are inconsistent with each other or with motion constraints (e.g., a sudden “teleport” across the hangar) and then widening uncertainty bounds or declaring degraded mode.

One practical integrity metric is the normalized innovation squared (NIS) for each update, which can be thresholded to detect outliers:

where is the innovation and is the innovation covariance. Persistent NIS violations can indicate NLOS bias, anchor failure, spoofing, or severe multipath. Research is needed to translate such statistical diagnostics into operationally meaningful “trust states” that can drive safety logic without overwhelming users.

4.4 Dynamic Geofencing and Controlled Access

Geofences are digital boundaries with rules governing entry, presence, and transitions. In MRO, geofences should be tied to hazard state and role-based authorization (e.g., only engine-run qualified staff may enter an engine-run zone). A key design decision is to treat geofencing not merely as a visualization feature, but as a real-time safety function with explicit timing and failure requirements.

Figure 3 illustrates how a single aircraft can have multiple concurrent zones: a restricted engine inlet/exhaust zone, a moving control-surface hazard zone, and a vehicle corridor with enforced separation distances.

4.5 Proximity Risk Model: From Distance to Time-to-Contact

Simple distance thresholds can create false alarms (e.g., a worker standing near a parked forklift). For mobile machinery, a better trigger is based on predicted time-to-collision/time-to-contact under uncertainty. Let be the estimated separation distance between a person and a machine, and be the relative closing speed along the line of approach. A basic time-to-contact estimate is:

where is a minimum safe separation distance and prevents division by zero. In practice, and are uncertain. A safety-oriented system should use conservative estimates, e.g., replacing with a lower confidence bound derived from the position covariance and replacing with an upper bound. This creates a probabilistic risk trigger rather than a brittle threshold.

Research gap: while TTC-like constructs are common in collision avoidance, translating them into dependable, low-nuisance alerts in multipath-heavy hangars with intermittent localization dropouts remains an open engineering problem, especially when alerts must occur within short stopping distances.

4.6 Alerting and Human–Machine Interface (HMI)

Alerts must work under hearing protection, high noise, and visually cluttered environments. A multimodal approach is recommended:

• Haptic: vibration patterns on wearable tags to provide private, immediate cues.
• Visual: high-intensity LEDs on tags and fixed beacons near zone boundaries.
• Audio: localized beepers for visitors and transient personnel, with careful use to avoid alarm fatigue.

Escalation should be state-based: advisory → warning → imminent hazard, tied to integrity (confidence) and TTC. The system should explicitly communicate degraded mode (e.g., “tracking uncertain—use procedural controls”). This principle is aligned with safety engineering expectations in machinery contexts, where diagnostics and safe states are essential [20], [21].

4.7 Cybersecurity and Privacy-by-Design

A tracking and safety enforcement system changes the threat surface. Attacks could cause nuisance alarms (availability loss), suppress alarms (integrity loss), or exfiltrate movement data (confidentiality loss). Industrial control system security guidance recommends defense-in-depth, secure authentication, network segmentation, monitoring, and incident response planning [25]. For privacy, worker-tracking acceptance depends on transparency, minimal data retention, and clear governance boundaries between safety and performance management. Technical controls that support privacy-by-design include:

• On-edge processing for real-time alarms, with only event summaries sent to central storage.
• Pseudonymization of identifiers, with role-based re-identification only for investigations.
• Configurable retention windows aligned to safety assurance needs under SMS.

5. Implementation Blueprint

5.1 Hardware Configuration (Illustrative)

A practical implementation can be built using commercially available components and open integration patterns. An illustrative configuration includes:

• Wearable tags: UWB + BLE + IMU, ruggedized, glove-friendly buttons for acknowledgment, and haptic motor; battery sized for a full shift.
• Infrastructure anchors: UWB anchors mounted on hangar walls/trusses; optional BLE antenna arrays for direction finding.
• Machine nodes: tags on forklifts/tugs/cranes/AGVs broadcasting position or ranging with personnel tags; integration with machine speed/state where feasible.
• Edge compute: an industrial PC running localization/fusion, safety logic, and event logging; networked to anchors and beacons.
• Actuators: fixed beacons at entry points; optional gate controllers; optional machine slow-down interface (site-dependent and subject to safety case).

IEEE 802.15.4 and 802.15.4z provide relevant foundations for UWB signaling and ranging enhancements [26], [27]. BLE behavior is governed by Bluetooth core specifications [28]. These standards influence interoperability and can constrain how multi-vendor systems are integrated.

5.2 Software Architecture and Interfaces

The system software can be decomposed into services:

• Localization service: ingests raw ranges/angles/IMU and outputs with covariance and integrity state.
• Zone service: maintains geofence polygons and associated rules (role authorization, escort requirement, hazard state).
• Risk engine: computes proximity and TTC metrics, evaluates rule violations, and triggers alerts.
• Event logger: records alarms, zone entries, integrity degradations, and acknowledgments for safety assurance.
• Integration API: connects to MRO tooling (e.g., work order systems) to pull context such as “engine run scheduled” without exposing sensitive details.

Low-latency safety decisions should run at the edge. Cloud analytics can be used for long-term trend analysis and SMS reporting, but real-time safety functions should not depend on wide-area connectivity.

5.3 Safety Logic: Policy Evaluation and State Machines

Geofence and proximity enforcement can be implemented using explicit state machines that make behavior predictable and auditable. A simplified policy evaluation is shown below.

# Pseudocode (author-generated): real-time safety policy evaluation loop

for each tracked_person p:
    x_p, P_p, integrity_p = localization(p)

    for each zone z:
        if point_in_polygon(x_p, z.geometry):
            if not authorized(p.role, z.rule) or (z.requires_escort and not has_escort(p)):
                trigger_alert(p, level="warning", reason="unauthorized_zone_entry")
                log_event(p, z, "zone_violation", integrity_p)

    for each machine m:
        x_m, P_m, integrity_m = localization(m)
        d = conservative_distance(x_p, P_p, x_m, P_m)
        ttc = conservative_ttc(d, rel_speed(p, m))
        if ttc < THRESH_IMMINENT and integrity_ok(integrity_p, integrity_m):
            trigger_alert(p, level="imminent", reason="machine_proximity")
            trigger_alert(m, level="imminent", reason="person_proximity")
            if m.supports_slowdown:
                command_machine(m, "slowdown")
        elif ttc < THRESH_WARNING:
            trigger_alert(p, level="warning", reason="approaching_machine")

The key is that “conservative” computations use uncertainty bounds rather than point estimates. This is necessary to avoid false negatives when localization uncertainty grows due to multipath or partial occlusion.

5.4 Calibration, Deployment, and Maintainability

Deployment in hangars must accommodate changes: aircraft positions vary, equipment moves, and temporary scaffolding appears. Therefore:

• Anchor geometry survey: anchors must be placed and surveyed; periodic checks detect drift.
• Self-diagnostics: anchors and tags should report health status; integrity monitoring should detect failing nodes.
• Zone templates: reusable aircraft-specific zone templates (e.g., narrow-body vs. wide-body) that are positioned relative to aircraft location markers.
• Change management: zone edits should be controlled and auditable, consistent with SMS assurance expectations [1]-[3].

6. Results and Validation Plan

6.1 Validation Philosophy: Evidence Without Overclaiming

A safety system intended to reduce injuries must be validated beyond “it works in a demo.” Yet, injury outcomes are relatively rare events, making direct statistical proof difficult without large-scale deployment. Therefore, validation should combine: (i) engineering performance metrics (latency, accuracy, integrity), (ii) scenario-based safety testing (near-miss detection, unauthorized entry detection), and (iii) leading indicators (reduced hazardous proximity exposures) that plausibly correlate with injury reduction under SMS risk reasoning.

6.2 Scenario-Based Test Matrix

Table 4 defines a scenario matrix representative of high-risk MRO interactions. Sites should adapt it based on their hazard registers and SMS risk assessments.

Table 4: Illustrative scenario-based validation matrix for MRO proximity safety (author-generated).

6.3 Performance Metrics

Key engineering metrics include:

• End-to-end latency: time from sensor measurement to alert on wearable and/or machine beacon.
• Position error distribution: not only mean/median but tail behavior (e.g., 95th/99th percentile).
• Integrity performance: probability of hazardous misleading information (HMI) analog—how often the system reports high confidence when it is wrong beyond a safety threshold.
• Nuisance alert rate: alerts per hour per worker, stratified by task type; a key driver of adoption.
• Zone compliance indicators: time spent in restricted zones without authorization; frequency of boundary crossings.

6.4 Illustrative Modeling (Not Empirical Results)

To avoid overstating evidence, we provide only illustrative modeling grounded in well-established localization literature. Surveys and analyses show that indoor positioning performance is strongly environment-dependent [13], [16]. UWB ranging performance in multipath and NLOS environments has been deeply studied, emphasizing that biases—not just noise—are critical [14], [15].

Assume a conservative alert rule triggers when TTC in Eq. (4) falls below a threshold . A simplified probability of timely alert can be expressed as:

where is end-to-end latency. This highlights a design reality: even perfect localization cannot compensate for high latency, and low latency cannot compensate for undetected NLOS biases. Thus, research must jointly optimize sensing, fusion, and compute pipeline timing.

We further note that MRO requires mixed indoor/outdoor transitions; GNSS may help outside but becomes unreliable inside. A robust system must treat transitions as first-class validation cases rather than edge conditions.

6.5 Human Factors and Organizational Validation

Human factors are central: if the system is ignored or disabled due to nuisance alarms, its technical performance is irrelevant. Human error theory emphasizes that accidents emerge from interactions among people, technology, and organization, not from isolated mistakes [10]. Maintenance human factors training guidance underscores communication, situational awareness, and procedural compliance [11], [12]. Therefore, evaluation should include:

• Usability testing of wearable form factors with gloves and PPE.
• Alarm comprehension tests under high noise.
• Trust calibration: whether users understand degraded mode and do not over-rely on the system.
• Supervisor workflows for temporary overrides (e.g., controlled entry with authorization) with full audit trails.

7. Discussion: Engineering Challenges, Research Proposals, and TRL Advancement

7.1 From Advisory Alerts to Safety Functions: The Assurance Gap

Many RTLS deployments in industry are advisory (analytics, logistics). MRO safety improvement, however, motivates more direct interventions: controlling access, preventing entry into hazardous zones, and enabling safe human–robot collaboration. The step from “informational” to “safety-related” function is where maturity often collapses. Machinery safety standards emphasize systematic design, diagnostics, and predictable failure behavior for safety functions [20], [21]. Even if a system is not “safety-rated” in a formal sense, its engineering should adopt comparable discipline if it is relied upon for preventing injury.

Research proposal A (high value): develop a safety argument pattern (a “safety case template”) for MRO proximity systems that is aligned with industrial functional safety concepts while remaining compatible with SMS assurance practices [1]-[3]. This would include explicit claims, evidence types, and operational limitations.

7.2 Integrity Monitoring as the Core Technical Differentiator

In hangars, multipath and NLOS can create rare but large errors—exactly the errors that cause safety systems to fail. UWB literature makes clear that multipath/NLOS introduces bias that cannot be treated as Gaussian noise [14], [15]. Indoor localization surveys emphasize environment-specific limitations and the need for hybrid approaches [13], [16].

Research proposal B: create MRO-specific integrity monitoring methods and datasets. This includes collecting synchronized ground truth in hangars with representative aircraft, equipment, and worker motion patterns, then benchmarking algorithms on: (i) tail error behavior, (ii) NLOS detection rates, and (iii) integrity state correctness. The dataset itself would be a major community contribution because MRO environments are underrepresented in public benchmarks.

7.3 Dynamic Hazard State Without Aircraft Intrusion

Dynamic geofences are only as good as their hazard state inputs. Yet many hazard states (engine run, energized hydraulics, control-surface movement) are not easily observable without integrating with aircraft systems—an approach that raises complexity and governance concerns.

Research proposal C: develop non-intrusive hazard-state sensing and inference that leverages (i) procedural signals (work order state, permits), (ii) environmental sensing (acoustic signatures for engine run, vibration), and (iii) tool state (e.g., ground power unit active) while explicitly quantifying confidence and supporting safe fallbacks when state is uncertain.

7.4 Human–Robot Collaboration in MRO: Standards Are Necessary but Not Sufficient

As hangars adopt robotic tugs, AGVs, and automated platforms, human–robot collaboration becomes a realistic near-term scenario. Robot and collaborative operation standards provide critical baselines [17], [18], and driverless truck safety standards address industrial AGVs [19]. However, MRO geometry is distinctive: work often occurs under wings, around landing gear wells, near engine nacelles, and on stands. In addition, “visitors” may be present at unpredictable times.

Research proposal D: define an MRO-specific “human–robot ODD” and scenario library, with standardized tests for separation monitoring and geofence compliance around aircraft geometries. This parallels how autonomous vehicle domains define ODDs, but tailored to hangar/ramp constraints and to the collaborative features allowed by standards.

7.5 Privacy, Governance, and Adoption as TRL Blockers

Even a technically excellent safety system can fail to deploy if privacy and labor concerns are not addressed. Worker tracking can be perceived as surveillance. A credible privacy-by-design approach—technical and procedural—should be treated as a core requirement rather than an afterthought.

Research proposal E: evaluate privacy-preserving architectures (edge processing, pseudonymization, minimal retention) and quantify their impact on safety performance and organizational acceptance. This is a direct path to TRL advancement because it removes a major non-technical barrier to operational trials.

7.6 TRL Advancement Roadmap

Figure 4 summarizes an example TRL roadmap emphasizing integrated demonstration rather than isolated component improvement.

8. Conclusion

Airport maintenance safety demands more than procedural controls; it requires engineered defenses that operate at the speed and proximity of real hazards. This paper proposed a sensor-enabled, integrated safety system for MRO that provides continuous tracking of personnel and visitors, enforces controlled access to aircraft safety zones, and maintains safe separation between humans and mobile or automated machinery. Using a TRL-guided lens, we identified that while enabling sensors (UWB, BLE, vision) are maturing, the primary gaps for MRO deployment are integrity monitoring under aircraft-induced multipath, state-aware geofencing without invasive aircraft integration, human factors designs that avoid nuisance alarms, cybersecurity resilience, and privacy-preserving governance.

The most value-added research directions are those that transform “works in a demo” into “trustworthy in operations”: integrity-aware fusion with published MRO datasets, formalized safety logic with auditable policies, and rigorous scenario-based validation aligned with both SMS practices and machinery safety principles. Advancing these areas will raise system-level TRL and enable credible, scalable deployment that can reduce injuries and near-misses in the high-risk, high-tempo environment of Maintenance Repair Operations.

References