Abstract: Development of reliable power-by-wire actuation systems for both aeronautical and space applications has been sought to eliminate hydraulic systems from aircraft and spacecraft and thus improve safety, efficiency, reliability, and maintainability. The Electrically Powered Actuation Design (EPAD) program was a joint effort between the Air Force, Navy, and NASA to develop and fly a series of actuators validating power-by-wire actuation technology on a primary flight control surface of a tactical aircraft. To achieve this goal, each of the EPAD actuators was installed in place of the standard hydraulic actuator on the left aileron of the NASA F/A-18B Systems Research Aircraft (SRA) and flown throughout the SRA flight envelope. Numerous parameters were recorded, and overall actuator performance was compared with the performance of the standard hydraulic actuator on the opposite wing. This paper discusses the integration and testing of the EPAD electromechanical actuator (EMA) on the SRA. The architecture of the EMA system is discussed, as well as its integration with the F/A-18 flight control system. The flight test program is described, and actuator performance is shown to be very close to that of the standard hydraulic actuator it replaced. Lessons learned during this program are presented and discussed, as well as suggestions for future research.

Abstract: In order to be certified by the FAA, airborne software must comply with the DO-178B standard. For the unit testing of safety-critical software, this standard requires the testing process to meet a source code coverage criterion called Modified Condition/Decision Coverage. This part of the standard is controversial in the aviation community, partially because of perceived high cost and low effectiveness. Arguments have been made that the criterion is unrelated to the safety of the software and does not find errors that are not detected by functional testing. In this paper, we present the results of an empirical study that compared functional testing and functional testing augmented with test cases to satisfy MC/DC coverage. The evaluation was performed during the testing of the attitude control software for the HETE-2 (High Energy Transient Explorer) scientific satellite (since that time, the software has been modified). We found in our study that the test cases generated to satisfy the MC/DC coverage requirement detected important errors nor detectable by functional testing. We also found that although MC/DC coverage testing took a considerable amount of resources (about 40% of the total testing time), it was not significantly more difficult than satisfying condition/decision coverage and it found errors that could not have been found with that lower level of structural coverage.

Abstract: Modern systems such as fly-by-wire aircraft, nuclear power plants, manufacturing facilities, battlefields, etc. are all examples of highly connected network enabled systems. Many of these systems are also mission critical, and need to be monitored round the clock. Such systems typically consist of embedded sensors in networked subsystems that can transmit data to central (or remote) monitoring stations. Moreover, many legacy systems were originally not designed for real-time onboard diagnosis, but are safety critical, and would benefit from such a solution. Embedding additional software or hardware in such systems is often considered too intrusive, and introduces flight safety and validation concerns. Such systems can be equipped to transmit the sensor data to a remote-processing center for continuous health monitoring. At Qualtech Systems, we are developing a Remote Diagnosis Server (RDS) that can support multiple simultaneous diagnostic sessions from a variety of remote systems. The RDS server is built on a three-tier architecture with a "Broker" application in the middle layer, and multiple TEAMS-RT and TEAMATE based reasoners at the backend. The client layer consists of sensor agents that collect test results and transmit them over a message-passing network. The resultant solution is remarkably efficient. Even an old 50 MHz Sparc20 can support tens of concurrent sessions involving hundreds of tests. The solution scales easily to hundreds of sessions in any modern workstation or server. Inspired by the significant interest from the aerospace community, we are enhancing the scalability of our RDS solution to solve huge and complex systems such as system-wide health monitoring of the International Space station or a fleet of commercial jetliners. We also recently won an STTR from NASA to make RDS accessible to automobiles and appliances over standard wireless telephone networks.

Abstract: As computer and software technologies have advanced, the approach of Integrated Modular Avionics (IMA) has emerged in the field of avionics systems. The IMA approach can dramatically reduce production and maintenance costs and increase reliability of these safety-critical real time systems. The IMA hardware and foundation software must be able to provide guarantees to the application software so that the real-time constraints of all applications are simultaneously satisfied. In addition, each application must be protected from interference by other applications and the operating system software must itself be protected while physically sharing resources such as processors and communication hardware and busses. In other words, an IMA implementation requires that the concepts of spatial and temporal partitioning are provided and guaranteed. This paper introduces a scheduling tool and its algorithms that can be used to solve the fundamental temporal partitioning problems together with implementation related practical constraints. Based on the two-level scheduling hierarchy architecture of ARINC IMA standards, we model an IMA system composed of multiple partition servers and channel servers. A partition server models a protected application that may be composed of multiple concurrent tasks. A channel server provides temporally and spatially protected message transmission among applications. The ultimate objective of the tool is to provide schedules for both tasks and messages that provide for robust temporal partitioning.

Abstract: Complex control systems for autonomous vehicles require integrating new control algorithms with a variety of different component technologies and resources. These components are often supported on different types of hardware platforms and operating systems and often must interact in a distributed environment (e.g., in communication with a groundstation, mothership, or other UAVs in a swarm). At the same time, the configuration and integration of components must be flexible enough to allow rapid online reconfiguration and adaptation to react to environmental changes and respond to unpredictable events during flight, such as avoiding a moving obstacle or recovering from vehicle equipment failures. This paper describes an open software architecture, called the open control platform, for integrating control technologies and resources. The specific driving application is supporting autonomous control of VTOL uninhabited autonomous vehicles.

Abstract: Recently model checkers have been applied to software areas such as analyzing protocols and algorithms, measuring test adequacy, and generating abstract tests from formal models. When using model checkers to generate tests, the generated tests are execution traces of the models. Thus the type, occurrence, and order of variables, calls, and events in the execution traces are intimately tied to the choice of modeling representation. We briefly review how to use a model checker to generate tests from a high-level representation, such as MATLAB(R), UML, or SCR. Since the model checker uses a particular general model, the analyst has choices about how a piece of software may be modeled. We list some choices and discuss their advantages and disadvantages. We also describe a program to marshal model variables from resultant model checker traces and translate them into function calls, program variables, and other software artifacts.

Abstract: An understanding of potential damage mechanisms, structural design criteria and fail-safe features, structural maintenance philosophy is needed in order to develop a sensor-based system to effectively monitor structural condition. The purpose of this paper is to review the primary aging mechanisms in current aging aircraft, identify a sensing and data management strategy to monitor aircraft structure, and describe analytical tools and technological development needed to implement structural health monitoring on commercial transport aircraft.

Abstract: The SCR (Software Cost Reduction) requirements method is a formal method based on tables for the specification and analysis of the required behavior of safety-critical software systems. Originally developed in 1978 by NRL (Naval Research Laboratory) to document the flight program requirements of the Navy's A-7 aircraft, SCR has also been applied by a number of organizations in industry to a wide range of practical systems, including avionics and space systems. For example, in 1994, in the largest application of SCR to date, Lockheed used SCR to specify the requirements of the C-130J flight control software, which contains more than 250,000 lines of Ada code. To provide tool support for the SCR method, our group at NRL has developed an integrated suite of tools called the SCR toolset. The toolset includes a consistency checker for checking the specification for type errors and missing cases.

Abstract: The Virtual Reality Applications Center at Iowa State University, VRAC, has the mission of applying virtual reality technology to the challenges of engineering and science. We typically create virtual worlds that allow the user to interact with 3D real time graphics. We refer to the virtual worlds enabling this interaction as synthetic environments. A synthetic environment produces sufficient sensory cues to make the user believe they are actually in a different geographic location with a different velocity and orientation than they have in the real world. These cues may include a large field of view real time stereoscopic visual display, surround sound digital audio, and haptic interactions. The user's head is tracked to enable the appropriate viewpoint for the stereoscopic display, and other parts of the user's body may be tracked to enable interaction with the environment and haptic feedback. Classical flight simulators are a subset of synthetic environments. Although they do not usually use stereoscopic displays, they do use large field of view visual systems, digital audio, force feedback via the flight controls, and force feedback on the simulator as a whole via a motion base. We believe the addition of stereoscopic 3D graphics will be particularly valuable in hovering, formation flying, and landing.

Abstract: There is currently great interest in developing stand-alone electronic devices to support flight deck tasks. These devices, called "Electronic Flight Bags," (EFBs) were originally seen as a repository for electronic documents. Today, some airlines envision EFBs as multi-function devices supporting an array of applications, while others envision a simple low-end device used only for viewing documents, or perhaps for performing flight performance calculations. The Federal Aviation Administration (FAA) is charged with approval of EFBs for installation and use in aircraft. The approval process will be a multidimensional effort requiring an understanding of how the device functions and is used by crews, how the device interacts with other cockpit equipment, and training and operating procedures. Volpe Center has been tasked with writing a document on the human factors issues related to EFBs. Our goal is for the document to be of value to both system evaluators in the FAA and system designers in industry. Our challenge was to create a document that addresses the wide range of proposed EFB implementations, suits the needs of the various readers, and provides useful information for designers and evaluators. In this paper we review the design of the document and how it addresses each of these requirements. We also give an overview of the content of the document and provide illustrative extracts from the text.

Abstract: A means for enabling UAVs (unmanned air vehicles) to achieve and eventually exceed the capabilities of a human pilot must be developed before UAVs can achieve their potential. The safety, reliability, and capability exhibited by UAVs require an enormous amount of improvement to match that of manned aircraft. An approach towards achieving this goal is presented. The approach is centered on the concept of the "active state." Active state provides a framework for an air vehicle to acquire information about itself (e.g. dynamic states, subsystem data, etc.) and it's operational environment (e.g. weather, terrain, air traffic, targets, threats, etc.), analyze the data for pertinent information (subsystem health status, system resources such as fuel, weather hazards, traffic conflicts, etc.), and produce rational decisions resulting in robust, successful, and safe pursuit of mission goals.

Abstract: The goal of the Crisis Action Planning Tutored On-line Resource (CAPTOR) project is to design, develop, and implement a state-of-the-art, Internet-based course of instruction that utilizes Intelligent Tutoring System (ITS) technology. ITS technology is ideally suited to teach complex, cognitive tasks, such as those required for troubleshooting, problem-solving, and for resolving critical situations. As currently taught, Crisis Action Planning is part of an Armed Forces Staff College 12-week classroom course. It is projected that fully implementing CAPTOR as a distance learning ITS will dramatically reduce instructional training time.

Abstract: An observer based fault detection and isolation method is presented. The method involves combining the unknown input observer theory with the Beard fault detection filter theory to generate a residual signal that has both disturbance decoupling and unidirectional properties. This robust, in the sense of disturbances, residual was used to detect and isolate sensor faults in a turbofan engine model. Finally, the method was successfully extended to detect and isolate sensor faults over a wide range of power input levels by scheduling the observer based on power code.

Abstract: While automation has eliminated many types of operator error, it has also created new types of technology-induced human errors. Many of these new errors are the result of what has been labeled technology-centered automation, where designers focus most of their attention on the mapping from software inputs to outputs, on mathematical models of required functionality, and on the technical details and problems internal to the computer: Little attention is given to evaluating software in terms of whether it provides transparent and consistent behavior that supports operators in their monitoring and control tasks. The goal of our research is to create and evaluate a methodology for integrated design of complex systems, including design of the automation and the human tasks, that minimizes human error through appropriate system and operator task design. The methodology is based on formal modeling, simulation, and analysis techniques for the software behavior, the user model of the system, and the operator tasks. This paper describes the human factors aspects of our approach using as an example the vertical flight control logic for a realistic aircraft flight management system FMS. Although the MD-11 FMS was used to derive the example for our case study, we made up much of the information due to our lack of knowledge about the design and the rationale of the real MD-11 design, and nothing in this paper should be taken as applying to that aircraft's actual automation.

Abstract: This paper describes a Runway Incursion Advisory and Alerting System (RIAAS), intended to help minimize the number of runway incursions and provide conflict alerts for all aircraft and vehicles on the airport surface. PathProx is an RIAAS avionics system designed to provide timely alerts directly to the pilot. Airport surface incursions have been identified as one of the most significant safety hazards in civil aviation, and yet thus far, there is no operational system to alert pilots automatically at the onset of such conflicts. PathProx is designed to monitor aircraft that are either on the airport surface area, or are still within the airport's arrival and departure zones. The prototype design specifies that the system is activated whenever an aircraft enters an arrival or departure zone associated with a runway. ADS-B and/or TIS traffic data from other aircraft and ground vehicles within the proximity of this zone are processed by the system, which tracks their movement. Decision rules are set up to issue alerts based on the states and proximity of the aircraft. The goal of the system when implemented is a reduction in the number of runway incursions and also an improvement in the reaction time by pilots to avoid such conflicts.

Abstract: An A-SMGCS architecture and operational concept is presented that has been designed to prevent runway incursions while also improving operational capability. Results of a full-mission simulation using 18 airline pilots and six air traffic controllers are presented along with a description of flight testing to be performed at the Dallas-Fort Worth International Airport. During the simulation, pilot test subjects executed multiple approaches followed by taxi to the gate in visibilities down to 150' using a synthetic vision display system. This system consists of a head-up display providing tactical guidance and a head-down moving map with position, traffic, and ATC instructions depicted to improve situational awareness in the flight deck. Runway incursion warnings were also generated in the flight deck based on surface traffic positions. Simulation scenarios modeled peak traffic conditions and included typical runway incursion events during both landing and takeoff roll. Results are presented as a function of visibility.

Abstract: One of the requirements for closely spaced parallel approaches is the proof that possible blunders of the adjacent aircraft do not lead to a loss of separation. Our paper addresses this problem by considering the blunderer as a "pursuer" and the other aircraft as an "evader". We then use differential game methodology to find the safe region in which it is guaranteed that blunders do not lead to a loss of separation. We apply the technique to a practical case to show how the minimum safe longitudinal separation can be computed. Finally, simulation is performed to show how the technique can be used as an alerting algorithm for onboard on-line computation.

Abstract: Two approaches for the implementation of a suite of cockpit navigation displays designed to increase the safety and efficiency of surface operations were developed and compared in NASA Ames' high-fidelity Advanced Concept Flight Simulator. Eighteen airline crews completed fourteen low-visibility land-and-taxi scenarios at a simulated Chicago O'Hare airport. An evolutionary implementation approach integrated the new technologies into current operations. A revolutionary implementation approach proposed substantial changes to current operating procedures such as airborne, datalinked clearances. The impact of these implementation strategies on surface operations revealed that cockpit display technologies can provide substantial benefits for the efficiency and safety of surface operations, but further gains may be realized by revolutionary changes to current operations. This research highlights the importance of considering procedural and operational integration issues as part of a human-centered approach to cockpit technology design.

Abstract: Proposes a future method of avionics data communication. The need for this proposal results from the shortcomings in the current avionics architecture, video distribution network, and in the MIL-STD-1553 data communication system. The separately wired video and data communication systems can be combined to save weight, which is especially critical for rotorcraft. Aircraft, once fielded, have limited capacity for modification and improvement due to fixed computer throughput and processing performance, network bandwidth and space available in the avionics equipment bays. The changes proposed by this paper are to be made in conjunction with the replacement of the redundant computer boxes with open system avionics functions on industry standard circuit cards. This open architecture approach was developed over the last ten years and is now being implemented in many aircraft applications including the F-22 and the RAH-66 programs. The V-22 rotorcraft, which although just entering production, is being modified for joint service customers where modern computer performance and expanded data network bandwidth is needed. The changes of this proposal will fill this need, reduce weight of upcoming production models, and provide growth or spare capability so that additional video and data components can be added with minimal effect on existing components. This paper will examine the current V-22 avionics video and data communication hardware and wiring and propose a new implementation of open system architecture standards with integrated digital video and data communication based on ANSI standard copper Fibre Channel.

Abstract: In this paper we propose a general framework for multi-mode switching in flight control. From the flight control design point of view, multi-mode switching between controllers corresponding to different modes of operation is needed in those cases when the transition from one mode to another results in substantial flight-critical variations in the aircraft dynamics. To address this problem, a general framework for multi-modal flight control is proposed. The framework is based on the Multiple Models, Switching and Tuning (MMST) methodology, combined with Model-Predictive Control (MPC), and the use of different robust mechanisms for switching between the multi-modal controllers. It was shown that many different switching control strategies can be naturally derived from the basic framework, which demonstrates the generality of the proposed approach. Simulations of the Boeing's Tailless Advanced Fighter Aircraft (TAFA) are included to illustrate the feasibility of the schemes rising from the proposed framework.

Abstract: Over the last decade the United States Government has significantly increased its use of commercial-off-the-shelf (COTS) software as stand-alone solutions and as components in safety-critical systems. This increased use stems from the realization that pre-existing software products can be a means of lowering development costs, shortening development time, and keeping pace with the changing software market. The Federal government, particularly with regards to safety-critical systems, has found that COTS software is currently not plug-and-play, has significant tradeoffs, and usually contains a "cradle-to-grave" dependence on the software manufacturer. Unfortunately, there is currently no standard "best commercial practice" with regard to the acceptance of COTS software. Ad hoc attempts to apply standards for commercial software acceptance have been based upon subjective criteria and have proven to be imprecise and prone to error. Moreover, acceptability in safety-critical systems generally demands analysis of source code. Many software vendors, however, have chosen to keep all such source code proprietary due to liability and intellectual property concerns. When the source code is not available, there is very little that can be done to ensure the safety, reliability, and integrity of the software. This paper discusses the COTS Score, an approach that aids in determining the acceptability of COTS software. The process involves the application of predictive techniques used for financial credit scoring to the COTS domain. The methodology addresses the issue of acceptability by incorporating both functional and environmental software measures related to reliability, compatibility, certifiability, obsolescence, and life cycle including trade-off analyses. This approach satisfies NASA and ISO 9001 requirements to define an acceptance procedure for COTS software.

Abstract: A sensitivity study for aircraft wake vortex transport has been conducted using a validated large eddy simulation (LES) model. The study assumes neutrally stratified and nonturbulent environments and includes the consequences of the ground. The numerical results show that the nondimensional lateral transport is primarily influenced by the magnitude of the ambient crosswind and is insensitive to aircraft type. In most of the simulations, the ground effect extends the lateral position of the downwind vortex about one initial vortex spacing (b/sub o/) in the downstream direction. Further extension by as much as one b/sub o/ occurs when the downwind vortex remains "in ground effect" (IGE) for relatively long periods of time. Results also show that a layer-averaged ambient wind velocity can be used to bound the time for lateral transport of wake vortices to ensure safe operations on a parallel runway.

Abstract: Real time passive millimeter-wave imaging systems have a wide variety of uses from aircraft navigation and landing in fog to detection of concealed weapons. A useful imaging system for flight platforms requires a large number of pixels and a high frame rate combined with a small antenna volume and a low cost. We present a millimeter-wave imaging system which uses 32 MMIC low noise amplifiers to display a 60/spl times/75 pixel image at a 30 Hz frame rate. The system's pupil-plane phased array architecture allows for a relatively thin large aperture antenna. A remotely located processor utilizes microwave guiding circuit boards to perform phase and frequency discrimination on the radiation received by the antenna array. The imaging system was mounted on a helicopter platform and used to gather real-time imagery of a variety of targets. Targets include improved and unimproved runways, roadways, vehicles on roadways, and power lines. We present video-rate millimeter-wave imagery of ground features which are obscured from visible and infrared sensors by fog. The helicopter is shown to be able to follow and navigate ground features while travelling above a layer of fog using only the millimeter-wave imagery.

Abstract: Over the past five years the GPS Laboratory at Stanford University has developed a 3-D "Out the Window" Tunnel-in-the-Sky Display. This display intuitively and accurately renders the attitude and location of the aircraft relative to the local terrain. This paper summarizes the design, development, and implementation of the Stanford Tunnel-in-the-Sky Display from 1995 through Spring 2000. In particular, details of the display content and system hardware for each stage of development throughout the last five years will be discussed. Extensive flight-testing, culminating in 41 hours of Tunnel-in-the-Sky flight and 180 approaches, have proved invaluable in this research in that it led to solutions that did not appear in laboratory simulations. The research has shown that functional Tunnel-in-the-Sky Displays can be inexpensive, easy to fly, and provide exceptional guidance, terrain and traffic awareness.

Abstract: Nonintrusive test equipment is now available that can test aircraft wiring including any type of insulation or shielding. The test equipment can identify fault location within several centimeters and compare the examined wire performance to new wiring specifications regardless of type. The information gained from this test is then compared to a database of other aircraft as part of the management of the health of the wiring circuits, assessing risk due to wiring faults and planning for various maintenance and management decisions. The equipment can identify certain cost centers providing one aspect in the measure of total ownership cost for the aircraft. The average age of the commercial air fleet has exceeded 12 years with 2500 aircraft exceeding their design service objective, some exceeding 35 years of age. The forecasts indicate that both of these numbers will continue to increase over the next several decades. The down side of the aging process is that inspections methods in use today for examining the condition of aircraft wiring are only 25% effective and then only where the wire can be easily examined. This has placed special emphasis on wire testing, electronic system husbandry, improved testing methods and new wire system designs to ensure cost effective maintenance and improved safety. This has also resulted in the FAA starting to issue guidance for electrical systems as part of their aging aircraft program. In the past extending the safe and useful life of the aircraft has focused only on aircraft structure.

Abstract: The capabilities of surveillance radar assets are being extended to provide Doppler-weather sensing at select major airports. Currently, the ASR-9 radar can be augmented with a wind-shear processor (WSP) to provide data on wind shear, gust fronts, storm tracks and local precipitation levels. The radar, however, is primarily an aircraft surveillance system that features several characteristics that pose a challenge to Doppler-weather processing. These include a fan-beam antenna pattern in the vertical dimension and a relatively short coherent pulse burst that is punctuated with interim shifts in the pulse repetition frequency (PRF). As a result, weather spatial resolution, wind measurement accuracy and surface-clutter suppression all suffer to a degree, relative to dedicated weather radars. The WSP incorporates signal processing that somewhat mitigates these obstacles. By comparison, the ASR-11 radar possesses most of the same limitations for Doppler-weather processing, and more. As a lower-cost solution for aircraft surveillance at secondary airports, the radar features some 17 dB less peak power than the ASR-9. To achieve the required performance in detecting aircraft, the ASR-11 uses a longer pulsewidth and much more rapid switching of the RF and PRF than the ASR-9. In addition, the average PRF of the ASR-11 is substantially lower than the average of the ASR-9. All of these differences make the ASR-11 less well suited for Doppler-weather processing than the ASR-9. These differences also mandate a new approach to processing the weather return. This paper describes a signal processing design that is adapted to the ASR-11 waveform. The key elements of the design are an adaptive whitening filter for separating multiple weather sources within the fan beam, a dealiasing logic that incorporates the four ASR-11 PRFs to resolve wind speeds, and a measurement acceptance logic that suppresses erroneous windspeed indications.

Abstract: Airport security is a key issue that is being addressed worldwide by civil aviation agencies to counter the threat of terrorism. Pursuing numerous initiatives appropriate combination of techniques that will yield a realistic and cost-effective solution to this problem. This paper addresses one such solution, using the Airport Surface Detection Equipment (ASDE-3) radar for perimeter intrusion detection. The ASDE-3 system is now deployed at 34 major US airports as part of the FAA's Runway Incursion Reduction Program. The systems provide rapid, high-resolution imagery of aircraft and vehicular traffic to tower controllers. The ASDE-3 system also has the potential to provide a similar level of surveillance for human targets and this intelligence can be made available to security personnel without interfering with Air Traffic Control (ATC) operations. The conditions under which the ASDE-3 can detect human targets and the regions of a major airport where this detection is possible are fully investigated in this program. The paper presents the results of an analysis performed under FAA William J. Hughes Technical Center Research Grant 99-G-042.

Abstract: Despite their potential, formal methods have had difficulty gaining acceptance in the industrial sector. Some complaints are based on supposed impracticality: many consider formal methods to be an approach to system specification and analysis that requires a large learning time. Contributing to this scepticism is the fact that some types of formal methods have not yet been proven to handle systems of realistic complexity. To learn more about how to design formal specification languages that can be used for complex systems and require minimal training, we developed a formal specification of an English language specification of the vertical flight control system similar to that found in the MD-11. This paper describes the lessons learned from this experience.

Abstract: New advances in control theory are required to enable aggressive maneuvering of autonomous vehicles, while adapting in real time to changes in the operational environment. A hybrid control architecture, the states of which represent feasible trajectory primitives, is constructed to reduce the complexity of the motion-planning problem for a nonlinear, high-dimensional system such as an aerial vehicle. Any feasible trajectories in the primitive list are available to the automatic control system; these may include a complete set of transitions between pairs of trim trajectories in addition to pilot-inspired behaviors recorded during manual flight tests with a human pilot. This paper describes the structure of a hybrid automaton that solves a time-optimal motion-planning problem by sequencing maneuvers in real time from such a primitive list. The algorithm can be used in a free workspace, or in the presence of fixed or moving obstacles. We present simulation results showing the effectiveness of this approach for a behavior library generated by a combination of analysis and live flight tests with a small remote-controlled helicopter.