Abstract: This paper describes the avionics developed for a miniature acrobatic helicopter and the applications for such a system. The avionics system is designed to safely achieve a robust, high-bandwidth feedback control system while meeting physical specifications. The system that is currently implemented has provided an efficient platform for testing new closed-loop controllers and has yielded critical flight data used for developing simple models of small-scale helicopter dynamics. The helicopter has already demonstrated successful flight under a body-axis velocity/heading rate-tracking controller.

Abstract: The new technologies in flight control avionics systems selected for the Boeing 777 airplane program consists of the following: Fly-By-Wire (FBW), ARINC 629 Bus, Deferred Maintenance. The FBW must meet extremely high levels of functional integrity and availability. The heart of the FBW concept is the use of triple redundancy for all hardware resources: computing system, airplane electrical power, hydraulic power and communication path. The architecture of the 777 flight controls system follows the earliest Boeing 7J7 design. The Boeing designed global DATAC bus, also known as ARINC 629 data bus, is used to communicate among all computing systems. Each DATAC bus is isolated, both physically and electrically from the other two. The three DATAC buses are not synchronized. The control system performance under the autonomous and asynchronous DATAC bus operation has been studied. The primary flight computers (PFCs) form a triple-triple redundant system; three PFC channels and three computing lanes in each channel. Each channel is also isolated, both physically and electrically from the other two. The microprocessor hardware for three computing lanes in each channel are dissimilar to facilitate detection of generic design errors of the most complicated hardware devices; microprocessors. The Byzantine general problem has been considered in the design of the PFC redundancy management to cope with functional asymmetry and communication asymmetry. The deferred maintenance is to provide hot spare modules within an LRU such that the airplane dispatchability can be enhanced. This concept is applied to the three major avionics systems, PFC, Air Data Inertial Reference System (ADIRU) and Airplane Information Management System (AIMS).

Abstract: A Runway Incursion Prevention System (RIPS) was tested at the Dallas-Fort Worth International Airport (DFW) in October 2000. The system integrated airborne and ground components to provide both pilots and controllers with enhanced situational awareness, supplemental guidance cues, a real-time display of traffic information, and warning of runway incursions in order to prevent runway incidents while also improving operational capability. A series of test runs was conducted using NASA's Boeing 757 research aircraft and a test van equipped to emulate an incurring aircraft. The system was also demonstrated to over 100 visitors from the aviation community. This paper gives an overview of the RIPS, DFW flight test activities, and quantitative and qualitative results of the testing.

Abstract: The DragonFly experimental test bed is a platform that supports new research and innovations in navigation, fault tolerant control and multiple vehicle coordination. It consists of two UAVs with modular onboard avionics packages, which communicate through a wired and wireless network to the ground and lab development systems running QNX real-time OS. Its modularity and networked architecture is key in supporting such a wide range of concurrent research. This paper gives an overview of the DragonFly experimental test bed and the specific research goals that it currently supports.

Abstract: Flight trials were conducted by Smiths Aerospace with Scandinavian Airlines in the spring of 2001 evaluating the use of the Four-Dimensional Flight Management System (4-D FMS) and it's Required-Time-of-Arrival (RTA) function for a future Air Traffic Management (ATM) environment. 4-D FMS, along with air-ground datalink capability, is central to the ATM operational environment established by the European Commission's AFAS (Aircraft in the Future ATM System) program. These RTA trials supported this project's development by assessing the current generation FMS RTA algorithm's performance in an AFAS-like flight environment, and identifying necessary improvements for the next generation avionics. The Swedish CAA participated in these trials by providing priority servicing to the trials' flights allowing the evaluation of 4-D FMS performance in an "undisturbed AFAS operational scenario". Required-Time-of-Arrival (RTA) points were established at takeoff targeted for waypoints as late in the flight plan as the top of the Standard Terminal Arrival (STAR) and the destination runway threshold. The Smiths Aerospace standard FMS equipment on the Boeing "Next Generation" B737 was then responsible to guide the aircraft for the entire flight while an observer in the jump seat recorded performance data. The preliminary results from the 33 trial flights and subsequent analysis indicate that aircraft equipped with the current generation Smiths FMS can reliably predict and maintain a 4-D trajectory over an entire flight in real-world fleet operations. Time-of-arrival errors at waypoints located at the top of the Standard Arrival procedures were demonstrated to be less than 7 seconds with a standard deviation of 4.8 seconds. In cases targeting the runway with an RTA constraint, errors were bounded to 21 seconds with a standard deviation of 12.7 seconds. This precise "runway-to-runway" trajectory prediction and control capability is a critical building block in the AFAS "gate-to-gate" 4-D ATM concept. This paper describes the background and setup of these trials. Five supporting research objectives are introduced including RTA accuracy assessment, wind modeling effects, and the evaluation of trajectory time-control authority. Preliminary results and analysis are presented.

Abstract: RTOSs supporting critical avionics applications must provide time partitioning; that is, the ability to guarantee a certain amount of execution time to applications in one time partition regardless of resource requests from applications in a different time partition. Time partitioning permits applications of differing criticalities to be cohosted on a single processor (e.g., DO-178B levels A-E). This paper presents the major design components of slack stealing with its supporting time partitioning algorithms. These algorithms have been implemented in DEOS, the RTOS developed for use in Primus Epic, Honeywell's next generation integrated avionics system. From a time partitioning perspective, DEOS differs from earlier ARINC 653 systems in that it uses preemptive fixed priority (PFP) scheduling, and consequently the time partitioning model includes preemption. Additionally, DEOS supports dynamic thread and dynamic time partition allocation. With the slack and time partitioning upgrades added to DEOS, several improvements were observed. About a threefold increase in communication throughput between a processor and a remote file server and approximately a sevenfold reduction in the amount of a priori reserved execution time required for "fast enough" response times of noncritical applications were reported. Also, certain display tasks were able to achieve higher average refresh update rates using slack. Our algorithms provide robust time partitioning capabilities, enabling the safe cohosting of COTS software with safety critical software without decreases in the COTS software performance.

Abstract: Over the past 30 years, safety-critical avionics systems such as fly-by-wire (FBW) flight controls, full-authority digital engine controls, and other systems have been introduced on many commercial and military airplanes and spacecraft. Early FBW systems, such as on the F-16 and Airbus A320, were considered revolutionary and were introduced with extreme caution. These early systems and their successors all make use of redundant and fault-tolerant avionics to provide the required dependability and safety, but have used significantly different architectures. This paper examines the different levels of criticality and fault tolerance required by different types of avionics systems, establishes architectural categories of fault-tolerant architectures, and identifies the discriminating features of the different approaches. Examples of discriminators include the level of redundancy, methods of engaging backup systems, protection from software errors, and the use of dissimilar hardware and software. The strengths and weaknesses of the different approaches are identified. The paper concludes with some speculation on trends for future systems based on this evaluation of previous systems.

Abstract: Space flight programs face continuous and increasing pressures to reduce risks to safety of flight, accomplish mission success and reduce the cost of operations and maintenance. Space flight operations are complex and inherently high-risk. Large teams of experts are needed to perform all of the required activities, and several months of work are needed to prepare a vehicle and train the flight crew and operations teams for the mission. Multiple layers of oversight have been developed to assure that missions are completed safely and successfully. These extensive and complex processes drive up the cost of space flight and assure that only a few missions are flown per year. Many of the concepts needed for significant gains in efficiency of space flight operations have been demonstrated in isolation. Meeting the challenges to integrate vehicle health management across the enterprise will open doors to highly streamlined space flight operations and enhances the possibility of commercial viability of space flight.

Abstract: After a short description of common accident models and their limitations, a new model is used to evaluate the causal factors in a mission interruption of the SOHO (SOlar Heliospheric Observatory) spacecraft. The factors in this accident are similar to common factors found in other recent software related aerospace losses.

Abstract: The paired approach procedure is intended to facilitate IFR approaches to closely spaced parallel runways i.e., runways separated by less than 2500 feet. Parallel ILS approaches cannot currently be conducted under instrument meteorological conditions to such runways. The paired approach procedure requires aircraft to maintain longitudinal separations within a specific band on approach to the runways such that protection is provided against collision as well as wake vortex hazards. The procedure requires air traffic control to pair eligible aircraft and deliver them to the final approach courses within certain longitudinal tolerances. The flight crew of the trailing aircraft then conducts the paired approach procedure with a set of cockpit-based spacing tools. These spacing tools help the flight crew to achieve and maintain a defined longitudinal spacing prior to the final approach fix. Real time simulations were conducted with line pilots and full performance level controllers in a medium fidelity simulation. The simulation capability included a commercial twin jet flight deck and an ATC platform, which in turn, were used to define flight deck tasks, develop cockpit display and spacing tool requirements, and define ATC procedures and controller tasks. This paper describes these ATC procedures, pilot and controller tasks and cockpit display requirements. It also discusses ways in which the spacing concept and tools so developed are being applied and developed further for other approach spacing applications.

Abstract: This study compares how well general aviation (GA) pilots detect convective weather in flight with different weather information sources. A flight test was conducted in which GA pilot test subjects were given different in-flight weather information cues and flown toward convective weather of moderate or greater intensity. The test subjects were not actually flying the aircraft, but were given pilot tasks representative of the workload and position awareness requirements of the en route portion of a cross country GA flight. On each flight, one test subject received weather cues typical of a flight in visual meteorological conditions (VMC), another received cues typical of flight in instrument meteorological conditions (IMC), and a third received cues typical of flight in IMC but augmented with a graphical weather information system (GWIS). The GWIS provided the subject with near real time data-linked weather products, including a weather radar mosaic superimposed on a moving map with a symbol depicting the aircraft's present position and direction of track. At several points during each flight, the test subjects completed short questionnaires which included items addressing their weather situation awareness and flight decisions. In particular, test subjects were asked to identify the location of the nearest convective cells. After the point of nearest approach to convective weather, the test subjects were asked to draw the location of convective weather on an aeronautical chart, along with the aircraft's present position. This paper reports preliminary results on how accurately test subjects provided with these different weather sources could identify the nearest cell of moderate or greater intensity along their route of flight.

Abstract: The development of fault tolerant embedded control systems, such as flight control systems, FCS, is currently highly specialized and time consuming. We introduce a conceptual architecture for the next decade control system where all control and logic is distributed to a number of computer nodes locally linked to actuators and connected via a communication network. In this way we substantially decrease the lifecycle cost of such embedded systems and acquire scalable fault tolerance. Fault tolerance is based on redundancy and in our concept permanent faults are covered by hardware replication and transient faults, fault detection and processing by software techniques. With intelligent nodes and the use of inherent redundancy a robust and simple fault tolerant system is introduced with a minimum of both hardware and bandwidth requirements. The study is based on an FCS for JAS 39 Gripen, a multirole combat aircraft that is statically unstable at subsonic speed.

Abstract: When fully implemented, the global ATN will span organizational and international boundaries and facilitate implementation of air traffic management applications that improve communication reliability and maximize airspace utilization. To counter potential threats to these critical communications, the ATN specifies requirements for an integrated security solution. As described in this paper, the ATN security solution is based on an underlying open-system framework that supports cryptographic optimization techniques targeted to meet the specific challenges of the aeronautical communications environment. Application of this security solution provides the security services necessary to protect ATN communications while minimizing security overhead exchanged via the bandwidth-limited air-ground data link.

Abstract: The availability of commercial single antenna GPS units at low cost and discontinuation of selective availability of the system has caused increased interest in flying a stable fixed-wing aircraft using GPS alone. Utilizing such an inexpensive sensor, along with a relatively simple processor, a flight control and guidance system could be developed that would be so inexpensive as to be practically disposable even for some commercial applications. A flight control and guidance system that can operate on single antenna GPS measurements is also a candidate as an ultimate backup mode for any uninhabited air vehicle or piloted airplane given failure of sensors. In this paper, necessary hardware and software developments are described, as well as particular solutions explored in a flight test program.

Abstract: As Air Traffic Control Systems (ATC) move from a voice only environment to one in which clearances are issued via data link, there is a risk that an unauthorized entity may attempt to masquerade as either the pilot or controller. In order to protect against this and related attacks, air-ground communications must be secured. The challenge is to add security in an environment in which bandwidth is limited. This paper, which is derived from draft guidance material on security for the Aeronautical Telecommunications Network (ATN) begins with a basic introduction to the relevant security concepts of security threats, security services and security mechanisms. Security mechanisms are further examined by first presenting the fundamental building blocks of symmetric encipherment, asymmetric encipherment, and hash functions and then describing how the fundamental techniques may be combined to form cryptographic schemes. With this background, this paper next describes the cryptographic schemes defined for use in the (ATN) their specific application in securing controller-pilot data link communications. This paper also briefly describes how the ATN cryptographic schemes can be used to secure the exchange of other Air Traffic Services Communications (ATSC) applications, and non-ATSC applications, including Airline Operational Control (AOC) applications.

Abstract: Describes the initial test results of PathProx - a runway incursion alerting system, intended to help minimize the number of runway incursions and provide conflict alerts for all aircraft and vehicles on the airport surface. Rannoch Corporation is the developer of PathProx, an avionics system designed to provide timely alerts directly to the pilot. The test results presented in this paper are primarily based on testing accomplished at Dallas-Fort Worth International Airport in October 2000, as part of the NASA Runway Incursion Prevention System (RIPS) tests.

Abstract: As civil controlled airspace moves toward requiring new communication capabilities, the military will need to equip their aircraft if worldwide, unrestricted airspace access is to be maintained. The USAF has built a Reconfigurable Cockpit and Avionics Testbed (RCAT) with VHF, HF and SATCOM data links and ground stations to demonstrate the utility of these data links. This facility has been used to evaluate techniques available to encrypt ACARS data link messages. This paper discusses the results of these demonstrations and documents the strengths and limitations of the "commercial-off-the-shelf" (COTS) equipment and infrastructure for security of military AOC messages. It also hopes to stimulate discussion among military users about requirements for their use of ACARS.

Abstract: Over the coming decades, aviation operations are predicted to rise steadily, increasing the burden on already congested and constrained airports and terminal areas. It has long been recognized that a major factor governing the safe minimum separation distance between aircraft is the hazard associated with the wake generated by the preceding aircraft. A flight deck display that allows the pilot to "see" the neighboring aircraft, as well as its wake, may allow for a decrease in spacing and an increase in airport and airspace capacity, while maintaining safe separation distances from wake vortices. This research evaluates a model based on aircraft parameters that are readily available in flight to predict aircraft wake vortices in real time. Using this model, a number of graphical representations of wake symbology were created for use in a 3-D perspective view flight deck display. This research determines the feasibility of this method of wake vortex display and ascertains the most favorable symbology for use in flight deck operations.

Abstract: Safe, reliable, and low cost space-based navigation is being provided with embedded INS/GPS systems such as the space integrated GPS/INS (SIGI). The SIGI is being used for various space vehicle applications such as launch vehicles, orbital vehicles, and re-entry vehicles. This paper describes current space vehicle navigation capabilities. The SIGI is being enhanced to provide additions to these existing capabilities with such items as higher processing and a commercial-off-the-shelf operating system. This will allow hosting of various software applications such as advanced navigation functions, flight control, guidance and vehicle management algorithms. The SIGI can host redundancy management functions by incorporating a cross channel data link card (CCDL) using a high speed firewire bus. The SIGI can then be used as a redundancy management platform which has application to current space vehicle avionics topologies incorporating distributed processing architectures.

Abstract: Speech recognition features desired by air traffic controllers, such as the ability to use complex messages and address hundreds of individual aircraft could not be implemented a decade ago, but these tasks became possible with improved speech recognition engines and an increase in processing power and memory. Speech recognition was a key element in the air traffic controller (ATC) workstation used to support a Controller-Pilot Data Link Communications (CPDLC) system. Our work, under the direction of the Avionics Engineering Center at Ohio University, was in support of the Federal Aviation Administration's (FAA) Runway Incursion Reduction Program (RIRP) and the National Aeronautics and Space Administration's (NASA) Runway Incursion Prevention System (RIPS) conducted at the Dallas-Fort Worth International Airport (DFW). This paper examines the challenges and opportunities of developing voice recognition software solutions in ATC workstations using multiple dialects and accents, complex and varied grammars and terminology, accuracy, hardware restrictions, and user-training procedures.

Abstract: A Commercial-Off-The-Shelf PC-104 system using the Real Time Linux operating system is used for flight attitude control and navigation for autonomous flight testing of the Stingray UAV. The fast, time critical tasks of attitude control of the aircraft are placed in real time tasks in kernel space. The slower navigation routines, based on GPS data, is a user space task that provides attitude commands to the real time tasks. Data from the GPS, and attitude controllers are stored on board the aircraft for post-flight analysis. For these flight tests, the take-off and landing of the Stingray UAV will be by an external pilot.

Abstract: While today's aircraft have integrated alerting systems for conditions inside the aircraft (ECAM, EICAS), there is no comparable fully integrated alerting system for conditions outside of the aircraft. Current and near-future, separate alerting systems warn of conditions such as time-critical terrain, traffic, wind shear, clear air turbulence, wake vortices, each using different alerting and display philosophies to present information to the flight crew. Separate systems contribute to alert proliferation and the potential for multiple conflicting alerts during emergency situations. An integrated alerting system should deconflict alerts, and present information in an integrated fashion. In response to these issues, we have developed the Alerting and Notification of Conditions Outside the Aircraft (ANCOA) concept. Key aspects of the concept include: (1) deconflicting currently separate alerts such as TCAS and EGPWS; (2), categorization (weather, traffic, ground) and prioritization (time-critical, tactical and strategic) of alerts to reduce pilot information processing requirements; (3) directional, multidimensional aural cueing to allow quick "pre-processing" of the condition (this aids in time-critical responses and prioritizing the alerted condition relative to the ongoing task); and (4) integrated graphic presentation of conditions external to the aircraft to support better situation awareness. This paper discusses the theory and implementation of the ANCOA concept, and presents a usability study to evaluate the display configuration, ease-of-use, functionality, and navigation of information within an initial simulator prototype. Nine pilots participated in six scenarios under various conditions in the Honeywell Laboratories Medium-Fidelity Flight Simulator. Additionally, pilots conducted an information categorization task, filled out pre- and post-questionnaires, and were interviewed for qualitative assessments. The data were used to assess if the ANCOA integrated system could effectively prioritize and de-conflict information, support improved detection and identification of threats, increase overall situation awareness, and support better planning decisions. A revised prototype is presented, based on the results of the evaluation.

Abstract: The use of an algorithmic, checksum-based "EDAC" (error detection and correction) technique for matrix multiply operations is compared with the more traditional redundant self-checking hardware and retry approach for mitigating single event upset (SEU) or transient errors in soft, radiation tolerant signal processing hardware. Compared with the self-checking approach, the check-sum based EDAC technique offers a number of advantages including lower size, weight, power, and cost. In a manner similar to the SECDED (single error correction/double error detection) EDAC technique commonly used on memory systems, the checksum-based technique can detect and correct errors on the same processing cycle, reducing transient error recovery latency and significantly improving system availability. The paper compares the checksum-based technique with the self-checking technique in terms of failure rates; upset rates coverage, percentage overhead, detection latency, recovery latency, size, weight, power, and cost. The paper also looks at the percentage overhead of the checksum-based technique, which decreases as the size of the matrix increases.

Abstract: Describes initial results of a project developing fault tolerant control systems for critical aircraft systems and focuses on the early detection of faulty components. The main goal is the use of signal processing techniques to analyze sensor information and data-mine changes that could be attributable to faulty behavior. The approach compares well with residual-based techniques but requires only output data. Hence, it could be applied to situations where residual-based approaches are not feasible. We present the use of orthogonal filter banks as the processing elements to create fault indicators. The case study is an F14 jet fighter. Using computer simulations we create various faults and monitor the plane angle of attack. The filter bank creates a number of orthogonal components, some of which have a clearly distinct pre and post fault behavior. This behavior changes with the type of fault suggesting that it is possible to classify the faults. Another issue addressed is the generation of alarm signals based on the results of the fault detector. The paper discusses how the information in the components can be processed to create automatic alarm systems.

Abstract: US Air Force, Army, Navy, and NASA Research Laboratories, in addition to major aerospace companies, are considering millimeter wave (MMW) imaging technology as an enhancement to sensor suits on both occupied and unoccupied vehicles. This paper is a review of some of the basic technology involved in MMW imaging and some of the programs and products that might benefit from passive day or night imaging through mist, haze, fog, clouds, and/or dust. Integration of sensors into tactical aircraft requires close attention to the available volume on the platform, the location of apertures, power requirements, and operational environments. A patent application based on MMW technology includes the passive determination of relative attitude, direction of approach, coded digital information, and distance to a cooperative beacon. Potential applications include UAV surveillance of ground vehicles, air borne approach to airfields, tankers, and flight leaders, and detection of airborne targets, including stealth aircraft.

Abstract: Technological advances have made flight data a viable real-world data source for studies of human error and error prevention; hundreds of parameters are currently available for analysis. These data have enabled airlines to institute increasingly advanced Flight Operational Quality Assurance (FOQA) programs, which analyze flight data from line operations to detect "operational irregularities that can foreshadow accidents and incidents," and proactively disseminate this information to flight crews and maintenance personnel. This paper presents an intent inference technology, referred to as activity tracking, that in the future could also support flight-data-driven safety-enhancement efforts. A methodology for activity tracking has been implemented and validated in the Crew Activity Tracking System (CATS) As implemented for the flight deck, CATS uses knowledge about the pilot's task and the current operational context to predict nominal activities and interpret actual pilot actions. By analyzing pilot action data in conjunction with clearance constraints and other flight data parameters, CATS can help disambiguate errors from other causes of abnormal flight conditions, and characterize error-inducing contexts in operational terms.

Abstract: Describes a relatively straightforward method of estimating the probability of loss of separation between two aircraft at some future time, that is, the probability that they will enter into conflict. Initially the method is developed for encounters in which the planned or predicted speeds of both aircraft are constant during the prediction interval and in which their tracks are straight in regions of possible conflict. Various graphs of conflict probability are produced which are comparable with those already reported. These graphs indicate the levels of performance that may be attainable with medium-term conflict detectors. The method can also be applied in the cases of planned changes in speed prior to entering regions of possible conflict, and also to position-based changes in heading within regions of possible conflict, making it more suitable for use in conflict detectors.

Abstract: This paper describes the Tactical Load. Smoother (TLS), a display of air-traffic complexity for the support of multi-sector planning operations. After an initial evaluation in the context of the Program for Harmonised ATM Research in Eurocontrol (PHARE) TLS is presently being adapted to the operational environment of the Computer Assisted National ATC Centre (CANAC) in Belgium. This paper focuses on the algorithm used to calculate air traffic complexity.

Abstract: Next generation air traffic management (ATM) systems will rely on secure air-ground and ground-ground communications links. These links will be secured using a combination of commercial-off-the-shelf (COTS) techniques, (e.g., using the Internet IPsec standards), as well as techniques unique to the aviation community, (i.e., using aeronautical telecommunications network (ATN) security). In either case, as the supporting networks grow in size and as the number of aircraft using security grows, it is apparent that symmetric key pairs cannot be maintained for all combinations of participating entities. Rather, a general public key infrastructure (PKI) must be employed to handle the general problem of large-scale key distribution. This paper first introduces basic concepts of asymmetric cryptography, authentication, public key certificates, and a public key infrastructure. Next, a general description of how the public key infrastructure supports an Air Traffic Management environment is provided. Finally, the issue of cross-certification is described using the air-ground communications environment as an example.