Search NASA⌕ Search

SEARCH · Search NASA

Results for “Certification by Analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 181 records · Page 10
All sourcesNASA NTRSDOE OSTI
NASA NTRS2009

Proceedings of the Third International Workshop on Proof-Carrying Code and Software Certification

This NASA conference publication contains the proceedings of the Third International Workshop on Proof-Carrying Code and Software Certification, held as part of LICS in Los Angeles, CA, USA, on August 15, 2009. Software certification demonstrates the reliability, safety, or security of software systems in such a way that it can be checked by an independent authority with minimal trust in the techniques and tools used in the certification process itself. It can build on existing validation and verification (V&V) techniques but introduces the notion of explicit software certificates, Vvilich contain all the information necessary for an independent assessment of the demonstrated properties. One such example is proof-carrying code (PCC) which is an important and distinctive approach to enhancing trust in programs. It provides a practical framework for independent assurance of program behavior; especially where source code is not available, or the code author and user are unknown to each other. The workshop wiII address theoretical foundations of logic-based software certification as well as practical examples and work on alternative application domains. Here "certificate" is construed broadly, to include not just mathematical derivations and proofs but also safety and assurance cases, or any fonnal evidence that supports the semantic analysis of programs: that is, evidence about an intrinsic property of code and its behaviour that can be independently checked by any user, intermediary, or third party. These guarantees mean that software certificates raise trust in the code itself, distinct from and complementary to any existing trust in the creator of the code, the process used to produce it, or its distributor. In addition to the contributed talks, the workshop featured two invited talks, by Kelly Hayhurst and Andrew Appel. The PCC 2009 website can be found at http://ti.arc.nasa.gov /event/pcc 091.

Ewen, Denney, W.↗
NASA NTRS2016

Tethered Space Satellite-1 (TSS-1): Technical Roundabouts

In the early 1990's US and Italian scientists collaborated to study the electrodynamics of dragging a satellite on a tether through the electrically charged portion of Earth's atmosphere called the ionosphere. An electrical current induced in the long wire could be used for power and thrust generation for a satellite. Other tether uses include momentum exchange, artificial gravity, deployment of sensors or antennas, and gravity-gradient stabilization for satellites. Before the Tethered Space Satellite (TSS-1), no long tether had ever been flown, so many questions existed on how it would actually behave. The TSS consisted of a satellite with science experiments attached to a 12.5 mile long, very thin (0.10 inch diameter) copper wire assembly wound around a spool in the deployer reel mechanism. With the Space Shuttle at an altitude of 160 nautical miles above earth, the satellite was to be deployed by raising it from the Shuttle bay on a boom facing away from Earth. Once cleared of the bay, the deployer mechanism was to slowly feed out the 12-plus miles of tether. Scientific data would be collected throughout the operation, after which the satellite would be reeled back in. Pre-flight testing system level tests involved setting up a tether receiver to catch the 12.5 mile tether onto another reel as it was being unwound by the deployer reel mechanism. Testing only the reel mechanism is straightforward. This test becomes more complicated when the TSS is mounted on the flight pallet at Kennedy Space Center (KSC). The system level tests must be passed before the pallet can be installed into the Space Shuttle cargo bay. A few months before flight, the TSS payload had been integrated onto the Spacelab pallet and system level tests, including unreeling and reeling the tether, had been successfully completed. Some of this testing equipment was then shipped back to the contractor Martin Marietta. Systems-level load analyses, which cannot be run until all information about each payload is finalized, was run in parallel with the physical integration of the hardware into the Shuttle payload bay. The coupled loads analysis, as it is called, incorporates any updates to the model due to system level tests, and any changes that were found during integration. The coupled loads analysis revealed that a single bolt attaching the deployer reel mechanism to the support structure had a "negative margin" - which is an indication that it might fail during operation. Hardware certification rules do not allow for hardware to fly with negative margins, so this issue had to be resolved before the flight. Since there is conservatism in engineering analysis, there is an option to "waive" the margin requirement, and fly the experiment as is. On the other hand, a structural failure of one payload could have serious or catastrophic consequences to other payloads and possibly the mission. Minor design changes or fixes might be feasible within the payload bay prior to launch. Any major design changes that required the spooling test to validate the hardware, or for the pallet to be removed, would cause TSS not to be ready for the Shuttle launch.

O'Connor, Brian↗
NASA NTRS1998

Flight Testing and Real-Time System Identification Analysis of a UH-60A Black Hawk Helicopter with an Instrumented External Sling Load

Helicopter external air transportation plays an important role in today's world. For both military and civilian helicopters, external sling load operations offer an efficient and expedient method of handling heavy, oversized cargo. With the ability to reach areas otherwise inaccessible by ground transportation, helicopter external load operations are conducted in industries such as logging, construction, and fire fighting, as well as in support of military tactical transport missions. Historically, helicopter and load combinations have been qualified through flight testing, requiring considerable time and cost. With advancements in simulation and flight test techniques there is potential to substantially reduce costs and increase the safety of helicopter sling load certification. Validated simulation tools make possible accurate prediction of operational flight characteristics before initial flight tests. Real time analysis of test data improves the safety and efficiency of the testing programs. To advance these concepts, the U.S. Army and NASA, in cooperation with the Israeli Air Force and Technion, under a Memorandum of Agreement, seek to develop and validate a numerical model of the UH-60 with sling load and demonstrate a method of near real time flight test analysis. This thesis presents results from flight tests of a U.S. Army Black Hawk helicopter with various external loads. Tests were conducted as the U.S. first phase of this MOA task. The primary load was a container express box (CONEX) which contained a compact instrumentation package. The flights covered the airspeed range from hover to 70 knots. Primary maneuvers were pitch and roll frequency sweeps, steps, and doublets. Results of the test determined the effect of the suspended load on both the aircraft's handling qualities and its control system's stability margins. Included were calculations of the stability characteristics of the load's pendular motion. Utilizing CIFER(R) software, a method for near-real time system identification was also demonstrated during the flight test program.

McCoy, Allen H.↗
NASA NTRS1982

Aerodynamic comparisons of STS-1 Space Shuttle entry vehicle

A conventional flight-test program, which slowly and cautiously approaches more severe flight conditions, was not possible with the Orbiter. On the first flight, the Orbiter entered the atmosphere at Mach 28 and decelerated through the Mach range. (The subsonic portion of flight was also flown by another orbiter vehicle during the Approach and Landing Test Program.) Certification for the first flight was achieved by an extensive wind-tunnel test and analysis program and by restricting the flight maneuvers severely. The initial flights of the orbiter were heavily instrumented for the purpose of obtaining accurate aerodynamic data. Even without maneuvers to excite the system, the first flight provided comparisons between flight and wind-tunnel-derived predicted data in the areas of aerodynamic performance, longitudinal trim, and reaction-control jet interaction. The aerodynamic performance comparisons are presented.

Young, J. C.↗
NASA NTRS1992

Progress through precedent: Going where no helicopter simulator has gone before

Helicopter simulators have been approved by means of special exemption; there are no FAA standards for simulators used in training or airmen Certification checking. The fixed-wing industry provides a precedent which can be used for expediting implementation of helicopter simulators. The analysis in this paper is founded on the experience with that precedent and is driven by a clear definition of helicopter user needs for (1) improved training at lower cost, (2) more comprehensive emergency training at lower risk, (3) increased fidelity of transition and instrument training compared with low-cost aircraft alternatives, and (4) certification credit for improved simulator training.

Adams, Richard J.↗
NASA NTRS2012

Compliance with High-Intensity Radiated Fields Regulations - Emitter's Perspective

NASA's Deep Space Network (DSN) uses high-power transmitters on its large antennas to communicate with spacecraft of NASA and its partner agencies. The prime reflectors of the DSN antennas are parabolic, at 34m and 70m in diameter. The DSN transmitters radiate Continuous Wave (CW) signals at 20 kW - 500 kW at X-band and S-band frequencies. The combination of antenna reflector size and high frequency results in a very narrow beam with extensive oscillating near-field pattern. Another unique feature of the DSN antennas is that they (and the radiated beam) move mostly at very slow sidereal rate, essentially identical in magnitude and at the opposite direction of Earth rotation.The DSN is in the process of revamping its documentation to provide analysis of the High Intensity Radiation Fields (HIRF) environment resulting from radio frequency radiation from DSN antennas for comparison to FAA regulations regarding certification of HIRF protection as outlined in the FAA regulations on HIRF protection for aircraft electrical and electronic systems (Title 14, Code of Federal Regulations (14 CFR) [section sign][section sign] 23.1308, 25.1317, 27.1317, and 29.1317).This paper presents work done at JPL, in consultation with the FAA. The work includes analysis of the radiated field structure created by the unique DSN emitters (combination of transmitters and antennas) and comparing it to the fields defined in the environments in the FAA regulations. The paper identifies areas that required special attention, including the implications of the very narrow beam of the DSN emitters and the sidereal rate motion. The paper derives the maximum emitter power allowed without mitigation and the mitigation zones, where required.Finally, the paper presents summary of the results of the analyses of the DSN emitters and the resulting DSN process documentation.

DSN emitters↗
NASA NTRS2012

An Assessment of Civil Tiltrotor Concept of Operations in the Next Generation Air Transportation System

Based on a previous Civil Tiltrotor (CTR) National Airspace System (NAS) performance analysis study, CTR operations were evaluated over selected routes and terminal airspace configurations assuming noninterference operations (NIO) and runway-independent operations (RIO). This assessment aims to further identify issues associated with these concepts of operations (ConOps), and their dependency on the airspace configuration and interaction with conventional fixed-wing traffic. Safety analysis following a traditional Safety Management System (SMS) methodology was applied to CTR-unique departure and arrival failures in the selected airspace to identify any operational and certification issues. Additional CTR operational cases were then developed to get a broader understanding of issues and gaps that will need to be addressed in future CTR operational studies. Finally, needed enhancements to National Airspace System performance analysis tools were reviewed, and recommendations were made on improvements in these tools that are likely to be required to support future progress toward CTR fleet operations in the Next Generation Air Transportation System (NextGen).

Chung, William W.↗
NASA NTRS1997

The NASA Integrated Information Technology Architecture

This document defines an Information Technology Architecture for the National Aeronautics and Space Administration (NASA), where Information Technology (IT) refers to the hardware, software, standards, protocols and processes that enable the creation, manipulation, storage, organization and sharing of information. An architecture provides an itemization and definition of these IT structures, a view of the relationship of the structures to each other and, most importantly, an accessible view of the whole. It is a fundamental assumption of this document that a useful, interoperable and affordable IT environment is key to the execution of the core NASA scientific and project competencies and business practices. This Architecture represents the highest level system design and guideline for NASA IT related activities and has been created on the authority of the NASA Chief Information Officer (CIO) and will be maintained under the auspices of that office. It addresses all aspects of general purpose, research, administrative and scientific computing and networking throughout the NASA Agency and is applicable to all NASA administrative offices, projects, field centers and remote sites. Through the establishment of five Objectives and six Principles this Architecture provides a blueprint for all NASA IT service providers: civil service, contractor and outsourcer. The most significant of the Objectives and Principles are the commitment to customer-driven IT implementations and the commitment to a simpler, cost-efficient, standards-based, modular IT infrastructure. In order to ensure that the Architecture is presented and defined in the context of the mission, project and business goals of NASA, this Architecture consists of four layers in which each subsequent layer builds on the previous layer. They are: 1) the Business Architecture: the operational functions of the business, or Enterprise, 2) the Systems Architecture: the specific Enterprise activities within the context of IT systems, 3) the Technical Architecture: a common, vendor-independent framework for design, integration and implementation of IT systems and 4) the Product Architecture: vendor=specific IT solutions. The Systems Architecture is effectively a description of the end-user "requirements". Generalized end-user requirements are discussed and subsequently organized into specific mission and project functions. The Technical Architecture depicts the framework, and relationship, of the specific IT components that enable the end-user functionality as described in the Systems Architecture. The primary components as described in the Technical Architecture are: 1) Applications: Basic Client Component, Object Creation Applications, Collaborative Applications, Object Analysis Applications, 2) Services: Messaging, Information Broker, Collaboration, Distributed Processing, and 3) Infrastructure: Network, Security, Directory, Certificate Management, Enterprise Management and File System. This Architecture also provides specific Implementation Recommendations, the most significant of which is the recognition of IT as core to NASA activities and defines a plan, which is aligned with the NASA strategic planning processes, for keeping the Architecture alive and useful.

Baldridge, Tim↗
NASA NTRS2005

Fluids and Combustion Facility: Combustion Integrated Rack Modal Model Correlation

The Fluids and Combustion Facility (FCF) is a modular, multi-user, two-rack facility dedicated to combustion and fluids science in the US Laboratory Destiny on the International Space Station. FCF is a permanent facility that is capable of accommodating up to ten combustion and fluid science investigations per year. FCF research in combustion and fluid science supports NASA's Exploration of Space Initiative for on-orbit fire suppression, fire safety, and space system fluids management. The Combustion Integrated Rack (CIR) is one of two racks in the FCF. The CIR major structural elements include the International Standard Payload Rack (ISPR), Experiment Assembly (optics bench and combustion chamber), Air Thermal Control Unit (ATCU), Rack Door, and Lower Structure Assembly (Input/Output Processor and Electrical Power Control Unit). The load path through the rack structure is outlined. The CIR modal survey was conducted to validate the load path predicted by the CIR finite element model (FEM). The modal survey is done by experimentally measuring the CIR frequencies and mode shapes. The CIR model was test correlated by updating the model to represent the test mode shapes. The correlated CIR model delivery is required by NASA JSC at Launch-10.5 months. The test correlated CIR flight FEM is analytically integrated into the Shuttle for a coupled loads analysis of the launch configuration. The analysis frequency range of interest is 0-50 Hz. A coupled loads analysis is the analytical integration of the Shuttle with its cargo element, the Mini Payload Logistics Module (MPLM), in the Shuttle cargo bay. For each Shuttle launch configuration, a verification coupled loads analysis is performed to determine the loads in the cargo bay as part of the structural certification process.

McNelis, Mark E.↗
NASA NTRS2012

NASA's UAS [Unmanned Aircraft Systems] Related Activities

NASA continues to operate all sizes of UAS in all classes of airspace both domestically and internationally. Missions range from highly complex operations in coordination with piloted aircraft, ground, and space systems in support of science objectives to single aircraft operations in support of aeronautics research. One such example is a scaled commercial transport aircraft being used to study recovery techniques due to large upsets. NASA's efforts to support routine UAS operations continued on several fronts last year. At the national level in the United States (U.S.), NASA continued its support of the UAS Executive Committee (ExCom) comprised of the Federal Aviation Administration (FAA), Department of Defense (DoD), Department of Homeland Security (DHS), and NASA. The committee was formed in recognition of the need of UAS operated by these agencies to access to the National Airspace System (NAS) to support operational, training, development and research requirements. Recommendations were received on how to operate both manned and unmanned aircraft in class D airspace and plans are being developed to validate and implement those recommendations. In addition the UAS ExCom has begun developing recommendations for how to achieve routine operations in remote areas as well as for small UAS operations in class G airspace. As well as supporting the UAS ExCom, NASA is a participant in the recently formed Aviation Rule Making Committee for UAS. This committee, established by the FAA, is intended to propose regulatory guidance which would enable routine civil UAS operations. As that effort matures NASA stands ready to supply the necessary technical expertise to help that committee achieve its objectives. By supporting both the UAS ExCom and UAS ARC, NASA is positioned to provide its technical expertise across the full spectrum of UAS airspace access related topic areas. The UAS NAS Access Project got underway this past year under the leadership of NASA s Aeronautics Research Mission Directorate. This project is focused on advancing the state of the art and providing research and analysis results in the areas of Separation Assurance, Communications (non-governmental spectrum allocation for UAS), Certification, and Human System Integration (ground control station design/pilot interfaces). The project is working in close coordination with the FAA and industry standards organizations (e.g. RTCA SC 203). More details on this project are provided in a separate article in this year's yearbook

Bauer, Jeffrey↗
NASA NTRS2012

Improving Safety on the International Space Station: Transitioning to Electronic Emergency Procedure Books on the International Space Station

The National Aeronautics and Space Administration (NASA) originally designed the International Space Station (ISS) to operate until 2015, but have extended operations until at least 2020. As part of this very dynamic Program, there is an effort underway to simplify the certification of Commercial ]of ]the ]Shelf (COTS) hardware. This change in paradigm allows the ISS Program to take advantage of technologically savvy and commercially available hardware, such as the iPad. The iPad, a line of tablet computers designed and marketed by Apple Inc., was chosen to support this endeavor. The iPad is functional, portable, and could be easily accessed in an emergency situation. The iPad Electronic Flight Bag (EFB), currently approved for use in flight by the Federal Aviation Administration (FAA), is a fraction of the cost of a traditional Class 2 EFB. In addition, the iPad fs ability to use electronic aeronautical data in lieu of paper in route charts and approach plates can cut the annual cost of paper data in half for commercial airlines. ISS may be able to benefit from this type of trade since one of the most important factors considered is information management. Emergency procedures onboard the ISS are currently available to the crew in paper form. Updates to the emergency books can either be launched on an upcoming visiting vehicle such as a Russian Soyuz flight or printed using the onboard ISS printer. In both cases, it is costly to update hardcopy procedures. A new operations concept was proposed to allow for the use of a tablet system that would provide a flexible platform to support space station crew operations. The purpose of the system would be to provide the crew the ability to view and maintain operational data, such as emergency procedures while also allowing Mission Control Houston to update the procedures. The ISS Program is currently evaluating the safety risks associated with the use of iPads versus paper. Paper products can contribute to the flammability risk and require manual updates that take time away from research tasks. The ISS program has recently purchased three iPads for the astronauts and the certification has been approved. The crew is currently using the iPads onboard. The results of this analysis could be used to discern whether the iPad is a viable option for use in emergencies by assessing the risk posture through the development of a quantitative probabilistic risk assessment (PRA).

Carter-Journet, Katrina↗
NASA NTRS2009

Towards a Certified Lightweight Array Bound Checker for Java Bytecode

Dynamic array bound checks are crucial elements for the security of a Java Virtual Machines. These dynamic checks are however expensive and several static analysis techniques have been proposed to eliminate explicit bounds checks. Such analyses require advanced numerical and symbolic manipulations that 1) penalize bytecode loading or dynamic compilation, 2) complexify the trusted computing base. Following the Foundational Proof Carrying Code methodology, our goal is to provide a lightweight bytecode verifier for eliminating array bound checks that is both efficient and trustable. In this work, we define a generic relational program analysis for an imperative, stackoriented byte code language with procedures, arrays and global variables and instantiate it with a relational abstract domain as polyhedra. The analysis has automatic inference of loop invariants and method pre-/post-conditions, and efficient checking of analysis results by a simple checker. Invariants, which can be large, can be specialized for proving a safety policy using an automatic pruning technique which reduces their size. The result of the analysis can be checked efficiently by annotating the program with parts of the invariant together with certificates of polyhedral inclusions. The resulting checker is sufficiently simple to be entirely certified within the Coq proof assistant for a simple fragment of the Java bytecode language. During the talk, we will also report on our ongoing effort to scale this approach for the full sequential JVM.

Pichardie, David↗
NASA NTRS2014

Service Life Extension of the Propulsion System of Long-Term Manned Orbital Stations

One of the critical non-replaceable systems of a long-term manned orbital station is the propulsion system. Since the propulsion system operates beginning with the launch of station elements into orbit, its service life determines the service life of the station overall. Weighing almost a million pounds, the International Space Station (ISS) is about four times as large as the Russian space station Mir and about five times as large as the U.S. Skylab. Constructed over a span of more than a decade with the help of over 100 space flights, elements and modules of the ISS provide more research space than any spacecraft ever built. Originally envisaged for a service life of fifteen years, this Earth orbiting laboratory has been in orbit since 1998. Some elements that have been launched later in the assembly sequence were not yet built when the first elements were placed in orbit. Hence, some of the early modules that were launched at the inception of the program were already nearing the end of their design life when the ISS was finally ready and operational. To maximize the return on global investments on ISS, it is essential for the valuable research on ISS to continue as long as the station can be sustained safely in orbit. This paper describes the work performed to extend the service life of the ISS propulsion system. A system comprises of many components with varying failure rates. Reliability of a system is the probability that it will perform its intended function under encountered operating conditions, for a specified period of time. As we are interested in finding out how reliable a system would be in the future, reliability expressed as a function of time provides valuable insight. In a hypothetical bathtub shaped failure rate curve, the failure rate, defined as the number of failures per unit time that a currently healthy component will suffer in a given future time interval, decreases during infant-mortality period, stays nearly constant during the service life and increases at the end when the design service life ends and wear-out phase begins. However, the component failure rates do not remain constant over the entire cycle life. The failure rate depends on various factors such as design complexity, current age of the component, operating conditions, severity of environmental stress factors, etc. Development, qualification and acceptance test processes provide rigorous screening of components to weed out imperfections that might otherwise cause infant mortality failures. If sufficient samples are tested to failure, the failure time versus failure quantity can be analyzed statistically to develop a failure probability distribution function (PDF), a statistical model of the probability of failure versus time. Driven by cost and schedule constraints however, spacecraft components are generally not tested in large numbers. Uncertainties in failure rate and remaining life estimates increase when fewer units are tested. To account for this, spacecraft operators prefer to limit useful operations to a period shorter than the maximum demonstrated service life of the weakest component. Running each component to its failure to determine the maximum possible service life of a system can become overly expensive and impractical. Spacecraft operators therefore, specify the required service life and an acceptable factor of safety (FOS). The designers use these requirements to limit the life test duration. Midway through the design life, when benefits justify additional investments, supplementary life test may be performed to demonstrate the capability to safely extend the service life of the system. An innovative approach is required to evaluate the entire system, without having to go through an elaborate test program of propulsion system elements. Evaluating every component through a brute force test program would be a cost prohibitive and time consuming endeavor. ISS propulsion system components were designed and built decades ago. There are no representative ground test articles for some of the components. A 'test everything' approach would require manufacturing new test articles. The paper outlines some of the techniques used for selective testing, by way of cherry picking candidate components based on failure mode effects analysis, system level impacts, hazard analysis, etc. The type of testing required for extending the service life depends on the design and criticality of the component, failure modes and failure mechanisms, life cycle margin provided by the original certification, operational and environmental stresses encountered, etc. When specific failure mechanism being considered and the underlying relationship of that mode to the stresses provided in the test can be correlated by supporting analysis, time and effort required for conducting life extension testing can be significantly reduced. Exposure to corrosive propellants over long periods of time, for instance, lead to specific failure mechanisms in several components used in the propulsion system. Using Arrhenius model, which is tied to chemically dependent failure mechanisms such as corrosion or chemical reactions, it is possible to subject carefully selected test articles to accelerated life test. Arrhenius model reflects the proportional relationship between time to failure of a component and the exponential of the inverse of absolute temperature acting on the component. The acceleration factor is used to perform tests at higher stresses that allow direct correlation between the times to failure at a high test temperature to the temperatures to be expected in actual use. As long as the temperatures are such that new failure mechanisms are not introduced, this becomes a very useful method for testing to failure a relatively small sample of items for a much shorter amount of time. In this article, based on the example of the propulsion system of the first ISS module Zarya, theoretical approaches and practical activities of extending the service life of the propulsion system are reviewed with the goal of determining the maximum duration of its safe operation.

Kamath, Ulhas↗
NASA NTRS1998

Flight Acoustics Measurement Techniques and Applications

Careful consideration must be given to data acquisition and analysis techniques in the design of experiments for the measurement of noise generated by flight vehicles. Although noise measurement locations and data reduction procedures are specified for aircraft certification by FAA and ICAO directives, for example, there are virtually no established procedures for aircraft noise measurement for other purposes. To optimize the quality and quantity of information obtained in a flight acoustics experiment, microphone layout, data acquisition, and analysis must be tailored to the specific test objective. This paper will review flight acoustics technology at NASA Langley Research Center developed over the past decade. In particular, the paper will focus on flight experiments performed for three diverse objectives: (1) research applications, such as noise prediction code validation, (2) noise impact modeling, and (3) noise abatement flight procedures. To best achieve these diverse objectives, different deployments of microphone systems on the ground are required, and different data analysis techniques are needed. In all cases, accurate positioning of the aircraft synchronized in time with the data recording is necessary. However, there are some restrictions on flight operations unique to each case for the methods to properly work.

Preisser, J. S.↗
NASA NTRS2008

Towards Certification of a Space System Application of Fault Detection and Isolation

Advanced fault detection, isolation and recovery (FDIR) software is being investigated at NASA as a means to the improve reliability and availability of its space systems. Certification is a critical step in the acceptance of such software. Its attainment hinges on performing the necessary verification and validation to show that the software will fulfill its requirements in the intended setting. Presented herein is our ongoing work to plan for the certification of a pilot application of advanced FDIR software in a NASA setting. We describe the application, and the key challenges and opportunities it offers for certification.

Software verification↗
NASA NTRS2003

Advanced Durability and Damage Tolerance Design and Analysis Methods for Composite Structures: Lessons Learned from NASA Technology Development Programs

Aerospace vehicles are designed to be durable and damage tolerant. Durability is largely an economic life-cycle design consideration whereas damage tolerance directly addresses the structural airworthiness (safety) of the vehicle. However, both durability and damage tolerance design methodologies must address the deleterious effects of changes in material properties and the initiation and growth of microstructural damage that may occur during the service lifetime of the vehicle. Durability and damage tolerance design and certification requirements are addressed for commercial transport aircraft and NASA manned spacecraft systems. The state-of-the-art in advanced design and analysis methods is illustrated by discussing the results of several recently completed NASA technology development programs. These programs include the NASA Advanced Subsonic Technology Program demonstrating technologies for large transport aircraft and the X-33 hypersonic test vehicle demonstrating technologies for a single-stage-to-orbit space launch vehicle.

Harris, Charles E.↗
NASA NTRS1999

Detecting Controller Malfunctions in Electromagnetic Environments: Design and Analysis of the Detector - Part 2

Verifying the integrity of control computers in adverse operating environments is a key issue in the development, validation, certification, and operation of critical control systems. Future commercial aircraft will necessitate flight-critical systems with high reliability requirements for stability augmentation, flutter suppression, and guidance and control. Operational integrity of such systems in adverse environments must be validated. This paper considers the problem of applying dynamic detection techniques to monitoring the integrity of fault tolerant control computers in critical applications. Specifically, this paper considers the detection of malfunctions in an aircraft flight control computer (FCC) that is subjected to electromagnetic environment (EME) disturbances during laboratory testing. A dynamic monitoring strategy is presented and demonstrated for the FCC from glideslope engaged until flare under clear air turbulence conditions using a detailed simulation of the B737 Autoland. The performance of the monitoring system is analyzed.

Belcastro, Celeste M.↗