Search NASA⌕ Search

SEARCH · Search NASA

Results for “safety certification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 289 records · Page 16

Development of a low risk augmentation system for an energy efficient transport having relaxed static stability

An augmentation system for a 230 passenger, twin engine aircraft designed with a relaxation of conventional longitudinal static stability was developed. The design criteria are established and candidate augmentation system control laws and hardware architectures are formulated and evaluated with respect to reliability, flying qualities, and flight path tracking performance. The selected systems are shown to satisfy the interpreted regulatory safety and reliability requirements while maintaining the present DC 10 (study baseline) level of maintainability and reliability for the total flight control system. The impact of certification of the relaxed static stability augmentation concept is also estimated with regard to affected federal regulations, system validation plan, and typical development/installation costs.

Sizlo, T. R.↗

Phase Doppler Interferometry for Efficient Cloud Drop Size Distribution, Number Density, and LWC Measurements

Threats to aviation safety as a result of super-cooled large drops (SLD) has been addressed by the FAA rules change (14 CFR Part 25) with the additional icing certification requirement. SLD clouds often consist of bi-modal drop size spectra leading to significant problems in simulating and characterizing these conditions in situ and in icing wind tunnels. Legacy instrumentation for measuring drop size distributions and liquid water content are challenged under these conditions. The large size range measurement problem is addressed with the development of the Phase Doppler Interferometer, Flight Probe Dual-Range (PDI FPDR). The method is described in this report along with the measurement capabilities including the dynamic measurement range and overall working size range. The PDI instrument bases drop size measurements on the light wavelength as the measurement length scale. The light wavelength is a much more robust scale, especially as compared to the light scattering intensity. Additionally, methods for accurately characterizing the sample volume in situ based on measured drop velocity and transit time are reviewed, given the importance of this parameter for merging results and measuring LWC. Droplet coincidence in the sample volume can be problematic so this condition is treated with an innovative signal parsing approach. Measurement examples acquired in the NASA IRT are provided. Measurements of LWC showed good agreement with the Artium Particle Imaging (PI) instrument but diverged from the tunnel calibration results for larger MVD values.

42 ENGINEERING↗

Potential Advantages to Employing an Onsite Laboratory at FUSRAP Sites Contaminated with Radionuclides and Metals - 20353

Various factors that support an evaluation of the relative costs, advantages and disadvantages of utilizing an onsite laboratory or an offsite laboratory for remediation of Formerly Utilized Sites Remedial Action Program (FUSRAP) sites contaminated with radionuclides and metals are presented. In terms of how much more quickly an onsite laboratory provides results versus an offsite laboratory, the results of this study provide tools for calculating the amount of cost savings per day for excavation of contaminated soils for various scenarios including: - State, municipal or local property remediation where the remediation schedule becomes time-critical due to the extra cost and inconvenience to the town or municipality caused by the need for increased security and safety personnel, possible road closures and detours, and the inconvenience to the public due to modified or decreased services of State or municipal facilities; - Residential property where the remediation schedule becomes time-critical due to the inconvenience to the homeowner as well as the importance of maintaining good community relations; - Commercial property where the remediation schedule becomes time-critical due to the hardship and potential loss of revenue endured by the property owner; - Open area where treatment of excavation water is required, and - Open area where treatment of excavation water is not required. For every scenario, the number of matrices, radionuclide and metal contaminants of concern and the project duration are important factors. The costs for the onsite laboratory included the capital costs associated with setting up the lab such as trailer(s) or building(s), power and water hookup, analytical testing equipment, balances, computers, desks and bookcases; support equipment such as hot plates, filtration assemblies, safety equipment, ovens, etc.; and supplies such as glassware, pipettes, filters, etc. and ongoing costs such as labor, chemicals and reagents, standards, cost of the laboratory obtaining certification and maintenance. Offsite laboratory sample testing costs are generally very competitive and typically substantially lower than onsite laboratory costs if only the sample testing costs are considered. The great disadvantage of using an offsite laboratory is that they often cannot guarantee rapid turnaround times for results which creates project delays associated with the remediation process including delays determining the completeness of the characterization and remediation processes, delays in backfilling a property and additional costs for treating wastewater (excavation water, stormwater or both). These costs will vary greatly depending upon the area of the country in which the project is located due to the wide range of labor costs for the onsite laboratory and field workers, as well as the contaminants of interest, matrices and most importantly the size of the impacted area and the number of properties located in that area. This paper provides guidelines for calculating the cost savings that may be realized if an onsite laboratory can generate results more quickly than an offsite laboratory by estimating the costs associated with the remediation process for the various scenarios noted above such as work crew labor costs, excavator and dump truck equipment rentals, wastewater treatment costs (if applicable) and the additional costs incurred by homeowners, commercial property owners and towns/municipalities that are reimbursed by the potentially responsible parties. Key assumptions involve the typical quickest turnaround time provided by the onsite and offsite laboratories. Costs for the operation of a wastewater treatment system and the remediation of a site area or property were provided by personnel who have been involved in the operation of a large FUSRAP site in New Jersey for many years. This study provides valuable information for determining the most cost-effective approach for analysis of project samples and therefore may be used on upcoming FUSRAP projects. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Development of Advanced Verification and Validation Procedures and Tools for the Certification of Learning Systems in Aerospace Applications

Adaptive control technologies that incorporate learning algorithms have been proposed to enable automatic flight control and vehicle recovery, autonomous flight, and to maintain vehicle performance in the face of unknown, changing, or poorly defined operating environments. In order for adaptive control systems to be used in safety-critical aerospace applications, they must be proven to be highly safe and reliable. Rigorous methods for adaptive software verification and validation must be developed to ensure that control system software failures will not occur. Of central importance in this regard is the need to establish reliable methods that guarantee convergent learning, rapid convergence (learning) rate, and algorithm stability. This paper presents the major problems of adaptive control systems that use learning to improve performance. The paper then presents the major procedures and tools presently developed or currently being developed to enable the verification, validation, and ultimate certification of these adaptive control systems. These technologies include the application of automated program analysis methods, techniques to improve the learning process, analytical methods to verify stability, methods to automatically synthesize code, simulation and test methods, and tools to provide on-line software assurance.

Jacklin, Stephen↗

Ground Support for the Space-Based Range Flight Demonstration 2

The primary objective of the NASA Space-Based Range Demonstration and Certification program was to develop and demonstrate space-based range capabilities. The Flight Demonstration 2 flights at NASA Dryden Flight Research Center were conducted to support Range Safety (commanding and position reporting) and high-rate (5 Mbps) Range User (video and data) requirements. Required ground support infrastructure included a flight termination system computer, the ground-data distribution network to send range safety commands and receive range safety and range user telemetry data and video, and the ground processing systems at the Dryden Mission Control Center to process range safety and range user telemetry data and video.

Burkes, Darryl A.↗

NASA Support for Commercial Crew Launch Capabilities

Since the earliest days of U.S. human spaceflight, NASA’s Marshall Space Flight Center in Huntsville, Alabama, has played a key role in American crew launch capability, from engineering support for the first Mercury-Redstone launches, to the Saturn launches to the Moon, through Shuttle and now Artemis. Today, Marshall brings that expertise gained through decades of crewed space launches to NASA’s Commercial Crew Program (CCP), providing launch vehicle engineering and programmatic support. The team’s responsibilities have included human certification of commercial launch systems for the CCP missions, including Atlas V and Falcon 9, and verifying each launch vehicle complies with flight certification. MSFC provides expertise in nearly all aspects of launch vehicle design and performance including solid motors and liquid engines, stage propulsion, thrust vector control, structural and dynamics, safety and mission assurance. During each commercial crew launch, an engineering support team is on console at Marshall’s Huntsville Operations Support Center, which has provided launch operations support since Apollo, providing real-time oversight to safety standards for the vehicle and verifying data. Launch vehicle support for Commercial Crew has come as a paradigm shift for the MSFC team, inspiring new approaches that leverage expertise and best practices from past NASA-developed launch vehicle missions, while at the same time providing new synergies from work with commercial partners on CCP. This paper will explore the role that the Marshall launch vehicle services team plays in the Commercial Crew Program, as well as lessons learned from the program that will continue to benefit a new era of spaceflight partnerships.

Commercial Crew↗

Projection Operator: A Step Towards Certification of Adaptive Controllers

One of the major barriers to wider use of adaptive controllers in commercial aviation is the lack of appropriate certification procedures. In order to be certified by the Federal Aviation Administration (FAA), an aircraft controller is expected to meet a set of guidelines on functionality and reliability while not negatively impacting other systems or safety of aircraft operations. Due to their inherent time-variant and non-linear behavior, adaptive controllers cannot be certified via the metrics used for linear conventional controllers, such as gain and phase margin. Projection Operator is a robustness augmentation technique that bounds the output of a non-linear adaptive controller while conforming to the Lyapunov stability rules. It can also be used to limit the control authority of the adaptive component so that the said control authority can be arbitrarily close to that of a linear controller. In this paper we will present the results of applying the Projection Operator to a Model-Reference Adaptive Controller (MRAC), varying the amount of control authority, and comparing controller s performance and stability characteristics with those of a linear controller. We will also show how adjusting Projection Operator parameters can make it easier for the controller to satisfy the certification guidelines by enabling a tradeoff between controller s performance and robustness.

Larchev, Gregory V.↗

Automatic systems and the low-level wind hazard

Automatic flight control systems provide means for significantly enhancing survivability in severe wind hazards. The technology required to produce the necessary control algorithms is available and has been made technically feasible by the advent of digital flight control systems and accurate, low-noise sensors, especially strap-down inertial sensors. The application of this technology and these means has not generally been enabled except for automatic landing systems, and even then the potential has not been fully exploited. To fully exploit the potential of automatic systems for enhancing safety in wind hazards requires providing incentives, creating demand, inspiring competition, education, and eliminating prejudicial disincentitives to overcome the economic penalties associated with the extensive and riskly development and certification of these systems. If these changes will come about at all, it will likely be through changes in the regulations provided by the certifying agencies.

Schaeffer, Dwight R.↗

National plan to enhance aviation safety through human factors improvements

The purpose of this section of the plan is to establish a development and implementation strategy plan for improving safety and efficiency in the Air Traffic Control (ATC) system. These improvements will be achieved through the proper applications of human factors considerations to the present and future systems. The program will have four basic goals: (1) prepare for the future system through proper hiring and training; (2) develop a controller work station team concept (managing human errors); (3) understand and address the human factors implications of negative system results; and (4) define the proper division of responsibilities and interactions between the human and the machine in ATC systems. This plan addresses six program elements which together address the overall purpose. The six program elements are: (1) determine principles of human-centered automation that will enhance aviation safety and the efficiency of the air traffic controller; (2) provide new and/or enhanced methods and techniques to measure, assess, and improve human performance in the ATC environment; (3) determine system needs and methods for information transfer between and within controller teams and between controller teams and the cockpit; (4) determine how new controller work station technology can optimally be applied and integrated to enhance safety and efficiency; (5) assess training needs and develop improved techniques and strategies for selection, training, and evaluation of controllers; and (6) develop standards, methods, and procedures for the certification and validation of human engineering in the design, testing, and implementation of any hardware or software system element which affects information flow to or from the human.

Foushee, Clay↗

Validation and Verification (V&V) of Safety-Critical Systems Operating Under Off-Nominal Conditions

Loss of control (LOC) remains one of the largest contributors to aircraft fatal accidents worldwide. Aircraft LOC accidents are highly complex in that they can result from numerous causal and contributing factors acting alone or more often in combination. Hence, there is no single intervention strategy to prevent these accidents. Research is underway at the National Aeronautics and Space Administration (NASA) in the development of advanced onboard system technologies for preventing or recovering from loss of vehicle control and for assuring safe operation under off-nominal conditions associated with aircraft LOC accidents. The transition of these technologies into the commercial fleet will require their extensive validation and verification (V&V) and ultimate certification. The V&V of complex integrated systems poses highly significant technical challenges and is the subject of a parallel research effort at NASA. This chapter summarizes the V&V problem and presents a proposed process that could be applied to complex integrated safety-critical systems developed for preventing aircraft LOC accidents. A summary of recent research accomplishments in this effort is referenced.

Belcastro, Christine M.↗

Improving Safety on the International Space Station: Transitioning to Electronic Emergency Procedure Books on the International Space Station

The National Aeronautics and Space Administration (NASA) originally designed the International Space Station (ISS) to operate until 2015, but have extended operations until at least 2020. As part of this very dynamic Program, there is an effort underway to simplify the certification of Commercial ]of ]the ]Shelf (COTS) hardware. This change in paradigm allows the ISS Program to take advantage of technologically savvy and commercially available hardware, such as the iPad. The iPad, a line of tablet computers designed and marketed by Apple Inc., was chosen to support this endeavor. The iPad is functional, portable, and could be easily accessed in an emergency situation. The iPad Electronic Flight Bag (EFB), currently approved for use in flight by the Federal Aviation Administration (FAA), is a fraction of the cost of a traditional Class 2 EFB. In addition, the iPad fs ability to use electronic aeronautical data in lieu of paper in route charts and approach plates can cut the annual cost of paper data in half for commercial airlines. ISS may be able to benefit from this type of trade since one of the most important factors considered is information management. Emergency procedures onboard the ISS are currently available to the crew in paper form. Updates to the emergency books can either be launched on an upcoming visiting vehicle such as a Russian Soyuz flight or printed using the onboard ISS printer. In both cases, it is costly to update hardcopy procedures. A new operations concept was proposed to allow for the use of a tablet system that would provide a flexible platform to support space station crew operations. The purpose of the system would be to provide the crew the ability to view and maintain operational data, such as emergency procedures while also allowing Mission Control Houston to update the procedures. The ISS Program is currently evaluating the safety risks associated with the use of iPads versus paper. Paper products can contribute to the flammability risk and require manual updates that take time away from research tasks. The ISS program has recently purchased three iPads for the astronauts and the certification has been approved. The crew is currently using the iPads onboard. The results of this analysis could be used to discern whether the iPad is a viable option for use in emergencies by assessing the risk posture through the development of a quantitative probabilistic risk assessment (PRA).

Carter-Journet, Katrina↗

Selection and Assessment of Predictions of the Mars Pathfinder Landing Site

The successful landing of the Mars Pathfinder spacecraft on Mars allows the review of the process of selecting the landing site and assessing predictions made for the site based on Viking and Earth-based data. Selection of the landing site for Mars Pathfinder was a two-phase process. The first phase took place from October 1993 to June 1994 and involved: initial identification of engineering constraints, definition of environmental conditions at the site for spacecraft design, and evaluation of the scientific potential of different landing sites. This phase culminated with the first "Mars Pathfinder Landing Site Workshop", held at the Lunar and Planetary Institute in Houston, Texas on April 18-19, 1994, in which suggested approaches and landing sites were solicited from the entire scientific community. A preliminary site was selected by the project for design purposes in June 1994. The second phase took place from July 1994 to March 1996 and involved: developing criteria for evaluating site safety using images and remote sensing data, testing of the spacecraft and landing subsystems (with design improvements) to establish quantitative engineering constraints on landing site characteristics, evaluating all potential landing sites on Mars, and certification of the site by the project. This phase included a second open workshop, "Mars Pathfinder Landing Site Workshop II: Characteristics of the Ares Vallis Region and Field Trips in the Channeled Scabland, Washington" held in Spokane and Moses Lake September 24-30, 1995 and formal acceptance of the site by NASA Headquarters. Engineering constraints on Pathfinder landing sites were developed from the initial design of the spacecraft and the entry, descent and landing scenario. The site must be within 5 degrees of the subsolar latitude at the time of landing (15N for maximum solar power and flexible communications with Earth. It also must be below 0 km elevation to enable enough time for the parachute to bring the lander to the proper terminal velocity for landing. The entire landing ellipse, which is 70 km by 200 km due to navigational, ephemeris and atmospheric uncertainties, must be free of steep slopes, scarps and obvious hazards in Viking orbiter images, have acceptable radar reflectivity, moderate rock abundances and have little or no dust. Scientific considerations of the Mars Pathfinder payload and mission indicate that analyses of "grab bag" samples at the mouths of outflow channels can offer a first order assessment of a variety of rock types on Mars. Highland sites offer the advantage of in situ analysis of ancient rocks on Mars that record crustal differentiation and the nature of the early environment. Dark gray sites offer the potential of analyzing unweathered and unoxidized materials. Following a general assessment of the safety of different sites, a preliminary selection of a "grab bag" site was made. This site, Ares Vallis, is near the mouth of an outflow channel that may contain ancient Noachian terrain, Hesperian ridged plains, and reworked channel materials. All potential landing sites on Mars that met basic safety criteria were analyzed in detail. Sites (100 by 200 km target ellipses) were considered safe if they were below 0 km elevation, were free of obvious hazards (high relief surface features) in high-resolution (< 50 m/pixel) Viking orbiter images and had acceptable reflectivity and roughness at radar wavelengths, high thermal inertia, moderate rock abundance, low red to violet ratio, and low albedo. Only 4 sites on Mars met all the above criteria, which included 1995 opposition 3.5 cm delay-Doppler radar data. Complete data were evaluated for 7 sites and the Viking landing sites for comparison for all the above criteria as well as crater abundance, hill and mesa abundance, slopes over meter to kilometer scales, low altitude winds (from global circulation models and slopes), the size-frequency distribution of large rocks, as well as rover trafficability and science potential. Discussion of potential hazards at Ares Vallis using a variety of data sets (including radar) at a second open workshop, indicated this site cannot be shown to be any more hazardous than the Viking landing sites. Field trips to the Channeled Scabland and the Ephrata Fan, analogs for Ares Vallis and the landing site, respectively, provided valuable insight into possible geologic processes and potential surface characteristics. Three sites met all the data requirements and safety criteria for landing Pathfinder. Ares Vallis was selected by the project because it appeared acceptably safe (although it appeared to have greater rock abundances than other sites, its elevation was likely the best known) and offered the prospect of analyzing a variety of rock types expected to be deposited by catastrophic floods, which would enable addressing first-order scientific questions such as differentiation of the crust, the development of weathering products, and the nature of the early martian environment and its subsequent evolution. The selection was reviewed by an external board at a number of meetings and accepted, and the site was approved by NASA Headquarters. Data gathered by the Pathfinder lander' and rover provides the opportunity to test the predictions made for the site in the selection process based on remote observations from Earth, orbit, and the surface. The discussion below is taken from Golombek et al. to which the reader is referred for a more complete discussion and a complete list of references, which are omitted here for brevity. Many characteristics of the landing site are consistent with its being shaped and deposited by the Ares and Tiu catastrophic floods. The rocky surface is consistent a depositional plain comprising semi-rounded pebbles, cobbles and tabular boulders (some of which appear imbricated and/or inclined in the direction of flow) that appear similar to depositional plains in terrestrial catastrophic floods. The Twin Peaks appear to be streamlined hills in lander images, which is consistent with interpretations of larger hills in Viking orbiter images of the region that suggest the lander is on the flank of a broad, gentle ridge trending northeast from Twin Peaks. This ridge, which is the rise to the north of the lander, is aligned in the downstream direction from the Ares and Tiu Valles floods, and may be a debris tail deposited in the wake of the Twin Peaks. Channels visible throughout the scene may be a result of late stage drainage. As predicted by delay-Doppler radar measurements and tracking results, the average elevation of the center of the site was about the same as Viking Lander I relative to the 6.1 mbar geoid. The Doppler tracking and two-way ranging estimate for the elevation of the spacecraft is only 45 in lower than the Viking I Lander and within 100 in of that expected, which is within the uncertainties of the measurements. After landing, surface pressures and winds (5-10 m/s) were found to be similar to expectations based on Viking data, although temperatures were about 10 K warmer. The temperature profile below 50 km was also roughly 20 K warmer. As a result, predicted densities were 5% higher near the surface and up to 40% lower at 50 km but within the entry, descent and landing design margins. The populations of craters and small hills and the slopes of the hills measured in high-resolution (38 m/pixel) Viking orbiter images and the radar derived slopes of the landing site are all consistent with observations of these properties in the lander images. A rocky surface was expected from Viking Infra-Red Thermal Mapper (IRTM) observations and comparisons with the Viking landing sites. The observed cumulative fraction of area covered by rocks with diameters greater than 3 cm and heights greater than 0.5 in (potentially hazardous to landing) at Ares is similar to that predicted by IRTM observations and models of Viking lander and Earth analog rock size-frequency distributions. The IRTM prediction postulated an effective thermal inertia of 30 (10(exp -3) cgs units - cal/cubic cm/s(exp 0.5)/K) for the rock population, but we obtain a slightly different effective thermal inertia for the actual rock population. The validity of interpretations of radar echoes prior to landing are supported by a simple radar echo model, an estimate of the reflectivity of the soil from its bulk density, and the fraction of area covered by rocks. In the calculations, the soil produces the quasi-specular echo and the rocks produce the diffuse echo. The derived quasispecular cross section is comparable to the cross-sections and reflectivities reported for 3.5-cm wavelength observations. The model yields a diffuse echo that is modestly larger than the polarized diffuse echo reported for 3.5-cm wavelength observations. At 12.5-cm wavelength, similar rock populations at Ares and the Viking I site were expected because the diffuse echoes are comparable, but the large normal reflectivities suggests that bulk densities of the soils at depth are greater than those at the surface. We also obtain a fine-component inertia near 8.4 which agrees with the fine-component inertia of 8.7 (in 10(exp -3) cgs units) estimated from thermal observations from orbit by the IRTM; for this estimate, we used a bulk thermal inertia of 10.4 for the landing site, an effective thermal inertia near 40 (10(exp -3) cgs units) for the rock population, and a graphical representation of Kieffer's model. Color and albedo data for Ares suggested surfaces of materials at Ares Vallis would be relatively dust free or unweathered prior to landing compared with the materials at the Viking landing sites. This suggestion is supported by the abundance of relatively dark-gray rocks at Ares and their relative rarity at the Viking landing sites, where rocks are commonly coated with bright red dust. Finally, the 40 km long Ephrata Fan of the Channeled Scabland in Washington state, which was deposited where c

Golombek, M. P.↗

Station Program Note Pull Automation

Upon commencement of my internship, I was in charge of maintaining the CoFR (Certificate of Flight Readiness) Tool. The tool acquires data from existing Excel workbooks on NASA's and Boeing's databases to create a new spreadsheet listing out all the potential safety concerns for upcoming flights and software transitions. Since the application was written in Visual Basic, I had to learn a new programming language and prepare to handle any malfunctions within the program. Shortly afterwards, I was given the assignment to automate the Station Program Note (SPN) Pull process. I developed an application, in Python, that generated a GUI (Graphical User Interface) that will be used by the International Space Station Safety & Mission Assurance team here at Johnson Space Center. The application will allow its users to download online files with the click of a button, import SPN's based on three different pulls, instantly manipulate and filter spreadsheets, and compare the three sources to determine which active SPN's (Station Program Notes) must be reviewed for any upcoming flights, missions, and/or software transitions. Initially, to perform the NASA SPN pull (one of three), I had created the program to allow the user to login to a secure webpage that stores data, input specific parameters, and retrieve the desired SPN's based on their inputs. However, to avoid any conflicts with sustainment, I altered it so that the user may login and download the NASA file independently. After the user has downloaded the file with the click of a button, I defined the program to check for any outdated or pre-existing files, for successful downloads, to acquire the spreadsheet, convert it from a text file to a comma separated file and finally into an Excel spreadsheet to be filtered and later scrutinized for specific SPN numbers. Once this file has been automatically manipulated to provide only the SPN numbers that are desired, they are stored in a global variable, shown on the GUI, and transferred over to a new Excel worksheet for comparison. I managed to get my application to acquire the CSWG (Computer Safety Working Group) and the SPNWG (Space Station Working Group) SPN's with just two mouse clicks for each pull, as opposed to several from the original process. When all three pulls are performed, an Excel sheet containing all three different results will be generated for the user to compare and determine which SPN's will be presented or reviewed the following month. The experience from this internship has been spectacular. As a high school senior who will begin attending college in the fall, this internship has been both educationally and occupationally beneficial. The internship has allowed me the opportunities to learn new programming languages, effectively network with NASA personnel from a variety of departments at JSC, and allowed me to learn new professional skills and etiquette. My internship at NASA's Johnson Space Center has further motivated me to pursue a Master's degree in Software Engineering and strive for a prosperous career with NASA as a civil servant.

Delgado, Ivan↗

TPSAS-NF1676L-35747-DND

The Aircraft Certification Service (AIR) Policy & Innovation Division supports aerospace innovation by creating novel means of compliance, develops and maintains AIR regulations, manages the Chief Scientific and Technical Advisors and overall fleet safety, as well as educational outreach.

E H Glaessgen↗

Guidance and Control Software Project Data - Volume 1: Planning Documents

The Guidance and Control Software (GCS) project was the last in a series of software reliability studies conducted at Langley Research Center between 1977 and 1994. The technical results of the GCS project were recorded after the experiment was completed. Some of the support documentation produced as part of the experiment, however, is serving an unexpected role far beyond its original project context. Some of the software used as part of the GCS project was developed to conform to the RTCA/DO-178B software standard, "Software Considerations in Airborne Systems and Equipment Certification," used in the civil aviation industry. That standard requires extensive documentation throughout the software development life cycle, including plans, software requirements, design and source code, verification cases and results, and configuration management and quality control data. The project documentation that includes this information is open for public scrutiny without the legal or safety implications associated with comparable data from an avionics manufacturer. This public availability has afforded an opportunity to use the GCS project documents for DO-178B training. This report provides a brief overview of the GCS project, describes the 4-volume set of documents and the role they are playing in training, and includes the planning documents from the GCS project. Volume 1 contains five appendices: A. Plan for Software Aspects of Certification for the Guidance and Control Software Project; B. Software Development Standards for the Guidance and Control Software Project; C. Software Verification Plan for the Guidance and Control Software Project; D. Software Configuration Management Plan for the Guidance and Control Software Project; and E. Software Quality Assurance Activities.

Hayhurst, Kelly J.↗

Towards a Certified Lightweight Array Bound Checker for Java Bytecode

Dynamic array bound checks are crucial elements for the security of a Java Virtual Machines. These dynamic checks are however expensive and several static analysis techniques have been proposed to eliminate explicit bounds checks. Such analyses require advanced numerical and symbolic manipulations that 1) penalize bytecode loading or dynamic compilation, 2) complexify the trusted computing base. Following the Foundational Proof Carrying Code methodology, our goal is to provide a lightweight bytecode verifier for eliminating array bound checks that is both efficient and trustable. In this work, we define a generic relational program analysis for an imperative, stackoriented byte code language with procedures, arrays and global variables and instantiate it with a relational abstract domain as polyhedra. The analysis has automatic inference of loop invariants and method pre-/post-conditions, and efficient checking of analysis results by a simple checker. Invariants, which can be large, can be specialized for proving a safety policy using an automatic pruning technique which reduces their size. The result of the analysis can be checked efficiently by annotating the program with parts of the invariant together with certificates of polyhedral inclusions. The resulting checker is sufficiently simple to be entirely certified within the Coq proof assistant for a simple fragment of the Java bytecode language. During the talk, we will also report on our ongoing effort to scale this approach for the full sequential JVM.

Pichardie, David↗

Automatic Dependent Surveillance-Broadcast (ADS-B) In-Trail Procedures (ITP)

Aircraft in oceanic and remote non-radar airspace frequently fly for extended periods of time in the same direction, at the same time, along similar flight paths as other aircraft. Since there is no radar surveillance, controllers use procedural separation to ensure that aircraft remain separated. Procedural separation distances are typically larger than radar separation distances and as a result aircraft operating in oceanic airspace are sometimes held at non-optimal flight levels due to conflicting traffic at intervening flight levels. Automatic Dependent Surveillance-Broadcast (ADS-B) In-Trail Procedures (ITP) were developed to enable flight level change maneuvers that would otherwise not be possible with current procedural separation standards. Aircraft operators choosing to equip with an ADS-B transceiver and an appropriate onboard decision support system would be able to take advantage of these procedures when operating in proximity to aircraft equipped with a suitable ADS-B transmitter (“ADS-B Out”). The ability to perform in-trail maneuvers to achieve more time at optimum altitudes could result in more efficient and predictable flight profiles thereby saving fuel and in some cases allowing operators to make beneficial operational decisions. NASA first began developing ADS-B ITP in 2003 as a result of a desire to develop methodologies, concepts, and procedures to reduce separation requirements for future air transportation systems using airborne ADS-B. The objectives were to provide insight into the details necessary to reduce separation requirements for the future and to develop applications that could provide incentives for operators to voluntarily equip with transformational technologies. From 2003 to 2008, NASA conducted research that supported the development of ITP including batch simulations, human-in-the-loop experiments and avionics and separation standards development. This research showed enough maturity and benefit that in 2008, the FAA Surveillance and Broadcast Services (SBS) program adopted ADS-B ITP as one of their three key, near-term applications to make use of ADS-B-In. The FAA developed an agreement with NASA to transition the technology and established an FAA project for the purpose of performing an operational trial of ADS-B ITP in revenue service in the summer of 2011. The objectives of the project are to a) validate the operational performance and economic benefits of ITP; and b) develop and validate ADS-B ITP Minimum Operational Performance Specifications (MOPS) material. As a part of this project, the FAA established agreements with United Airlines and Honeywell. The agreements include the work necessary for the development, certification and installation of onboard systems for twelve United Airlines 747-400s. ITP system development is nearly complete and certification activities are underway. The FAA project has also been working with Oakland Oceanic Control Center (ZOA) and the FAA’s Oceanic and Offshore Operations Office to develop controller procedures and safety analyses that are required to support the flight trial. The FAA has also been working on the development of an ITP Operational Specification that should be approved this April. The presentation will cover some of the key aspects of the development, challenges, and integration required to successfully transition ADS-B ITP from a concept in 2003 to flight trials in revenue service in 2011.

Kenneth M Jones↗