SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
A viewgraph describing formal approaches taken to assure the safety of space software is presented. The topics include: 1) Certifiable Program Generation; 2) Certification Framework; 3) Annotation Generation; 4) Experiments; and 5) Future Work.
One of the claims made by proponents of Ada is that Ada software is highly reusable. The fact that specifications are compiled and accessible would make reusability seem easily achievable. However, specifications give only a limited amount of information about a package; moreover, a specification cannot help determine whether a package worked, or how well it worked. This problem has led to the concept of certifying Ada parts for reuse; that is, determining the worthiness of a part as a reusable component. Issues that are critical to reuse are addressed: the characterization of part performance, design for reuse, and correct utilization of parts. Current areas of study beneficial in the development of a certification process are then addressed.
This paper presents an overview of a Traffic Aware Strategic Aircrew Requests (TASAR) Electronic Flight Bag application intended to inform the pilot of trajectory improvement opportunities while en route that result in operational benefits. The results of safety analyses and a detailed review of Federal Aviation Administration (FAA) regulatory documents that establish certification and operational approval requirements are presented for TASAR. The safety analyses indicate that TASAR has a likely Failure Effects Classification of “No Effect,” and at most, is no worse than “Minor Effect.” Based on this safety assessment and the detailed review of FAA regulatory documents that determine certification and operational approval requirements, this study concludes that TASAR can be implemented in the flight deck as a Type B software application hosted on a Class 2 Portable Electronic Device (PED) Electronic Flight Bag (EFB). This implementation approach would provide a relatively low-cost path to certification and operational approval for both retrofit and forward fit implementation, while at the same time facilitating the business case for early ADS-B IN equipage. A preliminary review by FAA certification and operational approvers of the analyses presented here confirmed that the conclusions are appropriate and that TASAR will be considered a Type B application.
ANSYS Inc. develops and markets engineering simulation software and services used in the aerospace, automotive, manufacturing, electronics, biomedical, energy, defense, and many other industries. ANSYS is dedicated to engineering simulation and is the world’s leading software provider. ANSYS was founded in 1970 and is headquartered in Canonsburg, Pennsylvania. ANSYS provides an engineering analysis tool combining structural, thermal, computational fluid dynamics, acoustic, and electromagnetic simulation capabilities. ANSYS has two main programs, which use the same solvers: (1) Mechanical APDL (ANSYS Design Parametric Language), a Fortran-based coding platform, and (2) ANSYS Workbench, which uses a graphical user interface to aid in finite element analysis implementation. This plan covers both APDL and Workbench. The ANSYS computer program is a large-scale, multipurpose finite element program that can be used to solve several classes of engineering analyses. The analysis capabilities of ANSYS include the ability to solve static and dynamic structural analyses, steady-state and transient heat transfer problems, mode-frequency and buckling eigenvalue problems, static or time-varying magnetic analyses, and various types of field and coupled-field applications. The program contains many special features that allow nonlinearities or secondary effects such as plasticity, large strain, hyperelasticity, creep, swelling, large deflections, contact, stress stiffening, temperature dependency, material anisotropy, and radiation to be included in the solution. As ANSYS has been developed, other special capabilities such as substructuring, submodeling, random vibration, kinetostatics, kinetodynamics, free convection fluid analysis, acoustics, magnetics, piezoelectrics, coupled-field analysis, and design optimization have been added to the program. These capabilities contribute further to making ANSYS a multipurpose analysis tool for varied engineering disciplines. The ANSYS program has been in commercial use for over 50 years and has been used extensively in the aerospace, automotive, construction, electronic, energy services, manufacturing, nuclear, plastics, oil, and steel industries. Additionally, many consulting firms and hundreds of universities have used ANSYS for analysis, research, and educational purposes. ANSYS is recognized worldwide as one of the most widely used and capable programs of its type. Ansys design analysis software is the first created within a quality system with ISO 9001 certification, the internationally accepted quality standard. Product development, testing, maintenance and support processes also meet the United States Nuclear Regulatory Commission's quality requirements, as they have for nearly four decades. The Quality Assurance Service Agreement is suitable for the customers working in the nuclear industry who need to meet specific federal regulations including 10CRF50 Appendix B and provisions of 10CFR21. ANSYS has retained its original International Organization for Standardization (ISO) 9001 accreditation certificate since1995-05-04, It’s current certificate is valid until 2027-05-29.
Described is an introduction to a comprehensive database that is to be used for certification testing of airborne forward-look windshear detection systems. The database was developed by NASA Langley Research Center, at the request of the Federal Aviation Administration (FAA), to support the industry initiative to certify and produce forward-looking windshear detection equipment. The database contains high-resolution three-dimensional fields for meteorological variables that may be sensed by forward-looking systems. The database is made up of seven case studies that are generated by the Terminal Area Simulation System, a state-of-the-art numerical system for the realistic modeling of windshear phenomena. The selected cases contained in the certification documentation represent a wide spectrum of windshear events. The database will be used with vendor-developed sensor simulation software and vendor-collected ground-clutter data to demonstrate detection performance in a variety of meteorological conditions using NASA/FAA pre-defined path scenarios for each of the certification cases. A brief outline of the contents and sample plots from the database documentation are included. These plots show fields of hazard factor, or F-factor (Bowles 1990), radar reflectivity, and velocity vectors on a horizontal plane overlayed with the applicable certification paths. For the plot of the F-factor field the region of 0.105 and above signify an area of hazardous, performance decreasing windshear, while negative values indicate regions of performance increasing windshear. The values of F-factor are based on 1-Km averaged segments along horizontal flight paths, assuming an air speed of 150 knots (approx. 75 m/s). The database has been released to vendors participating in the certification process. The database and associated document have been transferred to the FAA for archival storage and distribution.
The projects undertaken by The Concurrent Engineering Research Center (CERC) at West Virginia University are reported and summarized. CERC's participation in the Department of Defense's Defense Advanced Research Project relating to technology needed to improve the product development process is described, particularly in the area of advanced weapon systems. The efforts committed to improving collaboration among the diverse and distributed health care providers are reported, along with the research activities for NASA in Independent Software Verification and Validation. CERC also takes part in the electronic respirator certification initiated by The National Institute for Occupational Safety and Health, as well as in the efforts to find a solution to the problem of producing environment-friendly end-products for product developers worldwide. The 3M Fiber Metal Matrix Composite Model Factory Program is discussed. CERC technologies, facilities,and personnel-related issues are described, along with its library and technical services and recent publications.
The Test and Engineering Directorate at NASA John C. Stennis Space Center developed an interest to study the modeling, evaluation, and control of a liquid hydrogen (LH2) and gas hydrogen (GH2) mixer subsystem of a ground test facility. This facility carries out comprehensive ground-based testing and certification of liquid rocket engines including the Space Shuttle Main engine. A software simulation environment developed in MATLAB/SIMULINK (M/S) will allow NASA engineers to test rocket engine systems at relatively no cost. In the progress report submitted in February 2004, we described the development of two foundation programs, a reverse look-up application using various interpolation algorithms, a variety of search and return methods, and self-checking methods to reduce the error in returned search results to increase the functionality of the program. The results showed that these efforts were successful. To transfer this technology to engineers who are not familiar with the M/S environment, a four-module GUI was implemented allowing the user to evaluate the mixer model under open-loop and closed-loop conditions. The progress report was based on an udergraduate Honors Thesis by Ms. Jamie Granger Austin in the Department of Electrical Engineering and Computer Science at Tulane University, during January-May 2003, and her continued efforts during August-December 2003. In collaboration with Dr. Hanz Richter and Dr. Fernando Figueroa we published these results in a NASA Tech Brief due to appear this year. Although the original proposal in 2003 did not address other components of the test facility, we decided in the last few months to extend our research and consider a related pressurization tank component as well. This report summarizes the results obtained towards a Graphical User Interface (GUI) for the evaluation and control of the hydrogen mixer subsystem model and for the pressurization tank each taken individually. Further research would combine the two components - mixer and tank, for a more realistic simulation tool.
The Subsonic Fixed Wing Project of NASA's Fundamental Aeronautics Program has adopted a noise reduction goal for new, subsonic, single-aisle, civil aircraft expected to replace current 737 and A320 airplanes. These so-called 'N+1' aircraft - designated in NASA vernacular as such since they will follow the current, in-service, 'N' airplanes - are hoped to achieve certification noise goal levels of 32 cumulative EPNdB under current Stage 4 noise regulations. A notional, N+1, single-aisle, twinjet transport with ultrahigh bypass ratio turbofan engines is analyzed in this study using NASA software and methods. Several advanced noise-reduction technologies are analytically applied to the propulsion system and airframe. Certification noise levels are predicted and compared with the NASA goal.
The Subsonic Fixed Wing Project of NASA s Fundamental Aeronautics Program has adopted a noise reduction goal for new, subsonic, single-aisle, civil aircraft expected to replace current 737 and A320 airplanes. These so-called "N+1" aircraft--designated in NASA vernacular as such since they will follow the current, in-service, "N" airplanes--are hoped to achieve certification noise goal levels of 32 cumulative EPNdB under current Stage 4 noise regulations. A notional, N+1, single-aisle, twinjet transport with ultrahigh bypass ratio turbofan engines is analyzed in this study using NASA software and methods. Several advanced noise-reduction technologies are empirically applied to the propulsion system and airframe. Certification noise levels are predicted and compared with the NASA goal.
Machine Learning (ML) is revolutionizing many technological fields, but its use in aviation remains restricted due to stringent certification requirements. Efforts by the aviation community to establish standards for certifying ML-based systems are progressing, yet challenges persist, particularly with safety assessment methods for ML-based systems. This research addresses these challenges through a case study of an autonomous emergency braking system utilizing a computer vision deep neural network (DNN). We demonstrate a safety assessment process tailored to ML-specific concerns, such as low integrity and performance variability in quantitative safety analysis. This study can serve as an illustrative example to facilitate the discussion and convergence on certification aspects for ML-based systems within the aviation community.
The Rendezvous and Proximity Operations Program (RPOP) is real-time guidance, navigation, and control (GN&C) domain piloting-aid software that provides 3D Orbiter graphics and runs on the Space Shuttle's Criticality-3 Payload and General Support Computer (PGSC) in the crew cockpit. This software provides the crew with Situational Awareness during the rendezvous and proximity operations phases of flight. RPOP can be configured from flight to flight, accounting for mission-specific flight scenarios and target vehicles, via initialization load (I-load) data files. The software provides real-time, automated, closed-loop guidance recommendations and the capability to integrate the crew s manual backup techniques. The software can bring all relative navigation sensor data, including the Orbiter's GPC (general purpose computer) data, into one central application to provide comprehensive situational awareness of the rendezvous and proximity operations trajectory. RPOP also can separately maintain trajectory estimates (past, current, and predicted) based on certain data types and co-plot them, in order to show how the various navigation solutions compare. RPOP s best estimate of the relative trajectory is determined by a relative Kalman filter processing data provided by the sensor suite s most accurate sensor, the trajectory control sensor (TCS). Integrated with the Kalman filter is an algorithm that identifies the reflector that the TCS is tracking. Because RPOP runs on PC laptop computers, the development and certification lifecycles are more agile, flexible, and cheaper than those that govern the Orbiter FSW (flight software) that runs in the GPC. New releases of RPOP can be turned around on a 3- to 6-month template, from new Change Request (CR) to certification, depending on the complexity of the changes.
This report is based on one prepared as a chapter for the FAA Digital Systems Validation Handbook (a guide to assist FAA certification specialists with advanced technology issues). Its purpose is to explain the use of formal methods in the specification and verification of software and hardware requirements, designs, and implementations; to identify the benefits, weaknesses, and difficulties in applying these methods to digital systems used in critical applications; and to suggest factors for consideration when formal methods are offered in support of certification. The presentation concentrates on the rationale for formal methods and on their contribution to assurance for critical applications within a context such as that provided by DO-178B (the guidelines for software used on board civil aircraft); it is intended as an introduction for those to whom these topics are new.
Code to estimate position and attitude of a spacecraft or aircraft belongs to the most safety-critical parts of flight software. The complex underlying mathematics and abundance of design details make it error-prone and reliable implementations costly. AutoFilter is a program synthesis tool for the automatic generation of state estimation code from compact specifications. It can automatically produce additional safety certificates which formally guarantee that each generated program individually satisfies a set of important safety policies. These safety policies (e.g.. array-bounds, variable initialization) form a core of properties which are essential for high-assurance software. Here we describe the AutoFilter system and its certificate generator and compare our approach to the static analysis tool PolySpace.
Optical navigation of human spacecraft was proposed on Gemini and implemented successfully on Apollo as a means of autonomously operating the vehicle in the event of lost communication with controllers on Earth. The Orion emergency return system utilizing optical navigation has matured in design over the last several years, and is currently undergoing the final implementation and test phase in preparation for Exploration Mission 1 (EM-1) in 2019. The software development is past its Critical Design Review, and is progressing through test and certification for human rating. The filter architecture uses a square-root-free UDU covariance factorization. Linear Covariance Analysis (LinCov) was used to analyze the measurement models and the measurement error models on a representative EM-1 trajectory. The Orion EM-1 flight camera was calibrated at the Johnson Space Center (JSC) electro-optics lab. To permanently stake the focal length of the camera a 500 mm focal length refractive collimator was used. Two Engineering Design Unit (EDU) cameras and an EDU star tracker were used for a live-sky test in Denver. In-space imagery with high-fidelity truth metadata is rare so these live-sky tests provide one of the closest real-world analogs to operational use. A hardware-in-the-loop test rig was developed in the Johnson Space Center Electro-Optics Lab to exercise the OpNav system prior to integrated testing on the Orion vehicle. The software is verified with synthetic images. Several hundred off-nominal images are also used to analyze robustness and fault detection in the software. These include effects such as stray light, excess radiation damage, and specular reflections, and are used to help verify the tuning parameters chosen for the algorithms such as earth atmosphere bias, minimum pixel intensity, and star detection thresholds.
The results of a research project on the development of computer software are presented. Research funds of $200,000 were expended over a three year period for software design and projects in connection with Project LOGOS (computer-aided design and certification of computing systems). Abstracts of theses prepared during the project are provided.
Optical navigation of human spacecraft was proposed on Gemini and implemented successfully on Apollo as a means of autonomously operating the vehicle in the event of lost communication with controllers on Earth. It shares a history with the "method of lunar distances" that was used in the 18th century and gained some notoriety after its use by Captain James Cook during his 1768 Pacific voyage of the HMS Endeavor. The Orion emergency return system utilizing optical navigation has matured in design over the last several years, and is currently undergoing the final implementation and test phase in preparation for Exploration Mission 1 (EM-1) in 2019. The software development is being worked as a Government Furnished Equipment (GFE) project delivered as an application within the Core Flight Software of the Orion camera controller module. The mathematical formulation behind the initial ellipse fit in the image processing is detailed in Christian. The non-linear least squares refinement then follows the technique of Mortari as an estimation process of the planetary limb using the sigmoid function. The Orion optical navigation system uses a body fixed camera, a decision that was driven by mass and mechanism constraints. The general concept of operations involves a 2-hour pass once every 24 hours, with passes specifically placed before all maneuvers to supply accurate navigation information to guidance and targeting. The pass lengths are limited by thermal constraints on the vehicle since the OpNav attitude generally deviates from the thermally stable tail-to-sun attitude maintained during the rest of the orbit coast phase. Calibration is scheduled prior to every pass due to the unknown nature of thermal effects on the lens distortion and the mounting platform deformations between the camera and star trackers. The calibration technique is described in detail by Christian, et al. and simultaneously estimates the Brown-Conrady coefficients and the Star Tracker/Camera interlock angles. Accurate attitude information is provided by the star trackers during each pass. Figure 1 shows the various phases of lunar return navigation when the vehicle is in autonomous operation with lost ground communication. The midcourse maneuvers are placed to control the entry interface conditions to the desired corridor for safe landing. The general form of optical navigation on Orion is where still images of the Moon or Earth are processed to find the apparent angular diameter and centroid in the camera focal plane. This raw data is transformed into range and bearing angle measurements using planetary data and precise star tracker inertial attitude. The measurements are then sent to the main flight computer's Kalman filter to update the onboard state vector. The images are, of course, collected over an arc to converge the state and estimate velocity. The same basic technique was used by Apollo to satisfy loss-of-comm, but Apollo used manual crew sightings with a vehicle-integral sextant instead of autonomously processing optical imagery. The software development is past its Critical Design Review, and is progressing through test and certification for human rating. In support of this, a hardware-in-the-loop test rig was developed in the Johnson Space Center Electro-Optics Lab to exercise the OpNav system prior to integrated testing on the Orion vehicle. Figure 2 shows the rig, which the test team has dubbed OCILOT (Orion Camera In the Loop Optical Testbed). Analysis performed to date shows a delivery that satisfies an allowable entry corridor as shown in Figure 3.
This tutorial provides a practical approach to assessing modified condition/decision coverage (MC/DC) for aviation software products that must comply with regulatory guidance for DO-178B level A software. The tutorial's approach to MC/DC is a 5-step process that allows a certification authority or verification analyst to evaluate MC/DC claims without the aid of a coverage tool. In addition to the MC/DC approach, the tutorial addresses factors to consider in selecting and qualifying a structural coverage analysis tool, tips for reviewing life cycle data related to MC/DC, and pitfalls common to structural coverage analysis.
This slide presentation reviews the past and current research that NASA has done in the area of airframe icing. Both the history experimental efforts and model development to understand the process and problem of ice formation are reviewed. This has resulted in the development of new experimental methods, advanced icing simulation software, flight dynamics and experimental databases that have an impact on design, testing, construction and certification and qualification of the aircraft and its sub-systems.