Search

This paper discusses the development and testing of an upset recovery architecture that is applicable for both piloted and autonomous recoveries. The architecture was first developed for unmanned vehicles and intended for fully automated implementation. The architecture was extended for use in manned aircraft and, in particular, for situations in which recoveries are being manually flown by a pilot. This extension required development of display technology for presenting recommended recovery guidance to the pilot as well as modification of recovery strategies to make them suitable for execution by a human pilot. Most recently, the architecture has been extended to accommodate off-nominal vehicle dynamics (e.g., due to actuator failures) and has been structured specifically to facilitate implementation without modification and recertification of existing flight control software. The approaches have been tested in multiple pilot-in-the-loop simulation experiments, which have shown both favorable pilot opini...

Aircraft Loss-Of-Control (LOC) has been a longstanding contributor to fatal aviation accidents. The research presented herein is structured to directly address several known contributing and causal factors associated with vehicle upset and LOC. This paper discusses the development and evaluation of an approach to improve flight safety by visually providing closed-loop guidance for upset recovery that is robust to pilot behavior variation and is able to accommodate vehicle failures and impairment. The Damage Adaptive Guidance for piloted Upset Recovery (DAGUR) system provides continuous closed-loop recovery guidance via visual cues to reduce instances of inappropriate pilot reaction and pilot inaction. Adaptation enables the recovery module to provide appropriate guidance even in cases of vehicle damage or impairment. The recovery guidance system is also specifically designed to be robust to variations in pilot dynamic behavior (including behavior associated with high-stress situations). The adaptive recovery guidance is implemented “upstream” of the pilot and provided via visual cues; therefore it does not require modifications to existing flight control software (for fly-by-wire aircraft) and is equally applicable to non-fly-by-wire aircraft. Included desktop simulation and pilot-in-the-loop evaluation results show that the upset recovery guidance system is able to provide effective guidance for recovery from a variety of post-stall and unusual attitude upsets including cases of hardover control surface failures and that the recovery guidance is robust to large variations in pilot dynamic behavior. Additionally, pilots who evaluated the system indicated that they found the guidance to be useful and intuitive, and that it provided timely and measured recovery guidance. Quantitatively, the pilot-in-the-loop evaluation revealed that the recovery guidance significantly reduced subject pilot inceptor frequency content magnitude (energy) and the associated vehicle response.

Both autopilot systems and human pilots, particularly human pilots operating in instrument meteorological conditions, rely heavily on sensor feedback to safely control aircraft. The loss of reliable information for even a single state feedback signal can initiate a chain of events that leads to an accident. On small aircraft, hardware redundancy is often impractical and the failure of a single physical sensor could be the triggering event that leads to an accident. On commercial transport aircraft, hardware redundancy is typical for many key sensors, but common-mode failures are a significant hazard that can make hardware redundancy ineffective for achieving the desired system reliability. We have recently developed a virtual sensor redundancy approach to enhance flight safety in the event of sensor failures. The approach continuously monitors sensor data and pilot inputs, and uses these in combination with a model of the air vehicle dynamics to identify sensor faults. The effectiveness of the fault detection is ensured through multi-timescale methods that can detect severe faults very rapidly, while also looking over longer time horizons to capture more subtle faults, and by customized statistical tests that provide increased sensitivity for known failure modes. By using knowledge of sensor faults from the fault detection and isolation component, the system generates replacement virtual sensor outputs that are not influenced by the faulty sensor data. The approach also generates estimates of the uncertainty associated with the virtual sensor outputs that can be used in downstream algorithms to mitigate safety hazards.

The type certification process for aircraft intended to fly in the National Airspace System (NAS) incorporates a process for assuring that the airborne software to be run on such aircraft complies with Federal Aviation Regulations (FARs). At the time of the work described in this paper, FAA AC 20-115B recognized RTCA/DO-178B as a means for demonstrating this assurance, and in practice DO-178B has been the means used almost exclusively for many years. For some organizations and some software systems, alternatives to DO-178B might be more effective in terms of cost, applicability, flexibility, and even strength of the ultimate assurance claim. Assurance cases have generated significant interest as a possible tool for addressing software assurance challenges, including those associated with the Next Generation Air Transportation System (NextGen). This paper describes work to compare a compliance approach based on DO-178B to one based around assurance case methods, and to do so in the context of collision avoidance software that is representative of the challenges of NextGen software systems. The comparison revealed substantial differences between the methods, both in the associated engineering goals and in the level of maturity. The work produced two argument structures for demonstrating software compliance, including one based on the guidance of AC 20-171. The authors conclude that the assurance case methods have the potential to provide value in the software assurance process in large part by presenting an explicit rationale for software assurance that is missing from standards like DO-178B.

For manned aircraft, loss of control in flight (LOC-I) is one of the main causes of aviation fatalities; new technologies that help to reduce LOC-I thus have the potential to significantly reduce loss of life. This paper presents refinements and expanded testing of an in-cockpit cueing system intended to assist the crew with recovery from upset conditions. The goal of the system is to keep pilots in the loop, leveraging their expertise while simultaneously conveying information about recovery procedures in an intuitive and unobtrusive manner. The system optimizes recovery strategies offline, stores the recovery procedures in a compact manner that can easily be queried in real-time online, and communicates the procedure to the pilot through visual and haptic cues. Eleven pilots with a type rating in at least one large commercial transport aircraft, regional jet/turbo-prop were recruited to evaluate the system. The overall findings were: (1) pilots were willing to follow strategies provided by the in-cockpit cueing system, (2) following strategies provided by the in-cockpit cueing system results in a final aircraft state closer to straight and level flight at the target airspeed, (3) following strategies provided by the in-cockpit cueing system significantly reduces the likelihood that the pilot will exceed structural limits, (4) following strategies provided by the in-cockpit cueing system significantly reduces excursions from the nominal angle of attack envelope during the recovery, and (5) following strategies provided by the in-cockpit cueing system significantly reduces pilot workload.

To improve pilot situational awareness, the authors have designed an energy-state protection system to monitor the aircraft energy state and generate crew alerts through multiple modalities when the energy state deviates from a prescribed energy pro le. These alerts indicate whether the energy state of the aircraft is high or low as well as the magnitude of the deviation from the prescribed pro le. The system was evaluated for the approach ight phase in a xed-base ight simulator using ve ATP-rated test pilots. The overall ndings were: (1) the energy-state protection system improved energy tracking in a statistically signi cant manner without signi cantly impacting altitude, airspeed, or localizer tracking, (2) all test pilots found the energy-state protection system useful, and (3) the majority of test pilots found that the energy-state protection system reduced workload.

reduce loss of life. This paper presents the development and initial testing of a joint human/automated (H/A) recovery system intended to assist the crew with recovery from upset conditions. The goal of the system is to keep pilots in the loop, leveraging their expertise while simultaneously conveying information about recovery procedures in an intuitive and unobtrusive manner. This research builds on recent work by the authors targeted at autonomous upset recovery for unmanned aerial vehicles. The authors have developed a number of crew-specic extensions to this automated system at both the architecture and interface levels. The resulting system optimizes recovery strategies oine, stores the recovery procedures in a compact manner that can easily be queried in real-time online, and communicates the procedure to the pilot through visual and haptic cues. The system was evaluated in a small-scale pilot-in-the-loop study. Three pilots with dierent backgrounds as well as dierent levels of experience were recruited to take part in the pilot-in-the-loop experiments. Metrics were dened to evaluate performance both in terms of quantitative recovery metrics (e.g. how fast did the vehicle recover nominal ight?)

The human pilot is a crucial component of the Pilot/Vehicle System (PVS) and many researchers have recognized that the dynamic behavior of the human should be explicitly considered when analyzing human-in-the-loop systems. This paper focuses on human behavior modeling during upset recovery and how that pilot model is included in the pilotvehicle-system to determine and evaluate recovery techniques. The research discussed herein examines and models experimentally observed (in a simulator) pilot behavior, examines the role of the pilot model in the PVS, and uses the composite PVS model to determine recovery sequences that accommodate the dynamic behavior of the pilot/vehicle couple. Subsequently, the pilot models are updated to estimate how a pilot might behave under distress and new recovery sequences are extracted to accommodate the behavior of the distressed pilot. Simulation results show that explicit consideration of pilot dynamics, particularly the dynamics of the distressed pilot, in the generation of recovery sequences leads to more desirable responses of the PVS.

Stochastic modeling is of interest in a wide variety of applications including many related to aerospace systems. Design-time stochastic models can help engineers understand how variations in a variety of factors including manufacturing processes, operating conditions, and operational history are expected to impact the performance of engineered systems. One important use of such models is to help understand and minimize risks associated with experimental testing of such systems. In the experimental testing process, a particular test article is constructed and is typically exercised through a build-up sequence that begins with low risk test points and proceeds to higher risk points. Ideally, information obtained at low-risk test points would be used to update the stochastic model in a way that reects the characteristics of the specic test article, and the updated model would be used to update predictions of behavior at future test points. These updated predictions could be used to revise the test plan as needed to avoid unacceptable risk. This paper presents a framework for fusing experimental data and design time models that is based on the generalized polynomial chaos representation of random quantities. The framework is applied to modeling aeroelastic damping of a wing, and numerical examples show how experimental observations at low risk test points can be used to update expected damping distributions for the particular test article throughout the test range.

The development of a more unified theory of automatic target recognition (ATR) has received considerable attention over the last several years from individual researchers, working groups, and workshops. One of the major benefits expected to accrue from such a theory is an ability to analytically derive performance metrics that accurately predict real-world behavior. Numerous sources of uncertainty affect the actual performance of an ATR system, so direct calculation has been limited in practice to a few special cases because of the practical difficulties of manipulating arbitrary probability distributions over high dimensional spaces. This paper introduces an alternative approach for evaluating ATR performance based on a generalization of NorbertWiener's polynomial chaos theory. Through this theory, random quantities are expressed not in terms of joint distribution functions but as convergent orthogonal series over a shared random basis. This form can be used to represent any finite-variance distribution and can greatly simplify the propagation of uncertainties through complex systems and algorithms. The paper presents an overview of the relevant theory and, as an example application, a discussion of how it can be applied to model the distribution of position errors from target tracking algorithms.

to identify eroding margins so that corrective action can be taken in a timely manner. ROME can be used in operational settings to identify adverse conditions such as vehicle icing, damage, and failures, and in ight test settings to minimize risk and expedite verication and validation. It uses a general approach that can be applied both to next-generation vehicles with advanced control systems, and as a retrot to the existing operational eet. A baseline version of the ROME tool was demonstrated in a ight test environment during a recent deployment of NASA Langley’s AirSTAR Testbed. The initial testing evaluated the near real-time system identication and stability margin estimation capabilities of ROME. The ight tests also aorded an opportunity to evaluate several key aspects of the software implementation including the interface to the real-time data stream from the AirSTAR Mobile Operation Station. The ight testing validated the baseline capabilities of the ROME tool, including near real-time system and margin identication.

eet vehicles is the lack of adequate verication and validation (V&V) approaches. This paper proposes a validation methodology for diagnostic systems that combines probabilistic analysis of diagnostic system performance with worst-case analysis methods and tools that have been previously applied to control law validation. The goals of the methodology are to accurately identify probabilistic measures of diagnostic system performance, leverage these metrics to help understand interactions between diagnostics and other algorithmic components in an air vehicle, and assess how these interactions impact safety of

Advanced control approaches offer the potential to significantly improve the safety and performance of next-generation aerospace systems. These systems can compensate for failures and damage as well as provide enhanced capabilities such as increased autonomy. Despite many successful demonstrations of advanced control laws in simulations and flight tests, the difficulty associated with the verification, validation, and testing of adaptive and nondeterministic systems poses a significant barrier to their use in safety-critical systems. Innovative verification and validation (V&V) strategies are essential to reducing the risk associated with employing these new technologies in production air vehicles, and to successfully certifying the systems. The Caesar software tool was developed to help address this V&V need, focusing particularly on the validation of advanced control laws. It provides a framework for integrating advanced model-based analysis, simulation-based testing, and an extensive graphical user interface for configuring inputs and viewing results. The current version of Caesar employs μ-based worst-case analysis techniques to gain insight into the impact of various uncertainties on stability and performance of a linearized model, and based on these results intelligently selects test points for high-fidelity nonlinear simulation evaluation. The framework allows incorporation of other analysis methods and simulation based searches in the future.

Approaches such as autonomous, intelligent, and adaptive control algorithms have shown signiflcant promise for improving the safety and performance, and expanding the capabilities of air vehicles, but V&V has been a major obstacle to their implementation in ∞eet aircraft. This paper presents a V&V aware control architecture intended to help overcome these hurdles and facilitate the ∞ight certiflcation of advanced control approaches. The architecture segregates high risk components of the control system, such as the adaptive and intelligent algorithms, and employs run-time safety monitors to perform real-time checks on the behavior of these components. In the event that a problem is detected, the safety monitors trigger a switch from the high-risk components to a failsafe control mode. The failsafe mode is fully verifled and validated at design time to provide a safe return to base capability, though performance and mission capabilities will typically be reduced in this mode. The run-time architecture was demonstrated in a batch simulation of a VTOL UAV with an indirect adaptive control law performing a shipboard landing task. The approach greatly increased the percentage of safe landings in the case of an intentionally poorly tuned on-line parameter identiflcation algorithm in the indirect adaptive control law.