Search

In this paper, an initial characterization was performed of the Mission Planner algorithm developed by NASA for Urban Air Mobility (UAM) operations research. The algorithm plans conflict-free trajectories for flights to support a given set of UAM passenger trips. The UAM trips are planned in an on-demand, first-come, first-served manner, such that any given trip is subject to the constraints imposed by previously planned trips. For this analysis, the mission planning algorithm considered only the trajectory constraints from previously-planned trips in one test condition and added vertiport constraints for the second test condition. The conflict and constraint resolution strategies used by the Mission Planner were characterized by their percentage contribution to planning iterations, their percentage effectiveness in those iterations, and their contributions to the departure delay applied to each UAM trip’s flight. With the exception of the climb and descent vertical speed strategies, most strategies showed reasonable or good performance in all test scenarios. In the test condition with vertipad constraints enabled, both the total number of iterations executed, and the number of flights that required planning iterations, was reduced for all scenarios. This was the result of the natural conditioning of the traffic achieved with scheduling and the additional information available to the Mission Planner from the vertiport scheduler. The next steps for this work will include improvements to the mission planning strategies and analyses with additional constraints and under other demand scenarios.

Trajectory-based operations (TBO) is a key concept in the Next Generation Air Transportation System transformation of the National Airspace System (NAS) that will increase the predictability and stability of traffic flows, support a common operational picture through the use of digital data sharing, facilitate more effective collaborative decision making between airspace users and air navigation service providers, and enable increased levels of integrated automation across the NAS. NASA has been developing trajectory-based systems to improve the efficiency of the NAS during specific phases of flight and is now also exploring Advanced 4-Dimensional Trajectory (4DT) operational concepts that will integrate these technologies and incorporate new technology where needed to create both automation and procedures to support gate-to-gate TBO. A TBO Prototype simulation toolkit has been developed that demonstrates initial functionality of an Advanced 4DT TBO concept. Pilot and controller subject matter experts (SMEs) were brought to the Air Traffic Operations Laboratory at NASA Langley Research Center for discussions on an Advanced 4DT operational concept and were provided an interactive demonstration of the TBO Prototype using four example scenarios. The SMEs provided feedback on potential operational, technological, and procedural opportunities and concerns. This paper describes an Advanced 4DT operational concept, the TBO Prototype, the demonstration scenarios and methods used, and the feedback obtained from the pilot and controller SMEs in this focus group activity.

This paper discusses results from a recent study that investigates certification requirements for an unmanned rotorcraft performing agricultural application operations. The process of determining appropriate requirements using a risk-centric approach revealed a number of challenges that could impact larger UAS standardization efforts. Fundamental challenges include selecting the correct level of abstraction for requirements to permit design flexibility, transforming human-centric operational requirements to aircraft airworthiness requirements, and assessing all hazards associated with the operation.

The performance of the conflict detection function in a separation assurance system is dependent on the content and quality of the data available to perform that function. Specifically, data quality and data content available to the conflict detection function have a direct impact on the accuracy of the prediction of an aircraft's future state or trajectory, which, in turn, impacts the ability to successfully anticipate potential losses of separation (detect future conflicts). Consequently, other separation assurance functions that rely on the conflict detection function - namely, conflict resolution - are prone to negative performance impacts. The many possible allocations and implementations of the conflict detection function between centralized and distributed systems drive the need to understand the key relationships that impact conflict detection performance, with respect to differences in data available. This paper presents the preliminary results of an analysis technique developed to investigate the impacts of data quality and data content on conflict detection performance. Flight track data recorded from a day of the National Airspace System is time-shifted to create conflicts not present in the un-shifted data. A methodology is used to smooth and filter the recorded data to eliminate sensor fusion noise, data drop-outs and other anomalies in the data. The metrics used to characterize conflict detection performance are presented and a set of preliminary results is discussed.

While incremental steps are being taken to integrate unmanned aircraft systems (UAS) into the various national airspace systems, much work remains to establish appropriate regulatory infrastructure that allows UAS larger than 55 lb to operate for commerce or hire. The magnitude of that effort is compounded by the wide-ranging variety of UAS types and possible applications, as well as the diversity in quality and provenance of UAS components. The FAA has suggested developing design standards tailored to specific applications and operating environments as an approach to facilitate integration and safe operation of some UAS. This paper introduces a case study to investigate design standards for a midsize unmanned rotorcraft operating in a rural environment. A key aspect of this study is the concept of using a certifiable containment system, different from a conventional geofencing application, to ensure that the unmanned aircraft does not escape its intended operational area. The proposed assured containment system is expected to reduce the effort needed to regulate some UAS that could not currently meet rigorous aircraft design standards and fall outside of the parameters for operation outlined in the proposed small UAS rule. This paper discusses how assured containment may be a useful approach to limiting risk and reducing an otherwise prohibitive certification burden to enable UAS operations in confined areas. The case study examines the potential effect the assured containment approach might have on airworthiness certification requirements.

Our previous work presented an approach for developing high confidence algorithms for recovering aircraft from loss of separation situations. The correctness theorems for the algorithms relied on several key assumptions, namely that state data for all local aircraft is perfectly known, that resolution maneuvers can be achieved instantaneously, and that all aircraft compute resolutions using exactly the same data. Experiments showed that these assumptions were adequate in cases where the aircraft are far away from losing separation, but are insufficient when the aircraft have already lost separation. This paper describes the results of this experimentation and proposes a new criteria specification for loss of separation recovery that preserves the formal safety properties of the previous criteria while overcoming some key limitations. Candidate algorithms that satisfy the new criteria are presented.

This paper analyzes priority rules, such as those in Part 91.113 of the Federal Aviation Regulations. Such rules determine which of two aircraft should maneuver in a given conflict scenario. While the rules in 91.113 are well accepted, other concepts of operation for NextGen, such as self separation, may allow for different priority rules. A mathematical framework is presented that can be used to analyze a general set of priority rules and enables proofs of important properties. Specific properties considered in this paper include safety, effectiveness, and stability. A set of rules is said to be safe if it ensures that it is never the case that both aircraft have priority. They are effective if exactly one aircraft has priority in every situation. Finally, a set of rules is called stable if it produces compatible results even under small changes to input data.

In this paper we introduce Stratway, a modular approach to finding long-term strategic resolutions to conflicts between aircraft. The modular approach provides both advantages and disadvantages. Our primary concern is to investigate the implications on the verification of safety-critical properties of a strategic resolution algorithm. By partitioning the problem into verifiable modules much stronger verification claims can be established. Since strategic resolution involves searching for solutions over an enormous state space, Stratway, like most similar algorithms, searches these spaces by applying heuristics, which present especially difficult verification challenges. An advantage of a modular approach is that it makes a clear distinction between the resolution function and the trajectory generation function. This allows the resolution computation to be independent of any particular vehicle. The Stratway algorithm was developed in both Java and C++ and is available through a open source license. Additionally there is a visualization application that is helpful when analyzing and quickly creating conflict scenarios.

In air traffic management, conflict prevention information refers to the guidance maneuvers, which if taken, ensure that an aircraft's path is conflict-free. These guidance maneuvers take the form of changes to track angle or ground speed. Conflict prevention information may be assembled into prevention bands that advise the crew on maneuvers that should not be taken. Unlike conflict resolution systems, which presume that the aircraft already has a conflict, conflict prevention systems show conflicts for any maneuver, giving the pilot confidence that if a maneuver is made, then no near-term conflicts will result. Because near-term conflicts can lead to safety concerns, strong verification of information correctness is required. This paper presents a mathematical framework to analyze the correctness of algorithms that produce conflict prevention information incorporating an arbitrary number of traffic aircraft and with both a near-term and intermediate-term lookahead times. The framework is illustrated with a formally verified algorithm for 2-dimensional track angle prevention bands.

Use of unmanned aircraft systems (UASs) has been characterized as the next great step forward in the evolution of civil aviation. Indeed, UASs are in limited civil use in the United States today, and many believe that the time is rapidly approaching when they will move into the commercial marketplace, too. To make this a reality, a number of challenges must be overcome to develop the necessary regulatory framework for assuring safe operation of this special class of aircraft. This paper discusses some of what must be done to establish that framework. In particular, we examine hazards specific to the design, operation, and flight crew of UASs, and discuss implications of these hazards for existing policy and guidance. Understanding unique characteristics of UASs that pose new hazards is essential to developing a cogent argument, and the corresponding regulatory framework, for safely integrating these aircraft into civil airspace.

Davies and Wakerly show that Byzantine fault tolerance can be achieved by a cascade of broadcasts and middle value select functions. We present an extension of the Davies and Wakerly protocol, the unified protocol, and its proof of correctness. We prove that it satisfies validity and agreement properties for communication of exact values. We then introduce bounded communication error into the model. Inexact communication is inherent for clock synchronization protocols. We prove that validity and agreement properties hold for inexact communication, and that exact communication is a special case. As a running example, we illustrate the unified protocol using the SPIDER family of fault-tolerant architectures. In particular we demonstrate that the SPIDER interactive consistency, distributed diagnosis, and clock synchronization protocols are instances of the unified protocol.

Four kinds of abstraction for the design and analysis of fault tolerant distributed systems are discussed. These abstractions concern system messages, faults, fault masking voting, and communication. The abstractions are formalized in higher order logic, and are intended to facilitate specifying and verifying such systems in higher order theorem provers.

The Aircraft System Simulation Environment and Toolkit (ASSET) is a software framework for rapid development and simulation of continuous systems. The central concept of ASSET is a model—analogous to a block in a system block diagram. One important way to simplify the software development process for models is to use encapsulation. Encapsulation is a software development technique that disallows one model from accessing another model's internal state; models can only communicate through their well-defined input/output interface. Unfortunately when building a simulation, the engineer will often require visibility to data values that are not part of the normal interface. The data management system of the ASSET framework attempts to solve this problem. The data management system consists of a large central repository in which all models may write data and a common set of tools to access the data.

The Aircraft System Simulation Environment and Toolkit (ASSET) project is being undertaken as a proof of concept, aimed at demonstrating a rapid model prototyping and modification capability by utilizing modern software technologies and design concepts. Initially, the project is focused on a self-contained batch simulation, but it is designed to ultimately run embedded within other software environments, including realtime. This report focuses on the design and implementation of the model software, which strictly follows a block-diagram design paradigm. The initial implementation, a six-degree-of- freedom simulation of an F-16 airplane, is presented, along with current status and near-term plans.