Urban Air Mobility (UAM) brings forth new complex challenges, necessitating the development of advanced technologies to meet the specialized requirements of this emerging sector. Predictive and proactive risk mitigation capabilities will likely be necessary to ensure that these novel aviation operations are safely integrated into the National Airspace System (NAS). This is especially true when considering the operational complexity and low risk tolerance associated with highly autonomous vehicles in urban environments. By analyzing potential hazards and identifying where and when high-risk scenarios might arise, flight planning tools can be leveraged to help reduce exposure to such risks. Currently, UAM systems rely heavily on Global Navigation Satellite Systems (GNSS) for accurate positioning. However, one significant safety concern is the loss or degradation of this critical navigation system. Particularly in low-altitude flights and urban settings, obstructions like buildings and trees are common and can cause reduced satellite visibility. Accurately predicting satellite visibility at varying altitudes and times is therefore essential to enhance the safety of UAM operations. This paper introduces an automated High Performance Computing (HPC) workflow backend and a Graphical User Interface (GUI) frontend to support flight planning by producing advanced visualizations to analyze the risk of GNSS performance degradation or loss caused by obstructed satellite visibility. The backend and frontend presented in this paper are designed for NavQ, a GNSS quality prediction service. NavQ allows mission planners to identify safe flight trajectories and operational zones within urban landscapes to minimize possible failure caused by poor navigation data.

Much of the prior work studying multipath interference and Non-Line of Sight (NLOS) reception literature studies precise pseudorange error estimation and/or improving a navigation filter’s performance in urban canyon environments. This paper instead studies statistical behaviors of pseudorange errors caused by multipath interference and NLOS reception. The error statistics are observed through histograms of known-NLOS measurements collected by a vehicle-mounted commercial Global Navigation Satellite System (GNSS) receiver traveling through a city center. The histograms formed from known-Line of Sight (LOS) measurements generally maintain a zero-mean bias and Gaussian shape, while the histograms from known-NLOS measurements exhibit both greater bias and heavier tails as the canyon depth increases. The histograms show that the NLOS measurements also suffer greater errors in canyons with similar depth on both sides as compared to canyons where the depth of one side is significantly greater. As modern state estimators often incorporate statistical error models to fuse measurements, these specific results offer insights into how to select statistical error models that better match the Radio Frequency (RF) environment which urban GNSS receivers experience.

Depending on the environment, multipath can be one of the largest error sources contributing to degradation in Global Navigation Satellite System (GNSS) (e.g., GPS) performance. Currently, open-source tools for simulating GPS signals are available and can be used in the testing and evaluation of GPS receiver equipment. These tools can generate GPS signals that, when used by a GPS receiver, result in computation of a position solution that was pre-determined at the time of signal generation. This work utilizes a custom version of the open-source GPS-SDR-SIM to produce emulated multipath GPS signals. A proof of concept was prototyped and demonstrated using this modified version of GPS-SDR-SIM to produce GPS as well as multipath signals. The generated data was processed using a software defined GPS receiver (GNSS-SDR) and it was found that the introduction of simulated multipath signals successfully produced the expected characteristics of a composite multipath signal in simulation.

Position estimation using global navigation satellite systems (GNSS) suffers from poor accuracy within urban canyons due to significant signal disruption caused by tall buildings. This issue can be attributed to the GNSS signals reflecting off buildings resulting in severe multipath reflections which degrade the receiver's performance. In this paper, we introduce an innovative approach to filter GNSS satellite measurements to improve the accuracy of the estimated position by leveraging a clustering algorithm. This approach utilizes a predictive GNSS availability service to filter out non-line-of-sight measurements. Then, a subset of line-of-sight satellite measurement combinations are evaluated using a clustering algorithm. When combined, results show these techniques can reduce the mean horizontal error measured in an urban canyon by nearly an order of magnitude, from ? 18 meters to ? 2 meters when using a single point positioning solver.

The In-Time Aviation Safety Management System (IASMS) Concept of Operations (ConOps) envisions new capabilities to monitor, assess, and mitigate flight safety risks. Systems will be tailored to mission type, vehicle/equipage type, operational environment, and safety risk tolerance. Within an IASMS framework, several capabilities may be implemented spanning three operational phases (pre-flight, in-flight, and post-flight/off-line); consisting of lower level functions and information services which may reside on board the aircraft, on third-party server(s), and/or on ground/operator station(s). Each capability will be designed to produce and disseminate safety-relevant information; perform detection, diagnosis, and prediction of unsafe situations; and/or execute mitigation actions when hazardous events warrant such changes. This paper focuses on recent testing of airborne capabilities that demonstrate inflight aspects of the overarching concept for autonomous unmanned aircraft systems (UAS) operations in urban environments. A flight test architecture is described that applies run-time assurance principles (e.g., executes independent of the unassured autopilot), real-time risk assessment, and a technique to execute contingencies if necessary either automatically or via pilot intervention. Several tests using small UAS were conducted to verify the assured inflight risk mitigation capability. The paper draws significantly from a larger NASA technical report and recent prior conference papers, providing additional details. Data are analyzed for two representative flights to illustrate the performance for various sequential and simultaneous hazards used during testing. During each automated flight, several hazards are encountered at various points along the flight path. At each point, the hazard is mitigated by the system, with the vehicle then continuing to subsequent points. The paper concludes with lessons-learned regarding relevant aspects of the overarching IASMS concept and how it may be updated and further advanced in the future.

Low altitude flight in urban areas is susceptible to degraded GNSS-based navigation system performance due to terrain interference with radio signals from orbital positioning satellites. Predictive navigation performance fidelity tools are needed a) in preflight planning to assist in the creation of safe flight paths and b) in-flight to provide contingency management agents with the navigation risk of proximal flight corridors. Two navigation fidelity prediction services are validated by comparison with over 6000 readings from GNSS sensors collected along a five-mile path through urban areas of Corpus Christi, Texas, on three dates in 2022. Predictions are based on satellite line of sight through 3D terrain data collected in 2018. Each service predicts a set of navigation fidelity metrics over a user-specified time period. One metric estimated by both is the number of visible satellites. A direct comparison of the number of predicted visible satellites with the number sensed by the receiver is used to validate the prediction services. Results show an exact match in the number of predicted satellites for 60% of the measurements, and a match within +/- 4 satellites for 95% of the measurements. As expected, agreement improves away from vertical blocking terrain. Most cases of mismatch are due a lower predicted count than measured (false negatives), and can be accounted for by receiver pickup of stray signals caused by multipath propagation. About 10 % of mismatches are false positives and are mostly accounted for by foliage effects. The two services predict visibility of the same set of satellites 80% of the time, differ by two or less satellites 95% of the time, and can compute predictions for one hour of observations in one minute or less. Validation is analyzed statistically and in detailed case studies of selected observation times. The prediction services validated in this study run fast enough for preflight safety planning. The more stringent challenge of in-flight navigation fidelity prediction for contingency management requires both a speedup of the current level of modeling and equally fast stray signal modeling.

The use of global navigation satellite systems (GNSS) for position estimation tends to yield poor results when operating inside of an urban canyon due to large obstructions (e.g., buildings) that disrupt signals as they travel from a satellite to a receiver resulting in a position estimate that may significantly fluctuate in magnitude and direction. Identifying and removing signals that are non-line-of-sight (NLOS) to the receiver and only using signals that are line-of-sight (LOS) can improve the estimated position. However, quickly and accurately determining the LOS status of each measurement can be challenging without additional information about the operating environment. Use of publicly available lidar data can be used to incorporate techniques, such as 3D-mapping-aided (3DMA), to estimate the LOS status of satellites and augment the position solution accordingly. To complicate the issue, the error on the GNSS position estimate in an urban canyon is often so large that is it not sufficient to use as an approximate location for LOS prediction. That is, at times the calculated GNSS solution is not representative of the true location and cannot be used to accurately predict which satellites are within LOS due to the difference in the physical geometry associated with the two locations. This paper explores the use of a GNSS/inertial fused position solution as the initial position estimate for predicting which satellites are within LOS in an urban environment and the impact that removal of predicted NLOS satellites has on the GNSS position solution.

Urban Air Mobility (UAM) is an emerging transport solution for passengers or cargo at lower altitudes within urban and suburban areas using electric Vertical Take-off and Landing (eVTOL) air vehicles. The complexity of UAM technology strains design-time safety-assurance methods, which is driving the use of dynamic monitoring methods such as runtime verification to ensure safety of intended functionality (SOTIF). Although cyber-physical system (CPS) testing and design-assurance literature exists [1], there is little focus on UAM testbed concepts that evaluate runtime safety assurance. Such testbeds would help ensure safety coverage across a range of failure scenarios. In this paper, we present a new testbed architecture that systematically integrates formal runtime verification methods and tools into an Unmanned Aerial Vehicle (UAV) flight simulator. The value of this testbed is to help evaluate and transition in-time hazard detection and mitigation methods (in realistic operational contexts) to higher levels of technology maturity. To the best of our knowledge this is the first testbed that integrates formal runtime verification tools into a eVTOL simulation testbed.

This study assesses the in-time safety management services, functions, and capabilities (SFCs) being investigated by NASA’s System Wide Safety (SWS) project to determine applicability to the project’s planned safety demonstrator (SD-1) for wildland fire management. The purpose of this work is to evaluate how effectively existing SFCs address the different hazards presented by a safety demonstrator operating in a wildland fire management scenario. This will help inform decision makers which SFCs would provide the most cost-effective solutions to fill the hazard gaps for further research. Hazards for the safety demonstrator wildland fire management scenario were collated, and the SFCs were evaluated for each hazard based on how applicable and effective the unmodified SFCs are at addressing the hazard. The SFCs are also evaluated for the gap type that needs to be addressed to improve the SFC effectiveness for the given hazard. The key finding of this assessment is that all the existing SFCs require at least some research and development to adapt to the safety demonstrator. No single SFC fully addresses any of the safety demonstrator operation hazards. The result of this study will be used to determine the performance of current SFCs and suggest strategies to adapt existing SFCs or add new SFCs.

Verification and validation of increasingly autonomous aviation systems is a major challenge. Traditional techniques for the assurance of high-confidence, safety-critical systems are not equipped to handle the complexity, uncertainty, and lack of predictability inherent in non-deterministic systems. Techniques such as run time monitoring, formal methods, and testing and simulation have been applied to some effect, but it is difficult to properly assess the success of such measures. The authors propose the concept of Assurance Efficacy to address this gap. Assurance Efficacy is seen as a parameter, criteria, or perspective by which to evaluate, identify and explore safety risk mitigation strategies and operational assurance architectures. Validation of the utility of this concept through flight testing is a first step in determining its potential role in assessing the overall safety of complex, increasingly autonomous systems that cannot be fully assured in the design phase.

View Video Presentation: https://doi.org/10.2514/6.2022-3458.vid Ongoing research at NASA is driven by a strategic plan defined by the Aeronautics Research Mission Directorate and a vision for future In-Time Aviation Safety Management Systems (IASMS) as described by the National Academies. In both visions, system safety awareness and provision are expanded through increased access to relevant data; integrated analysis and predictive capabilities; improved real-time detection and alerting of domain-specific hazards; decision support, and in some cases, automated risk mitigation strategies. One primary research focus is to develop means by which more timely (i.e., "in-time") actions may be taken to mitigate precursors, anomalies, or trends that are observed during operations. In this paper, we describe such means as a collection of Services, Functions, and Capabilities (SFCs) that are supported by an underlying information system. For example, an integrated risk assessment capability is envisioned that continuously monitors safety-related metrics and margins and recommends timely operational changes. Assessment functions and/or services can be based on data analytics and predictive models derived from heterogeneous data sets that span relevant indicator metrics and their time histories. Likewise, on-board functions can identify and reduce susceptibility to precursor conditions that have led (and can lead) to aircraft loss-of-control or out-of-control accidents. This paper summarizes development and testing of such an information system tailored to hazards anticipated for future highly autonomous flight missions near and over densely populated areas. Testing is accomplished via simulation and by using small, unmanned aircraft operating over a test range at NASA's Langley Research Center. Flight plans and test scenarios are defined to emulate several use-cases, including package delivery; reconnaissance; fire management; and urban air taxi vertiport operations. Two test phases are summarized with Phase 1 occurring in (2019-2020) and Phase 2 ongoing (2021-present). Results focus on SFC performance, technology readiness level assessment, and requirements discovery/validation. Companion papers are cited throughout for additional details on the recent testing.

Advanced Air Mobility (AAM) and Urban Air Mobility (UAM) are emerging concepts that capitalize on urban airspace for commercial transportation of passengers and cargo as well as augment surface transportation infrastructure. A major part of the solution towards achieving the UAM/AAM vision will be assured and trusted autonomy that enable human operators and passengers to interact with autonomous systems that transport humans and cargo with high assurance of safety, security and reliability. Given the complex interactions among the autonomy algorithms, human, environment and UAM control, there is a need for vehicle-level monitoring that detects emerging hazard scenarios. The data gathered from UAM systems that would help detect emerging hazards will be diverse: from highly-regular information (onboard flight controls) to irregular streaming information (weather, real time population dynamics). This paper presents a systematic approach for developing model- and data-driven hazard monitoring framework which we call pervasive monitoring. The aim of pervasive monitoring is to “comprehensively" observe a Cyber Physical System (CPS) at different architectural levels to ensure its safety and security with respect to its intended operation. Since there is no single monitor type that solves complex in-time hazard detection problems for UAM, we assert that several classes of monitors are needed to address this challenge. In this paper, we present a methodology based on STPA that partitions the UAM hazard monitoring challenge into two problems: a context monitoring problem and vehicle monitoring problem. We present preliminary results on deriving monitors from STPA, and realization of the monitors using the NASA Runtime Verification language Co-pilot.

View Video Presentation: https://doi.org/10.2514/6.2022-0029.vid This paper presents a detailed analysis of the accuracy and performance of line marching algorithms executing on a GPU. In the context of an accurate Global Navigation Satellite System (GNSS) quality of service simulation, horizon sky-plots are a useful tool to determine satellite visibility in the presence of obstructions from objects, such as buildings or dense foliage. In order to accurately model satellite visibility at a point of interest on a map, a horizon plot can identify the viewing angles at which objects are blocking the sky. This computation requires traversing a line starting at the point of interest on a 2D altitude map, moving outward for every azimuth angle. To explore the performance of this computation, we propose a new dynamic stopping condition for the traversal of the line, benefiting from objects close to the point of interest. We compare the accuracy of common line marching algorithms, and consider their parallel performance when developed in CUDA. We find that our proposed stopping condition for line marching provides a significant improvement in performance in urban canyon sky-plots, as compared to previous work. Additionally, these results show that simpler algorithms, such as the digital differential analyzer line algorithm, are better suited for GPUs than more sophisticated schemes such as Bresenham's algorithm, specifically in the context of sky-plot horizon computations. The trade-off between accuracy and performance is analyzed and guidelines are provided that depend on the targeted goal of the GNSS application.

Autonomous UAS navigation at low altitudes is often hindered by degradation of GNSS position estimates. The line of sight from the UAS to orbital satellites may be intersected by foliage (which attenuates the received signal) and by buildings (which block the signal). Since the geometric ray from the presumed UAS position to each GNSS satellite orbital location is predictable, if a 3D survey of ground structures is available, the degree of blockage of each GNSS signal can be estimated. In this study we show raycasting from a UAS location to GNSS satellites at two flight locations: one with overlying structures and bordered by tall trees, and another in an arboreal canyon bordered by tall trees. We confirm the intermittent blockage of satellites in the first location sufficient to lose GNSS position fix. We demonstrate low-altitude GNSS fidelity forecasting via the raycasting method at the second location that can be used to plan navigable flight locations and altitudes. Finally, we match the GNSS signal strength with raycast-derived foliage obstruction depth at hundreds of observation times from 55 recordings collected over 14 days from November 2018 to February 2021 at the second location. This matching confirms that signal attenuation varies with the depth of foliage blockage along a saturating exponential curve, as found in prior continuous-wave radio studies. The exponent and saturation value are species dependent and therefore vary from site to site; once determined empirically, they can be used to characterize foliage along a particular flight path and refine GNSS fidelity forecasts of flights along that path. The techniques described in this study show the feasibility of a survey method to construct low-altitude navigation safety maps and forecasts.

An onboard risk management automation design is presented based on run-time assurance principles, as well as the concept for In-Time Aviation Safety Management Systems (IASMS) as described by the National Academies. The automation is designed to operate independently of the autopilot and perform real-time risk assessment spanning multiple classes of hazards, predict constraint violations, and track autopilot states. In the event of elevated risk conditions or predicted constraint violations, the automation will select from a set of available contingencies and trigger autopilot mode changes if necessary to mitigate risk exposure. The onboard automation also informs the remote operator/pilot of what the independent monitor is observing and any contingency decisions or actions that may arise during flight. Details of an implementation of this design and results of verification and validation activities, as required to meet stringent NASA software and system assurance standards, are also presented. This includes simulation and flight testing using small unmanned aircraft systems.

The emergence and development of advanced technologies and vehicle types have created a growing demand for new forms of flight operations. These new and increasingly complex operational paradigms, such as Advanced and Urban Air Mobility (AAM/UAM), present regulatory authorities and the aviation community with several design-and-implementation challenges – particularly for highly autonomous vehicles. An overarching and daunting task is to develop protocols that can integrate these operations without compromising safety or disrupting traditional airspace operations. A shift toward a more predictive, autonomous, risk mitigation capability becomes critical to meet this challenge. This paper proposes and evaluates a computationally-efficient path planning approach to perform pre-flight planning and autonomous in-flight re-routing to minimize exposures to selected hazards. In our evaluation, hazards associated with degraded and missing critical GPS navigation data are considered. In this paper, we first present a high-performance computing path planning approach based on an adapted Bellman-Ford algorithm, developed in the CUDA programming language. Using the adapted path planning algorithm, we test this algorithm when encountering issues with GPS quality, and deliver an implementation that can produce flight paths that minimize exposure to risks, while maintaining a low computational burden. In our evaluation, the computation of periodic and aperiodic path updates are evaluated, prioritizing specific events as triggers for updates, based on changes to satellite availability. These critical events can lead to significant exposure to navigational hazards if not dealt with correctly.

The emergence and development of advanced technologies and vehicle types has created a growing demand for the introduction of new forms of flight operations. These new and increasingly complex operational paradigms such as Advanced and Urban Air Mobility (AAM/UAM) present regulatory authorities and the aviation community with several design and implementation challenges - particularly for highly autonomous vehicles. An overarching and daunting task is finding methods to integrate these emerging operations without compromising safety or disrupting traditional airspace operations. A shift toward a more predictive risk mitigation capability becomes critical to meet this challenge. This paper focus on the development and testing of a prognostic service aimed at estimating the quality of Global Navigation Satellite System (GNSS) performance for an autonomous aircraft in complex environments. The intent of this function is to proactively reduce a flight operations risk of exposure to states that may induce poor or unacceptable navigation system performance by factoring in estimates of GNSS quality into pre-flight and/or in-flight route planning. Methodologies for producing quality estimates are specified and results are provided for selected simulation and flight test cases

Advanced Air Mobility (AAM) is quickly developing as a new air transportation system with increasing autonomy levels to support low-cost on-demand passenger and package transport. AAM must operate safely despite the potential to encounter hazards and experience anomalies and failures in-flight. It becomes especially important to have systematic auto-mitigation strategies to perform safe contingency actions in AAM flight operations, as pilots have limited Situational Awareness (SA) and limited time to make decisions when encountering failures/anomalies in complex airspace and terrain. This paper presents Assured Contingency Landing Management (ACLM) with an online landing strategy selection capability to decide between the following three options when a contingency landing is required: (1) Return-to-launch landing, (2) Land immediately at a nearby clear but unprepared site, and (3) Land at a prepared landing site within the aircraft’s reachable footprint. Our presented algorithm shows a real-time auto-mitigation loop with multiple threads that run simultaneously to check controllability, reachability, and intermediate decisions to hold/ loiter or continue the flight plan as the landing strategy solution is being computed. A simulation case study demonstrates ACLM with a focus on safety-critical propulsion and battery system degradation scenarios to illustrate ACLM functionality.

This chapter focuses on capabilities needed to automatically enforce geospatial constraints as a means of avoiding static obstacles and specified locations designated as no-fly zones. Examples of no-fly zones for most commercial Unmanned Aircraft Systems (UAS) are airports, military bases, urban environments, and densely populated areas. The chapter presents the regulatory context of sense-and-avoid, or "sense and avoid" (also referred to as detect-and-avoid), quantifies the notion of "well clear," describes operational collision avoidance systems, and provides a brief review of recent research efforts. Flight management systems include trajectory prediction, performance computation, guidance, and high-level navigation functions. Remotely Piloted Aircraft is a subcategory of UAS that specifies that a pilot is involved in the operation of the aerial vehicle but not located onboard. Typically, size, weight, power, and cost constraints limit the choice of the UAS navigation payload.