Electrically-powered aircraft can enable dramatic increases in efficiency and reliability, reduced emissions, and reduced noise as compared to today's combustion-powered aircraft. This paper describes a novel flight demonstration concept that will enable the benefits of electric propulsion, while keeping the extraordinary convenience and utility of common fuels available at today's airports. A critical gap in airborne electric propulsion research is addressed by accommodating adoption at the integrated aircraft-airport systems level, using a confluence of innovative but proven concepts and technologies in power generation and electricity storage that need to reside only on the airframe. Technical discriminators of this demonstrator concept include (1) a novel, high-efficiency power system that utilizes advanced solid oxide fuel cells originally developed for ultra-long-endurance aircraft, coupled with (2) a high-efficiency, high-power electric propulsion system selected from mature products to reduce technical risk, assembled into (3) a modern, high-performance demonstration platform to provide useful and compelling data, both for the targeted early adopters and the eventual commercial market. Nomenclature

NASA researchers, in a partnership with Boeing, are investigating a fuel-cell powered variant of the X-57 "Maxwell" Mod-II electric propulsion aircraft, which is itself derived from a stock Tecnam P2006T. The "Fostering Ultra-Efficient Low-Emitting Aviation Power" (FUELEAP) project will replace the X-57 power subsystem with a hybrid Solid-Oxide Fuel Cell (SOFC) system to increase the potential range of the electric-propulsion aircraft while dramatically improving efficiency and emissions over stock internalcombustion engines.Our FUELEAP safety analysis faces two primary challenges. First, the Part 23 certificated Tecnam P2006T is undergoing significant modifications to host the hybrid electric-propulsion system, and the challenge is to assure that the safety inherent in the stock aircraft (and subsequently in X-57 Mod-II) is not compromised by changes in avionics, aircraft structural loading, weight and balance, or other considerations. Secondly, because the SOFC power system has little (if any) relevant in-service precedent, our challenge is to assure that we identify and mitigate all reasonably plausible hazards introduced by unique FUELEAP equipage.We are investigating and utilizing Model-Based Safety Analysis (MBSA) methods to help us address these FUELEAP safety challenges. We captured aircraft-level system hazard conditions using instances of a SysML hazard block via aircraft-level Functional Hazard Analysis (FHA). Then, using SysML models of the FUELEAP architecture, we related the hazard conditions to initiating system events and possible mitigations, such as design architecture modifications or operational constraints. We are continuing to define our approach to MBSA by developing a component-by-component inventory of local failure modes and tracing their possible contribution to hazard conditions. Finally, we are applying an argument-based approach to FUELEAP assurance. Through a FUELEAP "safety case," we are providing an explicit argument for FUELEAP safety by associating assurance evidence with overarching safety claims through a structured argument.

No abstract

LOng Time Archiving and Retrieval (LOTAR) of models is key to using the full capabilities of model-Based System Engineering (mBSE) in a system lifecycleincluding certification. The LOTAR MBSE workgroup is writing the EN/NAS 9300-Part 520 to standardize the associated process, in the aeronautics industry, and suggests the usage of Modelica, FMI and SSP standards for its purpose. Acceptance of such a process requires a match between industrial needs and software vendor implementations. This is helped by a tool-agnostic implementation of the process and following specific adaptations within the Modelon Impact software. This initiativeinside the LOTAR workgroupshighlights the suitability of such a process but also points at flaws or overhead due to the lack of connection between the Modelica, FMI and SSP standards, as well as the MoSSEC (ISO 10303-243) standard. The recommendations proposed in this document could have a significant impact on the final adoption of the LOTAR standardrelying on Modelica, FMI and SSP standards.

Glossary of Acronyms 65References 67iii | CMU/SEI-2010-TR-003 List of Tables Table 1: MDS Architectural Themes and Associated AADL Capabilities 3 List of Figures Executive SummaryThe aerospace industry is experiencing exponential growth in the size and complexity of onboard software. It is also seeing a significant increase in errors and rework of that software. All of those factors contribute to greater cost; the current development process is reaching the limit of affordability for building safe and reliable aircraft and spacecraft. The size of software in aircraft with respect to source lines of code (SLOC) has doubled every four years since the mid-1990s; the 27 million SLOC projected for 2010-2020 is estimated to cost more than $10 billion. Studies into the role of software in spacecraft accidents and the increasing complexity of flight software indicate the need for improvement in requirements elicitation and architecture, in particular for validation early and throughout the life cycle through modeling and analysis that complement testing.In order to improve predictability, the system and software engineering communities are practicing model-based engineering, where models of different aspects of a system are developed and analyzed. However, industrial experience has shown that such models, developed independently over the life cycle, result in multiple versions of the "truth" (i.e., they are not consistent with each other and the evolving architecture). The SAE Architecture Analysis and Design Language (AADL) standard addresses this issue of multiple truths due to inconsistency between analytical models by providing an architecture modeling notation with well-defined semantics that can accommodate multiple analysis dimensions through annotations and allow for auto-generation of these analytical models from a single source.The Carnegie Mellon Software Engineering Institute, L-3 Communications -EITS, and the Jet Propulsion Laboratory (JPL) have collaborated in a use of model-based engineering for the National Aeronautics and Space Administration (NASA) Software Assurance Research Program (SARP) project named "Model-Based Software Assurance with the SAE Architecture Analysis and Design Language (AADL)." The work involved applying the AADL to the Mission Data System (MDS) architecture. The SAE AADL industry standard for modeling and analysis of embedded software system architectures was chosen because of its ability to support analysis of nonfunctional properties, such as robustness, safety, performance, and security. The MDS was chosen because it takes an architecture-centric view by defining a multi-layered reference architecture for autonomous systems, whose dynamics are managed by feedback loops, and promotes state analysis through goal-oriented modeling to address uncertainty and faults. By combining the two technologies, we can take into account the impact of the embedded software's runtime architecture on these non-functional properties in the validation of systems.The result of that project sho...