Design of a Certifiably Dependable Next-Generation Air Transportation System

1. Design of a Certifiably Dependable Next-Generation Air Transportation System Stephen A. Jacklin Michelle M. Eshow Michael R. Lowry Dave McNally Ewen Denny Johann Schumann Willem Visser Russ Paielli NASA Ames Research Center Moffett Field, CA Presented at the 2006 National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems

2. Current State of the Practice in Air Traffic Management Software Key Issues and Needs Promising Research Directions Educational Needs 4 Topics in 3 minutes

3. State of Practice in ATM Software • The process by which air traffic controllers provide separation assurance for aircraft is largely a manual process aided by software

4. State of Practice in ATM Software

5. State of Practice in ATM Software • The process by which air traffic controllers provide separation assurance for aircraft is largely a manual process aided by software • Limited automation employed • Conflict alerts are shown • Control clearances issued to pilots by voice • Controller workload is the primary factor limiting airspace capacity • Two- to three-fold increase in air traffic demand expected by 2025

6. Key Issues and Needs • Complexity Makes ATM Systems Difficult to Analyze, Let Alone Certify • Large number of hardware/software systems • Large number of interfaces among various software entities and with other computers • Large number of states and constraints • Distributed nature of decision making • Variability of the environment both geographically and temporally • Non-determinism of many system inputs such as weather, emergencies, and security events

7. Key Issues and Needs • Automation tools for separation assurance needed to reduce controller’s workload • Identify failure and recovery modes for automated separation assurance • Identify risk of failures and risk of collision • Analyze safety criticality requirements of key architectural components • Develop formal methods for automated safety-focused analysis of automation algorithms

8. TIME BETWEEN COLLISIONS 523 years 0.30 157 years 31 years 0.20 3.14 years 0.10 5.25E-05 1.5 hours 4.3 min 0.05 Promising Research Directions Fault Tree Analysis • NASA Next Generation Air Traffic System (NGATS) Research • TSAFE • TCAS • Developments in advanced formal methods for V&V • Auto-coding methods with certification guarantees • Static analysis methods • Model checking methods • Compositional verification

9. Automated conflict detection and resolution algorithms Trajectory analysis methods Tactical safety assurance automation Human/machine operating concepts and user interface characteristics Identification and analysis of failure and recovery modes to ensure timely failure detection and graceful recovery Interaction of automated ATM software with weather, emergencies, and other non-deterministic events Training in automated methods of software verification and validation Study of cost effective V&V methods Educational Needs