A Formally Verified Hybrid System for the Next-Generation Airborne Collision Avoidance System

Abstract

The next-generation Airborne Collision Avoidance System (ACAS X) is intended to be installed on all large aircraft to give advice to pilots and prevent mid-air collisions with other aircraft. It is currently being developed by the Federal Aviation Administration (FAA). In this paper we determine the geometric configurations under which the advice given by ACAS X is safe under a precise set of assumptions and formally verify these configurations using hybrid systems theorem proving techniques. We conduct an initial examination of the current version of the real ACAS X system and discuss some cases where our safety theorem conflicts with the actual advisory given by that version, demonstrating how formal, hybrid approaches are helping ensure the safety of ACAS X. Our approach is general and could also be used to identify unsafe advice issued by other collision avoidance systems or confirm their safety.

Differential Adaptive Stress Testing of Airborne Collision Avoidance Systems

“…PMC provides complete evaluations of the properties and their probabilities of occurrence. Other studies have used hybrid systems theorem proving (HSTP), which models encounters as hybrid systems with idealized advisories and continuous dynamics then formally proves whether the system always avoids collision or whether a collision is possible [6] [7]. The advice of core components of ACAS X is then compared to that of the idealized system in different states to identify cases where the advice given by core ACAS X components may not avoid NMAC.…”

How to prove hybrid systems and why that matters

“…KeYmaera and KeYmaera X have been used for verifying a number of interesting applications, including Airborne Collision Avoidance System ACAS X [14], [15], roundabout type aircraft maneuvers [16], the European Train Control System ETCS [17], several automotive systems (e.g., provably safe adaptive cruise controllers for cars on highways [18]), mobile robot navigation with the dynamic window algorithm [19], and a surgical robotic system for skull-base surgery [20].…”

“…The Airborne Collision Avoidance System ACAS X, for example, has been subjected to a formal verification study [14], [15] using differential dynamic logic proofs. ACAS X is a challenging industrial system, a canonical hybrid system in principle, but-with its half a trillion discrete statesoverwhelmingly large.…”

Decoupling Abstractions of Non-linear Ordinary Differential Equations

“…In recent years, verification technology for hybrid systems has seen significant advances and a number of interesting case studies have been reported, e.g. verification of train control systems [20,29], aircraft collision avoidance protocols [13,1], descent guidance control software in a lunar lander [28] and satellite rendezvous manoeuvres [14], to give a few examples. However, non-linear ODEs appearing in hybrid system models often present a serious challenge to verification due to their inherent complexity.…”