Formal testing for separation assurance

Abstract

In order to address the rapidly increasing load of air traffic operations, innovative algorithms and software systems must be developed for the next generation air traffic control. Extensive verification of such novel algorithms is key for their adoption by industry. Separation assurance algorithms aim at predicting if two aircraft will get closer to each other than a minimum safe distance; if loss of separation is predicted, they also propose a change of course for the aircraft to resolve this potential conflict. In this paper, we report on our work towards developing an advanced testing framework for separation assurance. Our framework supports automated test case generation and testing, and defines test oracles that capture algorithm requirements. We discuss three different approaches to testcase generation, their application to a separation assurance prototype, and their respective strengths and weaknesses. We also present an approach for statistical analysis of the large numbers of test results obtained from our framework.

Formal specification and verification of a coordination protocol for an automated air traffic control system

“…The three AAC components that calculate resolution maneuvers have undergone verification through simulation as well as ongoing component-level verification utilizing formal methods [5,15,25]. However, there is an important verification aspect that has never been addressed: the cooperation between components.…”

"Fly Me to the Moon": Verification of Aerospace Systems

“…In this section, we discuss our experience with the development of techniques that ensure the creation of robust software prototypes for novel algorithms in the aerospace domain [7,16]. Our experience was obtained during a collaborative effort between the Robust Software Engineering (RSE) group and the NextGen group at the NASA Ames Research Center.…”

“…More specifically, we decided to model check descriptions of the inputs of such algorithms, in order to automatically generate large numbers of test inputs. We call this approach model checking of the system as a black box, since we only require knowledge about the inputs of the system under test, and not of the system implementation itself [13,16]. Through automatic generation and execution of large numbers of test inputs, it becomes much easier to engage the domain experts in our work, since they see a more immediate benefit from the application of our techniques.…”

Probabilistic model checking for comparative analysis of automated air traffic control systems

“…2) The Automated Airspace Concept: All AAC components that calculate resolution maneuvers have undergone verification through simulation as well as ongoing component-level verification utilizing formal methods [19], [12], [7], [18], [23]. The fault-tolerance of the AutoResolver algorithm given trajectory prediction errors was evaluated via simulation in [17].…”