Hybrid Theorem Proving of Aerospace Systems: Applications and Challenges

Abstract

Complex software systems are becoming increasingly prevalent in aerospace applications, in particular to accomplish critical tasks. Ensuring the safety of these systems is crucial, while they can have subtly different behavior under slight variations in operating conditions. In this paper we advocate the use of formal verification techniques and in particular theorem proving for hybrid software-intensive systems as a wellfounded complementary approach to the classical aerospace verification and validation techniques such as testing or simulation. As an illustration of these techniques, we study a novel lateral mid-air collision avoidance maneuver in an ideal setting, without accounting for the uncertainties of the physical reality. We then detail the challenges that naturally arise when applying such technology to industrial-scale applications and our proposals on how to address these issues.

A formally verified hybrid system for safe advisories in the next-generation airborne collision avoidance system

“…In this case the origin P is no longer defined, and Eqns. (10) are trivially true. The variables s and n are constants (s = 0, n = 0), their initial values are only restricted by the condition n 2 + s 2 = x 2 + y 2 in the assumption of the proposition, but they are not unique.…”

“…As the encounter evolves in (O, i, j) along x = r x , y = r y , its dimension-reduced version evolves in (P, k, ) along the differential equations s = −r v , n = 0, obtained by differentiating Eqns. (10) and canceling r v . The following proposition, proved in KeYmaera, combines both dynamics and shows that the absence of an NMAC of radius r p in (O, i, j) is equivalent to the absence of an NMAC of radius s p in (P, k, ).…”

“…Given r x and r y , Eqns. (10) imply that the coordinates (x, y) are uniquely determined by the choice of (s, n), as long as r v = 0 (using r v 2 = r 2 x + r 2 y ). For any 2-dimensional configuration, the encounter can thus be considered a head-on…”

Exploring Model Quality for ACAS X

“…The formulation of the collision avoidance problem used for ACAS X consists of two aircraft, the ownship and the intruder, on a collision course 3 . The ACAS X model keeps record of the altitude of the intruder relative to the ownship, the aircraft climb rates, the produced advisory and the pilot response.…”

“…Researchers [2,3,11,12,13,14] have investigated hybrid techniques and theorem proving for other collision avoidance systems. Some researchers have developed testing frameworks for automated air-traffic control [1,4,5].…”