Design of a Certifiably Dependable Next- Generation Air Transportation System Stephen A. JacklinMichelle M. Eshow Michael R. LowryDave McNally Ewen Denny Johann Schumann Willem VisserRuss Paielli NASA Ames Research Center Moffett Field, CA Presented at the 2006 National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems

National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems 2 / 9 4 Topics in 3 minutes Current State of the Practice in Air Traffic Management Software Key Issues and Needs Promising Research Directions Educational Needs

National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems 3 / 9 State of Practice in ATM Software The process by which air traffic controllers provide separation assurance for aircraft is largely a manual process aided by software

National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems 4 / 9 State of Practice in ATM Software

National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems 5 / 9 State of Practice in ATM Software The process by which air traffic controllers provide separation assurance for aircraft is largely a manual process aided by software Limited automation employed –Conflict alerts are shown –Control clearances issued to pilots by voice Controller workload is the primary factor limiting airspace capacity Two- to three-fold increase in air traffic demand expected by 2025

National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems 6 / 9 Key Issues and Needs Complexity Makes ATM Systems Difficult to Analyze, Let Alone Certify –Large number of hardware/software systems –Large number of interfaces among various software entities and with other computers –Large number of states and constraints –Distributed nature of decision making –Variability of the environment both geographically and temporally –Non-determinism of many system inputs such as weather, emergencies, and security events

National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems 7 / 9 Key Issues and Needs Automation tools for separation assurance needed to reduce controller’s workload Identify failure and recovery modes for automated separation assurance Identify risk of failures and risk of collision Analyze safety criticality requirements of key architectural components Develop formal methods for automated safety- focused analysis of automation algorithms

National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems 8 / 9 TIME BETWEEN COLLISIONS 1.5 hours 4.3 min 3.14 years 31 years 157 years 523 years E Promising Research Directions NASA Next Generation Air Traffic System (NGATS) Research –TSAFE –TCAS Developments in advanced formal methods for V&V –Auto-coding methods with certification guarantees –Static analysis methods –Model checking methods –Compositional verification Fault Tree Analysis

National Workshop on Aviation Software Systems: Design for Certifiably Dependable Systems 9 / 9 Educational Needs Automated conflict detection and resolution algorithms Trajectory analysis methods Tactical safety assurance automation Human/machine operating concepts and user interface characteristics Identification and analysis of failure and recovery modes to ensure timely failure detection and graceful recovery Interaction of automated ATM software with weather, emergencies, and other non-deterministic events Training in automated methods of software verification and validation Study of cost effective V&V methods