Case Study: Formal Verification of Curved Flight Collision Avoidance Maneuvers

Table of Contents Overview Flight Dynamics Classical Collision Avoidance Attempts Advanced and Flyable Collision Avoidance Maneuvers Distributed Aircraft Controllers Airborne Collision Avoidance System ACAS X Airborne Collision Avoidance Games in ACAS X Roundabouts Selected Publications

KeYmaera or Source

Overview

Flight control maneuvers are very important systems where correct functioning is crucial. At the same time, their dynamics is so complicated that the analysis of collision avoidance protocols in air traffic management is pretty challenging. These protocols direct aircraft, which are flying close, to flight paths which respect the protected zones of the aircraft.

Flight Dynamics

The dynamics of aircraft depends on several parameters, including positions, linear velocities, angular velocities. It is described in terms of differential equations for flight and computer control algorithms.

Classical Collision Avoidance Attempts

Several collision avoidance maneuvers have been proposed to resolve conflicting flight paths. The left figure illustrates the collision that happens in uncontrolled flight. The middle figure illustrates a classical roundabout collision avoidance resolution, which works successfully. The right figure illustrates an unsuccessful choice for classical fixed roundabout collision resolution attempts. It was found by our hybrid systems verification tool.

Advanced and Flyable Collision Avoidance Maneuvers

Possible advanced aircraft maneuvers for collision avoidance include the tangential roundabout (left) and flyable roundabout maneuver (right).

To prove correctness of those maneuvers, we have proved formulas in differential dynamic logic (dL). For example, the following dL expresses that two aircraft x and y always remain safely separated by the protected zone if they are safely separated initially and follow the tangential roundabout collision avoidance maneuver trm:

safeSeparation(x,y) -> [trm]safeSeparation(x,y) We have proved this formula in the dL proof calculus. For details on the model, the definition of the formula safeSeparation(x,y) and the proof, see [2]. The key proof techniques are the proof calculus for differential-algebraic dynamic logic [2] and differential invariants [2]. More complex properties about more complex systems, including a flyable roundabout collision avoidance maneuver, are proved in follow-up work [6,5]. We have proved corresponding safe separation properties about distributed air traffic control with arbitrarily many aircraft and dynamic appearance and disappearance of aircraft in quantified differential dynamic logic [7] using quantified differential invariants [8].

Distributed Aircraft Controllers

We have considered a class of distributed collision avoidance controllers designed to work even in environments with arbitrarily many aircraft or UAVs [9]. We have proved that the controllers never allow the aircraft to get too close to one another, even when new planes approach an in-progress avoidance maneuver that the new plane may not be aware of. Because these safety guarantees always hold, the aircraft are protected against unexpected emergent behavior which simulation and testing may miss. This is an important step in formally verified, flyable, and distributed air traffic control.

Airborne Collision Avoidance System ACAS X

The next-generation Airborne Collision Avoidance System (ACAS X) is intended to be installed on all large aircraft to give advice to pilots and prevent mid-air collisions with other aircraft. It is currently being developed by the Federal Aviation Administration (FAA). In this paper [10] we determine the geometric configurations under which the advice given by ACAS X is safe under a precise set of assumptions and formally verify these configurations using hybrid systems theorem proving techniques. We conduct an initial examination of the current version of the real ACAS X system and discuss some cases where our safety theorem conflicts with the actual advisory given by that version, demonstrating how formal, hybrid approaches are helping ensure the safety of ACAS X. Our approach is general and could also be used to identify unsafe advice issued by other collision avoidance systems or confirm their safety. An overview and a thorough investigation of the ACAS X decision table subsequently appeared in an invited paper [11]. More details and additional results on the verification of maneuvers that are safeable, so not necessarily safe right now but can still be made safe by a subsequent advisory, can be found in an extended journal version for STTT [12].

Airborne Collision Avoidance Games in ACAS X

The design of aircraft collision avoidance algorithms is a subtle but important challenge that merits the need for provable safety guarantees. Obtaining such guarantees is nontrivial given the unpredictability of the interplay of the intruder aircraft decisions, the ownship pilot reactions, and the subtlety of the continuous motion dynamics of aircraft. Existing collision avoidance systems, such as TCAS and the Next-Generation Airborne Collision Avoidance System ACAS X, have been analyzed assuming severe restrictions on the intruder's flight maneuvers, limiting their safety guarantees in real-world scenarios where the intruder may change its course.

This work takes a conceptually significant and practically relevant departure from existing ACAS X models by generalizing them to hybrid games with first-class representations of the ownship and intruder decisions coming from two independent players, enabling significantly advanced predictive power. By proving the existence of winning strategies for the resulting Adversarial ACAS X in differential game logic, collision-freedom is established for the rich encounters of ownship and intruder aircraft with independent decisions along differential equations for flight paths with evolving vertical/horizontal velocities. We present three classes of models of increasing complexity: single-advisory infinite-time models, bounded time models, and infinite time, multi-advisory models. Within each class of models, we identify symbolic conditions and prove that there then always is a possible ownship maneuver that will prevent a collision between the two aircraft.

More details can be found in ACM TECS [13].

Roundabouts

Aircraft collision avoidance maneuvers are important and complex applications. Curved flight exhibits nontrivial continuous behavior. In combination with the control choices during air traffic maneuvers, this yields hybrid systems with challenging interactions of discrete and continuous dynamics. As a case study illustrating the use of a new proof assistant for a logic for nonlinear hybrid systems, we analyze collision freedom of roundabout maneuvers in air traffic control, where appropriate curved flight, good timing, and compatible maneuvering are crucial for guaranteeing safe spatial separation of aircraft throughout their flight. We show that formal verification of hybrid systems can scale to curved flight maneuvers required in aircraft control applications. We introduce a fully flyable variant of the roundabout collision avoidance maneuver and verify safety properties by compositional verification.

Keywords: formal verification of hybrid systems, deduction, air traffic control, logic for hybrid systems

Selected Publications

Also see publications on verification of aerospace systems.

1. Rachel Cleveland, Stefan Mitsch and André Platzer.
   Formally verified next-generation airborne collision avoidance games in ACAS X.
   ACM Trans. Embed. Comput. Syst. 22(1), pp. 10:1-10:30, 2023. © The authors
   [bib | ✂ | pdf | doi | mypdf | kyx | arXiv | abstract]
   
   
2. Jean-Baptiste Jeannin, Khalil Ghorbal, Yanni Kouskoulas, Aurora Schmidt, Ryan Gardner, Stefan Mitsch, and André Platzer.
   A formally verified hybrid system for safe advisories in the next-generation airborne collision avoidance system.
   STTT 19(6), pp. 717-741, 2017.
   Special issue for selected papers from TACAS'15. © Springer
   [bib | ✂ | pdf | doi | kyx | study | TACAS'15 | abstract]
   
   
3. Jean-Baptiste Jeannin, Khalil Ghorbal, Yanni Kouskoulas, Ryan Gardner, Aurora Schmidt, Erik Zawadzki, and André Platzer.
   Formal verification of ACAS X, an industrial airborne collision avoidance system.
   In Alain Girault and Nan Guan, editors, International Conference on Embedded Software, EMSOFT'15, Amsterdam, The Netherlands, Proceedings, pp. 127-136. IEEE Press, 2015. © IEEE
   [bib | ✂ | pdf | doi | abstract]
   
   
4. Jean-Baptiste Jeannin, Khalil Ghorbal, Yanni Kouskoulas, Ryan Gardner, Aurora Schmidt, Erik Zawadzki, and André Platzer.
   A formally verified hybrid system for the next-generation airborne collision avoidance system.
   In Christel Baier and Cesare Tinelli, editors, Tools and Algorithms for the Construction and Analysis of Systems - 21st International Conference, TACAS 2015, London, UK, April 11-18, 2015, Proceedings, volume 9035 of LNCS, pp. 21-36. Springer, 2015. © Springer
   [bib | ✂ | pdf | doi | study | TR | STTT'17 | abstract]
   
   
5. Sarah M. Loos, David W. Renshaw and André Platzer.
   Formal verification of distributed aircraft controllers.
   In Calin Belta and Franjo Ivancic, editors, Hybrid Systems: Computation and Control (part of CPS Week 2013), HSCC'13, Philadelphia, PA, USA, April 8-13, 2013, pp. 125-130. ACM, 2013. © ACM
   [bib | ✂ | pdf | doi | slides | poster | study | TR | abstract]
   
   
6. André Platzer.
   Quantified differential invariants.
   In Emilio Frazzoli and Radu Grosu, editors, Proceedings of the 14th ACM International Conference on Hybrid Systems: Computation and Control, HSCC 2011, Chicago, USA, April 12-14, pp. 63-72. ACM, 2011. © ACM
   [bib | ✂ | pdf | doi | slides | abstract]
   
   
7. André Platzer.
   Quantified differential dynamic logic for distributed hybrid systems.
   In Anuj Dawar and Helmut Veith, editors, Computer Science Logic, 19th EACSL Annual Conference, CSL 2010, Brno, Czech Republic, August 23-27, 2010. Proceedings, volume 6247 of LNCS, pp. 469-483. Springer, 2010. © Springer
   [bib | ✂ | pdf | doi | slides | TR | LMCS'12 | abstract]
   
   
8. André Platzer and Edmund M. Clarke.
   Formal verification of curved flight collision avoidance maneuvers: A case study.
   In Ana Cavalcanti and Dennis Dams, editors, 16th International Symposium on Formal Methods, FM, Eindhoven, Netherlands, Proceedings, volume 5850 of LNCS, pp. 547-562. Springer, 2009. © Springer
   FM Best Paper Award.
   [bib | ✂ | pdf | doi | slides | study | TR | abstract]
   
   
9. André Platzer.
   Logical Analysis of Hybrid Systems:
      Proving Theorems for Complex Dynamics.
   Springer, Heidelberg, 2010. 426 pages. ISBN 978-3-642-14508-7.
   [bib | ✂ | doi | book | web | errata | abstract]
   
   
10. André Platzer and Edmund M. Clarke.
    Formal Verification of Curved Flight Collision Avoidance Maneuvers: A Case Study.
    School of Computer Science, Carnegie Mellon University, CMU-CS-09-147, 2009.
    [bib | ✂ | pdf | FM'09]
    
    
11. André Platzer.
    Differential Dynamic Logics:
       Automated Theorem Proving for Hybrid Systems.
    PhD Thesis, Department of Computing Science, University of Oldenburg, 2008.
    ACM Doctoral Dissertation Honorable Mention Award in 2009.
    Extended version appeared as book Logical Analysis of Hybrid Systems: Proving Theorems for Complex Dynamics, Springer, 2010.
    [bib | ✂ | pdf | eprint | slides | book | ebook | abstract]
    
    
12. André Platzer.
    Differential-algebraic dynamic logic for differential-algebraic programs.
    Journal of Logic and Computation 20(1), pp. 309-352, 2010.
    Special issue for selected papers from TABLEAUX'07. © The author
    [bib | ✂ | pdf | doi | eprint | study | errata | TABLEAUX'07 | abstract]
    
    
13. André Platzer and Edmund M. Clarke.
    The image computation problem in hybrid systems model checking.
    In Alberto Bemporad, Antonio Bicchi and Giorgio Buttazzo, editors, Hybrid Systems: Computation and Control, 10th International Conference, HSCC 2007, Pisa, Italy, Proceedings, volume 4416 of LNCS, pp. 473-486. Springer, 2007, © Springer
    [bib | ✂ | pdf | doi | slides | tool | abstract]