On the Formal Verification of the TCAS Conflict Resolution Algorithms

007486991997PDFResearch PaperTraffic alert and collision avoidance systemValidationAviation safetyAir traffic controlSafetyMathematical modelsConflict detectionHybrid systemsResolution advisoriesUnited StatesUniversity of California, Berkeley. Robotics and Intelligent Machines Laboratory. Air Traffic Management Systems ProgramLygeros, JohnLynch, NancyMassachusetts Institute of Technology. Laboratory for Computer ScienceUS Transportation CollectionPostScript file. TCAS is an on-board protocol for detecting conflicts between aircraft and providing resolution advisories to the pilots. Because of its safety-critical role the TCAS software should ideally be "verified" before it can be deployed. The verifcation task is challenging, due to the complexity of the TCAS code and the hybrid nature of the system. We show how the essence of this very complicated problem can be captured by a relatively simple hybrid model, amenable to formal analysis. We then outline a methodology for establishing conditions under which the advisories issued by TCAS are safe.75