Slide 14 Topics in 3 minutesState of Practice in ATM SoftwareSlide 4Slide 5Key Issues and NeedsKey Issues and NeedsPromising Research DirectionsEducational NeedsDesign of a Certifiably Dependable Next-Generation Air Transportation SystemStephen A. Jacklin Michelle M. EshowMichael R. Lowry Dave McNallyEwen Denny Johann SchumannWillem Visser Russ PaielliNASA Ames Research CenterMoffett Field, CAPresented at the 2006National Workshop on Aviation Software Systems:Design for Certifiably Dependable SystemsNational Workshop on Aviation Software Systems:Design for Certifiably Dependable Systems 2 / 94 Topics in 3 minutes•Current State of the Practice in Air Traffic Management Software•Key Issues and Needs •Promising Research Directions •Educational NeedsNational Workshop on Aviation Software Systems:Design for Certifiably Dependable Systems 3 / 9State of Practice in ATM Software•The process by which air traffic controllers provide separation assurance for aircraft is largely a manual process aided by softwareNational Workshop on Aviation Software Systems:Design for Certifiably Dependable Systems 4 / 9State of Practice in ATM SoftwareNational Workshop on Aviation Software Systems:Design for Certifiably Dependable Systems 5 / 9State of Practice in ATM Software•The process by which air traffic controllers provide separation assurance for aircraft is largely a manual process aided by software•Limited automation employed–Conflict alerts are shown–Control clearances issued to pilots by voice•Controller workload is the primary factor limiting airspace capacity•Two- to three-fold increase in air traffic demand expected by 2025National Workshop on Aviation Software Systems:Design for Certifiably Dependable Systems 6 / 9Key Issues and Needs•Complexity Makes ATM Systems Difficult to Analyze, Let Alone Certify–Large number of hardware/software systems–Large number of interfaces among various software entities and with other computers –Large number of states and constraints–Distributed nature of decision making–Variability of the environment both geographically and temporally–Non-determinism of many system inputs such as weather, emergencies, and security eventsNational Workshop on Aviation Software Systems:Design for Certifiably Dependable Systems 7 / 9Key Issues and Needs •Automation tools for separation assurance needed to reduce controller’s workload•Identify failure and recovery modes for automated separation assurance•Identify risk of failures and risk of collision•Analyze safety criticality requirements of key architectural components•Develop formal methods for automated safety-focused analysis of automation algorithmsNational Workshop on Aviation Software Systems:Design for Certifiably Dependable Systems 8 / 9 NOT RESOLVED BY TCAS NOT RESOLVED BY TSAFENOT RESOLVED BY ATS NOT RESOLVED BY VISUAL MEANSCOLLISION RATEPRE-RESOLUTION RATE OF NMACSCOLLISION IF CRITICAL MISSTIME BETWEEN COLLISIONS1.5 hours4.3 min3.14 years31 years157 years523 years0.055.25E-050.100.200.30Promising Research Directions•NASA Next Generation Air Traffic System (NGATS) Research–TSAFE–TCAS•Developments in advanced formal methods for V&V–Auto-coding methods with certification guarantees–Static analysis methods–Model checking methods–Compositional verificationFault Tree AnalysisNational Workshop on Aviation Software Systems:Design for Certifiably Dependable Systems 9 / 9Educational Needs•Automated conflict detection and resolution algorithms•Trajectory analysis methods•Tactical safety assurance automation•Human/machine operating concepts and user interface characteristics•Identification and analysis of failure and recovery modes to ensure timely failure detection and graceful recovery•Interaction of automated ATM software with weather, emergencies, and other non-deterministic events•Training in automated methods of software verification and validation•Study of cost effective V&V