Eliminating Hazards from a Medium Term Conflict Detection Tool
Natasha A. Neogi, Nancy G. Leveson · AIAA Guidance, Navigation, and Control Conference and Exhibit · 2003
to increase the capacity of the national airspace, either the separation standard between aircraft must be decreased, or some form of free flight must be a llowed. Either method raises the issue of maintaining safety in an already overtaxed system. In order to mitigate the workload placed on pilots and controllers, software aids such as conflict detection tools can be employed. However, these tools must be verified to be safe, before they can be employed with any degree of reliability. Furthermore, air traffic control, and aircraft conflict detection is a dual natured problem: discrete logic is being used to command and control vehicles that have inherently continuous dynamics. Identifying hazardous states in such a system and ensuring that these states are not reachable is an ongoing problem in any large system safety analysis. An exhaustive search of most complex process-control systems will encounter th e problem of state explosion; in the case of aircraft conflict detection, the state space is infinite. However, in this paper, we outline a more tractable approach to verification: the state explosion problem is minimized by requiring a search of only par t of the state space, as the hazard is not necessarily traced back to the initial state, only to a critical state from which an escape path to safe behavior exists. This path is then given priority in the control flow of the system by means of redesign. This method is demonstrated on a Medium Term Conflict Detection tool, and an actual hazard is identified and eliminated.