AShortHistoryofanAirTrafcManagementProjectRWButleretal41TrackOnlyGeometricSolutionForgivenvectorsvoandviweneedtondthetrackanglesasuchthattherelativevectorvagsvocosavixgsvosinaviyvozvi ID: 105602
Download Pdf The PPT/PDF document "AShortHistoryofanAirTrafcManagementProj..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
AShortHistoryofanAirTrafcManagementProjectR.W.Butleretalspeed,andverticalspeedalgorithms.Inthispaper,wewillonlypresentthetrackbands.Thesearethemostchallengingandinterestingofthethreeandtheotherbandsarecomputedandveriedusinganalogousmethods.WeadoptedtheNLRideaofintroducingtwoparameters,Tred(typically3minutes)andTamber(typicallyveminutes),whichdividethesetofconictsbasedontheirnearness(intime)toalossofseparation.IfalossofseparationwilloccurwithinTred,thentheregioniscoloredred.Ontheotherhand,ifalossofseparationwilloccurafterTred,butbeforeTamber,thentheregioniscoloredamber,otherwiseitispaintedgreen.Werstrecognizedthateachaircraft'scontributiontothepreventionbandisindependentofallotheraircraft;thus,theproblemneatlydecomposesintotwosteps:1.Solvethebandsproblemfortheownshiprelativetoeachotheraircraftseparately.2.Mergeallofthepairwiseregions.Wealsoquicklyrealizedthataniterativesolutionwaspossiblefortherststep.Wealreadyhadaformallyproven,efcientalgorithmavailabletousnamedCD3Dthatdecidesifaconictoccursforspecicvaluesofso,vo,si,andvi,andparametersD,H,andT.Moreformally,CD3Ddetermineswhetherthereexistsafuturetimetwheretheaircraftpositionsso+tvoandsi+tviarewithinahorizontaldistanceDofeachotherandwheretheaircraftarewithinverticaldistanceHofeachother.Inotherwordsthereisapredictedlossofseparationwithinthelookaheadtime.Therefore,oneneedsonlytoexecuteCD3Diteratively,varyingthetrackanglefrom0to360opertrafcaircraft.Byrunningdifferentscenarios,wedeterminedthatastepsizeof0:1owouldbeadequateforrangesofupto200nauticalmiles.Thisiterativeapproachmaynotscalewellinairbornesystems,wheretacticalseparationassurancealgorithmswillbetypicallyrunatfrequenciesofabout1Hz.Furthermore,thisbrute-forceapproachunnecessarilyconsumesthemuchneededon-boardcomputationalresources.4SearchForanAnalyticalSolutionTosolvethepreventionbandsprobleminananalyticalway,itisusefultodeneseparatehorizontalandverticalnotionsofconict.Intherelativecoordinatesystem,wedeneAnhorizontalconictoccursifthereexistsafuturetimetwithinthelookaheadtimeTwheretheaircraftarewithinhorizontaldistanceDofeachother,i.e.,(sx+tvx)2+(sy+tvy)2D2:(2)wheresandvare,respectively,therelativepositionandtherelativevelocityoftheownshipwithrespecttotheintruderaircraft.AverticalconictoccursifthereexistsafuturetimetwithinthelookaheadtimeTwheretheaircraftarewithinhorizontaldistanceHofeachother,i.e.,jsz+tvzjH:(3)Wesaythattwoaircraftareinconictifthereisatimetwheretheyareinhorizontalandverticalconict.Formally,wedenethepredicateconflict?asfollowsconflict?(s;v)90tT:(sx+tvx)2+(sy+tvy)2D2andjsz+tvzjH:(4)4 AShortHistoryofanAirTrafcManagementProjectR.W.Butleretal4.1TrackOnlyGeometricSolutionForgivenvectorsvoandvi,weneedtondthetrackanglesasuchthattherelativevectorva=(gs(vo)cosa�vix;gs(vo)sina�viy;voz�viz);(5)isnotinconict.Forsimplicity,wedecidedtorstsolvethetrackbandsproblemwithoutconsiderationofthenitelookaheadtime.Wealsodecidedtoignoreverticalspeedconsiderationsandlookatthehorizontalplaneonly.Theproblemthusreducedtondingthetangentlinestothehorizontalprotectionzone(intherelativeframeofreference)asafunctionofa.Webeginwiththeobservationthatinorderforavectortobetangentitmustintersectthecircleoftheprotectionzone.Inotherwords,weneedsolutionsofs+tva=D(6)orequivalently(s+tva)2=D2(7)Expandingweobtainaquadraticequationat2+bt+c=0witha=Va2b=2sVac=s2�D2Thetangentlinesarepreciselythosewherethediscriminantofthisequationiszero.Inotherwords,whereb2�4ac=0.But,expandingthedotproductsyield:b2=4[sx(wcosa�vix)+sy(wsina�viy)]24ac=4(w2�2w(vixcosa+viysina)+v2)(ss�D2)Thediscriminantnallyexpandsintoacomplexsecond-orderpolynomialinsinaandcosa.Buttosolvefora,weneedtoeliminatethecosausingtheequationcosa=p 1�sin2aThenetresultisanunbelievablycomplexfourthorderpolynomialinsina.Solvingforaanalyticallywouldrequiretheuseofthequarticformulas.Althoughtheseformulasarecomplicated,suchaprogramcouldprobablybewritteninadayortwo.But,howwouldweverifythesesolutions?Afterall,thequarticequationsinvolvetheuseofcomplexanalysis.Therefore,webegintolookforsimplications.Afterseekingsimplicationsoftheformulaabove,wefoundasimplicationofthediscriminantthathadbeenusedinthevericationoftheKB3Dalgorithm[6]:(sv)2�v2(s2�D2)=0ifandonlyifsv=Redet(s;v);(8)wheree2f�1;+1g,det(s;v)s?v,s?=(�sy;sx),andR=p s2�D2 D.Thebeautyofthenalformisthattheequationislinearonv.Thetwosolutionsarecapturedinthetwovaluesofe.Whenweinstantiatevainthisformula,weendupwithaquadraticequationinsina.Usingthisapproach,wewereabletoderivethefollowingsolutionsfora.IfjGj p E2+F21thenin5 AShortHistoryofanAirTrafcManagementProjectR.W.Butleretal Figure3:RelationshipofEncounterGeometryandLookaheadTimesome2prange,wehavea1=asinG p E2+F2�atan(E;F);a2=p�asinG p E2+F2�atan(E;F);whereE=w(Resx�sy);F=�w(Resy+sx);G=vi(Res?�s);SinceE,F,andGareallfunctionsofe,wehavetwopairsofa1anda2oratotaloffourtotalangles.Theseanglesrepresenttheangleswherethetrackpreventionbandchangescolor,assumingnolookaheadtime.Inmanycases,wehavefeweruniqueangles,forinstancewhenjGj p E2+F2�1orwhentheregionsareadjacent(i.e.,twoa'sareequal).ThisresultwasformalizedinthePVStheoremproverandwehavewrittenaJavaimplementationofthealgorithm.4.2SolutionwithLookaheadTimeThesolutionpresentedsofaronlyconsidersthe2-dimensionalcasewithnolookaheadtime.Figure3illustratesthreedistinctcasesthatappearwhenlookaheadisconsidered.Cases(a)and(c)wereeasytohandle,butwerealizedcase(b)wasgoingtotakesomeadditionalanalysis.Butwewerequitepleasedwithournewresultanddecidedtopresenttheresulttoourbranchheadandresearchdirector.Duringthepresentationamemberoftheteamannounced,“Ithinkyoucansolvethisproblemwithouttrigonometry,”andheurgedustodefertheuseoftrigonometryuntilthelastpossiblemoment.Inotherwords,hesuggestedthatwesolvefor(va)withoutexpandingitscomponents.Onlyaftertheappropriateabstractsolutionvectorisfound,shouldtheconversiontoatrackabemade.ThiswasakeyideathathadbeenusedinthedevelopmentoftheKB3Dalgorithms,whichresultedinveryefcientandelegantalgebraicsolutions[1].Indeed,werealizedthattheinnitelookaheadproblemwassolvablebyaparticularkindofKB3Dresolutionscalledtracklinesand,forthecaseoftracksolutions,computedbythefunctionpresentedinFigure4.Thefunctiontrk linereturnsthevector0whenalltrackanglesfortheownshipyieldapotentialconict.Otherwise,thevectorreturnedbythisfunctionisavelocityvectorfortheownshipthatistangenttothe2-dimensionalprotectedzone.Sinceeandiare1,forgivens,vo,andvitherearefourpossibletracklinesolutions.Thekeytosolvetrackbandswithnitelookaheadistondwheretheprojectedlookaheadtimeintersectstheprotectedzone.Thatis,plotwheretherelativepositionoftheaircraftwillbeafterTtimeunitsineverypossibledirectiongivenanunchangedgroundspeed.Andndtheintersectionpointswith6 AShortHistoryofanAirTrafcManagementProjectR.W.Butleretaltrk_line(s,vo,vi,e,i):Vect2=LETu=tangent_line(s,e),a=u2,b=uvi,c=v2i-v2oINIFdiscriminant(a,2*b,c)0THENLETk=root(a,2*b,c,i)INIFk0THENku+viELSE0ENDIFELSE0ENDIFFigure4:TrackLineSolutionstheprotectionzone.Thefunctiontrk_circle,alsoavailableinKB3D,providesthesesolutions,whicharecalledtrackcircles.Thefunctiontrk_circlereturnsthevector0whentherearenotrackcirclesolutions,i.e.,whenthelookaheadtimeboundarytandtheprotectedzonedonotintersect,orwhenthereareaninnitenumberofsolutions.Otherwise,thevectorreturnedbythisfunctionisavelocityvectorfortheownshipthatintersectthe2-dimensionalprotectedzoneatatimelaterthant.Sinceeandiare1,forgivens,vo,andvitherearefourpossibletrackcirclesolutions.Thetrk_lineandtrk_circlefunctionsandalloftheirsubfunctionsarefullydevelopedanddenedin[8].Webelievethatthenitelookaheadproblemwouldhavebeenintractableinthetrigonometricap-proachpursuedatrst.Thisswitchtoapurealgebraicapproachwasfundamentaltoachievingthenal3Dproofofthebandsalgorithm.7 AShortHistoryofanAirTrafcManagementProjectR.W.Butleretal4.3TheTrackBandsAlgorithmTheideaofthealgorithmistorstndthecriticaltrackvectorsusingourtrack_lineandtrack_circlefunctions.ThesecriticalvectorsareRmm=track line(s;vo;vi;�1;�1);Rmp=track line(s;vo;vi;�1;+1);Rpm=track line(s;vo;vi;+1;�1);Rpp=track line(s;vo;vi;+1;+1);Crm=track circle(s;vo;vi;Tred;�1);Crp=track circle(s;vo;vi;Tred;+1);Cam=track circle(s;vo;vi;Tamber;�1);Cap=track circle(s;vo;vi;Tamber;+1);Cem=track circle(s;vo;vi;tentry;�1);Cep=track circle(s;vo;vi;tentry;+1);Cxm=track circle(s;vo;vi;texit;�1);Cxp=track circle(s;vo;vi;texit;+1):Someofthesevectorsmaybezerovectorsinwhichcasetheyareignored.Next,ndthecorrespondingtrackangles(usingatan)andsortthislistofangles.Toprovideappropriatebounding,theangles0and2pareadded.Finally,usetheconictprobe(suchasCD3D)atananglebetweeneachofthecriticalanglestocharacterizethewholeregion(i.e.,determinewhichcolortheregionshouldbepainted:green,amber,orred).Thisprocedureisiteratedbetweentheownshipandalltrafcaircraft.Finally,theresultingbandsaremergedtogetthedisplayinFigure1.5FormalVericationofPairwisePreventionBandsAlgorithmsThealgorithmstrk_lineandtrk_circlediscussedinSection4.2havebeenveriedcorrectforconictresolution,i.e.,theycomputevectorsthatyieldconictfreetrajectoriesfortheownship,andcompletefortrackpreventionbands,i.e.,theycomputeallcriticalvectorswerethetrackbandschangecolors.Thesealgorithmsareslightlydifferentfromtheoriginalonespresentedin[8].Indeed,thealgo-rithmspresentedinthatreport,whilestillcorrectforconictresolution,failedtocomputeallthecriticalvectors.Therefore,thosealgorithms,whichhadbeentestedover10,000testcases,wereincorrect.Themissingvectorswerefoundduringtheformalvericationprocess.Thegeneralideaofthecorrectnessproofofthepreventionbandsalgorithmsissimple.Foragivenparameteroftheownship,e.g.,trackangle,wedeneafunctionWtrk:R!R,parametrizedbys,vo,andvo,thatcharacterizesconictsinthefollowingway:Wtrk(a)0ifandonlyifconflict?(s;va),wherevaisdenedasinFormula5.Then,weprovethatthecriticalvectorscomputedinSection4.3arecomplete,i.e.,theyareexactlythezerosofthefunctionWtrk.Next,weprovethatthefunctionWtrkiscontinuous.Therefore,bytheIntermediateValuetheorem,wecandeducethatanypointinanopenbandsregion,e.g.,themid-point,determinesthecolorofthewholeband.Thislaststeprequirestheexistenceofaconictprobealgorithmthatiscorrectandcomplete,whichwehavealreadydevelopedandveried.Sincethefunctionsthatcomputethecriticalvectorsforgroundspeedaremuchsimplerthatfortrackangle,wedecidedtostarttheformalizationofthatproofsketchwiththecaseof2-dimensionalgroundspeedbandswithnolookaheadtime.Inthiscase,thefunctionWgsthatweneededtoconstructhadto8 AShortHistoryofanAirTrafcManagementProjectR.W.Butleretalfunctionv7!v2W(v),whichisdenedeverywhere,andweprovethatitiscontinuousandthatitcorrectlycharacterizesconicts,i.e.,conflict?(s;v)ifandonlyifv2W(v)0.Thefunctionv2W(v)hasaninnitenumberofzeroesinsomespecialcases,e.g.,whensisattheborderoftheprotectedzone,i.e,whens2=D2.Inthose,specialcases,weuseanalternativecharac-terizationofconictsthathastherequiredproperties.InAugust2009,wecompletedtheproofofthe2-dimensionaltrackandgroundspeedbandswithnitelookaheadtime.Foradditionaltechnicaldetailsonthisformaldevelopment,wereferthereaderto[7].5.2Vericationof3DPreventionBandsThevericationofthe3Dconictpreventionbandsalgorithmissimilartothatofthe2Dalgorithm.Indeed,manyofthegeometricalconceptscriticaltothevericationinthe2Dcasecanbegeneralizedtothe3Dcase.However,thesegeneralizationsaretypicallynontrivial.Thereasonforthisisthat,geometricallyspeaking,acircle(a2Dprotectedzone)ismucheasiertoworkwiththanacylinder(a3Dprotectedzone).TheWfunctionusedinthevericationofthe2Dalgorithmusesthehorizontaltimeofminimumseparationt,whichiseasytocomputeanalytically.Incontrast,thefactthatacylinderisnotasmoothsurfaceindicatesthata3DgeneralizationoftheWfunctionwillnotbeassimplydened.Despitethesegeometricchallenges,aconceptwasdiscoveredthatcanbeusedtosimplifygeom-etryproblemsinvolvingdistanceoncylinders.Thisconceptisthenotionofanormalizedcylindricallength[2]:jjujjcyl=max(q u2x+u2y D;juzj H):(13)Thismetricnicelyreduceshorizontalandverticallossofseparationintoasinglevalue.Indeed,ifsistherelativepositionvectoroftwoaircraft,thenjjsjjcyl1ifandonlyiftheaircraftarein3Dlossofseparation.Usingthecylindricaldistancemetric,theWfunctioncanbedenedinthe3Dcaseasfollows.W3D(v)=mint2[0;T]jjs+tvjjcyl�1;(14)whereSistherelativedistancebetweentheownshipandintruderaircraft.AnimmediateconsequenceofthisdenitionisthattwoaircraftareinconictifandonlyifW3D(v)0.ThecorrectnessofthepreventionbandsalgorithmsreliesonthefactthatW3Disacontinuousfunctionofv,thatthesetofcriticalvectors,i.e.,thezeroesofthefunctionisnite,andthatthecriticalvectoralgorithmsarecomplete.Formanyfunctions,aproofofcontinuityfollowsimmediatelyfromdenitions.Inthiscase,functionW3Disaminimumovertheclosedinterval[0;T].Whilestandardmethodsfromdifferentiablecalculusareoftenemployedinsimilarproblems,thisfunctionisaminimumofanon-differentiablefunction,namelythecylindricallength.Itsclosedforminvolvesseveralif-elsestatementsanditwouldbedifculttousedirectlyinaproofofcontinuity.Thus,somewhatmoreabstractresultsfromrealanalysiswereneededtobeextendedtovectoranalysis,e.g.,thenotionoflimits,continuity,compactness,andnallytheHeine-CantorTheorem.Asinthe2-dimensionalcase,thefunctionW3Dmayhaveatareasand,consequently,insomespecialcases,mayhaveaninnitenumberofcriticalzeros.WecarefullyidentiedthesespecialcasesandthenusedanalternativedenitionofW3D.Thesespecialcasesareextremelyrare,indeedallthemissingcriticalvectorsintheoriginalalgorithmspresentedin[8]wereduetothesespecialcases.Althoughtheyarerare,dealingwiththemisnecessaryforthecorrectnessofthealgorithms.Ifonecriticalvectoris10 AShortHistoryofanAirTrafcManagementProjectR.W.Butleretalmissing,thecoloringofthebandswillbepotentiallyswitchfromredtogreen.Finally,thePVSproofthatthealgorithmsndallofthecriticalpointsislessabstractbutmoretediousthantheproofofcontinuity.ItrequiredthedevelopmentofseveralPVStheoriesontheW3Dfunction,whicharegeneralenoughtobeusedinotherstate-basedseparationassurancealgorithms.Theproofofthecorrectnessofthe3-dimensionalalgorithmsfortrack,groundspeed,andverticalspeedwithnitelookaheadtimewascompleteinDecember2009.6VericationoftheMergeAlgorithmSoonaftertheextensionfrompurelygeometricsolutionstosolutionsthatincorporatealookaheadtime,werealizedthatstandardsetoperations(setunion,setdifference,etc.)couldbeusedtoimplementboththelookaheadtimeandthemergingofbandsfromapairwisesolutiontoa1-to-nanalysis.SupposewehadawaytodeterminethesettrackanglesthathavealossofseparationwithintimeT,denotedGT.ThensinceTredTamber,wemaydenethecoloredbandsoftrackanglesintermsofthisnewset:Gred=GTredGamber=GTamber�GTredGgreen=faj0a360g�GTamberThisobservationsimpliestheanalysis,becausenowweonlyneedtoanalyzeoneset,GT.Thisopera-tiononlyusesthesetdifferenceoperation.Nextweobservedthateachaircraft'scontributiontothesetGTisindependentofallothertrafc;thus,theproblemneatlydividesintoaseriesofaircraftpairs:theownshipandeachtrafcaircraft.IfweuseGo;iTtorepresentthesetoftrackangleswhichcausealossofseparationwithintimeTbetweentrafcaircraftiandtheownshipo,thenthesetoftrackanglesforalltrafcisthenbeformedbyGT=[i2trafcGo;iTThisobservationsimpliestheanalysisagain,becausenowweonlyneedtondthetrackangleswhichcauseaconictbetweentwoaircraft,denotedbythesetGo;iT.BeforeweexaminethesetGo;iTindetail,weintroducesomemathematicalmodelingconcepts.AtthispointwerealizedthatoursolutionwouldrelyonaJavaorC++implementationofsetsofoatingpointnumberswiththeirassociatedsetoperations.Commonimplementionsofsetsinprogram-minglanguagesdonotincludeefcientwaystodealwithrangesofoatingpointnumber;therefore,wechosetoimplementourown.However,werealizedthatthesealgorithmswouldbenon-trivialandwouldrequireverication.Thusweperformedacode-levelvericationofthealgorithmtomergeandsubtractbands.Eachbandisrepresentedbyanintervaldescribingitsminimalandmaximalvalues,withthesetofallbandsofonecolorbeinganintervalset.Theseintervalsetswereinternallyrepresentedbyarraysof(ordered)intervals.Necessarypropertiesfortheimplementationwouldbethatthedatastructuresrepresentingthebandsbothremainedorderedandpreservedthepropervaluerangeswithinasetofbands.Formultipleaircraft,redbandsforeachownship/intruderpairaremergedtogetherandtheownshipgreenbandsarecalculatedasthedifferenceoftheredbandsfromasingleall-inclusiveband.Mergingcombinesoverlappingbandsasappropriate,withsubtractionbreakinglargerbandsintosmallerones.Themaincomplicationsintheproofresultedfromboundaryconditionsandanorderingcalculation11 AShortHistoryofanAirTrafcManagementProjectR.W.ButleretalPVSintoJavaorC++.WearecurrentlydevelopingatooltoautomaticallyconvertPVSspecicationsintoJava[5],butthetoolisnotmatureenoughtohandlethespecicationofthesekindsofalgorithmsinPVS.Evenbyconvertingbyhand,weranintocertainproblems.PVSlibrariescontainalltheap-propriatevectoroperations(addition,dot-product,etc.).TheselibrariesdonotexistinstandardJavaorC++.Firstwepursuedtheapproachofndingathird-partylibrarytoofferthesefunctions.However,wefoundcertainquirksintheirimplementation.OnevectorlibrarytookfulladvantageoftheimperativenatureoftheJavalanguage,implementingfunctionsonvectorswhichwouldchangetheparameterstothevector.Thisresultsinefcientcode,becauseobjectcreationisnotnecessary,butdoesnotcloselyrelatetothefunctionalstyleofPVS.Becauseoftheseincompatibilities,wechosetoimplementourownvectorlibraries.Inasimilarway,wedevelopedourownsetoperations(unionandintersection).Howeverevenwiththishandtranslation,westilldonothaveanbehavioralreplicaofthePVSinJavaorC++.ThemostglaringdifferenceisthatJavaandC++useoatingpointnumbersandPVSusesactualrealnumbers.AllofourvericationsinPVSareaccomplishedwithvectorsdenedovertherealnumbers.Thiscanbethoughtofascomputationusinginniteprecisionarithmetic.Clearly,ourJavaandC++implementationsexecuteonlesspowerfulmachinesthanthis.Thereareseveralplaceswherewemustbeespeciallycareful:Calculationofquadraticdiscriminants.Sinceweareoftencomputingtangents,thetheoreticalvalueiszero,buttheoatingpointanswercaneasilybesmallnegativenumbernearzero.Wewouldthenmissacriticalpoint.Thepossibilityofthemid-pointofaregionbeingveryclosetozero.Finally,anotheraspectrelatedtothisissueisthatthedatainputintothealgorithmisnotprecise.Thegeneralrule-of-thumbisthattheerrorintheinputdatawilloverwhelmanyerrorintroducedbyoatingpointcomputations.However,wewouldliketomakeaformalstatementthatincludesbothdataandcomputationalerrors.8ConclusionsInthispaper,wehavepresentedashorthistoryofthedevelopmentandformalvericationofpreventionbandsalgorithms.Theresultingtrack-angle,groundspeed,andverticalspeedbandsalgorithmsarefarmoresimplethanourearlierversions.Thegoalofcompletingaformalproofforcedustosearchforsimplicationsinthealgorithmsandintheunderlyingmathematicaltheories.Akeyinsightthatenabledthecompletionofthiswork,isthattrigonometricanalysisshouldbedeferreduntilthelatestpossibletime.Although,theprojecttookfarlongerthanweexpected,weareverypleasedwiththeeleganceandefcienciesofthediscoveredalgorithms.References[1]G.Dowek,A.Geser,andC.Mu˜noz.Tacticalconictdetectionandresolutionina3-Dairspace.InProceedingsofthe4thUSA/EuropeAirTrafcManagementR&DSeminar,ATM2001,SantaFe,NewMexico,2001.AlongversionappearsasreportNASA/CR-2001-210853ICASEReportNo.2001-7.[2]GillesDowekandC.Mu˜noz.Conictdetectionandresolutionfor1,2,...,Naircraft.InProceedingsofthe7thAIAAAviation,Technology,Integration,andOperationsConference,AIAA-2007-7737,Belfast,NorthernIreland,2007.[3]J.Hoekstra,R.Ruigrok,R.vanGent,J.Visser,B.Gijsbers,M.Valenti,W.Heesbeen,B.Hilburn,J.Groe-neweg,andF.Bussink.OverviewofNLRfreeightproject1997-1999.TechnicalReportNLR-CR-2000-227,NationalAerospaceLaboratory(NLR),May2000.13 AShortHistoryofanAirTrafcManagementProjectR.W.Butleretal[4]J.M.Hoekstra.Designingforsafety:Thefreeightairtrafcmanagementconcept.TechnicalReport90-806343-2-8,TechnischeUniversiteirDelft,November2001.[5]LeonardLensink,C´esarMu˜noz,andAlwynGoodloe.Fromveriedmodelstoveriablecode.TechnicalMemorandumNASA/TM-2009-215943,NASA,LangleyResearchCenter,HamptonVA23681-2199,USA,June2009.[6]JeffreyMaddalon,RickyButler,AlfonsGeser,andC´esarMu˜noz.Formalvericationofaconictresolutionandrecoveryalgorithm.TechnicalReportNASA/TP-2004-213015,NASA/LangleyResearchCenter,Hamp-tonVA23681-2199,USA,April2004.[7]JeffreyMaddalon,RickyButler,C´esarMu˜noz,andGillesDowek.Amathematicalanalysisofconictpre-ventioninformation.InProceedingsoftheAIAA9thAviation,Technology,Integration,andOperationsCon-ference,AIAA-2009-6907,HiltonHead,SouthCarolina,USA,September2009.[8]JeffreyMaddalon,RickyButler,C´esarMu˜noz,andGillesDowek.Amathematicalbasisforthesafetyanalysisofconictpreventionalgorithms.TechnicalReportTM-2009-215768,NASALangley,June2009.[9]S.Owre,J.Rushby,andN.Shankar.PVS:Aprototypevericationsystem.InDeepakKapur,editor,Proc.11thInt.Conf.onAutomatedDeduction,volume607ofLectureNotesinArticialIntelligence,pages748–752.Springer-Verlag,June1992.14