Provably correct conflict prevention bands algorithms

In air traffic management, a pairwise conflict is a predicted loss of separation between two aircraft, referred to as the ownship and the intruder. A conflict prevention bands system displays ranges of maneuvers for the ownship that characterize regions in the airspace that are either conflict-free or “don’t go” zones that the ownship has to avoid. Errors in the calculation of prevention bands may result in incorrect separation assurance information being displayed to pilots or air traffic controllers. Algorithms that compute conflict prevention bands are surprisingly difficult to formalize and verify. This paper presents a method for the analysis and verification of prevention bands algorithms. The method, which has been implemented in the Prototype Verification System (PVS), is illustrated with a provably correct 3-dimensional prevention bands algorithm for track angle maneuvers.