Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999...

44
March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System (SATS) Concept Victor A. Carreno Langley Research Center, Hampton, Virginia Hanne Gottliebsen National Institute of Aerospace, Hampton, Virginia Ricky Butler Langley Research Center, Hampton, Virginia Sara Kalvala University of Warwick, United Kingdom

Transcript of Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999...

Page 1: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

March 2004

NASA/TM-2004-212999

Formal Modeling and Analysis of a PreliminarySmall Aircraft Transportation System (SATS)Concept

Victor A. CarrenoLangley Research Center, Hampton, Virginia

Hanne GottliebsenNational Institute of Aerospace, Hampton, Virginia

Ricky ButlerLangley Research Center, Hampton, Virginia

Sara KalvalaUniversity of Warwick, United Kingdom

Page 2: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

The NASA STI Program Office . . . in Profile

Since its founding, NASA has been dedicated to theadvancement of aeronautics and space science. TheNASA Scientific and Technical Information (STI)Program Office plays a key part in helping NASAmaintain this important role.

The NASA STI Program Office is operated byLangley Research Center, the lead center for NASA’sscientific and technical information. The NASA STIProgram Office provides access to the NASA STIDatabase, the largest collection of aeronautical andspace science STI in the world. The Program Office isalso NASA’s institutional mechanism fordisseminating the results of its research anddevelopment activities. These results are published byNASA in the NASA STI Report Series, whichincludes the following report types:

• TECHNICAL PUBLICATION. Reports of

completed research or a major significant phaseof research that present the results of NASAprograms and include extensive data ortheoretical analysis. Includes compilations ofsignificant scientific and technical data andinformation deemed to be of continuingreference value. NASA counterpart of peer-reviewed formal professional papers, but havingless stringent limitations on manuscript lengthand extent of graphic presentations.

• TECHNICAL MEMORANDUM. Scientific

and technical findings that are preliminary or ofspecialized interest, e.g., quick release reports,working papers, and bibliographies that containminimal annotation. Does not contain extensiveanalysis.

• CONTRACTOR REPORT. Scientific and

technical findings by NASA-sponsoredcontractors and grantees.

• CONFERENCE PUBLICATION. Collected

papers from scientific and technicalconferences, symposia, seminars, or othermeetings sponsored or co-sponsored by NASA.

• SPECIAL PUBLICATION. Scientific,

technical, or historical information from NASAprograms, projects, and missions, oftenconcerned with subjects having substantialpublic interest.

• TECHNICAL TRANSLATION. English-

language translations of foreign scientific andtechnical material pertinent to NASA’s mission.

Specialized services that complement the STIProgram Office’s diverse offerings include creatingcustom thesauri, building customized databases,organizing and publishing research results ... evenproviding videos.

For more information about the NASA STI ProgramOffice, see the following:

• Access the NASA STI Program Home Page athttp://www.sti.nasa.gov

• E-mail your question via the Internet to

[email protected] • Fax your question to the NASA STI Help Desk

at (301) 621-0134 • Phone the NASA STI Help Desk at

(301) 621-0390 • Write to:

NASA STI Help Desk NASA Center for AeroSpace Information 7121 Standard Drive Hanover, MD 21076-1320

Page 3: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

National Aeronautics andSpace Administration

Langley Research Center Hampton, Virginia 23681-2199

March 2004

NASA/TM-2004-212999

Formal Modeling and Analysis of a PreliminarySmall Aircraft Transportation System (SATS)Concept

Victor A. CarrenoLangley Research Center, Hampton, Virginia

Hanne GottliebsenNational Institute of Aerospace, Hampton, Virginia

Ricky ButlerLangley Research Center, Hampton, Virginia

Sara KalvalaUniversity of Warwick, United Kingdom

Page 4: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

Available from:

NASA Center for AeroSpace Information (CASI) National Technical Information Service (NTIS)7121 Standard Drive 5285 Port Royal RoadHanover, MD 21076-1320 Springfield, VA 22161-2171(301) 621-0390 (703) 605-6000

Acknowledgment

The authors would like to thank Sheila Conway, Ken Jones, Maria Consiglio, DanWilliams, Cathy Adams, Gary Milsaps and other members of the SATS team fordiscussions regarding landing procedures, ATC practice, performance requirements andmany other characteristics of the National Air Space. Their help was invaluable informulating the model and parameters of the preliminary concept of operation. We wantto especially thank Ken Jones for his leadership of the High Volume Operations Teamand his recognition of the need for formal methods on this project.

Page 5: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

�������������

� ���������������������� �

� "!�#$��%'& ()%'#*�+�,��-����.��� �

/ 01����%'23�546 7%'2�4689���:�*�,��2.2.%'�<;��,%>= ?@BADC EGF'HJI�K�F�L�MONBIQPSR�TJTJUVFWR�XYNZA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA ]@BA_^ `6acb'aedVaeF+fgF�L�MhNJI[iJjlk1AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA m@BAn@ o�UhI�HBaeX*R,MOI�dqp6fGo�F+acf>MhdrA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA s@BAut `6I$MhI�UhvwaefBaefJx9MhNJI[jlF+UhUVI�XyMqkqUhUVacbzR�K�{�a}| A\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA ~

� 01����%'23�54�;��.�,�+��=J4��w���,=>�$%����*����! �tJADC �lI$L�F�UhI�O���q� ��� �������.�,�*��A[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA �tJA_^ �lI$M���I�I$f��O���q� ��� �����*�������3R�fJH)�O���q� ��� � ���������QAQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA C��tJAn@ kqL�MhI�U3�O���q� ��� � ���.�,�*��AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA C+CtJAut j3R�KeX$�JK R,MOaeF�f�F�L�¡B�£¢�� ¤��B¥��W�.�,�*����¦V�ZA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA C+C

? ;�0§0 ¨�%'©7���.��%'&ª%'�:��#«01���¬%'2 �'�

­ 7=B4®%W�y!<¯Q�,�5-�%>���°! �W�mBADC P±aevwaefJx²o³UVI�HJacX*RzMhI�d±A\AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA C*tmBA_^ ´�|BX$Ke�JHBaefJx�i�T�I�X$a R�K¬j3RzdhI�d A[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA C�]mBAn@ iBRzL�IQi�I$TµR�UhRzMOacF+f A[A\AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA C�m

¶ ¯[���7�5468[�����+%>-¬��# � ¶s�ADC i'MYR,MO�Jd·F�L�¸³I�UVac¹µX�RzMOacF+fºA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA C�ss�A_^ o�UhF'F�L�FzL�¢V�����y��» ¼�¼ ½�½¾A[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA C��

s�A_^�AcC j3RzdhIQ@¿AQA[A\AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA ^�Cs�A_^�A�^ j3RzdhI\tÀAQA[A\AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA ^�@

s�An@ o�UhF'F�L�FzL�Á����Y �B¥ à AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA ^�@s�Aut o�UhF'F�L�FzL�¢V�����y��» ¼:��½z�9AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA ^+ss�A_] o�UhF'F�L�FzL�¢V�����y��» Ä ÃÅAQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA ^�~

� 8[�:���W2.��#*����� /µÆ

; ÇQ%����*���,#ÉÈÊ�.Ë���=J��! /5�k9ADCÅ^�`̸³I�XyMOF+UVd6A[AQAQA[A\AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA @W^k9A_^Ío�F+dVacMhaeF+fJd±acfG^�`1dhTµR�X$IÎA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA @�tk9An@ ^�`§Ï�aefJI$dGAQA[AQAQA[A\AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA @W]k9AutÑÐ�fWMOI�UVdhI$X$MOacfJx�ϬacfJI�dÎA\AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA @+mk9A_]ÑjlKeF+dVI�dÒMqkqTJTJUVFWR�XYNÓA\AQA[AQA[AQAQA[AQA[AQA\A[AQAQA[AQA[AQAQA[AQA\A[AQA[AQAQA[AQA[AQA @+~

acaea

Page 6: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

� � �������������·����w�

P±NJI i�v�R�KcK�kqaeUVX�UOR,L�M�P�UOR�fJdVT:F�UVMYR,MOaeF�fri�'dVMhI�v ��i�k�P�iJ�gTJUVF+x+UORzv R�acv�dÉMOF TBUhF�b'aeHJI Rzf I �wX�acI�fWMMOUhR�fJdVT:F+UÒMYRzMhaeF+fwR�KDMOI$UhfµRzMhacb�I3MOF\X�F+vwvwI�UhX$a R�KBR�aeU³RzfJH�x�UhF+�JfBHwMhUOR�fJdVT:F�UVMYR,MOaeF�fÉMhNJUhF��Jx+NÉx+I�fBI�UORzK:R*b'a��RzMhaeF+f7AZP±NJI F�b+I$UOR�KcK6x+FWRzKed�R�UVI�MOFÎacfJX�UVI*R�dVI v�F��BaeKeaDM���3UVI�HJ�BX�I HJF'F+U���MOF��®HJF�F�U�MOUhR*b+I�KqMOaevwI�d � RzfJHTJUVF�b'acHJI�RzaeU²MOUhR�fJdVT:F+UÒMYRzMhaeF+f�MhF �BfJHJI�U���dVI�UVb�I�H v�R�U��zI$MhdgRzM�R�f<R��:F+UhHJR��JKeI�X$F+dVM�A P�FªRzX�X�F�v�TJKcaedVNMONBI�dhI[x+FWR�Kcd��JMhNJI²i'k�P�iGTJUhF�x+UOR�v¿aed·HJI$b�I�KcF+TJaefBxgX�F�fJX�I$TBMOdqF�L F+T�I�UhRzMOacF+fJd�R�fJHGI�fµR��JKeacfJxwMhI�XYNJfBF+KeF��x+acI�d�A¾p6fJIGFzL MONBIGX$F+fJX�I$TBMOd�F�L6F�T:I$UORzMhaeF+f���I�aefBx HJIyb+I$KeF+T�I�H R�d�TJR�UVMwF�LqMONJI�i�k�P�i TBUhF+x+UhR�vÍacdI�fWMhacMOKcI�H����qaex�NJI�Uʸ³F+Ke�JvwI pT�I�UhRzMOacF+fJd6� ��¸qp\�lR,M3fJF+f��®MOF���I�U �JfJF+f!�®UOR�HJR�UlRzaeUhT�F+UÒMOdlHB�JUhacfJx²Ð�fJdÒMOUh���vwI�fWM EGI$MhI�F+UVF+KeF+x�aeX*RzK�jlF+fJHBacMOacF+fJd\��ÐÒE j±��"BA

jl�JUhUVI�fWM·F+T�I�UhRzMOacF+fJd3R,M3fJF+f��®MOF���I�U �JfJF+f!�®UOR�HJR�UlRzaeUhT�F+UÒMOdlHB�JUhacfJx9ÐÒE j UhI$K#wF+f�TJUVF�X$I�HJ�BUOR�K�dhI$T!�R�UhRzMOacF+f$�JR�dhI$H�F+f�RQv�IyMONJF'HgF�L7F+fJI%�®aef'&,F+fJI%�®F+�BM�A�P±NJacdlvwI$MONBF�H�UhI�dV�JKcMhdlacf�R[dVaex+fBac¹µX�R�fWMlUVI�HJ�JXyMOacF+faef R�aeUVT:F+UÒM X�R�TµR�X$acM��AP±NJIÉi�k�P�i���¸qp X�F�fJX�I$TBM�·aeKcK�I$fµR��JKcI²v²�JKDMOacTJKeI\F+T�I�UhRzMOacF+fJdqMhF�fJF+f��®MOF���I�U �fJF+f���UORzHµR�UÊR�aeUVT:F�UVMOd³HJ�BUhaefBx[ÐÒE j A'ЮM�aedÊaevwT:I$UORzMhacb+I3MhNµRzMÊMONJacd�X$F+fJX$I�TBM(�:I�HJI$b�I�KcF+T:I$H�aef�R[UVaex+F�UhF+�Jdv�R�fJfJI$U\MhF)aefJdV�JUhIÉMONµR,M\dORzL�IyM� aed\fJF�MQX�F�v�TJUVF+vwaedhI$H7A«P±NJacdQUVI�)>�JacUhI�d\MONJRzM\MONJIÉX�F�fJX�I$TBM²�JfBHJI�UVx+FR�f)Iy|'MhI�fJdVacb+I[I$bzR�Kc�µRzMOacF+f*�+*��F�MON dhacv²�JK R,MOaeF�f�R�fJHGR�fµRzK#>MOacX*R�K:v�IyMONJF'HJd�A

Ð�f<MhNJaedwTµR�T�I�U ����I�HJI$v�F+fBdVMOUhRzMOI NJF��ÀMhNJI,�zI dOR,L�I$M� TJUhF�T:I$UVMOacI�dÉX*Rzf-��IGI$dVMYR��JKeacdhNJI$H-�+ Rv�RzMONJI$vgR,MOaeX�R�K7b+I$UhaD¹µX*RzMhaeF+f�v�IyMONJF'H.�µR�dVI�H F+f L�F�Uhv�R�K¬KeF+x+acXQR�fJH MONBI�F+UVI�v TJUhF�b'aefJxBA6P±NJI²d��dÒMOI$vaed�UVI�TJUVI�dVI�fWMOI$H�aefwR6L�F+Uhv�R�KBv�RzMhNJI�v�RzMOacX*R�K�K R�fBx+�µR�x+I·RzfJH«MONJI�UhI )'�BaeUhI$H�TBUhF+T�I�UÒMOaeI$dÊR�UhI3L�F+UVv²�JKeRzMOI$HR�d�X$F+f0/VI$X$MO�BUhI�d$A1k v�RzMONBI�v�RzMOacX*R�K·TJUVF�F�L6aedgX$F+fJdÒMOUh�BX$MOI$H MOF�dVNJF�� MhNµRzM�MONJI$dhI X�F�f0/VI�XyMO�JUVI�d)R�UVIaefBHJI�I$H�v�RzMONJI$vgR,MOaeX�R�K:MhNJI�F�UhI�vwdqR�fJH�X$F+fJdVI�)>�JI�fWMhK# MONµRzM·MhNJI[vwF'HJI�KcI�H d�'dVMhI�vºNµR�d·MONJIQUhI )>�JaeUVI�HTJUVF+T:I$UVMhaeI�d$A

kÀTJUVI�Keacv�acfµR�U� X�F+fJX$I�TBMÉFzL·F+T:I$UORzMhaeF+f �3R�d9HJI$b�I�KeF�T:I$H TBUhaeF�U[MOF MhNJI�X$F+v�TBKeI$MhaeF+f F�L±MONBIg¹µUhdÒMHJUhRzL�MÉF�L·MONJI)F��wX$a R�K3X$F+fJX$I�TBMwF�LqF+T�I�UOR,MOaeF�fJd�A P±NJaed²�lR�dÉHJF+fJI�MhF x�acb+I��Bd�R NJI�R�HÎdVMOR�UVMÉF+fÎMONBIHJIyb+I�KcF+TJvwI�fWM�F�L�RQUhaex�F+UhF+�Bd�vgRzMhNJI�v�RzMhaeX*RzKµR�fµR�K�'dhaed³vwI$MhNJF�HÉMONJRzMÊX*R�f$�:I��JdhI$H�MhF[b+I$UhaDL1«MONJI·¹µfµR�KX�F�fJX�I$TBM FzL F+T�I�UhRzMOacF+fJd·aefG^��+�ztJA�P±NBI[vwF�HBI�Ked·RzfJH�TJUVF�FzL�d�TBUhI�dVI�fWMOI$H aef)MONBaed·TµR�T�I�U·X�F�fJX�I$Uhf�F�fJK#MONBaed3TJUVI�KcaevwaefµR�U�«X�F�fJX�I$TBM�R�fJH�fJFzM3MONJIKeRzMOI$dVM±i�k�P�i*��¸qpZX$F+fJX$I�TBM·HJF'X��Bv�I$f>MhI�H)aef�MONJI6dV�Jvwv�I$UF�L�^z�+�+@BA�P±NBaed9TBUhI�KcaevwaefµRzU�GX�F+fJX$I�TBM9NµR�d[I�fµR��BKeI�H �Jd[MhF�HJIyb+I$KeF+T R)b'a R��JKcI«b+I�UVac¹µX�RzMOacF+fªvwI$MhNJF'HR�fJHwX�UVI*RzMhI R\dhacx+fJaD¹µX*R�fWMÊR�vwF+�JfWMÊF�L"UhI��BdOR��JKcI·Kea2�BUOR�UVaeI�d ��MONBI�F+UVaeI�d �'R�fJH�Rz�BMOF+v�RzMhI�HÉdVMhUORzMhI�x+acI�d�MONµR,M�·aeKcK3��I�JdVI$L��JK7L�F+U�MONJI6b�I�UhaD¹µX*R,MOaeF�f FzL�MhNJI6¹µfµRzK7X�F+fBX�I�T�MqFzL�F�T:I$UORzMhaeF+f�RzfJH)F�MONJI$U±d�'dVMhI�vwd·dhaevwaeKeR�UMOF«MhNJaed±F+fBI�A

P±NJI·TJUhI$Keacv�acfµR�U�QX$F+fJX�I$TBMÊaed�HJI$dhX$Uha2��I�Hwaef²MhNJI·fJIy|'MÊdhI$X$MhaeF+fwR�fJHwaef«vwF+UVI±HJI$MOR�aeKcd aef54u^06�A P±NJUhI$I�µR�dVaeXqI�KeI$v�I$fWMOdlFzL7MONJI d�'dVMhI�vÀRzUhI vwF'HJI�KcI�Hw�JdhacfJx9MONBI6o ¸\i�L�F+UVvgRzK�v�RzMhNJI�v�RzMOacX*R�KBK R�fJx��µR�x+I�7±�ÒC��MONBIgR�acUhdVTµR�X�IÉdV�JUhUVF+�JfJHJacfJx)MONJI�R�aeUVT:F�UVM8��X�R�KeKcI�H MONBI�i�I$KcL3jlF+fWMOUVF+KeKcI�H k UhI�Rª��iJjlk�9����^+�R)x+UhF+�BfJH�µR�dVI�HªR��BMOF�vgRzMhI�H d�'dVMhI�v X*RzKeKeI$H MhNJIÉk acUhT�F+UVM9E�R�fJR�x+I�vwI�fWM9EGF'HJ�JKcI���kE E��%�l��@W� MONBI�RzaeUhX$UORzL�MMOUhR:/VI�XyMOF+UVaeI$d�A P±NJI dORzL�IyM��UVI�)>�JacUhI�vwI�fWM�aed³L�F+Uhv9�JK RzMhI�H�R�d�R[x+I$F+v�IyMOUVaeX·dhI$TµR�UOR,MOaeF�f�TJUVF+T�I�UVM��A³{µUhF+vMONBIQvwF'HJI�Kcd±R�fJH)MONJI\dhRzL�I$M�)UVI�)>�JaeUVI�vwI�fWM8�µTBUhF'F�L�d·R�UhI\HJIyb+I$KeF+T�I�H)MONµR,M·dh�JTJT�F+UÒM�MhNJI\dORzL�IyM�)X�KeR�aev A

; <>= �� �@? A�B�C�D8E�����w�

P±NJI F���/VI$X$MOaDb+I)F�LqMONJacd«X�F+fJX$I�TBM�F�LqF+T�I�UOR,MOaeF�f acd²MOF TJUhF�b'aeHBIGRzf<Rz�BMOF+v�RzMhI�HÎdhI$UVb'aeX$I �·NJacXYN �·acKeKx+�µRzUOR�fWMOI$I�dhI$TµR�UhRzMOacF+f�R�dVdh�JUhR�fJX$I�L�F+U9RzaeUhX$UORzL�M[F+T�I�UhRzMOacfJx�acf MONBI�R�aeUVT:F�UVM[R�aeUVdhTµRzX�I�AGP±NJI�d��dÒMOI$vv²�JdÒMF��IQaevwTJKeI$v�I$f>MOR��JKcI �·acMhN�vwaefJacvgR�K�aef�L�UOR�dÒMOUh�BX$MO�BUhIg�.a�AuI�AlKeF��ÌX$F+dVMY�qR�fJH dhNBF+�JKeH,�:I\b+I$UhaD¹5R��JKcIMOF RGNJaex+N X$F+fB¹µHBI�fJX$I KcI$b�I�K�A P±NBI�d�'dVMhI�vÍX$F+fJdhacdVMhd«F�L±L�F+�JU²TBUhaev�R�U� L��BfJX$MhaeF+fµRzK�TµRzUVMOd 7 ��C��QMONBI

C

Page 7: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

i�I$KcLQjlF+fWMhUhF+KcKeI�H k UVI*R ��iJjlk6�%� ��^+�²MONJIGk acUhT�F+UVMgE�R�fJR�x+I�vwI�fWM�EGF'HJ�JKeIª�.k6E E �9�6�.@W�ÉF�f!����FWR�UVHfµR*b'aexWR,MOaeF�f MhF�F+Kcd���R�fJH��.t>�±HµRzMOR�X$F+v�v9�JfJaeX�RzMOacF+f7A·p6fJK��MONJIQ¹µUhdÒM MhNJUhI$I9TµR�UÒMOdqF�L MONBI9d�'dÒMOI�v R�UVIvwF�HJI$KeI$H�aefGMONJacdqTµRzT:I$U�A6P±NJI9HµRzMYR�X�F+vwv²�JfJacX*RzMhaeF+f aedqR�dVdh�JvwI�H MhF>�:I9R*b�RzaeK R��JKeIQR�fJH�I�UhUVF+UqL�UVI�IzAÐ�f L��BMO�JUVI«b+I�UVac¹µX�RzMOacF+f I �:F+UVMhd��¬MONJIÉX$F+v�v9�JfJaeX�RzMOacF+f TµR�UÒM\F�LÊMONJIwd�'dVMhI�v5��acfJX�Kc�JHJacfJx�I�UVUhF+UVd��¬vgR8��IQX$F+fJdVaeHJI$UhI�H"A

P±NJI�i�I�KDL±jlF�f>MhUhF+KcKeI$H k UhI�R ��iJjlk6�acdR�X 'KeacfJHJI$Udh�JUVUhF+�JfBHJaefJx�MhNJIÉR�aeUVT:F�UVM6L.R�X$aeKcacM�+A\P±NJI�R�T!�TJUVFWR�XYN TJUVF�X$I�HJ�JUVI�aed �µR�dVI�H F+f R � oÊi �VP " RzTJTJUhF+R�XYN R�d²HBI�dhX$Uha#�:I$H aef 4 C 6�A {�acx+�JUhI C�acd²RGMhF+Tb'aeIy� FzL�MONJI²P§X$F+fB¹µx+�BUORzMhaeF+f7A k aeUVX�UhRzL�MR�TBTJUhFWRzXYNJaefJx�L�UhF+vºMONJI9dVMOUhR�aex�N>M���acf�UhI$x+aeF�f R�UVI²Iy|�T�I�X$MhI�H

FAF

STRAIGHT−IN AREA

LEFT BASE AREA

IAF_R

IAF_L

MAP

Runway

RIGHT BASE AREA

initial segement

intermediate segment

final segment

(Missed Approach Point)

Missed ApproachHolding Fix

IF

{�aex+�BUhI«C�7³�3RzdhaeXPS`6I�dVaex+f�L�F+U � oÊiGi'MOR�fJHµRzUhH)Ð�fJdVMhUh�JvwI�fWMqk TJTBUhFWR�XYN

MOF)TJUVF�X$I�I$H HBaeUhI$X$MhK#�MhF�MONJIÉÐ�fWMOI$UhvwI�HJaeRzMOIÉ{�aD| �.Ð�{��°A7k acUhX�UhRzL�MRzTJTJUhF+R�XYNJaefBx)L�UVF+v MhNJI �µR�dVIÉUhaex�N>MF+U �µR�dVI KeIyL�M�R�UhI�Iy|�T�I�X$MhI�H�MhF9TJUVF�X$I�I�HgHJaeUVI�X$MhK#²MhF9Ð�fJaDMOaeR�Kµk UVUhacbzR�K5{�aD|G��Ð�k6{���Uhacx+NWM�F�U�KcI$L�M8�>UVI�dhT�I�X9�MOaDb+I$K#��°AÉk acUhX�UhRzL�M\I�fWMhI�UhacfJx)MONJI�iJjlk�R�X$X�I�T�M9UVI�dhT�F+fJdVa2�JacKeaDM�GL�F+UdVI�TµRzUORzMhaeF+f7AÉP±NµR,M[acd��¬R�acU6MOUhR��wXX�F�f>MhUhF+K�dVI�UÒb�acX�I$d R�UVI\fJF�M·TJUVF�b'acHJI�H aefJdVaeHJI6MhNJI[iJjlk9A

P±NJI�k aeUVT:F�UVMÊE�RzfµR�x+I$v�I$f>M�E F�HJ�BKeIQ�.k6E E � aed³RX$I�fWMOUhR�Kea���I�HwR���MOF+v�RzMOI$HÉd�'dVMhI�v �·NJacXYN�X$F+v �v²�JfBaeX*R,MOI�d3b'aeR²HµRzMYR²Kcaef �É�·acMhN)R�aeUVX�UhRzL�M±R�UVF+�JfJH�MhNJI\R�aeUVT:F�UVM*A�P±NJIkE EÓ�·aeKcK�M�'TJacX*R�KcK#�UhI$dhaeHBIF+fMONBI R�acUhT�F+UVM x+UhF+�BfJHJd�A�P±NBIqk6E E dVI�UVb�I�d±Rzd�RzfgR�U��JacMhI�UÊR�fJHwdhI )>�JI�fJX$I�U$A�ЮMÊUhI$X�I$acb+I$dlUVI�)>�JI�dÒMOdÊL�UhF+v������ ��������������������� !�"����#���$�% ��&����'(�"���)�+*,���!- ��"$!.(�)/0��!#1�����.�����#���$23���4*5#��+6����%�7�%.�.� �#���/8:9

^

Page 8: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

R�acUhX�UhRzL�M3MhF�I$f>MhI�U·MONJI[iJjlkZR�fBHGx+UhR�fWMOd·F+U·HJI$fJaeI$dqRzX�X�I$dhd$A � UOR�fWM·F+U·HJI$fJa R�K"F�L RzX�X�I$dhdqaed �µR�dVI�HGF+fR«MOaevwI%�®dhI$TµR�UOR,MOaeF�f�X�UhaDMOI$Uha R�A��rNBI�f Rzf�R�acUhX$UORzL�M·UVI�)>�JI�dÒMOdqI�fWMOU�)aefWMOFÉMONJI[iJjlk ��MhNJI\kE E XYNJI�X �>dMONJRzMqMhNJIQUhI�)>�JI$dVMhaefJx�RzaeUhX$UORzL�M±�·acKeK ��IQMhaevwI\dhI�TJR�UORzMhI�H �:RzMqHJI�dVaex+fJRzMOI$H�T�F+aefWMOd �µ�·acMON�R�KeK�FzMONJI$U R�acU��X�UhRzL�M³R�KcUhI�R�H ²x�acb+I$fÉR�X�X$I�dVd��,A�P�FQacv�TBKeI�vwI�fWM�MONJI3MhaevwI%�®dhI�TJR�UORzMhaeF+f9dhXYNJI$v�I·aef²R�lR8²MONJRzM�HJF'I�d�fJFzMF�b+I$UhK#�X�F+fJdÒMOUhR�aef�MONBI\R�aeUVdhTµR�X$I�� �B�BMqR�XYNJaeIyb+I$dqR«dVaevwTJKeaD¹µI�H�RzX�X�I$dhd�X�UVacMOI$UhaeR ��MhNJIQiJjlk1�3Rzd�HBacb'aeHJI$HaefWMhF�mgUhI$x+aeF�fJd�A{�aex+�JUVI²^wdhNJF��·d6MONBI«R�X�X$I�dVdUhI�x�aeF+fJd$A6k acUhX$UORzL�Mqaef�MhNJI²dhR�v�I[F+U6RzH0/hR�X�I$fWMUhI$x+aeF+fBd

IF

FAF

Region 2

Region 3 Region 4

Region 5

straight−in area

right base area left base areaRT (runway threshold)

runway

IAF_R IAF_L

Region R Region L(Region 1) (Region 6)

Virtual IAF

Entry Not Permitedin this zone

SCA Boundary

{�aex+�JUVIQ^!7ÊiJjlk��·I�x+acF+fJd3L�F+U±k6E E ´�fWMOU� jlUhaDMOI�UVa R

v²�JdÒM �:I6MhaevwIdhI�TJR�UORzMhI�HGRzM±MONBI\L�F�KeKeF��·acfJx²HJI$dhaex�fµRzMOI$HGT�F+acf>Mhd�7

� P±NJI[iJjlk ��F+�JfJHµRzU�

� P±NJI\Ð�k {S��Ð�fJacMha R�K:k UhUVacbzR�K"{�aD|J�lF+U3¸ aeUVMh�µR�K7Ð�k {

� P±NJI\Ð�{ �.Ð�fWMOI$UhvwI�HJaeRzMOI\{�aD|J��"� # ����$�� !� �!��1�1$!�4.(�% 8� �!��#�� �%� ����� #�� �!��)$ �1. #���� ��$&� � � $ ���"/��)$!$��% � � #� �!�������� ��#+(� 2����3��# *,���"����� #�� �!��

��#� ������� $ . �4�)�-.� �#%6����"$,#�� � ��� �4 ��4� �����3. �"$,#�� �%�� �/4 ��%��� �%���+�!��4�� ��! 8��� �)/0��#� ����)$49 ����$� �)�%��$,�!��%� �!������������$ ��� 2��+� ��� �8�%'���$ �+#%�&���� 8/� 8� ��� ���3.(�)$ ����� �!��"�� ��$�$!#3/4���%�!�)� � �"$�/��"� �1$!.(�"�"��$1��$ � ������/��!��#�� #%� ����$ ������/�� � �#� �!�� ���3* � ��9 ��� � ���8�%����$1#��&�# * �!��!����� . �4 !� #� 1$ ����"$!� /4����/"��� � �!��#��($ �% �� ��#%� ����/������ �)� ��� �!��#1# � �"��9 �����#� ������� �! 8��� �"/��!#� !���"$�% ���� �����4 1�����)��'$���!�� /4#���/4�4. �,����$!�4��� �����-�% �� ����/������ �)� ���-#��� % # � �"��9

@

Page 9: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

� P±NJIQ{'k6{ ��{�acfµR�K"kqUhUVacbzR�K7{�aD|J�

� P±NJI ��P � �·�JfW�3R8)P±NJUVI�dVNJF+KeHµ�k acUhX�UhRzL�M�acf fBF+f R�H0/hR�X$I�fWM UhI�x�aeF+fJdgv²�JdVM5��I MOacv�I dVI�TµRzUORzMhI�H RzM�MONJI L�F�KeKeF��·acfJx�HJI$dhaex�fµRzMOI$H

T�F+aefWMOd 7� P±NJI\Ð�{ �.Ð�fWMOI$UhvwI�HJaeRzMOI\{�aD|J�

� P±NJIQ{'k6{ ��{�acfµR�K"kqUhUVacbzR�K7{�aD|J�

� P±NJI ��P � �·�JfW�3R8)P±NJUVI�dVNJF+KeHµ��rNJI$fwMhNJI±kE E x+UhR�fWMOd³R�X$X�I�dVd�MOFQR�fwR�aeUVX�UhRzL�M8�zacM �JUVFWR�HJX�R�dVMhd�MOF6MONBI·R�aeUVX�UOR,L�M³R�fw´�dVMOacvgR,MOI�H«P±acv�IF�L�k UVUhaDb�RzK �.´³P�k�°ABP±NJI\´�P�k d·X�F�UhUhI$dhT�F+fJH�MOF[MONJI6L�F+KcKeF��·aefBx[HJI$dhacx+fµRzMhI�H�T�F+aefWMOd 7ÊiJjlk ��F+�JfJHµRzU���Ð�k6{ � Ð�{(��{'k6{(��R�fJH ��PA P±NJI ´�P�k dwR�UhI*�JR�dhI$H<F+f MhNJI�Iy|�T�I�X$MhI�H MOUOR /VI�X$MhF+U���ÊMhNJI�M�'T:I)F�L�MONBIR�acUhX�UhRzL�M8�JR�fJH)MONJI\fJF+vwaefJR�K7dhT�I�I$H�TJUVF�¹µKcIF�L�MhNJIQR�aeUVX�UOR,L�M*A�ЮMqaed·R�dVdh�JvwI�H MONµRzM·dV�JacMOR��JK� �®I�)>�JacTJT:I$Hi�k�P�i9RzaeUhX$UORzL�M¬�·acKeK>NµR*b+I3F�f!����FWR�UVH[fµR*b'aex+RzMOacF+fQMhF�F�Ked�MONµR,M x+I$fJI�UhRzMOI�NJI*R�HBaefJx R�fJH²dVT:I$I�H«R�H�b�acdhF+UVaeI$d��b�I�XyMOF+UVaefJx>�lMhFwI$fµR��JKcI6MONJI\TJacKeF�MlMOF � �MhNJI\Iy|�T:I$X$MhI�H�MhUOR:/VI$X$MOF�U�)R�fBHGvwI�IyM±MONJIQ´�P�kqd�A

P±NJI·F���/VI$X$MOaDb+I·F�L�MONJacd�X�F+fBX�I�T�M�acd MOFI$fµR��JKcI·R\x��µR�UORzf>MhI�I±MONJRzMÊR�KeKBR�aeUVX�UhRzL�M acfJdhacHJI3MONJI�iBjlkr�·acKeKUhI$vgRzaef dhI�TJR�UORzMhI�H R�d�KeF�fJx�R�d·MONBI9TJacKeF�Mhd � �acf�R�X$X�F+UVHµR�fJX$I9�·acMhNGMhNJI9acfJdVMhUh�JXyMOaeF�fJdqx�acb+I$f.�+)MONJacdd�'dÒMOI�v AQP�F�I$dVMYR��JKeacdhN�MhNµRzM6MhNJaed6x��µR�UORzf>MhI�I²acd bzR�KeacH �5�lI«v²�BdVMdVNJF�� �7L�F+UR�KcK�T�F+dVdha2�BKeI9MhaevwI�d6RzfJHR�KcK�RzKeKeF���I�H RzaeUhX$UORzL�MQMOUhR:/VI�XyMOF+UVaeI$d9MONµR,M«x+I�F�v�IyMOUhacX�dVI�TµRzUORzMhaeF+f�acd9v�R�aefWMOR�aefJI$H7A�P±NBaed9b�I�UhaD¹µX*R,MOaeF�faed9R�X�X$F+vwTJKeacdhNJI$H��JdhacfJx RGL�F�Uhv�R�K�v�RzMhNJI�v�RzMOacX*R�K�vwI$MhNJF'H ���·NJacXYN aed9HBI�dhX$Uha#�:I$H acfªMONBIgL�F+KeKcF��·aefJxdhI$X$MhaeF+fJd$A³P±NJI[x��µR�UORzf>MhI�I\aed±I$K R���F+UhRzMOI$H)R�d�RÉMhF+T)KeI$b�I�K�dhRzL�I$M�)TJUVF+T�I�UVM��R�d±L�F+KeKcF��·d 7���¬%>�5�,%'& ����� �����y��» Ã"���

� Ä�Ä �� e��+�� e�O�£�$¢��'����� ��� �,� � ����Y� ��¥ ��� � ����¦ � ��� � ����Y� ��¥ ��� � ����¦ � ��� � ���¥���� ��¥ ¥�� �z¥����� �y�B¥������.�,� ��� ��� � ��¢h������� » ¢Ò���,��  �����$¡��B� ��!�,� � ����� !��� � �$��¦V� � ��!�,� � �'�W� !�,� � ����¦V�V�

P±NJacdQMhNJI�F+UVI�vÓ�·acKeK���I�I°|�TJK R�acfJI�H aef HJIyMYR�acK�aef MONJIwfJIy|'M[dhI$X$MOacF+fJd �B�J�BM[aef�L�F+Uhv�R�KeK�)MONJacd\MhNJI�F�UhI�vdVMORzMOI$dMONµRzM6acL�MONBI«kE EÑTJUhFzMOF'X�F+K�TJUhF+T�I�UÒMOacI�d\R�UVI²dORzMhaedÒ¹µI�H � ��F�MhN RzaeUhX$UORzL�M6R�UhI²�·aDMONJacf�MONBIwiJjlkR�acUhdhTJR�X�I��>R�fJH ��F�MONÉF�LµMhNJI�acU I�fWMOU�«T�F+aefWMOd R�UhI±fJFzM �·acMhNJaef9MhNJI±fJF\I�fWMhU� �$F+fJI·RzM�MONJI �µRzdhI·F�L5MONJIlP@�MONBI�f)MONJIMOUhR:/VI�XyMOF+UVaeI$d�FzLB��F�MON R�acUhX$UORzL�M �"!��� � ����� !��� � �$��¦V�3R�fJH ��!��� � �'�W� !�,� � ����¦V�±R�UhI\dOR,L�I�K#gdhI$TµR�UOR,MOI�H#,AP±NJI)TJUhI$HJaeX�RzMOIg¢h������� » ¢V���,�� �������¡�$)Iy|�TJUhI$dhdVI�d�MhNJIgL��JfBHµR�vwI�fWMYR�KlTJUhF+T�I�UÒM�ªMhNµRzM²M���F T:F+acfWMOd²acfdhTJR�X�I[R�UhIdV� �wX�acI�fWMOK�)dhI�TJR�UORzMhI�H 7

¢V������� » ¢Ò���,��  �����$¡�����%& ��� %& � �('¡B� ¢Ò����%& ��� %& � �*) ¢Ò��� �\��¥,+���B¥ ��� �+¢Ò� ���- �¥��� .�'��%& ��� %& � ���À¡B�£¢��$��%& ��� ��!� /-0+�21 ¡B� ¢Ò����%& ��� ��!� /30��4) ¢Ò��� �\��¥z�

576 ��*,����� '(� ��$!����� �������#���� ����#��98": �!#1 ��4.� ��"$!�4� � �!�� �������!� �%�:$ ��� ��� !�)/�#� 8�������<;8": ��#1 !�".� !�)$ �"� � �!�����# /4�%�!��#��+#%��!�� �%�� �/4 ��%��� ��� �!����������!� �%� $ ���%�!��9

t

Page 10: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

�·NJI$UhI %& � R�fJH %& � RzUhI²T�F+aefWMhd6aef RgM���F��®HJaevwI�fJdVaeF+fJR�K�b�I�XyMOF+UdVTµR�X�IzA[P±NBI«¡B�£¢��qL��JfBX$MOacF+f aed HJI$¹µfBI�HR�d±L�F+KcKeF��·d�7

¡B�£¢��$��%& � %� �('�� ��%&���� %��� � � 1 ��%&�� %�� � ��rNJI�f�M���F R�acUhX�UhRzL�M[R�UhI�F+fªMhNJIgP R�fBH�F+fJI�F�L±MONJI$v aed9F�f�R �µRzdhIgKcI�x�R�fJHªMhNJI�F�MhNJI�U[aedQF+f

¹µfµRzK5R�TJTJUVFWR�XYN �>KeacfJI*RzU TµRzMhN�dVI�TµR�UhRzMOacF+fÉX*R�f ��I·�JdhI$HgUOR,MONJI$U³MhNµR�fÉx+I$F+v�IyMOUVaeX±dhI$TµR�UhRzMOacF+f7A�krvwF+UhIHJIyMYR�acKeI�H)HJI$dhX$UhaeT�MOaeF�f�F�L��B¥ ��� �+¢V� ���- �¥��� $9�·aeKcK ��I[x+aDb+I$f�aef)dVI�X$MhaeF+f�@BAn@BAlP±NJI[X�F+fBdVMYRzf>Mq¢Ò��� �Q�_¥²acdfJF+vwaefJR�KeK�g@«fµRz�BMOacX*R�K7vwaeKcI�d$A

� � ��� �� ��� < �� �� ���w��� ���� � ��@� � �����P±NJI²i�I�KDL³jlF+fWMOUVF+KeKcI�H)k UVI*R���iJjlk6�·acdqHJIy¹µfJI$H R�dqRwX$aeUhX$KeI\F�L�UOR�HJac�Jd ��� � ���¡B����¢·fJF+vwaefµRzKeK#�dhIyM6R,MC�^²fµR���MOaeX�R�K7vwaeKcI�d��BR�d·X*R�f5��IdhI�I$f�acf)¹Jx+�JUhI[^�A

����� � � ��!#"��%$'&)(�!+* ,.-�-�/)�%,102(P±NJI[R�TJTJUVFWR�XYN MOFÉMONJIQUh�JfW�lR8 L�F�KeKeF��·d·RwdVMYRzfJHµR�UVHGP1RzTJTJUhF+R�XYN7A3P±NJIQPÌacd�HBI$¹µfJI$H �+)¹Jb+I\¹B|�I�d 7�·�JfW�3R8ÉP±NJUVI�dhNBF+KeH�� ! e�h�9��{�aefµR�K�k TJTBUhFWR�XYN�{�a}|)�!�.���h�%�>Ð�fWMOI$UhvwI�HJaeRzMOI·{�aD|�� �"!� /-0+�%�>Ï�IyL�M³Ð�fJacMha R�K�k UhUVacbzR�K{�a}|ª� ��!����� ½+�9�"R�fBH �·aex+NWMqÐ�fJacMha R�K�kqUhUhaDbzR�K¬{�aD|ª� ��!����� ¼7�%��I*RzXYN F�L �·NJacXYN R�UVI9T�F+aefWMOd�aef ^�` dVTµR�X$I�� �J��MIy|BR�XyM\X�F'F+UhHBaefµRzMhI�d R�UhI²fBF�MdhT�I�X$ac¹µI$H ��Iy|�X$I�TBML�F+UqMONJI !�.�����·NJaeXYN acd MONJI9F+Uhacx+aefGF�L³MONJI²X$F�F�UhHJacfµRzMOId�'dÒMOI�vÅ�.� � �W�°A�{µF+U±R�KcK�¹�|BI$d �J�BM±MONBI !�.���%�JvwaefJacvgRzK�X$F+fJdÒMOUORzaefWMOd·R�UVI6x+aDb+I�f R,|�acF+vgR,MOaeX�R�KeK���WHJIy¹µfJacfJxMONBIQUVI�KeRzMOaDb+IKeF'X*R,MOaeF�fJd3F�L�MONJI¹B|�I$d�7

��!����� ½ �3 �"!� /-0 ���!����� ¼ �43+� �"!�£��� ½ � ���!����� ¼ �3 ��!� /-0 ���!����� ½ � 1 ��!� /30 65 ��� � ���¡B����¢

{µUhF+v MhNJaed³��I6dhI$I���MhNµRzM�MONJIqP aed�R�dhdV�Jv�I$H�d�'vwv�IyMOUVaeX��WMhNµRzM3acdÊMhNJIqM���F²acfJacMha R�KµRzUhUhaDbzR�KJ¹B|�I�d\� ��!����� ½R�fJH ��!����� ¼7�±R�UhI[RzM�I�)>�µRzK�HBaedVMOR�fJX$I�dqL�UVF+v¿MhNJI[acfWMOI�UVv�I$HJa R,MOI6¹B|ª����!� /-0+�yAlP±NBI9K RzdVM�TJUhF�T:I$UVM�)I�fBdh�JUVI�dMONJRzM±b'aeUVMh�µR�K7acfJacMha R�K5¹B|�I�dqR�d·vwI�fWMOacF+fJI�H���I�KcF��ÌR�UhI6�·aDMONJacf�MONJI[iJjlk[A

P±NJI\L�F+KeKcF��·acfJx«R�HBHJacMhaeF+fµRzK:TJUVF+T�I�UVMhaeI$dqRzUhIHJI$Uhacb�I�H L�UhF+v�MONJIM�'T:IQX�F�fJdVMhUOR�acf>Mhd·F�L�MhNJI¹B|�I�d 7

! c� ��3 ��� ! e� �5 � � ! c� �78� ��� �  �,¡B�9��¢ ���!� /-0 ��3 � � �"!� /-0 �7 ��� �"!� /-0 �5 � � �  �,¡B�9��¢ ���!����� ½ �:7 � � �"!�£��� ½ �;5 � � �  �,¡B�9��¢ � �"!�£��� ½ 3 ��!� /30

P±NJacd±F+UhacI�fWMOdlMhNJIP aefgMhNJIX�F'F+UhHBaefµRzMhI d��dÒMOI$v,�µdVFÉMhNµRzM3MhNJI ! e�laedlHBaeUhI$X$MhK#$�:I$KeF��rMONJI,!�.���%�µR�fJH�MONBIaefBacMOaeR�K:R�UhUVacbzR�K:¹�|BI$d²� ��!����� ½wRzfJH ��!����� ¼:�±R�UhII°|JRzX$MOK��KeIyb+I$K¬�·aDMON�MONBI ��!� /30>A

]

Page 11: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

P±NJI\L�F+KeKcF��·acfJx²HJacdVMOR�fJX�I$d�R�UhI\HJIy¹µfJI�H L�F+U±X�F�f>b�I�fJacI�fJX$I�7�£�����>� � 'S¡B� ¢Ò��� ��!� /-0 � ��!����� ½��� ���z�.��� 'S¡B�£¢����!�.��� � �"!� /-0���.����� c�('S¡B� ¢Ò��� ! c� � !�.���h�¡ �£��� 'Z�������'� �21 � ���,�.���21Î�.����� e�

P±NJI�HJacdVMOR�fJX�I�¡ �£���[aed[MONJI�HBaedVMOR�fJX$I�v�I�R�dh�JUVI�H R�KcF+fJxGMhNJI�P L�UhF+v R�f aefBacMOaeR�K³R�UVUhacbzR�K³¹B|ªMOF MONBIUh�Bf>�lR8�MONJUVI�dVNJF+KeH"A

����� ��������� � � � $ &)(�!������

P±NJI[R�aeUVdhTµRzX�Iaed±HBI�X�F�v�T�F+dhI$HGacfWMOFÉHJaed1/VF+aefWM±UVI�x+acF+fJd �5R�d±dhI$I�f�acf�¹µx+�JUVI9^�7  �$¤��£�B¥'¼ �W��%& � ' ��%& �;5 � � %&��5 ��!� /30 ��+Å��%&��43 � � %&��5 ! e� � +Å��%&��:5 �"!�£��� ¼ � � %&� 3 �"!� /-0 �  �$¤��£�B¥'½ �W��%& � ' ��%& �;7 � � %&��5 ��!� /30 ��+Å��%&��;7 ��!����� ½ � � %& �3 ��!� /30 � e��¤�� �B¥'Ä �W��%& � ' %&��7 �"!� /-0 Á,��¢V��� ��¤J¼ �>��%& � ' ��!����� ¼ ��� %&�� � %&��;5 ��!� /30 � � %&��3 ��!� /30 Á,��¢V��� ��¤J½��>��%& � ' �"!� /-0 �;5 %&�� � %& ��� �"!�£��� ½ � � %&� 3 ��!� /30 /�¥,�3� � �W��%& � ' %&��43 !�.��� � � !�.��� 5 %&� � %&��� ��!� /30 /�¥,�3� �-�W��%& � ' %&��43 !�.��� � � ! e� 5 %&� � %& �� !�.��� �W¥��³�$» �>��%& � ' %&��43 !�.��� � � ! e� 3 %&�

P±NJI«¹µUVdVMMONBUhI�IÉUVI�x+acF+fJdHJaDb�acHJI²�JT MONBI«dhTµR�X$IÉF+�BMOdVaeHJI²MhNJIÉP �JR�dhI$H F+f �·NJacXYN aefJaDMOa RzK�R�UVUhaDb�RzK�¹B|��F+�JKeH �:Iw�JdVI�HªL�F+UQR�acUhX$UORzL�M\acf MhNµRzMQT:F�dhacMhaeF+f"AgP±N>�Jd²Rzf�R�acUhX�UhRzL�M\aef UhI$x+aeF�f � ��F+�JKcH � MhFGMONBI��!����� ¼�A �·I�x�aeF+fwE aed MhNJI·R�UhI�R6�·acMON +��X$F�F�UhHJacfµRzMOI$d�NJaex�NJI�U MhNµR�f«MONµR,M³F�L ��!� /30!�+MhNµRzM³acd MONJI�R�UVI*R\R���F�b�IMONBI�P acf ¹Jx+�JUhIg^!��UhI$x+aeF+fªE acdQR�KedVFGX�R�KeKcI�H MONJI������ �"!$#&%'��(�!*)+�"�-, ��A�´³R�XYN�FzLlMONBI�dhIwMONJUVI�IwUhI$x+aeF+fBdIy|'MhI�fJH�acfWMOF\MONJIqR�aeUVdhTµRzX�I�F+�BMOdVaeHJI·MONBI6iJjlk[A�P±NBIqKeR�dVM³¹Jb�I UhI$x+aeF�fJdÊMhF+x+IyMONJI$U�v�R���I·�JT�MONJI�PA>P±NJI�µR�dVI�KcI�x+d��.!*)/!*�0!��"12�3,4#"56,�)/�7��aef[¹µx+�JUVIC���R�UVIlMONJI±TJRzMONJd ��I$M���I�I$fwMhNJI±aefBacMOaeR�K'R�UhUVacbzR�K>¹B|�I�d�� �"!����� ¼�RzfJH��!����� ½+� RzfJH MONJI ��!� /30�A\P±NJI$f �:IyM��lI$I�f MONJI ��!� /30gR�fBH MhNJI !�.��� acd MONBI9¹µUhdÒM\TµR�UÒMF�L³MONJI[¹µfµR�K�RzTJTJUhF+R�XYN� /�¥,�-� ���9� R�fJH�L�UVF+v !�.���QMhF ! e�[aed\MONJI�dhI$X�F+fJHÎTµRzUVM)� /:¥,�-� �W�yA�{�aefµRzKeK#���MONJI�UV�JfW�3R8 aed[x+acb�I�f R�d9RdhacfJx+KcIT:F+acfWM*A

P�F�L��JUVMhNJI�U·L.R�X�acKeaDMYRzMhIF+�JUqR�Kex+F�UhacMhNJv5�B�lI[HJacb'acHJI[UVI�x+acF+f�E aefWMOFwtgdV� �'8'UVI�x+acF+fJd 7 ��I$x+aeF+fBd·M���FMONBUhF+�Jx�N ¹Jb�I�7

e��¤�� �B¥&�-�>��%& � ' %&��7 �"!� /-0 � %&��:5 � � %&� � �"!� /-0 �� � %&�� e��¤�� �B¥&9-�>��%& � ' %&��7 �"!� /-0 � %&���� � � %&� � ��!� /30 �78� %&�� e��¤�� �B¥;:3�>��%& � ' %&��7 �"!� /-0 � %&��:7 � � %&� � �"!� /-0 �7 %&�� e��¤�� �B¥;<3�>��%& � ' %&��7 �"!� /-0 � %&�� ) � � %&� � ��!� /30 =� %&��

m

Page 12: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

´³R�XYNgFzL:MhNJI�dVI�UVI�x+acF+fJd³X�F�b�I�U�R\tW]���dhKeacX�I±F�L:UhI$x+aeF�fgE AWP±NJIqHBacb'aeHJacfJx6KcaefJI$d³R�UhI·R�dVdhacx+fJI�H�R�d�L�F+KcKeF��·d�7P±NJI�HJaDb'aeHJacfJx KeacfJI ��I$M���I�I$f UVI�x+acF+fJdÉ^ R�fBHÎ@.�:I$KeF+fJx�d9MOF UVI�x+acF+f ^!� MONBI�HJacb'aeHBaefJx KcaefJI$�:IyM��lI$I�fUhI$x+aeF�fJd3@²RzfJH�t ��I�KcF+fJx+dÊMOF²UVI�x+acF+f�@²RzfJHgMONBI6HJacb'acHJaefJxQKeacfJI �:IyM��lI$I�f)UhI$x+aeF+fBdlt«R�fBH ] �:I$KeF+fBx+dÊMhFUhI$x+aeF�f�]'A

��� � � /)! � � 0 ,6&�! �� ��� � �� & ЮM\aedqX�F+fWb�I�fJacI�fWM[MhF*�:I²R��JKeI[MOF�Iy|�TJUVI�dVdQ�·NJIyMONJI$UQR�T:F+acfWMaed �·aDMONJacf R�X�I$UVMOR�aef x+UVF+�JT F�LÊUVI�x+acF+fJd�AP±NJacd«aed²I�R�dhacK#ªR�X�X$F+v�TBKeaedVNJI�H �+ HBI$¹µfJacfJx dhF�v�I)R�HBHJacMhaeF+fµRzK�TJUVI�HJacX*RzMhI�dÉR�d«X$F+f0/V�JfBX$MOacF+fJd«F�L�MONBI�µR�dVaeXUVI�x+acF+fJd�A

{�aeUVdVM²��I)NµR*b+I�TJUVI�HJacX*RzMhI�dÉ�B¥ Á,��¢V��� �$¤3$GR�fBH �B¥ /:¥,�-� $��³I*RzXYN FzLq�·NJacXYNÎX�F+v �BaefJI$d9M��lF F�L�MONBIUhI$x+aeF�fJd±HJI$¹JfJI�H�R��:F�b�I�A³�B¥ à $QMONJI$fGX$F+v �JacfJI�d3MhNJI�dVIQM���FwfJI$�1TBUhI�HBaeX*R,MOI�d$A

�B¥ Á,�,¢Ò��� ��¤��'��%& � ' Á,��¢V��� ��¤J¼ �>��%& ��+ Á,�,¢Ò��� ��¤µ½ �'��%& ��B¥ /�¥,�-� �>��%& � ' /�¥,�3� � �W��%& ��+ /:¥,�-� �-�>��%& ��+ �W¥����$» ����%& ��B¥ à �W��%& � ' �B¥ Á,��¢V��� �$¤�����%& ��+À�B¥ /�¥,�-� �>��%& �

� acb+I$f�M��lFwT:F�aefWMOd·aef�MhNJI[iJjlk �J��IQX*R�f)HJIyMOI�UVv�acfJI\acL¬MONBI )R�UVI\F+f)HJa#�:I�UVI�fWM9�.F+TJT�F+dVacMOI*� �µR�dVI�KcI�x+d 7��-���+¢°� ��� Á,��¢V��� ��¤�¢��'��%& �"� %& � � ' ��Á,��¢V��� �$¤µ¼ �>��%& � ��� Á,��¢V��� ��¤J½��'��%& � �V��+

��Á,��¢V��� �$¤µ½��>��%& � ��� Á,��¢V��� ��¤J¼ �'��%& � �V�P±NJIvwaefJacvgR�KBdhI�TJR�UORzMhaeF+fgdORzL�IyM��X�UVacMhI�UhaeR[acdlUhI$K R,|�I$H�R²KeaDMhMOKcI±�·NJI�f*��F�MON)RzaeUhX$UORzL�MlR�UVI F+f�MhNJI6P

aefwMONµR,M�MhNJI dVI�TµR�UhRzMOacF+fgv�R8 �:I R�KeF�fJxQMhNJI PA'Ð�f�dVF+v�I�X*RzdhI�d�MONJacd�acdÊMhNJI dhR�v�I R�d³MONJIqx+I�F+vwI$MhUhacX*R�KHJacdVMYRzfJX�I���NJF���I$b�I�U±aefÉMONBI aefBdVMYRzfJX�I��·NJI�UVI F+fJI R�aeUVX�UhRzL�M³aedÊF+f�R �µR�dVI�KeI$x²R�fBHgMONJI�F�MhNJI�U�aedÊF+f�¹µfJR�K �MONBIHJaedÒMYR�fJX$IQR�KeF+fBx9MONJI � acx+NWM±TµRzMhN)aed±dhNBF+UVMhI�U3MONJR�f�MONJI\x+I$F+v�IyMOUVaeX*RzK:HJacdVMOR�fJX�IzA³P±N'�Bd�aDM±aed±�BdhI$L��BKMOF ��IQR��JKeI6MhFÉHJaedÒMOaefBx+�JaedVN�MONJacd·dhacMh�µRzMhaeF+f �'L�F+U3�·NJacXYN ��I\HJI$¹µfBI9RÉTJUhI$HJaeX�RzMOI��¥ ��� ��¢V� �$�- �¥��� $�7

��¥ ��� ��¢V� �$�- �¥��� �B��%& ��� %& � � ' �.��¥ Á,�,¢Ò��� ��¤��'��%& � � � �B¥ /:¥,�-� �>��%& � �h��+�.��¥ Á,�,¢Ò��� ��¤��'��%& � � � �B¥ /:¥,�-� �>��%& � �h�

P±NJI)MOaevwaefBx X�F+vwTµR�UVaedVF+fJd²L�F+UÉR�acUhX$UORzL�MÉRzUhI�HJI$T:I$fJHJI�fWMgF+f �·NJI$MhNJI�UÉMONJI R�acUhX$UORzL�MÉRzUhI)aef MONBIdORzv�IUVI�x+acF+f �JacfGRzH0/hR�X�I$fWMqUVI�x+acF+fJd±F+U·acf�fJF+f!��R�H0/hR�X$I�fWM�UhI�x�aeF+fJd$A

¢h�W�q�  �$¤��£�B¥��>��%& ��� %& � � '� e��¤�� �B¥'¼ �>��%& � ���  �$¤��£��¥'¼ �>��%& � �V� + �  �$¤��£��¥'½��>��%& � ���  �$¤��£�B¥'½ �>��%& � �V��+� e��¤�� �B¥&�-�>��%& � ���  �$¤��£�B¥&���'��%& � �h� + �  �$¤��£��¥&9-�W��%& � � �  ��¤'�£�B¥&9-�>��%& � �h��+� e��¤�� �B¥;:3�>��%& � ���  �$¤��£�B¥;:-�'��%& � �h� + �  �$¤��£��¥;<3�W��%& � � �  ��¤'�£�B¥;<3�>��%& � �h�

�,¡��������,¥��  ��¤'�£�B¥��'��%& �"� %& � � '� e��¤�� �B¥'¼ �>��%& � ���  �$¤��£��¥&�-�>��%& � �V� + � e��¤�� �B¥'¼ �W��%& � ���  �$¤��£��¥&�-�>��%& � �V��+� e��¤�� �B¥'½��>��%& � ���  �$¤��£��¥;<3�>��%& � �V� + � e��¤�� �B¥'½��>��%& � ���  �$¤��£��¥;<3�W��%& � �V��+� e��¤�� �B¥&�-�>��%& � ���  �$¤��£�B¥&9��'��%& � �h� + �  �$¤��£��¥&�-�W��%& � � �  ��¤'�£�B¥&9-�>��%& � �h��+� e��¤�� �B¥&9-�>��%& � ���  �$¤��£�B¥;:-�'��%& � �h� + �  �$¤��£��¥&9-�W��%& � � �  ��¤'�£�B¥;:3�>��%& � �h��+� e��¤�� �B¥;:3�>��%& � ���  �$¤��£�B¥;<-�'��%& � �h� + �  �$¤��£��¥;:3�W��%& � � �  ��¤'�£�B¥;<3�>��%& � �h�

s

Page 13: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

ЮM6acdq��F+UVMhN fJF�MhaefJxwMONµRzM6R�KcMhNJF+�Jx�N UhI$x+aeF+fBd6ÏÎR�fJH �ZR�UVI«R�H0/hR�X$I�fWMacf Rgx+I$F+vwI$MOUVaeX�R�K¬dhI�fBdhI��7MhNJI R�UVIqfJFzMlHJIy¹µfJI$H)R�dlRzH0/hR�X�I$fWM3aefwMONJacdÊL�F�Uhv�R�Kea��*RzMhaeF+f �,dhacfJX�I R�aeUVX�UhRzL�MÊaefwUhI�x�aeF+fJd��rR�fJHgÏ � «MOF��3RzUhHM���F�HJa��"I$UhI$f>M�Ð�k {�d[� ��!����� ¼ R�fJH ��!����� ½z�yA

����� �8! & !#/�� ���� ��� &�(�!�� �%/)/)! 0 & � /)/ ���1,."�� ��

�3R�dVI�H�F�f MONBIgT�F+dhaDMOaeF�f FzL·R�f�RzaeUhX$UORzL�MQF+��MOdhacHJIÉMONJI�iJjlk �¬MONJIgR�TJTJUVF+TJUVa RzMhIwacfJacMha R�K R�UhUVacbzR�K ¹B| acd�JfJa#)>�JI�K� HJIyMOI�UVv�acfJI�H"A«Ð®L3R�f R�acUhX$UORzL�Macdaef UhI$x+aeF�f � �.UVI�x+acF+f Ï��9�"MONBIwacfJacMha R�K�R�UVUhaDb�RzK�¹B| acd ��!����� ¼� �"!�£��� ½��%�µNJF���I$b+I$U6acL�MONBI9R�acUhX$UORzL�M·acd�acfGUVI�x+acF+fGE �5acM·NJI�R�HJd�HJaeUVI�XyMOK#gMOFÉMONJI �"!� /-0�A��I$b�I�UVMhNJI�KcI�dVd6acM·acd�JdVI$L��JK�MOFÉHJIy¹µfJI\b'aeUVMh�µR�K7acfJacMha R�K5¹B|�I�d·L�F+U·R�acUhX$UORzL�M±I$fWMOI�UVaefJx«MhNJUhF+�Bx+NGUVI�x+acF+fGE 7

��!� � �£�����%&� � ' %&� 1 �ÒC � ��!����� ½ �¡B� ¢Ò���%&� � ��!� /30��

������!� /-0 � %&� ��·NJI$UhI %&� aed�R�f)aefBacMOaeR�K�T:F+acfWM·aef�UhI$x+aeF�f�E A

P±N>�Jd���x+aDb+I$f RgT�F+dhaDMOaeF�f�aefGMONJI²iJjlkº�.F�U aefBHJI�I$H aefGMhNJI«R�acUhdVTµR�X�I[F+�BMhdhaeHBI��qF+fBI9X*Rzf X�F+vwTJ�BMhIMONBI\¹�|�MONµR,M�MhNJIQR�aeUVX�UhRzL�M±TJUVF�X$I�I�HBd�MhF��lR�UVH�R�d3L�F�KeKeF��·d 7

��!��Â+�£�z �£�����%&� 7������.¦ &�� ���:¦V� '����  �$¤��£��¥'¼ �>�%&� �3Ã������ �"!�£��� ¼�7½ � ���  �$¤��£��¥'½��>�%&� �3Ã������ �"!�£��� ½�7½ � � �"!� � �������%&� ����� !���

k KDMONJF��Jx+N �lIw�JdVIwMhNJI«b�acUVMh�µR�K acfJacMha R�K�R�UhUVacbzR�K�¹B|�I�d[L�F�U\R�aeUVX�UOR,L�MI�fWMOI$UhacfJx MhNJUhF��Jx+N UhI�x�aeF+f E �7��IR�KcdhF�FzL�MOI�f,/V�BdVMÉR�dVdh�JvwIgMhNµRzM9MhNJI x+F dÒMOUhR�aex+NWM[MOF�MhNJI �"!� /-0'A���F��lIyb+I�U ��dVaefJX$IgMONBIgb'aeUVMh�µR�KÊaefJaDMOaeR�KR�UVUhacbzR�KJ¹�|BI$d·R�UhI�F+fgMhNJI dÒMOUhR�aex+NWM�KeacfJIC��I$M���I�I$f�MONJIqI�fWMOU�gT�F+aefWMÊL�F+U³MONJI R�aeUVX�UOR,L�MlRzfJHgMONBI �"!� /-0!�>MONJacdHJF'I�d·fJF�M·XYNJR�fJx+IQF+�JU·R�dVdh�JvwTBMhaeF+fJd·F+f�MhNJI � aex+NWM·TµR,MON7A

" � ��� �� ���8� �� � �1� ���$# �1�&%��@�·��� � =

{µ�JfJHµRzv�I$f>MOR�K�MhF)MhNJIÉdhT�I�X$ac¹µX�RzMOacF+f F�L�MhNJI�i�k�P�i d�'dVMOI$v aed6MhNJIÉHJI�KcaefJI�RzMOacF+f F�LÊMONJI«MOUhR:/VI�XyMOF+UVaeI$dF�L�R�acUhX�UhRzL�Mqaef MONBIÉi�k�P�i R�aeUVdhTµRzX�I�A\P±NJI$dhI«MOUhR:/VI�XyMOF+UVaeI$dR�UhI9v�F'HJI�KcI�H �BdhaefBx)RgL��JfJX$MhaeF+f ��!�,� � ���[F�LMOacv�I�7

~

Page 14: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

��!�,� � �'�W� !�,�*����¦V�('½ �Bà ¦ � ��� 3 �O���q� ��� �����*�.�,�*� �

�"!�� /30 3 ��!��Â+�£�, �£����� !�,�*� �¦����� 3 �,¥��" e» �O���q�>������� ���

� ��¦ 5 ¦ � ��� Ã������ !�,�91É��¦ � ¦�������� �"!� ��� �  �B� ¢��+¡:� !��� � ��!�q /-0 � ��� �u¤+¢O��"½ � � ��¦ ) �O���q� ��� c��������� à ��� � � e� � � e� ��"½ � �

� �À¦4)¾�O�_� � ��� � �*�������rÃ����������!� /30 � � �"!� /-0 � ¡B�£¢�� ¤+�B¥��+�������$��¦V� � �������'� �O�

�"½ � � �  �$¤��£��¥'¼ �>� !������+ e��¤�� �B¥'½��>� !�,�*� à ������ � ��!�� /30 3 ��!����� ¼ à ��� � �"!� ��� �B¥ � ��¤µ¼��.¡B�£¢�� ¤+�B¥��+����������¦V�h�

�"½ � � �"!� ��� �B¥ � �$¤µ½B��¡B�£¢�� ¤+�B¥��W�.�,�*����¦V�h�� �� !� �

�"½ � ���!�� /-0 1 ¡B�£¢�� ¤+�B¥��W�.�,�*����¦V�

�������'� � ����!� /30 � ��!�q /-0+�� �� !� �

� �� !� �

�·NJI$UhI !���3aed¬MONBI3aefJaDMOaeR�K+KeF'X*R,MOaeF�f[F�LµMhNJI±R�acUhX$UORzL�M¬�·NJI$fwaDM�I$fWMOI�UVd MONJI3i�k�P�i²R�acUhdhTJR�X�IzA�P±NJacd�L��JfJXyMOacF+fHJI$X�F+vwT:F�dhI�d6MhNJI²X�R�KeX$�JK RzMhaeF+f F�L³MONBI²T:F�dhacMhaeF+fGF�L�MONBIÉR�aeUVX�UOR,L�MF�µRzdhI�H �JT�F+f MhaevwI�A6P±NJI ��I �MOaevwI�dR�UVI

�O�_� � ��� �������������97 MhaevwI\R�aeUVX�UhRzL�M·R�UVUhacb�I�d�RzM±MhNJI\aefJaDMOa RzK"R�TBTJUhFWRzXYN ¹B|3 �z¥��" e» �O���q�W�.�,�*� 1 ¡B�£¢��$� !��� � ��!�qÂ+� �z ������� !�����V������� �u¤+¢

�O�_� � ��� � ���������97 MhaevwI\R�aeUVX�UhRzL�M·R�UVUhacb�I�d�RzM±MhNJI\aefJaDMOa RzK�¹B|�O�_� � ��� e�$�������97 MhaevwI\R�aeUVX�UhRzL�M·R�UVUhacb�I�d�RzM±MhNJI\Uh�JfW�lR �MhNJUhI$dhNJF�KeH

P±NJI MhaevwIqMhNµRzM±Rzf�R�aeUVX�UhRzL�M3I$f>MhI�UVd3MONJI\i'k�P�i�R�aeUVdhTµR�X$I acdlUhI$TJUhI$dhI$f>MhI�H5�+�R�f��BfJaefWMOI$UhTJUVI$MhI�H�L��JfJX9�MOacF+f �J�,¥��" e» �O���q�>�.�,�*�yA

� ��� � !#$ �%/)!�������� ��� ��������� ��!o�UhacF+U�MhF6�O���q� ��� �£�����.�,�*�%��MhNJI·R�aeUVX�UhRzL�M�MhUOR*b+I$Ked�RzM�R6X�F+fJdÒMYR�fWM�b�I�KeF'X�aDM�+A�ЮM �3Rzd�X�F+fWb+I$fJaeI$fWMÊMhFHJI$¹JfJIMONBI«R�aeUVX�UhRzL�MqMhUOR:/VI$X$MhF+U���JdhacfJx�R�KeacfJIQaef ^�` dVTµR�X$I�A\P±NJI9MhUOR�HJaDMOacF+fµR�K��lR GMOF�HBI$¹µfJIÉR�KeaefBI9aef ^�`dhTJR�X�I6acd(�+�dVT:I$X�aDL1�acfJx[M���F«HJacdVMOacfJX$MlT:F�aefWMOd � %& " RzfJH %& � ��F+f�acM�A��l�BM±R9KeacfJIqX�R�f�R�KcdhF ��I HBI$¹µfJI$H�� R«T:F�aefWM·R�fJH R²HJacUhI$X$MOacF+f�b+I$X$MhF+U�AÊ{µ�JUVMhNJI�UVv�F�UhI����lI\X*RzfGRzKedhFÉRzHJH)H 'fµR�vwaeX�d3MhF«F+�JU±KcaefJIq�JdhacfJxwR�f

Page 15: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

aefBacMOaeR�K�T:F+acfWM %& " R�fJHGR«b�I�KcF�X$acM��b�I�X$MhF+U %� R�d3L�F+KcKeF��·d�7%&�" 1 ¦�%�

�·NJacXYNªHJI$dhaex�fµRzMOI$dMONJIwKeF'X*RzMhaeF+f�F�L±R�vwF�b'acfJx)TµR�UVMhaeX$KeIÉRzM\MOacv�I[M*AwP±N'�Bd[aDL !���ÉaedMONJIÉT�F+dhaDMOacF+f F�LMONBIÉR�aeUVX�UOR,L�M �·NJI$f aDMI�fWMhI�UhdMhNJIwi�k�P�i R�aeUVdhTµRzX�I��"acMT�F+dhaDMOacF+f��JT MhF�MONJI«Ð�k {rX�R�f���I«X*R�KcX��JKeRzMOI$HR�d±L�F+KcKeF��·d�7

!�,�91É��¦ � ¦�������� �"!� ��� �  �B� ¢��+¡:� !��� � ��!�q /-0 � ��� �u¤+¢O��·NJI$UhI\¦�� ��³acd±MONJI\I�fWMhU��MOacv�I\RzfJH ��!� ��� � e�B� ¢��+¡�� !�,� � ��!�� /30 � �,���n¤+¢h�3aed±MONBIQX$F+fJdÒMYR�fWM�b+I�KcF�X$acM��FzL�MONBIb+I$NJaeX$KeIzA qF�MhI�MhNµRzMÊMONJacd�b+I�KcF�X$acM�«b�I�X$MhF+UÊaedÊX�F+vwTJ�BMhI�H�L�UVF+v MhNJIqacfJacMha R�K�T:F�aefWM8�WMONBI�¹µfJR�K5T:F+acfWMlRzfJHMONBIQdVT:I$I�H�R�d±L�F+KeKcF��·d 7

� ��� � e�B� ¢��+¡���%& ��� %& � ��� � ' � � %& � 3 %& � à ����� �y�� e��7½ � � �

¡B�£¢��$��%& ��� %& � ���%& � � %& � �

���� !���

� ��� � ! &�� ! ! � ������� ��� ��������� ��! , ��� ������� ��� � ��� � ��!p6fJX�I²MhNJI«R�acUhX$UORzL�M UhI*RzXYNJI�dQR�f Ð�k {¾F+URgb'aeUÒMO�µR�K�Ð�k6{¾aDM ��I�x+acfJd MhF�HJI�X$UhI*RzdhIÉacMhd6dhT�I�I$H acf R�X$X�F+U��HµR�fBX�I6�·acMhN)R²dhT�I�I$HGTJUVF�¹µKcI MONµR,M±aed±R9L��BfJX$MhaeF+f�F�L�UVI�v�R�aefJacfJx9HBaedVMOR�fJX$I6MOF²MONBI6Uh�JfW�lR8�MONJUVI�dhNBF+KeH7AP±NJI$UhI$L�F�UhIqR\L��JfBX$MOacF+fÀ¡B� ¢Ò� ¤+�B¥��+�������$��¦V� aed³fJI$I�HJI$HgMOFQX�F+vwTJ�BMhI±MONJI�UhI$K RzMhacb+I±HBaedVMOR�fJX$I�A³`6I$MOR�aeKcd�R�UVITJUVF�b'acHJI�HÉaef«dVI�XyMOaeF�fwtBAntJA�P±NJI±T�F+dhaDMOaeF�f²F+f«MONJI±P<RzM MhaevwI�M³HJI$T:I$fJHJd³�JT�F+f«�·NJaeXYNÉF�L5MhNJI3M��lFQÐ�k6{�dF+Ub'aeUÒMO�µR�K�Ð�k6{�dMONBIgR�acUhX$UORzL�MTJR�dhdVI�HªMhNJUhF+�Bx+N7AÉP±NJI ��!�,� � �'�ÉL��BfJX$MhaeF+f ¹µUVdVMQMOI�dÒMOd\MOF)dhI$I��·NJIyMONJI$UMONBI\R�aeUVX�UOR,L�Mlacd3X��JUVUhI$f>MhK#�RzM·R�f�Ð�k {r�.a�AuI�A�I$fWMOI�UVI�H�L�UhF�v�UVI�x+acF+f � F�U3UhI$x+aeF+f)Ï���F�U3R9b'aeUÒMO�µR�K:Ð�k6{lAЮL aDM±aed·R,M�R�fGÐ�k {�MONJI$fGMONBIQT�F+dVacMOacF+f�acd±X*R�KcX��JKeRzMOI$HGRzd·L�F�KeKeF��·d 7

��� �"!�� /-0 3 ��!�£��� ¼ à ��� � ��!� �'� �B¥ � ��¤µ¼��.¡B� ¢Ò� ¤+�B¥��+�������$��¦V�h��7½ � � �"!� ��� �B¥ � ��¤µ½B�.¡B�£¢�� ¤+�B¥��+����������¦V�h����� !� �

�·NJI$UhI\MONJI\dh� �BL��JfJXyMOaeF�fJd�R�UhI\HJIy¹µfJI�H�R�d±L�F+KeKcF��·d�7

�"!� ��� �B¥ � �$¤µ¼ ���.� ' ���� 5 �£�����>� �3à ��� � � ��!����� ¼ � 1� � �"!�£��� ¼ ��7½ � �ª���"!� /-0 � � ��!� /30 �� ��� � �������'� �O�V����� !� �

�"!� ��� �B¥ � �$¤µ½J���.� ' ���� 5 �£�����>� �3à ��� � � ��!����� ½ �:� � � ��!����� ¼ ��7½ � �ª���"!� /-0 � � ��!� /30 �� ��� � �������'� �O�V����� !� �

C��

Page 16: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

ЮL"MhNJI�R�aeUVX�UhRzL�M�I�fWMhI�UhI$H�MhNJIqiJjlk MONJUVF+�Jx+NwUhI$x+aeF+f�EºR�fJHwNµR�dÊR�KcUhI*RzH ²TµRzdhdhI$H�MhNJUhF+�Bx+N«MONJI±b'aeUÒMO�µR�KÐ�k6{ �JMONJI\T�F+dhaDMOaeF�f�aed±X�R�KeX$�JK RzMhI�H R�d±L�F+KcKeF��·d�7

�"!�� /-0 1 ¡B�£¢�� ¤+�B¥��+�������$��¦V��������'� � ���"!� /-0 � �"!�� /-0��

� � � � $ & ! / � � � � � � � ����� ��!ЮL�MONJI3MhaevwI3aed³RzL�MhI�U��O�_� � ��� e����������MhNJI�f«MhNJI±L��JfJX$MhaeF+f«UVI$Mh�JUhfJd�MhNJI·KeF'X*RzMhaeF+f[F�L:MhNJI·Uh�JfW�lR8²MONJUVI�dVN!�F+KcHª� e� � � c� �°AÊp6MhNJI�UÒ�·aedVI��JMONBI[RzaeUhX$UORzL�M·acd±F+f�MONJI¹µfJR�K¬R�TJTJUVFWR�XYN7A³P±NJI\X�R�KeX$�JK RzMhI�H)KeF'X*R,MOaeF�f�aed 7

� �"!� /-0 � � ��!� /-0 �� ¡B�£¢�� ¤+�B¥��W�.�,�*����¦V� � �������'� �h�� ��� � ,." 0 � " ,6&/� � � �%$�� ��� � � ��� � ��� � ! � !P±NJI·dhT�I�I$H�FzL:MhNJI·R�aeUVX�UhRzL�M�RzL�MhI�U�aDM�UhI�R�XYNJI�d�R�fÉÐ�k6{ F�U³Rb'acUVMO�JR�KBÐ�k { acd HJIy¹µfJI�H$�+ÉR6dhT�I�I$H�TJUVF�¹µKcIHJIyMOI�UVv�acfJI�H � �acMhd3R�acUhX$UORzL�M³M�'T:IzA³P±NJaed�dhT�I�I�H)TJUVF�¹µKcIqacd3R[L��JfBX$MOacF+f�F�L7UhI�v�R�acfJaefJxQHJacdVMYRzfJX�I MhF9MONBIUh�Bf>�lR8�MONJUVI�dVNJF+KeH"A�{µF+U±I°|BR�v�TBKeI���MONJI\dhT�I�I$H�TJUVF�¹µKcI6L�F+U3MONJI[jlI$dhdhfJRGC�s+^²acd�7

¢��+���$¡ �� e� / � � �"��� �J�� ��Y�(' � �� �� � C à ��� � �+� 1 ^�]J�� �� � C���7½ � � �� �� � ]�Ã������ ����7½ � � �� �� � s�Ã������ C�^�� 1 �ÒC�^�� � �+�W�

^ �� �� � s+��7½ � � C�^������ !���

i�acfJX�I±MONBaed�L��JfJXyMOaeF�fwacd�X�F+fWMhaef>�JF+�Jd �'��I�X*R�fwHJI$¹JfJI RMOacv�I9�®MhF���T�F+aefWM�L��JfJXyMOaeF�fgR�d�MhNJI·aefWMOI$x+UOR�K ���·acMhNUhI$dhT�I�XyMqMhFwHBaedVMOR�fJX$I��µF�L�F+fJI\F�b+I$U�MhNJI\dhT�I�I�H TJUVF�¹µKeI��µTJKe�Bd·R�f�R��JdhF+Kc�BMOI6MhaevwI6X�F�fJdVMOR�fWM�����7

�Y�=� �����.�,�*��� �.� 3����" C¢��+���$¡ �� e� / � �>����� � ¡ ����� � �.� � 1����

�·NJI$UhI����µaed�MONJIÊMOaevwIÊRzM��·NBaeXYN9MhNJI3R�acUhX$UORzL�M�X�UVF+dhdVI�d MhNJIlÐ�k {(���µacd�HJIy¹µfJI$HÉR�d�MhNJIlHJacdVMOR�fJX�IÊMOUhR�b�I�KcI�HRzL�MhI�U«X�UVF+dhdVaefJx MONBI Ð�k {(� ¡ �£���«acd²MONJI)TµR,MONÎHJaedÒMYR�fBX�I�L�UhF+vÅMONJI)Ð�k {1MhF MhNJI�Uh�Bf>�lR8ÎMONJUVI�dhNBF+KeH �R�fJH MhNJIÉR�Uhx��Jv�I$fWM\�,�«acf MONJI«dVT:I$I�H TJUhFz¹µKeI9L��BfJX$MhaeF+f dh�BTJTJKeacI�d MhNJI²M�'T:IÉF�L�R�acUhX$UORzL�M�A[P±NJI$UhIyL�F+UhI���Y� � ���$�������$���W� 3 �O�_� � ��� �£���*�����z¥ � �YA qF�MhI�MhNµRzM³¡ ����� � �7acd³MhNJI·UhI$vgR�acfJaefBxHJaedÒMYR�fJX$I�MhFMONJI�Uh�JfW�lR8MONBUhI�dVNJF+KcH7A

i�aefBX�I[MhNJI9dVT:I$I�H TJUVF�¹µKcI[acdqX$F+fWMOaef>�JF��JdR�fJHGT:F�dhacMhacb�I��5MONJIQL��JfJX$MhaeF+f �Y�=�����·aed�X�F+fWMOacf>�JF+�JdRzfJHaefBX�UhI�R�dhacfJx �JdVFw��I\X*R�f HJIy¹µfJI[R�f)aefWb+I$UhdhI\L��JfJXyMOacF+f R�d±L�F+KeKcF��·d 7

¦ 3 �Y� � ���$�������$� �.� � ¡B� ¢Ò� ¤+�B¥��+�������$��¦V� 3 �

ЮM�aedÊaevwT:F+UÒMYR�fWM�MhF ��I$I�T�acf�vwaefBHwMhNµRzM�¡B�£¢�� ¤��B¥��qUVI$Mh�JUhfJdÊMONJI�UhI$K RzMhacb�IqHJacdVMOR�fJX�I·MOUhR*b+I�KcI�HgL�UVF+v MONBIÐ�k6{ �J��M�MOR���I$d RzdqRzfGRzUhx+�JvwI�fWMqR��JdVF+Ke��MOI6MOacv�IzA

C+C

Page 17: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

ȳ%�&ª&ª= � �h�¬%'�,���J=B������% ��%'2.=����.���

¡W�� �� � ���O� � � e���£���O�£��¥ 7 ½ �"Ä�Ä � ��� �B7 [�Y� � ���$����� � �$� �.� � ) [�Y� � ���$����� � �$� �.� � ��+

��� �B7 \�Y�=�����*�.�,� � �����.� � ) \�Y�=�����*�.�,� � �����.� � � �ÒC��

� �����°AgP±NJacdQacd\I�dVMOR��JKcaedhNBI�H L�F�U[RzKeK X$F+v �JacfµRzMOacF+fJdF�L3R�aeUVX�UhRzL�M\dhT�I�I$H�TJUhFz¹µKeI$d �+ R X*R�dVI�dVTJKeaDM\F+fI*RzXYN<F�L�MONBI dVT:I$I�H<TJUhF�¹JKeI�L��JfJXyMOacF+fJd�AÎP±NJacd«aedÉR���I% TJUhF+T�I�UÒM��MONJRzM«�lI UhI$K#ªF+f MONJI)I�dÒMYR��BKeaedVNdhI$TµR�UhRzMOacF+f)F+f MhNJI\PA

� � � � ���*����³� ? ����� � ��� �� Ð�f²MONBaed dVI�X$MhaeF+f ��MONJIlUhI�)>�JacUhI$v�I$f>Mhd L�F+U�MhNJI3kqaeUhX$UORzL�M�E�R�fµRzx+I�vwI�fWMÊEGF'HJ�JKcI\�.k6E E ��RzUhI3HJI$dhX$Uha2��I�H"AP±NJI$dhI�UVI�)>�JaeUVI�vwI�fWMOd5�µR�dVaeX�R�KeK�¾HJIy¹µfJI�RzfÌR��JdÒMOUhR�X$M MOacv�I dVI�TµR�UhRzMOacF+fSTBUhF�MhF�X$F+K ���·NJaeXYN HJF fJFzMdhT�I�X$acL1 R�f+ F�L³MONBI²HJI$MOR�aeKcd6F�LÊR�f acv�TJKcI�vwI�fWMYR,MOaeF�f7A P±NJI% R�UVI²aefWMOUVaefJdVaeXQMOF�MONBI«X�F+fJX$I�TBM\aDMOdVI�KcL³F�UR�UVI·R\TBUhF'HJ�JX$MÊF�L5MhNJI±L�F+Uhv�R�KBTBUhF'F�L�TJUhF'X�I$dhd �.a�AuI�A,MONJI%²��I�UhIqR�HJHBI�Hwaef«F+UVHJI�U�MOFX$F+vwTJKeIyMOI·RTJUhF'F�LO�yAo�UhF+T�I�UÒMOacI�d�MhNµRzM ��I�UVI±fJI�I$HJI�Hwaef²F�UhHJI$U MOF6I$dVMYR��JKeacdhN²MONBI3dhI$TµR�UOR,MOaeF�f«KeI�vwv�R�d���I�UVI·X�F+KcKeI�XyMOI$H²�JfJHJI$UR«TJUhI$HJaeX�RzMOI\fµRzv�I$H � Ä�Ä �� e��+�� e�O�£�$¢�$9HBI$¹µfJI$H R�d±L�F+KcKeF��·d�7

� Ä�Ä ��  ����� c�O�£��¢ �B�.�,� ��� ��� � � ' � Ä�Ä ��� �-�>����� ��� ��� � � ��O�_� � ¢Ò��� ��  ��,��,¥��" e» �O���q�>����� � � 7 �,¥��" e» �O���q�>�.�,� � ����£��� ½ ¤�� ¢Ò��� �\��¥,��_¥+� � ¢V��� �� e�������� ��� �,� � �

� IÉ�·acKeK�HJaedVX��JdVdQI�R�XYN F�L�MhNJI�dVI�X$F+f0/V�JfBX$MOd\acf MhNJI«F+UVHJI�UMONJRzMMONJI% R�TJT�I*RzU�AÉ{�acUhdVM MONJIÉTJUVI�HJacX*RzMhI� Ä�Ä ��� ��$�aed�MONBIlR��BdVMOUhR�X$M�UhI$TJUhI$dhI$f>MORzMOacF+f9FzLBMONBI�k6E E MhaevwaefJx±TJUVF�MOF'X�F�K>R�fJH9HBI$¹µfJI$H²R�d¬L�F+KcKeF��·d�7

� Ä�Ä ��� �-�>�.�,� ��� ��� � � ' �O���q� ¢Ò���,��  ���O� �B¥ ��� c���>����� ��� ��� � � ��O�_� � ¢V���,�� ����O�£�B¥ ��� �.���"�>����� �"� �,� � ����O�_� � ¢V���,�� ����O�£�B¥ ��� � ���>����� ��� �,� � ����V�h��¢h�W� �  �$¤��£�B¥��>� !�,� ��� !�,� � �+���¡��Ò�����,¥��  �$¤��£�B¥��>� !�,� ��� !��� � �V�h��DÄ���½�� � �

�O���q� ¢Ò���,��  ���O� �B¥ ��� �£�����>����� ��� �,� � ����O���q� ¢Ò���,��  ���O� �B¥ ��� �,¥��" e» �'����� ��� ��� � �V�

P±NJI ¹JUhdVMlMONJUVI�I6X$F+fJdVMhUh�JXyMOd±dVT:I$X�acL1wMONJRzMlMhNJI�UVIaed�MhaevwIqdVI�TµRzUORzMhaeF+fgRzM3MONBI Uh�Bf>�lR8�MONBUhI�dVNJF+KcH �.UÒM°�%�MONBI[¹µfµRzK�R�TBTJUhFWRzXYN�¹B| ��L.RzLO� �:R�fJHGMONJI[aefJaDMOa RzK"¹B| �.acLO�yA·P±NJI[fJIy|'Macv�TBKeaeX�RzMOacF+f�dVMORzMOI$dqMhNµRzM6aDL MONBIM���F�R�acUhX�UhRzL�MwR�UVI acf MONJI dOR�vwI)UhI$x+aeF+fÎF+UÉacf R�H:/hR�X�I$f>MwUVI�x+acF+fJd��ÊMONJI$f<MhNJI�UVI�R�UVI�M��lFªR�HJHJaDMOaeF�fµR�K

C�^

Page 18: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

MOacv�acfJx)X�F+fBdVMOUhR�aefWMhd���fµR�vwI�K����MONµRzM[MONJI$UhI�aed[MhaevwI�dVI�TµRzUORzMhaeF+fªRzM9MhNJIgÐ�k {�d«R�fJH�RzM9MhNJIgT�F+aefWM[F�LI�fWMhU�+AÊP±NJI�O���q� ¢Ò���,��  ���O� �B¥²TBUhI�HBaeX*R,MOI�d�R�UVI\HJI$¹µfBI�H Rzd·L�F�KeKeF��·d 7

�O���q� ¢Ò���,��  ���O� �B¥ ��� �,¥��" e» �'����� ��� ��� � �('Ì�,¥��" e» �O���q�>����� � � � �z¥��" e» �O���q�>�.�,� � �4)¾�O���q� ¢V���

�O���q� ¢Ò���,��  ���O� �B¥ ��� �£�����>����� ��� �,� � � ' �Y�=� ���$�.�,� � ���.�W� � �Y� � ��������� � �$���W� )¾�O�_� � ¢Ò���

�O���q� ¢Ò���,��  ���O� �B¥ ��� � �"�>�.�,� ��� ��� � �(' �Y� � ��������� � �$���������'� �O� � �Y�=� �����.�,� � ���®�������'� �h�4)¾�O���q� ¢Ò���

�O���q� ¢Ò���,��  ���O� �B¥ ��� �.�����W����� ��� ��� � � ' �Y� � ���$����� � �$���£�����'� �21¾� ���z�.���O� ��Y�=�����$����� � ���®�������'� � 1 � ���z�.���Y� )¾�O�_� � ¢Ò���

�O���q� ¢Ò���,��  ���O� �B¥ ��� c�����.�,� ��� ��� � � ' �Y� � ��������� � �$�.¡ �£���h� � �Y� � ���$����� � �$�.¡ �����h�4)¾�O���q� ¢V���

P±NJI kE�E acv�TBKeI�vwI�fWMORzMOacF+f<�·acKeK�NµR*b+I MOF T�I�UÒL�F+Uhv vgR�f+<X*R�KcX��JKeRzMOacF+fJd�aefWb+F+KDb'aefJx RzaeUhT�F+UÒM�x+I9�F+vwI$MhU���·RzaeUhX$UORzL�MwMOUhR:/VI�XyMOF+UVaeI$d�R�fJH dhT�I�I�HrTJUVF�¹µKcI�d��·RzfJH¾F�MhNJI�U�I°|'MOI�UVfµR�K�L.R�X$MhF+Uhd�dh�JXYN R�dw�·aefJH �X�F�v�v²�BfJaeX�RzMOacF+fJdlHBI�K R8��µR�fJH)TJacKeF�MlI�UhUVF+U±aef�F�UhHJI$U3MOFÉX*R�KcX��JKeRzMOI�MOacv�I6HBI�K R8'd±MONµR,M3�·aeKcK"vwI�I$M±MhNJI�dVIUhI )>�JaeUVI�vwI�fWMOd$A ЮMgaedwaevwT:F�UVMYRzf>M«MhNµRzMwMONJIGUhIy¹µfJI�vwI�fWMgF�L6MONBI�dhI�kE E UVI�)>�JacUhI�vwI�fWMhdgaefWMhF I°|BI9�X���MYR��JKcI·X�F'HJI �:I·X*RzUhUhacI�HwF+�BMÊaefwRUhacx+F+�JUVF+�Jd�v�R�fJfJI$UÊR�fJHÉL�F+Uhv�R�KeK�\b+I�UVac¹µI$H�R�d���I�KcK5R�dÊMhNJI·F�b+I�UhR�KeKd�'dÒMOI�v X$F+fJX�I$TBM*A�ЮM�aed³RzKedhFQaevwT�F+UVMOR�fWM MONµR,MÊMhNJI�kE EºX�F'HJI �:I�aevwTJKeI$v�I$fWMOI�H«F�fgRL.R��JKDM��®MhF+KeI$UOR�fWMX�F�v�TJ��MOaefBx�TJKeRzMhL�F+UVv,� ��I�X*Rz�JdhIgMhNJI�UVI�KeaeR��JacKeacM�GUhI )>�JaeUVI�vwI�fWMOd9�·acKeKD��I�b+I$U�ªNJaex+N"AGP±NJacd[�lR�d²fJFzMRzMVMOI�vwTBMhI�H acfGMONBaed I%�"F�UVM8�3�J�BMq�·aeKeK¬fJI$X�I$dhdORzUhaeK� ��I²R�TµR�UVM F�L³F+�JU�L��BMO�BUhI9I%�"F�UVMOd F+f�MONBI9I$b�F+Kcb'acfJxi�k�P�i�X�F+fBX�I�T�M F�L�F+T�I�UhRzMOacF+f7A

P±NJI²dVI�X�F�fJH X�F�f0/V�JfJXyMaef)MONJI[TJUhI$HJaeX�RzMOI � Ä�Ä ��  ����� c�O�£��¢ $«aed·�O���q� ¢V��� �� e��«�·NJaeXYN�aed�HJI$¹µfBI�HR�d±L�F+KcKeF��·d�7

�O���q� ¢Ò��� �� e�� ' �O�_� � ¢V��� q�Q�_¥ ¢�������¡ ) ¢V��� �\��¥P±NJacd�X�F�fJdVMhUOR�acf>M�I�dVdhI$f>Mha R�KcK#\HJIy¹µfJI$d��O���q� ¢Ò���·aef\MOI$Uhvwd�F�LBMONJI³MONJI�v�acfJaev9�JvSx+I$F+vwI$MOUVaeX³dhI$TµR�UhRzMOacF+f�.¢Ò��� �\��¥z��R�fJH MONBI²dhT�I�I$H FzL�MONJI²dVKeF���I�dVM\T�F+dVdha2�BKeI[R�aeUVX�UOR,L�MÉ���\��¥ ¢��+�$��¡'�°AP±NJI²MONJacUhHGX�F+f0/V�BfJX$M\acfMONBI±TJUhI$HJaeX�RzMOI � Ä�Ä ��  � �+�� c�O�£�$¢�$ acd /V�JdVM�RfµR�vwaefBx6X�F+fWb�I�fWMOacF+f�I$dVMOR��JKeacdhNJacfJx6MONJRzM MONBI·¹JUhdVMÊRzaeUhX$UORzL�MMOFÉI$f>MhI�U·MONJI[i�k�P�i)R�acUhdhTJR�X�I\aed±KeR���I�KeI$H)R�d\CQR�fJH)MONJI\dhI$X�F+fBH�aed±KeR���I�KeI$H ^!7

�,¥��" e» �O���q�>����� � � 7 �,¥��" e» �O���q�>�.�,� � �P±NJIL�F+�JUÒMON)X�F�f0/V�JfJXyM acf�MONJI\TJUVI�HJacX*RzMhI � Ä�Ä �� e��+�� e�O� ��¢ $9aed ����� ½ ¤�� ¢V��� �Q�_¥²HJIy¹µfJI�H�R�d3L�F+KcKeF��·d�7

����� ½ ¤�� ¢Ò��� �\��¥ 'Z����� ½ � ) ¢Ò��� �\��¥P±NJacd�aed�RqUVI�dÒMOUhacX$MhaeF+f[F+f9dVa ��I�F�Lµ¢Ò��� �\��¥·X�F�v�TµRzUhI�H[MOFqMhNJI��·acHBMON[F�LJMhNJIlP ��F+U�b'aeX$I�b�I�UhdhRW�yA {�aefµRzKeK#��MONBI\¹BL�MON X�F+f0/V�BfJX$M�aef�MhNJI\TJUhI$HJaeX�RzMOI � Ä�Ä ��  � �+�� c�O�£�$¢�$9acd ��¥+� � ¢Ò��� ��  ��Q�·NJaeXYNGaed±HJIy¹µfJI$H R�d 7

�_¥+� � ¢Ò��� ��  ��B����� �"� �,� � � '¢V�W� � e��¤�� �B¥��>� !��� ��� !�,� � � �� q�Q�_¥ ¢������$¡ ) ¡B�£¢���� !��� ��� ��!� ���9� � ¡B� ¢Ò��� !�,� ��� �"!� ���[�h�21΢V��� �\��¥

C�@

Page 19: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

�·NJI$UhI � 'À�z¥��" e» �O���q�>�.�,� � � � �z¥��" c» �O�_� �+����� � �\R�fJH ��!� ��� aedMONJI�X�F+vwvwF+f aefJaDMOa RzK�R�TJTJUVFWR�XYN ¹B|:AP±NJacdK R�dÒMX�F+f:/V�JfJX$M�lR�dQR�HJHBI�H MOF�L.R�X$aeKeaDMYRzMhI9R�TBUhF'F�L�A9ЮM\RzHJHJdQR�f R�HJHBacMOacF+fµR�K�UhI$dVMhUhaeXyMOacF+f MOF�MONBIMOacv�acfJx TBUhF�MhF�X$F+K�A�i�aev9�JK RzMhaeF+fQUh�BfJd��·acMON²MhNJaed R�HJHJaDMOaeF�fµR�K'UhI�dÒMOUVaeX$MhaeF+f«dVNJF��·d�MONµRzM�MONJI±T�I�UÒL�F+Uhv�R�fJX$IT�I�fµR�KDM��acf MOI$Uhvwd6F�L�R�aeUVT:F�UVM6F�T:I$UORzMhaeF+fµRzK�X�R�TµR�X$acM� acd b+I$U��dhv�R�KeK�AP±NJaedX$F+f0/V�JfJXyM\UhI )'�BaeUhI$d6MONµR,MMONBIkE E HJI$MhI�UVv�acfJI MONBIHJaedÒMYR�fJX$I�d±MOF²MhNJI\Ð�k6{ª�·NJI$f MhNJI6M���FgR�acUhX$UORzL�M3R�UhIacf�MONJIdhR�v�IUVI�x+acF+f7A

� < � �+� � = � ��� Eª�@� � =

Ð�f)MONJI\aefWMhUhF'HJ�JX$MhaeF+f ����I[dÒMYRzMhI�H)MONµRzM±MhNJIMOF+T KeIyb+I$K7MONJI$F+UhI$v �ÒC��3acd�7� Ä�Ä �� e��+�� e�O�£�$¢�������� ��� �,� � ����Y� ��¥ ��� � �'��¦ � ��� � ����Y� ��¥ ��� � �'��¦ � ��� � ���¥���� �_¥ ¥�� �z¥����� �$��¥�� �'� !��� ��� !��� � ��¢V������� » ¢Ò���,��  �����$¡���� ��!�,� � �'�W� !��� � ����¦V� � ��!��� � �'�W� !�,� � ����¦V�h�

� Ä�Ä ��  ����� c�O�£��¢ �'����� ��� ��� � �¬�3R�d³I°|BTBK R�acfJI�H«acf²MONJI±TJUVI$b'aeF��Jd�dhI$X$MOacF+f �+�Y� ��¥ ��� � �'��¦ � ������acd�RTJUhI$HJa��X*R,MOI3�JdVI±MOF6I$fJdh�JUVI±MONµRzM�MONJI±RzaeUhX$UORzL�M�aed acfJdhacHJI�MhNJI�iJjlk �WR�fJH�¥���� �_¥ ¥�� �z¥����� �$�B¥����·acd�R6TJUVI�HJacX*RzMhI�·NJacXYNgIy|�X$Ke�JHJI$d�I$fWMOU�ÉfBI*R�U³MONJI �µRzdhI�F�L"MhNJI·PA'Ð�fɹµx+�BUhIq^MhNJaed �$F+fJI�aed�HJI$dhaex�fµRzMOI$H �+«MONBI�TBNJUOR�dVI�h´�fWMOU� �F�M6o�I�UVv�aDMhMOI$H aef MONJacd �$F+fJI�"BAqÐ�f�MhNJaedqdhI$X$MOacF+f���I9�·aeKcK�HJI�dVX�UVa2��I²I*R�XYN FzL MONJI[TJUhI$HJaeX�RzMOI$d�Y� ��¥ ��� � $��7¥���� ��¥ ¥�� �,¥����� �y�B¥�� $[R�fJH)¢h������� » ¢V���,�� �������¡�$+A

����� *�� � ���� � /)! � � 0 ,6& ! P±NJIQTJUhI$HJaeX�RzMOI6�Y� ��¥ ��� � $[acd±HJI$¹JfJI�H,� 7

�Y� �_¥ ��� � ����¦ � ����� ' �Y� Á��$� Ã4�>��¦ � �,����+¿�Y� ��¥ Ã4�W��¦ � �,�*�R�fJH HJIyMOI�UVv�acfJI�d±aDL RzfGRzaeUhX$UORzL�M3aed±�·acMhNJaef�MhNJI[iJjlkZRzM·MOaevwI ¦°A

P±NJIQTJUhI$HJaeX�RzMOI$d·�Y� Á+�y� Ã4$QR�fJH��Y� �B¥ à $[RzUhIHJIy¹µfJI�H�R�d±L�F+KeKcF��·d�7�Y� Á��$� Ã4�W��¦ � ����� ' � �� e��¤�� �B¥'Ä �W� !�����3à ����� ¦ ) �z¥��" e» �O���q�W�.�,�*���¿¦ 5 �Y�=� ���$�.�,�*���®�������'� �h�

�"½ � ��¦4) �,¥��" e» �O���q�W�.�,�*���¿¦ 5 �Y� � ���$�.�,�*�����+�� �� !� �

�Y� �B¥ Ã4�W��¦ � ����� ' � �� e��¤�� �B¥'Ä �W� !�����3à ����� ¦ )¾�Y�=� ���$�.�,�*���®�������'� �h� � ¦ 5 �Y� � ��������������¡ �����h��"½ � ��¦4)¾�Y� � ���$�.�,�*�����+���¿¦ 5 �Y�=� �����.�,�*���.¡ �£���h�� �� !� �

P±NJI�¹µUhdÒM3TJUVI�HJacX*RzMhI��>�Y� Á��$� à $'��¦ � �����%�>HJIyMOI$UhvwaefJI$dlacL7RzM³MOacv�I±¦ MhNJI6R�acUhX$UORzL�MÊ���qacd�acfwMhNJI � � � RzfJHacM³NJR�d³fJF�MD+IyM3R�X )>�JaeUVI�HÉMONJI�ÃqAWi�aefJX$I RzaeUhX$UORzL�M I�fWMOI$UhaefBxQMhNJUhF+�Bx+N�UVI�x+acF+f�Eºx�F[dÒMOUORzaex+NWM�MOF\MONBI ��!� /30!�MONBI «HJF\fJFzM³R�X�)>�JacUhI3MhNJI·Ãª�JfWMOacK�MhNJI±MOaevwIlx�acb+I$f � 9�Y�=� �������,�������������'� ���yA�Ϭa#��Iy�·aedhI��+�Y� �B¥ à $>��¦ � �����HJIyMOI�UVv�acfJI�d·aDL�Rzf�R�acUhX$UORzL�M±NJR�d�R�X�)>�JacUhI�H)MONBIQÃ�A

C*t

Page 20: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

i�F+vwIL��JUVMhNJI�U±MOacv�acfJx«TJUVI�HJacX*RzMhI�d�R�UhIQ�JdVI$L��JK �µHJaedÒMOaefBx+�JaedVNJaefBx �:IyM��lI$I�f�MhNJI\HJa#�:I�UVI�fWM dÒMYR�x�I�d·F�L� acx+NWM87

�Y� ��¥ Á,�,¢Ò��� ��¤��'��¦ � ����� ' �  �$¤��£�B¥'Ä �>� !�,�*���¿¦4)¾�Y� � �����������$���W� �¿¦ 5 �Y� � ���$�������$���£�����'� �h��Y� �B¥ /�¥,�3� �>��¦ � ����� ' ��¦ )¾�Y�=�����$���������®�������'� �h���À¦ 5 �Y� � ���$�������$�.¡ �����h�h�

P±NJI TJUhI$HJaeX�RzMOI �Y� �B¥ Á,�,¢Ò��� ��¤3$>��¦ � �,�*�)HBI$MOI$UhvwaefJI$d��·NJI$MhNJI�UGR�fÌRzaeUhX$UORzL�MgMONµRzM I$f>MhI�UVI�HSMhNJUhF+�Bx+NUhI$x+aeF�fJd � F+UlÏ acd�F�f�R �µR�dVI�KcI�x«RzMÊMOacv�I·¦°AÊi�acfJX�I R�f�R�acUhX�UhRzL�M³MONµR,M3I�fWMhI�Uhd�MONJUVF+�Jx+N�UVI�x+acF+f�E HJF�I$dfJF�M\MhUOR*b+I$K�RzKeF+fJx�MhNJI �µR�dhI$KeI$x+d\F�LlMhNJIÉÃC�7MhNJI R�UVIÉIy|�X�Kc�JHJI�H NJI�UVI�A�P±NJI�TBUhI�HBaeX*R,MOI«�Y� ��¥ /:¥,�-� $HJIyMOI�UVv�acfJI�d·aDL�Rzf�R�acUhX$UORzL�M±acd±F+f�¹µfµR�K¬R,M±MOaevwI6¦9�BMhNJaed·aed±acfJHJI$T:I$fJHJI�fWM�F�L�MONJI\I�fWMhU��UVI�x+acF+f7A

{�aex��JUhIl@ dhNJF��·d�NJF��ÎMONBIlbzR�UhacF+�Jd�TJUhI$HJaeX�RzMOI$d³R�UhIÊMOUh�BIlL�F+U�HBa#�:I�UhI$fWM dVMOR�x+I$d F�L � acx+NWM8�+HJI$T:I$fJHJacfJxF+f��·NJIyMONJI$U�MhNJIQR�aeUVX�UOR,L�M·aed±I�fWMhI�UhacfJx«MONJUVF+�Jx+N UhI$x+aeF�fJd �SF+U·ÏªF�U3MONJUVF+�Jx+N UhI$x+aeF+f E A

Independent of entry region:

SCA border IAF (R/L/virtual) FAF

tm_on_T?(ac)

tm_bef_T?(ac)

tm_in_SCA?(ac)

tm_bef_T?(ac)

IF RT

tm_on_T?(ac)

tm_on_final?(ac)

tm_on_baseleg?(ac)

Entry through Region M:

Entry through Regions R or L:

{�aex+�JUVI\@ 7�P±aevwaefBx²TJUhI$HJaeX�RzMOI$dqX$F+vwTµR�UhI$H�MOFÉdVMOR�x+I\F�L � aex+NWM

����� � � 0 " � � � ��� � - ! 0 � ,."�� , ! `6�JI·MOFQMONJIqX�F+fJdÒMOUV�JX$MhaeF+f�F�L7MONBI TJUVF�MOF'X�F+K �+MONJI$UhIqaed�R[fµR�UVUhF�� ��I�HJx+IqF�L¬R�acUhdVTµR�X�I�dh�BUhUhF��JfJHJacfJx9MONBI��F+UhHJI$U �:IyM��lI$I�f UVI�x+acF+fJd·Ï�R�fBH � �.R�UhF��JfJH�� 3 �W�lacf)�·NBaeXYN dhI�TJR�UORzMhaeF+f aed±dVF+vwI$�·NµRzM�NµRzUhHJI$U·MhFI�dÒMYR��BKeaedVN7A � IQX�R�KeK:MONJacd3MONJI ) ��,�)/��,���� �&) ,%7

¥���� ��¥ ¥�� �z¥����� �y�B¥�� �>� !�,� ��� !�,� � � ' ¼�½ �*��¢V����� !�,� ��� !��� � � ��B¥�� � ����¢Y�£¡W� ��� ¢V���W�Q�_¥���� !�,� ��� !��� � ��+�B¥�� � ����¢Y�£¡W� ��� ¢V���W�Q�_¥���� !�,� � � !��� � ��+Á+���Y � ����¢°� ¡W� ��� ¢V���W�Q�_¥ ¡B� � �-�W� !��� ��� !�,� � �

ЮM3dVNJF+�JKcH>��I fJF�MhI�H�NJI$UhI MhNµRzM�MONJacdÊ��I�HJx�IaedÊUhI*RzKeK#ÉUhRzMONBI�UldVvgRzKeK�A�P±NJaedlR�KedVF9dVTJKeaDMOdÊUhI�x�aeF+fJd � RzfJHÏ acfWMOF �qR�& �±|�R�fJHGϬR+&�Ï"|��·acMhN �±| RzfJH Ï7|�HJI�fJFzMOaefBxÉMhNJI\Uhacx+NWM�R�fJH KeI$L�M=) ��,�)/�.,���� �&) ,yA

P±NJI«TJUVI�HJacX*RzMhI�¼�½ �*��¢V��$ÉHBI$MOI$UhvwaefJI$d6acL !�,� � R�fJH !��� � R�UVI²I�fWMhI�UhacfJxgMhNJUhF+�Bx+N UhI$x+aeF�fJd � R�fJH Ï�·acMhN)F+fJI\F�L�MONJIQR�acUhX�UhRzL�M±I$f>MhI�UVaefJxÉMONJUVF+�Jx+N)I�R�XYN�UVI�x+acF+f 7

¼�½ �*��¢V���>� !��� ��� !��� � � ' � e��¤�� �B¥'¼ �W� !�,� � ���  �$¤��£��¥'½��>� !��� � �V��+� e��¤�� �B¥'¼ �W� !�,� � ���  �$¤��£��¥'½��>� !��� � �V�

C�]

Page 21: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

P±NJIqTJUhI$HJaeX�RzMOIq�B¥�� � ����¢Y�£¡W� ��� ¢V���W�Q�_¥�$6aedÊfJF�M�d�'v�vwI$MhUhacX*R�K5aefÉMONBIqM���F«R�Uhx��Jv�I$fWMOd��'�·NJaeXYNgaed³�·N acMÉacdÉR�TJTJKcaeI$HÎM��·acX�I aef ¥���� �_¥ ¥�� �z¥����� �$��¥�� $+A<P±NBI ¹µUVdVMgR�Uhx��Jv�I$fWMG�.NJI$UhI !�,� � �²v²�JdVMwNµR*b�IGMONBIR��JdVF+Ke��MOI6bzR�Ke�BIF�L�MhNJI6|�bzR�Ke�BIF�L aDMOd±I�fWMhU��T�F+aefWM·x+UVI*RzMhI�U±MONJR�f)F+U±I�)>�µR�K�MhFw¢Ò��� �\��¥ 7

�B¥�� � ����¢Y�£¡W� ��� ¢Ò���W�\��¥��'� !��� �"� !�,� � � ' � e��¤�� �B¥'¼ �>� !��� � ���  �$¤��£�B¥'½ �>� !��� � �(� !�,� � � � � ¢Ò��� �\��¥z�+ � e��¤�� �B¥'½��>� !��� � ���  �$¤��£�B¥'¼ �>� !��� � �(� !�,� � � ) ¢V��� �Q�_¥z�

{�acfµR�KeK���>acL �:F�MhN)R�aeUVX�UhRzL�MlNJR�b�I6MONJI\R��JdhF+Kc�BMOI�bzR�Ke�JI$d3F�L�MhNJI |gbzR�Kc�JI�dlF�L�MONJI$aeU�I�fWMOU��T�F+aefWMOdlx+UhI�RzMOI$UMONJR�fGF�U±I�)>�µR�K7MhF�� � � � � �

��JMhNJI\TJUhI$HJaeX�RzMOI²Á����Y � ����¢Y�£¡W� �z� ¢V���W�Q�_¥ ¡B� � �-$QNBF+KeHJd 7

Á����Y � ����¢Y�£¡W� ��� ¢Ò���W�\��¥ ¡B� � ���W� !��� ��� !��� � � ' �  ��¤'�£�B¥'¼ �'� !�,� � ��� e��¤�� �B¥'½��>� !��� � ���!��� � � � � ¢Ò��� �\��¥��+^ �!��� � � ) ¢V��� �Q�_¥��+^+�

+ �  ��¤'�£�B¥'½ �'� !�,� � ��� e��¤�� �B¥'¼ �>� !��� � ���!��� � � � � ¢Ò��� �\��¥��+^ �!��� � � ) ¢V��� �Q�_¥��+^+�

P±N>�Jd�� aDL3F+fBI�F�L !�,� � F+U !�,� � acdQacfªUVI�x+acF+f � �¬R�fJH MONJI�F�MONBI�UQaef UhI�x�aeF+f Ï �¬MhNJI�f MONJIwMOF+T KeIyb+I$KMONBI�F+UVI�vºF+fJK�)X�F+fJdVaeHJI$Uhd MhNJF+dVI9dhaDMO�µR,MOaeF�fJd±�·NJI�UVI²I�aDMONJI$U R�acUhX$UORzL�M�NµR�d R�f�I$fWMOU�GT�F+aefWM��·acMON�� ��� )¢Ò��� �Q�_¥ �µF+U ��F�MON R�acUhX�UhRzL�M±NµR*b�I[I$f>MhU�)T�F+aefWMhd3�·acMON�� ��� )�� � � � � �

�A

��� � ��,1$ ! ��!#-�,1/),6& � � �

p6�JUwF�b�I�UhR�KeK�R�acvÑaed«MOF dhNJF��ºMONµR,M�L�F+UwR�f+ÎM���F R�aeUVX�UhRzL�MÉ�·acMONBaefÎMONJI iJjlk �³MONJF�dhI)M��lF RzaeUhX$UORzL�Mv�R�aefWMYRzaef<MhNJI vwaefJacv²�JvÑUhI )>�JaeUVI�HrdhI$TµR�UOR,MOaeF�frRzM)R�KcK�MhaevwI�d�AZP±NJI TJUVI�HJacX*RzMhI ¢h������� » ¢V���,�� �������¡�$dVMORzMOI$d·Iy|BR�X$MhK#�MhNµRzM�7

¢V������� » ¢Ò���,��  �����$¡��B��%& ��� %& � � ' ¡B� ¢Ò�$��%& ��� %& � � ) ¢Ò��� �\��¥,+���B¥ ��� �+¢Ò� ���- �¥��� .�B��%& ��� %& � ���¡B� ¢Ò�$��%& ��� ��!� /30+�21ΡB�£¢��*��%& ��� ��!� /30z�*) ¢Ò��� �\��¥z�

� IgdhI$IgMONJRzM9¢V������� » ¢Ò���,�� �������¡�$�aedQIy|�TJUhI$dhdVI�HÎaef MOI�UVv�d[F�L3MhNJIgKcF�X�RzMOacF+f F�L3MONBI�R�acUhX�UhRzL�MQx+acb�I�f RzdT�F+aefWMOd aef ^�` dVTµR�X�IzA[P±NBI�dhIwR�UVI«X*R�KcX��JKeRzMOI$H �JdVaefJx �"!��� � ��� � !��� ���.� �%�"�·NBaeXYN aed6HBI�dhX$Uha#�:I$H vwF+UVI[L��JKcK#aef dVI�XyMOaeF�f tBA�Ð�fÎx+I�fJI$UOR�K ���lI)UhI )>�JaeUVI)R dVaevwTJKeI�x+I�F�v�IyMOUhacX*R�K�dhI$TµR�UOR,MOaeF�f ��MONµRzMÉacd9MONBI HBaedVMOR�fJX$I��I$M���I�I�fGMONJIM���FgR�acUhX$UORzL�M±v9�JdVM ��IQx�UhI*R,MOI�U3MhNµR�f F+U±I�)>�µRzK¬MhFÉ¢V��� �\��¥9fµR��BMhaeX�R�K7vwaeKeI$d�A ��F��lIyb+I�U �acL¬MhNJI6M��lF�R�acUhX�UhRzL�M·R�UVI\R�KeUVI*R�H!gF+f�MhNJI\ÃC�BR�fJH)MONJI6¹µUVdVM�F+fJIacd3F+f�¹µfµRzK¬R�TJTJUVFWR�XYN R�fJH�MONBIQFzMONJI$UF+fJIgaed9F�f R �µR�dVI�KcI�x ��aDM²aed[I�fJF��Jx+N�MOF�NµR*b+I�¢Ò��� �\��¥ HJaedÒMYR�fBX�I�R�d9v�I�R�dh�JUVI�HÎR�KcF+fJx MONJI�à ��R�d9acdHJacdhX��BdhdhI$H�acf dVI�XyMOaeF�f ^�A

i�F�MhNJI9v�R�acf MhNJI�F+UVI�vºdOR8'dqMhNµRzMqacL�M��lF�RzaeUhX$UORzL�MqR�UVI ��F�MhN�aef)MONBI«iJjlk ��MhNJI � Ä�Ä ��  � �+�� c�O�£�$¢NJF+KcH L�F�U�MhNJIQM���F�R�acUhX$UORzL�M��5R�fJHGMhNJI GR�UVI[fBF�M acf MhNJI6) ��,�)/��,�� � �&) ,%�5MhNJI�f�dhI�TJR�UORzMhaeF+fGR�dqHJI$¹µfBI�HR���F�b+I\aed±I$fJdh�JUVI�H7A

C�m

Page 22: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

� � �³��� � ���w���·�@E���

� ��� ��&�,6& � �%$�� ! / ��� 0 ,6&/� � �

Ð�fªdVI�XyMOaeF�fªm��lIwHJacdhX��BdhdhI$HªMONBIwMhF+T!��KcI$b�I�K³dORzL�IyM� TJUhF�T:I$UVM� P±NJI$F+UhI$v C�A�Ð�f MONJacddhI�XyMOacF+f ��Iw�·acKeKx+aDb+IQR�f)F�b+I�UÒb'aeI$�1R�fJH dVMYR,MO�Jd·F�b+I$U�MhNJI\TJUhF'F�L�F�L�MhNJaed3MhNJI�F�UhI�v A

P±NJI3k6E E¿TJUhFzMOF'X�F+K'�JdhI$d�MONBIlbzR�UhacF+�Jd�I�fWMOU�9UVI�x+acF+fJd Rzd���I�KeKBR�d�MhaevwaefJx�d¬MhF6HJIyMOI�UVv�acfJIÊacL5R�X$X�I$dhddhNBF+�JKeH ��I±x+UhR�fWMOI�H �>R�fJH«MONJacd aed�UhI � I�X$MhI�Hwaef²MhNJI±TJUhF'F�L����·NBI�UhI±��I±X�F+fBdhaeHBI�U�TµR�acUhd FzL"RzaeUhX$UORzL�MB�µR�dVI�HF+f�MONBI�aeU·I$f>MhU��UVI�x+acF+fJd·R�fBH'&zF+U±�·NJacXYNGdÒMYR�x+IFzL � acx+NWM±MONJI%)R�UhIQRzM�A³{µF+U±Iy|BR�vwTJKeI��BMONBIQKcI�vwvgR

ȳ%�&ª&ª= � � ¢V�����y��» ¼�¼ ½�½3� Ä�Ä � � �-�W�.�,� ��� �,� � ���¿�O�_� � ¢Ò��� ��  ��,�¢h�W�q�  �$¤��£�B¥��'� !��� �"� !�,� � ���� e��¤�� �B¥'¼ �>� !��� � ��+  �$¤��£�B¥'½ �>� !��� � �V�����¥+� � ¢Ò��� ��  ����.�,� ��� ��� � � ��Y� Á��$� à �W��¦ � �,� � ���À�Y� Á��$� à �W��¦ � �,� � �

� ¢h������� » ¢Ò���,�� �������¡��'� ��!��� � �'�W� !�,� � ����¦V� � �"!��� � �'�W� !�,� � ����¦V�h�

Iy|�TJUVI�dVd�MONJRzM�acL>M��lF R�aeUVX�UhRzL�M ��F�MONQI�fWMOI$U�MhNJUhF��Jx+N\UhI$x+aeF+f � �*�·acMhN\MhNJI³MOaevwI dVI�TµR�UhRzMOacF+fJd¬UhI )>�JaeUVI�H � MONBI9TJUVF�MOF'X�F+K¬RzfJH ��F�MON � dVMhUOR�acx+NWM�L�UVF+vÀMONBI�aeU�I�fWMhU� T:F�aefWM·MOF�MhNJI[¹�| �5MONBI�f dVTµR�X�aeR�K�dhI$TµR�UhRzMOacF+faed[vgRzaefWMYR�acfJI�HªR�d²KcF+fJx R�d �:F�MhNÎR�aeUVX�UhRzL�M²RzUhI�acf�UhI$x+aeF+f �QA�p6fJX�I�MhNJIg¹µUVdVMwR�acUhX�UhRzL�M[UhI*RzXYNJI�d«MONBI��!����� ¼ �7aDMR�X )>�JaeUVI�d6MONBI«P@��R�fJH R�fBF�MONJI$U6KeI$v�v�R�acd6�JdVI�H MOF�NµRzfJHJKeI[MONJacd6X*R�dVI�A9i�aefBX�I9MhNJI«TJUhF'F�L³acdd�'vwv�IyMOUVaeX*RzKµaef�MhNJI X�R�dhI��·NJI�UVI ��F�MONgR�aeUVX�UOR,L�M�I$fWMOI�UÊMONJUVF+�Jx+NgUhI�x�aeF+f�Ï �>MhNJI KcI�vwvgR¢V�����y��» ¼�¼ ½B½aed±dÒMYRzMhI�H dhFÉMONµR,M·acM·X�F�b�I�Uhd ��F�MON)MONJI$dhIQX*R�dVI�d$A

P±NJI3TJUVF�FzLµF�L5P±NJI$F+UhI$v�ClMOR���I$d�MONBIlL�F+Uhv§F�LµR K R�UVx+IÊX*R�dVI3dhTJKcacM�A�P±NBIlL�F+KeKcF��·aefJx·MYR��BKeI�d�aefJHBaeX*R,MOI�dMONBI±HJa#�:I�UVI�fWM³X*R�dVI�d�MOF�x+I$MhNJI�U��·aDMON²MhNJI±fµR�vwI�d�F�L5MhNJI±KeI$v�v�R�d�X�F�b+I$UhaefBx\MhNµRzM³X�R�dhIzA P±NJI±MYR��BKeI�d R�KedVFdhNBF��·d3MhNJI TBUhF'F�L�dVMORzMO�BdlL�F+UlI�R�XYN�KeI$v�v�R �>oÎaefJHBaeX*R,MOI�d³MONJRzMlMhNJI6TJUVF�F�L7F�L�MONJIqKeI$v�v�RQacdlX$F+v�TBKeI$MhI��� aefJHBaeX*R,MOI�d3MhNµRzM·aDM·aed±fJF�M�A

{�aeUVdVM��JMONJI\TJUVF�F�L�F�L�P±NJI�F+UVI�v C\X�F+fWMOR�aefJd±MhNJIQMhNJIQX*R�dVI�d�KeaedÒMOI$H acfGP�R��JKcI«C+A�P±NJaed·dhNBF��·d�MONµR,ML�F+U\MONJIwX*RzdhI�d9UhI�x+R�UhHJacfJx UhI�x�aeF+fJd!� R�fJHªÏ¾Iy|�X�Kc�JdhaDb+I�K� MONJI�TJUhF'F�L�d[R�UhIwX�F+vwTJKcI$MOI$H ���·NBI�UhI�R�d[L�F�UMONBI9X*RzdhI�d X�F�b+I$UhaefBx�UhI$x+aeF+f�E R�fBHGMONBI9vwaD|�I�HGX*R�dVI�d6F�L UhI�x�aeF+fJd �§R�fJH�ÏD�:R�fJHGUhI$x+aeF+f E R�UVI[fJFzM+IyM TBUhF�b+I$f7A

{µ�JUVMhNJI�UVv�F+UVI�� MhNJI TJUhF'F�L[F�L9MhNJI KeI$v�v�R�¢h�����$�.» Á+�z�Y �B¥ à aed*�µRzdhI�H F+frMONJI X*R�dVI dhTJKcacMOd)acfP�R��JKeI[^�A � I\dhI�IQMONµR,M�R�KeK"MhNJIQX*R�dVI�d·�·NJI�UVI ��F�MONGR�acUhX�UhRzL�M�R�UVI[RzKeUhI�R�H gF+f MhNJIQPSNµR*b+I[X�F+vwTJKcI$MOITJUVF�F�L�d$A

{�aefJR�KeK���>MONJI\TJUVF�F�L�F�L�KeI$v�v�R � �����$�.» �Q� 0z��¡ þacd �µR�dVI�H�F�f)MhNJI\X*R�dVI[dVTJKeaDMOd3KcaedÒMOI�H)acf P�R��JKcI\@BA�qI$UhI ��I6dVI�I MhNµRzMlMhNJI6vwaD|�I�HgX*R�dVI�dl�·NJI$UhI6F�fJIR�acUhX�UhRzL�M�aedÊF+fgMONBI6P R�fJHgMhNJI F�MhNJI�UlF+fJI acdlfJFzM(+IyMF+f�MONBIQP NµR*b+IQfJF�M ��I�I�f TJUVF�b�I�f7A

Ð�fSMONBI fJI°|'M dhI$X$MhaeF+fJd �lI �·aeKcK6HJaedVX��JdVd aef dhF�v�I v�F�UhI HJI$MOR�aeKdVF+vwI F�L9MONJI X*R�dVI�d �[fµRzv�I$K#¢V�����y��» ¼�¼ ½B½ ��dhI�XyMOacF+f s�A_^+�9��¢V�����y��» Á����Y �B¥ Ã��.dVI�XyMOaeF�f s�An@W�R�fJH ¢h�����$�.» ¼"�'½�� ��dhI�XyMOacF+f s�Aut>�°A�Ð�fdhI$X$MhaeF+f)s'A�]Q��I6TJUVI�dVI�fWM·dhF+vwI F��JdhI$UVbzRzMOacF+fJd±R��:F+��MlF+fBI6X*R�dVI6aefWb�F+Kcb'aefBx9F+fJI6R�aeUVX�UOR,L�M�F�f�MONJIqP RzfJHMONBI[F�MhNJI�UqF�� F�L MhNJIQPA7i�F�v�I\vwaefJF+U±vwF'HJac¹µX�RzMOacF+fJd3MhF�MONBI[vwF�HBI�Ked±�·acKeK ��I[fJI$X�I$dhdORzU��MhF�NJR�fJHJKcIMONBaed±X*RzdhI�A

C�s

Page 23: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

qR�v�IFzL�KcI�vwvgR j3R�dhI+�.dY�±X�F�b�I�UhI$H i'MORzMO�Jd¢V�����y��» ¼�¼ ½�½ !�,� � R�fJH !�,� � R�UVI �:F�MhNSacf UVI�x+acF+f �ÓF+U,��F�MhN acf

UhI�x�aeF+f Ïo

¢V�����y��» ¼ �W½ ½'�W¼ !�,� � aed�aef[UhI�x�aeF+f!�Î�·aDMON\|[bzR�Kc�JI³F�LµI$f>MhU�[T:F�aefWM�KcI�dVdMONµR�f�F+UqI )>�µR�K¬MOFg¢Ò��� �\��¥wR�fBH !��� � acdqacf�UhI$x+aeF�f�Ï8�pU±d�'v�vwI$MhUhaeX��·acMhN !�,� � acf�UhI$x+aeF+f�Ï R�fBH !��� � acfUhI�x�aeF+f �

o

¢V�����y��» ¼�½ � ½�¼ � i�aevwaeKeR�U�MOF[¢h�����$�.» ¼ �W½ ½ �+¼ � �J�BM��·acMON�I�fWMOU�gT�F+acf>MF�L !��� � UhI$dVMhUhaeXyMOI$HGacfJdVMhI*R�H F�L !�,� �

o

¢V�����y��» ¼:��½z� !�,� � aed\acf UVI�x+acF+f � R�fJH !�,� � acdQacf UVI�x+acF+f Ï � �:F�MhN�·acMON R��BdhF+Kc�BMOI�bzR�Kc�JI F�L| bzR�Kc�JI F�LQI$f>MhU� T�F+acf>Mx+UhI�RzMOI$U·MhNµR�f)F+U·I�)>�µRzK7MOF � � � � � �

o

¢V�����y��» Ä ¢V�W� � �- �,¡��������z¥�� !�,� � R�fJH !�,� � R�UhIqaefÉMONJIqdOR�vwI�F+UlRzH0/hR�X�I$fWM3TµR�UÒMOd�F�LUhI�x�aeF+fGE�

¢V�����y��» Ä ¥���¥ �,¡��������z¥�� !�,� � R�fJH !�,� � R�UVI$��F�MON aef UhI$x+aeF+fªE � �J�BM[aef fJF+f��R�H0/hR�X$I�fWM�TµR�UVMhd

¢V�����y��» Ä ¼�½ !�,� � aed)acf UVI�x+acF+f E � !�,� � acf I$acMhNJI�U)UhI$x+aeF�f �ÓF�UUhI�x�aeF+f Ï

¢V�����y��» ¼�½ Ä !�,� � acd±aef)UhI$x+aeF+f �SF�U±UhI�x�aeF+f Ï � !�,� � acf�UhI$x+aeF+fGE �

¢V�����y��» Á����Y �B¥ à !�,� � R�fBH !��� � R�UhI ��F�MON)F+f�MhNJI\P o� �����$�.» �\� 0z��¡ à pfBI[RzaeUhX$UORzL�M3NµR�d·UhI�R�XYNJI�HGP@�JMONJI\F�MhNJI�U·NµRzd�fBF�M �

P�R��JKeI«C�7�j3R�dVI�d�aef�MhNJI\TJUhF'F�L�F�L�P±NBI�F+UVI�v C

qR�v�IFzL�KcI�vwvgR j3R�dhI+�.dY�±X�F�b�I�UhI$H i'MORzMO�JdÁ,��¢V� �>¥�¡ /�¥,�-� !�,� � acd±F+f ¹JfµR�K¬R�fJH !��� � aed±F+fGR �µR�dVI�KeI$x o�B¥ ��� �+¢Ò� �$�3 �¥��� !�,� � R�fJH !�,� � R�UhI�F+fgR[X�F�UhfJI$U��JRzd�HJI$dhX$Uha2��I�HgaefwdhI�X9�MOaeF�fG@�A_@

o

Á����Y �B¥ à /:¥,�-� !�,� � R�fBH !��� � R�UhI ��F�MON)F+f�¹µfJR�K oÁ����Y �B¥ à ¢h�W�q� !�,� � R�fBH !��� � R�UhI\F+f�MhNJI\dOR�vwI@�µR�dVI�KeI$x oÁ����Y �B¥ à ¥���� ¢V�>�q� !�,� � R�fBH !��� � R�UhI\F+f)F+TBT:F+dVacMhI@�µR�dhI$KeI$x+d o

P�R��JKcI[^!7Êj3R�dhI$dqacf�MONJI\TJUVF�F�L�F�L�KeI$v�v�R²¢V�����y��» Á����Y �B¥ Ã

C�~

Page 24: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

qR�v�IFzL�KcI�vwvgR j3R�dhI+�.dY�±X�F�b�I�UhI$H i'MORzMO�Jd¢V�����y��» Ã Ä !�,� � acd±F+f MhNJI\P@� !�,� � acd±aef)UhI$x+aeF�f E �

¢V�����y��» Ä Ã !�,� � acd±aef)UhI$x+aeF+fGE � !��� � aed±F�f)MhNJI\P �

¢V�����y��» à ¼�½ !�,� � acd±F+f MhNJI\P@� !�,� � acd±aef)UhI$x+aeF�f �ÌF+U±UhI$x+aeF+f Ï �

¢V�����y��» ¼�½ à !�,� � acd±aef)UhI$x+aeF+f �SF�U±UhI�x�aeF+f Ï � !�,� � acd±F+f�MONJI\P �

P�R��JKeI\@ 7�j3R�dVI�d�aef�MONBIQTBUhF'F�L�F�L�KcI�vwvgR � �����y��» �\� 0z�$¡ Ã

� ��� � /)� �%$ � $ � ��� � ��� ��� ���

Ð�f«MONJacd dhI$X$MhaeF+f �z�lI±�·aeKcK�TBUhI�dVI�fWM³MONJI �JR�dhacX3aeHJI�RF��I�NJacfJH«MONJI3TBUhF'F�L�F�L5MONJI±X�R�dhI3�·NJI$UhI ��F�MONÉRzaeUhX$UORzL�MR�UVIqacf�UVI�x+acF+f � F+U³UVI�x+acF+fgÏ�A>P±NJacd�acd�acKeKe�BdVMOUhRzMOI$HÉaefɹµx+�JUVIqtJA�i�aefJX$IqacfwMhNJaedÊX*RzdhIqMhNJIqR�aeUVX�UOR,L�M�NJR�b�I

{�acx+�JUVI6t 7�k TBTJUhFWRzXYN o�R,MONJd±L�F+U�j3R�dVI � �

fJF�MqUhI�R�XYNJI$H�MONJIQP@�µMONJIQdhT�I�I$HJdR�UVI[X$F+fJdÒMYR�fWM R�fJHGMhNJI ��!�,� � ���L��JfBX$MOacF+f dhaevwTJKcac¹µI$d3MOF�MhNJIQv�F�MhaeF+fF�L RÉTJR�UVMhaeX�KcIF+fGRwdÒMOUORzaex+NWM·KeacfJI�A³Ð�f L.R�X$M��µacM·aed±T�F+dVdha2�BKeIMOFwUhI�R�dhF+fGR���F+�BM�HJacdVMYRzfJX�I$dqacfGR«MOUVa R�fBx+KeIUOR,MONJI$UÊMhNµR�f�R��:F+��MlT�F+aefWMhd�vwF�b�acfJxQaefg^�` dVTµR�X�I R�dlacKeKc�JdVMhUORzMhI�HÉaefɹµx+�JUVI]�A�P±NJI TµRzUOR�vwI$MhI�UhdÊ�JdVI�Haef�MhNJI¹µx+�JUVI[RzUhIHJIy¹µfJI�H�R�d±L�F+KeKcF��·d�7

C��

Page 25: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

{�aex��JUhIQ]!7�kC�JdVMhUOR�XyMOacF+f)P�F�`6aedÒMYR�fJX$I�d±acfGR«P�UhaeR�fJx+KcI

¦ X$KeF'X �gMOacv�I���¦ 3 �«�·NBI�f�dVI�X$F+fJH RzaeUhX$UORzL�M3I�fWMOI$Uhd i�k�P�i RzaeUhdVTµR�X$I� MhaevwI HJI�KeR8 �:IyM��lI$I�f �·NJI�f ¹µUhdÒM�RzaeUhX$UORzL�M�I�fWMOI$Uhd�i�k�P�i RzaeUhdVTµR�X$I R�fJH

�·NJI$f�dVI�X�F�fJH R�acUhX$UORzL�M±I$fWMOI�UVd�A¢Ò��� �\��¥ dVI�TµR�UhRzMOacF+f�vwaefJacv²�Jv A�P3��FÉR�acUhX�UhRzL�M�dhNJF+�BKeH�fJIyb+I$U±x+I$MlX�KeF�dhI�UÊMONµRzf�MONJacd

HJacdVMOR�fJX�I���I�AuxJAÊ@ÉvwaeKcI�dO�yA�(� X$F+fJdVMOR�fWM dVT:I$I�HGF�L�MhNJI¹µUhdÒMqR�aeUVX�UOR,L�M�$� X$F+fJdVMOR�fWM dVT:I$I�HGF�L�MhNJI¹µUhdÒMqR�aeUVX�UOR,L�M � dÒMYR�UÒMOaefBx«HJaedÒMYR�fJX$I\F�L¬¹µUhdÒM RzaeUhX$UORzL�M�L�UhF+v�MONJIÐ�k { �.aefBacMOaeR�K�R�TJTJUVFWR�XYN)¹B|J� � dÒMYR�UÒMOaefBxGHJacdVMOR�fJX�IwF�L±dVI�X$F+fJH R�acUhX$UORzL�ML�UVF+vÓMONJIwÐ�k6{ �.acfJacMha R�K�R�TJTJUVFWR�XYN

¹B|J��ªI�dV�·aDMOXYNgMhF9R\KeF'X*RzKBMOacv�I3MÊ�·NJaeXYN�aed³dhIyM�MhF9��·NJI$fgMONJI�dhI$X�F+fBH�R�aeUVX�UhRzL�M³I�fWMOI$UhdÊMONJIqR�aeUVdhTµRzX�I�A

i�acfJX�I R�aeUVX�UOR,L�MqC I�fWMOI$UhdlMhNJIi�k�P�i�RzaeUhdVTµR�X$I � dVI�X$F+fJHJd ��I$L�F+UVIqMhNJI dVI�X�F�fJH)R�aeUVX�UhRzL�M8�WMONBI L�F+KeKcF��·aefJxI�)>�µR,MOaeF�fJd�HBI$¹µfJI MONJI$aeUÉUhI$vgRzaefJacfJx HJaedÒMYR�fBX�I�dÉMOF MONJI Ð�k6{�A��:��¦V�Éacd«MONJI UhI$vgR�acfJaefBx HBaedVMOR�fJX$I)L�F�UR�acUhX�UhRzL�MCQR�fJH��,��¦V�3aed3MhNJI\UhI$vgR�acfJaefBx«HJaedÒMYR�fJX$I6L�F+U·R�acUhX�UhRzL�Mq^!7

�:��¦V� 3 � � �(� � � 1ΦV��,��¦V� 3 � � �$� ¦

� dVaefJx[MONJIϬR*�Sp L�jlF+dhacfJI�d �BMONJI HJaedÒMYR�fJX$I ��I$M���I�I�f�MhNJI M���FÉR�aeUVX�UOR,L�M±RzM�MOaevwI·M3X*Rzf*�:I6X$F+vwTJ�BMOI$HR�d±L�F+KcKeF��·d�7

� � ��¦V� 3 � � ��¦V�21�� � ��¦V� � ^�����¦V���,��¦V� � � ���·NJI$UhI � aed3MONBI[RzfJx+KeI\R,M±MONJI\Ð�k6{�AP�FwI�dÒMYR��BKeaedVN)x+I�F+vwI$MhUhacX6dhI$TµR�UOR,MOaeF�f �J�lI\v²�BdVM�dhNJF�� 7

^��

Page 26: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

P �q´�p#��´ÊE 75Ð�{ � � ¦ 5����� � � � P � ´ � ��¦V� 7 ¢Ò��� �Q�_¥� IQUVI�vwI�v ��I�U3MhNµRzM � � )�� ��� � )��gL�F�U±fJF+f!�®fJI�xWR,MOacb�I � � �3��dhFwKeIyM��ud�KcF�F��gRzM � �,��¦V�97

� � ��¦V� 3 � � ��¦V�21�� � ��¦V� � ^ �:��¦V���,��¦V� � � ��) � � ��¦V�21�� � ��¦V� � ^ �:��¦V���,��¦V�3 � ����¦V� � �,��¦V�V� �

P±N>�Jd��5aDL���I\X*R�f I�dÒMYR��JKcaedVN

� ��¦V� ) � ����¦V� � �,��¦V� � ) ¢Ò��� �\��¥��I9R�UVIHJF+fJIzA

�ªI\X�R�fGdVaevwTJKeaDL1ÉMONJIL�F+UVv²�JK RzdlL�F+U ����¦V�±R�fJH��,��¦V� �+��JdVaefJxÉMONJIL�F+KcKeF��·aefBx²dh� �BdVMOaDMO�BMhaeF+fBd�7 3 � � � � �(� �

� 3 �$� � � �

P±NJI$f� ����¦V� � �,��¦V� � 3 � � � �(� � � 1ΦV� � �� � � �$� ¦V� �3 � � � � � �(� � 1S�

�$� � �(� ��¦V� �3 � 1 � ¦ �P±N>�Jd��5aDL���I\X*R�f I�dÒMYR��JKcaedVN

� 1 � ¦ ��) ¢V��� �Q�_¥ ��^����I9R�UVIHJF+fJIzA �ªI\X*RzfGHJI$X�F+vwT�F+dhIMONBaed±TJUVF�F�L �+)RÉdhaevwTJKcI6X*R�dVIQR�fµR�K��dVaed 7

� � 5 �$� �(� ) � � � � � j3R�dhIwC j3R�dVIQ@ � 7 � j3R�dhIwC j3R�dVI\t�ªI�·acKeK7acKeKe�BdVMOUhRzMOI�MONJI\TJUVF�FzL�F�L�X*RzdhIQ@�RzfJH)X*R�dVI[tJA

¶�� � � � 89=J#�% /� �����°A³{5UVF+v�MhNJI\X*R�dVI9@«TJUVI�vwaedVI�d��J��I\NµR*b+I�7

� � � � � � ) �$� � 3 � � � � � � � � � 3 �$� � �(� ������������ �� ��� ��� � �"���$��� � �

P±NJIQTJUhI$v�acdhI � Ä�Ä ��� acd±HJI$¹µfBI�H Rzd·L�F�KeKeF��·d����� ���g�� ��� �����(�����$��� � �(' � )!� �\��¥��� ��� � ���(�����$� � � � � �$� �� � � �(� � � �*) ¢Ò��� �\��¥

^�C

Page 27: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

ЮM¬L�F+KeKcF��·d7MOUhaDb'a R�KcK#±L�UhF�vSMONJI�MhF+T!��KcI$b�I�KWTJUVI�vwaedhI � Ä�Ä ��  � �+�� c�O�£�$¢¬L�F�U¬MhNJaed�dVacMh�µRzMOacF+f7A¬P±NJI³L�F+KeKcF��·aefJxKeI$v�v�R9NJF�KeHJd 7

¢V�>�q� e��¤�� �B¥��>� !��� ��� !��� � � �Å�  �$¤��£��¥'¼ �W� !��� � ��+  ��¤'�£�B¥'½ �'� !�,� � �h���� Ä�Ä ��  � �+�� c�O�£�$¢��'����� ��� ��� � �

�DÄ���½ ��� �� Ä�Ä �����.¡B�£¢���� !��� ��� �qÂ+� �z ������� !��� � �V� �

¡B� ¢Ò��� !��� � � ��Â+�£�z �£����� !��� � �h� �!��� � ��� ��� !�,� � ��� ��� �,¥��" e» �O���q�W�.�,� � � � �z¥��" e» �O�_� �>�.�,� � �h�

�·NJI$UhI !�,� � ��� �-� !��� � ��� � R�UhI6MhNJI\x+UhF+�BfJHGdVT:I$I�HJd�F�L�R�aeUVX�UhRzL�MOdCQR�fJH�^²UhI$dhT�I�X$Mhacb�I�K#�A�ªI�·acKeK7TJUVF�b+I\KeI$v�v�R)��^+�lacf�M��lFwdVMhI�TJd 7

� �3) ¢Ò��� �\��¥ ��@+�

� 1 � ¦ ��)�� � �.tW�

R�fJH � �\��¥9dhaevwTJKcac¹µI$dlMOF 7

� �\��¥��� ��� � ���(�����$� � ' � �� � 7 � � �(� 7 � � à ������.¢Ò��� �\��¥41S�� � � � �V��� �(�

�"½ � �¢Ò��� �Q�_¥��

�(�� �� !� �

3 ¢Ò��� �\��¥ ��(�

{�aeUVdVM±��I[fBI�I�H)MOFÉI$dVMYR��JKeacdhN dVMOI$T C�7

� �3) ¢V��� �Q�_¥

i�acfJX�I � �\��¥B�� ��� � ���(�����$� � 3 ¢Ò��� �\��¥���(� R�fJH � 7 3 � �Q�_¥��� ��� �����(��� � � �3��I\F��BMOR�aef 7

�(� � ) ¢Ò��� �\��¥

{µUhF+v�MONJIQR�dVdh�JvwTBMhaeF+fJd3��IQdhI�I\MONJRzM 5 �!�JdhF

� � 3 � 3 � � � 1 �(� �)

�(� �) ¢Ò��� �\��¥

^+^

Page 28: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

qF��ÌR�KeK"��I\NµR*b+I\MOFÉHJFwaed±I$dVMYR��JKeacdhN)dVMhI�T ^�7� 1 � ¦ ��)�� �

�l�BM·L�UVF+v�MhNJI\X*R�dVI9@«TJUVI�vwaedhI$d�7 ��I[NJR�b�I � � �ÉR�fJH NJI�fJX$I � ¦ � �BA³P±N>�Jd� 1 � ¦ � 3 � � � ¦

) � 3 � �

R�fJH)��I[RzUhI\HJF+fJIzA

¶�� � � � 89=J#�% �� �����°A³{5UVF+v�MhNJI\X*R�dVI[tÉTJUVI�vwaedVI�d��J��I\NµR*b+I�7

� 7 � � � � ) �$� � 3 � � � � �(� � � � 3 �$� � �(� ������������ �� ��� �����(��� � � � � �

{�acUhdVM±��I�·aeKcK7I�dÒMYR��JKcaedVN)MhNµRzM� 1 � ¦ ��)�� � ��]��

P�F dVI�IGMhNJaed«��I�fJFzMOI�MONµR,MwMhNJIGR��JdhF�Ke�BMhI)bzR�Kc�JI�L��JfJXyMOaeF�f R�XYNBaeI$b�I�d�acMOdÉvwaefJacv²�Jv RzM ��I$UhF �lMhN>�Jd� 1 � ¦ �¬aed²R v�acfJaev²�Bv �·NBI�f � ¦ 3 � � � ��A {5F�U9bzR�Ke�JI$d«F�L·¦9x�UhI*R,MOI�U[MONµR�f MhNJaed9��I)NµR*b+I�MONBIUhI$K RzMhaeF+fBdhNJacT ¦ � � ¦ � � � 1 � ¦ � � � � 1 � ¦ � ��A P±N'�Bd�� L�UVF+v � � � � � � ¦w�lI F���MYR�acf� � � � 1 � ¦ � �JMhNJI\HJI�dVaeUhI$HGUVI�dV�JKcM�A��F��ÌIy|�TµRzfJHJaefBx ����������� �� ��� ��� � �"���$��� � ����I[x�I$M

� )Z�� � � � 1 ¢Ò��� �\��¥z��� � �RzL�MhI�U²X$UhF+dVd���v9�JKcMhaeTJK��acfJx)�lI�dVaevwTJKeaDL1 R�fJHÎF��BMOR�aefª� ) � �(� � 1� � � � 1 ¢Ò��� �Q�_¥>A � dhacfJx MONBIHJIy¹µfJacMhaeF+f)F�L ��IQx+I$M � )r¢V��� �Q�_¥«R�fJH NJI$fJX�I � �3)r¢Ò��� �Q�_¥>A�jlF+v �JacfJaefJx²MhNJaed·UVI�dh�BKcM±�·acMhN��]���¹µfJaedVNJI�d·MONBIQTBUhF'F�L�A

� � � � /)� �%$ � $�� � ��� ��� �Ð�f MONJacdQdVI�XyMOaeF�f ���lIwTJUhI$dhI$f>MQMONBI �JR�dhacXwacHJI*R�F�LÊMONBI�TJUVF�FzL�FzLlMONBIwX�R�dhI$dQ�·NBI�UhI ��F�MON R�aeUVX�UhRzL�M\R�UVIX��BUhUhI$fWMOK#�F+f MhNJI\P@7ȳ%�&ª&ª= / � ¢V�����y��» Á����Y �B¥ Ã*

�O���q� ¢V��� ��  ��,� � Ä�Ä ��� ���W����� ��� ��� � ����Y� �B¥ à ��¦ � ��� � ���¿�Y� �B¥ à ��¦ � ��� � ��¢h������� » ¢Ò���,��  �����$¡��B� ��!�,� � ����� !��� � �$��¦V� � ��!�,� � �'�W� !�,� � ����¦V�V�

^�@

Page 29: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

� �����°A�P±NJI[TBUhF'F�L�F�L�MhNJaed±KcI�vwvgR9acfWb+F+KDb+I�d·twX*R�dVI�d 7C+A��lFzMON R�aeUVX�UhRzL�M·F+f)dOR�vwIKeI$xÉF�L�MhNJI\P^�A·kqaeUhX$UORzL�M±R�UhI\F+f)F+TJT�F+dVacMOIKcI�x+d·F�L�MONBIQP@BAqp6fJIQR�acUhX�UhRzL�M±acd±F+f ¹JfµR�K�R�fBH MhNJI\F�MONJI$U·aed±F+f RÉKeI�xtJA��lFzMON R�aeUVX�UhRzL�M�R�UhIF�f ¹µfJR�K�A

� I\�·acKeK:aeKeKc�JdVMhUORzMhI MONBIQTBUhF'F�L�F�L�MhNJI¹µUhdÒM X�R�dhI�7

Á����Y �B¥ à ¢h�W� � 7¬½ �7Ä�Ä � ½ ��à %& � 3 ��!��� � �'�W� !�,� � ����¦V� �%& � 3 �"!��� � ���+� !��� � �$��¦V� ���

¢V�>�q� Á,��¢V��� �$¤���� & ��� & � ���� Ä�Ä ��  � ��¢��'����� ��� �,� � ����Y� �B¥ Á,�,¢Ò��� ��¤��'��¦ � ��� � ���¿�Y� �B¥ Á,�,¢Ò��� ��¤��'��¦ � ��� � ��DÄ���½ ��� � ¢h������� » ¢Ò���,�� �������¡��'� %& ��� %& � �

P�F�I$dVMYR��JKeacdhN�MONJI\X$F+fJX�Kc�JdhacF+f �JaDM±dh�!��X$I�d�MOFÉdhNJF��ÌMhNµRzM¡B�£¢��$� & ��� & � � ) ¢V��� �Q�_¥

i�aefBX�I �:FzMON R�aeUVX�UhRzL�M·R�UVIQF�f MhNJI\dOR�vwIKeI$x �B��IQNJR�b�I¡B�£¢���� & ��� & � � 3 ¡B�£¢�� ¤+�B¥��+����� � �$��¦V� � ¡B� ¢Ò� ¤+�B¥��+����� � �$��¦V� ��m+�

�.P�F)dhI$I²MONJacd6L�F+U MONBI«X*R�dVI²�·NJI�UVI ��F�MhN RzaeUhX$UORzL�M6R�UhI9F+f Á,�,¢Ò��� ��¤µ¼ �7fJF�MhI²MONµRzM & � 3 ��!�,� � �'�W� !�,� � ����¦V�dhacv�TBKeac¹JI�dlMhF � ��� �B¥ � �$¤µ¼ ��¡B�£¢�� ¤+�B¥��+����� � ����¦V�h�3R�fBH & � 3 �"!��� � ���+� !��� � �$��¦V�ldhacv�TBKeac¹JI�dlMhF� �'� ��¥ � ��¤J¼ �.¡B� ¢Ò� ¤��B¥��W�.�,� � ����¦V�V�yA � dhaefBxÉMhNJI\HJI$¹JfJacMhaeF+f)F�L � �'� �B¥ � ��¤µ¼ �B��I[NµR*b�I

& � ��3 ¡B�£¢�� ¤+�B¥��+����� � �$��¦V�21 �£��� ¼ �& � 3 ����� ¼ & � ��3 ¡B�£¢�� ¤+�B¥��+����� � �$��¦V�21 �£��� ¼ �& � 3 ����� ¼

L�UhF�v��·NJacXYN��.mW�3aed±F��BMOR�aefBI�H7A_�� �HJIy¹µfJaDMOaeF�f FzL�¡B� ¢Ò� ¤+�B¥��6��IQNµR*b+I

¦ 3 �Y� � ��������� � ��� � � � � ¡B� ¢Ò� ¤+�B¥��+����� � �$��¦V� 3 � �¦ 3 �Y� � ��������� � ��� � � � � ¡B� ¢Ò� ¤+�B¥��+����� � �$��¦V� 3 � �

� dVaefJxÉKcI�vwvgR²Ã ¢V�����y��» �����3��s+�9�B�lIQNµR*b+I� � � � � 3 ¡B� ¢Ò� ¤+��¥��W����� � �$��¦V� � ¡B� ¢Ò� ¤+��¥��W����� � �$��¦V� ) ¢Ò��� �\��¥

{µUhF+v�MONJacd6Á+���Y ��¥ à ¢V�>�q�L�F+KeKcF��·d�A

^zt

Page 30: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

ȳ%�&ª&ª= � � à ¢h����� ¢Ò��� �£��� �O���q� �£¢ �������� �£�����W����� ��� �,� � � ¦V����O���q� ¢V��� q�Q�_¥ ¢��+�$��¡ ) ¢Ò��� �\��¥,��O���q� ¢V���,�� ����O�£�B¥ ��� �����"�>����� �"� �,� � ����O���q� ¢V���,�� ����O�£�B¥ ��� e���'����� ��� ��� � ���¦ 3 �Y� � ���$����� � �$� � � ���¿¦ 3 �Y�=� �����.�,� � ����� � �

�cÄ���½�� � � � � � � � )r¢Ò��� �\��¥ ��s��� �����°A³{5UVF+v¿Ã �Y� ¢Ò��� � � �� c»��qÂ���  �

� �B7+�Y� � ���$����� � �$� �.� ) �Y�=�����$����� � �$� �.� 1Î�O���q� ¢Ò���Ð�f TµR�UVMhaeX$�JK R�U�MONJacd±aed3MOUV�JIL�F+U � � 7

�Y�=� ���$�.�,� � ����� � �4)¾�Y�=�����$����� � ����� � �21 �O���q� ¢V���i�acfJX�I�Y� � ���$����� � �$� � � � 3 �Y�=� ���$�.�,� � ����� � �lMONJacd �:I$X�F+vwI�d

�Y�=�����*�.�,� � ����� � � � �Y� � ��������� � �$� � � �*)¾�O�_� � ¢V��� ��~+�{µUhF+v�HJI$¹JfJacMhaeF+f)F�L��Y�=�����\�ÒC��%�B��I[x�I$M Q�Y� � ���$�������$� �.� � 3 C

¢��+���$¡ �� e� / � �W�.�,� � ¡ ����� � �.� ���+�

R�fJH)dVF � ���Y�=� ���$�.�,�*�������4)r�BAD��I�fJX$I�Y�=� ���$���.�laed±R�f�acfJX�UVI*R�dVaefJx²L��BfJX$MhaeF+f)R�fBH dVF � � ) � � A³{µUhF+v���+���lI[R�KedVF«F��BMOR�aefC

�\��¥ ¢��+�$��¡ )C

¢��+�$��¡ ��  � /�� �+����� � ¡ �£��� � ��� 3 � �5�Y�=� ���$�.�,�*�������

R�fJH)MON>�Jd

� � ����

C�\��¥ ¢��+�$��¡ � ) � � ����

�Y�=�����$�����������.� �'aeI$KeHJacfJx

� ��\��¥ ¢��+���$¡ � � �

�\��¥ ¢��+�$��¡ )¾�Y� � ���$�������$� � � � � �Y�=� �����.�,�*��� � � �

L�F+U·R�KcK�����A�k TBTJK#'aefBxÉMhNJaed3MhFw�,� � R�fBHG�JdVaefJxG�.~W�%�B��IQx+I$M�7� � �'�\��¥ ¢��+���$¡ � � � �>�Q�_¥ ¢�������¡ )¾�O���q� ¢Ò���

EG�JKDMOacTJK#'aefBx �:FzMON)dhacHJI�d �+ �Q�_¥ ¢������$¡ 'aeI�KcHJd� � � � � )¾�O���q� ¢V��� q�Q�_¥ ¢������$¡

�l�BM·L�UVF+v¿TJUVI�vwaedVIQ^!�J�lI\NµR*b�I�O���q� ¢V��� q�Q�_¥ ¢������$¡ ) ¢V��� �Q�_¥

R�fJH)��I[RzUhI\HJF+fJIzA

^+]

Page 31: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

ȳ%�&ª&ª= ? �h�9( ��& #�%>- % ��%>��!�� �¬%>��% �O���q� ¢V���,�� ����O�£�B¥ ��� �����"�W�.�,� ��� �,� � ���¿�O�_� � ¢Ò���,�� ����O�£�B¥ ��� c���'�.�,� ��� ��� � �

� ��� �B7+�Y� � ���$�.�,� � ��� �.� )¾�Y� � ��������� � �$� �.�21Î�O�_� � ¢Ò����� �ÒC��W�

� �����°A³{5UVF+v¿KcI�vwvgR)��C��%���lI\F��BMOR�aef

� �B7 \�Y�=�����*�.�,� � �����.� � ) \�Y�=�����*�.�,� � �����.� � � ¼

� �B7 \�Y�=�����$����� � �����.� � ) \�Y�=�����$����� � �����.� � �ÒC+C��

j3R�dVI�C�7���� �B7 � ���Y� � ���$����� � �$� �.� ) � ���Y� � ���$����� � �$� �.�h�97P±N>�Jd

� � � ����

�Y�=� ���$�.�,� � ������� � ) � � � ���

��Y� � ���$�.�,� � ��� �.�� �

R�fJH NJI$fJX�I�Y�=�����$����� � ����¡ �����h� � �Y�=� ���$�.�,� � ������� )¾�Y� � ��������� � ���.¡ �£���h� � �Y� � ��������� � �$� �.�

�·I*R�UVUOR�fJx�aefJx 7�Y�=�����$����� � �����.� � �Y�=� ���$�.�,� � �����.�*)¾�Y� � ��������� � ���.¡ �£���h� � �Y� � ���$����� � �$�.¡ �£���h�

{µUhF+v�HJI$¹JfJacMhaeF+f)F�L��O���q� ¢Ò���,��  ���O� �B¥ ��� c�����.�,� ��� ��� � ��Y� � ��������� � ���.¡ �£���h� � �Y� � ��������� � �$�.¡ �£���h�4)¾�O���q� ¢Ò���

R�fJH)MON>�Jd±��I9RzUhIHJF+fBI�Aj3R�dVI²^!7���� �B7 � ���Y� � ���$����� � �$� �.� ) � ���Y� � ���$����� � �$� �.�h�97P±N>�Jd

� �" �Y�=� ���$�.�,� � ������� � ) ���" �Y�=�����$����� � �$� �.� �R�fJH NJI$fJX�I

�Y� � ��������� � ��� �.� � �Y� � ��������� � �$���W� )¾�Y� � ��������� � ��� �.� � �Y� � ���$����� � �$���W��·I*R�UVUOR�fJx�aefJx

�Y� � ��������� � ��� �.� � �Y� � ��������� � �$� �.�4)¾�Y�=�����$����� � ���.�W� � �Y� � ���$����� � �$���W�{µUhF+v�HJI$¹JfJacMhaeF+f)F�L��O���q� ¢Ò���,��  ���O� �B¥ ��� �£�����>����� ��� �,� � �

�Y�=�����$����� � ���.�W� � �Y� � ��������� � �$���W� )¾�O�_� � ¢V���R�fJH)MON>�Jd±��I9RzUhIHJF+fBI�A

^�m

Page 32: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

� ��� � /)� �%$ � $ � ��� � ��� � � � �Ð�fGMhNJaed±dVI�XyMOaeF�f �µ�lI\�·aeKcK7TJUhI$dhI$f>MqMONJI �µR�dVaeX\aeHBI*R �:I$NJaefBH MhNJI[TBUhF'F�L�FzL�MONBI[X�R�dhI\�·NJI�UVI[F�fJI[FzL�MONBIR�acUhX�UhRzL�M�acd aef«UVI�x+acF+f �¾R�fJH«MhNJI·F�MONJI$U�aed acf«UhI$x+aeF+fÉÏ�A+P±NBaed�aed�acKeKc�JdVMhUORzMhI�H²acf²¹µx+�JUVIqm�A�i�acfJX�I±acf²MONJacdX*RzdhI³MONJIÊR�acUhX�UhRzL�M¬NµR*b+IÊfJF�M�UVI*R�XYNJI$H[MhNJI³P@��MhNJI³dhT�I�I$HJd�RzUhI³X�F+fBdVMYRzf>M�R�fJH\MONBI !����L��JfJXyMOaeF�f[dVaevwTJKeaD¹µI�dMOFQMONJIqv�FzMOaeF�fwFzL¬R[TµRzUVMOacX�KcI�F�f�R[dÒMOUORzaex+NWM�KeaefBI�A�Ð�fwL.R�X$M���aDMlacd�T�F+dVdha2�BKeI±MOF[UhI*RzdhF+f�R��:F+��MlHJacdVMOR�fJX�I$daef�R )>�µR�HJUVaeKeRzMOI$UOR�K¬UOR,MONJI$UqMONJR�f R���F+�BMqT:F�aefWMOdqv�F�b'aefJx�aef ^�` dhTJR�X�IzA{µ�JUVMhNJI�UVv�F+UVI�� �:I$X*R��BdhI²MONBIR�acUhX�UhRzL�MRzUhI«UhI$dVMhUhaeXyMOI$H � �+ TJUhFzMOF'X�F+K �·L�UhF�v I$f>MhI�UVaefJx�MONBI«UhI�XyMYR�fBx+�JK RzU6UhI$x+aeF+fBdK R���I�KcKeI�H ����RzfJHÏ��ºaef�¹µx��JUhI)m�MhNJI�TJUhF'F�L�aed )'�BacMOI�I$KeI$v�I$f>MOR�U��AªP±NJI$dhI UhI$x+aeF+fBd²NµR*b+I��·aeH�MON ¢Ò��� �Q�_¥��+^ dhF MONBI

path of aircraft 1

aircraft 2RX LX

a

b

c = d =IAF_R IAF_L

path of

{�aex��JUhI\m 7��·I�dÒMOUVaeX$MhI�H ��I$x+aeF�fJd

dhNBF+UVMhI�dVM�HJaedÒMYR�fJX$I.��I$M���I�I�f R�f+ T:F+dVdha#�JKeI)MOUhR:/VI�XyMOF+U� acdgx+UVI*RzMhI�U�MhNµR�f ¢Ò��� �\��¥>A ��F���I$b�I�U �qMONBITJUVF�F�L�NµR�d ��I�I$f L�F+UVvgRzKea �$I�H�RzfJHGXYNBI�X ��I$H aef)o ¸\i�A�P±NBI �zI R��BdVMOUhR�X$M�KcI�vwvgR9�lR�d�7

� ��� � � � ) � �� ��� � � � � ) � �� ��� � ¢V��� �\��¥,� � ) ¢V��� �\��¥,�� ��� � ¢V��� �\��¥���^ � � � ) ¢Ò��� �Q�_¥��+^ �� ) � � ) � ��B¥ ¢V�$¤B�q�z¥����'��%� � %� � %& � ����B¥ ¢V�$¤B�q�z¥����'� %� � % � %& � �� ¡B� ¢Ò��� %& ��� %& � �4) ¢Ò��� �\��¥

^+s

Page 33: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

P±NJI6TBUhI�vwaedVI�dÊ�·acMONwMONJIqTJUhI$HJaeX�RzMOIq�B¥ ¢Ò��¤B�q�z¥���$\X�F+fJdÒMOUhR�aef�KeF'X*RzMhaeF+fJd %& � R�fJH %& � MOF ��I dVF+v�Iy�·NJI�UVIF+f�MONBIQKcaefJIdVI�x+vwI�fWMhd·L�UVF+v %�ÉMOF %�6R�fJH %�qMhF %� UVI�dVT:I$X$MOaDb+I$K#+A

Ð�fWMOI�UVI�dÒMOaefBx+K#��+�lI±F+UVaex+acfµR�KcK#6I°|�T:I$X$MOI$HwMhF@�:I3R��JKeIÊMOFTJUVF�b+I3MONBaed�MhNJI�F+UVI�v§�·acMhNJF+�BM MhNJI3UVI�vwF�bzR�KF�L�MONJIÊUhI$dVMOUVaeXyMOI�H ��F+fBI�d�A�P±NJI�L�F�KeKeF��·acfJx3aef�L�F+Uhv�R�KWR�UVx+�JvwI�fWM¬�3Rzd�X$F+fJX�I$acb�I�H«R�d¬acKeKe�BdVMOUhRzMOI$H\aef\¹µx+�JUVIs�A i�acfJX�IwMONJIgR�aeUVX�UhRzL�MQR�UhI�F+Uhacx+aefJR�KeK�GdVI�TµRzUORzMhI�H RzMQMONBI�aeUQI�fWMhUOR�fJX$IgMOacv�I$dQR�fJHªMhNJI�TJRzMONJd[I�aDMONJI$U

IAF_R IAF_L

path of aircraft 1 aircraft 2

path of

{�aex+�BUhI\s!7Êi'F+v�I\´�UVUhF+fJI$F+�Jd�P±NJaef �'acfJx

HJaDb+I�UVx+I\F+U·X�F+fWb�I�Uhx�I �J��MqfBI$b+I$UqX$F+vwIQX$KeF+dVI�U3MhF+x+I$MhNJI�U±MhNµR�f)MONJI\KeI$fJx�MhN FzL F+fJI\F�L�MONBIQKcI�x+d±FzL�MONBIP@��MhNJI 9v²�JdVM��:I·R�HBI�)>�µRzMhI�K#9dhI$TµR�UOR,MOI�HÉfJFv�RzMVMOI�U��·NµRzM MhNJI±UhI$K RzMhacb+IldhT�I�I�HBd�RzUhI�A � fBL�F�UVMO�BfµRzMOI$K#MONBaed �����3! ��� ��1��� �&� �-,��� ��MONJI$F+UhI$v$"²acdÊL.RzKedhI�� �rNµRzMlMONJIqaefBL�F+UVvgRzKµUhI*RzdhF+fJacfJx²F�b+I$UhKcF�F��zI�H�acd�MONBIqL.R�XyMMONJRzM MhNJI9F+UVaex+acfµR�K�dVI�TµR�UhRzMOacF+f�x��µR�UORzf>MhI�I9R�TJTJKcaeI�d��·NJI�f MhNJI[¹JUhdVM6R�aeUVX�UhRzL�M I$fWMOI�UVdR�fJHGMONJI²dVI�X$F+fJHR�acUhX�UhRzL�Mwaed ����!*1*1����'�*��!� ',ÉF�L6MhNJI i'k�P�i R�aeUVdhTµRzX�I�A p6fJX$IGMONBI ¹µUVdVM�R�aeUVX�UOR,L�M�I$fWMOI�UVd��3MhNJI�UVI�x+acF+fµR�KX�F�f>MhUhF+KcKeI$UwfBFªKeF�fJx+I�UÉNµRzdgUhI$dhT�F+fJdVa2�JacKeacM� L�F+UwdhI�TJR�UORzMhaeF+f"A �rNµRzMw�lIGHJaeH<fJF�M�UhI*RzKea �$I��3R�dwMONµR,MMONBI�UhI²��I�UVI�HBacb+I$Uhx+I$fWMMOUOR /VI�X$MhF+UhacI�d6�·NJI$UhI«MONBI«H 'fµR�vwaeX²T�F+aefWMFzL�X$KeF+dVI�dÒM9RzTJTJUhF+R�XYN F�X$X��JUVd\RzL�MOI$UMONBIq¹µUVdVM±RzaeUhX$UORzL�MÊI$f>MhI�UVdlMONJI6i�k�P�i�R�acUhdhTJR�X�IzA P±NJaed�aedÊaeKcKe�JdÒMOUOR,MOI�HÉacf�¹µx+�BUhI6~�A�P±NJI T�F+aefWMhd�KeR��:I$KeI$HkºR�UVIgMONJI�KcF�X�RzMOacF+fJd[F�L·MONJI)R�acUhX$UORzL�M[�·NJI�f<R�aeUVX�UhRzL�M�C�¹µUVdVMÉI�fWMhI�Uhd$A �qI$UhI�MhNJI ÎRzUhI�R�HBI�)>�µRzMhI�K#�J�BM²v�acfJaev�R�KeK� dVI�TµR�UhRzMOI$H7A �qF���I$b+I$U«�·NJI�f MONBI�dhI�X$F+fJH R�acUhX�UhRzL�M[aed9L.R�dÒMOI$U²acM[MOUOR*b�I�Ked[L��JUVMhNJI�U«acfacMhd6MOUhR:/VI�XyMOF+U��MONJR�f MONJI«¹µUVdVM[R�aeUVX�UhRzL�M6F�b+I$UQR�MhaevwI²aefWMhI�UVbzR�K�A9P±NJI$UhIyL�F+UhIÉdhNBF+UVMhK# R,L�MOI�U\RzaeUhX$UORzL�M9CI�fWMhI�Uhd ���·NJI$f MhNJI R�UVIwRzM\MONJIwT:F�dhacMhaeF+fBd6K R���I�KcKeI$H �§MhNJI R�UVIÉX�KeF�dhI�UMhF+x+I$MhNJI�U\MONJR�f �·NBI�f MhNJI ��I�UhI[RzM·T�F+aefWMhd±k9AµP±NJI$UhI$L�F�UhI\dhI$TµR�UOR,MOaeF�f acd±KeF+dÒM*AÊE�Rzf gb�Rzaef RzMhMhI�vwTBMOd3��I�UVI[v�R�HJI6MhFÉTJUhF�b+I\MONBIdhI$TµR�UhRzMOacF+fGTBUhF+T�I�UÒM�Gacf MhNJI[o�¸i)MhNJI�F+UVI�vºTJUVF�b�I�U²�.I�AuxJA3�BdhaefBx�b+I$X$MhF+UqL�F+UVv²�JKeR�d3L�F+U±MONJIQT�F+aefWM�F�LX�KcF+dhI$dVMqR�TJTBUhFWR�XYNµ� ��I$L�F�UhI\acM3�lR�d�UhI�R�Kea���I�H�MhNµRzM·MONBI �ÒKeI�vwv�R�"9�lR�d·fJF�M·MOUV�JI�A

� ��� � /)� �%$ � $ � ��� � ��� � �

�rNJacKeI�aef6MhNJIÊTJUhF'X�I$dhd¬F�LB�·UVacMhaefJx±�JT\MONBaed�TµR�T�I�U �,��I³HJI�X$aeHJI$H[MhFqR,MhMOI$v�T�M�MONJI³TJUVF�F�L�F�LBR�fJF�MhNJI�U¬X�R�dhIzAi�acfJX�IQ�lI«NµRzH fJF�Mqb+I�UVac¹µI$H R�f+�X�R�dhI$d6�·NJI�UVI²F+fJI²R�aeUVX�UOR,L�M��lR�dF+fGMONJI[P RzfJH�MONBI²F�MONBI�U6RzaeUhX$UORzL�M

^�~

Page 34: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

IAF_R IAF_L

path of aircraft 1

parg of aircraft 2

A

BA

B

{�aex+�BUhI~ 7Êi'F+v�I\´�UVUhF+fJI$F+�Jd�P±NJaef �'acfJx

�lR�dldÒMOaeKcK5R�TJTJUVFWR�XYNJacfJx[MhNJI P@�W��I6HJI$X�aeHBI�HgMhF9RzMVMOI$v�TBMlR[TBUhF'F�L7F�L7¢h�����$�.» Ä ÃC�+�·NJI$UhI6F�fJI RzaeUhX$UORzL�Maed·acfGUVI�x+acF+fGt�R�fJH�R�fJF�MhNJI�U�F+fJI\acdqF+f)¹µfµRzK�RzTJTJUhF+R�XYN7A �rNJacKeIQRzMVMOI�vwTBMhaefJx«MOFwTJUVF�b�I[MhNJaed·X*RzdhI���acM�lR�d HJacdhX$F�b�I�UVI�H MONµR,MqMhNJaed�KeI$v�v�R²�3R�dqfJF�MqMOUh�BI�A·Ð�f�MONBaed�X*R�dVI[MONBI�UhI9aed·fJFgMhaevwIQd�'fJXYNJUhF�fJa ��RzMOacF+fI�f�L�F+UhX$I�H �+<MhNJI�k6E E F+f MONJI RzaeUhX$UORzL�M�RzM�MONJI$aeUÉb'aeUVMh�µR�K·F+U�UhI*RzKqÐ�k {�d�A � fBL�F+UÒMO�JfJRzMOI$K# MOacv�Id�'fJXYNBUhF+fJa��*RzMhaeF+f[RzM¬MONBI�Ð�{ �.acfJacMha R�K�¹B|J��RzfJH ��P �.UV�JfW�3R8\MONBUhI�dVNJF+KcH5�¬acd�fJF�M�dh�!��X$aeI$f>M�MOF·x+�µRzUOR�fWMOI$IMONJRzM±MONJI% R�UhIx�I�F+vwI$MhUhaeX�R�KeK�wdhI�TJR�UORzMhI�H�RzM�R�KeK:MOaevwI�d$A P±NJI$UhI[R�UhIM���F�T�F+dhdVa2�JKcIUhI$dhF+Kc�BMOacF+fJd�7C+A �·I�)>�JacUhIMOacv�I6d�'fJXYNJUhF�fJa ��RzMOacF+f RzM·MONJI\Ð�k6{�d�A^�A � I�fJI$UOR�Kca �$I[MONBI²fJF�MhaeF+fGF�L³¢h������� » ¢V���,�� �������¡)MOF�R�KeKcF��ÌTµRzMON dVI�TµRzUORzMhaeF+f acf�MONBI�dhI«X�R�dhI$d\R�d6acfMhNJI\��� ��¢V� �$�- �¥��� �dVacMO�JRzMOacF+f7A

ЮL�MONBI6dhI$X�F+fJH)dVF+Ke�BMhaeF+f�aed�dhI�KcI�XyMOI�H �BMONJI HJI$¹µfBacMOacF+fgFzL¬¢h������� » ¢V���,�� �������¡É�·aeKcK�NJR�b�I6MOF²XYNJR�fJx+I$H�L�UhF+v

¢V������� » ¢Ò���,��  �����$¡�����%& ��� %& � �('¡B� ¢Ò����%& ��� %& � �*) ¢Ò��� �\��¥,+���B¥ ��� �+¢Ò� ���- �¥��� .�'��%& ��� %& � ���À¡B�£¢��$��%& ��� ��!� /-0+�21 ¡B� ¢Ò����%& ��� ��!� /30��4) ¢Ò��� �\��¥z�

MOFÉdVF+v�IyMONJacfJxÉKea#��I

¢V������� » ¢V���,�� �������¡��'��%& �"� %& � � '¡B�£¢�����%& �"� %& � � ) ¢Ò��� �Q�_¥,+�.��¥�� /:¥,�-� ��¥�� �·� �YÂ+�_¥ �£�����W��%& ��� %& � ���À¡B�£¢��*��%& ��� ��!� /30+�21ΡB�£¢��$��%& � � �"!� /-0+�4) ¢V��� �\��¥z�

^��

Page 35: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

P±NJI�¹µUVdVM«UVI�dVF+Ke�BMhaeF+fªaed²R XYNJR�fJx+I�MhF�MONJI�F�T:I$UORzMhaeF+fµRzKÊX$F+fJX$I�TBMÉaDMOdhI$KcL����·NBI�UhI�R�d²MONBI�dhI�X$F+fJHÎaed9RXYNµR�fBx+I MOF�MONBI dhRzL�I$M�¾TJUhF+T�I�UÒM�¾aDMOdhI$KcL�A P±NJI ¹µUhdÒM UhI�dVF+Ke��MOaeF�f¾�lF+�BKeH aevwT�F+dhI dVF+vwI R�HJHJaDMOaeF�fµR�KMOacv�acfJx X�F+fBdVMOUhR�aefWMhdwMhNµRzMw�lF+�BKeH NJR�b�I�MOF �:I I�f�L�F+UhX$I�H �+ÎMONJIGkE E R�fJH X$F+fJdVI�)>�JI�fWMhK#<X�F+�JKcHUhI$HJ�JX$I�MONJI�T�I�UÒL�F+Uhv�R�fJX$I�A � I�dh�JdVT:I$X$M«MhNµRzM²MhNJI�aevwTµR�XyM[��F+�JKcH �:I�L.R�aeUVK# dhv�R�KcK �B�B�BM²MONBaed[�·acKeKNµR*b+IMhF ��I\R�dVdhI�dVdhI$H�b'a R«dhacv²�JK R,MOaeF�f7A�kqKcMhI�UhfJRzMOaDb+I�K���'MONJI\UhI$K R,|BRzMhaeF+fgF�L�MhNJIdOR,L�I$M�)TJUVF+T:I$UVM�gHJF�I$dfJF�M±R�TJT�I*R�UlMhF �:I�BfJUhI�R�dhF+fJR��JKeI aef�MONJRzM±acMlaed3HBaeUhI$X$MhK#gR�fµR�KcF+x+F+�JdÊMOF²�·NµR,M±aed±RzKeUhI�R�H �HJF+fJI6�·NBI�f��F�MON R�acUhX�UhRzL�M·R�UVIF+f�MONJI\PAµÐ�f)L.R�X$M·acf�MONJacd±dhaDMO�µRzMhaeF+f�MhNJI\x+I�F�v�IyMOUhacX6dhI$TµR�UhRzMOacF+f)aed±x+UVI*RzMhI�U3MONJR�f�·NJI$f ��F�MON R�acUhX�UhRzL�M·R�UVI\F+f�MONJI\PA

� ���w���� 8� ���w�

Ð�f MONJacd²TµR�T�I�U[�lI)NµR*b+I�TBUhI�dVI�fWMOI$H¾R�L�F+UVvgRzK�vwF�HBI�KlFzL R X$F+fJX$I�TBM«L�F+U9dhI�)>�JI$fJX�acfJx R�aeUVX�UOR,L�M²aefWMhFR i�k�P�i<RzaeUhT�F+UÒM²�·acMhNJF+�BMwR MOF���I�U �lUORzHµR�U��ÊF+UÉR�acUhT�F+UVM²X�F+fWMOUVF+KeKcI�U$A�P±NJI X�F+fJX$I�TBM�UhI$KeacI�d«�JT�F+f RMOacv�acfJx²TJUVF�MOF'X�F�K7aevwTJKeI$v�I$fWMOI�Hgaef)dhF�L�M��lR�UVIQfJR�v�I$H�MONJI\k acUhX$UORzL�MqE�RzfµR�x+I$v�I$f>MqE F�HJ�BKeIw�.k6E E �°AP±NJI3X$F+fJX$I�TBM�NJR�d���I�I�f²L�F�Uhv�R�KeK�6vwF�HJI$KeI$H9�JdVaefJx ��F�MhN²X�F+fWMhaef>�JF+�Jd R�fJH²HJacdhX$UhI$MhI3v�RzMONJI$vgR,MOaeX$d�RzfJHX�F�fJdhacdVMOd�F�L�MONJUVI�I³vgRzaef\TJaeI$X�I$d�7��ÒC��¬EGF'HJI$K'FzL�MhNJI3i'k�P�i[R�acUhdhTJR�X�I³�JdVaefJx ^:��HBaevwI�fJdVaeF+fµRzKzb+I$X$MhF+Uhd �µ��^��vwF�HJI$K+F�LBR�aeUVX�UhRzL�M7MOUhR:/VI�XyMOF+UVaeI$d�Rzd¬L��BfJX$MhaeF+fJd¬F�L'MOacv�I�MONµRzM�R�UVI�HJI$MhI�UVv�acfJI�H �+\R�aeUVX�UhRzL�M�dhT�I�I$H �z�·NBaeXYNaed�HJI$T:I$fJHJI�fWM�BT:F+f MONJIQUhI$vgRzaefJacfJxÉHJaedÒMYR�fJX$IQMhF�MhNJI9UV�JfW�3R8 MONJUVI�dhNBF+KeH ��R�fBHÎ��@W�±RwUhI�)>�JacUhI$v�I$f>MhdvwF�HJI$K�FzLÊMhNJI«kE�E �"�·NJacXYN dhT�I�X�aD¹µI�d6MhNJI«NJacx+N!��KcI$b�I�K¬MOaevwaefBxgTJUVF+T:I$UVMhaeI�d I�fBL�F+UVX�I$H �+GMONJI²k6E EdhFzL�M��3R�UVI�A

kÎvgRzMhNJI�v�RzMhaeX*RzK,MhNJI�F+UVI�v1NµRzd ��I�I$fQL�F�Uhv²�JKeRzMOI$H6�·NJaeXYNQdVMORzMOI$d�MhNµRzM�MhNJI³kE E MOaevwaefBxlTJUVF�MOF'X�F+K�·aeKcK¬vgR�acfWMYR�acf�R�HBI�)>�µRzMhI²dhI$TµR�UOR,MOaeF�f.�:IyM��lI$I�f R�KcK�RzaeUhX$UORzL�M R�dVdh�JvwaefJxwMONµR,MR�KcK�RzaeUhX$UORzL�M�L�F+KcKeF��ÌMONBIaefBdVMOUV�JX$MhaeF+fBd x+acb�I�f �+²MONBI±kE EºR�fJH«MONBI �VUh�JKcI�d FzL:MhNJI±UhFWRzH "\R�dhdVF�X$a RzMhI�H«�·acMhN²MONJI±X$F+fJX$I�TBM�A�P±NJITJUVF�F�LÊF�LÊMONBaed MhNJI�F+UVI�v �lR�d\HJI$X�F+vwT:F�dhI�H acf>MhF�MOI$f X�R�dhI$dQFzLÊ�·NBaeXYN ¹Jb+IÉNµR*b+I ��I�I$f TJUVF�b+I�H"A«P±NJITJUVI�Keacv�acfµR�U��X$F+fJX$I�TBM�vwF�HJI$KeI$H�aef�MONJacd±TµR�T�I�U3�lR�d·HJI$b�I�KcF+T:I$H m«vwF+fWMONJd±TJUVaeF+U�MOF«MONJI\X$F+v�TBKeI$MhaeF+fF�L�MONJI[i�k�P�i)HJUOR,L�M\C[F+T�I�UhRzMOacF+fµR�K:X�F+fBX�I�T�M dVFwMhNµRzM±L�F+UVvgR�K�b+I$Uhac¹JX*RzMhaeF+f)MOI$XYNJfJa2)>�JI$d RzfJHGKca2�JUhR�UhacI�ddh�BacMYR��JKeI«L�F+U\MONJacd[TBUhF��JKcI�v HJF�vgR�acf X$F+�JKcH ��I�HJIyb+I$KeF+T�I�H7A,�qF�T:IyL��JKeK����v²�JXYN�F�LlMONJIwMONJacdQ�·acKeK ��IUhI$�JdhI$H��·NJI�f�MhNJI ¹µfµRzK�i�k�P�igF+T�I�UhRzMOacF+fµR�K5X$F+fJX�I$TBM±acdlvwF�HJI$KeI$H�R�fJH)RzfµR�K# �$I�HgL�F+UVvgRzKeK#�A�Ð�f�F�UhHJI$UMOFÉvwF�b+I\F+f)MOF«MONJI¹µfJR�K�i�k�P�i�F+T:I$UORzMhaeF+fJR�K"X$F+fJX�I$TBM8�µMhNJIb+I�UVac¹µX�RzMOacF+f��3RzdqfJFzM±L��JKeK�gX$F+v�TBKeI$MhI�H7A� I ��I�KcaeIyb+I MONJRzM�MONJI³X$F+v�TBKeI$MhaeF+f F�Lµ]z��� F�L'MONBI�dh� ��X*R�dVI�d�aed7I$fJF+�Jx+N\MOF·HJI$v�F�fJdVMhUORzMhI³MhNJI L�I*Rzdha2�BaeKeaDM�F�L�MhNJaed b�I�UVac¹µX�RzMOacF+f R�TJTBUhFWR�XYN Iyb+I�f MhNJF+�Jx+N Iyb+I$U�>MONJacfJx��lI«dVI$M\F+��M6MOF�RzX�X�F�v�TJKcaedVN aef m�vwF+fWMONBd�lR�d�fBF�MɹµfJaedVNJI�H"A-��F���I$b�I�U � �:I$X*R��JdVIGFzLqMhNJIGacfJX�F�v�TJKcI$MhI�fJI$dhdÉF�L�MONJI TJUhF'F�L�d²��IGHBF fJFzM$�>fJF���·NJIyMONJI$UlMONJIqTJUhI$Keacv�acfµR�U�[X�F�fJX�I$TBM±acMhdhI$KcL7acd�dhRzL�I�A � I�NµR*b+I6UV�Jf�v�R�f+Édhaev9�JK RzMhaeF+fBd�F�L7MONBI X�F�fJX�I$TBM�J�BM��lI HJF²fJF�M(�:I$KeacI$b+I·MONJRzM3dVaev²�JKeRzMOacF+fwR�KeF�fJIqTBUhF�b'aeHJI$d±R9UOR,MOaeF�fµR�K �µR�dVaedÊL�F+UlRzdhdh�BUhaefBx²dORzL�IyM�+A � IHJF ��I�KeacI$b�IgMONµR,M«�·acMON dV� �wX�acI�fWMwI �:F+UVMG��TJUhF��JR��JK#�^�MOF t v�R�f v�F�f>MhNJdY�[MhNJI�UhI$vgRzaefJacfJx�TJUVF�FzL�dX�F��JKeH$�:I�X�F+vwTJKcI$MOI$H��·aDMON�R,M�vwF+dÒM�L.R�acUhK�²vwaefJF+U³vwF�HBac¹µX�RzMOacF+fJd MOFQMONJI�kE�E TJUhFzMOF'X�F+KcdÊF�U�dÒMYRzMhI�HdOR,L�I$M�)TJUVF+T:I$UVMhaeI�d$A

���+� �³�6�����

4 C�6�� , ',�� �"1�� �3!��"��! �&)�� ,4#��'1$�"�0! �&)���� ,����&) ��� ��! � �"1 ��) �&� 5 �"�0! �&)�� �") � �"1 A���I$TJT:I$dhI$fwiBR�fJHJI$UhdVF+f²Ð�fJX��C��+�+�BA

@+�

Page 36: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

4u^069j3R�UhUVI�fJF ��¸6aeXyMOF+U 7ZjlF+fJX$I�TBM²L�F�U«EG�JKDMOacTJKeI�p6T:I$UORzMhaeF+fBd9RzM qF+f���P�F���I�U qF+f!� �qRzHµR�UQk aeUVT:F�UVMOd`6�JUhacfJx3Ð�fJdÒMOUh�Bv�I$f>M�EGIyMOI$F+UhF+KcF+x+acX*R�K�jlF+fJHJaDMOacF+fJd�A,Ð�f � ��� � , , "!*)'#&� �� �7%/,���� ) ���!$#"!*� �"1�� �3!��"��! �&)� �;����,�5�� �&) �,��-,�) � ,%�JÐ�fJHJaeR�fµR�T�F+Kcaed��'Ð�fJHJaeR�fµR �µpXyM*A�^����+@BA

@BC

Page 37: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

� � �@�·��� �Ê�� ����1� � =

P±NJI qk6i�kZo�¸i)Kca2�JUhR�U��X�F�f>MOR�aefBd3MONJUVI�IQHJaedÒMOaefBX$M±b+I$X$MhF+Uhd�Kea#�JUOR�UVaeI$dC+Aq^:�®HJaevwI�fBdhaeF�fµR�K5b+I�XyMOF+UVd^�A�@0�®HJaevwI�fBdhaeF�fµR�K5b+I�XyMOF+UVd@BA ��HJacv�I$fJdhacF+fµR�K�b+I�XyMOF+UVd

p6fJI�v�acx+NWMÊ��F+fJHBI�U��·N+ÉMONBI�UhIqdhNJF��JKeH �:I ^�`ÌRzfJH�@+`rb+I$UhdhacF+fJd �'�·NJI$f)R�f ��HBaevwI�fJdVaeF+fµRzKBb+I$UhdhacF+faed R*b�RzaeK R��JKeIzA�P±NBIÉR�fJdV��I�U aedqMhNµRzMqMONJI$UhI«R�UVI²dhF�v�I[fJF�MYR,MOaeF�fµR�K¬X�F+fWb�I�fJacI�fJX$I�dL�F+U HBF+aefJxwMONJacd�A{µF+UIy|BR�vwTJKcI��Jacf)MhNJI[^�`1b+I�UVdhacF+f ��IQUhI�TBUhI�dVI�fWM R«b�I�XyMOF+UqR�d

�������� ������ ��������� ��� � �! "��#�$ ��%

�·NJI$UhI*Rzdqacf)MhNJI �®HJaevwI�fJdVaeF+fJR�K"Kca2�JUhR�U�gR²b+I�XyMOF+U�aed

&�'"("� � �)��� �����+* �"$��-,/.0'21�������� �)��� ������� &�'"("� ��354 "�5#"$ %

�·NJI$UhI\¥aed³RL�F+Uhv�R�KJTJR�UOR�vwI$MhI�Uq� ���+¢°¥,���V��MOF\MONBI·MhNJI�F�U�+A�P±N>�Jd �BacfÉMhNJI·M��lF[HJaevwI�fJdVaeF+fJR�KBX�R�dhI���MONBI| ��X$F+v�T�F+fJI$fWMlF�L�RQb+I$X$MhF+U � acd �56 0\�·NJI$UhI�R�d3aefÉMONBI� �®HJaevwI�fBdhaeF�fµR�KJKca2�JUhR�U�«aDMÊaed � ��7 �°A k KcdhFQX�I�UÒMYR�acfF+T�I�UhRzMOacF+fJd·R�UVIx+UhI�RzMOK��dhacv�TBKeac¹JI�H�aef�MhNJI[^�`1X*R�dVI�AÊP±NJI\HJF�M�TJUhF'HJ�JXyM·aed

8 .09 �;: 1<� "��#"$ � 9�= � 8 : = �?> 9�= � 8 : = ��@ A (B�-DC" B��(E92�

aef�MhNJI[^:��HJacv�I$fJdhacF+fµR�K�X*RzdhI��µ�·NJI$UhI�R�dqacf�MONJI �®HJaevwI�fBdhaeF�fµR�K�X*R�dVI[aDM±aed

8 .09 �;: 1<� "��#"$ �GF5HIKJ #L.NM � ' 3POQ�;R�����SUT��VH �W9/. H 1 8 : . H 151 @ A+T �- � B��(E9P�-

�·NJI$UhIQdhaex�vgR²acd·RÉdV�JvwvgRzMhaeF+f�F�T:I$UORzMhF+U±aevwT:F�UVMOI$H�L�UhF+v�MONJI\UVI*R�Kcd±Kea2�BUOR�U�+AÐ�f�MONBaed6RzTJT:I$fJHJa}|G��I9�·acKeK�TJUVI�dhI$fWMMONJI²^:��HJacv�I$fJdhacF+fµR�K7b�I�UVdhaeF�f.�:I$X*R��BdhI9MhNµRzM6acd��·NJRzM6acd �JdVI�H

aef MONJI i�k�P�iª��F+U��5A �qF���I$b+I$U��ÊMONJI�HBa#�:I�UhI$fJX�I$dÉaefªMhNJI�Kea#�JUOR�UVaeI$d9R�UVI>��I$TBM«MOF R vwaefBaev²�Jv A�kqKeKF+T�I�UhRzMOF+UVd��ÊHJI$¹JfJacMhaeF+fJd �lRzfJH<KcI�vwvgRzd«R�UhI)x+aDb+I$f<acHJI�fWMOacX*R�KlfµR�vwI�d«MOF dhacv�TBKeacL1 MhNJIG�BdhI)F�L MhNJI�dVIKea#�JUORzUhaeI$d�A

� ��� � � � !#0 & �%//P3��F�fµRzv�I$dqRzUhIQR*b�RzaeK R��JKeI�L�F+U·R²b+I�XyMOF+U·M�'T:IQR�UVI\TJUhF�b'aeHJI$HGacf�MONJIMONBI�F+U� � ���y���3 e¢ � ±A

�������� �)��� ��������� ��� � �) "�5#"$ ��%�����BX �)��� ����� �����Y�K

P±NJI\b+I$X$MOF�U�F�T:I$UORzMhF+Uhd�R�UVIHJI$¹µfBI�H Rzd·L�F�KeKeF��·d 7

@W^

Page 38: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

# �)� ��� "��#"$9 �0:/� , �)� ��� ��������

3 . : 1 �)�������� � . 3K: = ��� 3K: = � 1 @

> .09 �;: 1<���������� � .09�= �?>+: = ��� 9�= � >+: = � 1 @

3 .09 �;: 1<���������� � .09�= ��3 : = ��� 9�= �?3 : = � 1 @

8 .09 �;: 1<� "��#"$ � 9�= � 8 : = �?> 9�= � 8 : = ��@ A (B�-DC" B��(E92�

8 .N# �;: 1<���������� � .N# 8 : = ��� # 8 : = � 1 @

k§X�F+fWb�I�UhdVaeF+f aed±TBUhF�b'aeHJI$H�dhF«MhNµRzM�F+fJIX�R�fGX$UhI�RzMOI9^�`Ìb+I$X$MOF�UhdqR�d±L�F+KeKcF��·d

. �U:��;�U: 1

UOR,MONJI$U·MhNµR�f)NµR*b'aefJxÉMOF«�·UVacMOI

. � � � �D�U:/� � � � ��:D� 1

P±NJI$UhI[R�UhIdVI$b+I$UOR�K¬L��JfJXyMOacF+fJd·R�fJH TJUVI�HJacX*RzMhI�d·TJUhF�b'aeHBI�H dh�JXYN�R�d

F��E: . : 1<�)'�'" "�5#"$ � : 8 :'��� J . : 1<�)'�'" ���#"$ � F�� U�. F��E: . : 151

� �E B� �K: ������ �� . : 1�� � ����� * ����$ � .0'��� J . : 1 � M �� �T: = �?� M �� UT?: = �?� MY1

' � �K: ���Y�� �� . : 1 � � ����� * ����$ � .0'��� J . : 1�� � M �� �T. : = � � � M ��D: = � � � MB1�1

'��� J #"$ H � �U(�� . : 1 � � ����� * ����$ � .0'��� J . : 1 � O 1

� �E B� �����U B� �K: �B�Y�� � .NM � MB1 @

�Q.0' � : 1 � �� J #"$ H � �E( � . O �'��� J .0' � : 1�1 8 ' � :

CB#E "#�$�$E�"$��<.0' � 9 � ' � : 1<� * ����$ � �Q.0' � 9 1 8 �Q.0' � : 1 � O�����Q.0' � 9 1 8 �Q.0' � : 1 � 3�O

�� U��P� I �'B#�$�� .09 �;: 1<� * ����$ � 9 8 :?� M @

P±NJI$UhI[R�UhIdVI$b+I$UOR�K�HJF �$I�f KeI$v�v�R�d±R*bzR�aeKeR��JKcIqL�F+U±v�R�fJacTJ�JK R,MOaefBx[b+I$X$MhF+Uhd�dh�JXYN�R�d

#E(�( � # F�F �5� � R�� ��� � 9 > . :�> ,P1 � .;9 >E: 1 > ,#E(�( ��J � : � � HI �5 � R�� ��� � 9 > , �+: &����+9 � : 3 ,

@+@

Page 39: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

#E(�( � �K#�'P�K��$ � $E���� � R�� ��� � 9 >+:?� 9 > , & ���5R & ���+:�� ,'B� I � ( HUF 5 ��F 9 * � R�� ��� ��3 . : 3 9 1 � 9 3 :(B�- � � ��� #E IYF��EI � � R�� ��� � 9 8 9 4U� M(B�- � ( HUF 5 � #E(�( � HI �5 � R�� ��� � . :"> ,21 8 9 �+: 8 9 > , 8 9(B�- �BF �K#"$ � $E���U � R�� ��� � .N# 8 9 1 8 : � # 8 .09 8 : 1(B�- �BF �K#"$ � �K#�'��' � R�� ��� � .N# 8 9 1 8 . * 8 : 1 � . # 8 * 1 8 .09 8 : 1F��E: �BF �K#"$ � R�� ��� � F��E: . # 8 : 1 � F�� .N#B1 8 F��E: . : 1F�� U ��F��E: � '��� J � R�� ��� � F�� U/. F��E: . : 1�1 � '��� J . : 1'��� J � � ��� M � R�� ��� � '��� J . : 1 � M & ��� : � � �E Y��K#�9P� � � ��F � �5,�#E U � � R�� ��� � F�� .09 8 : 1�� �GF��E: .09 1 8 F��E: . : 1

� ��� � � � &/� � �= � � � � -�,10 !P±NJI«MONBI�F+U� �+��¢°� �O�£�B¥�¢ �� I�fJNµRzfJX�I$dQMhNJI²b+I$X$MOF�UQdVTµR�X$IÉ�·aDMON X�F�fJdVMhUh�JXyMOdL�F+UdhT�I�X$acL1'aefBx�HJaedÒMYR�fJX$I�d$Ap6fJI±L�UhI )'�BI�fWMOK�w�lR�fWMOd³MOFQ�JdVI R6b+I$X$MhF+U�MhFQHBI�dhacx+fµRzMhI�RQKcF�X�RzMOacF+f«aef�^�` dhTµR�X$I�A�P�F[v�R��zI·MhNJaed³vwF+UhIIy|�TJKcaeX$acM8�'MONJIL�F+KcKeF��·aefBx9M�'T:IQHJI$¹JfJacMhaeF+f��lR�dqR�HJHJI$H� � F X T ����� ����� �B����X

MONBF+�Jx+N acM±acd±UhI�R�KeK� /V�JdÒMqRwd��fBF+f+�v A qI°|�MqacM3aed±�JdVI$L��JK�MOFÉNµR*b�I9R«vwI$MOUVaeXF+U±HBaedVMOR�fJX$I\L��BfJX$MhaeF+f 7F���� ( HUF �.0C OQ� CBX�� � � F X T 1<�)'�'" "��#�$ � F�� .0C O = � 3 CYXL= � 1 >�F�� .0C O = ��3 CBXL= � 1

( HUF /.0C OQ� CYX�� � � F X T 1 �!'�'" "��#�$ � F�� U/. F���� ( HUF �.0C OQ� CBXB151

E�R�f+)KcI�vwvgR�dlR�UhIQR*bzR�aeKeR��JKcI��'aefJX$Ke�JHJacfJx( HUF � "���B$ � RU� ��� � ( HUF �.0C � C 1 � M( HUF ��F-�KJ � RU� ��� � ( HUF �.0C OQ� CBXB1 � ( HUF �.;CBX � C O 1( HUF � � ��� M � RU� ��� � ( HUF �.0C OQ� CBXB1 � M & ��+C O � CYX( HUF � '��� J � RU� ��� � ( HUF �.09 �0: 1 � '��K J .09 3E: 1F���� ( HUF � $U� � RU� ��� � F���� ( HUF �. : OQ�0: XY1�� �GF���� ( H�F �.0C O � CBXB1 & ���5R & ���

( HUF �. : OQ�;: XB1�� � ( HUF /.0C OQ� CYXB1( HUF �EI � �E� � RU� ��� � ( HUF �.0C OQ� CBXB1 4U� # *PF .;C O = �G3 CBXL= � 1( HUF �EI � �E� � RU� ��� � ( HUF �.0C OQ� CBXB1 4U� # *PF .;C O = �G3 CBXL= � 1( HUF � 5 H #K' I $E��� RU� ��� � F�� . ( HUF �.;CBX � CBMY1�1 � F�� . ( H�F �.0C O � CBMB1�1 > F�� . ( HUF /.0C OQ� CYXB1�1

3 X 8 .;C O3 CBMY1 8 .0C O-3 CBXB1P±NJI\L�F+KeKcF��·aefJx[TJUhI$HJaeX�RzMOI$d R�UVI\R*b�RzaeK R��JKeI�7�' � � H Y�U$E��� .0C � P1<� * ���5$ � ( HUF /.0C � � �U B�"1 �

�' � $ H 'B� � .;C OQ� CBX � C21<� * ����$ ���� & � � � . � �! "��#�$"1 � C � C O > � 8 .;CBX 3 C O 1

�' ��F � IKJ ��'"�� .0C O � CBX � C 1<� * ����$ ���� & � � � . � � � � '5'" "��#"$�� � � � O� 1 � C � C O > � 8 .0CBX 3 C O 1

@�t

Page 40: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

� � � � � � � ��! P±NJIMONBI�F+U� �n�_¥���¢ �� <TBUhF�b'aeHJI$d�X$F+fWb+I$fJaeI$f>M�L�F+UVvgR�Kca ��RzMOacF+fJd³L�F+U3KeacfJI�dlaefG^:��HBaevwI�fJdVaeF+fµRzK:dVTµR�X�IzA³P±NJIMOUhR�HJaDMOaeF�fµR�K��3R8GMOF�HJIy¹µfJI$d[R�KcaefJI�� acdF�+ dVT:I$X�aDL1�acfJxgM���F)HJaedÒMOaefBX$M6T�F+acf>Mhd�� %&�" R�fJH %& � �:F+f acM�AkKeacfJI��rX*Rzf R�KedVF>�:I9HJI$¹µfBI�H � RgT�F+aefWM\R�fBH RgHJaeUVI�XyMOaeF�f7A\Ï�I$M %& " ��I«RgT�F+aefWMF�f�MONJI«KcaefJI�� RzfJHKeIyM % � ��I[RÉfJF+f ��I�UVFwb�I�XyMOF+U�dhT�I�X$acL1'aefJx«MhNJI\HJaeUVI�X$MhaeF+f)F�L�MONBIQKcaefJIzA�P±NJaed·acd±I�)>�JacbzR�KcI�fWM·MOF«MONBI\M���FT�F+aefWM6HBI$¹µfJaDMOacF+f �"dVaefJX$I9��I«X�F+�JKcH /V�JdÒM\TJ�BM % � 3 � %& � � %& " �°A#�ªI²X�R�f R�KcdhF�R�HBH H 'fµR�vwaeX�dqMOF�F+�BUKeacfJI�A�ЮL���I\R�dVdh�JvwI\R²TµR�UÒMOaeX$KeIqaed3vwF�b�acfJx²acf�R²KeacfJIq�·aDMON)R²X�F�fJdVMOR�fWM±b+I�KcF�X$acM����MONBI�f��lIX�R�f)HJI$¹JfJIMONBaed·KeacfJI*R�Ulv�F�MhaeF+f)�JdVaefJx«MhNJI[KcF�X�RzMOacF+f�F�L�MONJI\T�F+aefWMqRzM±MOacv�I �$I�UVF ��RÉb�I�KeF'X�aDM��b+I$X$MhF+U RzfJH�R«MOacv�ITµR�UhR�vwI$MOI$U3¦97

%&�" 1 ¦� %� ����·NJacXYNGTJUVF�b�acHJI�d±MhNJI\KeF'X*RzMhaeF+f�F�L�MONBIQTJR�UVMhaeX�KcIRzM±MhaevwI ¦°A

Ð�f MhNJI\Kea#�JUOR�U����KeaefBI�d·R�UVIQHBI$¹µfJI$H R�d·R«MO�BTJKeI�7A S # F5H � � T5� 'B# J H �A�3�3�3�3�353�3�3�3�353�3�3�3�353�3�3 � 353�3�3�3�3"3�3�3"3�3�3�3"3�3�3�3

R�H 'B� �)��� ����� �0� C �)�����BX � A C�� H '" �-' ��Y�?$ H 'B� � C�� F5H H �' #K H J � M: � � �K: ����X ��% A ( H "�B� H �' : ���Y�� � : �"$��5� H �?: ���-Y��

R�H 'B�5X T ����� �����DR�H 'B�

P±NJacd�I$fµR��JKcI�d·F+fJIMhFwUVI�TJUVI�dVI�fWM6RÉKeacfJI6�JdVaefJxwR«T�F+aefWM�R�fJHGR«HJaeUVI�XyMOaeF�f)b�I�XyMOF+U

C/. R 1 > : . R 1 �� R =�C >+R = :

F+U±�JdVaefJxwRÉT:F�aefWM·R�fJHGR²b+I$KeF'X�acM�gb+I�XyMOF+U

C/. R 1 > : . R 1 �� R =�C > 8 R = :

P±NJI\L�F+KeKcF��·aefJx9R�KcMhI�UhfJRzMOI6¹µI$KeH fµR�vwI�d·R�UVI\TJUhF�b'aeHJI$H

CBM . R � R�H 'B�B1 � � ����� �����BX � C/. R 1 A #"$-��U E'B#K�� � H �"$�(D'B# J � F: �"$ . R � R�H 'B�B1 � � ����� �����BX �+: . R 1

{µF+U±Iy|BR�vwTJKcIR =�CYM > 8 R = : ��$

P±NJacd�X�R�f5�:I\R�TBTJUhIyb�aeRzMOI$HG�BdhaefBxÉMhNJIL�F+KeKcF��·aefJx²v�R�X$UhF 7

$��5� . R � R�H 'B�B1 .;� � "��#�$"1<� � ����� �B����X � C�. R 1 > � 8 : . R 1

P3��FwL��JfBX$MOacF+fJd�R�UVIQTBUhF�b'aeHJI$H MhFwX�R�KeX$�JK R,MOI MhNJIb+I�KcF�X$acM��b�I�XyMOF+U±L�F+U±HJa��"I$UhI$f>M�dVacMO�JRzMOacF+fJd�7

� ��� � e�B� �Y� 7 x�I�fJI$UORzMhI�d·b+I�KcF�X$acM��b�I�XyMOF+U±L�UhF�v¿M��lFwT�F+aefWMOd·RzfJH MhUOR�fBdhT�F+UVM±MhaevwI� ��� � e�B� ¢���¡ 7Åx�I�fJI$UORzMhI�d·b+I�KcF�X$acM��b�I�XyMOF+U±L�UhF�v¿M��lFwT�F+aefWMOd·RzfJHGdVT:I$I�H

P±NJI$dhI[R�UhI\HJIy¹µfJI�H�R�d±L�F+KeKcF��·d

@W]

Page 41: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

: �"$ � �5 B� J � J .0C OQ� CBX � P1 � : � CBX � C O > 8 : � O �� 8 .0CBX 3 C O 1

: �"$ � �5 B� J ��F C"( .0C O � CBX � F 1<� ������X � & �+C O � CBX ��B��' � �E B��5R �K� F ��( H�F �.0C O � CBXB1 8 .0CBX 3 C O 1� UT & �

p MONJI$U·�JdhIyL��JK�KeI$v�v�R�d3acfJX�Kc�JHJI

: �"$ � �5 B� J � J � "�K, � RU� ��� � : �"$ � �5 B� J � J .0C OQ� CBX � P1 � O �- 8 .0CYX 3 C O 1: �"$ � �5 B� J � J � � ��� #E IYF � RU� ��� � : �"$ � �5 B� J � J .0C � C � P1 � � �E Y�: �"$ � �5 B� J ��F C"( � $E� J � RU� ��� � C O � � CBX & ���5R & � �

: ��$ � �� B� J ��F C"(�.0C OQ� CYX � C F 1 �+: �"$ � �5 B� J � J .0C OQ� CBX � ( H�F �.0C O � CBX�1�C F 1: �"$ � �5 B� J ��F C"( � '��K J � RU� ��� � C O � � CBX & ���5R & � �

: ��$ � �� B� J ��F C"(�.0C OQ� CYX � F 1 � F 8 '��� J #"$ H � �L.0CBX 3 C O 1

i�F+vwITJUVI�HJacX*RzMhI�d·F+f KeaefBI�d·R�UVI\R�KedVFwTBUhF�b'aeHJI$H 7

R��;R2OQ� R X���� ���?R�H 'B�

�' � $ H 'B� � .0C �;R 1<� * ����$ � ��� & � � � . � �) "�5#"$"1 � C � C/. R 1 >D� 8 : . R 1

�' ��F � IKJ ��'5 � .0C �;R 1<� * ���5$ ���� & � � � . � � � � '�'� "��#"$ � � � � O� 1 � C � C/. R 1 >D� 8 : . R 1

�� U���� I �'B#"$� . R2OQ� R XB1<� * ����$ � � . : . R2O 1�1 8 �Q. : . R XB151 � M

CB#E "#"$5$E�"$�� . R2OQ�;R XY1 � * ����$ � � . : . R2O 1�1 8 �Q. : . R XB151 � O ��� �Q. : . R O 1�1 8 � . : . R XY1�1 �?3�O

� ��� �2� &�! // ! 0 & � ��� � � ��! P±NJIlMhNJI�F�U�«��¥�����  ¢Ò���$�O� �B¥�¢ �� TBUhF�b'aeHJI$d dhF+vwIlI%�wX�aeI$fWM vwI$MONBF�HJd�L�F+U�HBI$MOI$UhvwaefJacfJx·�·NJI$MhNJI�U�M���FKeacfJI�daefWMhI�UhdVI�XyM«F+U9fBF�M«R�fBH�MONJI�T�F+acf>M[F�L·acf>MhI�UVdhI�XyMOacF+f�acLlMONJI%�HJF dVFJA P±NJI�MONJI$F+U� aed �J�JaeKDM²RzUhF+�JfBH RL��JfJXyMOacF+f)fµR�vwI�H)�� e�+¢V¢%7

��  �+¢Ò¢�� & � � � 3 &�� � �� � � &�P±NJI\L�F+KeKcF��·aefJx[dhaevwTJKcI6TJUhF�T:I$UVM�)NJF+KcH�L�F+U±�� e�+¢V¢%7

�� e�+¢Ò¢�� & � � � 3 � ��  �+¢Ò¢�� � � & �P±NJI�UVI9RzUhIMONJUVI�I\X*RzdhI�d·L�F+U3M���F�KcaefJI$d �³��R�fBH �±C�7

acf>MhI�UVdhI�XyMOacfJx 7 �� e�+¢V¢*� �³��� � �±C������3 �TµRzUOR�KcKeI�K 7 �� e�+¢V¢*� �³��� � �±C���� 3 �¿k ` ��  �+¢Ò¢���� � �Ê���*���3 �dhR�v�IKcaefJI�7 �� e�+¢V¢*� �³��� � �±C���� 3 �¿k ` ��  �+¢Ò¢���� � �Ê���*� 3 �

�·NJI$UhI� 3 �±C� � �³��WAÊjlF+UhUVI�dVT:F+fBHJaefJx�K#���MONJI\Kea#�JUORzU��TJUhF�b'aeHJI$d�MhNJIL�F+KeKcF��·aefJx²TBUhI�HBaeX*R,MOI�d 7

@+m

Page 42: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

H '5��U F ��� � . R M � R2O 1<� * ����$ � �� B� F�F . R ML= :/� R2O = : 1 � � M

F # J � � $ H 'B��� . R M � R2O 1<� * ����$ � R�� � T5�5R � �?� R O =�C 3+R M =�C & �- B� F�F . R M = :/�;R2O = : 1 � M � UT �� B� F�F . T��5R � �/�;R ML= : 1 � M

� acb+I$f�M��lF�KeaefBI�dlMhNµRzM�aefWMOI$UhdVI�X$M·MhNJIL��JfJX$MhaeF+f �_¥�����  ¢Ò���y� ����UhIyMO�JUVfJd�MhNJI\aefWMOI$UhdVI�X$MhaeF+f)T�F+aefWM�7H '5��U F ��� � C5�. R M�� R�H 'Y��X T/�;R O � R�H 'B��X T � �- B� F5F . R ML= :/�;R2O = : 1 � � MB1<� � � F X T?�

RU� � T��5R � �?� R2O =�C 3+R ML=�C �F�F � �- B� F5F . T��5R � ���;R2O = : 1�5�� B� F�F . R ML= :/�;R2O = : 1 & R ML=�C > F5F 8 R ML= :

i�Iyb+I�UhR�K ��I%)KeI�vwv�R�d±R�UVIQTBUhF�b'aeHJI$H 7H '5��U F ��� H �' � $U� J � RU� ��� � �- Y� F�F . R ML= :/�;R O = : 1 � � M & ���5R & � �

RU� � T��"R � �?� R2O =�C 3 R ML=0C �F�F � �- Y� F�F . T5�5R � ��� R2O = : 1��5�- B� F5F . R M�= :/�;RQO = : 1 �� � �- Y� F�F . T5�5R � ��� R ML= : 1��5�- B� F5F . R M�= :/�;RQO = : 1

& R ML=�C > F�F 8 R ML= : � R2O =0C > � 8 R2O = :

C5 �BH '5��E F ��� � RU� ��� � �' � $ H 'B��� .0C �;R MB1 �� UT �' � $ H 'B� �<.0C �;R2O 1 �� UT � � F # J � � $ H 'B� � . R M �;R2O 1G& ���5R & � �

H '"��E F �B��� . R M �;R2O 1

H '5��U F ��� � C5 � 95' H�� 9B� � RU� ��� � H '"��E F �B��� . R M �;R2O 1G& ���5R & � �C�'P�- � �GH '"��E F �B� � C5/. R M �;R O 1 �� �T�' � $ H 'B��� .0C�'��� �;R MB1

& ���5R & ��� � �G�' � $ H 'B��� .0C�'��� �;R2O 1

F # J � � $ H 'B� � $E� J � RU� ��� � CBM � � C O�� UT. �-' � $ H 'Y� � .0CBM �;R MB1 � UT �-' � $ H 'Y� � .0CBM �;R2O 1 � UT�-' � $ H 'Y� � .0C O �;R MB1 � UT �-' � $ H 'Y� � .0C O �;R2O 1 1& � �5R & � �GF # J � � $ H 'B� � . R M �;R2O 1

'��- �BF # J � � $ H 'B� � RU� ��� � �' � $ H 'B��� .0C �;R MB1 �� UT � �G�' � $ H 'B��� .0C �;R O 1

& ���5R & ��� �� � F # J � � $ H 'B� � . R M �;R2O 1

H '5B�E F ���- � C5 � $E� J � RU� ��� � �� � F # J � � $ H 'B� � . R M �;R2O 1 �� UT�' � $ H 'B��� .0C�'��� �;R MB1 �� UT�' � $ H 'B��� .0C�'��� �;R2O 1

& ���5R & ���H '5��E F ��� � C"�. R M � R2O 1 � C�'���

@Ws

Page 43: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

� ��� � " � ! & � -�-�/)�%,102(P±NJIlMhNJI�F�U�[��� ��¢V�$¢Ò� �3�-��  �+�,�, �� TJUhF�b'aeHBI�d�dhF�v�IÊMOF'F+Ked¬MOF6X�R�KeX$�JK R,MOI³MONJI3T�F+acf>M�F�L5X�KcF+dhI$dVM³RzTJTJUhF+R�XYN��j3o�k�@�:IyM��lI$I�fªM���F�T�F+acf>MhdMONµRzM[R�UVI�H!�fJR�v�acX*R�KcK#Gv�F�b'aefBx acf R dÒMOUORzaex+NWMQKeacfJI�AwP±NJaed\acd[Rzf acv �T�F+UVMOR�fWM X$F+v�TB�BMYRzMhaeF+f)L�F+U·X�F�KeKeacdhacF+f�HJI$MhI�XyMOaeF�f7A�{5F�U�I°|BR�v�TBKeI��µMhNJaed�X*R�f �:IQ�JdhI$H MOFwX*R�KcX��JKeRzMOI\MONBIMOacv�I\RzfJHGHBaedVMOR�fJX$I[F�L�M��lFgR�aeUVX*RzL�M[��UhI$TJUhI$dhI�fWMhI�H R�d·KeacfJI6b+I$X$MhF+UhdO�·�·NJI$fGMONBI R�UVI9RzM·MhNJI�acU�X$KeF+dVI�dÒMT�F+aefWM*A

i��JTJT�F+dVIQ��I[NJR�b�IM��lFwMOaevwI%�®TµR�UhR�v�IyMOUVaeX�KeaefBI*R�U3I )>�µRzMOacF+fJd

%& ��¦V� 3 %& " 1 ¦�%� %� ��¦V� 3 %� " 1Φ�%�EGacfJaev²�Bv�dVI�TµR�UhRzMOacF+f)F�X$X��JUVd R,M87

¦�� � � 3+� %� " ��%� � %� ��.%� � %� � ��·NJI$UhI %� "3 %& " � %� " A�P±NJIQKea#�JUOR�U�gTBUhF�b'aeHJI$dqR«L��JfJXyMOacF+f��O���q� ��� �+¢V�$¢Ò�97 H J � � �U$�� F � F �.0CBM � � M � 9 �0: 1<� "��#"$ �& � '��� J .09 3K: 1 � M+��� � A CB#E "#"$5$E�"$ � � � F CB���U(M

�5R �K�3 .�.;CBM 3�� MY1 8 .09 3E: 1�1� F�� .0'��� J .09 3E: 1�1

� �T & �

P±NJI\L�F+KeKcF��·aefJx[KeI�vwv�R²x+acb�I�d�R�f R�KcMhI�UVfµRzMOI6�lR8�MOFÉX*RzKeX��BK RzMhI6MONJIL��JfJXyMOacF+f7A

H J � � �U$�� F � F � $E� J � RU� ��� � '��� J .;9 3K: 1 � � M � UT# � .09 3K: 1 8 .09 3K: 1 �� UT*?� X 8 .0CBM 3�� MB1 8 .09 3K: 1& ���5R & � � H J � � �U$�� F � F �.;CBM � � M � 9 �0: 1 � 3�* � .NX 8 #B1

P±NJI6KcI�vwvgR\�O���q� ���,�[I�dÒMYR��BKeaedVNJI�d�MONµRzM�MONJacd�MhaevwIqacdlaefBHJI�I$H�MONJIqT:F+acfWMl�·NJI$UhI6MONBI HJacdVMYRzfJX�I6acd3RzM3RvwaefJacv²�Jv A

H J � � � CB#�� RU� ��� � � � CB# � H J � � �U$�� F � F �.0CBM � � M � 9 �0: 1& ���5R & � �HUF��-J H ' H J 9 J � .; � �CB# � . R����"SUT�� � F���� ( HUF �.;CBM > 8 9 � � M > 8 : 1�151

i�I$I

�5�UC � ��� I ��� J �K5 � #"$ I �K H �� J F�� �U� J � � �� � H : ���E#"$ I �� H �� J � M O M����E#"$ I �� H � J � M O M�� � �5 J

L�F+U·R²b+I$U�)fJacX�I\HJacdhX��BdhdhacF+f7A

@+~

Page 44: Formal Modeling and Analysis of a Preliminary Small Aircraft ......March 2004 NASA/TM-2004-212999 Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System

REPORT DOCUMENTATION PAGE Form ApprovedOMB No. 0704-0188

2. REPORT TYPE

Technical Memorandum 4. TITLE AND SUBTITLE

Formal Modeling and Analysis of a Preliminary Small Aircraft Transportation System (SATS) Concept

5a. CONTRACT NUMBER

6. AUTHOR(S)

Carreno, Victor A.; Gottliebsen, Hanne; Butler, Ricky; and Kalvala, Sara

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)

NASA Langley Research CenterHampton, VA 23681-2199

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)

National Aeronautics and Space AdministrationWashington, DC 20546-0001

8. PERFORMING ORGANIZATION REPORT NUMBER

L-18449

10. SPONSOR/MONITOR'S ACRONYM(S)

NASA

13. SUPPLEMENTARY NOTESCarreno and Butler, Langley Research Center; Gottliebsen, National Institute of Aerospace; Kalvala, University of WarwickAn electronic version can be found at http://techreports.larc.nasa.gov/ltrs/ or http://ntrs.nasa.gov

12. DISTRIBUTION/AVAILABILITY STATEMENTUnclassified - UnlimitedSubject Category 61Availability: NASA CASI (301) 621-0390 Distribution: Standard

19a. NAME OF RESPONSIBLE PERSON

STI Help Desk (email: [email protected])

14. ABSTRACT

New concepts for automating air traffic management functions at small non-towered airports raise serious safety issues associated with the software implementations and their underlying key algorithms. The criticality of such software systems necessitates that strong guarantees of the safety be developed for them. In this paper we present a formal method for modeling and verifying such systems using the PVS theorem proving system. The method is demonstrated on a preliminary concept of operation for the Small Aircraft Transportation System (SATS) project at NASA Langley.

15. SUBJECT TERMS

Safety; Software; Formal methods; Verification; Air traffic management

18. NUMBER OF PAGES

44

19b. TELEPHONE NUMBER (Include area code)

(301) 621-0390

a. REPORT

U

c. THIS PAGE

U

b. ABSTRACT

U

17. LIMITATION OF ABSTRACT

UU

Prescribed by ANSI Std. Z39.18Standard Form 298 (Rev. 8-98)

3. DATES COVERED (From - To)

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

23-786-10-10

11. SPONSOR/MONITOR'S REPORT NUMBER(S)

NASA/TM-2004-212999

16. SECURITY CLASSIFICATION OF:

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS.

1. REPORT DATE (DD-MM-YYYY)

03 - 200401-