Measuring the impact of avionics faults with a set of safety metrics

Safe operations in the National Airspace System (NAS) require understanding the individual failure space of avionics technologies, the joint failure space as faults propagate within the distributed environment, and a framework to quantify safety. This paper focuses on the last point, in which the safety assessment framework consists of a set of safety metrics: Loss of Separation (LoS), Traffic Collision Avoidance System (TCAS) II, NASA's Well Clear (WC), and a novel metric called Critical Pair Identification (CPI). The fault space considers the surveillance device Automatic Dependent Surveillance-Broadcast (ADS-B). Using an agent-based model, we demonstrate the framework with a two aircraft example of a perpendicular crossing, in which each aircraft implements self-separation via NASA's Chorus software. We compare three different variations of the crossing: (a) Chorus is absent (open loop), (b) Chorus is operational (closed loop), and (c) Chorus is operational, but one aircraft broadcasts a faulty ADS-B message with a +0.05 deg longitude error (closed loop with a fault). Our results show that the included set of safety metrics cover a variety of dimensions of state information, but may be an overdetermined system for assessing safety. The set or subset appears capable of assessing safety, but requires a detailed case study for understanding faults and their propagating effects within an arbitrary scenario in the NAS.