The Automatic Dependent Surveillance-Broadcast (ADS-B) system allows aircraft to communicate current state information, including position and velocity messages, to other aircraft in their vicinity and to ground stations. The Compact Position Reporting (CPR) algorithm is the ADS-B protocol responsible for the encoding and decoding of aircraft positions. CPR is sensitive to computer arithmetic since it relies on functions that are intrinsically unstable such as floor and modulus. In this paper, a formal verification of the CPR algorithm is presented. In contrast to previous work, the algorithm presented here encompasses the entire range of message types supported by ADS-B. The paper also presents two implementations of the CPR algorithm, one in double-precision floating-point and one in 32-bit unsigned integers, which are both formally verified against the real-number algorithm. The verification proceeds in three steps. For each implementation, a version of CPR, which is simplified and manipulated to reduce numerical instability and leverage features of the datatypes, is proposed. Then, the Prototype Verification System (PVS) is used to formally prove real conformance properties, which assert that the ideal real-number counterpart of the improved algorithm is mathematically equivalent to the standard CPR definition. Finally, the static analyzer Frama-C is used to verify software conformance properties, which say that the software implementation of the improved algorithm is correct with respect to its idealized real-number counterpart. In concert, the two properties guarantee that the implementation meets the original specification. The two implementations will be included in the revised version of the ADS-B standards document as the reference implementation of the CPR algorithm.

中文翻译：

---

紧凑位置报告算法的形式分析

自动相关监视广播 (ADS-B) 系统允许飞机将当前状态信息（包括位置和速度消息）传递给附近的其他飞机和地面站。紧凑型位置报告 (CPR) 算法是负责飞机位置编码和解码的 ADS-B 协议。CPR 对计算机算术很敏感，因为它依赖于本质上不稳定的函数，例如下限和模数。在本文中，提出了 CPR 算法的形式验证。与以前的工作相比，这里介绍的算法涵盖了 ADS-B 支持的所有消息类型。本文还介绍了 CPR 算法的两种实现，一种是双精度浮点，一种是 32 位无符号整数，它们都针对实数算法进行了形式化验证。验证分三个步骤进行。对于每个实现，提出了一个 CPR 版本，该版本经过简化和操作以减少数值不稳定性并利用数据类型的特性。然后，使用原型验证系统 (PVS) 正式证明实数一致性属性，它断言改进算法的理想实数对应物在数学上等同于标准 CPR 定义。最后，静态分析器 Frama-C 用于验证软件一致性属性，这表明改进算法的软件实现相对于其理想化的实数对应物是正确的。这两个属性共同保证了实现符合原始规范。