Nathalie Bochard
email: nathalie.bochard@univ-st-etienne.fr

Florent Bernard
email: florent.bernard@univ-st-etienne.fr

Viktor Fischer
email: fischer@univ-st-etienne.fr

Boyan Valtchanov
email: boyan.valtchanov@univ-st-etienne.fr

True-randomness and Pseudo-randomness in Ring Oscillator-based True Random Number Generators

Keywords: True Random Number Generators, Randomness Tests, Clock Jitter, Ring Oscillators, FPGA

I. INTRODUCTION

True Random Number Generators (TRNG) are used to generate confidential keys and other critical security parameters (CSP) in cryptographic modules [START_REF]FIPS 140-2: Security Requirements for Cryptographic Modules[END_REF]. Generation of high rate and high quality random bit-stream inside logic devices is difficult because these devices are intended for implementing deterministic data processing algorithms whereas generating true-randomness needs some physical non deterministic process.

The quality of the generated bit-streams is evaluated using dedicated statistical tests such as FIPS 140-2 [START_REF]FIPS 140-2: Security Requirements for Cryptographic Modules[END_REF], NIST 800-22 [START_REF] Rukhin | A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications[END_REF], Diehard [START_REF] Marsaglia | DIEHARD: Battery of Tests of Randomness[END_REF], etc. However, the statistical tests are not able to give a mathematical proof that the generator generates true random numbers and not only pseudo-random numbers that can be employed in attacks [START_REF] Menezes | Handbook of Applied Cryptography[END_REF]. For this reason, Killmann and Schindler [START_REF] Killmann | AIS 31: Functionality classes and evaluation methodology for true (physical) random number generators, version 3.1[END_REF] propose to characterize the source of randomness from the raw binary signal in order to estimate the entropy in the generator output bit-stream.

The TRNGs implemented in reconfigurable devices usually use metastability [START_REF] Vasyltsov | Fast Digital TRNG Based on Metastable Ring Oscillator[END_REF], [START_REF] Fechner | A meta-level true random number generator[END_REF], [START_REF] Varchola | New High Entropy Element for FPGA Based True Random Number Generators[END_REF] or the clock jitter [START_REF] Fischer | True Random Number Generator Embedded in Reconfigurable Hardware[END_REF], [START_REF] Tsoi | Compact FPGA-based true and pseudo random number generators. Field-Programmable Custom Computing Machines[END_REF], [START_REF] Dichtl | High-Speed True Random Number Generation with Logic Gates Only[END_REF], [START_REF] Danger | Fast True Random Generator in FPGAs[END_REF] as the source of randomness. Many of them employ ring oscillators (RO) as a source of a jittery clock [START_REF] Tkacik | A Hardware Random Number Generator[END_REF], [START_REF] Kohlbrenner | An embedded true random number generator for FPGAs[END_REF], [START_REF] Sunar | A Provably Secure True Random Number Generator with Built-In Tolerance to Active Attacks[END_REF]. One of principles employed the most frequently in reconfigurable devices is that proposed by Sunar et al. in [START_REF] Sunar | A Provably Secure True Random Number Generator with Built-In Tolerance to Active Attacks[END_REF]. This principle was later exploited and modified in [START_REF] Schellekens | FPGA vendor agnostic true random number generator[END_REF], and enhanced in [START_REF] Fischer | Enhancing Security of Ring Oscillator-based RNG implemented in FPGA[END_REF] and [START_REF] Wold | Analysis and enhancement of random number generator in FPGA based on oscillator rings[END_REF]. Sources of randomness and randomness extraction in RO-based TRNG were analyzed in [START_REF] Valtchanov | Modeling and observing the jitter in ring oscillators implemented in FPGAs. Design and Diagnostics of Electronic Circuits and Systems[END_REF], [START_REF] Rozic | Random Numbers Generation: Investigation of Narrow Transitions Suppression on FPGA[END_REF] and [START_REF] Valtchanov | Characterization of randomness sources in ring oscillator-based true random number generators in FPGAs. Design and Diagnostics of Electronic Circuits and Systems[END_REF].

In order to increase the entropy of the generated binary raw signal and to make the generator "provably secure", Sunar et al. employ a huge number of ROs [START_REF] Sunar | A Provably Secure True Random Number Generator with Built-In Tolerance to Active Attacks[END_REF]. The outputs of 114 supposedly independent ROs are XOR-ed and sampled using a reference clock with a fixed frequency in order to obtain a raw binary signal. This binary signal is then post-processed using a resilient function depending on the size of the jitter and the number of ROs employed. The main advantages of the generator of Sunar are:

• the claimed security level based on a security proof,

• easy (almost "push button") implementation in FPGAs. Without the security proof the generator of Sunar et al. can be considered as just one of many existing TRNGs that passes the statistical tests. This security approach is essential for TRNG evaluation according AIS31 [START_REF] Killmann | AIS 31: Functionality classes and evaluation methodology for true (physical) random number generators, version 3.1[END_REF] that is accepted as a de facto standard in the field. Unfortunately, the Sunar's security proof is based on at least two assumptions that are impossible or difficult to achieve and/or validate in practice [START_REF] Dichtl | High-Speed True Random Number Generation with Logic Gates Only[END_REF]:

• the XOR gate are supposed to be infinitely fast in order to maintain the entropy generated in rings, • the rings are supposed to be independent. Wold and Tan show in [START_REF] Wold | Analysis and enhancement of random number generator in FPGA based on oscillator rings[END_REF] that by adding a flip-flop to the output of each oscillator (before the XOR gate), the generated raw bit-stream will have better statistical properties: the NIST [START_REF] Rukhin | A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications[END_REF] and Diehard [START_REF] Marsaglia | DIEHARD: Battery of Tests of Randomness[END_REF] tests will pass without post-processing and with a significantly reduced number of ring oscillators.

It is commonly accepted that contrary to the original design of Sunar et al., the modified architecture proposed by Wold and Tan maintains the entropy of the raw binary signal after the XOR gate, if the number of rings is unchanged. However, we believe that several other questions are worthy of investigation. The aim of our paper is to find answers to the following questions and to discuss related problems:

• Is the security proof of Sunar valid also for the generator of Wold and Tan?

• What is the entropy of the generated bit-stream after the reduction of number of rings? • How does security enhancement proposed by Fischer et al. in [17] modify the quality of the generated binary raw signal? • How should the relationship between the rings be taken into account in entropy estimation?

The paper is organized as follows: Section II analyzes the composition of the timing jitter of the clock signal generated in ring oscillators. Section III deals with the simulation and experimental background of our research. Section IV compares the behavior of the two generators in simulations and in hardware. Section V discusses the impact of the size and type of the jitter on the quality of the raw bit-stream. Section VI evaluates the dependence between the rings inside the device and its impact on generation of random bit-stream. Section VII discusses the obtained results and replies to the questions given in the previous paragraph. Section VIII concludes the paper.

II. RING OSCILLATORS AND TIMING JITTER

Ring oscillators are free-running oscillators using logic gates. They are easy to implement in logic devices and namely in Field Programmable Gate Arrays (FPGAs). The oscillator consists of a set of delay elements that are chained into a ring. The set of delay elements can be composed of inverting and non-inverting elements, while the number of inverting elements has to be an odd number. The period of the signal generated in the RO using ideal components is given by the form

T = 2 k i=1 d i , (1)
where k ∈ {3, 4, 5, . . . , n} is the number of delay elements and d i is the delay of the i-th delay element. This expression is simplified in two ways:

• the delay d i is supposed to be constant in time;

• the delays of interconnections are ignored.

In physical devices, the delay d i varies between two halfperiods (i.e. between two instances i and i+k) and expression (1) gets the form

T = 2k i=1 d (i-1 mod k)+1 . (2)
In the case of ring oscillators, the variation of the clock period is observed as the clock timing jitter, which can be seen as a composition of the jitter caused by local sources and the jitter coming from global sources, usually from power supply and/or global device environment [START_REF] Valtchanov | Modeling and observing the jitter in ring oscillators implemented in FPGAs. Design and Diagnostics of Electronic Circuits and Systems[END_REF]. When observing rings implemented in real devices and namely in FPGAs, the delays of interconnections cannot be ignored anymore. For simplicity, we propose to merge them with the gate delays. This approach was validated in [START_REF] Valtchanov | Characterization of randomness sources in ring oscillator-based true random number generators in FPGAs. Design and Diagnostics of Electronic Circuits and Systems[END_REF]. The delay d i of gate i including interconnection delay between two consecutive gates in the ring oscillator can then be expressed as

d i = D i + ∆d Li + ∆d Gi , (3)
where D i is a constant delay of gate i plus interconnection between gates i and i + 1 (mod k) corresponding to the nominal supply voltage level and nominal temperature of the logic device, ∆d Li is the delay variation introduced by local physical events and ∆d Gi is the variation of the delay caused by global physical sources such as substrate noise, power supply noise, power supply drifting, temperature variation, etc. The delay d Li is dynamically modified by some amount of a random signal ∆d LGi (LG -Local Gaussian jitter component) and by some local cross-talks from the neighboring circuitry ∆d LDi (LD -Local Deterministic jitter component). The jitter from local sources used in Eq. ( 3) can thus be expressed as

∆d Li = ∆d LGi + ∆d LDi . (4)
The local Gaussian jitter components ∆d LGi coming from individual gates and interconnections are characterized by normal probability distribution N (µ i , σ 2 i ) with the mean value µ i = 0 and the standard deviation σ i . We can suppose that these sources are independent. On the other side, the local deterministic components can feature some mutual dependency, e.g. from cross-talks.

Besides being influenced locally, the delays of all logic gates in the device are modified both slowly and dynamically by global jitter sources. The slow changes of the gate delay ∆D (the drift) can be caused by a slow variation of the power supply and/or temperature. The power source noise and some deterministic signal, which can be superposed on the supply voltage, can cause dynamic gate delay modification composed of a Gaussian global jitter component ∆d GG and a deterministic global jitter component ∆d GD . The overall global jitter from Eq. (3) can therefore be expressed as

∆d Gi = K i (∆D + ∆d GG + ∆d GD ), (5)
where K i ∈ [0; 1] corresponds to the proportion of the global jitter sources on the given gate delay. This comes from the fact that the amount of the global jitter included in delays of individual logic gates is not necessarily the same for all gates.

It is important to note, that K i depends on the power supply voltage, but this dependence may differ for individual gates.

In real physical systems, the switching current of each gate modifies locally and/or globally the voltage level of the power supply, which in turn modifies (again locally and/or globally) the gate delay. This way, the delays of individual gates are not completely independent. We will discuss this phenomenon in Section VI.

III. SIMULATION AND EXPERIMENTAL SET-UP

The aim of the first part of our work was to compare the behavior of two RO-based TRNGs: the original architecture depicted in Fig. 1 a) that was proposed by Sunar et al. in [START_REF] Sunar | A Provably Secure True Random Number Generator with Built-In Tolerance to Active Attacks[END_REF] and its modified version presented in Fig. 1 b) proposed by Wold and Tan in [START_REF] Wold | Analysis and enhancement of random number generator in FPGA based on oscillator rings[END_REF]. Contrary to the strategy adopted in [START_REF] Wold | Analysis and enhancement of random number generator in FPGA based on oscillator rings[END_REF], where the behavior of the two generators was compared only in hardware, we propose to compare it on simulation level, too. This approach has two advantages:

RO 1 RO 2 RO N F s F s F s F s RO 1 RO 2 RO N F s a) b)
• the functional simulation results correspond to an ideal behavior of the generator, this way the two underlying mathematical models can be compared; • in contrast with the real hardware, thanks to simulation we can modify the parameters of injected jitter and evaluate the impact of each type of jitter on the quality of the generated bit-stream. The principle of our simulation platform and experimental platform is depicted in Fig. 2. For both platforms, the two generators were described in VHDL language and their architectures differed only in the use of flip-flops on the rings outputs (dashed blocks in Fig. 2). The bit-streams obtained at the output of the final sampling flip-flop (before the postprocessing) were tested and evaluated for different types and sizes of jitter in simulations and for different numbers of ring oscillators in both simulations and hardware experiments. The output of the TRNG was written into a binary file that was used as an input file in statistical tests.

We avoided the post-processing in the generator of Sunar et al. for two reasons:

• the post-processing function can hide imperfections in the generated signal; • using the same structures, we wanted to compare the two generators more fairly. At this first level of investigation, we used the statistical tests FIPS 140-2 [START_REF]FIPS 140-2: Security Requirements for Cryptographic Modules[END_REF] in order to evaluate the quality of the generated raw bit-streams. We preferred the FIPS tests before the NIST test suite [START_REF] Rukhin | A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications[END_REF], because of the speed and the size of files needed for testing. While using significantly smaller files, the FIPS tests give a good estimation of the quality of the generated raw signal. If these tests do not pass, it is not necessary to go further. As our aim was to test a big set of TRNG configurations, the time and data size constraints were important. However, when the FIPS tests pass, we cannot conclude that the quality of the sequence produced by the TRNG is good. In this case, the generator should be thoroughly inspected.

A. Simulation Methodology

In order to compare the two generators on the functional simulation level (i.e. using ideal components), the behavior of ring oscillators was modeled in VHDL by delay elements with dynamically varying delays. The jittered half-period, generated in MatLab Ver. R2008b, is based on equations (2) to [START_REF] Killmann | AIS 31: Functionality classes and evaluation methodology for true (physical) random number generators, version 3.1[END_REF]. However, we take into account only local Gaussian jitter ∆d LGi (the source of truerandomness) and global deterministic jitter ∆d GD (the source of pseudo-randomness which can easily be manipulated) in our simulations. This approach was explained in [START_REF] Valtchanov | Modeling and observing the jitter in ring oscillators implemented in FPGAs. Design and Diagnostics of Electronic Circuits and Systems[END_REF]. Both sources of jitter depend a priori on the time t. Thus the simplified equation used in MatLab for generating jittery halfperiods over the time t, denoted by h(t), is expressed as

h(t) = k i=1 (D i (t) + ∆d LGi (t) + K i × ∆d GD (t)). (6)
The fix part of the generated delay that determines the mean half-period of the ring oscillator is defined as a sum of k delay elements featuring constant delay D i (t) = D i for each gate i. The variable delay that is added to the mean half-period is composed of a Gaussian component generated for each gate individually and of a deterministic component generated by the same generator for all gates and rings. The Gaussian delay component ∆d LGi (t) can be seen as a stationary process (i.e. mean and variance of ∆d LGi (t) do not change over the time t). Thus ∆d LGi (t) can be generated using the normrnd function in MatLab with mean 0 and standard deviation σ i . The deterministic component ∆d GD (t) applied at time t is calculated in MatLab in the following way:

∆d GD (t) = A GD × sin(2πF GD × t), (7)
where A GD and F GD represent the amplitude and frequency of the deterministic signal. Note, that the sin function can be replaced with the square, sawtooth or other deterministic function. Coefficients K i are used to simulate the varying influence of ∆d GD (t) on each gate i.

Once the parameters k, D i , K i , σ i , A GD and F GD were set, a separated file containing a stream of half-period values was generated for each ring oscillator. These files were read during the VHDL behavioral simulations performed using the ModelSim SE 6.4 software, as presented in Fig. 3 (a).

The output signals were sampled using a D flip-flop at the sampling frequency F s = 32 MHz and the obtained 20,000 samples were written during the simulation to a binary file. Finally, generated sequences were tested using FIPS 140-2 tests.

B. Methodology of Testing in Hardware

Enhancements of the generator architecture brought by Wold and Tan were related to the behavior of the XOR gate. In order to compare generators' behavior in two different technologies, we employed one from Altera (the same that was used in [START_REF] Wold | Analysis and enhancement of random number generator in FPGA based on oscillator rings[END_REF]) based on Look-up tables (LUT) and one from Actel based on multiplexers. We developed two different modules dedicated to TRNG testing. Each module contained a selected FPGA device, a 16 MHz quartz oscillator and lownoise linear voltage regulators. The modules were plugged into a motherboard containing Cypress USB interface device CY7C6B013A-100AXC powered by an isolated power supply. The Altera module contained the Cyclone III EP3C25F256C8N device. The non-inverting delay elements and one inverter were mapped to LUT-based logic cells (LCELL) from Altera library (see Fig. 3 (b)). This way, either odd or even number of delay elements could be used in order to tune the frequency in smaller steps. We used Quartus II software version 9.0 from Altera for mapping the rings into the device. All delay elements were preferably placed in the same logic array block (LAB) in order to minimize the dispersion of parameters.

The Actel Fusion module featured the M7AFS600FGG256 FPGA device. The non-inverting delay elements were implemented using AND2 gates from Actel library with two inputs short-connected and one inverter (again from Actel library) was added to close the loop (see Fig. 3 (c)).

On both hardware platforms, an internal PLL was used to generate the 32 MHz sampling clock F s . The generated bitstreams were sent to the PC using the USB interface. A 16bit interface communicating with the Cypress USB controller was implemented inside the FPGA. A Visual C++ application running on the PC read the USB peripheral and wrote data into a binary file that was used by the FIPS 140-2 tests software.

IV. COMPARISON OF THE GENERATORS' BEHAVIOR IN

SIMULATIONS AND IN HARDWARE First, we compared the behavior of both generators in VHDL simulations. The generators used 1 to 20 ROs consisting of k = 9 inverters each. To take into account the differences related to the placement and routing of ROs, we supposed that the mean delay D i of individual gates were slightly different from one ring to another (between 275 ps and 281 ps). The additional Gaussian jitter ∆d LGi have mean 0 and standard deviation σ i = 30 ps. No deterministic component was added in this experiment (i.e. ∆d GD (t) = 0). It is important to note that the same random data files were used for both Sunar's and Wold's generators. The simulation results for both evaluated generators are presented in Fig. 4. Note that the "Monobit" and "Poker" tests succeed if the test result lies in the gray area. The "Run" test succeeds if no run fails. The "Long run" test is not presented in the graphs because it always succeeded.

It can be seen that in all configurations the two versions of the generator gave very similar (almost identical) results. Next, we will explain the reason for this behavior.

Let b j (t) be the bit sampled at time t ≥ 0 at the output of the ring oscillator RO j . This bit depends on the time t, the period T j > 0 generated by RO j and the initial phase ϕ j of RO j at time t = 0. Note that T j , t and ϕ j are expressed in the time domain. This dependency is given by the following relation:

b j (t) = 1 - (ϕ j + t) mod T j T j /2 . ( 8
)
Equation ( 8) ensures b j (t) is a bit (i.e. b j (t) ∈ {0, 1}). Indeed, by definition of operation mod T j 0 ≤ (ϕ j + t) mod T j < T j ,

then 0 ≤ (ϕ j + t) mod T j T j /2 < 2,
and by definition of the floor operation,

0 ≤ (ϕ j + t) mod T j T j /2 ≤ 1, that means (ϕ j + t) mod T j T j /2 ∈ {0, 1}, thus b j (t) = 1 - (ϕ j + t) mod T j T j /2 ∈ {0, 1}.
Equation ( 8) holds if T j is constant. Then if (ϕ j + t) mod T j < T j /2, the sample value will be ′ 1 ′ otherwise it will be ′ 0 ′ (in the case where the rising edge appears first, Eq. ( 8) would be b j (t) = (ϕj +t) mod Tj Tj /2

). In both Sunar's and Wold's designs, outputs of N ring oscillators are XOR-ed to get one random bit as it is shown in Fig. 1.

From the mathematical point of view, XOR-ing the outputs of N ring oscillators in Sunar's architecture is given by:

S(t) = N j=1 b j (t), (9)
or

S(t) = N j=1 b j (t) mod 2 = N j=1 1 - (ϕ j + t) mod T j T j /2 mod 2.
Thus

S(t) =   N + N j=1 (ϕ j + t) mod T j T j /2   mod 2. ( 10
)
This way, the n th bit sampled at time n × T s in the D flip-flop is given by Eq. ( 10) for t = n × T s . In Wold's architecture, each ring oscillator is sampled at time n × T s , which gives a set of bits {b 1 (n × T s ), b 2 (n × T s ), . . . , b N (n × T s )}. Then all these bits are XOR-ed and the result is sampled at time (n + 1) × T s , giving the output of Wold's TRNG denoted by W ((n + 1) × T s ):

W ((n + 1) × T s ) = N j=1 b j (n × T s ). (11)
Thus using equations ( 9) and [START_REF] Dichtl | High-Speed True Random Number Generation with Logic Gates Only[END_REF], the relation between outputs of Wold's TRNG and Sunar's TRNG is given by,

W ((n + 1) × T s ) = S(n × T s ). (12)
We can conclude that from the mathematical point of view, assuming constant periods of ring oscillators and ideal components, Sunar's and Wold's generators can be described in the same way. The only difference is the right shift of the sequence from the Wold's generator. Note, that this conclusion explains also the similar behavior of both generators in simulation as it is shown in Fig. 4.

The claim that both ideal generators behave according to the same mathematical model is very important, because it means that the security proof of Sunar can be applied to both of them. However, as we will see in the next section, their behavior in hardware is very different.

B. Results Obtained in Hardware

We applied the FIPS 140-2 tests on the raw binary signals generated by the two generators, while incrementing the number of ROs. The results obtained for Actel FPGA are presented in Fig. 5 and those obtained for Altera FPGA in Fig. 6. The number of ROs varied from 1 to 20 by increments of 1 and from 20 to 115 by increments of 5.

It can be seen that for the Sunar's architecture the tests passed neither for Altera, nor for Actel family. However, we can note that the Altera Cyclone III device gave slightly better results. This was probably due to the different behavior of the XOR gate in selected technologies. In the same time, concerning the architecture of Wold, the tests passed for both technologies if the number of ROs was higher than 8. Note that these results confirmed those obtained on standard evaluation boards from Altera and Actel published in [START_REF] Bochard | Observing the randomness in RO-based TRNG[END_REF].

The claims of Wold are thus confirmed in both technologies and various types of boards. However, it is not clear, what kind of randomness lets the tests pass. Is it mostly a pseudorandomness (coming from the sequential behavior of the generator characterized by the internal state evolution) that can theoretically be attacked or a true-randomness that should be employed? The tests are clearly not able to distinguish between them. Again, the simulation can give answers to these questions.

V. IMPACT OF THE SIZE AND TYPE OF THE JITTER ON THE QUALITY OF THE RAW BIT-STREAM

As the architectures of Sunar and Wold have the same ideal behavior, we will analyze only the architecture of Wold and Tan, because its behavior in hardware is closer to the idealized mathematical model. Next, we will study the impact of both Gaussian and deterministic components of the jitter on the generated raw signal.

A. Impact of the Size of the Gaussian Jitter on the FIPS 140-2 Tests

Again, we have simulated the behavior of the Wold's architecture with 1 to 20 ROs composed of 9 elements. The half period of each RO was composed of a mean value (frequency of RO-generated clock signal varied between 197,5 MHz and 202 MHz in 250 kHz steps) and of an additional random value (normally distributed with mean 0 and σ i = 0, 10, 30 and 50 ps for each gate). The random signals were generated in MatLab, independently for each RO. The results are presented in Fig. 7.

Two facts can be observed in these figures:

• as expected, when the random jitter increases, the tests pass more easily (i.e. with a reduced number of ROs); • more surprisingly, the tests pass even if the random jitter is not injected at all (σ = 0), and this for 18 ROs or more. Thanks to the mathematical model from Eq. [START_REF] Tsoi | Compact FPGA-based true and pseudo random number generators. Field-Programmable Custom Computing Machines[END_REF], which generates the same sequences as the simulation tool, we could generate faster long bit-streams in order to perform NIST tests. The results were conclusive: the NIST tests passed with this full deterministic behavior (without any randomness) for only 18 ROs.

The fact that the tests (FIPS and NIST) pass for a few ROs without Gaussian jitter means that both Sunar's and Wold's architectures produce a great amount of pseudo-randomness. We recall that pseudo-randomness in the generated sequence depends on the frequencies of ROs and can be manipulated from outside the chip (e.g. by modulating the power supply or by an electro-magnetic interference as it was presented recently at the CHES conference [START_REF] Markettos | The Frequency Injection Attack on Ring-Oscillator-Based True Random Number Generators[END_REF]). Furthermore, using a mathematical model (e.g. that from Eq. ( 10)), some patterns can be predicted. The proportion of pseudo-random and truerandom components in the generated sequence is thus very important. However, in the solution proposed by Wold, the number of ROs is significantly reduced, because the NIST tests passed. This can be considered as a security-critical attempt for cryptography applications and should certainly be avoided.

B. Injecting a Deterministic Jitter

In the next experiments, the Gaussian jitter remained constant (σ i = 30 ps per gate) and we applied a sinusoidal deterministic jitter of 3 kHz and 0 to 10 ps in amplitude. The It can be seen that when the deterministic part increases, the tests pass more easily. But there are two problems concerning the deterministic component of the jitter:

• the results are strongly dependent on the frequency of the injected signal: depending on the frequency, the output of the TRNG can vary in time in a predictable way; • the deterministic jitter can be manipulated (for example, an attacker can superimpose a chosen signal that seems to improve randomness so that the tests would pass more easily, but in fact, he can predict some trends in subsequences). For the above mentioned reasons, the designer should reduce the pseudo-randomness coming from the deterministic jitter component as much as possible.

C. Reducing the Influence of the Deterministic Jitter Component

As we pointed out in [START_REF] Fischer | Enhancing Security of Ring Oscillator-based RNG implemented in FPGA[END_REF], the impact of the deterministic jitter on the generated random numbers can significantly be reduced by the use of a reference clock signal featuring the same deterministic global jitter. This fact is not taken into account in any observed TRNG designs [START_REF] Sunar | A Provably Secure True Random Number Generator with Built-In Tolerance to Active Attacks[END_REF], [START_REF] Schellekens | FPGA vendor agnostic true random number generator[END_REF], [START_REF] Wold | Analysis and enhancement of random number generator in FPGA based on oscillator rings[END_REF]. In the following experiments, we used a clock signal generated by another internal ring oscillator as a sampling clock. The generated signal frequency was divided by 8 and then used as a sampling clock (having thus the frequency of about 25 MHz). We implemented the Wold's TRNGs with 1 to 20 ROs. In the first experiment, we did not inject the deterministic jitter component and we let the Gaussian part vary between 0 and 50 ps. The results are presented in Fig. 9. Next, we fixed the Gaussian jitter to σ = 30 ps and we applied a sinusoidal deterministic jitter of 3 kHz and 0 to 10 ps in amplitude. The results are prese nted in Fig. 10. As expected, increasing the standard deviation of the injected Gaussian jitter component from 0 to 50 ps, the tests passed more easily for both external and internal sampling clocks (see Fig. 7 and Fig. 9, respectively). It is important to note that for a fixed Gaussian jitter size, tests passed more easily if the sampling was performed with an internal clock signal (i.e. from another ring oscillator), because independent Gaussian jitter components were included in both sampling and sampled signals and they increased the entropy of the generated bit-stream.

In the last experiment, the Gaussian jitter component was constant and the deterministic jitter component varied. The results for external and internal sampling clocks are presented in Fig. 8 and Fig. 10, respectively. Contrary to the use of an external clock, the influence of the deterministic jitter was strongly reduced when an internal clock was used. As expected, whatever the size of the injected deterministic jitter component, the test results were similar.

VI. MUTUAL DEPENDENCE OF RINGS AND ITS IMPACT ON THE QUALITY OF THE RAW BIT-STREAM

The aim of the following experiment was to validate the mutual independence of ring oscillators implemented in FPGA. Note that this mutual independence of rings is a necessary Fig. 8. Results of the FIPS 140-2 tests in the Wold's TRNG architecture simulations while injecting a Gaussian jitter of 30 ps and a varying deterministic jitter condition for the validity of the security proof from [START_REF] Sunar | A Provably Secure True Random Number Generator with Built-In Tolerance to Active Attacks[END_REF]. First, we implemented pairs of 9-element ROs with similar topology (similar routing) in both tested FPGA technologies. The generated clock periods were measured using the high bandwidth (3.5 Ghz) digital oscilloscope LeCroy WavePro 735Zi. The 1.2 V power supply of the FPGA core was replaced with an external variable power supply. The output clock signal periods were measured for the power supply ranging from 0.9 V to 1.3 V.

We can observe in Fig. 11 that for the Actel Fusion family the periods of the generated clock signals depend on the power supply in very similar, but not exactly the same way. We note that for a certain voltage interval the periods overlap, while outside this interval they tend to separate slightly. This corresponds to the use of coefficients K i in Section II and to the claim that they depend on the power supply, but differently for each gate or ring.

The difference between the two clock periods as the function of the power supply can be observed in Fig. 12. We can notice that it changes from negative to positive values following a monotonously rising curve; but suddenly, in the interval from 1.02 to 1.12 V, it drops almost to zero. The only explanation of this effect is that the rings become locked (otherwise they should cross only in one point). The fact that the period difference is not zero is explained later. We can conclude that in the locking range the role of coefficients K i on determination of the frequency (period) is overruled by some other phenomenon. This is coming probably from the dependence of the frequency of one oscillator on the current peaks caused by rising and falling edges of the second oscillator, as it is explained in the end of Section II. This phenomenon was not observed in the literature up to now.

The locking of two rings was also observable on the oscilloscope, as it is depicted in Fig. 13 using the screen persistence. We could observe several phenomena during our experiments:

• when the rings' frequencies were sufficiently close, it was quite easy to lock the rings by modifying the power supply; • the locking could be observed for both technologies used; • although most of the time the phase of the two signals on the oscilloscope was perfectly stable, sometimes they became unlocked for a very short time -this explains why the period difference measured in long time intervals was not exactly zero in the locking zone; • we could quite easily obtain the state when about 25 % of rings were locked -most of them were locked on a dominant frequency and other smaller groups of rings on other frequencies (this phenomenon was observed on all tested cards -five cards for each evaluated technology); • the state when two or more rings were locked on the nominal voltage level (without manipulating the power supply) could also be obtained. 10)), when built using ideal components. This fact means that the proof of Sunar can be valid for both architectures. We recall that the proof of Sunar is based on the entropy estimation based on the jitter measurement before the XOR gate, while supposing that this gate does not reduce the entropy. However, this last assumption is not true for the architecture of Sunar when implemented in physical devices. The architecture of Wold and Tan solves this Nevertheless, even the new architecture does not eliminate serious doubts about the entropy contents in the raw signal. Unfortunately, this entropy cannot be measured. Applying the theory of Sunar et al., the entropy of the raw binary signal can be estimated knowing the sampling frequency, size of the jitter and number of independent rings. Supposing that the rings are independent, this theory remains valid for the new generator architecture as we showed in Section II. For this reason we can conclude that while reducing number of rings, Wold and Tan reduced unconsciously the entropy of the generated signal. In order to maintain the security level, they should also modify the resilient function, in order to increase the compression ratio and to guarantee the output entropy per bit close to one. Instead, they propose to remove the post-processing, which is clearly a very dangerous action from the point of view of security.

Equation [START_REF] Tsoi | Compact FPGA-based true and pseudo random number generators. Field-Programmable Custom Computing Machines[END_REF] implies that both generators contain some memory element (they are not memoryless in the sense of term used in [START_REF] Killmann | AIS 31: Functionality classes and evaluation methodology for true (physical) random number generators, version 3.1[END_REF]). This means that besides the true random behavior coming from the Gaussian jitter, they will feature a pseudo-random behavior. This behavior can be described for any time instant t depending on the previous generator state characterized by phases ϕ j of N rings that generate clocks with periods T j . Following the principle of the generator, the presence of this kind of pseudo-randomness in generated bitstream is unavoidable.

There is another source causing the pseudo-randomness in the raw binary signal. It comes from the global deterministic jitter sources. Both above-mentioned sources of pseudorandomness are dangerous because they can mask the entropy insufficiency (the tests of randomness will pass) and at the same time they can be manipulated. However, the pseudorandomness coming from the evolution of the state of the generator described by Eq. ( 10) is more dangerous, because it can have two impacts: the attacker can manipulate the contents of the bit-stream and at the same time the entropy can be reduced.

For example, by modulating the power supply and thus changing the periods T j , the attacker can control the pseudorandom behavior of the generator to some extent (mutual relations between clock periods) and the state can be reached where the rings are locked. This way, the effective number of usable (independent) rings is reduced. As in the case of the generator of Wold and Tan, the reduced number of rings will lower the entropy of the generated signal and at the same time the generator's pseudo-random behavior will be simpler and thus easier to guess.

VIII. CONCLUSIONS

As it was shown, the generator of Wold and Tan follows the same mathematical model as that of Sunar et al. The security proof of Sunar can thus be applied (theoretically) also in this case. Because the generator of Wold and Tan gives much better binary raw signal in hardware, it should be preferred. However, in order to assure that the proof of Sunar will hold, the number of rings shouldn't be reduced as proposed in [START_REF] Wold | Analysis and enhancement of random number generator in FPGA based on oscillator rings[END_REF] only because the tests passed. As we showed, the generator using more than 18 ideal jitter-free rings having slightly different frequencies and producing only the manipulable pseudo-randomness, will always let the tests pass.

In an ideal case (i.e. when the rings are independent) and following the proof of Sunar, the number of rings is defined by the size of the Gaussian component of the jitter and by the reference clock frequency, both in relationship with the postprocessing resilient function. However, even if the number of rings remains high, some of them could be locked and the effective number of exploitable rings could be significantly lower. In this case, which is easy to obtain in real FPGAs and which can concern as much as 25 % of rings or more, the entropy of the generated raw signal would be much lower than expected and the generator would be predictable or manipulable.

The locking of rings depends on their topology (placement and routing) and on the technology used. The probability of locking could perhaps be reduced by a careful placement and routing on a per-device basis or by an independent powering of all rings. Applying the first approach, the designer loses the main advantage of this class of TRNGs -device-independent design. The second approach is impossible to apply in FPGAs. Another strategy can consist in detection of locking of rings in order to stop the generation of random numbers. However, the complexity of the detection circuitry would rise with the square of number of rings and it would thus limit the practical use of the generator, which is already penalized by the fact that the number of rings is considerable.

Although locking of rings can have disastrous consequences on the security of TRNGs based on ring oscillators, this phenomenon is not yet observed in the literature. For this reason, it should be studied extensively in the future.

Fig. 1 .

 1 Fig. 1. Original TRNG architecture of Sunar et al. (a) and modified architecture of Wold and Tan (b)

Fig. 2 .

 2 Fig. 2. Simulation and experimental platforms

Fig. 3 .

 3 Fig. 3. Implementation of ring oscillators in simulations and in hardware

Fig. 4 .

 4 Fig. 4. Results of the FIPS 140-2 tests in simulation with 30 ps of Gaussian jitter for Sunar's and Wold's architecture (excluding long runs that always passed), the tests pass if the results are in the gray region or are equal to zero for the "Runs" test A. Simulation Results and Mathematical Analysis of the Generator Behavior

Fig. 5 .

 5 Fig. 5. Results of the FIPS 140-2 tests for observed TRNG architectures with varying number of ring oscillators in Actel Fusion device

Fig. 6 .

 6 Fig. 6. Results of the FIPS 140-2 tests for observed TRNG architectures with varying number of ring oscillators in Altera Cyclone III device results are presented in Fig. 8.It can be seen that when the deterministic part increases, the tests pass more easily. But there are two problems concerning the deterministic component of the jitter:

Fig. 7 .

 7 Fig. 7. Results of the FIPS 140-2 tests in the Wold's TRNG architecture simulations with varying size of injected Gaussian jitter

Fig. 9 .

 9 Fig. 9. Results of the FIPS 140-2 tests of the Wold's TRNG architecture simulations with internal reference clock and varying size of injected Gaussian jitter

Fig. 10 .Fig. 11 .

 1011 Fig. 10. Results of the FIPS 140-2 test of the Wold's TRNG architecture simulations while injecting a Gaussian jitter with σ = 30 ps and a varying size of deterministic jitter, with internal reference clock

Fig. 12 .Fig. 13 .

 1213 Fig. 12. Difference between clock periods of two rings depending on the power supply

ACKNOWLEDGMENT

This paper is an extended version of the conference paper [22] presented at ReConFig09. The research was partially supported by a grant from the French National Research Agency -ANR-09-SEGI-013 and by the Rhone-Alpes Region and Saint-Etienne Metropole, France.


Luigi Macchi

Erik Hollnagel

Jörg Leonhard

Resilience Engineering Approach to Safety Assessment: An Application of FRAM for the MSAW system

This paper describes a safety assessment study of the Minimum Safety Altitude Warning system (MSAW) using resilience engineering principles. The purpose of the MSAW system is to alert Air Traffic Controller (ATCO) of potential Controlled Flight Into Terrain and Controlled Flight Into Obstacles with sufficient warning time for appropriate instructions to be issued to pilot. The first step of the safety assessment is to identify and describe the MSAW functions by means of the Functional Resonance Analysis Method (FRAM). The impact of the introduction of MSAW in the Air Traffic Management (ATM) system is evaluated by incorporating the MSAW functions into an existing FRAM model of ATCO activities. The resulting FRAM model is then used to evaluate two scenarios to identify possible risks emerging from the introduction of MSAW. Risk identification is based on the evaluation of functions' performance variability and on the occurrence of unexpected combinations. The advantages of this approach are discussed in the conclusion of the paper.

Provide to CWP QNH, wind speed and direction, heavy rain etc. Technical function performed by IDVS/omega system.

PROVIDE FLIGHT & RADAR DATA

Provide CWP flights call sing, flight level, aircraft typology, aircraft vectoring, route information etc. Technical function performed by P1/ATCAS system.

Introduction

The introduction in the Air Traffic Management system of a safety net device such as the Minimum Safety Altitude Warning system (MSAW), must be preceded by a safety assessment. The MSAW has been here used as case study for the application of the Functional Resonance Analysis Method (FRAM) to identify emergent risks due to the combination of variability of normal performance. A detailed description of the FRAM can be found in, e.g., [START_REF] Hollnagel | Barriers and accident prevention[END_REF], [START_REF] Woltjer | The Alaska airlines flight 261 accident: a systemic analysis of functional resonance[END_REF], or [START_REF] Macchi | A systemic approach to HRA: A FRAM modelling of Control Over Flight activity[END_REF]. The Deutsche Flugsicherung (DFS) MSAW System requirements document (Version 2.1 issued 11.01.2007) states that MSAW is a safety function that "under normal circumstances, allows the ATCO to conduct his tasks with MSAW operating in the background and not disturbing ATC process." MSAW, being normally transparent to the controller, has the objective to prevent a "serious situation from developing into a catastrophic one in case of loss of terrain awareness." In more detail, MSAW has the objective to alert ATCOs of a potential Controlled Flight Into Terrain (CFIT) and Controlled Flight Into Obstacle (CFIO) and serious approach path deviations. Alerts have to be provided with sufficient time to allow ATCOs to respond. The MSAW has the functionality to monitor:

1. General Terrain; 2. Minimum Radar Vectoring Altitudes; 3. Approach Path.

This paper describes the safety assessment of the Approach Path Monitoring functionality of MSAW. This functionality must alert ATCO in case of an aircraft that deviates, or is predicted to deviate, from the approach path of a runway.

System functions

In order to perform a safety assessment with FRAM it is necessary to identify and characterise MSAW specific functions and how they are coupled to other ATM functions (e.g., Monitoring, Planning, etc.). The detailed characterisation of the functions uses the six aspects (Input, Output, Preconditions, Resources, Time and Control) defined by the FRAM guidelines [START_REF] Hollnagel | Barriers and accident prevention[END_REF]. In the current analysis, the functions were grouped into the three categories of ATM functions, MSAW related functions, and Organisational functions.

ATM functions

The ATM functions represent what the ATM system does to achieve its objective, i.e., assure a safe and efficient air traffic flow in a given airspace. Twelve functions (Table 1) have been identified in collaboration with Air Traffic Controllers (ATCOs) and safety experts.

MONITORING

Monitor traffic situation and anticipate traffic development. This function consists in building and updating a mental picture of traffic situation, as well as search for potential conflicts.

PLANNING

Develop a control plan to anticipate conflicts and manage traffic flow.

STRIP MARKING

Mark the issued clearances on paper or electronic strip

COORDINATION

Coordinate with adjacent sectors on desired flights level, vectoring, route, airplanes reported problems etc. This function is performed by the planning controller to support executive controller activity 8 UPDATE FDPS Update data processing system with respect to issued clearances.

PILOT-ATCO COMMUNICATION

Communication, initiated by pilots, to establish radio contact or to request information or clearances to controller 10

SECTOR-SECTOR COMMUNICATION

Radio telecommunication between adjacent sectors to initiate the coordination function.

ISSUE CLEARANCE TO PILOT

Issue clearances to pilots via radio communication system or data link.

12 UPDATE MET DATA Manually update Meteorological data if technical system temporally fails and some data are missing

MSAW related functions

In order to evaluate the impact of the MSAW introduction on the ATM system it is necessary to integrate MSAW related functions with ATM functions. Based on participation in the official safety assessment workshop for MSAW, as well as several interactions with controllers, the following four functions have been identified (Table 2). The first function is performed by the technical system that computes and generates alerts on the base of the predicted aircraft paths and on the implemented logic. The three other functions require the intervention of humans to enable or disable the transmission of alerts to the Controller Working Position and define the airspace volumes and SSR codes for which alerts (if calculated) are not transmitted.

Organisational functions

The FRAM assumes that performance variability to a large extent is determined by the context or the work environment, and also that the context can be unstable or changing. Indeed, it is possible to consider the context as the outcome of other functions (physical, social, organisational, economical, etc.) in the environment where the work takes place, hence subject to organisational control.

To provide the basis for the identification of organisational functions, the set of Common Performance Conditions proposed by [START_REF] Hollnagel | Cognitive reliability and error analysis method[END_REF] was combined with recent research on evaluation of safety-critical organisation [START_REF] Reiman | Evaluating safety critical organizations -emphasis on the nuclear industry[END_REF]). An initial list was complied and compared against others from the organisational literature (e.g., [START_REF] Reason | The human contribution: Unsafe acts, accidents and heroic recoveries[END_REF][START_REF] Weick | Managing the unexpected: Resilient performance in an age of uncertainty[END_REF][START_REF] Hopkins | Failure to learn: the BP Texas City refinery disaster[END_REF]2008) and then refined for the specific case. The identified organisational functions are summarised in Table 3 and shown relative to the corresponding Common Performance Condition.

ENABLE MSAW ALERT

When MSAW is not enabled, the alert generation process continues, but alert transmission will be suppressed

DEFINE ALERT INHIBIT AIR SPACE VOLUMES

Define specified airspace volumes to inhibit the transmission of MSAW alerts

DEFINE ALERT INHIBIT SSR CODES

Define individual or list of SSR codes to inhibit the transmission of MSAW alerts.

Common Performance Conditions Function Description

HMI and operational support, conditions of work

MANAGE WORKING CONDITIONS

Organizational function: manage the conditions (e.g. HMI, ergonomic aspects, noise, lightening etc) in which the work is carried out

The FRAM model

The function identification leads to the FRAM model of the ATM system (Figure 1). The model is composed of the three types of functions presented above:

• ATM functions,

• Organisational functions (thick lined functions in the figure) and

• MSAW functions (in grey in the figure).

Notice that the functions in the model are not linked a priori. The links between them are generated according to the analysed scenario. The following describes a scenario that was developed to demonstrate the safety assessment. A set of instantiations (i.e., the way in which functions are coupled under given conditions) of the model is then presented. The instantiations, together with the evaluation of the performance variability, are the basis for the risk identification.

Approach landing scenario

The scenario used to assess the introduction of MSAW in the ATM system is a Landing approach at the Stuttgart airport (Germany). The airport and air traffic characteristics suggest that a scenario with two approaching aircraft is realistic. Interviews and field observations performed at DFS control centre in Langen showed how controllers would interact with the two flying pilots to direct them towards the Final Approach Fix point in the most efficient way. The following clearances will be issued:

1. Aircraft #1 identified, proceed direct to DLS 512, descend altitude 5000 FT-QNH 1027 2. Aircraft #2 identified, descend FL60, proceed direct to DLS 512 3. Aircraft #1 descend altitude 4000 FT, turn right heading 230, cleared ILS25 4. Aircraft #2 descend altitude 4000 FT-QNH 1027, turn left heading 210, cleared ILS25 5. Aircraft #1 contact tower 6. Aircraft #2 contact tower Figure 2 shows the arrival chart of Stuttgart airport and the paths aircraft would follow according to issued clearances (dotted lines).

Evaluation of variability of normal performance

In the FRAM, the identification of risks is based on the evaluation of the variability of normal performance and in its potential non-linear combination (so called functional resonance effect). It is therefore necessary first to assess performance variability. To begin with it is recognised that the functions of a socio-technical system have different characteristics that conveniently may be described by one of the three MTO categories: Human (M), Technology (T), and Organisation (O). These three categories describe functions of a different nature and with characteristic differences in performance variability.

• Human functions will typically be quite variable because people must adjust their performance to current working conditions (resources and demands, cf., [START_REF] Hollnagel | The ETTO principle: Why things that go right sometimes go wrong[END_REF]. Human performance can vary on a short term basis, but may also have a dampening effect.

• Technological functions that depend mainly on the technology implemented in the system are less subject to variability since they are designed to be stable, reliable, and predictable. For the purpose of this study the technological functions are assumed to be properly designed, implemented and maintained and variability is therefore not expected. Technical functions, however, do not have the possibility to dampen performance variability.

Organisational functions are subject to a different kind of variability, relative to the human functions. The nature or organisational functions makes these less variables than human functions -or rather their variability has a delayed effect on the human functions. A typical example could be the production and updating of procedures. However, since the aim of this safety assessment was the evaluation of the human contribution to system safety, organisational functions were considered stable for the scenario.

The following presents how performance variability for human functions could manifest itself (i.e., what the outputs of variable functions could be) and proposes a rule to assess performance variability. The application of the rule to the instantiations of the model supports the identification of emergent risks.

Human functions: Assessment of performance variability

The above presented set of organisational functions was introduced to account for the context effect on human performance. In this way the model and the method are both composed of homogeneous elements, namely functions and their aspects. The advantage of this is the possibility to assess performance variability by using a set of elements that can be described in a common way. In order to assess performance variability it is necessary to characterise the aspects for all the functions. Each aspect could be characterised in terms of the precision and timing with which it is produced.

terms of precision, an aspect can be:

• Precise;

• Acceptable;

• Imprecise.

In terms of time, an aspect can be:

• Too early;

• On-time;

• Too late.

In FRAM, the output of an upstream function may be used by a downstream function as Input or Precondition or Control or Resource. The timing of the output from an upstream function may affect the available time for the downstream functions to be performed, i.e., it may increase or decrease temporal pressure, which in turn may have an impact on the precision and timing of their output. It is possible to represent the quality of possible outputs combining the precision and the timing characteristic as shown in Table 4. 4 can be used to assess the potential for performance variability induced by the combination of all the incoming aspects for a given function and consequently the likely quality of its output. The effect on performance variability of the aspects could be presented as follow (Figure 3): For the time being a quite simple rule (method) could be proposed:

The median of the quality of the aspects is the quality of the output.

Risks identification results

The risk identification for the scenario is based on a 'paper and pencil' simulation. It is used to illustrate how the proposed methodology can be applied to a real safety assessment case, although such an application certainly will be more intricate. The presented scenario could be instantiated in the model leading to a set of sequence of instantiations representing the temporal development of the scenario. Note that the analysis of the consequences of performance variability is based on the contents of the FRAM model rather than on the graphical rendering. The latter can be useful for communication, but is not essential for the method as such.

In order to apply the method to the identification of potential emergent risks, a further set of assumptions has to be made: 1. Organisational functions produce precise outputs, therefore the context for Human functions performance is acceptable and the organisational functions therefore do not induce variability; 2. The MSAW function 'Generate MSAW alert' during the scenario triggers an alert (for Aircraft #1) during the development of the scenario. The remaining technological functions are properly designed and implemented their outputs are therefore correct and no variability is induced; 3. The MSAW function 'Enable MSAW alert transmission' is performed imprecisely characterised as H in Table 4); 4. 'Issue clearance to pilot' function is performed earlier than expected when the clearance Aircraft #1 descend altitude 4000 FT, turn right heading 230, cleared ILS2 is issued (Output characterised as D in Table 4); 5. The remaining functions are performed with acceptable precision and timing (Output characterised as E in Table 4). It is now possible to present the instantiations, to apply the methodology, and to draw preliminary conclusions. In the diagrams that follow, dotted lines represent the output of organisational functions, i.e., the context. Only relevant functions are represented in the instantiations.

Landing approach scenario -First instantiation

The first instantiation (Figure 4) represents the starting point for the 'paper and pencil' simulation. Due to the above mentioned assumptions, no risks emerge from this instantiation. Although the inaccurate enabling of MSAW alert transmission introduces potential performance variability in the system, the potential variability is not because there is no need of an MSAW alert at the time.

Landing approach scenario -Third instantiation

In addition, an alert is calculated but not displayed on CWP (as assumed) since Preconditions are not satisfied. The Monitoring function therefore receives:

• Acceptable precision and correctly timed output from the Provide Met. Data (Output E); • Acceptable precision but premature flight data for A/C #1 (Output D); • Imprecise but correctly timed data from the MSAW functions (Output H).

Its output therefore is still acceptable but no longer on time (Output F), since it is reasonable to consider ATCO will detect the dangerous situation for Aircraft #1 later than if supported by MSAW. The application of the proposed methodology to a simplified example has shown the possibility for identification of emergent risks due to the interaction of the variability of normal performance induced by the 'Issue clearance to pilot' and 'Enable MSAW alert transmission' functions. Given the above assumptions, this variability may affect the Monitoring function in such a way that that it is performed with acceptable precision but later than expected.

Conclusion

This paper has presented the application of the Functional Resonance Analysis Method to perform a safety assessment study for the Minimum Safe Altitude Warning system. The introduction of a safety net system in the ATM domain requires the evaluation of its potential impact in safety terms. Adopting a resilience engineering approach, the FRAM and the proposed methodology have been applied to look for risks due to the combination of variability of normal performance rather than to system failures or breakdowns. The Landing approach scenario illustrated how an inappropriate enabling of the alert transmission in combination with a 'trivial' anticipation of a clearance could result in a degraded performance of the monitoring function. This result, within the limitations of the example, nevertheless shows the added value of a resilience engineering approach when evaluating the potential of the introduction of new equipments in the ATM domain.

Figure 1 -

 1 Figure 1 -The FRAM model of the socio-technical system

Figure 2 -

 2 Figure 2-Approach landing scenario at Stuttgart airport

Figure 3 -

 3 Figure 3-Aspect's quality effect on Performance variability

Figure 4 -

 4 Figure 4-Scenario -First instantiationLanding approach scenario-Second instantiationThe second instantiation for the scenario represents the temporal evolution of the situation. After the first instantiation the two aircraft have been instructed to proceed directly towards DLS512. During this instantiation, two additional clearances are issued to the pilots. As assumed, the clearance Aircraft #1 descend altitude 4000 FT, turn right heading 230, cleared ILS2 is issued too early (Output D).

  Figure 6-Scenario -Third instantiation

Table 1 -

 1 ATM functions

	1	PROVIDE MET DATA
	3	DISPLAY DATA CWP

Display data on Controller Working Position

Table 2 -

 2 MSAW functions

Table 3 -Mapping CPCs into Organisational functions Common Performance Conditions Function Description

 3

	Availability of resources, number	MANAGE RESOURCES	Organizational function: provide and manage
	of goals and conflict resolution,		economical, technical and human resources to
	available time		allow system functioning
	Training and experience	MANAGE COMPETENCE	Organizational function: provide operators with
			required competences and knowledge for system
			operation. This includes technical, safety
			competence and deference to expertise.
	Access to procedures and	MANAGE PROCEDURES	Organizational function: design, update, distribute
	methods		procedures to support operational activity
	Crew collaboration and quality	MANAGE TEAMWORK	Organizational function: manage teamwork to
			assure a desired quality in team collaboration

Table 4 -

 4 Human functions: output characterisation

			Temporal characteristics
		Too early	On time	Too late
	Precise	A: Output to down-	B: Output to down-	C: Output to down-
		stream functions is	stream functions is	stream functions is
		precise but too early	precise with the right	precise but delayed,
			timing	reducing available
				time
	Acceptable D: Output to down-	E: Output to down-	F: Output to down-
		stream functions is	stream functions is	stream functions is
	Precision	acceptable but too	acceptable with the	acceptable but
		early	right timing	delayed, reducing
				available time
	Imprecise G: Output to down-	H: Output to down-	I: Output to down-
		stream functions is	stream functions is	stream functions is
		imprecise and too	imprecise but cor-	imprecise as well as
		early	rectly timed	delayed, reducing
				available time
	Table

Acknowledgements

We are grateful to the air traffic controllers at DFS and to Ivonne Herrera for their availability, the useful discussions and the support they have always been ready to provide.