e.02.39 emergia d2.2 report...e.02.39 emergia d2.2 report emergent behaviour of simulation model...

E.02.39 EMERGIA D2.2 Report

Emergent Behaviour of Simulation Model

Document information

Project title EMERGIA - Powerful Emergent Behaviour In ATM

Project N° E.02.39.

Project Manager National Aerospace Laboratory NLR

Deliverable Name

Project Plan

Deliverable ID D2.2

Edition V1.0

Task contributors

National Aerospace Laboratory NLR

Abstract

One of the key innovations in SESAR2020+ is the introduction of a strategic Trajectory

Based Operation (TBO) layer. In this report for the first time rare emergent behaviour has

been studied for a ground-based future concept that makes use of both a strategic TBO layer

and a tactical resolution layer. The agent-based model studied has been derived from an

advanced airborne self-separation TBO model for which remarkably positive results have

been obtained through the iFly project. The current report documents the development of the

ground-based version of this so well performing airborne based TBO model, and the

systematic evaluation of this ground based TBO model through rare event Monte Carlo

simulations. This study reveals key challenges that remain to resolved in order for a ground-

based TBO model to accommodate very high traffic demands as safe as the airborne based

TBO model does.

Authoring & Approval

Prepared By

Name & organisation Position / Title Date

Henk Blom / NLR Project leader of EMERGIA

13 May 2014

Bert Bakker / NLR Key Expert in EMERGIA 13 May 2014

Reviewed By


Dennis Nieuwenhuisen Leader of WP3 in EMERGIA

7 October 2014

Frank Bussink Contributor to WP3 21 October 2014

Richard Irvine SESAR WP-E project officer

21 November 2014

Approved By


Henk Blom / NLR Project leader of EMERGIA

11 December 2014

Approval does not refer to approval by EUROCONTROL / SJU but approval by the project consortium. Document History

Edition Date Status Author Justification

V0.1 13 May 2014 Draft H. Blom 1st draft, inputs from D2.1

V0.2 16 June 2014 Draft H. Blom 2nd

draft, inputs from MSc

V0.3 19 June 2014 Draft H. Blom 3rd

draft, + SESAR ConOps

V0.4 26 June 2014 Draft H. Blom 4th draft, significant edits

V0.5 30 June 2014 Draft H. Blom 5th draft, significant edits

V0.6 22 August 2014 Draft H Blom 6th draft, ATCo activity added

V0.7 3 October 2014 Draft H. Blom 7th draft, 8 a/c added

V0.8 13 October 2014 Draft H. Blom Internal review incorporated

V0.9 17 October 2014 Draft H. Blom Minor final editing cycle

V1.0 11 December 2014 Final H. Blom SESAR WP-E review comments

V1.0u 31 December 2014 Final H. Blom Minor corrections

of 96

TABLE OF CONTENTS

ACRONYMS ................................................................................................................................ 5

1 INTRODUCTION .................................................................................................................. 7

1.1 BACKGROUND ......................................................................................................................... 7

1.2 EMERGIA PROJECT ................................................................................................................. 7

1.3 THE OBJECTIVE OF THIS REPORT ................................................................................................. 8

1.4 THE ORGANIZATION OF THIS REPORT ............................................................................................ 8

2 THE NOVEL CONOPS: A3GROUND .................................................................................... 10

2.1 FROM A3 CONOPS TO A3GROUND (A3G) CONOPS ................................................................. 10

2.2 RBT UPDATING AND MTCDR IN THE A3G CONOPS ....................................................................... 11

2.3 TACTICAL RESOLUTION AND STCDR IN THE A3G CONOPS .............................................................. 13

2.4 A3G CONOPS VERSUS SESAR 2020+ CONOPS ........................................................................... 14

3 THE A3G MODEL ............................................................................................................... 21

3.1 A3G MODEL ASSUMPTIONS .................................................................................................... 21

3.2 AGENTS IN THE A3G MODEL .................................................................................................. 21

3.3 ATC GROUND SYSTEM ARCHITECTURE IN THE A3G MODEL......................................................... 23

3.4 INTERCONNECTED LPN’S OF THE ATC SYSTEM ............................................................................. 25

3.5 ATCO AS AGENT IN THE A3G MODEL ...................................................................................... 28

3.6 NEW COMMUNICATION SYSTEMS IN THE A3G MODEL ................................................................ 30

3.7 PILOT FLYING AS AGENT IN THE A3G MODEL ........................................................................... 33

3.8 IMPLEMENTATION AND VERIFICATION OF THE A3G CODE ........................................................... 35

4 MC SIMULATION OF 2 AIRCRAFT ENCOUNTERS ...................................................... 38

4.1 A3G BASELINE PARAMETER VALUES ....................................................................................... 38

4.2 MC SIMULATION RESULTS UNDER A3G BASELINE PARAMETER VALUES ......................................... 40

4.3 A3G SIMULATION RESULTS UNDER A3 BASELINE PARAMETER VALUES ......................................... 41

4.4 ADDITIONAL MC SIMULATION TESTS OF 2 A/C ENCOUNTERS ..................................................... 42

of 96

4.5 TEST C: GLOBAL GNSS/GPS ............................................................................................... 44

4.6 TEST D: GLOBAL ADS-B FREQUENCY .................................................................................... 45

4.7 TEST E: GLOBAL ATC UPLINK FREQUENCY ............................................................................. 46

4.8 TEST F: AIRCRAFT GPS RECEIVER ......................................................................................... 47

4.9 TEST G: AIRCRAFT ALTIMETER .............................................................................................. 49

4.10 TEST H: AIRCRAFT ADS-B TRANSMITTER ............................................................................... 50

4.11 TEST I: ATC GROUND SYSTEM CORRUPTED ............................................................................. 52

4.12 TEST J: ATC GROUND SYSTEM FAILURE .................................................................................. 53

4.13 TEST K: GROUND ADS-B RECEIVER ...................................................................................... 54

4.14 TEST L: ATCO-TACTICAL MAXIMUM RESPONSE TIME ................................................................ 55

4.15 TEST M: ATCO-PLANNING MAXIMUM RESPONSE TIME .............................................................. 58

4.16 TEST N: ATC UPLINK TRANSMITTER ...................................................................................... 60

4.17 SELECTED PARAMETER VALUES FOR THE A3G MODEL ................................................................ 63

4.18 INTERPRETATION OF THE 2 AIRCAFT ENCOUNTER RESULTS OBTAINED ......................................... 64

5 MC SIMULATION OF 8 AIRCRAFT ENCOUNTERS ...................................................... 68

5.1 A3G SELECTED AND A3G BASELINE PARAMETER VALUES APPLIED TO 8/AC ENCOUNTERS ................ 68

5.2 A3G BASELINE PARAMETER VALUES, EXCEPT A VERY FAST PILOT RESPONSE .................................. 70

5.3 FINDINGS FOR 8 A/C ENCOUNTERS ........................................................................................ 72

6 RANDOM TRAFFIC SCENARIOS ................................................................................... 73

6.1 MONTE CARLO SIMULATION RESULTS FOR RANDOM TRAFFIC SCENARIOS ...................................... 73

6.2 MTCR AND STCR ACTIVITY FREQUENCIES FOR PILOT CREWS .................................................... 73

6.3 PREDICTED A3G CONOPS MTCR AND STCR ACTIVITY FREQUENCIES FOR PLANNING ATCO .......... 74

6.4 PREDICTED A3G CONOPS MTCR AND STCR ACTIVITY FREQUENCIES FOR TACTICAL ATCO ........... 76

7 CONCLUSION .................................................................................................................. 77

8 REFERENCES ................................................................................................................... 79

of 96

ACRONYMS

4D

4 dimensional

a/c

aircraft

A3

Autonomous Aircraft Advanced

A3G

Autonomous Aircraft Advanced Ground

ABMS ACAS

Agent Based Modelling and Simulation Airborne Collision Avoidance System

ADS-B

Automatic Dependent Surveillance-Broadcast

AMFF ANP

Autonomous Mediterranean Free Flight Actual Navigation Performance

ANSP AP/FD

Air Navigation Service Provider Auto Pilot / Flight Director

AOC

Airline Operations Centre

ASAS

Airborne Separation Assistance System

ATC

Air Traffic Control

ATCo ATI

Air Traffic Controller Aeronautical Telecommunication Information

ATM

Air Traffic Management

CAA

Civil Aviation Authority

CAST

Commercial Aviation Safety Team

CD

Conflict Detection

CD&R CDTI

Conflict Detection and Resolution Cockpit Display of Traffic Information

CICTT

CAST/ICAO Common Taxonomy Team

ConOps

Concept of Operations

CPDLC

Controller Pilot Data Link Communication

CR

Conflict Resolution

DAG-TM

The Distributed Air/Ground Traffic Management

DCPN FDPS

Dynamically Coloured Petri Net Flight Data Processing System

FL

Flight Level

FMS

Flight Management System

ft.

foot

GNC

Guidance, Navigation and Control

GNSS

Global Navigation Satellite System

GPS GSHS

Global Positioning System General Stochastic Hybrid System

HMI

Human Machine Interface

ICAO

International Civil Aviation Organization

IPN

Interaction Petri Net

IPS

Interacting Particle System

IRS

Inertial Reference System

JAA

Joint Aviation Authority

LOS

Loss of Separation

LPN

Local Petri Net

MAC

Mid Air Collision

MC

Monte Carlo

of 96

MSI

Minimum Separation Infringement

MTC

Medium Term Conflict

MTCD MTCDR

Medium Term Conflict Detection Medium Term Conflict Detection and Resolution

MTCR

Medium Term Conflict Resolution

n.a.

not applicable

NLR

National Aerospace Laboratory

NLR

Nationaal Lucht- en Ruimtevaart laboratorium

Nm

Nautical mile

NMAC OSED P-ASAS

Near Mid Air Collision Operational Services and Environment Description Predictive Airborne Separation Assurance System

PF

Pilot Flying

PN

Petri Net

PNF

Pilot-Not-Flying

R/T

Radio-Telephony

RA

Resolution Advisory

RBT RTA

Reference Business Trajectory Required Time of Arrival

RTCA

Radio Technical Commission for Aeronautics

SA SBT

Situation Awareness Shared Business Trajectory

SDCPN

Stochastically and Dynamically Coloured Petri Net

SES

Single European Sky

SESAR

Single European Sky ATM Research

SMC

Sequential Monte Carlo

SSA

Self-Separating Airspace

SSR

Secondary Surveillance Radar

STC

Short Term Conflict

STCA

Short Term Conflict Alert

STCD STCDR

Short Term Conflict Detection Short Term Conflict Detection and Resolution

STCR

Short Term Conflict Resolution

SWIM

System Wide Information Management

TBO

Trajectory Based Operations

TCP

Trajectory Change Point

TOPAZ WP

Traffic Organization and Perturbation AnalyZer Work Package

of 96

1 INTRODUCTION

1.1 Background

Following [SESAR, 2007], the SESAR concept of operations beyond 2020 (SESAR2020+)

involves a series of changes relative to current Air Traffic Management (ATM). Central to these

changes is the paradigm shift that aircraft should fly according to agreed conflict free 4D

trajectory plans which are made known to all actors involved as Reference Business Trajectories

(RBT’s). A big unknown in this RBT framework is how everything works under various kinds of

uncertainty, as a result of which one or more aircraft may not realize their RBT’s. There are

several categories of uncertainty (including unexpected disturbances) that cannot be totally

avoided, such as: Meteorological uncertainties; Data related uncertainties; Human related

uncertainties; and Technical systems related uncertainties.

In principle the SESAR2020+ ConOps has been designed to take care of these kinds of

uncertainty through the possibility to revise 4D trajectory plans, and also to allow air traffic

control to issue tactical flight instructions to pilots if the 4D planning layer has run out of time.

Although these tactical instructions are quite similar to the established way of working by an air

traffic controller, there also are significant differences.

Under SESAR2020+ an air traffic controller is expected to handle significantly more aircraft in

its sector. Therefore the SESAR2020+ ConOps also foresees dedicated tactical decision support

tools for air traffic controllers. The key issue is how to optimize the socio-technical collaboration

between the 4D planning layer and the tactical layer in order to manage air traffic most

effectively while taking into account the various uncertainties.

In conventional ATM, mediumterm planning is provided by the planning controller, flight crews

and their Flight Management Systems (FMS), whereas the tactical loop is formed by the tactical

controller and flight crews. Thanks to decades of evolutionary developments, the collaboration

between these two layers has been optimized. For SESAR2020+ a similar optimization of the

novel 4D planning layer with the tactical layer is needed. Because the collaboration between

these layers involves dynamic interactions between human decision makers, technical support

systems, aircraft evolution, weather and other uncertainties, the combined effects result in types

of emergent behaviours that cannot be predicted from the sum of the elemental behaviours. This

can easily lead to negative emergent behaviours at time scales that remain invisible using

established evaluation techniques.

1.2 EMERGIA project

During large European research projects HYBRIDGE and iFly, innovative complexity science

techniques have been developed and applied to airborne self-separation concepts of operations.

In order to understand and improve the emergent behaviours of SESAR2020+ at multiple time

scales, the EMERGIA project will use these innovative complexity science techniques. This way

EMERGIA aims to dramatically reduce the risks that negative emergent behaviours have to be

of 96

repaired at a late stage, at huge operational costs, and will shorten the period needed to optimize

the system architecture and design of SESAR2020+.

The most advanced airborne self-separation concept of operations studied within iFly, makes use

of similar 4D planning and tactical layers as SESAR2020+, though fully airborne. This ConOps

is referred to as the A3 model. Based on rare event Monte Carlo simulations of this A3 model,

conducted within the iFly project, [Blom & Bakker, 2011a,b, 2012] have shown that in an

advanced airborne-self separation TBO concept the 4D planning and tactical layers can work so

well together that this leads to very powerful positive emergent behaviours, even beyond

expectations of the concept developers. As a result of these powerful positive emergent

behaviours, the advanced airborne self-separation concept considered can safely accommodate

very high enroute traffic demands. This raises the question whether these powerful emergent

behaviours can be maintained while moving the 4D planning layer and the tactical layer to the

ground, as is the case with SESAR2020+. The objective of EMERGIA is to answer this research

question [EMERGIA, 2012].

1.3 The objective of this report

The original EMERGIA plan was to address the above formulated research question in three

steps. The first step is to develop a ground-based version of the A3 model (shortly referred to as

A3G model), to compare this to the SESAR2020+ ConOps, and to use the innovative complexity

science techniques to identify the emergent behaviours of this A3G model. The second step is to

compare these emergent behaviours to the powerful positive emergent behaviours of the

advanced airborne self-separation ConOps, and to study the possible improvement of the A3G

model in case of significant difference in emergent behaviours. The third step is to evaluate the

improved A3G model on its emergent behaviours, again by using the innovative complexity

science techniques.

Hence, according to the initial EMERGIA plan, the comparison of the A3G model results versus

the A3 model results would only be done during step 2. However it turned out to be more

practical to follow another approach. The idea behind this new approach is that by changing

appropriate parameter values in the A3G model it should be possible to arrive at the same

emergent behaviour results as those found for the A3 model. This novel approach however

required that a regular comparison between the A3 model and the A3G model was made already

during step 1, rather than delaying such comparison to step 2. Therefore, the current report

presents the results obtained during step 1 as well as the results of the comparison against the A3

model behaviour planned for the first half of step 2.

1.4 The organization of this report

This report is organized as follows. First, in section 2 it is described how the A3 model is

systematically used to develop an ground-based version of it, i.e. the A3G model. Also a

systematic comparison of the A3G model is made with the SESAR2020+ ConOps.

Subsequently, Section 3 presents the systematic development and verification of an agent-based

Monte Carlo simulation model of the A3G model.

The systematic evaluation of the A3G model regarding the feasibility of getting its emergent

behaviour the same as it has been seen for the A3 model, is addressed in sections 4-6. In section

of 96

4, for 2 aircraft encounter scenarios it is considered under which A3G model parameter values

the behaviour is the same as it has been observed under the A3 model. Subsequently, in Section

5 it is investigated whether there are additional requirements on the model parameter settings

under the eight aircraft encounter scenarios. Finally, in Section 6, a systematic study is

conducted regarding the task load of pilots and controllers under the A3G model relative to those

under the A3 model. Finally, section 7 draws conclusions.

For sections 2-4, some material has been used from [Nieskens, 2014].

of 96

2 THE NOVEL CONOPS: A3GROUND

In subsection 2.1 the novel concept of operations (ConOps) is described; it is a ground-based

version of the A3 ConOps. Subsequently in subsection 2.2 a comparison is made of this novel

A3G ConOps versus the SESAR2020+ ConOps [SESAR-JU, 2013].

2.1 From A3 ConOps to A3Ground (A3G) ConOps

Within the iFly project, NASA’s advanced ConOps [NASA, 2004] has gratefully been used as

starting point for the development of an advanced airborne self separation concept for en-route

traffic under the name A3 ConOps [iFly D1.3, 2010]. This A3 ConOps intentionally addresses

the hypothetical situation of 100% well equipped aircraft. For this A3 ConOps an Operational

Services and Environmental Description (OSED) is also available [iFly D9.1, 2009].

Similar to the SESAR2020+ TBO concept, the A3 ConOps adopts TBO in the sense that each

aircraft maintains a 4D trajectory intent that is shared with all other aircraft. According to

SESAR2020+ terminology [SESAR, 2007], the 4D trajectory intent of an aircraft is referred to

as a Reference Business Trajectory (RBT). However, RBT management in the A3 ConOps is

done by each aircraft itself, without any support from air traffic control at the ground. Each

aircraft is assumed to be equipped with the same dedicated ASAS system which is monitoring

the surroundings and helps the flight crew to detect and resolve conflicts.

The A3G ConOps is an adaptation of the A3 ConOps. The A3G abbreviation is short for

A3Ground. In the A3 ConOps the separation was managed by the aircraft. In the A3G ConOps

the responsibility for separation assurance is moved back to ATC. Hence the 4D trajectory plans

and tactical resolutions are provided by ground-based ATC.

Figure 2.1 gives a graphical presentation of A3 ConOps vs. A3G ConOps. At the left side is the

A3G ConOps where separation is controlled by ATC. At the right side is the A3 ConOps where

the pilots are responsible for self separation.

Figure 2.1: Graphical representation of A3G ConOps (left) and A

3 ConOps (right) (Cuevas, et

al., 2010)

Similar as in [NASA, 2004], A3’s uses two layers in the detection and resolution of potential

conflicts: the RBT layer and the tactical resolution layer. The RBT layer takes care in making

of 96

updates of the RBT in case of a medium term conflict. The ASAS support of the RBT layer

consists of a Medium Term Conflict Detection and Resolution (MTCDR) support system. The

tactical layer takes care of resolving short term conflicts. The ASAS support of the Tactical layer

consists of a Short Term Conflict Detection and Resolution (STCDR) support system.

Because the development of proper working MTCDR and STCDR support systems has been a

major effort within the iFly project, and these support systems have proven to work well, the

proposal is to reuse these MTCDR and STCDR support systems, with one major difference: now

they are going to be used as support systems for ATC instead of flight crews. In addition to this,

in the A3G ConOps the ATC system will maintain a database containing all currently active

RBT’s.

For each aircraft, MTCDR supports the controller in identifying 4D trajectories which are

conflict-free (i.e. centre lines stay 5NM or 1000 ft apart) with the currently active RBT’s of

higher priority aircraft over a time horizon of at least 15 minutes. Each time MTCDR detects a

medium term conflict between any of the currently active RBT’s in the ATC system database,

then MTCDR tries to resolve this through determining a new conflict-free 4D trajectory for the

aircraft having lower priority. The priority of an aircraft is primarily determined by the

remaining distance to destination. Conflict-free also means that the 4D trajectory does not create

a new conflict with an RBT of any of the other aircraft that have higher priorities. Upon

acceptance of such new 4D trajectory by the controller, it is uplinked to the appropriate aircraft

and evaluated by the flight crew. Upon acceptance by the flight crew this 4D trajectory plan is

entered into the FMS and downlinked to the ATC system as the aircraft’s new RBT. In the ATC

system this downlinked RBT is then stored in the database of currently active RBT’s.

STCDR provides tactical maneuver support to a controller for conflict resolution with a time

horizon of 3 minutes, at a separation criterion of 5Nm/900ft. When STCDR detects a potential

infringement of these separation criteria, then STCDR proposes tactical resolution maneuvers to

the controller for each of the aircraft involved. The controller can select one of these tactical

resolution maneuvers and subsequently instructs the corresponding flight crew to implement this

tactical maneuver. This tactical maneuver instruction is then also inserted in the ATC database as

a correction to the corresponding RBT.

In the A3 ConOps there is an emergency procedure for the crew in case an aircraft suffers from

technical problems. Within the A3G ConOps however, the pilot has to inform ATC about an

aircraft emergency situation. Subsequently ATC should start to handle this problem. The current

A3G ConOps does not yet describe what ATC should do.

2.2 RBT updating and MTCDR in the A3G ConOps

Similar as in the A3 ConOps, in the A3G ConOps an RBT prescribes multiple waypoints which

can be inserted by the pilot in the FMS, directing the aircraft to its end goal.

In Figure 2.2 the new procedure for RBT updating in the A3G ConOps is presented. In this

procedure the ground-based ATC system and the ATCo are incorporated.

of 96

Figure 2.2: RBT updating in the A3G ConOps

The procedure is initiated on the ground by the ATC system. The MTCDR support system of

ATC detects a medium term conflict and will then try to generate a new conflictfree trajectory

based on the available intent information of all aircraft. This conflict-free trajectory is proposed

as candidate RBT update to the planning ATCo (ATCo-P). The ATCo-P will check if the

proposal is OK or not. If the ATCo-P accepts the proposal, then it is submitted to the

corresponding aircraft through the ATC Uplink Transmitter. The Pilot Flying will check the

given RBT update and when approved will insert this in the FMS, and the aircraft will follow

this updated RBT. Finally the aircraft will broadcast the updated RBT from its FMS to the ATC

ground system using ADS-B or ADS-C. Upon reception this received RBT is used to update the

RBT data in the ATC ground system.

The above described procedure for RBT updating may also be used to let the FMS guide an

aircraft back to its initial path after a tactical resolution manoeuvre. In such case the RBT

updating consists of a conflict-free 4D trajectory that brings the aircraft back to its goal.

In the MTCDR support system used within the A3 ConOps, the selected conflict resolution

approach was based on Velocity Obstacles [Fiorini & Schiller, 1998; Abe at al., 2001]. Velocity

Obstacles (also known as Collision Cones) based conflict resolution means that an aircraft stays

away from the set of courses and velocities that lead to a predicted conflict with any other

aircraft. In airborne self-separation research, such Velocity Obstacles approach has been referred

to as Predictive ASAS [Hoekstra, 2001]. At this moment the Velocity Obstacle approach is

limited to horizontal maneuvering only.

Complementary to the choice of Velocity Obstacle based conflict resolution, the following

implementation principles have been adopted for the MTCDR support system:

+ MTCDR detects planning conflicts (5Nm/1000ft) 10 min. ahead and subsequently determines

a 4D trajectory plan that is conflict free over a horizon of 15 min.

+ Aircraft nearest to destination are given priority over other.

+ Aircraft with lowest priority are assumed to make its 4D plan conflict free (15 min ahead) with

all other plans.

+ If there is no feasible conflict free plan then rather than doing nothing, it is better for the

MTCDR to identify a plan that has a minimal undershooting of the 5Nm/1000ft criterion and

does not create a short term conflict.

ATC Ground

System

New 4D

trajectory planPlanning ATCo

Pilot-Flying-i

ATC Uplink

Transmitter

FMS-i

4D

trajectory plan

4D

trajectory plan

OK / Not-OK

ADS-B

transmitter-iRBT a/c-i

RBT a/c-i

OK / Not-OK

a/c receiver-i4D

trajectory plan

4D

trajectory plan

of 96

+ Upon approval by the controller a non-conflict-free 4D trajectory plan is uplinked to the

aircraft together with a “Handicap” message. For the flight crew this handicap message means

that the priority of its aircraft has been increased, and that the controller will resolve the

remaining conflicts with the help of those aircraft having now a lower priority. Upon acceptance

by the flight crew, the 4D plan is entered into the FMS, and it is downlinked as the new RBT to

ATC, again together with the Handicap message. This new RBT are stored in the ATC database

together with the Handicap message.

Using the above principles, for each aircraft the MTCDR computes an RBT advisory by

determining a sequence of Trajectory Change Points (TCP’s) with minimum turning angles (to

the left or to the right) such that there are no predicted conflicts remaining with any aircraft

which has higher priority and which is within the MTCDR horizon. If there is no minimum

turning angle possible below a certain value φM, max, then the turning angle below φM, max is

identified which does not create a short term conflict and provides the lowest undershooting of

the minimum spacing criteria of 5Nm/1000ft between the RBT’s. In that case ATC assumes the

corresponding aircraft to be handicapped. As soon as the advised MTCDR advisories have been

accepted by the controller and the pilot, then they are implemented in the FMS and downlinked

to ATC together with the handicap message.

2.3 Tactical resolution and STCDR in the A3G ConOps

When a short term conflict is detected its resolution through RBT updating would take too much

time. Hence a faster tactical resolution process is necessary. Just as in the A3 ConOps a tactical

resolution is based on aircraft states and if available also on intent information. A tactical

resolution consists of an immediate heading change or a height change. In Figure 2.3 the tactical

resolution process as used in the A3G ConOps is presented.

Figure 2.3: Short Term Resolution (STC) process in the A3G ConOps.

The tactical resolution process starts with the detection of a short term conflict by the STCDR

support system of ATC. This STCDR will then automatically determine a possible tactical

resolution in terms of a heading or height change. Because the time horizon is short, this tactical

resolution is open loop, i.e. it does not include a back-to-goal maneuver. The proposed tactical

ATC Ground

System

Proposed

Heading

/ height

change

Tactical ATCo

Pilot-Flying-i

ATC Uplink

Transmitter

Aircraft

Guidance

Heading /

height

change

instruction

Heading / height

change

New heading/height

Manual

Heading /

height

change

a/c receiver-i

Heading /

height

change

ADS-B

transmitter-i

Current

heading /

height

of 96

resolution is shown to the ATCo-Tactical (ATCo-T). The ATCo-T verifies the proposed

resolution, and may reject or accept it. If accepted it is sent to the corresponding aircraft through

the ATC uplink transmitter (CPDLC message).

Upon receiving the CPDLC message, the Pilot flying will implement the tactical resolution by

switching the aircraft from FMS to manual (tactical Auto Pilot / Flight Director) mode and

subsequently implement the given heading or height change. Subsequently ADS-B broadcasts

the slowly changing heading or height to the ATC ground system.

Simultaneously with sending the tactical resolution through CPDLC, the ATCo-T inserts the

instructed heading or height change in the ATC ground system. A side-effect of this is that the

actual behaviour of the aircraft will happen with some delay relative to the information in the

ATC ground system. This allows the ATC system to anticipate on the proposed heading change,

because it is already aware of the oncoming heading or height change of the aircraft. By directly

updating the intent information before the aircraft actually has changed its heading, the detection

and resolution of other short term conflicts works more efficiently.

The specific implementation principles adopted for the STCDR support system are at this

moment directed to horizontal maneuvers only:

+ STCDR detects conflicts (5Nm/900ft) 3 min. ahead and subsequently determines a course

change into a direction that is conflict free over a horizon of 3 min. plus 1 min.

+ Short term conflict resolution is also based on Velocity Obstacles approach.

+ When a short term conflict is detected between two aircraft, then agent-based STCDR

identifies two conflict-free tactical maneuver options, one for each aircraft. It is up to the

controller to select one of the proposed tactical maneuver options, and then to instruct this

maneuver to the applicable flight crew, and to enter this as an RBT modification in the ATC

database.

+ If there is no feasible alternative, then rather than doing nothing it is better to choose a tactical

maneuver which minimizes the undershooting of the minimum tactical separation criterion.

+ Upon approval of the crew, the aircraft downlinks its new course, which allows the ATC

system to verify that the instruction has been implemented well.

Using the above principles, STCDR proposes resolution course as the minimum turning angle (to

the left or to the right) such that there are no predicted conflicts remaining with any aircraft and

which is within the short term horizon. If there is no minimum turning angle possible below a

certain value φS, max, then the turning angle below φS, max is identified which provides the lowest

undershooting of the minimum separation criteria.

2.4 A3G ConOps versus SESAR 2020+ ConOps

The SESAR2020+ ConOps [SESAR, 2007, 2012] aims for a Trajectory Based Operation (TBO),

in the sense that aircraft should fly according to agreed conflict-free 4D trajectory plans which

are made known to all actors involved as Reference Business Trajectories (RBT’s).

Well ahead of take-off by an aircraft, its airline will publish a Shared Business Trajectory (SBT).

Before take-off, this SBT is agreed between Airline and ATM, becomes registered as a

Reference Business Trajectory (RBT), and is distributed through System Wide Information

of 96

Management (SWIM). After take-off, this RBT is updated and down linked by the pilot to ATC

using ADS-B out, and when it is accepted by both pilot and ATC it will be registered as an

Update in SWIM. From then on, it is an active RBT. Every stakeholder will have access to the

RBTs in SWIM.

If during the flight there is any change or delay (e.g. due to significant wind deviations from the

predictions) then an RBT updating process will be conducted with the active involvement of

controllers and pilots concerned [SESAR, 2007, 2012]. Although there is agreement about the

need for such RBT updating process there are multiple views of how this should be done under

SESAR2020+. The consensus is that when there is sufficient time, then an updated RBT is being

produced by the aircraft concerned. In this case the role of ATC is to timely inform the aircraft

about applicable constraints. Because this exchange and verification of information between

ATC and aircraft crews takes significant time, there also is consensus that ATC should propose

an updated RBT themselves when time is too short.

Because the SESAR2020+ ConOps is a work in progress, it was felt to be most relevant to take

into account SESAR2020+ ConOps developments agreed within SESAR-JU. In consultation

with SESAR-JU, it has been decided that SESAR-JU’s Preliminary OSED_2 report [SESAR-JU,

2013] forms the most up to date reference document for the SESAR2020+ ConOps for use

within EMERGIA.

Regarding ASAS, on page 60 of the project P04.07.02 report [SESAR-JU, 2013] it is explicitly

described that ASAS aspects are out of scope, because other SESAR-JU projects address various

ASAS topics, such as:

+ P04.07.04a “ATSA-ITP Pioneer trials”;

+ P04.07.04b “ASAS-ASEP Oceanic Applications”;

+ P04.07.05 “En Route Trajectory and Separation Management – ASAS Separation (Cooperative

Separation)”;

+ P05.06.06 “ASAS Sequencing and Merging”.

The aim of this subsection is to provide a systematic comparison of the A3G ConOps against this

SESAR2020+ ConOps, as a result of which similarities and differences are identified. This

comparison is organized in three steps.

Step 1 compares their scopes.

Step 2 compares their 4D trajectory layer

Step 3 compares their tactical resolution layer.

Step 1: Comparison of scopes

Table 2.1 gives an overview of the main scoping issues for the two ConOps considered.

Table 2.1 Comparison of scoping issues

of 96

Aspect SESAR2020+ A3G ConOps

Airspace En Route and TMA En Route

Traffic demand 1.22x 2010 traffic 3x 2005 traffic ~ 3x 2010 traffic

RBT based operation Yes Yes

RBT equipped aircraft 40% 100%

SWIM Yes Yes

ASAS No ASAS use by pilots No ASAS use by pilots

ACAS Improved TCAS Improved TCAS

The main similarities are RBT approach, SWIM and the no use of ASAS by pilots. The main

differences concern the percentages of fully equipped aircraft, the traffic demands, and the type

of airspace.

The 100% equipment level assumed within the A3G ConOps has its rationale in the objective of

the EMERGIA project. It simply will be unrealistic to expect that the remarkably positive

emergent behaviours identified for the A3 ConOps can be realized with not fully equipped

aircraft. Hence from an EMERGIA project perspective this difference is less relevant, although it

will have posed extra challenges to the designers of the SESAR 2020+ ConOps.

For the higher traffic demand (about a factor 2.5) of the A3G ConOps and the restriction to En-

route airspace it has been shown that an agent based model of the A3 ConOps produces the very

positive emergent behaviour we are looking for in a ground based ConOps model.

Step 2: Comparison of 4D trajectory layers

Table 2.2 gives an overview of the main 4D trajectory layer based issues for the two ConOps

considered.

Table 2.2 Comparison of 4D trajectory layer issues


of 96

Separation Minima 5 NM / 1000 ft 5 NM / 1000 ft

Time Horizon 25 - 8 minutes 15 – 3 minutes

4D trajectories RBT sharing RBT sharing

Responsible Planning Controller Planning Controller

TRACT Subliminal speed

advisories through CTO’s

Not considered within A3G

Conformance Monitoring

MONA for PC MONA for PC

Conflict Detection MTCD Medium term conflict detection

Conflict Resolution MTCD probing by PC MTCDR based proposals to PC

4D Conflict Resolution Architecture

None; based on mental model of PC

Distributed architecture, i.e. conflict resolution algorithm works concurrently for each aircraft.

4D info to aircraft CPDLC CPDLC

Pilot role Reject OR Accept and implement

Reject OR Accept and implement

4D trajectory downlink ADS-C ADS-B

The main differences in the 4D trajectory layer are: the shorter time horizon of A3G, No

subliminal speed advisories in A3G, and conflict resolution is supported by algorithms instead of

MTCD probing by ATCo-P.

The subliminal speed advisories could very well be integrated in an extended version of the A3G

ConOps, which may be a sound option for an improved next A3G version. In such case it also

would make good sense to increase the upper value of the time horizon for this next A3G version

to the 25 minutes of SESAR2020+.

Regarding the lower value of the time horizon, it is important to notice that according to

[SESAR-JU, 2013] it remains to be determined what the optimal prediction time horizon is to

of 96

define the split between the RBT layer and the Tactical resolution layer. From this perspective it

is quite relevant that for the A3 Conops significant experience has been gained regarding this

design aspect. For example in [Meulenbelt, 2012], it has been shown that a decrease of the

splitting value below 3 minutes leads to a deterioration, while an increase above the 3 minutes

does not lead to an improvement. That’s why for the A3 ConOps the splitting value has been set

at 3 minutes in order to give the RBT layer as much time as possible to resolve as many

conflicts as is possible, and thus leaving as few as possible to the Tactical resolution layer.

Hence the same splitting time value of 3 minutes has been adopted for the A3G ConOps.

Regarding the SESAR2020+ MTCD supported resolution by the ATCo-P, there are large

differences with the 4D resolution approach in the A3G ConOps. However, in order to maintain

the powerful emergent behaviour of the A3 model, the specific choice made for the A3G

ConOps follows from the principle in staying as close as is possible to the architecture of the

MTCDR in the A3 ConOps. Moreover, the A3G ConOps aims to accommodate a 2.5 times as

high traffic demand than SESAR2020+. Such factor of 2.5 implies two complementary

challenges: 1) there are far more conflicts to be resolved, and 2) the resolution of each conflict

involves more aircraft and is therefore more complex.

Step 3: Comparison of tactical resolution layers

Table 2.3 gives an overview of the main 4D trajectory layer based issues for the two ConOps

considered.

Table 2.3 Comparison of Tactical layer issues


Separation Minima 5 NM / 1000 ft 5 NM / 1000 ft

Time Horizon 8 - 6 minutes 3 - 0 minutes

Type of instructions Closed loop heading/height change OR Open loop

heading/height change

Open loop heading/height change

OR

Back to 4D trajectory clearance

Responsible Tactical Controller Tactical Controller

Surveillance SSR Mode-S and ADS-B out SSR Mode-S and ADS-B out

Conformance Monitoring MONA for TC MONA for TC

of 96

Conflict Detection MTCD and STCA Short Term Conflict detection

Conflict Resolution MTCD probing by TC STCDR based proposals to TC

Tactical Conflict

Resolution Architecture

None; based on mental model of TC

Distributed architecture, i.e. conflict resolution algorithm works concurrently

for each aircraft.

Sequence of pair-wise resolutions

TC decides on basis of Safety, Geometry, Queue management

FIFO (of proposed resolutions)

ATCo – Pilot

communication

R/T CPDLC

Pilot role Reject OR Accept and implement

AND Reply

Reject OR Accept and implement

through Control Panel AND Confirm

Insertion of tactical instruction in ATC

system

Simultaneously with R/T message Simultaneously with CPDLC message

The main differences in the tactical layer are: Shorter time horizon for A3G, Open loop type of

tactical instruction under A3G, No use of SSR mode-S for surveillance by A3G, Algorithm

based conflict resolution by A3G, and ATCo-Pilot communication using CPDLC instead of R/T.

The rationale of the shorter time horizon has already been explained before. Related to this

shorter time horizon, tactical instructions always are of the open-loop type, which means that the

back-to-goal aspect can be resolved through an RBT update with support of the ATCo-P.

Regarding the SESAR2020+ MTCD supported resolution by the ATCo-T, there are large

differences with the Tactical resolution approach in the A3G ConOps. However, in order to

maintain the powerful emergent behaviour of the A3 model, the specific choice made for the

A3G ConOps follows from the principle in staying as close as is possible to the architecture of

the Tactical layer in the A3 ConOps. Moreover, the A3G ConOps aims to accommodate a 2.5

times as high traffic demand than SESAR2020+. Such factor of 2.5 implies two complementary

challenges: 1) there are far more conflicts to be resolved, and 2) the resolution of each conflict

involves more aircraft and is therefore more complex.

of 96

Regarding R/T messages between ATCo-T and Pilots, it may be demanding to continue this

under a 2.5 higher traffic demand. Hence it seems to make good sense that the A3G ConOps has

switched to CPDLC.

of 96

3 THE A3G MODEL

In this section the A3G model is presented. First, the main A3G model assumptions are listed in

subsection 3.1. Next, in subsection 3.2, an overview of the agents in the A3G model is presented,

with the focus on the newly added Local Petri Nets (LPNs). In subsection 3.3 to 3.7 the newly

and adjusted agents are shown in more detail by presenting the structure of their interconnected

LPNs. In subsection 3.8 the phased implementation of the A3G model is presented.

3.1 A3G model assumptions

In developing the A3G model, the following model assumptions have been adopted:

A1. In the A3G model all aircraft are identical and fly at the same level with the same speed.

A2. In the A3G model no emergency situations are modelled.

A3. In the A3G model no SSR radar data is assumed to be available to ATC.

A4. In the A3G model the 4D plan in Flight Data Processing System (FDPS) is considered to be

unreliable when ADS-B messages about the RBT in the FMS are not received.

A5. In the A3G model no ground based navigation support is available, i.e. navigation is based

on Global Navigation Satellite System (GNSS) and Inertial Reference System (IRS) only.

The consequences of these A3G model assumptions shall be taken into account later on when

arguing about the results obtained for the A3G model.

3.2 Agents in the A3G model

This subsection provides an overview of the agents in the A3G model. All agents used in the A3

model are also incorporated in the A3G model. In the A3G model the following agents are

present:

Aircraft-i

Pilot-Flying-i

Pilot-Not-Flying-i

Airborne Guidance, Navigation and Control (GNC) systems-i

Air Traffic Control (ATC) Ground System

Air Traffic Controller (ATCo)

Environment

It should be noticed that this model is an initial one which does not (yet) incorporate Weather,

Airborne Collision Avoidance System (ACAS) or Airline Operations Centre (AOC).

The Petri net formalism supports a compositional specification approach, which means that

first for each agent particular local Petri nets are being developed using agent specific expert

of 96

knowledge, and without the need to bother about the connections between the agents. Once this

has been done, the interactions between these local Petri nets are being developed. A listing of

local Petri nets per agent is given in Table 3.1.

Table 3.1: All agents and the corresponding number of LPN's in the A

3G model

Aircraft-i local Petri nets:

o Type

o Evolution mode

o Engine system mode

o Navigation system mode

o Emergency mode

Pilot-Flying-i (PF) local Petri nets:

o State Situation Awareness

o Intent Situation Awareness

o Goal memory

o Current goal

o Task performance

o Cognitive mode

Pilot-Not-Flying-i (PNF) local Petri nets:

o Current goal

o Task performance

Airborne GNC-i local Petri nets:

o Indicators failure mode for PF

o Engine failure mode for PF

o Navigation failure indicator for PF

o ADS-B receiver failure indicator for PF

o ADS-B transmitter failure indicator for PF

o Indicator failure mode for PNF

o Guidance mode

o Horizontal guidance configuration mode

o Vertical guidance configuration mode

o FMS Intent

o Airborne GPS receiver

o Airborne Inertial Reference System (IRS)

o Altimeter

o Horizontal position processing

o Vertical position processing

o Regular Broadcast FMS Intent

o Reguar Broadcast aircraft State

o ADS-B transmitter

o ADS-B receiver

o ATC Uplink receiver

o MTCR/STCR audio alert

ATC Ground System:

of 96

o ADS-B ground receiver

o ADS-B receiver mode

o ATC uplink transmitter

o System mode

o State & Intent

o Conformance Monitoring

o Conflict Detection & Management -i

o Resolution Mode -i

o STCR Advisory -i

o MTCR Advisory -i

o Back2Goal -i

Air Traffic Controller:

o Air Traffic Controller

Environment:

o Global Navigation Satellite System (GNSS)

o Global ADS-B ether frequency

o ATC uplink frequency occupied

o Weather

The resulting model comprises 50 different local Petri nets. With the exception of 11 ATC

system and Environment local Petri nets, each local Petri net is copied for each aircraft in the

model. Hence, for N aircraft, there are 39N+11 local Petri nets in the A3G model. Table 3.2

gives an overview of the agents and LPNs that were not in the A3 model.

Table 3.2: LPNs and corresponding agent added to A3 model to obtain A

3G model

Agent Local Petri Net

Airborne GNC systems: communication systems-i ATC Uplink receiver-i

ATC ground system ADS-B ground receiver mode

ATC Uplink transmitter

Back-to-Goal-i

Air Traffic Controller ATCo-Tactical

ATCo-Planning

Environment Global ATC Uplink frequency

3.3 ATC ground system architecture in the A3G model

In this subsection the internal structure of the ATC ground system agent in the A3G model is

presented.

The ATC ground system is designed using the ASAS from the A3 model. The internal LPN

structure of the ASAS remained the same in order to obtain similar results. The agent ASAS

consists of 10 LPN’s. These can be categorised in two tasks:

Surveillance and conformance monitoring systems

Conflict Detection and Resolution advice generation systems

of 96

This A3 model structure is re-used in order to make it possible that the A3G model can produce

the same positive emergent behaviour as the A3 model . The resulting architecture of the ATC

ground system in the A3G model is shown in Figure 3.1. ATC-System

States, identity and intents of all aircraft

(LPN 5-10)

ATC-System-Other

i

(LPN 1-4)

ATC-CDR-i

...1k

(# of aircraft)...

ATC-CDR-iATC-CDR-i

Figure 3.1: Schematic overview of the ATC ground system architecture in the A3G model

Instead of relocating each individual ASAS from the air to the ground, there is one ATC ground

system designed in the A3G model. The ATC Ground system consists of two parts. The first part

named ‘ATC system-other’ is modelled only once. The ‘ATC system-other’ is used as a global

surveillance system. It receives the state and intent information of all aircraft. This part consists

of the following LPN’s:

State & Intent all aircraft

Conformance monitoring

Surveillance / ADS-B ground receiver

ATC system mode

ATC Uplink transmitter (new)

ADS-B receiver mode (new)

The second part named ‘Conflict Detection and Resolution (CDR)’ is modelled for each aircraft

independently. In the system there are k number of aircraft flying. The part CDR-i is introduced

k times in the model, for i=1, .., k. The CDR-i part is responsible for detecting conflicts and

generating resolution advices for aircraft-i. The CDR-i consists of the following LPN’s:

Conflict Detection (CD) & Management-i

Resolution mode-i

Intent based STCR advisory-i

Intent based MTCR advisory-i

Back-to-goal checker-i (new)

The following two audio alert LPN’s are removed from the system:

STC Audio Alerting

MTC Audio Alerting

of 96

In the A3G model the system automatically generates a conflict free trajectory after a conflict is

detected. So an audio alert is not necessary anymore.

3.4 Interconnected LPN’s of the ATC System

In the A3G model, the ATC system is modelled through the SDCPN depicted in Figure 3.2. First

we describe the LPN’s that are similar to those used in the ASAS agent of the A3 model.

Subsequently we describe the three LPN’s which are completely new, i.e. LPN ATC Uplink

transmitter to send each MTCDR advisory or STCDRinstruction through datalink to the

appropriate aircraft, LPN ADS-B receiver mode sometimes switches from working to not-

working, and LPN Back2Goal-i

The ADS-B information received from all aircraft is processed by the LPN ADS-B ground

receiver. This yields up to date information about the state and intent of all aircraft which are

maintained in the LPN State&Intent. This LPN also maintains other relevant information for

each a/c, such as mode, priority and handicap information.

This information is used by LPN CD&Management-i to detect conflicts of a/c i with any of the

other aircraft. The LPN Resolution Mode-i determines which type of conflict advise should be

provided to aircraft i. The LPN STCDR Advisory-i and LPN MTCR Advisory-i generate

advisories for aircraft i, and show these to the air traffic controller (ATCo).

An MTCR Advisory applies to conflicts with any other aircraft within time horizon of M . It is

determined as the minimum turning angle (to the left or to the right) such that there are no

predicted conflicts left with any aircraft which has higher priority than aircraft i and which is

within reach of the M horizon. If there is no minimum turning angle possible below a certain

value ,maxM , then the turning angle below ,maxM is identified which provides the lowest

underscoring of the minimum spacing criteria of 5Nm and 1000 ft between centrelines. In that

case aircraft i is assumed to be handicapped. As soon as the advised MTCDR advisories and the

corresponding advisories have been accepted by the controller and by the crew of aircraft i, then

these are broadcasted together with a handicap-i message.

An STCDRAdvisory applies to conflicts of a/c i with any other aircraft within time horizon of

S . It is determined as the minimum turning angle (to the left or to the right) such that there are

no predicted conflicts left with any aircraft and which is within reach of the S horizon. If there

is no minimum turning angle possible below a certain value ,maxS , then the turning angle below

,maxS is identified which provides the lowest underscoring of the minimum separation criteria.

Finally, there are the following two complementary LPN’s:

LPN system mode represents whether the ATC system is working, failed, or corrupted

(failed or corrupted mode also influences the resolution LPN’s).

LPN Conformance Monitoring Intent compares for each a/c j whether j’s state

information agrees with j’s intent information. In case a significant difference is

of 96

identified, then both Medium Term and Short Term CD&R for each other aircraft is

informed to stop using intent information of aircraft j.

G1

State & Intent

I-kI1

I2

Processing

G2

CD & Management-i

I3

Gx

GQ

I5

D

Working

System Mode

D

Failure

D

D

Corrupted

I7

3 MTC Res

G5

1

No Res

I

Int-Res-i

Resolution Mode-i

G3

2 STC Res

I1

I2

G6

G4

Processing

I4

Int-MTCD-i

Int-STCD-i

2

STCR Advisory

I

STCR Advisory-i

MTCR Advisory

MTCR Advisory-i

Info

G

ADS-B Ground Receiver / Surveillance

I

I-k

Int-Surv-Intent-Update

Int-Surv-State-Update

Info

Info

Conf. Mon. Intent

I

IPN-SI-CM

I6

G

Processing

1

2I

G1

Processing

IPN-CM-SI

IPN-SI-CDMan-i

ADS-B Receiver mode

Working

Not Working

D D

Back to Goal-i

Check B2G

G

Int-CD Man-i

ATC Uplink Transmitter

G

I

Sending

is Sent

I-ATCo-k

Figure 3.2: Complete DCPN specification of the ATC Ground system agent in the A3G model

Back-to-Goal-i

The Back-to-goal-i LPN is modelled for each aircraft separately. It is part of the CDR-i part of

the ATC Ground System. The LPN Back2Goal-i verifies whether the final RBT direction is

aiming for the destination of aircraft i; if this is not the case, then a token is generated to an IPN,

from which the LPN CD&Management is reminded that an appropriate RBT should be

determined for aircraft i by the LPN MTCDR Advisory-i . In such case the RBT should satisfy

the 5NM/1000ft separation criterion; i.e. no undershooting is allowed. This may have as

implication that no feasible RBT is found. In the latter case the LPN Back2Goal-i will keep on

sending reminders to the LPN CD&Management until a feasible 4D plan has been found by the

LPN MTCDR Advisory-i and this has been accepted by the ATCo and the crew, and downlinked

as current RBT through ADS-B and stored in the LPN State&Intent.

of 96

In Figure 3.3 a simulation realization shows what happens when after a short term conflict

resolution the aircraft has no longer an intent which leads to its final goal. The magenta parts of

the curve indicate when the aircraft is controlled manually (i.e. not by FMS), meaning in Short

Term Conflict resolution mode. As can be seen after an aircraft comes in STC mode, it will

continue to do so. The aircraft will continue to fly the proposed STC heading change. The back-

to-goal resolution is in the A3 model initiated by the Pilot-Flying after an STCR. In the A3G

model this is automatized. After a short term conflict has occurred the back-to-goal initiates the

check for a back-to-goal resolution. This is done at predetermined times. The resolution is

generated in the ‘CD & Management-i’ LPN.

-1.5 -1 -0.5 0 0.5 1 1.5

x 105

-1

-0.5

0

0.5

1

x 105

0

1

2

3

4

5

6

7

2D paths, Turn=Red, Command Mode=Magenta, PID is 1

m

m

Figure 3.3: Eight aircraft scenario A3G model without back-to-goal checker. Magenta = a/c in STC

Resolution mode, Red = a/c in MTC Resolution mode.

ADS-B receiver mode

Via the ADS-B ground receiver / surveillance receives the ATC ground system the state and

intent information of all aircraft. This is only received if the ADS-B receiver mode is working.

The ADS-B receiver mode is only modelled once. The ADS-B receiver mode has the following

places:

Working

Not Working

The system changes at exponentially distributed times.

ATC uplink transmitter

of 96

The ATC Uplink transmitter LPN is part of the ATC ground system. It is only modelled once.

The ATC uplink receiver has two places for the following modes:

Sending

Is sent

The ATC Uplink transmitter the resolution advices from the ATCo’s to the corresponding

aircraft. Due to the auxiliary place ‘Int-ATCo-Uplink-queue’ a queue is possible which is

handled on a first-in-first-out basis. The ATC uplink transmitter sends the resolution advice to

the corresponding aircraft if the ‘Global ATC Uplink frequency’ is working. Otherwise the

transmitter will remain in ‘sending’ mode. The ATC uplink transmitter can only send one

resolution advice at a time.

3.5 ATCo as agent in the A3G model

In this subsection an overview of the Air Traffic Controller (ATCo) agent is presented.

The task of the Air Traffic Controller in the A3G model consists of three steps:

Notice the alert of a resolution advice generated by the ATC ground system after a

conflict is detected.

Confirm if the resolution advice is still viable by checking if the aircraft is still in conflict

in ‘Resolution mode-i’ in the ATC ground system.

Insert the resolution advice in the ATC Uplink transmitter so it can be send to the correct

aircraft.

The steps are combined in one reaction time parameter in the A3G model.

The agent consists of two LPN’s. The ATCo’s tasks are divided in two parts; one being the

tactical part and one the strategic part. The tasks require different responses. The ATCo-Tactical

(ATCo-T) deals with the short term resolutions. The ATCo-Planning (ATCo-P) deals with the

strategic tasks. Strategic tasks contain the medium term conflict resolutions and back-to-goal

advices.

In Figure 3.4 the schematic overview of the agent is given with the external interacting agents.

The ATCo receives resolution advices the ATC Ground system agent. The ATCo inserts the

resolution advice in the ATC Uplink transmitter and with a STCR also directly in the ATC

system. The place before the ATCo has space for multiple resolution advices therefore a queue is

possible. The IPN with place ‘Int-ATCo-Uplink-Queue’ makes it possible to have a queue of

outstanding resolution advices.

of 96

G1

G

STC

I-i

MTC

STC Advisory-i

MTC Advisory-i

Int-MTC-i

Int-STC-i

Int-ATCo-Uplink-Queue

ATCo-Tactical

I-i

ATC ground systemState & Intent

I1

G2

2

G


1

I

Sending

is sent

I-i

I2

Info

Processing

Int-STC-State&Intent-i

G

ATCo-Planning

I-ATCo-k

CD & Management-i

Res Mode-i

Figure 3.4: Schematic overview of the ATCo agents and communicating LPN's

ATCo Tactical (ATCo-T)

The ATCo-T is only modelled once. Due to the auxiliary place ‘Int-STC-i’ modelled for each

aircraft independently a queue is possible. An outbound queue is also possible in the place of the

‘Int-ATCo-Uplink-Queue’ IPN. Resolution advices are handled in a first-in-first-out principle.

The place Int-STC-i can be overwritten, meaning the resolution advice can be updated while the

ATCo is working on it.

Start of the ATCo-T tasks is a short term resolution from STC Advisory-i. The ATCo-T then

validates if the corresponding aircraft is still in conflict in Resolution Mode-i (Res Mode-i). If

the aircraft is still conflict the resolution is accepted. The ATCo will then give a sign to the ATC

Uplink Transmitter to send the resolution advice. Simultaneously he/she inserts the new heading

change directly in the ATC ground system. If the resolution is not viable anymore the ATCo-T

will drop the resolution advice.

of 96

ATCo Planning (ATCo-P)

The ATCo-P is modelled only once. Due to the auxiliary place ‘Int-MTC-i’ modelled for each

aircraft independently a queue is possible. An outbound queue is also possible in the place of the

‘Int-ATCo-Uplink-Queue’ IPN. Resolution advices are handled in a first-in-first-out principle.

The place Int-MTC-i can be overwritten, meaning the resolution advice can be updated while the

ATCo-P is working on it. The ATCo-P receives Medium Term Conflict Resolution (MTCR)

advices via the ‘MTC advisory-i’. The back-to-goal advices which are needed after a short term

conflict resolution advice are generated by the ‘CD & Management-i’ LPN in the ATC ground

system.

The task starts with an incoming resolution advice. The ATCo-P checks if the aircraft is still in

conflict in ‘Res Mode-i’ before sending the resolution to the ATC Uplink transmitter, otherwise

the resolution is dropped.

3.6 New communication systems in the A3G model

In this section the newly added ground-air communication LPN’s will be discussed. The new

agents are the ATC Uplink Transmitter, global ATC uplink and the airborne ATC Uplink

receiver-i.

Figure 3.5 shows a schematic overview of the path of a resolution advice from ATC ground

system to the pilot. In Figure 3.6 the full process is shown using the SDCPN structure as used in

the A3G model.

The process in the figures starts with a generated resolution advice in the STC advisory-i, MTC

advisory-i or CD & Management-i. The ATCo checks in ATC resolution mode (Res Mode) if

the resolution is still viable before inserting it in the ATC Uplink transmitter. The ATC uplink

transmitter sends the resolution to the corresponding aircraft, but only if the global ATC uplink

frequency is working. This resolution is received in the airborne ATC Uplink receiver-i. The

received message will generate an audio alert. This audio alert will be picked up by the pilot and

the corresponding task performance will be initiated.

Next the new communication systems will be presented in more detail.

Figure 3.5: Schematic overview of the agents involved in the resolution advice process in the A3G model.

of 96

G1

G

STC

I-i

MTC

STC Advisory-i

MTC Advisory-i

Int-MTC-i

Int-STC-i

Int-ATCo-Uplink-Queue

ATCo-Tactical

I-i

State & Intent

I1

G2

2

G


1

I

Sending

is sent

I-i

I2

Info

Processing

Audio Alert (IPN)

Current Goal PF

Collision Avoidance (C1)

Navigation Vertical (C4)G

interrupt

Conflict Resolution (C3)

Preparation Route Change (C6)

Miscellaneous (C7)

Gsub-

sequent

Emergency Actions (C2)

Navigation Horizontal (C5)

Audioalert

II

I

I

Int-Emergency-Audio

Int-Indicator-Audio

Int-STC-Audio

IInt-MTC-B2G-Audio

Int-STC-State&Intent-i

G

ATCo-Planning

I-ATCo-k

CD & Management-i

2

G

1 Not Working

I

Working

ATC global Uplink

FMS Intent-i

Res Mode-i

Int-Uplink-i

ISI

ATC Uplink Receiver-i (IPN)

I S

IM I M

IB I B

Int-MTC-Audio

Int-Uplink_Rec-i

Figure 3.6: DCPN specification overview of the resolution advice process in the A3G model

Global ATC uplink frequency

The global ATC uplink frequency LPN is part of the environment agent. It is only modelled

once. The global ATC uplink LPN has two places representing the following modes of the

system:

Working

Not working

of 96

The global ATC uplink frequency is the frequency used to send the resolution advice from the

ATC ground system to the corresponding aircraft. The switches occur at exponentially

distributed times. The ATC uplink frequency is based on the global ADS-B frequency in the A3

model.

ATC uplink receiver

For the ATC uplink receiver-i on-board of aircraft-i a DCPN model is presented in Figure 3.7.

The ATC uplink receiver model manages a proper reception by and alerting of a pilot for the

three different types of resolution advices from the ATC ground system: Tactical instruction, 4D

plan update proposal, and Back-to-Goal resolution advice. The ATC uplink receiver is modelled

as an Interaction Petri Net (IPN) that aims to imitate the response of the Pilot-Flying in the A3

model. The specifics of this response are presented in Table 3.3.

FMS Intent-i

Int-Uplink-i

ISI


I

Audio Alert (IPN)

Audioalert

II

I

I

Int-Emergency-Audio

Int-Indicator-Audio

Int-STC-Audio

Int-MTC-Audio

I

Int-MTC-B2G-Audio

S

IM I M

IB I B

ATC UplinkTransmitter

Int-Uplink_Rec-i

Figure 3.7: DCPN specification of the ATC Uplink receiver IPN including communicating LPNs

In Table 3.3 the upper row indicates the current task of the Pilot-Flying. The left column

indicates the type of resolution received. Each of the matrix elements specifies what the pilot

should do. The possible response options for the pilot are: 1) to start a new task, or 2) to locally

save this task and start doing it after the current task is finished. The specifics of Table 3.3 are

captured in the IPN’s in Figure 3.7.

of 96

Table 3.3: overview of the pilot response for incoming alerts in the A3G model

Current →

Incoming ↓

MTC task STC task Back-to-Goal task Else

MTC

resolution

Advice

Audio Alert

+

Restart MTC task

-

+

Finish STC task

Save MTCR advice

Audio Alert

+

Start MTC task

Audio Alert

+

Start MTC task

STC

resolution

advice

Audio Alert

+

Start STC task

-

+

Finish STC task

Save STC advice

Audio Alert

+

Start STC task

Audio Alert

+

Start STC task

Back-to-goal

resolution

advice

-

+

Save B2G advice

-

+

Save B2G advice

Audio Alert

+

Restart B2G task

Audio Alert

+

Start B2G task

3.7 Pilot Flying as Agent in the A3G model

In this subsection the Pilot flying agent in the A3G model is presented.

In the A3G model the pilot flying is responsible for the final step in executing the resolution

advice generated by the ATC ground system. The Pilot inserts the resolution advice in the FMS

after which the aircraft will change its heading.

In the A3G model only small adaptations to the Pilot Flying agent are made in comparison with

the A3 model. The internal LPN structure remained the same. In the A3G model the overall

responsibilities of the Pilot-Flying are decreased and taken over by the ATC Ground system. The

pilot is not in the position to initiate a process. All instructions are generated by the ATC ground

system and by the ATCo via ATC Uplink send to the aircraft.

In Figure 3.8 the Pilot Flying agent from the A3G model is presented. Relative to the A3 model,

the changes are only in the Audio Alert IPN and the Task Performance LPN; these are further

explained next.

Audio Alert (IPN)

The Audio Alert is an Interaction Petri Net (IPN). Its goal is to give alerts to the pilot of

incoming events. In the A3G model it is just only used for the incoming resolution advices

coming from the ATC Uplink receiver. Its structure is very basic. The adaptations are made due

to the fact that emergency procedures are not yet implemented in the A3G model. In case of an

emergency this is saved in a separate file, this can be used for analysis.

of 96

Current Goal PF

Goal Memory PF

Memory

I

I

I3

Other EmergencySituations

Audio Alert PF (IPN)

Audioalert

II

I

I

Int-PF-Emergency-Audio

Int-PF-Indicator-Audio

I

Int-PF-TP1

Int-PF-TP2

Int-Fail-Ind

I

No Emergency

GG

Emergency

(5x)

(5x)

Int-STC-Audio

Int-STC-Audio

Task Performance PF

Monitoring(T1)

Coordination(T3)

Monitoring &Goal Prioritisation(T6)

G

G

D

Execution(T4)

G

G

Monitoring andDecision(T2)

D

G

Execution Monitoring(T5)

G

D

End Task(T7)

Ginterrupt

Gsub-

sequent

D

Failure Indicators for PF

No FailureIndication

I G

Failure Indication

Working

G G

Not Working

(5x)

Collision Avoidance (C1)

Navigation Vertical (C4)G

interrupt

Conflict Resolution (C3)

Preparation Route Change (C6)

Miscellaneous (C7)

Gsub-

sequent

Emergency Actions (C2)

Navigation Horizontal (C5)

II

Int-B2G-Audio

Int-PF-GM2Int-PF-GM5

Int-PF-GM1

ISI


I S

IM I M

IB I B

Int-Uplink_Rec-i

Figure 3.8: DCPN specification of the Pilot Flying agent in the A3G model

of 96

Task Performance

The internal structure of the Task Performance LPN has not been changed in comparison with

the A3 model. The following tasks are present in the A3G model:

Task Performance Goal 3: Conflict resolution actions for STC and MTC

Task Performance Goal 5: Navigation horizontal actions for Back-to-Goal

Task Performance goal 6: Preparation route changes

Task Performance 7: Miscellaneous.

The Tasks Goals 2 (Emergency Actions) and 4 (Vertical Navigation) are not used in the A3G

model. The A3G model can only cope with horizontal heading changes. Task performance goal

1 is not used in both the A3 model as the A3G model.

The other change is the Pilot-Flying now implements the new resolution advice from the ATC

Uplink receiver instead of from the ASAS as in the A3 model.

3.8 Implementation and verification of the A3G code

The next step is to implement the SDCPN model in the selected programming language, which is

the object oriented Delphi XE3 language, i.e. the same language used for the A3 model

implementation.

The implementation of the A3G model code is done in steps. The motivation behind this

stepwise approach is that it allows conducting an intermediate verification test after each step.

Step 1: Introduce ‘shadow’ aircraft, agent 0

A new agent 0 is introduced. Eventually, this agent 0 will form the ATC system agent. In step

agent 0 is filled with the 4 LPN’s of ‘ATC system-other’ part described in subsection 3.3. Agent

0 receives the state and intent information from all other aircraft through ADS-B downlink.

Verification test 1:

Using the eight aircraft scenario the state and intent information in each aircraft’s ASAS

surveillance part is compared to the state and intent information in agent 0. Code corrections

have been made until this verification test has shown that the state and intent data on the ground

equals the state and intent data in the ASAS systems of the aircraft.

Step 2: Insert CDR-i part to agent0

The Conflict Detection and Resolution (CDR) part of agent 1,..,N is added to agent 0. Hence in

agent 0 the CDR part is separately modelled for each aircraft. Each CDR-i in agent 0 uses the

information of the ATC system to detect conflicts and generate a conflict trajectory for aircraft-i.


Using the eight aircraft scenario, the resolution advice generated by agent 0 is compared to the

resolution advice generated by corresponding aircraft’s airborne ASAS. Code corrections have

been made until the outcome of the verification test was positive.

of 96

Step 3: Add air-ground uplink

The LPN for ATC uplink is added to the system. The ATC uplink is used to send an agent 0

generated resolution advice to the corresponding aircraft.


Using the eight aircraft scenario, the resolution advice received is compared to the resolution

advice generated by agent 0. Code corrections have been made until the outcome of this

verification test was positive.

Step 4: Add an Air Traffic Controller (ATCo)

The Air Traffic Controller agent is inserted between the agent 0 and the ATC uplink. In Figure

3.9 an overview of the model after step 4 is shown.


Using the eight aircraft scenario, the resolution advice received is compared to the resolution

advice of generated by agent 0. Code corrections have been made until the outcome of this

verification test was positive.

State & Intent all

aircraft +

system

Agent0

CDR-i

Agent0

CDR-i

Agent0

ATCo ATC Uplink

Save

resolution

advice

Aircraft-i

Save

resolution

advice

Aircraft-i

Figure 3.9: Schematic overview of sending the resolution advice to the aircraft.

Step 5: Using ATC ground resolution advice in the air

So far in the model each aircraft uses resolutions generated by its own ASAS. In this step 5 the

resolution advices received through ATC uplink from the ground are used instead of those from

own ASAS. Due to this step 5, each aircraft will fly according to the resolution advice generated

by agent 0 on the ground.


Using the eight aircraft scenario, it has been compared whether the aircraft behaved the same as

in the previous test. Code corrections have been made until the outcome of the verification test

was positive.

Step 6: Delete airborne ASAS

Finally, for each aircraft airborne ASAS is deleted.


of 96

It has been verified that the simulation results do not change due to the deletion of the airborne

ASAS from the implemented code.

Step 7: Rare event verification

The verification tests conducted in steps 1 through 6 are based on a few simulation runs for the

implemented code. Hence, the positive outcomes of these verification tests do not preclude the

occurrence of rare event differences either due to remaining code errors or due to differences in

rare emergent behaviour of the A3G model relative to the A3 model. In order to get hold on

either type of rare event differences, in the next sections we conduct rare event MC simulations

for 2 and 8 aircraft encounters.

During the rare event simulations for 8 a/c encounters, there appeared to be some unexplained

differences between the behaviour of the A3 model and the A3G model [Nieskens, 2014].

Through conducting additional rare event MC simulations, the causes of these differences have

been identified, and subsequently the necessary improvements in the code have been made and

verified through running additional rare event MC simulations.

The three main improvements that resulted from this rare event verification and improvement

activity are:

- When an MTCR plan is too old in the sense that it includes trajectory changes that

should already have been made by the aircraft, then the pilot will not enter this

plan in the FMS. This condition was not properly implemented in the A3G code.

- After having given an open tactical resolution, ATC determines a back-to-goal

tactical instruction. In doing so an erroneous waypoint and an erroneous distance

calculation was used, as a result of which the back-to-goal instruction could work

counterproductive in some rare cases.

- A pilot receives an audio alert in case of an MTCR uplink, which makes the pilot

stop finishing his current activity, e.g. on implementing an STCR instruction. In

some rare events this could lead to a sequence of instructions rendering a pilot

becoming totally unproductive. In order to avoid this, the pilot does no longer

receive an audio alert when there is a sequence of instructions awaiting.

The proper working of these improvements in the A3G model have been verified through

running additional rare event MC simulations.

of 96

4 MC SIMULATION OF 2 AIRCRAFT ENCOUNTERS

The aim of this section is to investigate under which conditions it is possible to get A3G model

rare event MC simulation results for two aircraft encounters as good as obtained for the A3

model. The two aircraft head-on encounter scenario is the same as the one being used for the

Monte Carlo simulation results of the A3 model [Blom & Bakker, 2011a,b].

This section is organized as follows. In subsection 4.1 A3G baseline parameter values for the

A3G model are adopted such that it is sure that the A3G model has the same performance on two

aircraft encounters as the A3 model had with the A3 baseline parameter values. These A3G

baseline parameter values are chosen in a conservative way, i.e. such that for the 2 a/c encounter

scenario, it is sure that the A3G model performs as good as the A3 model does. Subsection 4.2

provides MC simulation results for the A3G model using these A3G baseline parameter values.

In subsection 4.3 the effect of A3G results is shown when A3 baseline parameter values would

be used instead of the A3G baseline parameter values. From this point on, for the A3G parameter

values that differ from the A3 baseline values, extra MC simulation tests are conducted in order

to find out whether there is room for a less conservative value, i.e. somewhere in between the A3

baseline and the A3G baseline values. First, in subsection 4.4 the Monte Carlo simulation Tests

to be conducted are defined. Subsequently, in subsections 4.5 to 4.16 the Monte Carlo simulation

results obtained for these Tests on two aircraft head-on encounter scenarios are presented. In

subsection 4.17, A3G selected parameter values and corresponding simulation results are

summarized, and in subsection 4.18 an interpretation is given of the results obtained for the two

aircraft encounter scenarios.

4.1 A3G Baseline parameter values

In this subsection A3G baseline parameter values for the A3G model are adopted. These A3G

baseline parameter values are adopted in a conservative way in order to be sure that the A3G

model has the same performance on two aircraft encounters as the A3 model had with the A3

baseline parameter values [Blom & Bakker, 2011a]. For the complete list of adopted A3G

baseline parameter values (177 in total) the reader is referred to appendix C. In this subsection

only those parameter values are explained that differ from the A3 baseline parameter values.

These A3G baseline parameter values are shown in Table 4.1. The number in the first column

corresponds to the number in the full parameter list in Appendix C.

The adopted A3G baseline parameter values can be separated in three groups:

The twelve parameters that are coloured white in Table 4.1: These influence the state of

the technical systems. A system failure event has a probability of occurrence and a mean

duration of failure. For the A3G baseline parameter values the mean duration parameters

have not been changed. The ATC global frequency is new, though its function is similar

to the global ADS-B frequency in the A3 model. The value zero for the first two

parameters reflects that this functionality is not implemented in the A3G model. The

other A3G baseline probability values are all set to a probability of failure or Not

Working of 101*10 . This is many orders in magnitude better in comparison with the A3

baseline parameter values.

of 96

The seven parameters that have a grey shading in Table 4.1: These are all used by the

newly added ground-based agents. First the location of the ATC ground system is located

in the centre. Second the parameter 2B GT is added to the ATC ground system, because

this was previously done in the A3 model for the pilot. The rest of the new baseline

parameter values are all set to 1 second to simulate almost no delay.

For the remaining 158 parameter values, the adopted A3G baseline parameter values

equal the A3 baseline parameter values.

Table 4.1: Baseline parameter values for the A3G model that differ from baseline A

3 model

# Parameter Explanation

A3

G Baseline

Value

A3

Baseline

Value

2 Fail

Enginep Probability of Engine Failure 0 1/6000

4 down

OESp Probability of Other Emergency Failure 0 1/6000

62 down

SATp Probability of Global GNSS/GPS Not working 101*10

51*10

66 occ

ADS Bglobalp Probability of ADS-B global Occupied 101*10

61*10

69 down

ATC global

Mean duration of Global ATC uplink Occupied

Not Occupied

1 hr. 1hr. 1

70 down

ATC globalp Probability of Global ATC uplink Occupied 101*10

61*10

1

94 down

GNSS RECp

Probability of Airborne GPS receiver Not

Working

101*10

55*10

98 down

Altimp Probability of Airborne Altimeter Not Working 101*10

55*10

111 down

ADS TRMp Probability of ADS-B transmitter Not Working 101*10

55*10

165 ownx Position of ATC ground system [x,y,z] [0,0,0] -

168 corr

ATCsysp Probability of ATC ground system Corrupted 101*10

55*10

2

169 down

ATCsysp Probability of ATC ground system Not working 101*10

55*10

2

170

2B GT ATC ground system, Interval time for Back-to-

Goal Evaluation

20 s - 3

172

,

down

ATC ADS RECp

Probability of ADS-B ground receiver Not

Working

101*10

55*10

4

1 The global ATC uplink is new, but in function the same as Global ADS-B frequency in A3 model

2 The ATC ground system is new, but system mode is a direct copy of ASAS in A3 model

3 In A3 model Back-to-goal resolution advice generation was initiated by Pilot Flying with an interval of 20

seconds until a conflict free back-to-goal advice was generated.

4 ADS-B ground receiver is new but exactly the same as aircraft ADS-B receiver in A3 model

of 96

173 Transmit

uplinkT ATC ground Uplink Transmitter duration of

sending resolution to aircraft

1 s -

174 min

ATCo TT ATCo-Tactical minimum response time 1 s -

175 max

ATCo TT ATCo-Tactical maximum response time 1 s -

176 min

ATCo PT ATCo-Planning minimum response time 1 s -

177 max

ATCo PT ATCo-Planning maximum response time 1 s -

4.2 MC simulation results under A3G baseline parameter values

In this subsection the MC simulation result for the A3G model using A3G baseline parameter

values is presented. Similar as in [Blom & Bakker, 2011a], in this scenario two aircraft start at

320 km (178 Nm) from each other. The initial 3D-position has standard deviations of 20m in

longitudinal direction along the Reference Business Trajectory (RBT) centreline, 0.5 Nm in

lateral direction and 20m in height. Both fly straight opposite flight plans at 250 m/s airspeed.

The short and medium term detection and resolution criteria used in the MC simulations are

shown in Table 4.2. The horizontal separation minimum (medium and short term) is 5 Nm.

Table 4.2: Short term and medium term separation criteria for the A3 and A

3G model

Look ahead

time

Resolve ahead

time

Horizontal

separation min

Vertical separation

min

Max Turn

angle

STC 3 min 3 min + 10s 5 Nm 900 ft. 60 degrees

MTC 10 min 15 min 5 Nm 1000 ft. 60 degrees

Figure 4.1 presents the results of one million Monte Carlo simulations of the A3G model using

the A3G baseline parameter values. The simulation results in Figure 4.1 show the same curve as

obtained for the A3 baseline parameter results for the A3 model [Blom&Bakker, 2011a].

of 96

Figure 4.1: MC simulation results for two aircraft encounter under the A3G model with A3G baseline

parameter values.

4.3 A3G simulation results under A3 Baseline parameter values

Figure 4.2 presents MC simulation results of the A3G model using the A3 baseline parameter

values for those parameters that coincide with those of the A3G model. As expected, Figure 4.2

shows far less good results than Figure 4.1. Comparison with Figure 4.1 shows the same positive

behaviour during the left part of the curve, though far less good results for the right part of the

curve. The difference can be seen from the 42*10 event probability level, meaning once in

5000 Monte Carlo runs of 2 aircraft encounters.

of 96

Figure 4.2: MC simulation results for two aircraft encounters under the A3G model with parameter settings

according to the A3 model baseline parameter values.

4.4 Additional MC simulation Tests of 2 a/c encounters

For those A3G baseline parameter values that differ from the A3 baseline values, extra MC

simulation Tests will be conducted in order to find out whether there is room for a less

conservative value, i.e. somewhere in between the A3 baseline and the A3G baseline values.

These extra Tests are conducted in subsection 4.5 to 4.16. These extra tests are defined in the

current subsection.

An overview of the parameter setting in the additional scenarios is given in Table 4.3. Each of

the tests will be performed with the two aircraft encounter scenario and contains one million rare

event Monte Carlo simulations. In each test only one parameter value is changed with respect to

the A3G baseline parameter values.

Tests A and B have been conducted in sections 4.1 and 4.2 respectively. Tests C-N are

conducted in the remainder of this section.

The A3G model parameter tests C-N can be categorised in two groups. The categorisation is

based on what they influence in the system. The two categories are:

Performance of the technical systems parameters (tests C – K).

of 96

Parameters of the new ground based agents and LPN’s, which generate a delay in the

system (tests L – N).

Table 4.3: Overview of the alternative parameter setting test for the two aircraft encounter scenario

Test Parameter Explanation Baseline

Value Test value

A Same A3 Baseline Parameter value setting A3 baseline -

B All A3G Baseline Parameter value setting A3G baseline -

C down

SATp Probability of Global GNSS/GPS Not

working

101*10 51*10

D occ

ADS Bglobalp Probability of Global ADS-B Occupied 101*10 61*10

E down

ATC globalp

Probability of Global ATC Uplink

frequency Occupied

101*10 61*10

F down

GNSS RECp Probability of Aircraft GPS receiver Not

Working

101*10 55*10

G down

Altimp Probability of Aircraft altimeter Not

Working

101*10 55*10

H down

ADS TRMp Probability of Aircraft ADS-B transmitter

Not Working

101*10 55*10

I corr

ATCsysp Probability of ATC ground system

Corrupted

101*10

55*10

J down

ATCsysp Probability of ATC ground System Not

working

101*10 55*10

K ,

down

ATC ADS RECp

Probability of ATC Ground ADS-B

receiver Not Working

101*10 55*10

L max

ATCo TT ATCo-Tactical response time 1s 10 s

M max

ATCo PT ATCo-Planning response time 1s 10 s

N Transmit

uplinkT ATC Uplink transmitter Send time 1s 12 s

Each test will be performed using a series of Monte Carlo simulations, whereby in each test only

one variable is changed compared to the baseline parameter value setting. If the results of the

tested version are the same as the baseline results, the parameter has no substantial (negative)

influence on the system and can therefore be changed.

The goal of tests C - K is to bring these A3G model baseline parameter values closer to the

baseline parameter values used in the A3 model. For the parameters depending on probability,

this means that they are set to a higher probability, or a higher likelihood of failure.

The goal of tests L – N is to investigate the influence of a longer delay on the total system.

Instead of the A3G baseline parameter value of 1 second the ‘delay or response time’ parameters

will be set to higher values.

of 96

4.5 Test C: Global GNSS/GPS

The parameter ‘Global GNSS/GPS’ is a parameter setting for the probability of Global

GNSS/GPS not working in the environment agent. If global GPS is down, all aircraft are not able

to use the navigation satellites to determine their position. Aircraft are then left to depend on

their inertial reference system (IRS). The non-baseline test C parameter setting of 1*10-5 is

obtained from the A3 baseline parameter values. In Figure 4.3 the Monte Carlo simulation

results for test C are presented.

Figure 4.3: Monte Carlo simulation results for Test C; the non-baseline Global GNSS/GPS parameter

setting in the A3G model

The curve in Figure 4.3 is the same as in Figure 4.1. A global interruption of the navigation

satellites has no significant effect on the results. This can be explained as follows. Each aircraft

has a second system to determine its position, namely the Inertial Reference System (IRS). The

broadcasted state information of each aircraft will thus still be quite precise. The results of the

Monte Carlo simulation show that the effect of the non-baseline variable is not significant.

Therefore the parameter can be changed to the value used in the A3 model.

In Table 4.4 the outcome of test C is indicated through a green background.

of 96

Table 4.4: Non-baseline parameter value setting for the Global GNSS/GPS parameter

Agent LPN Parameter Explanation

A3

G

Baseline

Value

Test C

value

Environment GNSS system (GPS/

Nav. Global) /

Satellites

down

SATp

Probability of Global

GNSS/ GPS Not working 101*10

51*10

4.6 Test D: Global ADS-B frequency

The parameter ‘Global ADS-B frequency concerns the probability of global ADS-B frequency

being occupied in the environment agent. Global ADS-B frequency is used to send state and

intent information of the aircraft to the ground. If the ADS-B frequency is occupied, this mean

that the ATC ground system cannot receive the latest intent information of all aircraft. The non-

baseline test D parameter setting of 1*10-6 is obtained from the baseline parameter values of the

A3 model. In Figure 4.4 the Monte Carlo simulation results for test D are presented.

Figure 4.4: Monte Carlo simulation results for Test D; Global ADS-B frequency non-baseline parameter

setting

As can be seen the effect of the non-baseline value is negligible. The effect of a global

interruption of the ADS-B frequency has no significant effect on the total safety of the system.

This effect can be explained by two arguments. Firstly if aircraft intent information is not

received the old information can still be used. Also new intent can still be send up via the ATC

of 96

uplink frequency. Secondly the non-baseline parameter value is still very small, an effect of

1*10-6 is hard to detect with only one million simulations.

In Table 4.5 the outcome of test D is indicated through a green background.

Table 4.5: Non-baseline parameter setting for Global ADS-B frequency parameter


A3

G

Baseline

Value

Test D

value

Environment Global ADS-B

ether

frequency

occ

ADS Bglobalp

Probability of ADS-B global

Occupied 101*10

61*10

4.7 Test E: Global ATC Uplink frequency

The parameter ‘Global ATC uplink frequency is a parameter setting for the probability of global

ATC uplink frequency being occupied in the environment agent. Global ATC uplink frequency

is used to send the short term and medium term resolution advice from the ATC ground station

to each corresponding aircraft. Although the parameter is new, the test E value is based on the

very similar global ADS-B frequency baseline parameter value used in the A3 model.

In Figure 4.5 the Monte Carlo simulation results for test E are presented; they show a significant

effect. When the ATC uplink frequency is blocked, no aircraft can receive a new resolution

advice. Although this blocking happened only once in the one million simulation runs, its effect

is large when it happens. Therefore a better value is needed. The results in Figure 4.5 also mean

that a factor 100 improvement relative to the A3 baseline value of 61*10 will suffice. Therefore

we conclude as outcome of test E that the frequency of Global ATC Uplink frequency blocking

probability should be 81*10 . The latter value is indicated with green background in Table 4.6.

In Table 4.6 the non-baseline parameter setting and the outcome of test E is presented.

Table 4.6: Non-baseline parameter setting for the Global ATC uplink frequency parameter


Test E

derived

value

A3

G

Baseline

Value

Environment Global ATC

uplink

frequency

down

ATC globalp

Probability of Global ATC

Uplink frequency Occupied 81*10

101*10

of 96

Figure 4.5: Monte Carlo simulation results for Test E; Global ATC uplink frequency non-baseline

parameter setting..

4.8 Test F: Aircraft GPS receiver

The parameter ‘Aircraft GPS receiver’ is a parameter setting for the probability of GPS receiver

not working in the own positioning systems agent of the aircraft. If the GPS is not working, the

specific aircraft is not able to use the navigation satellites to determine its position. The aircraft is

then only depending on its inertial reference system (IRS).

In Table 4.7 the non-baseline parameter setting for test F-2 is presented. The test F parameter

setting of 5*10-5 is the A3 baseline parameter value.

Table 4.7: Non-baseline parameter setting for the aircraft GPS receiver parameter


A3

G

Baseline

Value

Test F

value

GNC systems:

Own

Positioning

Systems

Aircraft GNSS/

GPS receiver

down

GNSS RECp

Probability of Aircraft GPS

receiver Not Working 101*10

55*10

of 96

In Figure 4.6 the Monte Carlo simulation results for test F are presented. For rare events the

results in Figure 4.6 differ from those in Figure 4.1. Therefore the A3G model parameter value

should not be changed to the A3 baseline parameter value.

Figure 4.6: Monte Carlo simulation results for Test F; aircraft GPS receiver non-baseline parameter

setting

Test F-2

In test F the effect of the simulation results were significant but not very large. Therefore a

second test has been performed with the parameter setting and the test F outcome shown in Table

4.8.

Table 4.8: Test F-2: parameter setting for the aircraft GPS receiver; the green background indicates the

outcome of test F-2.


A3

G

Baseline

Value

Test F-2

value

GNC systems:

Own

Positioning

Systems

Aircraft GNSS/

GPS receiver

down

GNSS RECp

Probability of Aircraft GPS


61*10

of 96

In Figure 4.7 the results of Monte Carlo simulation for test F-2 are presented. The simulation

results are similar to the simulation results in Figure 4.1. This means that changing the GPS

receiver parameter to 61*10 is sufficient for two aircraft encounters.

Figure 4.7: MC simulation results for Test F-2; GPS receiver setting to 10-6

in the A3G model

4.9 Test G: Aircraft altimeter

The parameter ‘Aircraft Altimeter’ is a parameter setting for the probability of Altimeter not

working in the own positioning agent of the aircraft. The A3 model and A3G model only detect

horizontal conflicts. The non-baseline test G parameter setting of 5*10-5 is obtained from the

baseline parameter values of the A3 model. In Figure 4.8 the Monte Carlo simulation results for

test scenario G are presented.

of 96

Figure 4.8: Monte Carlo simulation result for Test G; aircraft altimeter non-baseline parameter scenario

As can be seen the effect of the aircraft altimeter not working is negligible. The results are the

same as the baseline parameter results. A failure with the aircraft altimeter has no effect on the

system. In the A3G model all aircraft fly at the same flight level. Therefore an error in the

vertical position calculation is negligible.

In Table 4.9 the outcome of test G is indicated through a green background.

Table 4.9: Non-baseline parameter setting for the altimeter scenario


A3

G

Baseline

Value

Test H

value

GNC systems: Own

Positioning Systems

Aircraft

Altimeter

down

Altimp Probability of Aircraft

Altimeter Not Working

101*10

55*10

4.10 Test H: Aircraft ADS-B transmitter

The parameter ‘Aircraft ADS-B transmitter’ is a parameter setting for the probability of the

ADS-B transmitter not working in the communication systems agent of the aircraft. The ADS-B

transmitter only sends the intent information of the aircraft to the ground. In Figure 4.9 the

Monte Carlo simulation results for test scenario H are presented.

of 96

Figure 4.9: Monte Carlo simulation results for Test H; aircraft ADS-B transmitter non-baseline scenario.

The results Figure 4.9 are significantly different from those in Figure 4.2. The effect is large; this

can be explained as follows. The aircraft sends own intent information via the ADS-B transmitter

to the ATC ground system. If the aircraft’s ADS-B transmitter is not working the intent

information is not received on the ground. Because this denies 4D trajectory plan verification, in

the A3 model the 4D plan of such an aircraft is considered to become unreliable. The same

approach has been copied in the A3G model. That this unreliability assumption yields far more

problems for the A3G model than it does for the A3 model is because in the A3 model the

aircraft with the failing ADS-B transmitter still has high quality state and intent information from

all other aircraft. Hence this aircraft will continue to provide a very reliable resolution. In the

A3G model however, there is only agent 0 (the ATC system) where all state and intents of

aircraft are used to determine proper resolutions; and this agent 0 is lacking proper intent of the

aircraft with failing ADS-B transmitter.

In Table 4.10 the outcome of test H is indicated through a green background.

Table 4.10: Non-baseline parameter value for the aircraft ADS-B transmitter scenario


A3

G

Baseline

Value

Test H

value

GNC: Communication

Systems

ADS-B

Transmitter

down

ADS TRMp

Probability of Aircraft ADS-B

transmitter Not Working 101*10

55*10

of 96

4.11 Test I: ATC ground system corrupted

The parameter is the probability of ATC Ground system being corrupted. This parameter is used

in the ATC system mode in the ATC ground agent. When the system is corrupted the system

doesn’t detect conflict and also doesn’t give an indication that the ATC system has a failure.

The ATC ground system agent is newly added to the model, but is originated from the ASAS

agent in the A3 model. The ATC system mode is a direct copy of the ASAS system mode,

therefore the non-baseline test value is based on the A3 model baseline value. In Figure 4.10 the

Monte Carlo simulation results for test scenario I are presented.

Figure 4.10: Monte Carlo simulation results for Test I; scenario ATC ground system corrupted

The results show a significant effect on the total system. The ATC ground system is responsible

for the resolution advice for all aircraft. If the ATC ground system is corrupted the system does

not detect conflicts. When there are no conflicts detected, there is no resolution advice generated.

The aircraft will then continue their path along the given trajectories. Hence, the A3G baseline

parameter value cannot be changed to the test I value. In Table 4.11 the outcome of test I is

presented with a green background.

Table 4.11: Non-baseline parameter values for the corrupted ATC ground system scenario


A3

G

Baseline

Value

Test I

value

ATC Ground

System

ATC System

Mode

corr

ATCsysp Probability of ATC ground

system Corrupted

101*10

55*10

of 96

4.12 Test J: ATC ground system failure

This parameter concerns the probability of failure of the ATC Ground system, and is used in the

ATC system mode in the ATC ground agent. When the ATC ground system fails the system

doesn’t detect conflict but does indicate that the ATC system has a failure.

The ATC ground system agent is newly added to the model, but is originated from the ASAS

agent in the A3 model. The ATC system mode is a direct copy of the ASAS system mode,

therefore the non-baseline test value is based on the A3 model baseline value.

In Figure 4.11 the Monte Carlo simulation for test J are presented. Figure 4.11 shows that the

effects on the simulations results under the non-baseline parameter setting are significant. The

results are very different from the A3G model baseline parameter results. The effect of the ATC

system failure is comparable to ATC system corrupted in Figure 4.10.

Figure 4.11: Monte Carlo simulation result for Test J; ATC ground system failure scenario

The difference between a system failure and being corrupted is as follows. In both situations the

ATC system doesn’t detect conflicts. Thus there is no resolution advice generated. When the

system has a failure it shows a failure indication, this in contrast to ‘corrupted’ when no

indication is shown. In the A3G model there is only one ATC ground system. There are no back-

up systems present. The effect of failure or corrupted is the same. In view of the significant

effect on the results, the A3G baseline parameter value should not be changed to the test J value.

In Table 4.12 the outcome of test J is indicated by a green background.

of 96

Table 4.12: Non-baseline parameter setting for the ATC ground system failure scenario


A3

G

Baseline

Value

Test J

value

ATC Ground

System

ATC System

Mode

down

ATCsysp Probability of ATC Ground

System Failure

101*10

55*10

4.13 Test K: Ground ADS-B receiver

In the A3G model the ADS-B ground receiver is a LPN in the ATC Ground agent. It has two

places and can be working or not working. The ADS-B ground receiver is a new LPN in the

model, but is derived from the airborne aircraft ADS-B receiver. Therefore the A3G non-

baseline test value is based on the A3 model baseline value.

The switches between the two modes happens at exponentially distributed times. The ADS-B

ground receiver mode is only connected to the Surveillance LPN of the ATC system. When the

ADS-B ground receiver is not working the Surveillance LPN is unable to receive intent or state

information. The system will then try to use the old information. When the information becomes

too old, the system will delete this. For state information this timeframe is 10 seconds, for intent

information this is 6 minutes. See appendix C, parameters 151 and 152. In Figure 4.12 the

Monte Carlo simulation results for test scenario K are presented.

Figure 4.12: Monte Carlo simulation result for Test K; ADS-B ground receiver scenario

of 96

The simulation results in Figure 4.12 are different from the A3G baseline setting results. The

effects on the results in Figure 4.12 are significant. In the A3G model when the ADS-B ground

receiver is down the ATC ground system is not able to receive intent or state information from

any aircraft. In Table 4.13 the outcome of Test K is presented with a green background.

Table 4.13: Non-baseline parameter setting for the ADS-B ground receiver scenario


A3

G

Baseline

Value

Test K

value

ATC

Ground

System

ADS-B ground

receiver mode ,

down

ATC ADS RECp

Probability of ADS-B Ground


55*10

4.14 Test L: ATCo-Tactical maximum response time

The ATCo agent consists of two parts: The Tactical, ATCo-T, which is in charge of the short

term conflicts (STC) resolution advices. Second is the Planning, ATCo-P, which handles all the

medium term conflicts (MTC) and back-to-goal (B2G) resolution advices. In either case, the Air

Traffic Controller has to check if the resolution advice generation by the ATC system is accepted

or not. When the ATCo accepts a resolution advice it is given to the ATC Uplink transmitter.

Because the ATCo does not exist in the A3 model, no reference parameter values can be taken

from the A3 model. For test L a maximum ATCo-T response of 10 s is used.

Figure 4.13: Monte Carlo simulation result for Test L; the ATCo-Tactical scenario

of 96

The simulation results in Figure 4.13 are slightly different from the A3G model baseline

parameter results shown in Figure 4.2. The effect of the non-baseline parameter setting for the

Tactical Air Traffic Controller is thus significant. In Figure 4.1, the baseline parameter results of

the A3G model the smallest miss distance obtained was 4.6 Nm, while in Figure 4.13 it is 4.4

Nm. The non-baseline test L value for the ATCo-T response time is a factor 10 in comparison

with the baseline. Although this is a large step the effect is noticeable but small. The ATCo-T

only deals with the short term conflict resolution advice; in this procedure time is an important

factor.

Although the effect is only small on the simulation results the baseline value for the ATCo

response time cannot be changed to the non-baseline value of 10s.

In Table 4.14 the outcome of test L is presented as being undecided yet.

Table 4.14: Non-baseline parameter value for the ATCo-Tactical scenario


A3

G

Baseline Value

Test L

value

ATCo ATCo-Tactical

min

ATCo TT

ATCo-T minimum response

time

1 s 10 s

max

ATCo TT

ATCo-T maximum

response time

1 s 10 s

Test L-2

In the previous test scenario L the effect on the simulation results were significant but not very

large. Therefore an additional test scenario L-2 is performed with the parameter setting shown in

Table 4.15.



A3

G

Baseline Value

Test L-2

value

ATCo ATCo-Tactical

min

ATCo TT


time

1 s 5 s

max

ATCo TT

ATCo-T maximum

response time

1 s 5 s

Figure 4.14 shows the Monte Carlo simulation results of test scenario L-2. The smallest miss

distance obtained is around the 4.45 Nm. This is still different from the A3G model baseline

parameter result of 4.6 Nm. Also n the lower part of the graph smaller miss distances are

obtained in comparison with the A3G model baseline results in Figure 4.1. The results in the

lower part of the graph depend on the Short Term Conflict resolution capacities of the system.

The ATCo-T plays an important role in solving those conflicts. As the effect of the test L-2 value

is still noticeable the conclusion is that the A3G parameter value should be lower than 5 seconds.

of 96

Figure 4.14: Monte Carlo simulation results for Test L-2; ATCo-T response time is 5 seconds in the A3G

model

Test L-3

A third test scenario is conducted. The non-baseline parameter setting in this test is shown in

Table 4.16, including an indication of the outcome of test L-3 through a green background.



A3

G

Baseline Value

Test L-3

value

ATCo ATCo-Tactical

min

ATCo TT


time

1 s 2 s

max

ATCo TT

ATCo-T maximum

response time

1 s 2 s

Figure 4.15 shows the Monte Carlo simulation results for test scenario L-3. The results in Figure

4.15 are the same as the A3G model baseline parameter results. The response time of the ATCo-

T can therefore be changed to the non-baseline parameter value of 2 seconds.

of 96

Figure 4.15: Monte Carlo simulation results for Test L-3 ATCo-T is 2 seconds in the A3G model

4.15 Test M: ATCo-Planning maximum response time

The ATCo-Planning (ATCo-P) deals with the Medium term conflict resolution advisory and the

Back-to-Goal resolution advisory. Both these resolutions consist of multiple waypoints which

lead the corresponding aircraft conflict free to its final goal.

The parameter for ATCo-P response time is divided in a minimum and maximum response time

parameter. This function is not used in this test scenario, but can be used to give boundaries to

the response time. The ATCo is a newly added agent. The non-baseline test parameter of 10

seconds is a factor 10 in comparison with the A3G baseline parameter value. It is expected that

this is enough time for the Air Traffic Controller to check if the resolution advice generation by

the ATC system is conflict free and to accept this. When the ATCo accepts the resolution advice

it is given to the ATC Uplink transmitter.

In Figure 4.16 the Monte Carlo simulation results for test scenario M are presented. The results

are very similar to the A3G model baseline parameter results, but not exactly the same. There is

a small kink which starts at the 10-3 mark. So it can be stated that the non-baseline parameter

setting has a minor effect on the results. The overall results are slightly less than the baseline

parameter results of the A3G model. After the kink in the lower part the results are somewhat

more to the right side of the graph in comparison with the baseline results, which means a

smaller miss distance.

of 96

The smallest miss distance during the one million simulations is 4.55 Nm, which is in

comparison to the baseline results negligible. This result is not significant. This ATCo-Planning

only deals with the Medium Term conflict and Back-to-Goal resolution advices. The aircraft is

not in a direct conflict when these resolutions are generated and therefore a longer response time

has almost no effect on the results.

The results of the simulation in Figure 4.16 are almost the same as the A3G model baseline

parameter results and therefore the ATCo-P response time parameter setting can be changed to

10 seconds.

Figure 4.16: Monte Carlo simulation result for Test M; ATCo-Planning response time

In Table 4.17 the outcome of test M is indicated through a green background.

Table 4.17: Non-baseline parameter value for the ATCo-Planning scenario


A3

G

Baseline Value

Test M

value

ATCo ATCo-Planning

min

ATCo PT

ATCo-P minimum response

time

1 s 10 s

max

ATCo PT

ATCo-P maximum response

time

1 s 10 s

of 96

4.16 Test N: ATC uplink transmitter

The ATC Uplink transmitter is a newly added LPN in the A3G model. The ATC uplink

transmitter is part of the ATC ground system. Just as there is only one ATC ground system, there

is only one ATC Uplink transmitter. The ATC Uplink transmitter is responsible for the sending

the resolution advices from the ground to the corresponding aircraft.

The non-baseline parameter setting is based on the send duration parameter in the ‘Broadcast

FMS Intent’ LPN of the A3 model. In the A3 model the duration of sending is derived from the

following formula:

Send Send

d Num TimeT T T

The duration for sending is the multiplication of the number of waypoints times the duration for

sending of a waypoint. For the two aircraft scenario a normal resolution advice consist of 4

waypoints. The duration for sending of a waypoint is 3 seconds (see appendix C, parameters 90

and 91), which yields a total of 12 seconds.

In Figure 4.17 the Monte Carlo simulation results for test N are presented.

Figure 4.17: Monte Carlo simulation results for Test N; ATC uplink transmitter

The results in Figure 4.17 are very different from the A3G model baseline parameter simulation

results in Figure 4.1.

In order to better understand the difference between the results obtained for the A3 model and

for the A3G model we compare the delays under both models. Under the A3 model the delay is

of 96

largely caused by the decision-making delay of the flight crew. The probability density function

of this delay is presented at the top of Figure 4.18 in the form of a Rayleigh shaped density with

mean value of 5.6 s. Under A3, the flight crew can synchronize the tactical decision-making with

the implementation of this decision.

However, under A3G the flight crew no longer has this tactical decision-making power; this is

now done by the ATCo-T (takes 1 s only in the MC simulation of Figure 4.17). Of course the

ATCo-T does this in an optimal way. Though from that moment on there are two sequential

delays: 1) the delay of the data uplink, and 2) the delay of pilot acceptance and implementation

of the tactical instruction received. The sum of these two delays is pictured through the bottom

pdf in Figure 4.18; this is the same Rayleigh density as the one at the top of Figure 4.19, though

now shifted 12 s to the right, which is the uplink delay in the MC simulation of Figure 4.17. This

has as consequence that the chance to be too late (e.g. the probability of more than 30 s delay) is

many orders of magnitude larger.

Figure 4.18: Top: Rayleigh probability density function with mean delay of 5.6 s.

Bottom: The same Rayleigh probability density function shifted to the right by 12 s.

of 96

Thus there are two key differences between A3 and A3G:

- The extra delay by the data uplink increases the probability of being too late by

many orders of magnitude.

- The tactical decision making and the implementation is now split over the ATCo-

T and the crew and is therefore no longer synchronized.

Through investigating MC simulated trajectories that ended in the tail of Figure 4.17, the specific

consequence of being too late has also been investigated. The finding is that in rare occasions

only, a 12 s delay of the uplink transmitter leads to a too late implementation of the STCR in the

aircraft. As a result of such extra delay, the next STCR will be generated by the ATC system. In

the current A3G model this next STCR is passed on by the ATCo, through the uplink transmitter

to the pilot. In some specific rare cases this may lead to an alternating series of left/right

instructions, yielding the tail in Figure 4.17.

The above also explains why that the delay by the uplink transmitter is far more critical than a

delay by the ATCo-T. The choice of the STCR update is being made by the ATCo-T in a way

that is kind of optimal at that very ATCo decision-making moment. That’s why some more delay

by the ATCo also leads to a more optimal decision. However the delays by the uplink transmitter

and by the pilot make that by the time this ATCo decision is implemented it may be far from

optimal in some rare cases. For the 2 a/c encounter scenarios this rare but undesired effect could

be mitigated by limiting the delay of the uplink transmitter to 1 second.

Due to the large effect on the simulation results the ATC uplink transmitter sending duration

parameter should not be changed to the non-baseline parameter setting. In Table 4.18 the

outcome of test N is indicated through a green background.

Table 4.18: Non-baseline parameter value for ATC uplink transmitter scenario


Baseline

A3

G

Test N

value

ATC

Ground

System

ATC Uplink

Transmitter

Transmit

uplinkT

ATC Uplink transmitter

Duration of sending resolution

to aircraft

1 s 12 s

of 96

4.17 Selected parameter values for the A3G model

In Table 4.19 an overview of the parameter values is presented. The green coloured column

shows the selected parameter values due to the outcomes of the conducted tests C-N (which aqre

taken from the green indicated outcomes in Tables 4.4 through 4.18. The fourth column shows

the A3G model baseline parameter values as presented in Table 4.1. In the last column the

corresponding baseline parameter value of the A3 model is shown for reference.

Table 4.19: Selected parameter values for the A3G model compared to the A

3G baseline parameter

values and the A3 baseline parameter values.

# Parameter Explanation

A3

G

Baseline

value

A3

G

Selected

value

A3

Baseline

value

62 down

SATp Probability of Global GNSS/GPS Not working 101*10

51*10

51*10 =

66 occ

ADS Bp Probability of ADS-B global Occupied

101*10

61*10

61*10 =

69

occ

ADS B

Mean duration of ATC global Occupied Not

Occupied

1 hr. 1hr. -

70 down

ATC globalp

Probability of Global ATC uplink frequency

Occupied

101*10

81 * 10

-

94 down

GNSS RECp

Probability of Airborne GPS receiver Not

Working

101*10

61*10

55*10 ≠

98 down

Altimp Probability of Airborne Altimeter Not Working 101*10

55*10

55*10 =

111 down

ADS TRMp Probability of ADS-B transmitter Not Working 101*10

101*10

55*10 ≠

165 ownx Position of ATC ground system [x,y,z]

[0,0,0] [0,0,0] -

168 corr

ATCsysp Probability of ATC ground system Corrupted 101*10

101*10

55*10 ≠

169 down

ATCsysp Probability of ATC ground system Not working 101*10

101*10

55*10 ≠

170

2B GT ATC ground system, Interval time for Back-to-

Goal Evaluation

20 s 20 s -

172 ,

down

ATC ADS recp

Probability of ADS-B ground receiver Not

Working

101*10

101*10

55*10 ≠

173 Transmit

uplinkT ATC Uplink Transmitter duration of sending

resolution to aircraft

1 s 1 s -

174 min

ATCo TT ATCo-Tactical minimum response time 1 s 2 s -

175

max

ATCo TT

ATCo-Tactical maximum

response time

1 s 2 s -

176 min

ATCo PT ATCo-Planning minimum response time 1 s 10 s -

177 max

ATCo PT ATCo-Planning maximum response time 1 s 10 s -

of 96

In Figure 4.19 the Monte Carlo simulation results for the A3G model with the selected baseline

parameter values as presented in Table 4.19 are shown.

Figure 4.19: Monte Carlo simulation results for the selected baseline parameter values of the A3G model.

The results Figure 4.19 are the same as the A3G model under baseline parameter values. The

results show that some parameters could be slightly changed without negatively affecting the

simulation results. The A3G model selected parameter values are closer to the baseline ones of

the A3 model than the A3G baseline parameter values.

4.18 Interpretation of the 2 aircaft encounter results obtained

In this subsection the results obtained for the two aircraft encounter tests C-N are elaborated.

Also the influence of the A3G model assumptions A1-A5 (see subsection 3.1) is considered. In

Table 4.20 a summary of the A3G model results is presented. The first column indicates the

specific test. The second column represents the key model parameter, which was changed in the

specific test. The last column denotes the effect on the results of the change in the key parameter.

The effects can be none, negligible, significant or large. A significant effect can be

surmountable, but this is not possible for a large effect. In none of the test scenarios was a

positive effect on the results observed.

Table 4.20: Overview of the A3G model results from the two aircraft encounters scenarios.

Test Changed parameter Measurable effect

C Global GPS not working (down) none

of 96

D Global ADS-B occupied (down) none

E Global ATC Uplink Frequency occupied (down) large

F Airborne GPS receiver not working (failure) significant

G Altimeter not working (failure) none

H ADS-B transmitter not working (failure) large

I + J ATC ground system mode failure / corrupted large

K ADS-B ground receiver not working (failure) large

L ATCo-Tactical maximum response time significant

M ATCo-Planning maximum response time negligible

N ATC uplink transmitter sending duration large

There are seven model parameters with non-negligible effects:

E. Global ATC Uplink Frequency occupied (down)

F. Airborne GPS receiver not working (failure)

H. ADS-B transmitter not working (failure)

IJ. ATC Ground system mode failure / corrupted

K. ADS-B ground receiver not working (failure)

L. ATCo-Tactical maximum response time

N. ATC Uplink transmitter sending duration

Each of these seven is discussed next, taking into account assumptions A1-A5 adopted for the

A3G model.

E. Global ATC uplink frequency occupied (down)

The global ATC uplink frequency is used in the A3G model to send the resolution advices from

the ATC ground system to the aircraft. If this frequency is occupied then no resolution is send.

The aircraft will continue to fly according to their current conflicted flight plan.

The MC simulation results showed that a very high dependability of 81*10 appeared necessary

to obtain similar results as the A3 model. Because none of the assumption A1-A5 has influence,

this may look like a very high requirement. However it should be taken into account that this

high dependability requirement applies for a mean duration of the occupancy of 1 hr (see #69 in

Table 4.1). At factors 10 or 100 lower mean durations, the dependability requirement may go

down by the same factors. This brings the Global ATC uplink requirements at a practically

manageable level.

F. Airborne GPS receiver not working (failure)

The effect of an airborne GPS receiver failure in the A3G model is different from the effect in

the A3 model. In the A3 model a not working GPS receiver doesn’t have a large effect on the

results, because the own aircraft still resolves all the conflicts. However in the A3G model this is

not the case anymore. The position error of an aircraft increases when the GPS receiver is not

working. In the ATC ground system this difference between the real position of aircraft-i and the

4D RBT-i information results in a not conform RBT. The ATC ground system then drops the

intent information of aircraft-i. When only the state information of aircraft-i can be used, this

results in a short term conflict.

of 96

The Monte Carlo simulation results showed that in the A3G model a dependability of 61*10 is

necessary. In the A3 model this safety requirement is 55*10 , which is a factor 50 less good.

One should be aware that in the A3G ConOps ground based navigation support will be well

available. This overrules A3G model assumption A5, and implies that for the A3G ConOps there

likely is no problem in realizing a 50 times higher navigation dependability.

H. ADS-B transmitter not working (failure)

The large effect on the results of the ADS-B transmitter is different in the A3G model with

respect to the A3 model. In the A3 model the situation would be as follows. If the airborne ADS-

B transmitter of aircraft-i fails than other aircraft-k are unable to receive state and intent

information of aircraft-i. Without state and intent information aircraft-k cannot safely resolve the

conflict and thus does nothing. But in the A3 model aircraft-i still receives state and intent

information of aircraft-k and thus aircraft-i can resolve the conflict.

In the A3G model separation is controlled from the ground. If the ADS-B transmitter of aircraft-i

fails, the ATC ground system doesn’t receive the state and intent information of aircraft-i. Hence

no resolution with aircraft-k is possible. Outdated state and intent information is dropped by the

ATC ground system after predetermined times. The ATC ground system is then unaware of the

state and intent of aircraft-i both the medium term as tactical layer are unable to generate a

resolution for aircraft-i or aircraft-k. ‘

The MC simulations results showed that a dependability of 101*10 was necessary to obtain

similar results as the A3 model. In the A3 model the safety requirement for the ADS-B

transmitter is 55*10 . One should be aware that in the A3G ConOps assumption A4 does not

hold true, i.e. an RBT in the ATC system will not so rapidly be considered to be unreliable when

ADS-B transmitter is down. This means that for the A3G ConOps it likely would not be required

that the ADS-B transmitter should realize this very high dependability.

IJ. ATC Ground System failure / corrupted

If the ATC ground system is down or corrupted both the Medium Term TBO layer as the Short

Term layer are not working. This means there are no conflicts detected and no resolution

process. The aircraft will continue flying their current conflicted flight plan (RBT).

In the A3 model the separation is controlled by the ASAS. The dependability for the ASAS is 55*10 in the A3 model. In the A3G model the dependability for the ATC ground systems needs

to be 101*10 , which is a much higher safety requirement. One should be aware that this kind of

very high dependability requirement does not come as a surprise, because similarly high

dependability requirements already apply to current ATC ground system in busy airspace.

K. ADS-B Ground receiver not working (failure)

In the A3G model the ADS-B ground receiver is used by the ATC ground system to receive the

state and intent information of all aircraft. When the ADS-B ground receiver is not working there

is no new information received. In the A3 model when the ADS-B ground receiver of aircraft-i is

down the other aircraft are still capable of resolving the conflicts with the available state and

intent information. In the A3G model when the ADS-B ground receiver is down this applies to

all aircraft. Hence none intent and state information is received. The ATC ground system is then

unable to resolve conflicts, due to outdated information.

of 96

The Monte Carlo simulation results showed that the dependability for the ADS-B ground

receiver needs to be 101*10 . One should be aware that in spite of assumption A3 for the A3G

model, in the A3G ConOps SSR Mode-S radars are fully in use, which avoids the very high

dependability requirement for the ADS-B ground receiver.

L. ATCo-Tactical maximum response time

In the A3 model there are no ATCo’s present. Conflict detection and resolution advice is

performed by the airborne ASAS and is directly presented to the Pilot-Flying. In the A3G model

conflict detection and resolution advice is performed by the ATC ground system. The resolution

advice is then first checked by the ATCo before sending it to the corresponding aircraft using the

ATC Uplink transmitter.

For the A3G model the results in Figure 4.13 through 4.15 show that the ATCo-T response

should not take longer than 2 seconds in order to get A3 model simulation results. This 2 seconds

response time requirement is not realistic at all. None of the A1-A5 assumptions influences this.

Though, the good news is that the results in Figures 4.13-4.15 also show that the A3G deviation

from the A3 results is rather small when the ATCo-T response is increased from 2 seconds to 5

or 10 seconds.

N. ATC Uplink transmitter sending duration

The ATC Uplink transmitter is used to send resolution advices generated by the ATC ground

system to the aircraft. For the A3G model to get A3 model simulation results it appears

necessary that the uplink transmission does not take longer than 1 second. None of the A1-A5

assumptions influences this.

In contrast with the finding for the ATCo-T response time above, the A3G deviation from the A3

results is far larger when the ATC uplink transmitter sending duration is increased from 1 s to 12

s. In subsection 4.16 it has been explained that this big difference in sensitivities is because the

ATCo-T is still able to decide optimal at the moment of decicion-making. However, the uplink

transmitter just adds delay, and the pilot no longer can synchronize tactical maneuver selection

with implementation. As a result, in rare cases the optimal decision by the ATCo has become

obsolete by the time it is implemented by the pilot.

Overall finding

To conclude the described 2 aircraft encounter MC simulation results: It is possible to obtain

similar results with the A3G model as obtained for the A3 model. However to obtain these

results the A3G baseline parameter values that were based on the A3 baseline parameter values,

needed to be changed to better values (which are referred to as the A3G selected parameter

values). When taking into account assumptions A1-A5, two key parameters remain for which

unexpectedly high requirements apply:

L. ATCo-Tactical maximum response time (2 seconds)

N. ATC Uplink transmitter sending duration (1 second)

Specifically, the 2 second response time for the ATCo-Tactical differs a lot from current

practice. Also demanding are the requirements on the ATC Uplink speed.

of 96

5 MC SIMULATION OF 8 AIRCRAFT ENCOUNTERS

In this Section Monte Carlo simulation results for eight aircraft encounters under the A3G model

are presented and discussed. This is organized as follows. First, in subsection 5.1 eight aircraft

encounter scenarios are presented using the A3G baseline parameter values as well as the A3G

selected parameter values from Table 4.19. Next, in subsection 5.2 the effects reducing of the

pilot’s response time on the simulation results in the eight aircraft encounter scenario are shown.

In Subsection 5.3 the eight aircraft scenario A3G model Monte Carlo simulation results are

compared to eight aircraft baseline results of the A3 model in [Blom&Bakker, 2011a,b].

5.1 A3G selected and A3G baseline parameter values applied to 8/ac encounters

In Figure 5.1 the Monte Carlo simulation results are presented for the eight aircraft encounter

using the A3G selected parameter values.

Figure 5.1: MC simulation results for Eight aircraft scenario under A3G model with A

3G selected

parameters (100 thousand MC runs).

The results of the A3G model under A3G selected parameter values in Figure 5.1 are very

different from the eight aircraft scenario MC results of the A3 model under A3 baseline

parameter values [Blom & Bakker, 2011]. The first part of the curve is the same, but beyond a

of 96

probability of 210 , the curve is completely different. The A3G model under the selected

parameter values doesn’t resolve Short Term Conflicts as well as the A3 model does. In Figure

5.2 the MC simulation results are shown for the A3G baseline parameter values. Main difference

is faster responses by ATCo-T (from 2s to 1s) and ATCo-P (from 10s to 1s). Moreover, the

dependability of various technical systems has been improved.

Figure 5.2: MC simulation of eight aircraft encounter under A3G model and A3G baseline parameter

values (135 thousand MC simulation runs).

The results in Figure 5.2 show a significant improvement over the results in Figure 5.1.

Nevertheless there still is a major difference with the rare event MC simulation results obtained

for the A3 model under A3 baseline parameter values. For the part of the curve at left of the 5

Nm point, the A3G model results are similar to those for the A3 model. However, for the part of

the curve at right of the 5 Nm point the results are very different from those for the A3 model.

Because of these large differences identified, some realized MC simulation results in the tail of

the curve in Figure 5.2 have been analyzed on what happens. This showed that the cause of the

problem lies in the tail of the delay by the pilot in implementing an updated MTCR or STCR. In

the A3 ConOps such rare lengthy delay by a pilot may also happen, though then this has a

completely different impact. In the A3 model the choice for a new MTCR or STCR is made by

the pilot on the basis of the actual traffic situation, and then it is immediately implemented in the

FMS or through the mode control panel. However, in the A3G model the choice of the MTCR or

of 96

STCR update is being made by the controller, also in a way that is an optimal decision at that

very moment. However from that moment on it takes some time until such MTCR or STCR is

being implemented by the pilot. This means that there occur situations in which the optimal ATC

decision is no longer optimal at the moment of implementation by the pilot. According to Figure

5.2, once in 1000 flight hours this leads to a serious mismatch in optimal timing of the MTCR

and/or STCR decision-making by the ATCo relative to the moment that it is implemented by the

pilot.

This explanation also would mean that in the A3G model this problem can easily be resolved by

shortening the time delay caused by the pilot to a very low value. This very fast pilot response is

tested next.

5.2 A3G baseline parameter values, except a very fast pilot response

In order to see the effect of a rapid reaction by pilots, in this subsection the effect of a very fast

reaction time of the Pilot-Flying is investigated through Monte Carlo simulations. All parameter

values are taken from the A3G baseline values, with the exception of the mean decision delay

time and monitoring duration of pilot flying (parameter numbers 14 and 24 in Appendix C). In

Table 5.1 the parameter values are shown.

Table 5.1: Parameter values for the faster Pilot Flying response times for MTC and Back-to-Goal

resolution advice implementation


A3

G

Baseline

value

Test

eight a/c

value

Pilot-

Flying

Task Performance

Goal 3: Conflict

Resolution (STC &

MTC)

#14

2dT

Mean decision delay time MTC

Monitoring & Decision

Execution

30 s 1 s

Task Performance

Goal 5: Navigation

horizontal actions

(Back2Goal)

#24

Mon

PF

Mean duration of Monitoring


20 s 1 s

Figure 5.3 shows the Monte Carlo simulation results of the test scenario. This confirms the

expected major improvement relative to the results in Figure 5.2. The curve in Figure 5.3 is

almost as good as the curve obtained for 8 a/c encounters under the A3 ConOps with the A3

baseline parameter values.

In Figure 5.3 a miss distance of 3.8 Nm at the 610 frequency level is obtained for the A3G

model in comparisons to 4.1 Nm at the 610 frequency level for the A3 model.

In spite of this dramatic improvement of the A3G model, there still is some difference with the

curve obtained for the A3 model. However, this difference lies below the 610 frequency level,

which means that the A3G results are not statistically meaningful. In order to reach statistically

meaningful results a factor 10 more MC runs should be conducted with the A3G model.

of 96

Figure 5.3: Monte Carlo simulation results A3G baseline parameter values except with very faster pilot

response time (2.1 million MC runs).

Figure 5.4: Comparison of A3G model results (blue curve) versus A

3 model results (black curve).

of 96

5.3 Findings for 8 a/c encounters

Figure 5.4 compares the simulation results from Figure 5.3 with similar MC simulation results of

the A3 model for the 8 a/c encounter scenario using the A3 baseline parameter values.

Comparison of this curve with the curve in Figure 5.3 shows that the differences are quite small.

To conclude the described 8 aircraft encounter MC simulation results: It is possible to obtain

similar results with the A3G model as obtained for the A3 model. However to obtain these

results the A3G baseline parameter values that were based on the A3 baseline parameter values,

needed to be changed to better values. When taking into account assumptions A1-A5, four key

parameters remain for which unexpectedly high requirements apply:

L. ATCo-Tactical maximum response time (1 second)

M. ATCo-Planning maximum response time (1 second)

N. ATC Uplink transmitter sending duration (1 second)

8. Pilot maximum response time (1 second)

Specifically, the 1 second response time for the Pilot as well as the ATCo-Tactical and ATCo-

Planning differs a lot from current practice. Also demanding are the requirements on the ATC

Uplink speed.

of 96

6 RANDOM TRAFFIC SCENARIOS

6.1 Monte Carlo simulation results for random traffic scenarios

For the A3 model rare event MC simulation results have been obtained by making use of a

Periodic Boundary Condition (PBC). This way it was possible to simulate a very large area

through running rare event MC simulations for eight aircraft only [Blom & Bakker, 2011a,b].

For the A3G model there are two challenges to apply this approach: i) The A3G model asks far

more CPU time than the A3 model; and ii) There is a need to develop a dedicated approach to

applying the PBC to the ATC part of the A3G model.

A straightforward approach towards the latter problem would be to make the PBC area such

large that the number of aircraft in it correspond to the number of aircraft in one ATC sector

under the 3x 2005 high traffic demand. This would ask to use a PBC with 24 or more aircraft,

which is 3x as many as have been used in to simulate random traffic scenarios under the A3

model. This factor 3 extra simply multiplies the already higher CPU load of the A3G model.

Hence it appeared to be infeasible to run MC simulations for random traffic scenarios under A3G

model within the time-frame of this D2.2 report schedule.

However, what we will do is to make a theoretical derivation of the activity loads on the

Planning ATCo, the Tactical ATCo and the pilot crew under the hypothetical assumption that the

A3G model would yield the same aircraft trajectories as the A3 model does. In view of the

results obtained for two and eight aircraft encounters this seems to be a rather optimistic

assumption for the A3G model. Thanks to this optimistic assumption for the A3G model, it

becomes possible to predict pilot crew and ATCo resolution activity frequencies simply by

measuring these frequencies for the A3 model under random traffic demands. This is the

accomplished in the current section.

First, subsection 5.2 provides the A3 measured activity frequencies for the pilot crews. Under the

hypothetical assumption about A3G model, these very same frequencies also apply to the pilot

crews under the A3G model. Next, subsections 5.3 and 5.4 use the results of subsection 5.2 for

the prediction of the activity frequencies for a Planning ATCo and a Tactical ATCo respectively.

6.2 MTCR and STCR activity frequencies for pilot crews

Table 5.1 shows the mean STCR and MTCR conflict resolution activity frequencies of a flight

crew that have been measured during rare event MC simulations of the A3 model. In view of the

hypothetical assumption mentioned above, these frequencies are assumed to also apply under the

A3G model. For 3x high 2005 traffic demand, the STCR/MTCR total amounts about one conflict

resolution activity per five minutes. To put this value into perspective, in current European en

route airspace a flight crew receives on average one executive instruction from ATC per eight

minutes [Eurocontrol, 2014]. Hence the mean frequency of executive activities by flight crew is

under 3x 2005 high traffic demand only 60% higher than the current average in en route

European airspace.

of 96

Table 5.1 also shows what happens when the random traffic demand goes up by another

factor 2. Under this 6x high 2005 traffic demand the MTCR and STCR activity frequencies go

also up by a factor three to four, to a total MTCR/STCR crew activity frequency of about 0.7 per

minute.

Table 5.2 shows the effect of changing APN1 by a factor 2 in either direction. A factor two

change in ANP value leads to a 10-25% change in the STCR activity frequencies of the flight

crew. These ANP changes have marginal effect on the MTCR activity frequency.

Table 5.3 shows that a wind prediction error of 30 m/s leads to a significant increase of

STCR/MTCR activities for the crew. The mean frequency increases from about one activity per

five minutes to one activity per two minutes. Because this high increase of conflict resolution

activities applies for a short time only, it is expected that this does not form an unmanageable

problem. Through running additional MC simulations it has been verified that an improvement

from ANP1 to ANP.5 may reduce the total MTCR/STCR activity frequency by some 10%, i.e. to

one activity per two minutes.

6.3 Predicted A3G ConOps MTCR and STCR activity frequencies for Planning ATCo

In view of the results found for two and eight aircraft encounters under the A3G ConOps, in

theory it is possible to let the A3G ConOps do the same from the ground as what the A3 ConOps

is doing from the air. The total activity for each pilot crew is expected to be the same as has been

measured for the A3 ConOps, in 5.1. These results allow us to predict the STCR and MTCR

activity loads for the tactical and planning ATCo by multiplying the A3 measured frequencies by

Table 5.1 Mean frequency of STCR and MTCR activities per aircraft under no wind prediction error

3x & 0 m/s 6x & 0 m/s

Mean MTCR frequency 0.11 per min 0.42 per min

Mean STCR frequency 0.08 per min 0.26 per min

Mean Total frequency 0.19 per min 0.68 per min

Table 5.2 Impact of ANP on the mean frequency of STCR and MTCR activities per aircraft under

3x high 2005 traffic demand and 0 m/s wind prediction error

3x & ANP.5 3x & ANP1 3x & ANP2

Mean MTCR frequency 0.10 per min 0.11 per min 0.11 per min

Mean STCR frequency 0.06 per min 0.08 per min 0.09 per min

Mean Total frequency 0.16 per min 0.19 per min 0.20 per min

Table 5.3. Effect of 30 m/s wind prediction error on mean frequency of STCR and MTCR activities

3x & 0 m/s 3x & 30 m/s

Mean MTCR frequency 0.11 per min 0.15 per min

Mean STCR frequency 0.08 per min 0.40 per min

Mean total frequency 0.19 per min 0.55 per min

of 96

the number of aircraft in a A3G sector. The results of such predictions are shown in figures 5.1

and 5.2, for the planning and tactical ATCo respectively.

Figure 5.1 Predicted MTCR activity frequency of a Planning ATCo as a function of the

number of aircraft in a sector. Purple line: 3x 2005 high and no wind error; green line: 3x

2005 high and 30 m/s wind prediction error; red line: 6x 2005 high and no wind error.

Planning ATCo

According to the curve in Figure 5.1, under the A3G ConOps, in a sector of 27 aircraft, a

Planning ATCo has to perform 3 MTCR activities per minute under 3x high 2005 traffic demand

and no wind prediction error. This is a demanding task level, though is expected to be

manageable by a well trained planning controller for the A3G ConOps. Under wind prediction

errors of up to 30 m/s, the MTCR activity frequency goes up to about 4 MTCR activities per

minute. Because this higher load will continue for a short period only, this also seems to be

manageable for an ATCo who is well trained for the A3G ConOps. However when the traffic

demand increases up to 6x high 2005 level, then the MTCR activity frequency goes up to more

than 10 per minute. This is expected to be an unreasonably high load which cannot be safely

managed by a planning ATCo. This means that the Flow Control should assure that local traffic

demands do not really go beyond the 3x high 2005 level.

of 96

6.4 Predicted A3G ConOps MTCR and STCR activity frequencies for Tactical ATCo

Figure 5.2 Predicted STCR activity frequency of a Tactical ATCo as a function of the

number of aircraft in a sector. Purple line: 3x 2005 high and no wind error; green line: 6x

2005 high and no wind error; red line: 3x 2005 high and 30 m/s wind prediction error.

Tactical ATCo

According to the curve in Figure 5.2, under the A3G ConOps, in a sector of 27 aircraft, a

Tactical ATCo has to perform about 2.5 STCR activities per minute under 3x high 2005 traffic

demand and no wind prediction error. This is a demanding task level, though is expected to be

manageable by a well trained tactical controller for the A3G ConOps. However, under wind

prediction errors of up to 30 m/s, the STCR activity frequency goes up to more than 10 STCR

activities per minute. This is expected to be an unreasonably high load which cannot be safely

managed by a tactical ATCo. This rapidly increasing STCR activity load under non-ideal

conditions makes the A3G ConOps a less realistic future ATM design.

of 96

7 CONCLUSION

One of the key innovations in SESAR2020+ is the introduction of a strategic TBO layer

[SESAR, 2007, 2012]. In this report for the first time rare emergent behaviour has been studied

for a ground-based future concept that makes use of both a strategic TBO layer and a tactical

resolution layer. The development of the Trajectory Based Operations A3G ConOps and model

is described. The A3G ConOps and model are derived from the A3 ConOps and model. Inherent

to this, the A3G model is a hypothetical model which for example does not yet address aircraft

emergency situations.

For the A3 model it was shown that the combination of a strategic TBO layer and a tactical layer

had a significant positive effect on safely accommodating high traffic demands. The objective of

this research was to investigate by rare event Monte Carlo (MC) simulations if the same positive

results could be obtained with the A3G model as with the A3 model. In the A3G model all

separation is controlled from one ground-based Air Traffic Control (ATC) system instead of by

each aircraft separately as in the A3 model. The A3G model was evaluated for three types of

scenarios, namely two aircraft head-on encounter scenarios, eight aircraft head-on encounter

scenarios, and random traffic scenarios with very high traffic demand.

The Monte Carlo simulation results for the two aircraft encounter scenario showed that the A3G

model was capable to deliver the same results as the A3 model. However, this posed high

requirements on the settings of the parameter values of the A3G model. By taking into account

the A3G model assumptions adopted, most of these parameter value requirements appeared to be

practically manageable. However, crucial exceptions have been found regarding the maximum

response times of the tactical ATCo (2 seconds) and of the ATC uplink transmitter (1 second).

The MC simulations results for the eight aircraft encounter scenario showed that in order for the

A3G model to obtain similar simulation results as the A3 model, additional requirements have to

be posed on the maximum response times of the ATCo-Tactical (1 second), the ATCo-Planning

(1 second), and the Pilot (1 second). Under these parameter settings the A3G model was able to

perform like A3 model did for the 8 a/c scenarios.

The key explanation of this need of such short response times is as follows. In the A3 model the

choice for a new MTCR or STCR is made by the pilot on the basis of the actual traffic situation,

and then it is immediately implemented in the FMS or through the mode control panel. However,

in the A3G model the choice of the MTCR or STCR update is being made by the controller, also

in a way that is an optimal decision at that very moment. However from that moment on it takes

some time until such MTCR or STCR is being implemented by the pilot. This means that there

occur rare but non-negligible situations in which the optimal ATC decision is no longer optimal

at the moment of implementation by the pilot. For the 8 a/c encounter scenarios this rare effect

could be avoided by reducing all responses by pilots, ATCo’s as well as the uplink transmitter to

1 second. For the 2 a/c encounter scenario the requirements are far less demanding, though the

rare signs already were noticeable in the MC simulations.

of 96

Through running MC simulations with the A3 model for random traffic scenarios, it has been

identified how much conflict resolution activities should be handled by the pilots, by the ATCo-

Planning and by the ATCo-Tactical under very high traffic demands. The results obtained show

that these demands are expected to be manageable by pilots, but seem unmanageable for the

ATCo’s.

In conclusion the rare event Monte Carlo simulations showed that the A3G model studied is not

able to safely accommodate very high air traffic demand as well as the A3 model can.

of 96

8 REFERENCES

[Abe & Yoshiki,

2001]

Y. Abe, M. Yoshiki, “Collision avoidance method for multiple autonomous mobile

agents by implicit cooperation”, Proc. IEEE/RSJ Int. Conf. Intelligent Robots and

Systems (IROS 01), pp. 1207–1212.

[Blom & Bakker,

2011a]

Blom, H., & Bakker, G. (2011). iFly Deliverable D7.4: Final Report on Accident Risk

Assessment of the A3 model. Amsterdam: NLR.

[Blom & Bakker,

2011b]

H.A.P. Blom, G.J. Bakker, Safety of advanced airborne self separation under very

high en-route traffic demand, Proc. SESAR Innovation Days, ENAC, Toulouse, 29

November-1 December 2011.

[Blom & Bakker,

2012]

Blom, H., & Bakker, G. (2012). Can airborne self separation safely accommodate

very high en-route traffic demand? 12th AIAA Aviation Technology, Integration, and

Operations (ATIO) Conference. Indianapolis, Indiana: American Institute of

Aeronautics and Astronautics, Inc.

[Blom & Bakker,

2013]

Blom, H., & Bakker, G. (2013). In search of positive emergent behaviour in

Trajectory Based Operations. Proceedings of the Third SESAR Innovation days.

Stockholm.

[Bujorianu, 2004]

M.L. Bujorianu. Extended stochastic hybrid systems. In Proceedings of Hybrid

Systems Computation and Control, Eds. O.Mahler, A. Pnuelli, LNCIS number 2993,

Springer, Berlin, pages 234–249, 2004.

[Cassandras &

Lafortune, 1999]

C.G. Cassandras, S. Lafortune. Introduction to Discrete Event Systems, Kluwer

Academic Publishers, Boston, 1999.

[David & Alla, 1994] R. David, H. Alla. Petri Nets for the modeling of dynamic systems - A survey,

Automatica, Vol. 30, No. 2, pages 175–202, 1994.

[EMERGIA, 2012] EMERGIA project web site http://emergia.nlr.nl

[EUROCONTROL,

2014]

Eurocontrol, Airborne Conflict Safety Forum, Organized by Flight Safety Foundation,

European Regions Airline Association and Eurocontrol, 10-11 June 2014, Brussels,

Findings and conclusions, V1.0, 18th July 2014

[Everdij & Blom,

2003]

M.H.C. Everdij, H.A.P. Blom. Petri nets and hybrid state Markov processes in a

power-hierarchy of dependability models. In Proceedings of IFAC Conference on

Analysis and Design of Hybrid Systems, Saint-Malo Brittany, France, pp. 355–360,

June 2003.

[Everdij & Blom,

2005]

M.H.C. Everdij, H.A.P. Blom. Piecewise deterministic Markov processes represented

by Dynamically Coloured Petri Nets, Stochastics, Vol. 77, pp.. 1–29, 2005.

[Everdij & Blom,

2006]

M.H.C. Everdij, H.A.P. Blom. Hybrid Petri nets with diffusion that have into

mappings with generalised stochastic hybrid processes. . Eds: H.A.P. Blom, J.

Lygeros. Stochastic Hybrid Systems: Theory and Safety Critical Applications, LNCIS

series, Springer, Berlin, July 2006, pp. 31–64.

[Everdij & Blom,

2010]

Everdij, M., & Blom, H. (2010). Hybrid state Petri nets which have the analysis

power of stochastic hybrid systems and the formal verification power of automata

(P. Pawlewski, Petri Nets, Chapter 12 ed.). Vienna: I-Tech Education and

Publishing.

[Everdij et al.,

2006]

M.H.C. Everdij, M.B. Klompstra, H.A.P. Blom, B. Klein Obbink. Compositional

specification of a multi-agent system by stochastically and Dynamically Coloured

http://emergia.nlr.nl/

of 96

Petri Nets. Eds: H.A.P. Blom, J. Lygeros. Stochastic Hybrid Systems: Theory and

Safety Critical Applications, LNCIS series, Springer, Berlin, July 2006, pp. 325–350,

2006.

[Fiorini & Schiller,

1998]

P. Fiorini, Z. Schiller, “Motion planning in dynamic environments using velocity

obstacles”, The International Journal of Robotics Research, Volume 17 (1998), pp.

760–772.

[Haas, 2002] P.J. Haas. Stochastic Petri Nets, Modeling, Stability, Simulation, Springer-Verlag,

New York, 2002.

[Hoekstra, 2001] J. Hoekstra, Designing for Safety, the Free Flight Air Traffic Management concept,

PhD Thesis, Delft University of Technology, 2001.

[iFly D1.3, 2010]

iFly Deliverable D1.3, Autonomous Aircraft Advanced (A3) ConOps, written by

Isdefe (Gustavo Cuevas, Ignacio Echegoyen, José García García), Honeywell (Petr

Cásek, Claudia Keinrath), NLR , and Utartu (Aavo Luuk), January 2010. Available on

iFly website http://ifly.nlr.nl/

[iFly D9.1, 2009]

iFly Deliverable D9.1, Operational Services and Environmental Description (OSED)

of Airborne Self-Separation Procedure (SSEP), by E. Gelnarová, P. Cásek, August

2009.iFly Deliverable D8.1, “A3 ConOps refinement”, Editors: L. Biescas and H.A.P.

Blom, Final draft of October 2011

[Jensen, 1992] K. Jensen. Coloured Petri Nets: Basic Concepts, Analysis Methods and Practical Use,

Vol. 1, Springer, London, UK, 1992.

[Labeau et al.,

2000]

P.E. Labeau, C. Smidts and S. Swaminathan. Dynamic reliability: towards an

integrated platform for probabilistic risk assessment. Reliability Engineering and

System Safety, Vol. 68, pp. 219–254, 2000.

[Meulenbelt, 2012] D. Meulenbelt, Veiligheid van A3 ConOps, Afstudeerscriptie, Hogeschool van

Amsterdam, 12 juli 2012.

[NASA, 2004]

NASA (2004). DAG-TM Concept element 5 en-route free maneuvering for user-

preferred separation assurance and local TFM conformance operational concept

description, AATT Project Milestone 8.503.10, NASA Airspace Systems Program

Office, Washington D.C.

[Nieskens, 2014]

Nieskens, C., Agent-based modelling and Monte Carlo simulation of ground

controlled trajectory-based operations, MSc Thesis, Delft University of Technology,

April 2014.

[Pola et al., 2003]

G. Pola, M.L. Bujorianu, J. Lygeros, M.D. Di Benedetto. Stochastic hybrid models:

an overview with applications to air traffic management. In Proceedings of IFAC

Conf. Analysis and Design of Hybrid Systems (ADHS), Saint-Malo, Brittany, France,

2003.

[SESAR, 2007] SESAR, “Concept of Operation, Sesar definition phase, Task 2.2.2, Milestone 3”,

Report DLT-0612-222-02-00, Version 2.0, October 2007.

[SESAR, 2012] SESAR Concept of Operations Step 2, SESAR-JU Deliverable D65-011, edition

01.00.00, May 2012.

[SESAR-JU, 2013] SESAR-JU, Preliminary OSED_2, Final V2 OSED_1, November 2013

http://ifly.nlr.nl/

of 96

Appendix A. Model Specification Formalism

A.1 Petri Net formalism

For the modelling of accident risk of safety-critical operations in nuclear and chemical industries, the most

advanced approaches use Petri nets as model specification formalism, and stochastic analysis and Monte Carlo simulation to evaluate the specified model, e.g., see [Labeau et al., 2000]. Since their introduction

as a systematic way to specify large discrete event systems that one meets in computer science, Petri

nets have shown their usefulness for many practical applications in different industries, e.g., see [David & Alla, 1994]. Various Petri net extensions and generalisations and numerous supporting computer tools

have been developed, which further increased their modelling opportunities. Nevertheless, literature on Petri nets appeared to fall short for modelling the class of General Stochastic Hybrid Systems (GSHS)

[Bujorianu, 2004] that was needed to model air traffic safety aspects well [Pola et al., 2003].

Cassandras and Lafortune [1999] provide a control systems introduction to Petri nets and a comparison

with other discrete eventmodelling formalisms like automata. Both Petri nets and automata have their

specific advantages. Petri net is more powerful in the development of a model of a complex system, whereas automata are more powerful in supporting analysis. In order to combine the advantages offered

by both approaches, there is need for a systematic way of transforming a Petri net model into an automata model. Such a transformation would allow using Petri nets for the specification and automata

for the analysis. For a timed or stochastic Petri net with a bounded number of tokens and deterministic or

Poisson process firing, such a transformation exists [Cassandras and Lafortune, 1999]. In order to make the Petri net formalism useful in modelling air traffic operations, we need an extension of the Petri net

formalism including a one-to-one transformation to and from GSHS. Everdij and Blom [2003, 2005, 2006, 2010] have developed such extension in the form of (Stochastically and) Dynamically Coloured Petri Net,

or for short (S)DCPN.

Jensen [1992] introduced the idea of attaching to each token in a basic Petri net (i.e., with logic

transitions only), a colour which assumes values from a finite set. Tokens and the attached colours

determine which transitions are enabled. Upon firing by a transition, new tokens and attached colours are produced as a function of the removed tokens and colours. Haas [2002] extended this colour idea to

(stochastically) timed Petri nets where the time period between enabling and firing depends of the input tokens and their attached colours. In [Haas, 2002] and [Jensen, 1992] a colour does not change as long

as the token to which it is attached remains at its place. Everdij and Blom [2003, 2005] defined a

Dynamically Coloured Petri Net (DCPN) by incorporating the following extensions: (1) a colour assumes values from a Euclidean state space, its value evolves as solution of a differential equation and influences

the time period between enabling and firing; (2) the new tokens and attached colours are produced as random functions of the removed tokens and colours. An SDCPN extends an DCPN in the sense that

colours evolve as solutions of a stochastic differential equation [Everdij & Blom, 2006].

This appendix explains how the SDCPN formalism has been used to develop a MC simulation model of the Conservative SESAR2020+ operation. Within the iFly project the same formalism has been used to

develop a MC simulation model of the A3 operation. Similarly as applied with the A3 operation, for the development of a Petri net model of A3G operation, two key challenges have to be addressed: a

syntactical challenge of developing a model that is consistent, complete, and unambiguous; and a semantics challenge of representing the A3G operation sufficiently well. This appendix aims to show the

(S)DCPN formalism that is used to address the syntactical challenge.

A.2 Specification of the developed Petri net model

In using the (S)DCPN formalism [Everdij & Blom, 2003, 2005, 2006] for the modelling of increasingly

more complex multi-agent hybrid systems, it was found that the compositional specification power of Petri nets reaches its limitations. More specifically, the following problems were identified:

of 96

1. For the modelling of a complete Petri net for complex systems, a hierarchical approach is

necessary in order to be able to separate local modelling issues from global or interaction modelling issues.

2. Often the addition of an interconnection between two low-level Petri nets leads to a duplication of transitions and arcs in the receiving Petri net.

3. The number of interconnections between the different low level Petri nets tends to grow

quadratically with the size of the Petri net.

Everdij et al. [2006] explained which Petri net model specification approaches from literature solve

problem 1, and developed novel approaches to solve problems 2 and 3. Together, these approaches are integrated into a compositional specification approach for SDCPN, which is explained below.

In order to avoid problem 1, the compositional specification of an SDCPN for a complex process or operation starts with developing a Local Petri Net (LPN) for each agent that exists in the process or

operation (e.g., air traffic controller, pilot, navigation and surveillance equipment). Essential is that these

LPNs are allowed to be connected with other Petri net parts in such a way that the number of tokens residing in an LPN is not influenced by these interconnections. We use two types of interconnections

between nodes and arcs in different LPNs:

Enabling arc (or inhibitor arc)

from one place in one LPN to one transition in another LPN. These types of arcs have

been used widely in Petri net literature.

Interaction Petri Net (IPN)

from one (or more) transition(s) in one LPN to one (or more) transition(s) in another LPN.

In order to avoid problems 2 and 3, high level interconnection arcs have been introduced that allow, with well-defined meanings, arcs to initiate and/or to end on the edge of the box surrounding an LPN [Everdij

et al., 2006]. The meaning of these interconnections from or to an edge of a box allows several arcs or transitions to be represented by only one arc or transition.

A.3 High level interconnection arcs

As an illustration of how high level interconnection arcs avoid duplication of arcs and transitions within an LPN and duplication of arcs between LPNs, we give three examples of these high level interconnection

arcs. See [Everdij et al., 2006] for a complete overview of these high level interconnection arcs.

In the first example, Figure A.1, an enabling arc starts on the edge of an LPN box and ends on a

transition in another LPN box, means that enabling arcs initiate from all places in the first LPN and end on

duplications of this transition in the second LPN. The duplicated transitions should have the same guard or delay function and the same firing function and their input places should have the same colour type.

This high level interconnection arc is not defined for inhibitor or ordinary arcs instead of enabling arcs.

of 96

FIGURE A.1: High level enabling arc starts at the edge of an LPN box.

In the second example, Figure A.2, an enabling arc ends on the edge of an LPN box. This means that for

each transition in the receiving LPN a copy of this enabling arc should be in place. Figure A.2 shows an example of this high level interconnection arc. This type of high level arc can also be used with inhibitor

arcs instead of enabling arcs. It cannot be used with ordinary arcs, due to the restriction that the number of tokens in an LPN should remain the same.

In the third example, Figure A.3, an ordinary arc starts on the edge of an LPN box and ends on a

transition inside the same box. This means that ordinary arcs start from all places in the LPN box to duplications of this transition. The duplicated transitions should have the same guard or delay function

and the same firing function and their set of input places should have the same set of colour types. Figure A.3 illustrates how this avoids both the duplication of transitions and arcs within an LPN, and the

duplication of arcs between LPNs.

FIGURE A.2: High level enabling arc ends at the edge of an LPN box.

of 96

FIGURE A.3: High level ordinary arc starts on the edge of an LPN box and ends on a transition inside the

same LPN box.

of 96

Appendix B. List of A3G parameters and their A3G baseline values

# Agent LPN Parameter Explanation

Baseline

value

1 Aircraft Engine System Fail

Engine Mean duration of Engine Failure

No Engine Failure

1 hr

2 Fail

Enginep Probability of Engine Failure 101*10

3 Aircraft

Emergency mode

down

OES Mean duration of Emergency No

Emergency

1 hr

4 down

OESp Probability of Emergency 101*10

5 Pilot

Flying

Current Goal

goals

PFm Total number of goals PF 7

6 failures

PFm Total Number of failures in case of

‘Emergency actions’ goal for PF

6

7 Goal Memory 3ExMon

PF Mean duration of Execution

Monitoring & Goal Prioritisation

14.7 s

8 3MonGP

PF Mean duration of Monitoring & Goal

Prioritisation End Task

10 s

9 Task Performance

Goal 2:

Emergency

Actions

MD

PF

Mean duration of Monitoring &

Decision Coordination, Duration

parameter of Monitoring & Decision

Execution

10 s

10 Coord

PF Mean duration of Coordination


5 s

11 ExMon



20 s

12 MonGP



10 s

of 96


Baseline

value

13 Pilot flying

(continued)

Task

Performance

Goal 3: Conflict

Resolution (STC

& MTC)

1dT

Mean decision delay time STC

Monitoring & Decision Execution

5.7 s

14 2dT

Mean decision delay time MTC

Monitoring & Decision Execution

30 s

15 Coord



∞

16 ExMon



0

17 3ExMon



14.7 s

18 3MonGP



10 s

19 Task

Performance

Goal 4:

Navigation

vertical

TW

PF Duration in Monitoring & Decision 10 s

20 MD

PF Mean duration of Monitoring &

Decision Coordination

∞

21 Coord



0 s

22

ExMon

PF

Mean duration of Execution

Monitoring Monitoring & Goal

Prioritisation

20 s

23 MonGP


Goal Prioritisation End Task

10 s

24 Mon

PF Mean duration of Monitoring


20 s

25 Task

Performance

Goal 5:

Navigation

horizontal

actions

(Back2Goal)

MD



∞

26 Coord



0 s

27

ExMon

PF



Prioritisation

20 s

28 MonGP



10 s

29 Mon

PF Mean duration of Monitoring


20 s

of 96


Baseline

value

30 Pilot flying

(continued)

Task

PerformancePF

Goal 6: Prepare

Route Change

MD



∞

31 Coord



0 s

32

ExMon

PF



Prioritisation

20 s

33 MonGP



10 s

34

2MD E

PF

Mean duration of


Execution

10 s

35 Task

PerformancePF

Goal 7:

Miscellaneous

MD



∞

36 Coord



0 s

37

ExMon

PF



Prioritisation

20 s

38 MonGP



10 s

39

2MD E

PF

Mean duration of


Execution

10 s

40 Task

Performancepf

Mon

PF

Duration parameter of

Monitoring Monitoring &

Decision

20 s

41

TD

PF

Duration parameter of


Prioritization

3 min

of 96


Baseline

value

42 Pilot flying

(continued)

State Situation

AwarenessPF

max FL

PFz SA by PF of maximum FL FL 300

43

min FL

PFz SA by PF of minimum FL FL 70

44 Intent Situation

AwarenessPF

FLISA Intended FL FL 220

45

ClimbVSISA Intended ROC 1500

ft/min

46

ClimbxVSISA Intended ROC expedite 2000

ft/min

47

DescVSISA Intended ROD -2000

ft/min

48

DescxVSISA Intended ROD expedite -3000

ft/min

49 SSAFL SSA minimum FL FL 90

50 Cognitive Mode

goals

PFm Total number of goals of PF 7

51

failures

PFm

Total Number of failures in case

of ‘Emergency actions’ goal for

PF

6

52

,

opp

PF i Mean duration of Oportunistic

mode for F of aircraft i = {1…n}

5 min

53 Pilot not flying Task

PerformancePNF

MD

PNF

Mean duration of


Coordination, Mean duration of


Monitoring

5 s

54

Coord

PNF

Mean duration of

Coordination Monitoring &

Decision

2 s

55 ExMon

PNF Mean duration of Execution


5 s

56 MonGP

PNF Mean duration of Monitoring &


5 s

57

Mon

PNF

Mean duration of

Monitoring Monitoring &

Decision

5 s

of 96


Baseline

value

59 Environment GNSS system (GPS/

Nav Global) /

Satellites

down

SAT Mean duration of Not Working

Working

½ hr

60 degraded

SAT Mean duration of Degraded

Working

0 s

61 corrupted

SAT Mean duration of Corrupted

Working

½ hr

62 down

SATp Probability of Not working 101*10

63 degraded

SATp Probability of Degraded 0

64 corrupted

SATp Probability of Corrupted 201*10

65 Global ADS-B ether

frequency

occ

ADS Bglobal

Mean duration of Occupied Not

occupied 1 hr

66 occ

ADS Bglobalp

Probability of Occupied

101*10

67 SSR frequency

(1030) ,

occ

SSR FRQ Mean duration of Occupied Not

occupied

0 s

68 ,

occ

SSR FRQp Probability of Occupied

0

69 Global ATC uplink

frequency

down

ATC global Mean duration of Occupied Not

Occupied

1 hr

70 down

ATC globalp Probability of Occupied 101*10

71 Weather magW Horizontal wind magnitude 0 m/s

72 degW Horizontal wind angle 0 deg

of 96


Baseline

value

73 Airborne GNC

systems:

Failure

indicators for

PF

Indicators Failure

mode PF

down

HMI Mean duration of HMI Not Working

Working

0 s

74

down

HMIp Probability of HMI Not Working 0

75 failures

PFm Total number of failures in case of

‘Emergency actions’ goal for PF

6

76 Airborne GNC

systems:

Guidance

Systems

Aircraft Guidance down

GUID Mean duration of Not Working

Working

0 s

77

HMI

downp Probability of Not Working 0

78 Horizontal

Guidance

Configuration

Mode

Vertical Guidance

Configuration

Mode

err

Standard deviation of course error

when LNAV disengaged

0.5 deg

79

Standard deviation on position of

aircraft entering the system, vertical

direction

20 m

80

v

Standard deviation on velocity of

aircraft entering the system, vertical

direction

0.5 m/s

81

3b Noise factor on velocity, vertical

direction

0.1 m/s

82

z

leveld

Boundary Baseline value used to

determine if the aircraft is flying

level or climbing/descending

10 m

83

w

z Standard deviation vertical wind 0 m/s

84

w

z Mean vertical wind 0 m/s

85 Aircraft FMS Intent

Intended

bank Intended bank angle 25 deg

86

Intended

gV Intended groundspeed 250 m/s

87 ANP ANP value 1 Nm

88

Hor

fxCB

Factor for Horizontal Conformance

boundary, i.e., boundary value (in

Nm) is 0.5 Hor

fxANP CB

2x

89

Ver

fxCB

Factor for vertical Conformance

boundary, i.e., boundary value (in

m) is

Ver

fxCB

2x

90 Send

TimeTCP Duration for sending one trajectory

change point (TCP)

3 s

of 96


Baseline

value

91

Send

NumTCP

Number of TCP’s sent belonging to

intent (hence total duration of

sending intent takes

Send Send

Time NumTCP TCP

4

92

Pr io

constd

a/c priority (w.r.t. distance to goal)

is constant within this range (to

avoid continuous switching of

priorities)

10 Nm

93 Airborne GNC

systems: Own

Positioning

Systems

Aircraft GNSS

(GPS) receiver

down

GNSS REC Mean duration of Not Working

Working

500 s

94

down

GNSS RECp Probability of Not Working

101*10

95 Aircraft IRS

down

IRS Mean duration of Not Working

Working

0 s

96

down

IRSp Probability of Not Working 0

97 Aircraft Altimeter

down

Altim Mean duration of Not Working

Working

½ hr

98

down

Altimp Probability of Not Working 101*10

99 Aircraft Horizontal

Position

Processing

IRS

x Standard deviation of horizontal

position error in case of IRS

estimate

0 m

100 1c Covariance of horizontal position

and velocity error in case of IRS

estimate

0 m2

/sec

101

IRS

v Standard deviation of horizontal

velocity error in case of IRS estimate

4 Nm/hr

102

GNSS


position error in case of GNSS/GPS

working well

20 m

103

GNSS

v Standard deviation of horizontal

velocity error in case of GNSS/GPS

working well

2 m/s

104

,GNSS DC


position error in case of GNSS/GPS

degraded or corrupted

20 m

of 96


Baseline

value

105

,GNSS DC

v

Standard deviation of horizontal velocity

error in case of GNSS/GPS degraded or

corrupted

10 m/s

106

Aircraft Vertical

Position

Processing

Ver

x Standard deviation of vertical position

error in case of altimeter working well

10 m

107 Ver

v Standard deviation of vertical velocity

error in case of altimeter working well

1 m/s

108

,degrver

x

Standard deviation of vertical position

error in case of altimeter degraded or

corrupted

60 m

109

,degrver

v

Standard deviation of vertical velocity

error in case of altimeter degraded or

corrupted

2 m/s

110 b Noise factor on velocity 0.5 m/s

111 Airborne

GNC:

Communicati

on Systems

ADS-B Transmitter down

ADS TRM

Mean duration of Not Working

Working

½ hr

112

down

ADS TRMp Probability of Not Working

101*10

113 ADS-B Receiver

(not used)

down

ADS REC


Working

½ hr

114

down

ADS RECp Probability of Not Working

55*10

115 Regular Broadcast

FMS Intent

IRBT Time interval for regular broadcast of

intent to ground

2 min

116 Regular Broadcast

aircraft state

SRBT Time interval for regular broadcast of

intent to ground

1 s

of 96


Baseline

value

117 ATC

Ground

System

CD &

Management

x

updateT Duration before processing update of state

info

1.5 s

118 I

updateT Duration before processing update of Intent

info

1.5 min

119 STC

predT STC prediction time of potential conflict

3 min

120 MTC

predT MTC prediction time of potential conflict

10 min

121

SODT

Time duration after which Start of Descend

(leaving SSA) will be initiated in case of Nav.

Failure

10 s

122 MTCD

sepATCH Vertical separation used in ATC MTCD

1000 ft

123 STCD

sepATCH Vertical separation used in ATC STCD

900 ft

124 MTCR

resATCR Horizontal resolution distance for ATC

MTCR

5 Nm

125 MTCR

resATCH Vertical resolution distance for ATC MTCR 1000 ft

126 STCR

resATCR Horizontal resolution distance for ATC STCR 3 Nm

127 STCR

resATCH Vertical resolution distance for ATC STCR 900 ft

128 2

max

B Goal Maximum turn angle allowed for flying back

to goal after STCR

90 deg

129 Resolution

Mode

STC

resT

Duration of state-based short term conflict

before ATC ‘switches’ to STC resolution

mode

10 s

130 STC

AlertAgainT

If an STC conflict exist longer than

STC

AlertAgainT , then another alert is generated 30 s

131 MTC

AlertAgainT

If an MTC conflict exist longer than

MTC

AlertAgainT , then another alert is generated 2 min

132

STC

in

If another STC is predicted to occur STC

in

earlier than the existing earliest STC, then

an STC alert is generated

5 s

133

MTC

in

If another MTC is predicted to occur MTC

in

earlier than the existing earliest STC, then

an STC alert is generated

5 s

of 96


Baseline

value

134 ATC

Ground

System

(continued)

ATC Intent

based STCR

advisory

max

res Maximum course change for resolution 60 deg

135

STC

addT

Additional time beyond the Short Term

horizon to avoid the new immediate Short

Term conflicts when doing ST resolution

10 s

136

min

resR

Minimum reduced horizontal separation

value allowed if no horizontal resolution

can be found

100 m

137 CPU

STCRT Time duration to calculate STCR 1 s

138 deg

div Angle used to diverge parallel STCR’s 5 deg

139

div

BoundH

All a/c within div

BoundH height difference are

initially taken into account for divergence

of parallel STCR’s

300 ft

140

divStep

BoundH

Stepwise increase of div

BoundH -value if there

are no a/c within div

BoundH height

difference

100 ft

141 Step

ROTd Step size in course change for finding

short term conflict resolution

0.5 deg

142 ATC Intent

based MTCR

advisory

max

res Maximum course change for resolution 60 deg

143

MTC

addT

Additional time beyond the Medium Term

horizon to avoid the new immediate

Medium Term conflicts when doing MT

resolution

5 min

144 CPU

MTCRT Time duration to calculate MTCR 2 s

145

deg

MTCR Step size in course for finding medium

term conflict resolution

0.5 deg

146

2 max

MTCR

B G Maximum turn angle allowed in ‘back to

goal’ part of resolution

45 deg

147

2 max

MTCR

B Gd Maximum detour distance allowed for

MTCR

15 Nm

148

2

MTCR

B GT Time interval at which a waypoint is

placed to find a path ‘back to goal’

15 s

149

MTCR

Adviz

MTC Resolution ‘starts’ (SOT) at

MTCR

Advizt (to take ATCo response time

and sending duration in account)

20 s

of 96


Baselin

e value

150 ATC

Ground

System

(continued)

ATC State &

Intent all

aircraft

ASAS SI

updateT

Duration before automatic reprocessing

of Info (determine if info has become to

old)

1 min

151 State

dropT Time difference for dropping State info

of other aircraft (i.e. info too old)

10 s

152 Intent

dropT Time difference for dropping Intent info

of other aircraft (i.e. info too old)

6 min

153 ADS BR

ADS-B range (horizontal) ∞ *

154 ATC

Conformance

Monitoring

Intent all

aircraft

CMI

DistTd Time duration bound for horizontal and

vertical distance conformance

2 s

155 CMITd Time duration bound for course

conformance

2 s

156 CMI

VgTd Time duration bound for groundspeed

conformance

2 s

157 CMI

ModeTd Time duration bound for Manoeuvre-

mode conformance

7 s

158 CMI

VTd

Time duration bound for vertical speed

conformance

7 s

159 Course

bound Course conformance bound 5 deg

160 Bound

gV Groundspeed conformance bound

10 m/s

161

,

Bound

LevelV Vertical speed conformance bound when

flying Level

0.1 m/s

162

,

Bound

N LevelV Vertical speed conformance bound when

climbing/descending

2 m/s

163 ATC

Surveillance

(ADS-B ground

receiver )

surv

updateT Duration before ADS-B info update of all

aircraft

1 s

164

occ

Probability that any aircraft is not

received due to ADS-B global occupied or

not

0.5

165 ownx Position of ATC ground system [x,y,z] [0,0,0]

*: It is assumed that SWIM provides an unlimited extension of ADS-B reach without causing any

delay.

of 96


Baseline

value

166 ATC

Ground

System

(continued)

ATC System

Mode

Fail

ATCsys Mean duration of Failure Working 1 hr

167 corr

ATCsys Mean duration of Corrupted Working

1 hr

168 corr

ATCsysp Probability of Corrupted 101*10

169 down

ATCsysp Probability of Not working 101*10

170 Back-to-Goal

evaluation 2B GT

Interval time for Back-to-Goal Evaluation

20 s

171 ADS-B ground

receiver mode

_ ,

down

ATC ADS REC


Working ½ hr

172 _ ,

down

ATC ADS RECp

Probability of Not Working 101*10

173 ATC Uplink

Transmitter

Transmit

uplinkT Duration of sending resolution to aircraft

1 s

174 ATCo ATCo-Tactical min

ATCo TT ATCo-T minimum response time 1 s

175

max

ATCo TT

ATCo-T

maximum

response time

1 s

176 ATCo-Planning min

ATCo PT ATCo-P minimum response time 1 s

177 max

ATCo PT ATCo-P maximum response time 1 s

e.02.39 emergia d2.2 report...e.02.39 emergia d2.2 report emergent behaviour of simulation model...

Documents