The information contained in this document is the property of the EUROCONTROL Agency and no part should be reproduced in any form without the Agency’s permission.

The views expressed herein do not necessarily reflect the official views or policy of the Agency.

EUROPEAN ORGANISATION FOR THE SAFETY OF AIR NAVIGATION

EUROCONTROL

EUROCONTROL EXPERIMENTAL CENTRE

DISTRIBUTED CENTRALISATION:

A SPECULATIVE APPROACH TO THE COORDINATION OF AIRBORNE CONFLICT-FREE TRAJECTORY RE-PLANNING USING AN ARRAY OF SEQUENCERS

EEC Note No. 21/05

Project INO

Issued: November 2005

REPORT DOCUMENTATION PAGE

Reference: EEC Note No. 21/05

Security Classification: Unclassified

Originator: EEC - INO (InNOvative Research)

Originator (Corporate Author) Name/Location: EUROCONTROL Experimental Centre Centre de Bois des Bordes B.P.15 F - 91222 Brétigny-sur-Orge Cedex FRANCE Telephone: +33 (0)1 69 88 75 00

Sponsor: EEC

Sponsor (Contract Authority) Name/Location: EUROCONTROL Agency 96, Rue de la Fusée B-1130 Brussels Telephone: +32 2 729 90 11 WEB Site: HTUwww.eurocontrol.intUTH

TITLE: DISTRIBUTED CENTRALISATION: A SPECULATIVE APPROACH TO THE COORDINATION

OF AIRBORNE CONFLICT-FREE TRAJECTORY RE-PLANNING USING AN ARRAY OF SEQUENCERS

Authors Richard Irvine

Date 11/2005

Pages vi + 15

Figures 6

Tables -

Annexes -

References 14

Project INO

Task No. Sponsor -

Period 2005

Distribution Statement: (a) Controlled by: Head of INO (b) Special Limitations (if any): None (c) Copy to NTIS: SYESS / NO Descriptors (keywords): Centralised, Distributed, Sequential, Concurrent, Automation, Autonomous, Coordination, Sequencer, Air Traffic Control.

Abstract:

This document outlines an operational concept as a possible topic for further elaboration and investigation. It has not been validated in any way.

Radical approaches to redesign of air traffic control have included centralised, ground-based automation and distributed autonomous aircraft. Achieving a level of reliability commensurate with the control of thousands of passenger carrying flights is a daunting challenge for a single centralised system. On the other hand the fully distributed approach to autonomous aircraft opens the Pandora’s box of concurrent processing. In the current air traffic control system control of airspace is distributed over many sectors but within each sector control is centralised. In this document a distribution of functionality is described in which the sequencing of trajectory re-planning is centralised within sector-like regions and individual trajectory re-planning, either for conflict avoidance or trajectory optimisation, is performed onboard aircraft.

Distributed Centralisation: Coordination Using an Array of Sequencers EUROCONTROL

Project INO - EEC Note No. 21/05 v

TABLE OF CONTENTS

TULIST OF FIGURESUT ............................................................................................................. V

TUREFERENCESUT .................................................................................................................. VI

TU1. UT TUCHALLENGES FOR THE EXISTING AIR TRAFFIC CONTROL SYSTEM UT..................1 TU1.1. UT TUCAPACITYUT ..................................................................................................................... 1 TU1.2. UT TUCOST UT ............................................................................................................................. 2 TU1.3. UT TUUNMANNED AERIAL VEHICLES UT .................................................................................. 3

TU2. UT TUSOME CHARACTERISTICS OF THE EXISTING AIR TRAFFIC CONTROL SYSTEM UT........................................................................................................................4 TU2.1. UT TUCENTRALISED OR DISTRIBUTED? UT ............................................................................. 4 TU2.2. UT TUSECTORS UT ...................................................................................................................... 4 TU2.3. UT TUCONTROLLERSUT ............................................................................................................ 4

TU3. UT TUPOTENTIAL BENEFITS OF AUTOMATIONUT ................................................................5

TU4. UT TUPAST WORKUT ................................................................................................................6

TU5. UT TUCOORDINATION BETWEEN AUTONOMOUS AIRCRAFTUT .........................................7 TU5.1. UT TUPRIORITY RULES UT ......................................................................................................... 7 TU5.2. UT TUFORCE FIELDS UT ............................................................................................................. 8

TU6. UT TUPROPOSED SCHEMEUT ..................................................................................................9

TU7. UT TUREDUNDANCY, FAILURE AND RECOVERYUT............................................................12

TU8. UT TUHUMAN INTERVENTION IN AN AUTOMATED SYSTEM UT .........................................13

TU9. UT TUCONCEPT TESTING THROUGH SIMULATIONUT ........................................................14

TU10. UT TUNEXT STEPSUT ..............................................................................................................15

LIST OF FIGURES TUFigure 1: Yearly traffic variation UT ....................................................................................................... 1 TUFigure 2: Unit costs per km (KPI), total costs and trafficUT .................................................................. 2 TUFigure 3: The wingspan of the Global Hawk is similar to that of a 737UT ............................................ 3 TUFigure 4: Coordination between autonomous aircraft UT ...................................................................... 7 TUFigure 5: Multiple conflictsUT ............................................................................................................... 7 TUFigure 6: Airspace devided into regions UT........................................................................................... 9

EUROCONTROL Distributed Centralisation: Coordination Using an Array of Sequencers

vi Project INO - EEC Note No. 21/05

REFERENCES

PRR8 HTUAn Assessment of Air Traffic Management in Europe during the Calendar Year 2004 UTH, EUROCONTROL Performance Review Commission, April 2005.

GoP HTUEUROPEAN AERONAUTICS: A VISION FOR 2020 UTH REPORT OF THE GROUP OF PERSONALITIES, January 2001

6th ATM R&D HTU6 UPU

thUPU USA/Europe ATM R&D Seminar Executive SummaryUTH

CAP754 HTUUK Regional Air Services, Civil Aviation Authority, February 2005 UTH

Lezaud et al. HTUAccident Risk Assessment and Monte Carlo Simulation Methods UTH Pascal Lezaud, Jaroslav Krystul, Henk Blom, June 2004 See HTUHYBRIDGE UTH for related references.

ARC EUROCONTROL Experimental Centre Report 274, December 1994.

FREER1 HTUInitial Results of Investigation into Autonomous Aircraft Concept (FREER-1)UTH Vu N. Duong, Eric Hoffman, Jean-Pierre Nicolaon 1 P

stP FAA/Eurocontrol ATM R&D Seminar Saclay, France, June 17-20, 1997

FREER3 FREER3 An Experimental Airborne Separation Assurance System Richard Irvine, EUROCONTROL Experimental Centre, 1999. Contact HTURichard Irvine UTH for further details.

FACES HTUFACES: a Free flight Autonomous and Coordinated Embarked Solver UTH FAA/EUROCONTROL R&D Seminar, Orlando, December, 1998.

GEARS1 HTUThe GEARS Conflict Resolution AlgorithmUTH Richard Irvine EUROCONTROL Experimental Centre Report 321, November 1997

GEARS2 The GEARS Conflict Resolution Algorithm Richard Irvine AIAA Guidance, Navigation and Control Conference, Boston, August 1998. Contact HTURichard Irvine UTH for further details.

MAICA MAICA Final Report, MAICA: AED-11-DOC-WP4-R2.0 Pierre Faure et al., Aerospatiale, 15th May 1998

Zeghal A Review of Different Approaches Based on Force Fields for Airborne Conflict Resolution Karim Zeghal AIAA Guidance, Navigation and Control Conference, Boston, August 1998.

Dimarogonas HTUInventory of Decentralized Conflict Detection and Resolution Systems in Air TrafficUTH Dimos V. Dimarogonas and Kostas J. Kyriakopoulos HYBRIDGE Deliverable D6.1

Distributed Centralisation: Coordination Using an Array of Sequencers EUROCONTROL

Project INO - EEC Note No. 21/05 1

1. CHALLENGES FOR THE EXISTING AIR TRAFFIC CONTROL SYSTEM

1.1. CAPACITY

In 1990 there were about 5.3 million flights in Europe, and in 2004 this had risen to about 8.6 million flights [ HTUPRR8 UTH].

Figure 1: Yearly traffic variation

Taken from [HTUPRR8UTH, section 2.2.1, fig. 10]

This corresponds to a growth rate year on year of about 3.5%. If this rate of growth were to continue traffic would double in 20 years (2005 – 2025).

The vision of the “Group of Personalities” convened by the European Commissioner for Research, foresees in 2020 an air traffic management system which copes with up to three times more aircraft movements than today” [HTUGoPUTH].

Further, according to the executive summary of the 6P

thP USA/Europe ATM R&D seminar, in June

2005, “The main economic driver for ATM R&D should be the search for increased capacity [...] R&D is not generating credible solutions to the looming capacity wall, and this should be urgently addressed.” [ HTU6th ATM R&D UTH].

Some major airports appear to be nearing saturation. Wake vortices determine minimum safe separations on approach which in turn limit landing rates. It is often not possible to build new runways, either for reasons of space or environmental impact. However, saturation at major airports is not limiting the growth of air traffic; rather traffic is growing rapidly at regional airports [ HTUCAP754 UTH]. Consequently, the challenge of managing en-route traffic continues to grow.

The future is difficult to predict. Demand for air transport might grow more quickly than in the past, it might increase more slowly, it might plateau or it might decrease. If demand increases the existing system may adapt and evolve to accommodate it, as it has done in the past, or we may discover in hindsight that the system was nearing its limits.

EUROCONTROL Distributed Centralisation: Coordination Using an Array of Sequencers

2 Project INO - EEC Note No. 21/05

In view of the difficulty of predicting the future, prudent risk management should allow, at least at the level of research, for the development of a range of options for tackling different scenarios.

1.2. COST

Air traffic management costs amounted to 5912 M€ in Europe in 2004 [ HTUPRR8 UTH, section 7.1.2, fig. 65].

Total en-route air navigation service provision costs have increased roughly in line with traffic in the period from 1997 to 2005 [HTUPRR8 UTH, section 7.2.1, fig. 66] and as a consequence costs per kilometre have been stable.

Figure 2: Unit costs per km (KPI), total costs and traffic

Taken from [HTUPRR8UTH, section 7.2.1, fig. 66]

If increases in air traffic do occur, with a possible tripling of movements by 2020 [ HTUGoPUTH], and if this relationship between traffic and total costs persists, then proportional increases in total air navigation service provision costs are to be expected.

This year [2005] has seen rapid increase in fuel costs and it seems reasonable that the long-term tendency will continue upwards. Rising fuel costs increase the pressure on the air traffic management system to provide fuel efficient flight profiles.

Distributed Centralisation: Coordination Using an Array of Sequencers EUROCONTROL

Project INO - EEC Note No. 21/05 3

1.3. UNMANNED AERIAL VEHICLES

Recent years have seen the advent of unmanned aerial vehicles (UAVs). Initially developed for military purposes they are now finding civil applications. While some are effectively remotely piloted others have greater autonomy. As well as being a potential source of growth in air traffic, there is the challenge of working out how to operate them safely together with conventionally piloted flights.

Figure 3: The wingspan of the Global Hawk is similar to that of a 737

EUROCONTROL Distributed Centralisation: Coordination Using an Array of Sequencers

4 Project INO - EEC Note No. 21/05

2. SOME CHARACTERISTICS OF THE EXISTING AIR TRAFFIC CONTROL SYSTEM

The existing air traffic control system has the remarkable property that it provides a solution to the air traffic control problem which is acceptable to society. While research and development organisations propose many possibilities over time, few, if any, have a higher level of acceptability. In view of this remarkable property, it is interesting to focus on some salient characteristics of this system.

2.1. CENTRALISED OR DISTRIBUTED?

Airspace is divided into sectors and control of aircraft is distributed across these sectors. On the other hand, within each sector, a controller constitutes a central authority. So the current system is neither fully centralised nor is it fully distributed. It is an example of “distributed centralisation”. This is a key feature of the current ATC system and one which will be carried over into the scheme proposed later.

2.2. SECTORS

The division of airspace into sectors provides a decomposition of the problem. A decomposed problem is generally easier to solve than a problem which has not been decomposed.

Sectors serve to identify a subset of aircraft. If all such subsets can be controlled satisfactorily then the whole set can be controlled satisfactorily.

Aircraft are transferred between sectors in accordance with letters of agreement, which specify entry and exit points and flight levels. This tight specification of entry and exit conditions is necessary for the human controller to perform her work. However, as traffic increases, these conditions can become bottlenecks on sector boundaries.

2.3. CONTROLLERS

Controllers give trajectory modification instructions to aircraft. Within a sector instructions are given in sequence. The controller ensures that successive trajectory modifications are compatible.

Distributed Centralisation: Coordination Using an Array of Sequencers EUROCONTROL

Project INO - EEC Note No. 21/05 5

3. POTENTIAL BENEFITS OF AUTOMATION

Potential benefits of automation include:

• Capacity increase

• Reduction of air traffic management operating costs

• Automated control of unmanned aerial vehicles (UAVs)

• Optimisation of trajectories in accordance with airline preferences (fuel, time)

EUROCONTROL Distributed Centralisation: Coordination Using an Array of Sequencers

6 Project INO - EEC Note No. 21/05

4. PAST WORK

The ARC2000 project sought to investigate the feasibility of automating air traffic control [ARC]. The main difficulty encountered was the development of a simulator incorporating automatic conflict resolution without the prior existence of reliable conflict resolution algorithms. The idea of forbidden area (a transformation of the trajectory of an obstacle aircraft into a region to be avoided) was introduced. However, the development of reliable algorithms proved elusive.

An algorithm [ HTUGEARS1 UTH, HTUGEARS2 UTH], taking advantage of the ARC2000 experience, was devised during the twilight months of the project. This algorithm was subsequently used in the MARS simulator developed by Alcatel ISR as part of the European Commission MAICA project [MAICA] which investigated the feasibility of free flight. Seventy-six simulations were performed varying geographical region and traffic level. A look-ahead time of ten minutes was used corresponding to an ADS-B range of 150 nautical miles. In seventy-two simulations solution trajectories were always found for the designated aircraft on the first call to the resolution algorithm (over 17 000 resolutions). From this point of view these simulations were very encouraging. However, in four simulations (a further 17 000 resolutions) ten cases of missed resolutions were counted, that is, conflicts which were not solved on the first call to the algorithm but which were solved on a subsequent simulation step (presumably other changes in the traffic situation made resolution possible at a later time). One conflict was not solved either on the first call or on subsequent calls. Ten of the eleven anomalous cases occurred in three simulations in which the traffic level corresponded to about three times current peak traffic levels. The project had a tight time scale for development of the simulator, for the performing of simulations and reporting. Unfortunately the schedule and organisation did not allow any investigation of the anomalous cases, which might well have been the most interesting cases. Consequently, it was not possible to pin down whether the problems were attributable to the overall resolution strategy, the resolution algorithm or the software implementation or whether the eleven anomalous cases were remediable.

The HTUFREER1 UTH project developed an approach to autonomous aircraft which envisaged concurrent resolution of conflicts. Concurrent resolution can potentially lead to induced conflicts (that is, conflicts which results from resolutions of other conflicts) and instability (see later). The MAICA project simulated the FREER1 approach, but in fact the simulation was such that conflicts were detected and resolved sequentially. In other words, the simulation actually overcame a key problem of the FREER1 concept. In conceptual terms, the simulation really corresponded to a single, centralised system, similar to that envisaged in ARC2000, rather than to a distributed system. This project was also committed to pilot in the loop resolution, which implies significant delays between detection and resolution.

Distributed Centralisation: Coordination Using an Array of Sequencers EUROCONTROL

Project INO - EEC Note No. 21/05 7

5. COORDINATION BETWEEN AUTONOMOUS AIRCRAFT

Figure 4: Coordination between autonomous aircraft

In corridors it sometimes happens that to avoid walking into one another two people move to the same side of the corridor. Realising that the resulting trajectories are still incompatible they both move to the other side of the corridor. This is an example of uncoordinated behaviour which, while amusing in corridors, would be unsafe for aircraft. The problem becomes more complicated as the number of agents increases.

How can autonomous aircraft coordinate their trajectories?

5.1. PRIORITY RULES

One approach is the application of priority rules such as those proposed in [ HTUFREER1 UTH]. In this scheme, in a two aircraft conflict, one aircraft will maintain its trajectory and the other will modify its trajectory. It is essential to ensure that both aircraft reach the same conclusion as to which has priority over the other. This is difficult to ensure if priority is calculated using input data which may differ between the two aircraft.

Supposing priority can be unambiguously assigned in the case of a two aircraft conflict, there remains the problem of what to do in the case of multiple conflicts, as shown below.

Figure 5: Multiple conflicts

One approach would be to assign an order of priority to all of the aircraft involved. However, this supposes that one can identify the set of aircraft which should be ordered.

An elegant scheme is described in [HTUFACESUTH]. Here token passing is used to establish a resolution order amongst a set of autonomous aircraft. Conflicts are solved sequentially. It would be interesting to investigate the robustness of this scheme when aircraft come within range or move out of range during the resolution process, or when communication failures prevent tokens from being passed or cancelled.

EUROCONTROL Distributed Centralisation: Coordination Using an Array of Sequencers

8 Project INO - EEC Note No. 21/05

5.2. FORCE FIELDS

Another approach to distributed coordination is the use of force field methods, which are based on an analogy with repulsion between charged particles [Zeghal, Dimarogonas]. These methods operate concurrently. The use of forces which are inversely related to distance effectively gives greater weighting to the avoidance of aircraft nearby than those which are further away. This can result in induced conflicts of the kind shown above.

Distributed Centralisation: Coordination Using an Array of Sequencers EUROCONTROL

Project INO - EEC Note No. 21/05 9

6. PROPOSED SCHEME

In the proposed scheme:

It is assumed that aircraft communicate via a broadcast mechanism with finite range. Aircraft broadcast trajectory messages periodically (perhaps in the form of a current state vector, some anticipated trajectory change points, and the aircraft’s goal i.e. its destination) as proposed in FREER1 and implemented in FREER3 (see references).

Aircraft must respect some aspects of the trajectories they broadcast. They are expected to follow the horizontal path and to begin vertical transitions at the points shown in the broadcast trajectory. They are expected to move to the final flight level indicated in a vertical transition. Those parameters of the broadcast trajectory which an aircraft must respect will be termed the aircraft “intent”.

Where possible, flight management systems should take corrective action to progress as closely as possible in accordance with the broadcast trajectory. If corrective action is not possible aircraft may independently update broadcast trajectories to reflect actual progress or updated atmospheric data but they may not independently change their intent. So for example, times of arrival at points could be updated to reflect the wind which is being experienced, or the nominal position at which top of climb is reached might move if the presently predicted climb behaviour differs from earlier predicted behaviour.

Aircraft use their own trajectory messages and those of other aircraft to detect possible conflicts. Usually possible conflicts will be detected as aircraft come within range of one another but they may also be detected as trajectories are updated, as described above.

Trajectory messages list the possible conflicts which have been detected. The presence of possible conflicts in the trajectory message will be interpreted as a request [to a sequencer] to re-plan either the aircraft’s own trajectory or that of a conflicting aircraft. The trajectory message may additionally indicate a request to re-plan its own trajectory for the purposes of trajectory optimisation rather than conflict avoidance.

Imagine an airspace (perhaps an en-route airspace) divided into regions. In the diagram below these regions are squares, for example A9, but hexagons could also be used.

CFED

BA 1 2 3

8 9 4

7 6 5

1 2 3

8 9 4

7 6 5

1 2 3

8 9 4

7 6 5

1 2 3

8 9 4

7 6 5

1 2 3

8 9 4

7 6 5

1 2 3

8 9 4

7 6 5

Figure 6: Airspace devided into regions

EUROCONTROL Distributed Centralisation: Coordination Using an Array of Sequencers

10 Project INO - EEC Note No. 21/05

For each region there is an automatic sequencer whose responsibility is to sequence trajectory re-planning for aircraft whose trajectories show that they will enter the region or which are already in the region. The sequencer could be physically located within a region or logically associated with it. It is worth noting that in the current ATC system a controller is logically associated with a sector rather than being physically located within it.

The sequencer also receives position and trajectory broadcasts either directly or via a communications network. A network allows sequencers to be logically associated with regions and in principle removes any restrictions on the distance from which the sequencer can receive broadcasts. This is similar to today’s system in which radar and voice data are relayed to control centres. Sequencers might be ground-based or even space-based.

The sequencer itself does not perform any conflict detection or trajectory re-planning. It takes note of all aircraft which will transit the region for which trajectory messages indicate the need to re-plan either for possible conflict avoidance or for trajectory optimisation.

The sequencer instructs aircraft which are currently in its region or which are in adjacent regions to re-plan their trajectories. To avoid interference with one another the sequencers 1 - 9 operate in a sequence of time slices. Sequencers marked with the same number, for example all those marked 9 in the above diagram, operate in the same time slice, as they operate on different sets of aircraft. A configuration parameter would be the number of instructions issued per time slice. A single instruction per time slice would maximise the frequency with which a sequencer can take control.

Broadcast range limits the earliest time at which aircraft become visible to one another. If the length of the side of a small square is chosen to correspond to the broadcast range this will allow the earliest possible re-planning. The broadcast range is technology dependent. A broadcast range of 150 nautical miles would correspond to the side of a small square equivalent to about 20 minutes flying time. If a smaller square size is used then re-planning will occur later but a greater degree of parallelism will be achieved. This is analogous to decreasing sector sizes in the current system in order to increase the number of controllers available to handle greater traffic.

The sequencer defines the sequence in which aircraft will re-plan their trajectories. Re-planning for conflict avoidance would have priority over re-planning for trajectory optimisation. Re-planning of trajectories for conflict avoidance could be ordered by time to possible loss of separation or by some measure of severity. The sequencer would have rules, perhaps similar to the Extended Flight Rules [HTUFREER1 UTH], to decide which aircraft to move to resolve a conflict.

Trajectory re-planning itself is an automated airborne function which might use one-against-many algorithms similar, for example, to that described in [GEARS2]. Aircraft could use different trajectory re-planning algorithms although considerations of equity might lead to standardisation of a single algorithm. The resulting trajectory should be conflict-free with respect to all aircraft which are within broadcasting range. The trajectory re-planning algorithm could take account of higher level directives specified by either the aircrew or the airline. These might include a target time of arrival at an approach fix. The definition of conflict-free might take into account worst-case uncertainty limits in the short-term to ensure separation is not lost in the short-term and better-case limits in the longer-term to allow trajectories to be found which will probably avoid separation losses in the longer-term. The trajectory re-planning algorithm might take account of a route network or might join aircraft to established flows. Re-planning algorithms should provide a guarantee of the quality of resulting trajectories. More challenging is to develop algorithms which guarantee the existence of solutions under certain conditions, and then develop a system which ensures those conditions are always true. Note however, that in today’s system there is no guarantee that an air traffic controller will always find a solution. We simply accept that she invariably does.

Distributed Centralisation: Coordination Using an Array of Sequencers EUROCONTROL

Project INO - EEC Note No. 21/05 11

In the event that a re-planning algorithm does not provide a solution which fulfils required separation, it should nonetheless provide a solution which maximises the minimum separation.

The minimum separation provided by the re-planning algorithm should be greater than that used by the conflict detection algorithm to prevent small differences between actual and predicted trajectories immediately resulting in redetection of possible conflicts.

Trajectory re-planning will make use of trajectory prediction. Onboard an aircraft is in principle a good place for predicting that aircraft’s trajectory as a great deal of pertinent data is available such as aircraft type, mass, operating policy, actual wind etc. An advantage of airborne trajectory prediction compared with ground-based trajectory prediction is that it avoids the need for down-linking of aircraft parameters. Trajectory prediction also requires knowledge of weather conditions ahead of the aircraft. This requirement is common to all aircraft flying in an area and is broadcast as a general service.

Receipt of a re-plan instruction onboard an aircraft triggers the trajectory re-planning process. The re-planning process takes account of the most recently received trajectories from other aircraft. When re-planning is complete the aircraft broadcasts its preferred conflict-free trajectory. The delay due to the re-planning process will determine the rate at which re-plan instructions can be issued. This rate is likely to have an impact on the safe capacity of the system.

In some ways the regions described in this proposal are similar to sectors in the current system. A difference is that sequencers operate on aircraft in adjacent regions as well as in the region for which they are responsible and there are no region entry and exit conditions.

EUROCONTROL Distributed Centralisation: Coordination Using an Array of Sequencers

12 Project INO - EEC Note No. 21/05

7. REDUNDANCY, FAILURE AND RECOVERY

Redundancy is achieved by distributing the system amongst all aircraft on the airborne side, and by the use of multiple, independent sequencers. (The sequencers do require a common time-base for time-slicing, but this could probably be achieved through local clocks synchronised periodically with a global time source, such as GPS or Galileo). An airborne failure primarily affects one aircraft and a sequencer failure would affect a region. A variety of fallback mechanisms can be envisaged. The sequencer itself is a simple, independent device and one can imagine backup sequencers for each region operating as hot standbys. Another possibility would be for a neighbouring sequencer to take over the work of a failed sequencer. If sequencing were to fail completely for a region it would be desirable, in the absence of other measures, for the trajectories of the aircraft within the region to be conflict-free until they exit from the region [the trajectories would, in ARC2000 terms, be “autostable” within the region]. Aircraft approaching a region in which sequencing had completely failed could be re-routed around that region. The failed region would become a no-go zone for the trajectory re-planning algorithm. As all aircraft are effectively equipped for autonomous operation, another fallback possibility would be for aircraft to operate autonomously in the event of a complete ground-side failure within a region.

Computer processing is distributed. Each aircraft performs its own conflict detection and trajectory re-planning. This is attractive in the sense that as traffic grows the available computing power available for air traffic management grows commensurately.

Distributed Centralisation: Coordination Using an Array of Sequencers EUROCONTROL

Project INO - EEC Note No. 21/05 13

8. HUMAN INTERVENTION IN AN AUTOMATED SYSTEM

How can human beings intervene in an automated system of this kind?

One way of unhooking a selected aircraft from the automated system would be to inform the sequencers that the selected aircraft is no longer to be instructed to re-plan its trajectory. The effect of this would be that possible conflicts involving the selected aircraft would be resolved by automated re-planning of the trajectories of the other aircraft involved. Effectively automatically controlled aircraft would move out of the way of selected aircraft.

The trajectory of the selected aircraft could then be modified by the aircrew either independently or in accordance with instructions from a controller.

EUROCONTROL Distributed Centralisation: Coordination Using an Array of Sequencers

14 Project INO - EEC Note No. 21/05

9. CONCEPT TESTING THROUGH SIMULATION

ICAO (1998) specifies an upper limit on the risk of accidents due to collisions in en-route and oceanic airspace. For the period 2000-2010, this level is 1.5 x 10 P

-8P accidents per flight hour.

Collisions are rare events and collision risk is difficult to measure through simulation. Some researchers [ HTULezaud et al. UTH] have developed techniques for accelerating Monte Carlo simulations in order to allow measurement of the collision risk associated with a model in a reasonable time-frame.

A scientific theory cannot be proven true but an experiment can demonstrate that it is false. Knowledge of the circumstances in which the theory is false may contribute to the development of a theory which is more difficult to falsify. Similarly simulations cannot prove that a concept is safe. They may, however, highlight some of the ways in which a concept is unsafe and thereby contribute to the development of a safer concept. During the early stages of development, rudimentary simulations may be sufficient to illustrate the shortcomings of a concept. Only when a concept has been refined to the point that a given simulation technique no longer illustrates the inadequacies of the concept in a reasonable time-frame, does it become necessary to make use of more advanced techniques.

Distributed Centralisation: Coordination Using an Array of Sequencers EUROCONTROL

Project INO - EEC Note No. 21/05 15

10. NEXT STEPS

Further work could include the following steps:

• Consideration of validation methodology

• Further literature review, particularly autonomous aircraft work.

• Development of a fast-time simulation environment to evaluate, demonstrate and further develop a range of autonomous aircraft and automation concepts, including that described in this note.

• Safety assessment to identify areas for concept refinement.