The New Model for Air Traffic Control

Reference Paper from 1967



Held on 13-17 March 1967


by W.F. Ashton

Introduction The introduction of automation into Air Traffic Control is following the pattern usually seen in most systems. Initially, automation is limited to performing automatically, tasks which were previously carried out manually but without significantly changing the system. The gain from automation in this phase of its introduction is saving in manpower and, hopefully, elimination of human error. The second stage, more interesting but at the same time more difficult to achieve, is the use of automatic methods to make better use of resources or to provide a capability which is not possible by the mere development of extra manpower.

Immediate Plans for Automation in U.K. One area which will see the early introduction of some form of automation is Oceanic Control. Indeed a computer for this project has already had a period of experimental operation alongside the normal operational system. The other main project is Mediator with the Flight Plan Processing System (F.P.P.S.) initially limited to carrying out more efficiently and effectively operations now performed by controllers and their assistants, but capable of subsequent extension. This system is described in two other papers at the Conference, and it will suffice here to describe the initial F.P.P.S. task as the "strategic" one of planning aircraft movements and distributing the information prior to the aircraft coming under direct "tactical" control from a radar display. This automatic process of data distribution is an important contribution to overall efficiency of the A.T.C. system.

In a later phase the F.P.P.S. will be extended and interconnected with a Radar Data Processing System (R.D.P.S.) which holds in store and continually updates the positions of all aircraft in the system. As its name implies this information is derived from radar sources. The tracking process is carried out automatically for all aircraft which respond to secondary radar interrogation and by semi-automatic (or manual rate-aided) methods for the remainder. This stage of the introduction of automatic methods is of interest in that it now produces a significant impact on the tasks carried out by the operator. The overall task is divided, the book-keeping function of keeping track of the movement of an aircraft being removed from the actual radar controller and passed to a specialist sub-system. The control capability of the system depends on information derived from an automatic process, emphasizing the need for system reliability in this data collection and presentation.

Where to next? The first obvious use to be made of the data acquired is short term conflict detection by automatic means to assist the radar controller by concentrating his attention on particular problems and relieving him of the need to scan the situation to assess when conflicts are likely. This is easily said but needs a certain amount of investigation and experiment to devise a satisfactory system which does not miss possible conflicts but at the same time does not produce "false alarms" due to inaccuracy of data. An extension of this will be computer solution of any conflict discovered. This is clearly an area where the task needs to be approached carefully to avoid "chain reactions" of conflicts being generated in real situations.

There is perhaps a tendency to think of A.T.C. problems in terms of airways traffic. This is far from the whole problem. There are already significant numbers of aircraft wanting to cross the airways and this is likely to increase with the growth of air traffic. In fact to some extent the provision of adequate air traffic control facilities to allow relatively free but safe movement of aircraft will encourage the growth of non-scheduled traffic. Inadequate provision or increased restrictions will act as a deterrent. The problem of air traffic control is three dimensional not two. Although human controllers can think in three dimensions it is not easy and certainly much less rapid than in two. It is for this reason that procedures to date have reduced the problem to two dimensions - one vertical and one horizontal in the case of airways traffic and the two horizontal dimensions for middle airspace or airways crossing. These procedures reduce the problems to a manageable size but limit the effective use of airspace. It is the challenge to automation to provide this three dimensional thinking to increase airspace utilization.

The concept of three dimensional operation does not mean a glorious free for all. Nor, on the other hand, should it mean that every aircraft movement is controlled precisely in time and space. Flight route planning is essential but must be flexible. The aim must surely be the gradual disappearance of fixed artificial boundaries dividing up the airspace and the emergence of a uniform service over the whole F.I.R., in effect, an Area Control System or whatever other name might be appropriate. Some routes which are used regularly and frequently will acquire a high level of control and seeming permanence but it must be possible to establish a temporary route with ease, interlaced with any other routes. Of course it will be necessary to allot priorities to aircraft on a equitable basis to allow resolution of conflicting demands. In such a system, the aircraft operator decides his required route and time to travel between two points, and indicates his intention to a general co-ordinator (the A.T.C. computer), which decided whether or not the aircraft has a reasonable chance of following its stated intention without much delay, offering alternative advice if necessary. In doing so the computer will take into account all other flight plans known to it, including any probable plans originating from regular traffic even if precise timing is not yet available. During the flight the automatic co-ordinator will monitor the flight progress using its radar data and will control the execution of the plan in the interests of safety providing instructions when necessary.

In designing such a system to make maximum use of the airspace, especially one in which a large part of the process is automatic, it is necessary to determine the rules both for approving flight plans and for detecting potentially unsafe situations in adequate time. These rules will, in fact, set a limit to the density of traffic which can be handled safely. In "approving" a flight plan, the computer will need to make some allowance for the fact that the specified plan is unlikely to be carried out with absolute precision. It may even allow a number of "theoretical conflicts" to be present in flight plans accepted as a basis for medium term planning, relying on later radar data to provide information on which to modify the plans slightly in the short term. Clearly, if such a process is to be followed, the aircraft must carry out the plan with an acceptable accuracy in both time and space. Equally, there is no point in monitoring flight progress unless the monitoring system can detect potentially unsafe situations in time to allow corrective action to be taken whilst at the same time avoiding unnecessary alarms. To produce a satisfactory system will demand a detailed analysis and understanding of the complex individual control processes involved and their inter-relation. However it is suggested that the somewhat over-simplified considerations outlined below can indicate a possible approach to resolution of the problem.

From the A.T.C. point of view, the whole process of aircraft flight control can be visualised as two control loops. The first is the navigational loop, that is, the control process which tries to ensure that the aircraft follows a prescribed path in space and time, whilst the second one can be termed the safety loop which decides the paths to be followed. Both processes are involved in navigation as defined in the dictionary but here the terms navigation loop and safety loop are used to distinguish between the essentially separate processes. The navigation loop is contained within the A.T.C. safety loop and thus, when looked at in simple terms, for stability of the complete system the response time of the navigational loop should be significantly less than that of the A.T.C. loop, if the two loops are closed independently. Since the response time of the A.T.C. loop together with the minimum aircraft separation deemed acceptable determine the movement density achievable, it is desirable to keep the A.T.C. loop response time as low as possible.

Although only a superficial analysis has been made two points emerge which are perhaps worth making. Firstly, unless the absolute errors in any airborne position measuring device are considerably smaller than the relative position measurement by a common ground device, then for optimum use of the airspace, the navigation loop should be closed through this common position measuring device which would also provide separation information to the A.T.C. loop. To some extent this duplicates on the ground the airborne navigational capability and, in the interests of economy, it would appear sensible to close the navigational loop normally within the aircraft but to close it through the ground system when needed. For the en-route case this could be when potential conflicts were detected but in other areas, e.g. the dense terminal area it may well be continuous.

The second point is that in normal operation of an aircraft, the rates of change of some of the parameters in the control processes are not allowed to exceed certain limits. Often these limits will be reached during normal operation and the control loop made non-linear. The overall response time of the safety loop can probably be reduced by the knowledge that an A.T.C. instruction is, in fact, being obeyed i.e. that the parameter change demanded is being executed at a known and reasonably controlled rate. It may well be that this information is available in the internal aircraft control system long before it becomes apparent from actual positional measurements. For this reason, some form of automatic data link from air to ground would be very desirable. It could provide information on speed, heading, angle of bank, and rate of climb or descent. Since, by definition, it is most needed when aircraft are in close proximity it must operate on some form of individual address system for each aircraft to avoid information garbling problems.

There will need to be considerable investigation, experiments by simulation and trials before such a system could be shown to provide improved efficiency in airspace utilization without detriment to safety. It would be some time before confidence in such a system was established and it is perhaps as well that, in the case of the general airspace it is likely to be many years before it becomes essential. There is one volume of airspace in which the problem of providing adequate expedition and safety is already quite acute, namely the large Terminal Area, for example London. The precise form of the solution in this case is impossible to forecast but it must surely lie in flexibility of flight path within the area according to traffic demands and because it is essentially a three dimensional problem with relatively short times of flight involved automation of at least some parts of the process must inevitably be expected.

The Role of the Operator The increasing introduction of automation into A.T.C. will demand an even greater emphasis on system reliability. Where automatic processes are used to carry out tasks beyond the reasonable limits of a human operator organization then there can be no such thing as complete manual reversion. This, in turn demands consideration of the role of the operator in such a total system. Without going into great detail certain principles for system design seem clear. First, the technical design of the system should be such that, as far as can be ascertained, a single failure will not result in more than a tolerable loss of operational facilities. Secondly, consideration of the definition of the word "tolerable" used above gives a clue to the role of the operator in such a system, namely, that in the event of a partial failure the operator must step in to provide, as far as possible, just those particular facilities lost, and at the same time try to reduce the operational problem complexity to such an extent that the remaining automatic facilities can carry the load satisfactorily. There is likely to be a further way in which the operator participates in the system, namely, to provide decisions based on experience in situations where the problem is not easily quantified to allow logical automatic decisions. In some ways this is a non-scientific concept in that the man will apply rules to the solution of the problem which ought to be capable of being written down, and hence carried out automatically. However, to ensure that the pre-programmed rules of an automatic process always arrived at the correct decision would need very careful consideration of all the conceivable cases, including those, which, although theoretically possible may never occur in practice. This detailed work may well be so time-consuming as to prevent any real progress being made, unless some reliance is placed on the operator's intelligence to interpret some general rules in real time in the face of the particular difficulties encountered.

This whole problem of system reliability and operator participation is very complex and will probably have a much greater influence on the time scale of introduction of automatic facilities into A.T.C. than will the purely technical problems involved.

Contributed by permission of the Director of R.R.E.

Copyright Controller H.M.S.O.

The author is with the Royal Radar Establishment.

Reproduced under Exemption 1 of the need for a Crown Copyright Licence Crown Copyright