The graph above shows the loci of the separations of aircraft pairs from a scenario in the simulator lasting about 20 minutes. For each pair of aircraft (and N aircraft will have N*(N-1)/2 possible pairings) a line has been plotted showing the vertical separation (the y axis) against the horizontal separation (the x axis). No loci pass through the small area of the graph near the origin representing plus or minus 1000 feet and 5 nautical miles. The flights have all been successfully separated. In the New Model Concept this graph is continuously re-computed.
If you are looking for perfect safety, you will do well to sit on a fence and watch the birds.
Wilbur Wright via Roger Bacon, Flight International, 21 May 1988
Almost all authorities agree that automation is the way forward. Therefore the question should really address what is missing from today’s systems that will make the systems of tomorrow acceptably safe. As no magic ingredient has been identified we should suppose that a safe implementation must be possible today. The New Model Concept addresses safety in three ways. It defines an architecture that can be implemented on multiple independent redundant computers with a series of fallback options, it defines an approach whereby the controller is either fully in the loop or is in control of everything that happens, and it defines a method of solving the computational problem so that the validity of the solution can be very easily checked. An independent air transport safety consultant has examined the concept and found no reason to condemn the approach.
The controller is fully entitled to wholly or selectively ignore or modify the advice offered by the system. The controller does not even have to acknowledge the advisories that have been accepted. The New Model Concept is designed to support this situation. The New Model System will continue to monitor events and will refresh its advice at intervals. If some instructions have not been implemented and yet they remain appropriate they will be redisplayed. If an instruction seems (via the surveillance system) to have been implemented but has not been acknowledged the system will make (and indicate to the controller) a reasonable assumption about the parameters passed to the pilot. The controller always remains responsible for and in control of the sector.
The aim of the New Model Concept is to provide a single tool that can be brought into use at a moment’s notice. The advisory instructions are always on display so the controller can begin using and acknowledging them at any time. If any assumptions have been made by the system, possibly with regard to cleared levels, then the controller can confirm or modify the system’s data. Even if the controller does not do this the process of acknowledging the advisories will slowly clear any assumptions from the system. If the air situation was stable and ‘safe’ at the time the controller began acknowledging instructions then everything will proceed smoothly. If the air situation contains any impending losses of separation when the controller asks for help then the system will offer the best advice it can but there is no guarantee that an incident can be avoided.
Not really. No more than the pilot is reduced to an automaton by the introduction of the Autopilot, Fly-By-Wire and the Flight Management System (FMS). The nature of the job will change, the control task will be carried out with much more consistency and significantly more controllers who begin training will achieve full validation. Controllers will be able to spend more time thinking strategically and the likely career path will be from tactical control through sector planning to airspace planning in a centre or at CFMU. Controllers have actually asked for a tool that makes tactical control easier.
There is no reason to suppose that a computer cannot calculate conflict free paths. A computer can already play chess as well as the best human beings and chess is adversarial whereas ATC is co-operative. Everybody involved wants to achieve a satisfactory result. Also, it is easily possible to determine a reasonable flightpath for each aircraft and only small deviations from the set of such flightpaths should be necessary to resolve conflicts. It is true that flightpaths cannot yet be optimised on a world wide scale but today we are working within a sectorised structure. As the power of computers increases still further and our skill in devising algorithms is honed by experience we can expect the minor limitations imposed by sector boundaries to be removed. The OACC FDPS I System has been calculating conflict free paths for all types of flight within its own procedural airspace since 1987 and now the New Model Demonstrator shows how conflict-free trajectories can also be calculated for a Terminal Area. Unlike aircraft scheduling, the discovery of at least satisfactory conflict-free trajectories is probably not an “NP” hard problem according to the definition established by mathematician Stephen Cook in 1971. Also, following the work of Donald Becker at NASA with Beowulf Clusters running under Linux it is now possible to create inexpensive and scalable high performance processing systems. These systems are already being sold to the aerospace industry.Garry Kasparov versus Deep Junior Chess Match - January 2003
Now, after more than twenty years of trial and error, scientists are discovering how to crack such tough computational nuts. They are getting to the root of what constitutes a “hard problem” and are taking lessons from nature, mimicking, for example, how the fittest set of genes is selected in living organisms. And they are relying on computers to find the Achilles heel of these mathematical monsters.
Hard Maths? No Problem, New Scientist, 28th October 1995
If sufficient resources have been held in reserve within the sector under consideration then there must always be a solution to the problem of creating a set of onward conflict free trajectories. Any reasonable implementation of the search algorithm should be able to find at least the first solution within a very short period of time. In the unlikely event that no solution is found then the New Model Concept proposes a cascaded structure of searches using alternative parameters that must at least solve a part of the problem. As an example, the first alternative might exclude any aircraft that has made an unexpected manoeuvre and refer this flight to the controller for direct intervention. If all flights are flown within the agreed performance and manoeuvre margins then it is just not possible for a correctly constructed algorithm to fail.
Some controllers have been invited to see the New Model Demonstrator and in general the reaction has been favourable. The New Model Concept actually offers the controller of today the best chance that his (or her) job will remain interesting and fulfilling for the foreseeable future. Very few other tools can offer a graduated response to varying traffic levels. With the New Model the controller can choose exactly how much assistance he (or she) needs at any moment. The controller should be confident that, whatever happens, the system tools will provide enough support to ensure at least the complete safety of the aircraft under his (or her) control.
Some pilots have also been invited to see the New Model Demonstrator and here too the reaction has been favourable. Pilots are under pressure to operate their aircraft according to strict procedures and demanding schedules. With the New Model Concept they can be sure that airspace resources are being allocated equitably, that considerable effort is being applied to optimising the use of those resources and that specific facilities are available to support them in case of almost any emergency. The pilot can be confident that the future trajectory of every aircraft is being continually predicted and adjusted to resolve every conflict in a timely manner.
Supposed passenger reaction has been used many times in place of a proper safety analysis to delay the introduction of new technologies. Many people have a fear of flying but large numbers of people do still fly because it is cheap and convenient. Passengers trust that the appropriate regulatory authorities have taken all possible measures to ensure their safety. Therefore, we can be certain that passengers will welcome a technology that has a safety benefit. Automatic landings, fly-by-wire flight controls, satellite navigation and extended range operation (EROPS) on two engines have not stopped people from flying.
The New Model Concept is the first proposal for automation in ATC that addresses the issue of system failure as an intrinsic part of the concept. Every previous proposal has simply supposed that a hardware system with extremely high availability can be built. In the New Model Concept the computer is expected to continuously compute solutions using the data that it has available. There is therefore almost no dependency on any database or on any controller input for safety. If the controller can see the traffic on a surveillance display then so can the system. If one computer fails then another can be used and it does not matter if the details of the second computer’s solution differ from those of the first. Any number of such backup computers can be provided and because they can all operate independently they can be very cheap. In the limit, one could think of a New Model implementation in this mode as a comprehensive ground based Traffic Alert and Collision Avoidance System (TCAS).
The New Model Concept differs from other concepts in proposing a specific approach to the situation in which the system is recovering from one or more serious failures. These failures may be within the New Model components themselves or within one or more connected systems. The number of potential scenarios is very large but the New Model’s approach of continuously computing solutions using all available data means that some advisory data is always available to the controller. Even if surveillance input is lost completely the system can advance the tracks by dead reckoning and when surveillance data is restored the corrected positions may lead to a complete revision of the advisory data. The controller may have to re input any constraints that have been lost during the failure and such entries will typically lead to changes in the system’s advisory output.
She had heard the plane before she saw its lights. She had wondered what a plane was doing coming in at three in the morning. How could pilots fly at night? How could they tell where they were going in that limitless darkness? What if they took a wrong turn and flew out over the Kalahari, where there were no lights to guide them and where it would be like flying within a dark cave?
Alexander McCall Smith, Tears of the Giraffe
The New Model Concept can handle sector definitions containing many types of airspace restriction. If data on the location of weather cells is available then flights can be routed automatically around them. This is possible even if the cells are moving. If detailed information is not available then the aircraft will probably call up to request a deviation for weather. A default deviation can be allowed for in the route or the controller can enter and update the heading or track mileage values for the probable lateral excursion. Estimates for down route handover and reporting points will be automatically updated with inter-operating systems.
An implementation of the New Model Concept can be programmed to help the pilot and controller handle almost any conceivable emergency. The pilot has only to notify the controller of the problem (and in the future this may be done by datalink) and any number of potential trajectories can be immediately computed. Distances to diversionary airfields can be calculated and if required a complete set of instructions for a Ground Controlled Approach (GCA) can be brought up. Because all inter-sector coordination is electronic all other traffic could be transferred to another frequency and handled by another controller even though the airspace is still shared with the incident aircraft. The New Model Concept allows the system to create advisories for all aircraft taking the new circumstances into account. This capability may be of particular significance in areas where SEIFR (Single Engine Instrument Flight Rules) operation is permitted.
The airspace itself is far from full. If aircraft could be packed into a typical sector in the United Kingdom at the minimum separation then around twenty times more aircraft than the controller could handle could be packed in. The immediate limit in the New Model Concept is the RT channel occupancy. The demonstrator has been used to show that traffic levels of up to three times the current maxima can be handled and that it is possible for an experienced user to maintain a mental picture of the airspace under these conditions. If VHF RT is supplemented or replaced by Air Ground Data Link (AGDL) then even higher traffic levels are possible. Computer power is not a constraint.
Overall traffic levels may or may not increase to such levels. Airport capacity and environmental considerations will probably be influential. But in any system such as air transport the demand cannot be completely smoothed to match the capacity. There will be ‘hot spots’ at different times and in different places. The ability to handle very high peak loads can have a significant beneficial effect on the efficiency of the overall system. Under the New Model Concept the Central Flow Management Unit (CFMU) might only have to adjust a flight’s take-off time to meet runway slot and ground handling facility constraints.
A design aim in the concept was that any individual aircraft or operator fitting any piece of equipment should be able to benefit immediately and directly. This aim was intended to help the air transport industry break out of the ‘chicken and egg’ circle that has slowed down the adoption of advanced avionics. No longer would it be necessary to designate pieces of airspace for use only by aircraft carrying particular pieces of equipment. Reduced Vertical Separation Monitoring (RVSM) aircraft could be separated from non-RVSM aircraft according to the capabilities of each but the RVSM aircraft should have the more optimum level.
In the demonstrator the separations applied are 5 nautical miles horizontally and 1000 feet vertically. But in the New Model Concept any separation standards can be specified. Using some long range radars separations of 3 nautical miles at short range and 5 nautical miles at long range are applied. This can easily be programmed in. In the future the New Model Concept is designed to support fully parameterised separations so that the horizontal separation could be a complex function of the aircraft’s range from the radar head. Aircraft reporting their position by ADS could safely be given reduced separation. And if barometric height determination remains in force the minimum vertical separation could be determined as a variable function of height. It is believed that the New Model may be the first concept to propose that all of the heuristic rules used by controllers to ensure separation should be documented and programmed in. The ultimate aim is a resolution algorithm that is designed to maintain at a sufficiently low level the probability of any collision. It is a truism that large imposed ATC separations are safer but less economic.
A new scientific truth does not triumph by convincing its opponents and making them see the light, but rather because its opponents generally die and a new generation grows up that is familiar with it.
Max Planck via Lewis Wolpert, The Unnatural Nature of Science
Anyone observing the demonstrator might conclude that the New Model Concept is nothing more than a short term collision avoidance system. In fact, the concept envisages that all aircraft trajectories are computed to their conclusion with the aircraft parked on the airport stand. All constraints should be taken into account whether they are interactions with other aircraft or congested runways. The arrival sequence at a given airport can be computed in any conventional manner but any expected delay should then be fed back through the network of sector computers and represented as an additional constraint on the flight’s trajectory. Some sectors may apply a speed limitation (metering) while others (nearer the destination airport) may construct a trajectory through a holding stack.
In the simplest terms RT phraseology is used in the Human Computer Interface because it is well understood and requires no translation before transmission to the aircraft. But it is also used because RT phraseology defines more than just a trajectory to fly. Implicit in the phraseology are the various tolerances that are allowed to the aircraft. A simple climb instruction, for example, implies that the controller has taken a range of rates of climb into consideration. The pilot may select any reasonable rate according to his company’s Standard Operating Procedures (SOPs) without further reference to the controller. In addition, RT phraseology is the only means of specifying precautionary instructions. A typical precautionary instruction is a climb to an intermediate level. If a further climb is issued before the aircraft reaches the intermediate level then the climb can continue seamlessly and two instructions will have been issued where one would have been sufficient to describe the trajectory. The need for precautionary instructions can only be determined by reference to the sector definition and the complete air situation. RT phraseology is also the key to proving that each set of machine generated advisories is safe and operationally valid. In the UK a good guide to RT practice is CAP 413, the Radiotelephony Manual.CAA Publications CAP 413 Radiotelephony Manual
Given the power and speed of modern data communications it doesn’t really matter where the processing power is located but there are many compelling arguments for putting air traffic control computers on the ground. Ultimately, ATC is about resources and there has to be a central authority able to allocate those resources in cases of contention. A distributed ground based system could manage and optimise all flights from brakes-off to brakes-on. Short-term airborne traffic avoidance cannot predict the number of route deviations required nor consequently the amount of fuel needed for the journey. Airborne systems are extremely expensive to certify and have to be fitted to all aircraft that share a volume of airspace. Airborne systems work in a harsh environment and can have only limited system redundancy. Airborne systems are difficult to modify and it is almost impossible to make any simultaneous systematic changes to the world’s aircraft fleet. If the proposed microjets (VLJs or Very Light Jets) such as the Eclipse 500 appear in large numbers it will become almost essential to have the ATM system on the ground. VLJs are designed to be cheap and to be operated by single pilots which implies that they will expect to have ATC services provided externally. If unmanned aerial vehicles (UAVs) are ever to be integrated with conventional manned aircraft then ATM services will also have to be provided from the ground.Eclipse Aviation New Mexico
The Departure Cell
Aircraft departing from several major airports were at one time not individually handed over from the Tower Controller to the first TMA controller. Rather, an operator sitting in a darkened room would listen to the departure frequency and mark up, on a glass screen, the status of each flight as it was cleared towards the take-off point. The screen was monitored from below by a CCTV camera and the picture was relayed to the TMA controller. Visitors to the centre, on seeing a ghostly hand writing in Chinagraph pencil, would be told that the operators had learned to write from right to left. Some would never know that the operators wrote perfectly normally and that it was the electronics that transposed the picture into a mirror image.