Comparing Different Functional Allocations in Automated Air Traffic - - PowerPoint PPT Presentation

▶
comparing different functional allocations in automated
SMART_READER_LITE
LIVE PREVIEW

Comparing Different Functional Allocations in Automated Air Traffic - - PowerPoint PPT Presentation

Oct 21, 2022 274 likes •653 views

Comparing Different Functional Allocations in Automated Air Traffic Control Design FMCAD 2015, September 27-30 Cristian Mattarei 1 , Alessandro Cimatti 1 , Marco Gario 1 , Stefano Tonetta 1 , and Kristin Y. Rozier 2 1 Fondazione Bruno Kessler,

slide-1
SLIDE 1

Comparing Different Functional Allocations in Automated Air Traffic Control Design

Cristian Mattarei1, Alessandro Cimatti1, Marco Gario1, Stefano Tonetta1, and Kristin Y. Rozier2

1Fondazione Bruno Kessler, Trento, Italy 2University of Cincinnati, Ohio, USA

FMCAD 2015, September 27-30

slide-2
SLIDE 2

Air Traffic Control: Chicago-region Air Sector

www.flightradar24.com

2

slide-3
SLIDE 3

Air Traffic Control: Chicago-region Air Sector

www.flightradar24.com

  • In this example:

262 Aircraft (not on a traffic peak)

  • Expected 4 times current traffic

in the next 20 years

  • Need for a new technology

able to manage the traffic increase

3

slide-4
SLIDE 4

Air Traffic Control: Current Approach

Radio Radio

AC1 AC2 Position ATC Radar AC1 & AC2 Positions AC1 Intention Time

4

slide-5
SLIDE 5

Air Traffic Control: Current Approach

Radio Radio

AC1 AC2 Position ATC Radar AC1 & AC2 Positions AC1 Intention Time

5

slide-6
SLIDE 6

Air Traffic Control: Current Approach

Radio Radio

AC1 AC2 Position ATC Radar AC1 & AC2 Positions AC1 Intention Time Loss of Separation

6

slide-7
SLIDE 7

Air Traffic Control: Current Approach

Radio Radio

AC1 AC2 Position ATC Radar AC1 & AC2 Positions AC1 Intention Time

7

slide-8
SLIDE 8

Air Traffic Control: Current Approach

Radio Radio

AC1 AC2 Position ATC Radar AC1 & AC2 Positions AC1 Intention Time

8

slide-9
SLIDE 9

Air Traffic Control: Current Approach

Radio Radio

AC1 AC2 Position ATC Radar AC1 & AC2 Positions Time

9

slide-10
SLIDE 10

Air Traffic Control: Current Approach

Radio Radio

AC1 AC2 Position Time System Function Technology Allocation Collision Avoidance TCAS On-Board Tactical Separation Controller/ATC On-Ground Strategic Separation Controller/ATC On-Ground

10

slide-11
SLIDE 11

Air Traffic Control: Functional Allocation Questions

Radio Radio

AC1 AC2 Position Time System Function Technology Allocation Collision Avoidance TCAS/ACAS-X On-Board Tactical Separation Controller/ATC On-Ground -> Distributed? On-Board? Strategic Separation Controller/ATC On-Ground -> Distributed? On-Board?11

slide-12
SLIDE 12

NASA project: NextGen of the Air Traffic Control

  • Need for a more robust, reliable, and safe

approach

  • A lot of different perspectives to be taken into

account e.g., political and environmental impact, cost analysis, usability, safety, …

  • Different function allocations, and

implementations need to be analyzed

12

slide-13
SLIDE 13

NASA NextGen of ATC: The Functional Allocation Project

  • Provide a partial order over the set of ways to

allocate system functions, from a safety point

  • f view
  • Rely on a Formal Validation, Verification, and

Safety Assessment approach, based on symbolic model checking

  • Define formal model and system requirements

from a preliminary design of the system architecture

13

slide-14
SLIDE 14

NASA NextGen of ATC: The Functional Allocation Project

In this work

  • Formal modeling of a set of different possible

functional allocations

  • Adaptation of Formal Validation, Verification,

and Safety Assessment to compare early system designs

  • Real-world case study from a tight collaboration

with "Flight Dynamics, Trajectory and Controls Branch” of NASA Ames https://es-static.fbk.eu/projects/nasa-aac/

14

slide-15
SLIDE 15

Formal Modeling for Comparative Analysis

slide-16
SLIDE 16

Functional Allocation: GSEP and SSEP

Collision Avoidance Tactical Separation Strategic Separation TCAS/ACAS-X ATC Collision Avoidance Tactical Separation Strategic Separation TCAS/ACAS-X ATC Backup CD&R OnBoard Primary Current Approach: Only Ground Separated Aircraft (GSEP) With additional distributed Conflict Detection and Resolution (CD&R) on-board: Ground and Self Separated Aircraft (SSEP)

16

slide-17
SLIDE 17

Formal Modeling: Conflict Areas

AC1$ AC2$

X$

Tj1$ Tj2$ Tj3$ Tj4$ Tj5$

X$

  • Abstract concrete trajectories with Conflict Areas (CA)
  • Two aircraft are in the same conflict area if their

trajectories intersect in a given interval of time

  • Example: if AC1 and AC2 follow TJ2 and Tj3 they are in

the same Conflict Area

17

slide-18
SLIDE 18

Formal Modeling: Time Windows

Current Near Mid Far Conflict Avoidance Tactical Strategic Current Near Mid Far Conflict Avoidance Tactical Strategic Time 0 Time 1

CA1 CA1 CA1 CA1 CA2 CA2 CA2 CA3 CA1 CA1 ….. …..

Current Near Mid Far Conflict Avoidance Tactical Strategic Time 2 AC1 AC2

  • Four different time windows:

– Conflict Avoidance: Current – Tactical Separation: Near and Mid – Strategic Separation: Far

  • The passage of a unit of time causes a window shifting
  • A Loss of Separation (LOS) occurs when two aircraft are in the same

CA in the current time window

18

slide-19
SLIDE 19

Formal Modeling: System Components

Communica)on*Network* ATC* GSEP*1*

ADS$B&

GSEP*2*

ADS$B&

GSEP*3*

ADS$B&

SSEP*1* *

ADS$B&

SSEP*2* *

ADS$B&

SSEP*3* *

ADS$B& CD&R& CD&R& CD&R&

  • GSEP: Ground Separated Aircraft
  • SSEP: Self Separated Aircraft with

CD&R (Conflict Detection and Resolution) on-board

  • ADS-B: Automatic Dependent Surveillance Broadcast

ADS-B In and Out ADS-B Out only

19

slide-20
SLIDE 20

Formal Modeling: Scenarios Instantiation

Scenario Code GSEPs SSEPs #Bool Vars G 3 122 M1 3 1 185 M2 2 2 193 M3 1 3 201 S 3 146 ALL 3 3 353

  • Non-Mixed (only G/SSEP) and Mixed (both G/SSEP)
  • perations considered
  • Multiple implementation options (Enabled or Disabled)

– GSEP-Far: GSEPs send Far intentions over ADS-B Out – SSEP-Far: SSEPs send Far intentions to ATC.

20

slide-21
SLIDE 21

Formal Validation and Verification

21

slide-22
SLIDE 22

Formal Validation

  • Pure Airspace as Uncontrolled System and

CD&R agents (ATC, and CD&R on-board) as Controllers

  • Separated Validation for Uncontrolled System and Controllers
  • All 37 properties CTL and LTL properties validated using nuXmv

model checker

Uncontrolled System Controller Actuates Senses Controlled System

22

slide-23
SLIDE 23

Formal Verification

  • 93 LTL properties verified, using nuXmv, on all 20 possible

configurations (of the controlled system) by varying:

– Number of involved GSEPs and SSEPs aircraft – Information sharing implementation

  • Outcome: table representing pass/fail results

Uncontrolled System Controller Controlled System Actuates Senses

23

slide-24
SLIDE 24

Formal Safety Analysis

slide-25
SLIDE 25

Yes No + Counterexample

It is not possible to reach a Loss of Separation.

M ϕ M | = ϕ

Formal Validation and Verification

25

slide-26
SLIDE 26

Fault Tree

Formal Safety Assessment

M[F]

δ(F) : M[F] 6| = ϕ

All possible assignments to F such that M does not satisfy ϕ It is not possible to reach a Loss of Separation.

ϕ

26

slide-27
SLIDE 27

Formal Safety Assessment: Fault Tree Analysis

Loss of Separation

G1.apply_near G2.apply_near G1.apply_far G1.comm_atc_ partial G3.apply_near

  • Fault Tree Analysis as Minimal Cutsets Computation[Bozzano et al.

CAV15] via xSAP

  • CS={f1,…,fn} is a cutset of M, 𝜒 if there exists a counterexample 𝜌 of

M ⊨ 𝜒 that triggers f1,…,fn

  • A Cutset CS is Minimal iff ∀ 𝐷𝑇* ⊂ 𝐷𝑇, 𝐷𝑇′ is not a cutset of M, 𝜒

Top Level Event (TLE)

¬𝜒

Basic Fault Minimal Cutset

27

slide-28
SLIDE 28

Formal Validation, Verification, and Safety Assessment Process

  • Formal Requirements and Model Validation

– Outcome: positive results for all checks

  • Formal Model Verification

– Outcome: table where the cell i,j expresses whether the configuration i satisfies or not the property j.

  • Formal Safety Assessment

– Outcome: a Fault Tree for each pair of configuration, property… How do we compare them?

28

slide-29
SLIDE 29

Formal Safety Assessment: Minimal Cutsets Comparison

  • Impact on the “Loss of Separation” when varying the

sharing of GSEPs Far intentions (GFar):

– Same number of single point of failure (5) – While double failure increases (¬GFar), triple failures decreases

MCS Cardinality 3GSEPs-1SSEP (M1) 2GSEPs-2SSEPs (M2) ... GFar ¬GFar GFar ¬GFar … 1 5 5 5 5 2 12 15 12 16 3 33 24 35 23 … … … …

29

slide-30
SLIDE 30

Formal Safety Assessment: Minimal Cutsets Comparison

  • Analyze set relations between Minimal Cutsets i.e., MCS are

set of set of faults

  • Compare the MCS with TLE as “LoS between SSEP and GSEP”

varying GSEP-Far (GF) information sharing:

– MCS¬GF = {<…>, {FATC}} FATC = G.F_comm_ATC_tot, S.F_comm_ATC_tot – MCSGF = {<…>, {FATC, ATC.F_mid_res}, {FATC , ATC.F_far_res}, {FATC , G.F_comm_adsb}, {FATC , S.cdr.F_future_resolve, S.cdr.F_resolve_detection}

30

slide-31
SLIDE 31

Formal Safety Assessment: Reliability Function Evaluation

  • Set relation over Minimal Cutsets might be

inconclusive i.e., two sets can be incomparable

  • From Minimal Cutsets to Reliability Function

(P(TLE) : ℝ𝑜 ↦ ℝ) [Bozzano et al. ICECCS15], assuming no faults dependency

  • Analyze under which condition one Reliability

Function dominates the others

31

slide-32
SLIDE 32

Formal Safety Assessment: Reliability Function Evaluation

  • Loss of Separation between SSEPs and GSEPs as TLE, varying

P(failure ATC) and P(failure ADS-B). Other probability of failures are fixed

  • Still conceptual design, thus numerical values are not yet defined

10

−4

10

−3

10

−2

10

−1

10

−3.69886

10

−3.69886

10

−3.69886

10

−3.69886

10

−3.69885

10

−3.69885

F(ATC) PTLE LOS S−S (F(ADS−B)=10−1.5) LOS S−S (F(ADS−B)=10−1.8) LOS S−S (F(ADS−B)=10−8) LOS G−G

32

slide-33
SLIDE 33

Conclusion and Future Works

slide-34
SLIDE 34

Conclusion

  • Modeling of a real-world case study, from a

conceptual architecture description

  • Application and tailoring of a comprehensive

Formal Validation, Verification, and Safety Assessment process to evaluate different functional allocations

  • Collaboration with "Flight Dynamics,

Trajectory and Controls Branch” of NASA Ames to support decision making

34

slide-35
SLIDE 35

Future Works

  • Extend the modeling to cope with the whole

set of Functional Allocations and Scenarios i.e., > 1600

  • Integration with Compositional Modeling and

Verification

  • Evaluation of overlapped supervision i.e.,

with more than one ATC

  • Analysis of the impact of Unmanned

Autonomous Systems

35

slide-36
SLIDE 36

Cristian Mattarei - mattarei@fbk.eu

Comparing Different Functional Allocations in Automated Air Traffic Control Design

  • Modeling with Conflict Areas and Time Windows
  • Formal Validation and Verification, controlled and

uncontrolled system

  • Safety analysis via minimal cutsets and reliability function

computation

  • Website: https://es-static.fbk.eu/projects/nasa-aac/

Thank you!