Air traffic management (ATM) relies on several layers of technology supporting three essential functions: communication, navigation, and surveillance (CNS). Advances of the CNS technology base can directly lead to improved air traffic management operations. And indeed, the air traffic management system is left with no choice but to leverage the concurrent advent of digital communication technology, satellite-based navigation, and overall improvements of available instrumentation to adjust its ability to handle a fast-growing traffic demand [1], [2]. The resulting concepts of operations are described by the Joint Planning and Development Office (JPDO) and by the SESAR Consortium. The JPDO proposes the Next Generation (NextGen) [2] air transportation systems for U.S. operations, and the SESAR Consortium proposes the Single European Sky ATM Research (SESAR) [3], [4] project for European operations.

For example, one of the cornerstones of expanded operations is the Automatic Dependent Surveillance—Broadcast (ADS-B) system, a navigation and surveillance concept based on the GPS satellite positioning system, which offers the potential for giving pilots more flight autonomy during the en route flight phase and enabling higher and more flexible traffic densities in terminal areas. One of the main benefits of ADS-B is to improve navigation precision by providing an accurate position information. Such technology also enables so-called trajectory-based operations and strategic traffic separation management using the concept of four-dimensional trajectories, whereby an aircraft is able to forecast and broadcast its intended trajectory well before its execution.

However, the obligation for the ATM system to maintain very high reliability and safety levels implies that such new system technologies can be implemented only if they lead to a system with equal or better safety characteristics than currently available. While system safety includes the ability for the system to operate well under nominal conditions, it is also concerned with off-nominal system behaviors, whereby operations are expected to still remain accident-free for all known failure modes of the system. Failures may affect several parts of the ATM infrastructure.

*ATM computational infrastructure:* Computers and network systems form the backbone of the air transportation system information infrastructure. Computers are not exempt from such failures, whether the failures involve hardware (motherboard and wiring) or software (incomplete functional requirements or erroneous software implementation). Even though ATM providers ensure the infrastructure is redundant and robust to its own failures, it still happens that a third part application is plugged-in and crashes the entire system.

*Communications:* A communication mishap can lead to severe consequences. Most recently, on September 25th, 2007, a communication failure at Memphis' air route traffic control center shut down many phone lines, radio communications, and radar coverage, completely incapacitating operations for a period of two hours. At the time of failure, there were about 200 aircraft in the center's airspace.

*Surveillance:* Computer or radar failures can cause surveillance failures. For instance, in December 2000, Miami International airport was subject to repeated radar failures when erroneous flight information data appeared on the controllers' screen. During one such mishap, about 125 flights were rerouted, affecting traffic all over the United States.

*Operations:* For current operation degraded modes, there exist backup procedures described by ICAO in [5]. Also, issues in closely spaced parallel runway operations are the object of several papers [6], [7]. An analysis of current en route air traffic control usage during special situations can be found in [8]. Operation failures can lead to accidents, such as the 2002 crash over Germany between a Russian passenger jet and a cargo plane, when contradictory orders provided by the Traffic Collision Avoidance System and the controller led to a collision.

*Vehicles:* An intruder can enter the airspace and consequently jeopardize the safety of surrounding traffic. A private plane can unintentionally get too close to a restricted airspace, such as the vicinity of major airports. If a Visual Flight Rules aircraft gets in the landing path of Instrument Flight Rules flights, this generates an abnormal situation to be solved by the controller.

*Airport closure:* An airport or part of it can be closed, e.g., for weather conditions. The traffic needs to be reorganized and rerouted towards other airports. For instance, Bangor International Airport is often a diversion destination when freezing rain, snow, and fog close Boston, New York, or other major Northeast metropolitan centers.

In the past, such failure modes and how to recover from them have been identified on an ad hoc basis, whereby accidents have triggered extensive studies and redesigns of the air traffic management operations. Extensive experience by air traffic controllers about incidents has progressively led them to always address “what if” questions during routine operations, leading them to safe operations. This system comes complete with degraded operation and recovery procedures, such as those described in [5]. One example of a fault-tolerant or fail-safe procedure concerns departure operations: a safe, collision-free path is completely specified to the aircraft prior to takeoff, in such a way that the aircraft may follow this path safely even in the case of complete communication failure during takeoff [5].

ADS-B, digital communication technology, and advanced automation will enhance higher density airborne operations in the proximity of busy airports, en route or terminal airspace operations with flexible routes, or cockpit-centric decentralized conflict management. Those future evolutions of the system will need to be proven fully safe prior to their introduction within the operational landscape. All failure modes will need to be identified and shown to be handled safely prior to the new procedures implementation.

Within this paper, the process by which the current or future system keeps operating safely despite degradation of the sustaining CNS infrastructure will be called “graceful degradation.” The term finds its origins in complex computer systems [9]. However, it can be immediately extended to overall systems such as the National Airspace System (NAS), which include both physical assets (airplanes) and complex information infrastructures. The examination of concepts of operation such as NextGen in the United States [2] and SESAR [3], [4] in Europe reveals that system safety and graceful degradation are considered open research issues for most future operations. In many regards, the works that most closely relate to this paper are those devoted to traffic and airspace complexity [10], [11], [12], [13], [14], [15]. Indeed, these also aim at evaluating, in a broad sense, the resilience of ongoing controlled traffic against off-nominal events.

In this paper, we are interested in analyzing the conditions for the graceful degradation of high-density traffic when the positioning system substantially degrades. The motivation behind our work is the widespread and growing implementation of GPS-based ADS-B as a replacement for other, conventional navigation and surveillance mechanisms such as secondary radar and beacon-based positioning systems. Such development offers the potential for enabling higher traffic densities in the vicinity of large and busy airports, enabling “superdensity operations” [2] (Fig. 1) and parallel approaches. For that purpose, the remainder of this paper is organized as follows. First, we state the graceful degradation problem in the context of high traffic densities and failing navigation systems. Then, we use an algorithm for conflict avoidance under uncertainties to compare the ability of miles-in-trail and free-flight configurations to manage a loss of accuracy in the positioning system. Mathematical details of the algorithm are presented in the Appendix.

SECTION II

## GRACEFUL DEGRADATION OF SURVEILLANCE AND NAVIGATION SYSTEMS

### A. Definitions

This paper focuses on the impact of surveillance and navigation system degradation on aircraft separation requirements. Indeed, the primary mission of the air traffic control system is to ensure safe aircraft separation under all regular and degraded circumstances. Conventional surveillance systems include radar-based technology, such as primary and secondary radars, and ground-based beacons. New, higher resolution surveillance systems are enabled by satellite-based positioning systems. Such technologies may enable reduced horizontal separation minima and therefore higher airborne aircraft densities.

We formulate the following questions.

*Analysis: Graceful degradation sensitivity*. Consider a given air traffic situation (consisting of a number of aircraft with given positions, velocities and headings), what is the “sensitivity” of this situation relative to a sudden degradation of the surveillance system?

*Design: Graceful degradation-compatible guidance*. Consider a set of aircraft with given origins and destinations. Find a sequence of aircraft headings such that the graceful degradation sensitivity of the overall traffic of interest remains below a given threshold.

In this paper, we will be concerned with the analysis question, leaving the design question for further research. The principle that will drive our analysis can be sketched as follows: Considering a set of aircraft operating under a “high performance” surveillance system, we analyze whether safety can be maintained despite a failure of the surveillance system. Assuming that failures of the surveillance system consist of a partial loss of vehicle coverage, we will be interested in what maneuvers will allow aircraft to remain provably separated. Indeed, partial or complete loss of aircraft position coverage results in growing uncertainty about aircraft positions, in such a way that aircraft initially close to each other may not be distinguishable from each other shortly after the failure, unless they maneuver to augment their physical separation. Thus, underpinning our analysis of the ability for a particular airborne configuration to gracefully degrade, we find the necessity to design procedures enabling traffic to maintain provable separation under degraded conditions. In this paper, such procedure will consist of a novel aircraft conflict management algorithm.

Considering a planar traffic environment for simplicity, we introduce the following definitions.

*Nominal operations:* Nominal operations consist of all allowable aircraft operations when aircraft position accuracy is high. The nominal minimum aircraft separation distance (expressed in nautical miles) will be denoted 2*r*_{0}.

*Degraded operations:* Degraded operations consist of all allowable aircraft operations when aircraft position accuracy is low. The degraded minimum aircraft separation distance (expressed in nautical miles) will be denoted 2*r*_{f}, with *r*_{f} > *r*_{0}.

Radar precision is one of the main reasons for deciding on specific aircraft separation standards. The uncertainty in the position seen by the controllers leads to a separation requirement that can be interpreted as a circle of avoidance around each aircraft. The circle of avoidance corresponds to the area around the aircraft where no other aircraft is allowed. Its radius is generally 2.5 nmi for en route and 1.5 nmi for approach. The separation is guaranteed if the circles around each aircraft do not intersect, resulting in 5 or 3 nmi separation minima. This distance ensures safety if the position of the aircraft is relatively well known and regularly updated. Accurate positioning systems such as ADS-B will probably enable a reduction in allowable spacing distance [16]. If a failure happens, the system works in degraded mode, resulting in an increase in uncertainties on the aircraft position observed by the controller. As aircraft's positions are known less accurately, the resulting radius of avoidance must be increased. The growth of the avoidance circle is limited by backup positioning systems (primary surveillance radars, radio, etc.) that enable controllers to get reports on aircraft's position. For instance, in the case of a radar breakdown, separation distances must be increased to procedural separation standards [5]. The position of the aircraft will be reported by the pilot to the controller by radio with a low update rate. Between updates, the position of the aircraft is not known and the uncertainty on it increases with time.

### B. Algorithmic Aspects

From these considerations, we see it will not be difficult to create aircraft configurations that are conflict-free yet will rapidly generate conflicts in case of positioning system degradation. Thus, we want to measure the ability for such configurations to gracefully degrade using a conflict resolution strategy under degraded conditions. We developed a conflict detection and resolution algorithm that we will use as a probe to evaluate the configurations' sensitivity to degradation. This section presents an overview of the algorithm, and mathematical details are explained in the Appendix.

In the remainder of this paper, we will assume that a surveillance system failure occurs at time *t* = 0 and the time of failure is known in real time. The resolution maneuver is an indicator for the severity of the situation. Prior to the failure time, nominal aircraft position accuracy will translate into a circle of avoidance with radius *r*_{0}.

After the failure time (*t*≥ 0), we propose a time-varying model of position uncertainties, whereby the radius of avoidance grows from *r*_{0} to *r*_{f} > *r*_{0} over a given period of time. Fig. 2 presents the track of a growing circle of avoidance. For instance, *r*_{0} can be the radius of avoidance provided by an ADS-B positioning system, while *r*_{f} can be the one provided by a primary surveillance radar. In the event of an ADS-B failure, the transition from *r*_{0} and *r*_{f} must be eventless, in the sense that the transition should not jeopardize the safety of the overall traffic.

For each aircraft *i*, we will assume a constant growth rate , such that . Such a model approximately captures the growing but bounded uncertainty on aircraft position once the navigation system has failed. Such uncertainty might reflect the effect of uncertainties on the aircraft heading (denoted Δθ) and on the aircraft velocity (denoted Δ *V*_{i}). Fig. 3 shows the uncertainty on the trajectory. A simple way to connect these uncertainties to the growing avoidance radius is to write, for example, the following first-order conservative approximation for :
TeX Source
$$\mathdot{r}_{i}\approx\sqrt{V_{i}^{2}\sin^{2}\Delta\theta+\Delta V_{i}^{2}}.$$

Fig. 4 shows the difference between a classical conflict avoidance problem and the problem under consideration in this paper. In the classical avoidance problem, the radius of avoidance is constant. In our problem, the growing radius of avoidance makes the formulation and resolution more complicated since it is time dependent.

When several aircraft are present within a given airspace sector, the conflict resolution problem under degrading position uncertainty becomes much more complex. An approach using mathematical programming based on a formulation originally presented by Pallotino *et al.* [17] is introduced in the Appendix. The novelty of our algorithm is to deal with growing radii of avoidance. It not only is a conflict detection and resolution but also manages an increases in spacing distances. The problem is formulated as mixed integer linear programming (MILP) and is implemented using the AMPL/CPLEX linear programming tool set [18], [19].

SECTION III

## FREE FLIGHT VERSUS MILES-IN-TRAIL GRACEFUL DEGRADATION ANALYSIS

The parts of airspace where the highest aircraft densities occur are the terminal areas in the vicinity of airports. Therefore, these constitute an ideal setting for evaluating the ability for traffic to undergo graceful degradation. This choice is also motivated by current vistas on future operations in terminal areas, which have been named “superdensity operations” (NextGen) and “high-complexity terminal operations” (SESAR). Both consist of increasing the airspace capacity around busy airports. A solution proposed in SESAR [4] is the multiple merge points arrival operation shown in Fig. 5. One way to interpret this solution is to assimilate the new mode of operation to a “free-flight” scenario, whereby the route structure in the terminal area is relaxed and the only constraint on incoming aircraft is for them to meet a specific arrival time at the merge point. This scenario contrasts sharply with current airport arrival practices, where high-density arrival flows of aircraft are organized tens or even hundred of miles prior to landing by lining up aircraft along arrival routes and spacing them appropriately. Such operations are often denoted miles-in-trail (MIT) operations.

Therefore we believe it is interesting and worthwhile to compare the ability for both operations, denoted free-flight (FF) and MIT, to undergo graceful degradation of the navigation system. For that purpose, we consider a simplified scenario involving eight aircraft merging to a common point of coordinates (0,0). We assume that all aircraft are time separated: Each aircraft is given an arrival time so as to meet a precise and regular arrival rate at the merge point. Assuming all aircraft fly at the same speed of 200 kt, the aircraft must therefore be initially located on regularly spaced circles centered at the merge point, as shown in Fig. 6. The interaircraft spacings are designed to emulate future Instrument Meteorological Conditions arrival operations on closely spaced parallel runways, such as San Francisco Airport: As observed in [20], the average interarrival time for each runway is slightly less than 2 min. This translates into a 3 nmi average separation between aircraft when they fly at 200 kt and the two runways are in use. This separation also turns out to be a very conservative estimate of separation requirements for satellite-based navigation systems [16], leading us to an initial circle of avoidance of radius *r*_{0} = 1.5 nmi, as proposed by ICAO for ADS-B [21]. The final radius of avoidance was chosen to be *r*_{f} = 2.5 nmi to reflect the surveillance degradation that would occur, should a GPS-based surveillance fail and backup radar-based technology be used. The rate of growth reflects a heading uncertainty Δθ = 5°. Hence, nmi/min. The transition time between *r*_{0} and *r*_{f} is *T* = 3.44 min.

To evaluate the impact of changing arrival operations from miles-in-trail towards free flight, we consider an “arrival cone” whose vertex is at the merge point. When the cone's angular width is zero or takes small values, it corresponds to highly structured MIT operations. When the cone's angular width is large, it corresponds to less structured, FF-like operations.

To understand the impact of the cone angular width and the aircraft initial separations on traffic degradation, should a surveillance system failure occur, we varied it from 10° to 60°. The initial aircraft separation—that is, the distance between two consecutive circles—was chosen to be 3.5 nmi. We simulated 1650 cases with different arrival angles. The following procedure has been used to generate the cases: since we know the distance of each aircraft to the merging point (fixed separation distance), the aircraft initial heading was picked at random, using a uniform probability distribution in the allowed interval (± 5°,± 10°,…).

Fig. 6 presents two configurations: MIT and FF. The circles represent the avoidance circles (continuous/red = FF, dashed/black = MIT). They have initial radius 1.5 nmi and are centered on the aircraft. The blue line shows the aircraft's heading. Aircraft are represented by a small circle for the MIT configuration and asterisks for FF configuration. The allowed arrival cone for the FF configuration is slightly colored.

To analyze the impact of a surveillance system degradation, these traffic configurations have been probed by the conflict resolution algorithm under uncertainties developed in the Appendix. Let *S* be the set of all generated cases. The severity of the traffic management degradation on the traffic situation *s*∊ *S* was evaluated by measuring the average deviation *m*_{s} required for each aircraft, denoting θ_{is0} the initial heading of aircraft *i* and θ_{is} its heading after resolution in this situation
TeX Source
$$m_{s}={\sum_{i=1}^{n}\vert\theta_{is}-\theta_{is0}\vert\over n}$$ where *n* is the number of aircraft. All the cases were then sorted by absolute value of the maximum aircraft arrival angle and grouped in parameter increments of 2.5°. Let *S*_{k} denote the following subsets of *S*:
TeX Source
$$\eqalign{S_{5}=&\,\left\{s\in S\ {\hbox{such that}}\ \max_{i}\{\theta_{is0}\}\in[0,5),i=1,\ldots, n\right\} \cr S_{k}=&\,\left\{s\in S\ {\hbox{such that}}\ \max_{i}\{\theta_{is0}\}\in[k-2.5,k),\ldots,\right.\cr&\quad\left.i=1, \ldots , n\right\},\ k=7.5,10,12.5,\ldots,30.}$$

Fig. 7 presents the results of the analysis. The maximum deviation *m*_{s} experienced within each group was plotted as a function of the corresponding maximum aircraft arrival angle.

Although the figure suffers from sampling irregularities, the following general trend may be observed. As the arrival cone width increases from 10° to 60°, that is, as the absolute maximum arrival angle increases from 5° to 30°, the aircraft deviations required to ensure a conflict-free configuration increases 33%. For an arrival angle less than 5°, the maximum average deviation required is 10.6° per aircraft, while it is 14.2° for a maximum arrival angle less than 30°. FF or MIT do not appear to be significantly different from the stand point of surveillance degradation. However, these conclusions were reached using computer-based conflict management, which may differ from human-based conflict management.

Figs. 8 and 9 show the avoidance maneuvers for the worst cases of *S*_{5} and *S*_{30} with 3.5 nmi initial separation. Figs. 8(a) and 9(a) present the configuration at *t* = 0. Aircraft are at the position where the avoidance maneuver is calculated. The aircraft trajectories for *t* < 0 are represented, and the line pointing out of the aircraft represents the new aircraft's heading.

In this paper, we have outlined the principle of graceful degradation of air traffic operations against communication, navigation, or surveillance failures. Following a generic description of graceful degradation requirements and interpreting it in the context of safety, we have introduced a specific problem of graceful degradation that examines the impact of failures of the surveillance system on airborne traffic separation assurance. Considering current miles-in-trail and future free-flight approach scenarios, we have shown that free-flight-like airport approaches do not degrade significantly more than current miles-in-trail scenarios when facing failures of the surveillance system. In support of the work reported in this paper, we have developed a new conflict resolution tool that applies to the transient conditions encountered during failures of the surveillance system.

### Acknowledgment

The authors would like to thank J. Hansman, Massachusetts Institute of Technology, for useful discussions about superdensity operations and parallel approaches.

APPENDIX

## AN ALGORITHM FOR CONFLICT RESOLUTION UNDER GROWING POSITION UNCERTAINTIES

The following Appendix presents the algorithm used to solve the problem of conflict resolution when several aircraft are present. A typical MILP looks like
TeX Source
$$\eqalign{&\qquad\quad\min_{x,z}\quad f_{1}^{T}x+f_{2}^{T}z\cr&{\hbox{subject to}}\quad A_{1}x+A_{2}z\leq b}$$ where *f*_{1}∊^{m}, *f*_{2}∊^{n}, *x*∊^{m}, *z*∊{0,1}^{n}. *A*_{1}∊^{l × m}, *A*_{2}∊^{l × n}, and *b*∊^{l}. *n* is the number of real variables, *m* is the number of binary variables, and *l* is the number of constraints. In what follows, we will focus our attention on developing an MILP model for the conflict resolution problem of interest in this paper.

We consider a set of *n* aircraft in a planar space. Each aircraft *i*, *i* = 1,…,*n*, is defined by its position (*x*_{i},*y*_{i}), its heading θ_{i}, and its speed *V*_{i}.

The relative velocity *V*_{ij} and speed *V*_{ij} of aircraft *i* with respect to aircraft *j*, and the distance *D*_{ij} between aircraft, are given by
TeX Source
$$\eqalign{{\mmb V}_{ij}=&\,\left[\left(V_{x_{i}}-V_{x_{j}}\right),\left(V_{y_{i}}-V_{y_{j}}\right)\right]^{T}\cr=&\,[V_{i}\cos\theta_{i}-V_{j}\cos\theta_{j},V_{i}\sin\theta_{i}-V_{j}\sin\theta_{j}]^{T},\cr V_{ij}=&\,\sqrt{(V_{i}\cos\theta_{i}-V_{j}\cos\theta_{j})^{2}+(V_{i}\sin\theta_{i}-V_{j}\sin\theta_{j})^{2}},\cr D_{ij}=&\,\sqrt{(x_{i}-x_{j})^{2}+(y_{i}-y_{j})^{2}}.}$$ See also Fig. 10. We now define some useful parameters for the avoidance problem. Let θ_{ij} be the angle between the relative velocity *V*_{ij} and the *x*-axis and ω_{ij} be the angle between the connector of the aircraft and the *x*-axis. Also let γ_{ij} be the angle between the connector of the aircraft and a line starting from aircraft *i* and tangent to a circle of radius 2*r* and centered at aircraft *j*. We have

TeX Source
$$\eqalignno{\theta_{ij}=&\,\arctan{V_{y_{ij}}\over V_{x_{ij}}}\cr=&\,\arctan{V_{i}\sin
\theta_{i}-V_{j}\sin\theta_{j}\over V_{i}\cos\theta_{i}-V_{j}\cos\theta_{j}},\cr\omega_{ij}=&\,
\arctan{y_{j}-y_{i}\over x_{j}-x_{i}}\cr\gamma_{ij}=&\,\arcsin{2r\over D_{ij}}.&\hbox{(A-1)}}$$

### A. Problem Structure

We propose to solve the conflict resolution problem arising in this paper using a single heading change. The originality of our problem lies with the fact that the allowable miss distance between the two aircraft is time-dependent. Namely, at time *t* = 0, the minimum miss distance is 2*r*_{0}. For 0≤ *t*≤ *T*, the minimum miss distance grows from 2*r*_{0} to 2*r*_{f}, and *T* is given by
TeX Source
$$T={r_{f}-r_{0}\over\mathdot{r}}$$ where is the rate of growth of the circle of avoidance. For *t*≥ *T*, the miss distance is constant and equal to 2*r*_{f}. Fig. 11 illustrates the conflict avoidance constraint in a relative frame of reference. For no conflict to occur, the circle *C* of radius 2*r*_{0} and centered on aircraft *j* must not intersect the area enclosed by the contour *C*_{2}. This contour *C*_{2} can be seen to be the union of the half-line *P*1, the circular segment *P*3, and the line segment *P*2 and their symmetric images across the line passing though aircraft *i* and parallel to the velocity *V*_{ij}.

For the purpose of linearization, we approximate the contour *C*_{2} by means of line segments, not to be intersected by the circle *C*. The first, obvious linear approximation is to ask that the circle *C* not intersect either the gray stripe in Fig. 11 or the hatched cone whose vertex is aircraft *i*. Those conditions can be geometrically expressed as follows.

Asking that the circle *C* not intersect the gray stripe is a classical conflict avoidance problem that was developed and solved by Pallottino *et al.* in [17]. This problem deals with time *t*≥ *T*, when enough time has elapsed for the two radii of avoidance to be equal to *r*_{f}. The avoidance problem presented in Fig. 11 consists of finding a change of heading for aircraft *i* and *j* such that the line parallel to *V*_{ij} and tangent to the circle of radius 2(*r*_{f}−*r*_{0}) centered on the relative position of aircraft *i* to aircraft *j* at time *T* does not intersect the circle of radius 2*r*_{0} centered on aircraft *j*. This problem is equivalent to the line directed along *V*_{ij} and passing through aircraft *i* not intersecting a circle of radius 2*r*_{f} and centered on aircraft *j*. The avoidance constraints are then
TeX Source
$$\cases{\theta_{ij}-\omega_{ij}>\mathtilde{\gamma}_{ij}\cr{\hbox{or}}\cr\theta_{ij}-\omega_{ij}< -\mathtilde{\gamma}_{ij}}\eqno{\hbox{(A-2)}}$$ where
TeX Source
$$\mathtilde{\gamma}_{ij}=\arcsin{2r_{f}\over D_{ij}}.$$

Asking that the circle *C* not intersect the hatched cone can be detailed as follows, referring back to Fig. 11. The angular width 2α_{ij} of the cone depends on the relative velocity of the aircraft
TeX Source
$$\sin\alpha_{ij}={\mathdot{r}_{i}+\mathdot{r}_{j}\over V_{ij}}.$$ If , the sum of the radii of the avoidance circles increases faster than the aircraft move away from each other. Whatever the relative velocity, the circles are bound to intersect. Hence, the cone of avoidance is the entire plan: as arcsin α_{ij} is not defined, we set α_{ij} = π. If , the rate of increase of the circle of avoidance is the same as the relative speed. Hence, the avoidance cone is a half-plane perpendicular to the relative velocity and α_{ij} = π/2. The distance between the circles of avoidance will remain the same. To minimize the number of special cases, we order the aircraft so that −(π/2)≤ω_{ij}≤(π/2). Then, the condition of avoidance between two aircraft is given by a condition on angles
TeX Source
$$\eqalignno{&{\hbox{for}}\quad-\!\pi\geq\theta_{ij}-\alpha_{ij}\ {\hbox{and}}\ \theta_{ij}+\alpha_{ij}\leq\pi:\cr&\qquad\quad\cases{\theta_{ij}-\omega_{ij}-\alpha_{ij}>\mathhat{\gamma}_{ij}\cr{\hbox{or}}\cr\theta_{ij}-\omega_{ij}+\alpha_{ij}\ <-\mathhat{\gamma}_{ij}}&\hbox{(A-3)}\cr\cr&{\hbox{for}}\quad\theta_{ij}-\alpha_{ij}\ <-\pi:\cr&\qquad\quad\cases{\theta_{ij}-\omega_{ij}-\alpha_{ij}+2\pi>\mathhat{\gamma}_{ij}\cr{\hbox{and}}\cr\theta_{ij}-\omega_{ij}+\alpha_{ij}\ <-\mathhat{\gamma}_{ij}}&\hbox{(A-4)}}$$ and
TeX Source
$$\eqalignno{&{\hbox{for}}\quad\pi\ <\ \theta_{ij}+\alpha_{ij}:\cr&\qquad\quad\cases{\theta_{ij}-\omega_{ij}-\alpha_{ij}>\mathhat{\gamma}_{ij}\cr{\hbox{and}}\cr\theta_{ij}-\omega_{ij}+\alpha_{ij}-2\pi\ <-\mathhat{\gamma}_{ij}}&\hbox{(A-5)}}$$ where
TeX Source
$$\mathhat{\gamma}_{ij}=\arcsin{2r_{0}\over D_{ij}}.$$ Fig. 12 presents those avoidance constraints. To avoid any singularity due to angles around ±π, we ensure that −(π/2)≤ω_{ij}≤(π/2). To do so, aircraft are ordered in function of their position (*x*_{i},*y*_{i}) so that we get *x*_{1} ≤ *x*_{2} ≤⋅⋅⋅ ≤ *x*_{n} and if *x*_{i} = *x*_{i+1}, *y*_{i} < *y*_{i+1}.

The description of the avoidance constraints could be left at that point. However, the developed constraints are somewhat conservative. For example, as shown in Fig. 13, the circle *C* may intersect the cone and the gray stripe without intersecting *C*_{2}. To improve the solution, we may introduce a new constraint. Ideally, we would like to introduce the tangent ℓ_{1}) to *C*_{2} at point A and ask that it not intersect the circle *C*. In the relative frame of reference, ℓ_{1} has a slope θ_{ij}−(α_{ij}/2). Requiring ℓ_{1} to not intersect *C*}_{2} is equivalent to requiring ℓ_{3} to not intersect the circle centered on aircraft *j* and of radius (2*r*_{0}+ |*AD*|). To formulate the constraint, we need the distance | *AD* |. This distance is 2(*r*_{f}−*r*_{0})−*V*_{ij} *T* sin (α_{ij}/2). This distance is a non linear function of θ_{i} and θ_{j} as *V*_{ij} and α_{ij} are nonlinear with respect to θ_{i} and θ_{j}. This function depends on too many parameters to be linearized easily. Nevertheless, we can approximate this constraint by using ℓ_{2}: the line of slope θ_{ij}−(α_{ij}/2) passing through a point between *A* and *B*. For that, we need to find a majorant to | *DA* |. The following geometrical development gives this majorant: *D* is the middle of *EB* and *A*∊[*DB*]

TeX Source
$$\eqalign{ED=&\,{EB\over 2}\cr>&\,{EA\over 2}\cr=&\,r_{f}-r_{0}.}$$ Hence, we get
TeX Source
$$\eqalign{DA=&\,EA-ED\cr<&\,r_{f}-r_{0}.}$$

This leads to the constraint that the line of slope α_{ij}/2 not intersect the circle of radius 2*r*_{0}+((*r*_{f}−*r*_{0})/2) = *r*_{0}+*r*_{f}: it is captured by the constraints
TeX Source
$$\eqalignno{&{\hbox{for}}\quad-\pi\geq\theta_{ij}-{\alpha_{ij}\over 2}\ {\hbox{and}}\ \theta_{ij}+{\alpha_{ij}\over 2}\leq\pi:\cr&\qquad\quad\cases{\theta_{ij}-\omega_{ij}-{\alpha_{ij}\over 2}>\gamma_{ij}^{\ast}\cr{\hbox{or}}\cr\theta_{ij}-\omega_{ij}+{\alpha_{ij}\over 2}\ <-\gamma_{ij}^{\ast},}&\hbox{(A-6)}\cr\cr&{\hbox{for}}\quad\theta_{ij}-{\alpha_{ij}\over 2}\ <-\!\pi:\cr&\qquad\quad\cases{\theta_{ij}-\omega_{ij}-{\alpha_{ij}\over 2}+2\pi>\gamma_{ij}^{\ast}\cr{\hbox{and}}\cr\theta_{ij}-\omega_{ij}+{\alpha_{ij}\over 2}\ <-\gamma_{ij}^{\ast}}&\hbox{(A-7)}}$$ and
TeX Source
$$\eqalignno{&{\hbox{for}}\quad\pi\ <\ \theta_{ij}+{\alpha_{ij}\over 2}:\cr&\qquad\quad\cases{\theta_{ij}-\omega_{ij}-{\alpha_{ij}\over 2}>\gamma_{ij}^{\ast}\cr{\hbox{and}}\cr\theta_{ij}-\omega_{ij}+{\alpha_{ij}\over 2}-2\pi\ <-\gamma_{ij}^{\ast}}&\hbox{(A-8)}}$$ where γ_{ij}^{∗} is given by
TeX Source
$$\gamma_{ij}^{\ast}=\arcsin{r_{0}+r_{f}\over D_{ij}}.$$

### B. Optimization of the Conflict Resolution

In the previous section, we have presented constraints that should be satisfied by the aircraft headings to avoid a conflict. These constraints may be incorporated in an optimal conflict resolution scheme. Denoting θ_{i0} the initial heading of the aircraft *i* and θ_{i} its heading after resolution, the problem is to compute
TeX Source
$$\min J(\theta_{1},\theta_{2},\ldots , \theta_{n})=\min\sum_{i=1,\ldots , n}\vert\theta_{i}-\theta_{i0}\vert \eqno{\hbox{(A-9)}}$$ subject to
TeX Source
$$\eqalignno{&({\rm A}-2)\cr&\quad{\hbox{or}}\ {\rm A}-3\ {\hbox{if}}\quad\cases{-\pi\geq\theta_{ij}-\alpha_{ij}\cr{\hbox{and}}\cr\theta_{ij}+\alpha_{ij}\leq\pi}\cr&\quad{\hbox{or}}\ ({\rm A}-4)\ {\hbox{if}}\quad\theta_{ij}-\alpha_{ij}\ <-\!\pi\cr&\quad{\hbox{or}}\ ({\rm A}-5)\ {\hbox{if}}\quad\pi\ <\ \theta_{ij}+\alpha_{ij}\cr&\quad{\hbox{or}}\ ({\rm A}-6)\ {\hbox{if}}\quad\cases{-\pi\geq\theta_{ij}-{\alpha_{ij}\over 2}\cr{\hbox{and}}\cr\theta_{ij}+{\alpha_{ij}\over 2}\leq\pi}\cr&\quad{\hbox{or}}\ ({\rm A}-7)\ {\hbox{if}}\quad\theta_{ij}-{\alpha_{ij}\over 2}\ <-\!\pi\cr&\quad{\hbox{or}}\ ({\rm A}-8)\ \hbox{if}\quad\pi\ <\ \theta_{ij}+{\alpha_{ij}\over 2}\cr&i=1,\ldots, n-1,\quad j=i+1,\ldots, n }$$ where *n* is the number of aircraft.

### C. Formulation When Speeds are Identical

For the sake of computational simplicity, we assume all aircraft share the same speed *V*. This assumption simplifies the formulas for θ_{ij} and α_{ij} and allows us to obtain piecewise linear formulation for *theta*_{ij} and a linearization for α_{ij}.

#### Expression of the Angle of the Relative Velocity θ_{ij}

Using the assumption of identical speed, the angle between the relative velocity and the *x*-axis, the expression of θ_{ij} given by (A-1) can be simplified
TeX Source
$$\eqalign{\theta_{ij}=&\,\arctan{\sin\theta_{i}-\sin\theta_{j}\over\cos\theta_{i}-\cos\theta_{j}}\cr\cr=&\,\arctan{\sin\left({\theta_{i}-\theta_{j}\over 2}\right)\cos\left({\theta_{i}+\theta_{j}\over 2}\right)\over-\sin\left({\theta_{i}-\theta_{j}\over 2}\right)\sin\left({\theta_{i}+\theta_{j}\over 2}\right)}.}$$ θ_{ij} is a function of θ_{i}+θ_{j} and θ_{i}−θ_{j}. It can be shown that θ_{ij} is a piecewise affine function of θ_{i}+θ_{j} and θ_{i}−θ_{j} of the form θ_{ij} = *m*_{ij}(θ_{i}+θ_{j})+*p*_{ij}. The value of *m*_{ij} is always 1/2 and the values taken by *p*_{ij} are summarized in Table 1.

#### Expression of the Cone Angular Width 2 α_{ij} in the Relative Frame of Reference

This section presents the formulas to determine the cone angular width 2α_{ij} when aircraft share an identical speed. Rewriting , *i* = 1, … , *n*, we compute
TeX Source
$$\eqalignno{\alpha_{ij}=&\,\arcsin{2\mathdot{r}\over\sqrt{V^{2}(\cos\theta_{i}-\cos\theta_{j})^{2}+V^{2}(\sin\theta_{i}-\sin\theta_{j})^{2}}}\cr\cr=&\,\arcsin{\mathdot{r}\over V\left\vert\sin\left({\theta_{i}-\theta_{j}\over 2}\right)\right\vert}\cr\cr=&\,\arcsin{\tan\Delta\theta\over\left\vert\sin\left({\theta_{i}-\theta_{j}\over 2}\right)\right\vert}.&\hbox{(A-10)}}$$

The half cone angular width α_{ij} is given by (A-10) and is a nonlinear function of θ_{i}−θ_{j}. This function is symmetric about θ_{i}−θ_{j} = 0 and consists of two quasi-convex components, separated at θ_{i}−θ_{j} = 0, as shown in Fig. 14. The epigraph of each of these quasi-convex components can be approximated by the intersection of linear constraints defined by their slopes *a*_{k} and intercepts *b*_{k}. Using the big-*M* method allows us to account for the presence of two disconnected components, and this linearization leads to
TeX Source
$$\eqalign{&\cases{a_{1}(\theta_{i}-\theta_{j})+b_{1}\leq\alpha_{ij}\cr a_{2}(\theta_{i}-\theta_{j})+b_{2}\leq\alpha_{ij}\cr\quad\vdots\cr a_{l}(\theta_{i}-\theta_{j})+b_{l}\leq\alpha_{ij}}\cr&{\hbox{or}}\cr&\cases{-a_{1}(\theta_{i}-\theta_{j})+b_{1}\leq\alpha_{ij}\cr-a_{2}(\theta_{i}-\theta_{j})+b_{2}\leq\alpha_{ij}\cr\quad\vdots\cr-a_{l}(\theta_{i}-\theta_{j})+b_{l}\leq\alpha_{ij}.}}$$

### D. Mixed Integer Linear Programming Formulation

The global algorithm consists of minimizing (A-9) subject to all the constraints previously developed. We wrote the constraints in AMPL format and solved using CPLEX. To transform the *or* conditions to *and* conditions, we can use the big-M formulation [22]. An example of such formulation can be found in [17]. Another option is to use *if-then-else* conditions that are now handled by AMPL. MATLAB was used to generate the 1650 cases and was also used for the postprocessing. The computing time to solve an eight aircraft configuration ranged from less than a second to a minute on a four-processor Pentium-class computer.