Ariadne: A common-sense thread for enabling provable safety in air mobility systems with unreliable components

Abstract

Commercial air travel is by far the safest transportation modality available to humanity today. It has achieved this enviable status by deploying thousands of professionals, including pilots, dispatchers, and air traffic controllers to operate very reliable air vehicles, bringing them and their passengers safely from origin to destination while managing dangerous weather, other traffic and system failures for decades. The air transportation has been undergoing undeniable and continuous progress and modernization since its inception. Thanks to advances in navigation capabilities, such as satellite-based navigation systems, aircraft can fly increasingly complex trajectories, including final approaches. The same aircraft are envisioned to fly in formation relatively soon. More daring moves include the recent introduction of "Free Flight" operations. Despite all these impressive improvements, they remain largely incremental in nature and they hit a "wall of complexity" that makes it somewhat difficult to incorporate more automation, such as the elusive, and perhaps infeasible, goal of achieving fully automated air traffic control, and to design and insert autonomous vehicles, small and large, in cities and at high altitudes.We introduce Ariadne, a thread to accelerate the productivity gains achieved by air traffic services providers around the globe. Ariadne is an engineered version of the common sense practice of always keeping a "Plan B", and possibly "plans C, D, E, and F" against unexpected events when any decision is made by pilots, air traffic controllers, dispatchers, and any other safety-critical actor of the air transportation system. The name "Ariadne" was chosen to honor the mythical character Ariadne, daughter of Minos the king of Crete, who conceived the "Plan B" mechanism that would allow her lover to exit Daedalus' Labyrinth after killing the Minotaur.Ariadne and its informal definition as "Plan B engineering" offer surprising opportunities and properties, including not only provable operations safety with unproven components, but also a thread that can inherently be scaled up and quickly adapt to new air traffic scenarios, including the transition to free flight and accommodation of unmanned aviation. It also supports existing operations and therefore it does not conflict with current air traffic control practices. Modern computational capabilities and powerful AI algorithms make its implementation increasingly feasible to address more aspects of air traffic management.

Runtime Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems

“…In this context, a safe terminal set C b ⊆ C A is referred to as a backup set, and the set (17) is the safe backward image (SBI) of C b . Note that numerical integration over a continuous interval [0, T ] requires that the trajectory be approximated with a finite amount of points sampled along this interval; e.g.…”

“…In many cases it is not possible or practical to bring a vehicle to rest, and a backup set may instead be identified from safe periodic trajectories. For example, fixed wing aircraft may compute safe loiter circles [17], [21], [22], [47] or spacecraft may compute a set of safe orbits [48]. In many cases, the invariant set is a region without volume, and only an infinitesimal perturbation is required to cause a departure from the set.…”

“…Typically, explicit approaches identify trusted regions offline via the construction of either a large forward invariant or control invariant set. That is, implicit RTA approaches are those that utilize an online look-ahead and will bound the system to an implicitly defined safe set such as (17) while explicit RTA approaches determine safe states a priori and will bound the system to an explicitly defined safe set such as (9). This concept is demonstrated in the following example.…”

“…A practical consequence of this is that high performing black-box controllers can safely be used to generate backup trajectories. This concept has been used in practice [17] and is thoroughly explored for the context of Simplex-based systems in [108]. Furthermore, the idea extends to other methods of RTA.…”

“…RTA is emerging as the dominant approach for enforcing safety in real world autonomous systems and semi-autonomous systems. Though not always directly associated with the term run time assurance, notable autonomous systems applications are seen in road vehicles [13], [14], bipedal walking [15], [16], air traffic control [17], fixed wing aircraft collision avoidance [18]- [22] and flight envelope protection [23], VTOL aircraft [24] [25], spacecraft collision avoidance [26], manipulator arms [27], and propulsion [28] to name a few.…”