+ All Categories
Home > Documents > Research Article Z Specification of Gate and Apron Control Management at...

Research Article Z Specification of Gate and Apron Control Management at...

Date post: 02-May-2018
Category:
Upload: phamkhuong
View: 221 times
Download: 2 times
Share this document with a friend
10
Research Article Z Specification of Gate and Apron Control Management at Airport Nazir Ahmad Zafar, 1 Fahad Alhumaidan, 1 and Sher Afzal Khan 2 1 College of Computer Sciences and IT, King Faisal University, Alahsa 31982, Saudi Arabia 2 Department of Computer Sciences, Abdul Wali Khan University, Mardan 23200, Pakistan Correspondence should be addressed to Nazir Ahmad Zafar; [email protected] Received 4 March 2014; Revised 15 April 2014; Accepted 15 April 2014; Published 31 December 2014 Academic Editor: Saeed Islam Copyright © 2014 Nazir Ahmad Zafar et al. is is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Modelling of an air traffic control (ATC) system is an open issue and has become a challenging problem due to its complexity and increase of traffic at airports and in airspace. Consequently, automated ATC systems are suggested to improve efficiency ensuring the safety standards. It is reported that the number of collisions that occurred at airports surface is three times larger than in airspace. Further, it is observed that gates and aprons congestions cause significant delays at airports; hence, effective monitoring and guidance mechanisms are required to control ground air traffic. In this paper, formal procedure of managing air traffic from gate to enter in the active area of airport for taxiing is provided using Z notation. An integration of gate and apron controllers is described to manipulate the information for correct decision making and flow management. Graph theory is used for representation of airport topology and appropriate routs. In static part of the model, safety properties are described in terms of invariants over the critical data types. In dynamic model, the state space is updated by defining pre- and postconditions ensuring the safety. Formal specification is analysed using Z/Eves tool. 1. Introduction Air traffic control (ATC) system is a highly complex and safety critical system because its failure may cause a huge loss in terms of deaths or financial losses. It requires state-of-the- art techniques for development of ATC systems. Because of a large increase in movement of population and consequently a significant increase in capacity of air traffic [1], next generation ATC systems are suggested to improve efficiency by not compromising safety standards [25]. Although an automated support to ATC system is available nowadays, still it is heavily dependent upon human interaction causing delays and accidents due to failure of communication in decision making [6, 7]. erefore, developing an ATC system enabling aircraſt to move at airport and freely fly in the air is a current issue [8]. Further, we believe that modelling of safe and efficient ATC system will remain an open research problem because of its complexity. e ATC control can be divided into two categories, that is, in-air and airport control systems. e airport surface environment has historically been more dangerous than the airspace. For example, the number of collisions that occurred at the airport surface is three times more than the collisions in the airspace [9]. It means we need effective monitoring and automated guiding systems to control ground air traffic at gates, apron area, taxiways, and runway intersections. Apron area is used for preflight activities, for example, parking, waiting, and maintenance. Gate, apron, and ground controllers are main components for airport surface man- agement; however these are very less focussed on by the scientific community addressing ATC system [10]. Objective of apron controller is to share information, communication constraints, and priorities of aircraſts among the various operators and controllers in addition to providing an active decision support functions for route predictions [11]. In this paper, formal procedure of managing air traffic at airport from gate to taxiway is provided using Z notation. e Z is applied for formal description of the system under hand because of its abstract mathematical features and rigorous computer tool support [12]. It is noted that according to Euro- pean electrotechnical standards, the use of formal methods is recommended to achieve a required level of confidence in Hindawi Publishing Corporation Abstract and Applied Analysis Volume 2014, Article ID 530619, 9 pages http://dx.doi.org/10.1155/2014/530619
Transcript

Research ArticleZ Specification of Gate and Apron ControlManagement at Airport

Nazir Ahmad Zafar1 Fahad Alhumaidan1 and Sher Afzal Khan2

1College of Computer Sciences and IT King Faisal University Alahsa 31982 Saudi Arabia2Department of Computer Sciences Abdul Wali Khan University Mardan 23200 Pakistan

Correspondence should be addressed to Nazir Ahmad Zafar nazafargmailcom

Received 4 March 2014 Revised 15 April 2014 Accepted 15 April 2014 Published 31 December 2014

Academic Editor Saeed Islam

Copyright copy 2014 Nazir Ahmad Zafar et al This is an open access article distributed under the Creative Commons AttributionLicense which permits unrestricted use distribution and reproduction in any medium provided the original work is properlycited

Modelling of an air traffic control (ATC) system is an open issue and has become a challenging problem due to its complexity andincrease of traffic at airports and in airspace Consequently automated ATC systems are suggested to improve efficiency ensuringthe safety standards It is reported that the number of collisions that occurred at airports surface is three times larger than inairspace Further it is observed that gates and aprons congestions cause significant delays at airports hence effective monitoringand guidance mechanisms are required to control ground air traffic In this paper formal procedure of managing air traffic fromgate to enter in the active area of airport for taxiing is provided using Z notation An integration of gate and apron controllers isdescribed tomanipulate the information for correct decisionmaking and flowmanagement Graph theory is used for representationof airport topology and appropriate routs In static part of the model safety properties are described in terms of invariants over thecritical data types In dynamic model the state space is updated by defining pre- and postconditions ensuring the safety Formalspecification is analysed using ZEves tool

1 Introduction

Air traffic control (ATC) system is a highly complex andsafety critical system because its failure may cause a huge lossin terms of deaths or financial losses It requires state-of-the-art techniques for development of ATC systems Because of alarge increase in movement of population and consequentlya significant increase in capacity of air traffic [1] nextgeneration ATC systems are suggested to improve efficiencyby not compromising safety standards [2ndash5] Although anautomated support to ATC system is available nowadaysstill it is heavily dependent upon human interaction causingdelays and accidents due to failure of communication indecision making [6 7]Therefore developing an ATC systemenabling aircraft to move at airport and freely fly in the airis a current issue [8] Further we believe that modelling ofsafe and efficient ATC system will remain an open researchproblem because of its complexity

The ATC control can be divided into two categories thatis in-air and airport control systems The airport surfaceenvironment has historically been more dangerous than the

airspace For example the number of collisions that occurredat the airport surface is three times more than the collisionsin the airspace [9] It means we need effective monitoringand automated guiding systems to control ground air trafficat gates apron area taxiways and runway intersectionsApron area is used for preflight activities for exampleparking waiting and maintenance Gate apron and groundcontrollers are main components for airport surface man-agement however these are very less focussed on by thescientific community addressing ATC system [10] Objectiveof apron controller is to share information communicationconstraints and priorities of aircrafts among the variousoperators and controllers in addition to providing an activedecision support functions for route predictions [11]

In this paper formal procedure of managing air traffic atairport from gate to taxiway is provided using Z notationTheZ is applied for formal description of the system under handbecause of its abstract mathematical features and rigorouscomputer tool support [12] It is noted that according to Euro-pean electrotechnical standards the use of formal methodsis recommended to achieve a required level of confidence in

Hindawi Publishing CorporationAbstract and Applied AnalysisVolume 2014 Article ID 530619 9 pageshttpdxdoiorg1011552014530619

2 Abstract and Applied Analysis

development of safety critical system [13] In the algorithman integration of gate and apron controllers is defined bysharing the information required for managing the air trafficfrom gate to taxiway The airport surface is divided intosmall enough blocks Graph theory is used for the descriptionof airport and routs For mapping of real world airport tograph model block is represented as a node and connectivitybetween the blocks is represented as an edge The safetyproperties are described in terms of invariants over the datatypes carrying the critical information in the staticmodel Forexample it is assured that theremust exit atmost one aircraftin one region preventing collision at the airport surface Thetraffic sequence is updated by defining pre-postconditionsfor defining safety properties in the dynamic part of themodel Formal specification is analysed using ZEves tool

There exists much work on modelling of ATC systemsome important work is discussed in Section 2 Inmost of thework safety criteria are developed by testing through simula-tion but unfortunately this approach is lacking in verifyingthe correctness of ATC systems This is because the numberof simulations increases exponentially to provide a requiredlevel of confidence in complex systems Moreover when amodification is needed the complete set of simulations mustbe reconducted to ensure that the change did not compromisewith the defined safety and reliabilityTherefore it is requiredto apply formal approaches for modelling ATC system whichhas motivated us for embarking research in this direction

The rest of the paper is organized as follows In Section 2most relevant work is critically analysed In Section 3problem statement and formulation is presented Formalalgorithm is described in Section 4 Model analysis is done inSection 5 Finally conclusion and future work are discussedin Section 6

2 Related Work

There existsmuchwork onATC systemmost relevantwork isdiscussed here For example in the existent work a modifiedminimum cost and maximum-flow genetic algorithm isdeveloped to maximize the ground airport capacity [14] Thework is interesting in which the online scheduling of aircraftsconsidering airport capacity is analysed but results are testedand not fully verified NASA has developed the surfacemanagement system that provides information to federalaviation authority controllers and air carriers to manage theairport [15] In this paper it is focussed on prediction of futureairport surface characteristics for example taxiing and take-off time for allocation of departure runways In another worktraffic limitations enhancement is developed by advancedmodelling capability for simulating airport surface aircraftmovement as a case study [16] In this work a proba-bilistic timed automata model is developed under certainassumptions for describing operatorsrsquo behaviours A limitednumber of systemrsquos properties are expressed in probabilisticreal time computation tree logic Taxi operation and real-time planning function is developed to address taxi operationuncertainties based on real data in [17] However in thiswork only a part of the planning function is evaluated usingscenarios based approach In [18] unnecessary taxi time is

reduced by reducing taxiing process uncertainties and aircraftqueuing at the runway Planning function is developed foroptimizing the traffic flow by real time sequencing thedeparture traffic at the gate In this work although a processis described no proper algorithm is provided In anotherinteresting and most relevant work a model for estimatingthe ramp congestion delay is reduced by employing managedgate operation (MGO) tool [19] Again a detailed procedure isdescribed in this work however no validation or verificationapproach is provided to prove its correctness In [20] PRISMtool is used to verify and analyse the properties of ATCsystem using timed automataMultiagent approach is appliedin modelling of air traffic flow management (ATFM) in[21] The objective of this research is to show applicabilityof agent-based simulation In another work of NASA acollaborative air traffic flow is developed using multiagentsimulation technique Several strategies were used to selectvarious routes increasing complexity of the system [22] Afusion of intelligent computing is studied for development ofa new tactical system forATFMusing advantages of themeta-level control approach [23] In another application intelligentcomputing models are claimed for ATFM as presented in[24] Due to the increase of air traffic density and relativelylimited number of airways the future solution for optimalairspace and safe air traffic control is proposed in [25] Aprotocol for aircraft conflict resolution is proposed in [26ndash28]for information horizon in which the communication rangeof an aircraft is finite A predictable system is developed toachieve free flight to choose an optimal path minimizing fuelconsumption and delay time rather than using predefinedflight schedules in [29ndash31] This is very good effort for devel-oping free flight ATC systems The performance of conflictdetection and resolution is presented in [32] on estimationof aircraft state space Further satellite based communicationsystems have been suggested in current advances to considerthe free flight concept for the future ATC systems [33 34]Preliminary results of our research are reported in [35ndash39]Other similar work can be found in [40ndash45]

3 Problem Statement and Formulation

Ensuring safety and increasing efficiency of an ATC systemhave become a central issue due to increase of air-trafficand introduction of new technologies [46] The primaryobjective of ATC system is to provide a safe and efficientflow of air traffic [47] The safe operation is made possible bysharing information anddeveloping effective communicationthrough various systems to keep standard separation betweenaircrafts There are various ATCs responsible for monitoringaircrafts from gate (departing) to gate (destination)

The departing of aircraft begins with the pushback pro-cedure After checking the availability of the apron areathe aircraft is taxied to the active area of the airport Airtraffic control tower is responsible for giving permission toenter from apron area to taxiway The route sequence fromgate to taxiway is issued by the apron controller havingcommunication with tower controller The control tower isresponsible for assigning the departure runway and the taxiroute to reach the assigned runway The runway assignment

Abstract and Applied Analysis 3

decision is based on various factors for example gate pilotpreference and traffic size After reaching the runway theaircraft is put into the departure queue and then takes offafter the final permission To complete this whole procedurethe surface management system collects information fromvarious sources and then flight plan including gate leavingapron area occupation taxiway entering departure time andrunway assignment route is prepared

It is noted that the departure runway might be assignedafter pushback request is received This is because thedeparture runway can only be predicted if we are able topredict the time between pushback and the takeoff Variousfactors are involved assigning departing aircraft to a runwayFor example how the airport runways are configured forarriving and departing traffic which totally depends on theairport From gate to take-off few major reasons for delayin a flight are as follows (i) unoptimized calculation ofdeparture sequence because of various airport states causingstate space explosion (ii) inefficient push back proceduresbecause of dynamic change at airport (iii) revisiting routesequences because of accommodating priorities and (iv)apron controllers do not have full support to accommodateairline priorities because of lack of automated functioningsupport As a result it causes an irregular operation of apronand gate controllers

In our model a formal approach is developed to expediteairport traffic from gate to apron and taxiways throughintegration of various controllers It is noted that detailedinformation for example weather conditions wind speedand direction which may change the runway configurationin reality is not considered in our model in defining routesequence Further aircraft type and weight are also notconsidered In this way same length of route is assumed forevery type of an aircraft in our model In the model twoseparate queues are maintained each one for entering apronarea and taxiways Aircraft position taxiway location andrunway are provided by the surface surveillance systemwhichis usually integrated with GIS Such integration issues are alsoout of the scope of this research

In static part of the model the airport surface is dividedinto different regions and then transformed into a graph Inthe transformation a small unit (block) of airport surface isrepresented as a node and connectivity between two blocksis assumed as an edge in the graph As we have supposeddifferent routes for take-off and landing procedures in ourmodel hence the resultantmodel is a directed graph relationHowever a gate can be used for both incoming and departingflightsThe objective is to find and assign an appropriate routefrom gate to taxiing an aircraft Assigning gates and definingaprons and connectivity from apron to active area for taxiingare three main activities addressed in the dynamic part ofsystem

In the operational system initially an aircraft sendsa pushback request to the gate controller The pushbackoperation is executed after having a clearance from the aproncontroller Next the aircraft sends a request for taxi clearanceThe clearance is awarded to the aircraft for taxiing aftercommunication of apron controller and the air traffic controltower

4 Formal Modelling Using Z Notation

Safety and efficiency are two core requirements in safeand normal operation of an ATC system Safety requires awell-defined sequence of patterns whereas efficiency needsexpeditious movement of aircrafts In this section formalprocedure of aircrafts movement from gate to active areafor taxiing is described Formal rules are defined to preventcollisions and expedite the flow of traffic by maintaining aqueue of aircrafts using Z notation

41 Static Model First of all formal specification of airportsurface is described based on the graph relationThe smallestsurface unit of the airport is represented by a Block which isnode in the graph relation The connectivity of two blocksis represented by a link which is an edge in the graph Theordered pair (119906 V) in the edge-set means an aircraft canmovefrom node 119906 to node V

[Block] 119871119894119899119896119904 == 119909 119910 119861119897119900119888119896 | 119909 = 119910 ∙ (119909 119910)

Formal specification of the graph relation is describedby the schema Graph The schema consists of two partsdivided in horizontal form definition and predicate parts Infirst part of the schema variables definitions are given andinvariants are described in predicate part of the schema Theschema consists of two components that is block-set andlink-setThe block-set is defined as a finite power set of BlockThe link-set is a finite power set of Links which is in fact theset of all the possible edges of the graph relation

In predicate part it is stated that both ends of any edge arenodes which is a natural constraint in graph relation Furtherevery block is an end of an edge that is there is no isolatedblock Finally for any two blocks there is a path in the graphrelation because it is supposed that it is possible tomove fromone block to any other block at the airport surface

blocks FBlock

links FLinks

forallb1 b2 blocks ∙ path seq Blockexist

Graph

forallb1 b2 Block | (b1 b2) isin links ∙ b1 isin blocks and b2isin blocks

existforallb blocks ∙ b1 b2 Block | (b1 b2) isin links∙ b = b1 or b = b2

∙ foralli N | i ge 1 and i lt path ∙ (path i path (i + 1))isin links

Passenger gate is represented by the Gate schema con-stituted by two components that is gate identifier and gatestate The state variable has values clear or occupied Theset of gates is defined by the partial function gates from gateidentifier to Gate schema The Gates schema is a set of all thegates at airports which can be assigned to an aircraft

Gategateid Blockgatestate State

State= CLEAR | OCCUPIED

4 Abstract and Applied Analysis

gates Block Gate↛

Gates

forallgid Block gate Gate | (gid gate) isin gates∙ gid = gate middot gateid

Apron area is used for preflight activities includingparking waiting andmaintenance As there is an associationrelationship between apron area and gate hence apron isneeded to be defined as a separate entity which consistsof apron identifier and its state The identifier is assumedas a block The set of aprons is a partial function fromapron identifier to apron schema In predicate part it isstated that for every apron identifier apid and schema apronthe ordered pair (apid apron) is in the domain of apronsfunction

Apronapid Blockstate State

aprons Block ↛ Apron

∙ apid = apron middot apid

Aprons

forallapid Block apron Apron | (apid apron) isin aprons

Taxiway is a path on an airport connecting an apron areato a runway through various other services In our modeltaxiway is defined as a schema consisting of taxiway identifierand a sequence of blocks defining a well-defined path

Taxiway

seq Blockpathtaxiwayid TaxiwayId

[TaxiwayId]

The Taxiways schema contains two components namelytaxiways and taxiingA The first one taxiways is a functionfrom taxiway identifier to TaxiwayThe second one taxiingAis a partial function from taxiway identifier to aircraftidentifier occupying the taxiway In predicate part it is statedthat the domain of taxiingA is contained in the domain oftaxiways function

taxiways TaxiwayId rarr Taxiway

taxiingA TaxiwayId AircraftId

∙ tid = taxiway middot taxiwayid

dom taxiingA sube dom taxiways

Taxiways

foralltid TaxiwayId taxiway Taxiway | (tid taxiway)isin taxiways

[AircraftId]

The airport topology consists of four schemas defin-ing graph gates aprons and taxiways In predicate partit is stated that every block in the domain of gates andaprons functions belongs to the node-set The intersection

of domains of gates and aprons functions is empty Furtherit is stated that every block of gate and apron area isconnected to a taxiwayThe paths in taxiways are representedas a sequence of blocks satisfying the invariants of theconnectivity relation It is stated that every element of a pathsequence is a block in the graph relation Any two consecutiveelements in path sequence constitute an edge in the graphrelation

Graph Gates Aprons Taxiways

foralltw ran taxiways

forallb1 dom gates cup dom aprons

∙ tw ran taxiways ∙ b2 ran tw middot pathexist exist

∙ (tw middot path i tw middot path (i + 1)) isin links

∙ (route i route (i + 1)) isin links

AirportTopology

dom gates cap dom aprons =

forallb Block gate Gate | (b gate) isin gates∙ gate middot gateid isin blocks

forallb Block apron Apron | (b apron) isin aprons∙ apron middot apid isin blocks

∙ path1 seq Block | w middot path = path1exist t

∙ foralli N | i isin dom path1 and i isin 1 path1 minus 1

∙ route seq Block ∙ foralli N | ge 1 and i lt routeexist i

An aircraft is specified by a schema Aircraft whichconsists of two components that is aircraft identifier and itssafe area The set of all permissible aircrafts at the airportis defined as a mapping from aircraft identifier to AircraftIn predicate part of the Aircrafts schema it is stated thatan intersection of safe areas of any two aircrafts is alwaysempty

Aircraftaircraftid AircraftIdsafeArea seq Block

aircrafts AircraftId rarr Aircraft

∙ aid = acr middot aircraftid

Aircrafts

forallac1 ac2 ran aircrafts ∙ ac1 middot safeArea capac2 middot safeArea =

forallaid AircraftId acr Aircraft | (aid acr)isin aircrafts

The gate controller defined below consists of four com-ponents The first one is Gates schema which is alreadydefined The second component is gatesR representing theaircrafts which have requested a gate The gatesR componentis defined as a sequence type to provide the service on firstcome and first serve basis The gatesA is the third componentrepresenting mapping from aircraft identifier to gateThe last

Abstract and Applied Analysis 5

one is pushbackR which is the set of aircrafts which haverequested for pushback from the gate

It is mentioned that relationship among all the compo-nents of the gate controller is defined in terms of propertiesTo capture invariants for completeness of the specificationeach component of the gate controller was selected and thenit identified any relationship if exists with the rest of thecomponents

Gates

gatesR seq AircraftId

↛gatesA AircraftId Gate

pushbackR F AircraftId

forallgate ran gates

∙ gate isin ran gatesA rArr gate middot gatestate =

OCCUPIED and

gate notin ran gatesA rArr gate middot gatestate = CLEAR

pushbackR sube dom gatesA

GateController

ran gatesR cap dom gatesA =

Invariants are as follows (i) if a gate is assigned to anaircraft it must be in the occupied state otherwise it is inthe clear state (ii) if a gate is assigned to an aircraft theaircraft cannot be in the list of aircrafts which have requesteda gate If an aircraft has requested a gate it cannot be in thelist of aircrafts which are assigned a gate (iii) if an aircrafthas requested pushback then aircraft must be in the list ofaircrafts which are assigned the gates

It was possible to specify gate and apron controllers usingthe same schema however we have defined it separatelybecause of the simplicity of the model The apron controllerconsists of aprons set of aircrafts which have requested forpushback clearance pushbackC sequence of aircrafts whichare in apron area apronQ and sequence of aircrafts whichhave requested for taxiing taxiingR Formal specificationof the apron controller is described below following theinvariants

Aprons

pushbackC FAircraftIdapronQ seq AircraftIdtaxiingR seq AircraftId

forallaid ran taxiingR ∙ aid isin ran apronQ and aidnotin pushbackC

forallaid pushbackC ∙ aid notin ran apronQ ran taxiingRcup

ApronController

forallaid ran apronQ ∙ aid notin pushbackC

Invariants are as follows (i) any aircraft which hasrequested pushback clearance cannot be in the list of aircraftsin the apron area (ii) if an aircraft is in the apron area

it has not requested the pushback clearance (iii) if anaircraft has requested taxiing it is in the apron area butnot in the list of aircrafts which has requested pushbackclearance

42 Dynamic Model Formal specification of operationsrequired for moving aircrafts from gate to taxiways isdescribed in this section The model is a part of the take-off procedure from gate to taxiing for updating state spaceof the airport There are three main facilities namely gatesaprons and taxiways which are managed by gate and aproncontrollers At first an aircraft is entered from gate to apronarea by communication of gate and apron controller After anaircraft is entered from apron area to taxiway it is controlledby the local controller

First of all an operation for gate request is defined belowAn aircraft sends a request for gate to the gate controllerby showing its identity After verifying the identity thegate controller accepts the request and adds the aircraftin the waiting list gatesR The operation is described bythe schema RequestGate which contains ΞApronControllerΔGateController and aircraft identifier aid as inputs Thestate of gate controller is updated by verifying the propertiesas pre- and postconditions It is noted that postconditionmust be satisfied after the successful execution of the oper-ation The symbol Ξ used in the schema shows that state ofapron controller is not changed The symbol Δ shows thatstate of gate controller is changed The symbol after aidvariable represents that it is an input variable The schemacomponents are put in first part and pre-postconditions aredescribed in second part of the schema

ΞApronController

ΔGateController

aid AircraftId

gatesA998400 = gatesA

pushbackR998400 = pushbackR

gatesR998400 = gatesR ⟨aid⟩

RequestGate

aid isin ran apronQ

aid notin ran gatesR

Pre-postconditions are as follows (i) the requesting air-craftmust be in the apron area (apronQ) (ii) the aircraft is notin the list of waiting list (gatesR) (iii) if the above conditionsare satisfied then aircraft is added to the waiting list (iv)the other two variables of gate controller are unchangedThe symbol ldquo 1015840 rdquo decorating a variable is used for its newstate

Formal definition of the gate assignment operation is pro-vided by the AssignGate schema The schema contains threecomponents namely ΔGateController aircraft identifier andgate as inputs in first part of the schemaThe gate is assignedby the gate controller in terms of pre- and postconditions inthe predicate part of the schema

6 Abstract and Applied Analysis

ΔGateController

aid AircraftIdgate Gate

aid isin ran gatesR

aid notin dom gatesA

gate isin ran gates

gate notin ran gatesA

gatesR998400 = gatesR

pushbackR998400 = pushbackR

gatesA998400 = gatesA cup (aid gate)↦

AssignGate

Pre-postconditions are as follows (i) the aircraftmust bein the waiting list of aircrafts (ii) the aircraft is not assigned agate (iii) the input gate belongs to the valid list of gates (iv)the gate is not assigned to any other aircraft (v) if the aboveconditions are satisfied then aircraft is assigned the gate (vi)the other two variables gateR and pushbackR of gate controllerare unchanged

The pushback request procedure is denoted by the Push-backRequest schema The schema consists of ΔApronCon-troller ΔGateController and aircraft identifier The schemadefinition is given below following pre-postconditions forupdating state space of gates

ΔApronController

ΔGateController

aid AircraftId

aid isin dom gatesA

aid notin pushbackR cap pushbackC

pushbackC998400 = pushbackC cup aid

pushbackR998400 = pushbackR cup aid

gatesA998400 = gatesA

gatesR998400 = gatesR

apronQ998400 = apronQ

taxiingR998400 = taxiingR

PushbackRequest

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate before sending a pushback request (ii)the aircraft neither has requested for pushback nor has apushback clearance (iii) the aircraft is added in the pushbackrequest of gate controller and pushback clearance list of aproncontroller (iv) the other variables gatesA and gatesR of gatescontroller and apronQ and taxiingR of apron controller areunchanged

The pushback procedure is denoted by Pushback schemaconsisting of five components namely ΔGateControllerΔApronController aircraft identifier apron identifier and

apron as given below The schema definition is given belowfollowing the pre-postconditions

ΔGateController

ΔApronController

aid AircraftIdapid Blockapron Apron

aid isin dom gatesA

aid isin pushbackR cap pushbackC

(apid apron) isin aprons

gatesR998400 = gatesR

taxiingR998400 = taxiingR

gatesA998400 = aid gatesA⩤

apronQ998400 = apronQ ⟨aid⟩

Pushback

aprons998400 = aprons cup (apid apron)↦

pushbackC998400 = pushbackCaid

pushbackR998400 = pushbackRaid

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate (ii) it is in the lists of pushback requestsand pushback clearance (iii) the aircraft is removed from thegate list (iv) the aircraft is removed from the pushback andclearance lists (v) the aircraft is allowed to enter the apronarea (vi) the rest of the variables of gate and apron controllersare unchanged

The taxi request procedure is defined below by usingTaxiRequest schema consisting of ΔApronController andaircrafts identifier The schema definition is given belowfollowing the informal description

ΔApronController

aid AircraftId

aid = apronQ 1

apronQ998400 = apronQ

pushbackC998400 = pushbackC

aid notin ran taxiingR

taxiingR998400 = taxiingR ⟨aid⟩

TaxiRequest

Pre-postconditions are as follows (i) the aircraft whichhas requested for taxiing is the first one in the queue inapron area (ii) the aircraft does not belong to the listof aircrafts waiting for taxiing (iii) the aircraft is addedin the list of aircrafts waiting for taxiing (iv) the othertwo variables apronQ and pushbackC of apron controllerremained unchanged

Finally formal procedure of leaving the apron area for anaircraft and entering into taxiway is described usingEnterTaxi

Abstract and Applied Analysis 7

schema which consists of ΔApronController ΔTaxiways air-craft taxiway identifier and taxiway The aircraft is removedfrom the waiting list of aircrafts by using the filter ldquordquooperation

ΔApronController

ΔTaxiways

acr Aircrafttid TaxiwayIdtaxiway Taxiway

acr middot aircraftid isin ran taxiingR

acr middot aircraftid = apronQ 1

taxiingR998400

apronQ998400

pushbackC998400 = pushbackC

taxiways998400 = taxiways

middot aircraftid ∙ i(i acr middot aircraftid) notin taxiingR and aid acrne

middot aircraftid ∙ i(i acr middot aircraftid) notin apronQ and aid acrne

taxiingR

apronQ

EnterTaxi

taxiingA998400 = taxiingA cup (tid acr middot aircraftid)↦

(tid taxiway) isin taxiways

= i N aid AircraftId | i isin dom taxiingR and

= i N aid AircraftId | i isin dom apronQand

Pre-postconditions are as follows (i) the aircraft musthave taxiing permission (ii) the aircraft which has requestedfor taxiing is the first one in the queue in the apron area(iii) after the aircraft has taxied it is removed from the listof aircrafts having permission for taxiing and from the apronarea (iv) the rest of the variables of apron controller remainedunchanged

5 Model Analysis

In this section formal analysis of the specification is providedusing ZEves toolset Aswe know there does not exist any realcomputer tool which may assure complete correctness of for-mal specificationThat means even if the formal specificationis written well it may cause potential errors Hence an art ofwriting formal specification does not provide any guaranteeabout correctness of the model If the formal specification ofa system is analysed with a computer tool it improves theconfidence by identifying errors if it exists in the model

The ZEves is a powerful tool used here for analysing theformal specification of a part of the air traffic control systemresponsible for aircraftmovement from gate to the active areafor taxiing Some schemas of the formalmodel are checked tobe correct while the others are proved by reduction techniqueavailable in the tool

Table 1 Results of model analysis

Schema Name Syntax typecheck

Domaincheck Reduction Proof by

reductionGraph Y Y Ylowast YGate Gates Y Y NA YApron Aprons Y Y NA YTaxiway Taxiways Y Y NA YAirportTopology Y Y Ylowast YAircraft Aircrafts Y Y NA YGateController Y Y NA YApronController Y Y NA YRequestGate Y Y Ylowast YAssignGate Y Y NA YPushbackRequest Y Y NA YPushback Y Y Ylowast YTaxiRequest Y Y Ylowast YEnterTaxi Y Y Ylowast Y

Summary of the results is provided in Table 1 In firstcolumn of the table name of the schema is provided Thesecond column is used for syntax and type checking Thedomain checks proofs in the tool guarantees the consis-tency of the formal specifications for axiomatic declarationsDomain checking is done in column 3 Proof by reductionis a technique in which equivalent simpler combinations oftactics is substituted Reduction and proof by reduction arerepresented in columns 4 and 5 respectively The symbolldquoYrdquo in the table indicates that all schemas are proved to becorrect automatically The symbol ldquoYrdquo annotated with ldquolowastrdquoshows that the schema is proved to be correct by reductiontechnique The symbol ldquoNArdquo in 4th column is used to meanthat reduction is not required on the predicates and hencethe formal specification is proved to be written well andmeaningful

6 Conclusion

In this paper we have described a formal procedure forair traffic flow management from gate to taxiing in airtraffic control (ATC) system Initially we have describedfundamental components for description of the requiredsystemThe airport surface is represented using graph theoryas a part of static model We observed that graph modelwas an effective one for defining connectivity relation andappropriate taxing routs Dynamic model is described formanipulating critical information based on the static modelSafety properties are described in terms of invariants overthe components in the static model Pre- and postconditionsare used to define safety criteria in the operational system toavoid any unwanted situation Z notation is applied becauseof its rigorous and abstract nature for formal analysis of thiscritical system

We observed that the complexity of the ATC system wasreduced by decomposing into its components The use ofschema structure in Z notation facilitated both in the static

8 Abstract and Applied Analysis

and dynamic parts of the model Systematic developmentfrom abstraction to detailed model made it easy to proposea simple and abstract model

There exists much work on modelling of ATC systemhowever it needs more research to address next generationautomated systems achieving the required level of safety andefficiency The work of Michael and Steven is close to this inwhich gate management and ramp operations are analysedfor reducing delay time fuel burning and other costs [48]In their work the approach is fairly conservative based onobservations and results are not fully verified and established

Various benefits describing formal specification ofthe system were observed For example modelling ofcomponent-based system provided us with a completecharacterization at a higher level of abstraction On theother hand if the system was specified at a more detailedlevel intuition may have been lost Compositional approachenabled us to give reasoning about the components andsubsequently the entire system Further advantages of aformal model can be observed after refinement The detailedmodel can be achieved after a series of refinements whileguaranteeing the transformation of syntax and semanticsrules

A clear scope and set of assumptions were definedbefore producing a mathematical model of the system It ismentioned that this formal model can be applied to an ATCsystem after a further refinement and analysisThis is becausewe have defined the properties based on the requirements ofa real ATC system

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

References

[1] J VilliersERASMUSmdashAFriendlyWay for Breaking the CapacityBarrier ITA 2004

[2] H Erzberger ldquoTransforming the NAS the next generationair traffic control systemrdquo in Proceedings of the InternationalCongress of the Aeronautical Sciences 2004

[3] H Erzberger ldquoAutomated conflict resolution for air trafficcontrolrdquo in Proceedings of the 25th International Congress of theAeronautical Sciences 2006

[4] H Erzberger and K Heere ldquoAlgorithm and operational conceptfor resolving short range conflictsrdquo Journal of Aerospace Engi-neering vol 224 pp 225ndash243 2009

[5] T Farley and H Erzberger ldquoFast time air traffic simulation of aconflict resolution algorithm under high air traffic demandrdquo inProceedings of the USA Europe ATM Seminar 2007

[6] J Hu M Prandini and S Sastry ldquoOptimal maneuver formultiple aircraft conflict resolution a braid point of viewrdquo inProceedings of the 39th IEEE Confernce on Decision and Controlvol 4 pp 4164ndash4169 December 2000

[7] S T Shorrock and B Kirwan ldquoDevelopment and application ofa human error identification tool for air traffic controlrdquo AppliedErgonomics vol 33 no 4 pp 319ndash336 2002

[8] N E Debbache ldquoToward a new organization for air trafficcontrolrdquo Aircraft Engineering and Aerospace Technology vol 73no 6 pp 561ndash567 2001

[9] W Marshall and W I Joseph ldquoAirport movement area safetysystemrdquo in Proceedings of the IEEE Digital Avionics SystemsConference pp 549ndash552 1992

[10] Y Guo X Cao and J Zhang ldquoConstraint handling based mul-tiobjective evolutionary algorithm for aircraft landing schedul-ingrdquo International Journal of Innovative Computing Informationand Control vol 5 no 8 pp 2229ndash2238 2009

[11] G J Couluris R K Fong M B Downs et al ldquoA new modelingcapability for airport surface traffic analysisrdquo in Proceedings ofthe IEEEAIAA 27th Digital Avionics Systems Conference (DASCrsquo08) pp E41ndashE411 October 2008

[12] J M SpiveyThe Z Notation A Reference manual Prentice HallLondon UK 1992

[13] European Electro-Technical Standardization ldquoRailway applica-tions communications signaling and processing systems soft-ware for railway control and protection systemsrdquoThe EuropeanStandard BS EN 50128 2001

[14] J Garcıa A Berlanga J M Molina J A Besada and J RCasar ldquoPlanning techniques for airport ground operationsrdquo inProceedings of the 21st Digital Avionics Systems Conference 2002

[15] P M Moertl J M Hitt II S Atkins C Brinton and D HWalton ldquoFactors for predicting airport surface characteristicsand prediction accuracy of the surface management systemrdquoin Proceedings of the IEEE International Conference on SystemsMan and Cybernetics pp 3798ndash3803 October 2003

[16] T T B Hanh and D V Hung ldquoVerification of an air trafficcontrol system with probabilistic real-time model checkingrdquoTech Rep 355 UNU-IIST 2007

[17] G J M Koeners E P Stout and R M Rademaker ldquoImprovingtaxi traffic flow by real-time runway sequence optimizationusing dynamic taxi route planningrdquo in Proceedings of the 30thIEEEAIAA Digital Avionics Systems Conference (DASC rsquo11)October 2011

[18] G J M Koeners and R M Rademaker ldquoAnalyze possiblebenefits of real-time taxi flow optimization using actual datardquoin Proceedings of the 30th Digital Avionics Systems Conference(DASC rsquo11) Fremont Calif USA October 2011

[19] S Amy J S Philip and B Charles Ramp Control Issues inthe Design of a Surface Management System Cognitive SystemsEngineering Laboratory The Ohio State University 2002

[20] M Kwiatkowska G Norman J Sproston and F Wang ldquoSym-bolic model checking for probabilistic timed automatardquo in JointConference on Formal Modeling and Analysis of Timed Systemsand Formal Techniques in Real-Time and Fault Tolerant Systemsvol 3253 of Lecture Notes in Computer Science pp 293ndash208Springer 2004

[21] M Nguyen-Duc J-P Briot A Drogoul and V Duong ldquoAnapplication of multi-agent coordination techniques in air trafficmanagementrdquo in Proceedings of the IEEEWIC InternationalConference on Intelligent Agent Technology pp 622ndash628 Octo-ber 2003

[22] L C Yang and J K Kuchar ldquoPrototype conflict alerting systemfor free flightrdquo Journal of Guidance Control and Dynamics vol20 no 4 pp 768ndash773 1997

[23] D P Alves L Weigang B Bueno and B B Souza ldquoReinforce-ment learning to support meta-level control in air traffic man-agementrdquo in Reinforcement Learning Theory and Applicationspp 357ndash372 ARS Publishing 2008

Abstract and Applied Analysis 9

[24] L Weigang M V P Dib D P Alves and A M F CrespoldquoIntelligent computingmethods in air traffic flowmanagementrdquoTransportation Research C Emerging Technologies vol 18 no 5pp 781ndash793 2010

[25] A Cavcar and M Cavcar ldquoImpact of aircraft performance dif-ferences on fuel consumption of aircraft in air of managementenvironmentrdquo Aircraft Engineering and Aerospace Technologyvol 76 no 5 pp 502ndash515 2004

[26] I Hwang andC Tomlin ldquoProtocol-based conflict resolution forfinite information horizonrdquo inProceedings of the IEEEAmericanControl Conference (ACC rsquo02) pp 748ndash753 Piscataway NJUSA May 2002

[27] I Hwang J Hwang andC Tomlin ldquoFlight-mode-based aircraftconflict detection using a residual-mean interacting multiplemodel algorithmrdquo in Proceedings of the AIAA Guidance Navi-gation and Control Conference 2003

[28] I Hwang H Balakrishnan K Roy and C Tomlin ldquoTargettracking and identity management in clutter for air trafficcontrolrdquo in Proceedings of the American Control Conference(AAC rsquo04) 2004

[29] K Bousson ldquoWaypoint-constrained free flight collision avoid-ancerdquo in Proceedings of the SAE Advances in Aviation SafetyConference 2003

[30] S Kahne and I Frolow ldquoAir trafficmanagement evolution withtechnologyrdquo IEEE Control Systems Magazine vol 16 no 4 pp12ndash21 1996

[31] M S Nolan Fundamentals of Air Traffic Control BrooksColeWadsworth Ohio USA 3rd edition 1998

[32] J K Kuchar and L C Yang ldquoA review of conflict detection andresolution modeling methodsrdquo IEEE Transactions on IntelligentTransportation Systems vol 1 no 4 pp 179ndash189 2000

[33] J Hu M Pradini and S Sastry ldquoOptimal coordinated maneu-vers for three-dimensional aircraft conflict resolutionrdquo Journalof Guidance Control and Dynamics vol 25 no 5 pp 888ndash9002002

[34] S R Wolfe F Y Enomoto P A Jarvis and M SierhuisldquoComparing route selection strategies in collaborative trafficflowmanagementrdquo in Proceedings of the IEEE Computer SocietyTechnical Committee on Intelligent Informatics (TCII rsquo07) pp59ndash62 November 2007

[35] S Yousaf N A Zafar and S A Khan ldquoFormal analysis ofdeparture procedure of air traffic control systemrdquo in Proceedingsof the 2nd International Conference on Software Technology andEngineering (ICSTE rsquo10) pp 301ndash305 October 2010

[36] N A Zafar and K Araki ldquoFormalizing moving block railwayinterlocking system for directed networkrdquo Research Reportson Information Science and Electrical Engineering of KyushuUniversity vol 8 no 2 pp 109ndash114 2003

[37] N A Zafar ldquoModeling and formal specification of automatedtrain control system using Z notationrdquo in Proceedings of theIEEE InternationalMultitopic Conference (INMIC rsquo06) pp 438ndash443 December 2006

[38] N A Zafar S A Khan and K Araki ldquoTowards the safetyproperties of moving block railway interlocking systemrdquo Inter-national Journal of Innovative Computing Information andControl vol 8 no 8 pp 5677ndash5690 2012

[39] N A Zafar ldquoSafety control management at airport taxiing totake-off procedurerdquo The Arab Journal of Science and Engineer-ing In press

[40] R Banach C Jeske A Hall and S Stepney ldquoRetrenchmentand the atomicity patternrdquo in Proceedings of the 5th IEEE

International Conference on Software Engineering and FormalMethods (SEFM rsquo07) pp 37ndash46 September 2007

[41] A C Garcia H Idris R Vivona and S Green ldquoCommonaircraft performancemodeling evaluation tools and experimentresultsrdquo in Proceedings of the 24th Digital Avionics SystemsConference (DASC rsquo05) pp 51ndash59 2005

[42] M Jamal and N A Zafar ldquoFormal model of computer-basedair traffic control system using Z notationrdquo in Proceedingsof the 17th International Conference on Computer Theory andApplications 2007

[43] M Jamal and N A Zafar ldquoRequirements analysis of airtraffic control system using formal methodsrdquo in Proceedingsof the International Conference on Information and EmergingTechnologies (ICIET rsquo07) pp 216ndash222 July 2007

[44] M Medina L Sherry and M Feary ldquoAutomation for taskanalysis of next generation air traffic management systemsrdquoTransportation Research C Emerging Technologies vol 18 no6 pp 921ndash929 2010

[45] S Pickin C Jard T Jeron J-M Jezequel and Y Le TraonldquoTest synthesis fromUMLmodels of distributed softwarerdquo IEEETransactions on Software Engineering vol 33 no 4 pp 252ndash2692007

[46] A M F Crespo C V Aquino B B Souza L Weigang A CM A Melo A and D P Alves ldquoDistributed decision supportsystem applied to tactical air traffic flow management in caseof CINDACTA Irdquo Journal of the Brazilian Air TransportationResearch Society vol 4 no 1 pp 47ndash60 2008

[47] C Livadas J Lygeros and N A Lynch ldquoHigh-level modelingand analysis of the TrafficAlert andCollisionAvoidance System(TCAS)rdquo Proceedings of the IEEE vol 88 no 7 pp 926ndash9472000

[48] C Michael and S Steven ldquoManaging gate and ramp operationsto reduce delay fuel burn and costsrdquo in Proceedings of theIntegrated Communications Navigation and Surveillance Con-ference (ICNS rsquo12) 2012

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

2 Abstract and Applied Analysis

development of safety critical system [13] In the algorithman integration of gate and apron controllers is defined bysharing the information required for managing the air trafficfrom gate to taxiway The airport surface is divided intosmall enough blocks Graph theory is used for the descriptionof airport and routs For mapping of real world airport tograph model block is represented as a node and connectivitybetween the blocks is represented as an edge The safetyproperties are described in terms of invariants over the datatypes carrying the critical information in the staticmodel Forexample it is assured that theremust exit atmost one aircraftin one region preventing collision at the airport surface Thetraffic sequence is updated by defining pre-postconditionsfor defining safety properties in the dynamic part of themodel Formal specification is analysed using ZEves tool

There exists much work on modelling of ATC systemsome important work is discussed in Section 2 Inmost of thework safety criteria are developed by testing through simula-tion but unfortunately this approach is lacking in verifyingthe correctness of ATC systems This is because the numberof simulations increases exponentially to provide a requiredlevel of confidence in complex systems Moreover when amodification is needed the complete set of simulations mustbe reconducted to ensure that the change did not compromisewith the defined safety and reliabilityTherefore it is requiredto apply formal approaches for modelling ATC system whichhas motivated us for embarking research in this direction

The rest of the paper is organized as follows In Section 2most relevant work is critically analysed In Section 3problem statement and formulation is presented Formalalgorithm is described in Section 4 Model analysis is done inSection 5 Finally conclusion and future work are discussedin Section 6

2 Related Work

There existsmuchwork onATC systemmost relevantwork isdiscussed here For example in the existent work a modifiedminimum cost and maximum-flow genetic algorithm isdeveloped to maximize the ground airport capacity [14] Thework is interesting in which the online scheduling of aircraftsconsidering airport capacity is analysed but results are testedand not fully verified NASA has developed the surfacemanagement system that provides information to federalaviation authority controllers and air carriers to manage theairport [15] In this paper it is focussed on prediction of futureairport surface characteristics for example taxiing and take-off time for allocation of departure runways In another worktraffic limitations enhancement is developed by advancedmodelling capability for simulating airport surface aircraftmovement as a case study [16] In this work a proba-bilistic timed automata model is developed under certainassumptions for describing operatorsrsquo behaviours A limitednumber of systemrsquos properties are expressed in probabilisticreal time computation tree logic Taxi operation and real-time planning function is developed to address taxi operationuncertainties based on real data in [17] However in thiswork only a part of the planning function is evaluated usingscenarios based approach In [18] unnecessary taxi time is

reduced by reducing taxiing process uncertainties and aircraftqueuing at the runway Planning function is developed foroptimizing the traffic flow by real time sequencing thedeparture traffic at the gate In this work although a processis described no proper algorithm is provided In anotherinteresting and most relevant work a model for estimatingthe ramp congestion delay is reduced by employing managedgate operation (MGO) tool [19] Again a detailed procedure isdescribed in this work however no validation or verificationapproach is provided to prove its correctness In [20] PRISMtool is used to verify and analyse the properties of ATCsystem using timed automataMultiagent approach is appliedin modelling of air traffic flow management (ATFM) in[21] The objective of this research is to show applicabilityof agent-based simulation In another work of NASA acollaborative air traffic flow is developed using multiagentsimulation technique Several strategies were used to selectvarious routes increasing complexity of the system [22] Afusion of intelligent computing is studied for development ofa new tactical system forATFMusing advantages of themeta-level control approach [23] In another application intelligentcomputing models are claimed for ATFM as presented in[24] Due to the increase of air traffic density and relativelylimited number of airways the future solution for optimalairspace and safe air traffic control is proposed in [25] Aprotocol for aircraft conflict resolution is proposed in [26ndash28]for information horizon in which the communication rangeof an aircraft is finite A predictable system is developed toachieve free flight to choose an optimal path minimizing fuelconsumption and delay time rather than using predefinedflight schedules in [29ndash31] This is very good effort for devel-oping free flight ATC systems The performance of conflictdetection and resolution is presented in [32] on estimationof aircraft state space Further satellite based communicationsystems have been suggested in current advances to considerthe free flight concept for the future ATC systems [33 34]Preliminary results of our research are reported in [35ndash39]Other similar work can be found in [40ndash45]

3 Problem Statement and Formulation

Ensuring safety and increasing efficiency of an ATC systemhave become a central issue due to increase of air-trafficand introduction of new technologies [46] The primaryobjective of ATC system is to provide a safe and efficientflow of air traffic [47] The safe operation is made possible bysharing information anddeveloping effective communicationthrough various systems to keep standard separation betweenaircrafts There are various ATCs responsible for monitoringaircrafts from gate (departing) to gate (destination)

The departing of aircraft begins with the pushback pro-cedure After checking the availability of the apron areathe aircraft is taxied to the active area of the airport Airtraffic control tower is responsible for giving permission toenter from apron area to taxiway The route sequence fromgate to taxiway is issued by the apron controller havingcommunication with tower controller The control tower isresponsible for assigning the departure runway and the taxiroute to reach the assigned runway The runway assignment

Abstract and Applied Analysis 3

decision is based on various factors for example gate pilotpreference and traffic size After reaching the runway theaircraft is put into the departure queue and then takes offafter the final permission To complete this whole procedurethe surface management system collects information fromvarious sources and then flight plan including gate leavingapron area occupation taxiway entering departure time andrunway assignment route is prepared

It is noted that the departure runway might be assignedafter pushback request is received This is because thedeparture runway can only be predicted if we are able topredict the time between pushback and the takeoff Variousfactors are involved assigning departing aircraft to a runwayFor example how the airport runways are configured forarriving and departing traffic which totally depends on theairport From gate to take-off few major reasons for delayin a flight are as follows (i) unoptimized calculation ofdeparture sequence because of various airport states causingstate space explosion (ii) inefficient push back proceduresbecause of dynamic change at airport (iii) revisiting routesequences because of accommodating priorities and (iv)apron controllers do not have full support to accommodateairline priorities because of lack of automated functioningsupport As a result it causes an irregular operation of apronand gate controllers

In our model a formal approach is developed to expediteairport traffic from gate to apron and taxiways throughintegration of various controllers It is noted that detailedinformation for example weather conditions wind speedand direction which may change the runway configurationin reality is not considered in our model in defining routesequence Further aircraft type and weight are also notconsidered In this way same length of route is assumed forevery type of an aircraft in our model In the model twoseparate queues are maintained each one for entering apronarea and taxiways Aircraft position taxiway location andrunway are provided by the surface surveillance systemwhichis usually integrated with GIS Such integration issues are alsoout of the scope of this research

In static part of the model the airport surface is dividedinto different regions and then transformed into a graph Inthe transformation a small unit (block) of airport surface isrepresented as a node and connectivity between two blocksis assumed as an edge in the graph As we have supposeddifferent routes for take-off and landing procedures in ourmodel hence the resultantmodel is a directed graph relationHowever a gate can be used for both incoming and departingflightsThe objective is to find and assign an appropriate routefrom gate to taxiing an aircraft Assigning gates and definingaprons and connectivity from apron to active area for taxiingare three main activities addressed in the dynamic part ofsystem

In the operational system initially an aircraft sendsa pushback request to the gate controller The pushbackoperation is executed after having a clearance from the aproncontroller Next the aircraft sends a request for taxi clearanceThe clearance is awarded to the aircraft for taxiing aftercommunication of apron controller and the air traffic controltower

4 Formal Modelling Using Z Notation

Safety and efficiency are two core requirements in safeand normal operation of an ATC system Safety requires awell-defined sequence of patterns whereas efficiency needsexpeditious movement of aircrafts In this section formalprocedure of aircrafts movement from gate to active areafor taxiing is described Formal rules are defined to preventcollisions and expedite the flow of traffic by maintaining aqueue of aircrafts using Z notation

41 Static Model First of all formal specification of airportsurface is described based on the graph relationThe smallestsurface unit of the airport is represented by a Block which isnode in the graph relation The connectivity of two blocksis represented by a link which is an edge in the graph Theordered pair (119906 V) in the edge-set means an aircraft canmovefrom node 119906 to node V

[Block] 119871119894119899119896119904 == 119909 119910 119861119897119900119888119896 | 119909 = 119910 ∙ (119909 119910)

Formal specification of the graph relation is describedby the schema Graph The schema consists of two partsdivided in horizontal form definition and predicate parts Infirst part of the schema variables definitions are given andinvariants are described in predicate part of the schema Theschema consists of two components that is block-set andlink-setThe block-set is defined as a finite power set of BlockThe link-set is a finite power set of Links which is in fact theset of all the possible edges of the graph relation

In predicate part it is stated that both ends of any edge arenodes which is a natural constraint in graph relation Furtherevery block is an end of an edge that is there is no isolatedblock Finally for any two blocks there is a path in the graphrelation because it is supposed that it is possible tomove fromone block to any other block at the airport surface

blocks FBlock

links FLinks

forallb1 b2 blocks ∙ path seq Blockexist

Graph

forallb1 b2 Block | (b1 b2) isin links ∙ b1 isin blocks and b2isin blocks

existforallb blocks ∙ b1 b2 Block | (b1 b2) isin links∙ b = b1 or b = b2

∙ foralli N | i ge 1 and i lt path ∙ (path i path (i + 1))isin links

Passenger gate is represented by the Gate schema con-stituted by two components that is gate identifier and gatestate The state variable has values clear or occupied Theset of gates is defined by the partial function gates from gateidentifier to Gate schema The Gates schema is a set of all thegates at airports which can be assigned to an aircraft

Gategateid Blockgatestate State

State= CLEAR | OCCUPIED

4 Abstract and Applied Analysis

gates Block Gate↛

Gates

forallgid Block gate Gate | (gid gate) isin gates∙ gid = gate middot gateid

Apron area is used for preflight activities includingparking waiting andmaintenance As there is an associationrelationship between apron area and gate hence apron isneeded to be defined as a separate entity which consistsof apron identifier and its state The identifier is assumedas a block The set of aprons is a partial function fromapron identifier to apron schema In predicate part it isstated that for every apron identifier apid and schema apronthe ordered pair (apid apron) is in the domain of apronsfunction

Apronapid Blockstate State

aprons Block ↛ Apron

∙ apid = apron middot apid

Aprons

forallapid Block apron Apron | (apid apron) isin aprons

Taxiway is a path on an airport connecting an apron areato a runway through various other services In our modeltaxiway is defined as a schema consisting of taxiway identifierand a sequence of blocks defining a well-defined path

Taxiway

seq Blockpathtaxiwayid TaxiwayId

[TaxiwayId]

The Taxiways schema contains two components namelytaxiways and taxiingA The first one taxiways is a functionfrom taxiway identifier to TaxiwayThe second one taxiingAis a partial function from taxiway identifier to aircraftidentifier occupying the taxiway In predicate part it is statedthat the domain of taxiingA is contained in the domain oftaxiways function

taxiways TaxiwayId rarr Taxiway

taxiingA TaxiwayId AircraftId

∙ tid = taxiway middot taxiwayid

dom taxiingA sube dom taxiways

Taxiways

foralltid TaxiwayId taxiway Taxiway | (tid taxiway)isin taxiways

[AircraftId]

The airport topology consists of four schemas defin-ing graph gates aprons and taxiways In predicate partit is stated that every block in the domain of gates andaprons functions belongs to the node-set The intersection

of domains of gates and aprons functions is empty Furtherit is stated that every block of gate and apron area isconnected to a taxiwayThe paths in taxiways are representedas a sequence of blocks satisfying the invariants of theconnectivity relation It is stated that every element of a pathsequence is a block in the graph relation Any two consecutiveelements in path sequence constitute an edge in the graphrelation

Graph Gates Aprons Taxiways

foralltw ran taxiways

forallb1 dom gates cup dom aprons

∙ tw ran taxiways ∙ b2 ran tw middot pathexist exist

∙ (tw middot path i tw middot path (i + 1)) isin links

∙ (route i route (i + 1)) isin links

AirportTopology

dom gates cap dom aprons =

forallb Block gate Gate | (b gate) isin gates∙ gate middot gateid isin blocks

forallb Block apron Apron | (b apron) isin aprons∙ apron middot apid isin blocks

∙ path1 seq Block | w middot path = path1exist t

∙ foralli N | i isin dom path1 and i isin 1 path1 minus 1

∙ route seq Block ∙ foralli N | ge 1 and i lt routeexist i

An aircraft is specified by a schema Aircraft whichconsists of two components that is aircraft identifier and itssafe area The set of all permissible aircrafts at the airportis defined as a mapping from aircraft identifier to AircraftIn predicate part of the Aircrafts schema it is stated thatan intersection of safe areas of any two aircrafts is alwaysempty

Aircraftaircraftid AircraftIdsafeArea seq Block

aircrafts AircraftId rarr Aircraft

∙ aid = acr middot aircraftid

Aircrafts

forallac1 ac2 ran aircrafts ∙ ac1 middot safeArea capac2 middot safeArea =

forallaid AircraftId acr Aircraft | (aid acr)isin aircrafts

The gate controller defined below consists of four com-ponents The first one is Gates schema which is alreadydefined The second component is gatesR representing theaircrafts which have requested a gate The gatesR componentis defined as a sequence type to provide the service on firstcome and first serve basis The gatesA is the third componentrepresenting mapping from aircraft identifier to gateThe last

Abstract and Applied Analysis 5

one is pushbackR which is the set of aircrafts which haverequested for pushback from the gate

It is mentioned that relationship among all the compo-nents of the gate controller is defined in terms of propertiesTo capture invariants for completeness of the specificationeach component of the gate controller was selected and thenit identified any relationship if exists with the rest of thecomponents

Gates

gatesR seq AircraftId

↛gatesA AircraftId Gate

pushbackR F AircraftId

forallgate ran gates

∙ gate isin ran gatesA rArr gate middot gatestate =

OCCUPIED and

gate notin ran gatesA rArr gate middot gatestate = CLEAR

pushbackR sube dom gatesA

GateController

ran gatesR cap dom gatesA =

Invariants are as follows (i) if a gate is assigned to anaircraft it must be in the occupied state otherwise it is inthe clear state (ii) if a gate is assigned to an aircraft theaircraft cannot be in the list of aircrafts which have requesteda gate If an aircraft has requested a gate it cannot be in thelist of aircrafts which are assigned a gate (iii) if an aircrafthas requested pushback then aircraft must be in the list ofaircrafts which are assigned the gates

It was possible to specify gate and apron controllers usingthe same schema however we have defined it separatelybecause of the simplicity of the model The apron controllerconsists of aprons set of aircrafts which have requested forpushback clearance pushbackC sequence of aircrafts whichare in apron area apronQ and sequence of aircrafts whichhave requested for taxiing taxiingR Formal specificationof the apron controller is described below following theinvariants

Aprons

pushbackC FAircraftIdapronQ seq AircraftIdtaxiingR seq AircraftId

forallaid ran taxiingR ∙ aid isin ran apronQ and aidnotin pushbackC

forallaid pushbackC ∙ aid notin ran apronQ ran taxiingRcup

ApronController

forallaid ran apronQ ∙ aid notin pushbackC

Invariants are as follows (i) any aircraft which hasrequested pushback clearance cannot be in the list of aircraftsin the apron area (ii) if an aircraft is in the apron area

it has not requested the pushback clearance (iii) if anaircraft has requested taxiing it is in the apron area butnot in the list of aircrafts which has requested pushbackclearance

42 Dynamic Model Formal specification of operationsrequired for moving aircrafts from gate to taxiways isdescribed in this section The model is a part of the take-off procedure from gate to taxiing for updating state spaceof the airport There are three main facilities namely gatesaprons and taxiways which are managed by gate and aproncontrollers At first an aircraft is entered from gate to apronarea by communication of gate and apron controller After anaircraft is entered from apron area to taxiway it is controlledby the local controller

First of all an operation for gate request is defined belowAn aircraft sends a request for gate to the gate controllerby showing its identity After verifying the identity thegate controller accepts the request and adds the aircraftin the waiting list gatesR The operation is described bythe schema RequestGate which contains ΞApronControllerΔGateController and aircraft identifier aid as inputs Thestate of gate controller is updated by verifying the propertiesas pre- and postconditions It is noted that postconditionmust be satisfied after the successful execution of the oper-ation The symbol Ξ used in the schema shows that state ofapron controller is not changed The symbol Δ shows thatstate of gate controller is changed The symbol after aidvariable represents that it is an input variable The schemacomponents are put in first part and pre-postconditions aredescribed in second part of the schema

ΞApronController

ΔGateController

aid AircraftId

gatesA998400 = gatesA

pushbackR998400 = pushbackR

gatesR998400 = gatesR ⟨aid⟩

RequestGate

aid isin ran apronQ

aid notin ran gatesR

Pre-postconditions are as follows (i) the requesting air-craftmust be in the apron area (apronQ) (ii) the aircraft is notin the list of waiting list (gatesR) (iii) if the above conditionsare satisfied then aircraft is added to the waiting list (iv)the other two variables of gate controller are unchangedThe symbol ldquo 1015840 rdquo decorating a variable is used for its newstate

Formal definition of the gate assignment operation is pro-vided by the AssignGate schema The schema contains threecomponents namely ΔGateController aircraft identifier andgate as inputs in first part of the schemaThe gate is assignedby the gate controller in terms of pre- and postconditions inthe predicate part of the schema

6 Abstract and Applied Analysis

ΔGateController

aid AircraftIdgate Gate

aid isin ran gatesR

aid notin dom gatesA

gate isin ran gates

gate notin ran gatesA

gatesR998400 = gatesR

pushbackR998400 = pushbackR

gatesA998400 = gatesA cup (aid gate)↦

AssignGate

Pre-postconditions are as follows (i) the aircraftmust bein the waiting list of aircrafts (ii) the aircraft is not assigned agate (iii) the input gate belongs to the valid list of gates (iv)the gate is not assigned to any other aircraft (v) if the aboveconditions are satisfied then aircraft is assigned the gate (vi)the other two variables gateR and pushbackR of gate controllerare unchanged

The pushback request procedure is denoted by the Push-backRequest schema The schema consists of ΔApronCon-troller ΔGateController and aircraft identifier The schemadefinition is given below following pre-postconditions forupdating state space of gates

ΔApronController

ΔGateController

aid AircraftId

aid isin dom gatesA

aid notin pushbackR cap pushbackC

pushbackC998400 = pushbackC cup aid

pushbackR998400 = pushbackR cup aid

gatesA998400 = gatesA

gatesR998400 = gatesR

apronQ998400 = apronQ

taxiingR998400 = taxiingR

PushbackRequest

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate before sending a pushback request (ii)the aircraft neither has requested for pushback nor has apushback clearance (iii) the aircraft is added in the pushbackrequest of gate controller and pushback clearance list of aproncontroller (iv) the other variables gatesA and gatesR of gatescontroller and apronQ and taxiingR of apron controller areunchanged

The pushback procedure is denoted by Pushback schemaconsisting of five components namely ΔGateControllerΔApronController aircraft identifier apron identifier and

apron as given below The schema definition is given belowfollowing the pre-postconditions

ΔGateController

ΔApronController

aid AircraftIdapid Blockapron Apron

aid isin dom gatesA

aid isin pushbackR cap pushbackC

(apid apron) isin aprons

gatesR998400 = gatesR

taxiingR998400 = taxiingR

gatesA998400 = aid gatesA⩤

apronQ998400 = apronQ ⟨aid⟩

Pushback

aprons998400 = aprons cup (apid apron)↦

pushbackC998400 = pushbackCaid

pushbackR998400 = pushbackRaid

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate (ii) it is in the lists of pushback requestsand pushback clearance (iii) the aircraft is removed from thegate list (iv) the aircraft is removed from the pushback andclearance lists (v) the aircraft is allowed to enter the apronarea (vi) the rest of the variables of gate and apron controllersare unchanged

The taxi request procedure is defined below by usingTaxiRequest schema consisting of ΔApronController andaircrafts identifier The schema definition is given belowfollowing the informal description

ΔApronController

aid AircraftId

aid = apronQ 1

apronQ998400 = apronQ

pushbackC998400 = pushbackC

aid notin ran taxiingR

taxiingR998400 = taxiingR ⟨aid⟩

TaxiRequest

Pre-postconditions are as follows (i) the aircraft whichhas requested for taxiing is the first one in the queue inapron area (ii) the aircraft does not belong to the listof aircrafts waiting for taxiing (iii) the aircraft is addedin the list of aircrafts waiting for taxiing (iv) the othertwo variables apronQ and pushbackC of apron controllerremained unchanged

Finally formal procedure of leaving the apron area for anaircraft and entering into taxiway is described usingEnterTaxi

Abstract and Applied Analysis 7

schema which consists of ΔApronController ΔTaxiways air-craft taxiway identifier and taxiway The aircraft is removedfrom the waiting list of aircrafts by using the filter ldquordquooperation

ΔApronController

ΔTaxiways

acr Aircrafttid TaxiwayIdtaxiway Taxiway

acr middot aircraftid isin ran taxiingR

acr middot aircraftid = apronQ 1

taxiingR998400

apronQ998400

pushbackC998400 = pushbackC

taxiways998400 = taxiways

middot aircraftid ∙ i(i acr middot aircraftid) notin taxiingR and aid acrne

middot aircraftid ∙ i(i acr middot aircraftid) notin apronQ and aid acrne

taxiingR

apronQ

EnterTaxi

taxiingA998400 = taxiingA cup (tid acr middot aircraftid)↦

(tid taxiway) isin taxiways

= i N aid AircraftId | i isin dom taxiingR and

= i N aid AircraftId | i isin dom apronQand

Pre-postconditions are as follows (i) the aircraft musthave taxiing permission (ii) the aircraft which has requestedfor taxiing is the first one in the queue in the apron area(iii) after the aircraft has taxied it is removed from the listof aircrafts having permission for taxiing and from the apronarea (iv) the rest of the variables of apron controller remainedunchanged

5 Model Analysis

In this section formal analysis of the specification is providedusing ZEves toolset Aswe know there does not exist any realcomputer tool which may assure complete correctness of for-mal specificationThat means even if the formal specificationis written well it may cause potential errors Hence an art ofwriting formal specification does not provide any guaranteeabout correctness of the model If the formal specification ofa system is analysed with a computer tool it improves theconfidence by identifying errors if it exists in the model

The ZEves is a powerful tool used here for analysing theformal specification of a part of the air traffic control systemresponsible for aircraftmovement from gate to the active areafor taxiing Some schemas of the formalmodel are checked tobe correct while the others are proved by reduction techniqueavailable in the tool

Table 1 Results of model analysis

Schema Name Syntax typecheck

Domaincheck Reduction Proof by

reductionGraph Y Y Ylowast YGate Gates Y Y NA YApron Aprons Y Y NA YTaxiway Taxiways Y Y NA YAirportTopology Y Y Ylowast YAircraft Aircrafts Y Y NA YGateController Y Y NA YApronController Y Y NA YRequestGate Y Y Ylowast YAssignGate Y Y NA YPushbackRequest Y Y NA YPushback Y Y Ylowast YTaxiRequest Y Y Ylowast YEnterTaxi Y Y Ylowast Y

Summary of the results is provided in Table 1 In firstcolumn of the table name of the schema is provided Thesecond column is used for syntax and type checking Thedomain checks proofs in the tool guarantees the consis-tency of the formal specifications for axiomatic declarationsDomain checking is done in column 3 Proof by reductionis a technique in which equivalent simpler combinations oftactics is substituted Reduction and proof by reduction arerepresented in columns 4 and 5 respectively The symbolldquoYrdquo in the table indicates that all schemas are proved to becorrect automatically The symbol ldquoYrdquo annotated with ldquolowastrdquoshows that the schema is proved to be correct by reductiontechnique The symbol ldquoNArdquo in 4th column is used to meanthat reduction is not required on the predicates and hencethe formal specification is proved to be written well andmeaningful

6 Conclusion

In this paper we have described a formal procedure forair traffic flow management from gate to taxiing in airtraffic control (ATC) system Initially we have describedfundamental components for description of the requiredsystemThe airport surface is represented using graph theoryas a part of static model We observed that graph modelwas an effective one for defining connectivity relation andappropriate taxing routs Dynamic model is described formanipulating critical information based on the static modelSafety properties are described in terms of invariants overthe components in the static model Pre- and postconditionsare used to define safety criteria in the operational system toavoid any unwanted situation Z notation is applied becauseof its rigorous and abstract nature for formal analysis of thiscritical system

We observed that the complexity of the ATC system wasreduced by decomposing into its components The use ofschema structure in Z notation facilitated both in the static

8 Abstract and Applied Analysis

and dynamic parts of the model Systematic developmentfrom abstraction to detailed model made it easy to proposea simple and abstract model

There exists much work on modelling of ATC systemhowever it needs more research to address next generationautomated systems achieving the required level of safety andefficiency The work of Michael and Steven is close to this inwhich gate management and ramp operations are analysedfor reducing delay time fuel burning and other costs [48]In their work the approach is fairly conservative based onobservations and results are not fully verified and established

Various benefits describing formal specification ofthe system were observed For example modelling ofcomponent-based system provided us with a completecharacterization at a higher level of abstraction On theother hand if the system was specified at a more detailedlevel intuition may have been lost Compositional approachenabled us to give reasoning about the components andsubsequently the entire system Further advantages of aformal model can be observed after refinement The detailedmodel can be achieved after a series of refinements whileguaranteeing the transformation of syntax and semanticsrules

A clear scope and set of assumptions were definedbefore producing a mathematical model of the system It ismentioned that this formal model can be applied to an ATCsystem after a further refinement and analysisThis is becausewe have defined the properties based on the requirements ofa real ATC system

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

References

[1] J VilliersERASMUSmdashAFriendlyWay for Breaking the CapacityBarrier ITA 2004

[2] H Erzberger ldquoTransforming the NAS the next generationair traffic control systemrdquo in Proceedings of the InternationalCongress of the Aeronautical Sciences 2004

[3] H Erzberger ldquoAutomated conflict resolution for air trafficcontrolrdquo in Proceedings of the 25th International Congress of theAeronautical Sciences 2006

[4] H Erzberger and K Heere ldquoAlgorithm and operational conceptfor resolving short range conflictsrdquo Journal of Aerospace Engi-neering vol 224 pp 225ndash243 2009

[5] T Farley and H Erzberger ldquoFast time air traffic simulation of aconflict resolution algorithm under high air traffic demandrdquo inProceedings of the USA Europe ATM Seminar 2007

[6] J Hu M Prandini and S Sastry ldquoOptimal maneuver formultiple aircraft conflict resolution a braid point of viewrdquo inProceedings of the 39th IEEE Confernce on Decision and Controlvol 4 pp 4164ndash4169 December 2000

[7] S T Shorrock and B Kirwan ldquoDevelopment and application ofa human error identification tool for air traffic controlrdquo AppliedErgonomics vol 33 no 4 pp 319ndash336 2002

[8] N E Debbache ldquoToward a new organization for air trafficcontrolrdquo Aircraft Engineering and Aerospace Technology vol 73no 6 pp 561ndash567 2001

[9] W Marshall and W I Joseph ldquoAirport movement area safetysystemrdquo in Proceedings of the IEEE Digital Avionics SystemsConference pp 549ndash552 1992

[10] Y Guo X Cao and J Zhang ldquoConstraint handling based mul-tiobjective evolutionary algorithm for aircraft landing schedul-ingrdquo International Journal of Innovative Computing Informationand Control vol 5 no 8 pp 2229ndash2238 2009

[11] G J Couluris R K Fong M B Downs et al ldquoA new modelingcapability for airport surface traffic analysisrdquo in Proceedings ofthe IEEEAIAA 27th Digital Avionics Systems Conference (DASCrsquo08) pp E41ndashE411 October 2008

[12] J M SpiveyThe Z Notation A Reference manual Prentice HallLondon UK 1992

[13] European Electro-Technical Standardization ldquoRailway applica-tions communications signaling and processing systems soft-ware for railway control and protection systemsrdquoThe EuropeanStandard BS EN 50128 2001

[14] J Garcıa A Berlanga J M Molina J A Besada and J RCasar ldquoPlanning techniques for airport ground operationsrdquo inProceedings of the 21st Digital Avionics Systems Conference 2002

[15] P M Moertl J M Hitt II S Atkins C Brinton and D HWalton ldquoFactors for predicting airport surface characteristicsand prediction accuracy of the surface management systemrdquoin Proceedings of the IEEE International Conference on SystemsMan and Cybernetics pp 3798ndash3803 October 2003

[16] T T B Hanh and D V Hung ldquoVerification of an air trafficcontrol system with probabilistic real-time model checkingrdquoTech Rep 355 UNU-IIST 2007

[17] G J M Koeners E P Stout and R M Rademaker ldquoImprovingtaxi traffic flow by real-time runway sequence optimizationusing dynamic taxi route planningrdquo in Proceedings of the 30thIEEEAIAA Digital Avionics Systems Conference (DASC rsquo11)October 2011

[18] G J M Koeners and R M Rademaker ldquoAnalyze possiblebenefits of real-time taxi flow optimization using actual datardquoin Proceedings of the 30th Digital Avionics Systems Conference(DASC rsquo11) Fremont Calif USA October 2011

[19] S Amy J S Philip and B Charles Ramp Control Issues inthe Design of a Surface Management System Cognitive SystemsEngineering Laboratory The Ohio State University 2002

[20] M Kwiatkowska G Norman J Sproston and F Wang ldquoSym-bolic model checking for probabilistic timed automatardquo in JointConference on Formal Modeling and Analysis of Timed Systemsand Formal Techniques in Real-Time and Fault Tolerant Systemsvol 3253 of Lecture Notes in Computer Science pp 293ndash208Springer 2004

[21] M Nguyen-Duc J-P Briot A Drogoul and V Duong ldquoAnapplication of multi-agent coordination techniques in air trafficmanagementrdquo in Proceedings of the IEEEWIC InternationalConference on Intelligent Agent Technology pp 622ndash628 Octo-ber 2003

[22] L C Yang and J K Kuchar ldquoPrototype conflict alerting systemfor free flightrdquo Journal of Guidance Control and Dynamics vol20 no 4 pp 768ndash773 1997

[23] D P Alves L Weigang B Bueno and B B Souza ldquoReinforce-ment learning to support meta-level control in air traffic man-agementrdquo in Reinforcement Learning Theory and Applicationspp 357ndash372 ARS Publishing 2008

Abstract and Applied Analysis 9

[24] L Weigang M V P Dib D P Alves and A M F CrespoldquoIntelligent computingmethods in air traffic flowmanagementrdquoTransportation Research C Emerging Technologies vol 18 no 5pp 781ndash793 2010

[25] A Cavcar and M Cavcar ldquoImpact of aircraft performance dif-ferences on fuel consumption of aircraft in air of managementenvironmentrdquo Aircraft Engineering and Aerospace Technologyvol 76 no 5 pp 502ndash515 2004

[26] I Hwang andC Tomlin ldquoProtocol-based conflict resolution forfinite information horizonrdquo inProceedings of the IEEEAmericanControl Conference (ACC rsquo02) pp 748ndash753 Piscataway NJUSA May 2002

[27] I Hwang J Hwang andC Tomlin ldquoFlight-mode-based aircraftconflict detection using a residual-mean interacting multiplemodel algorithmrdquo in Proceedings of the AIAA Guidance Navi-gation and Control Conference 2003

[28] I Hwang H Balakrishnan K Roy and C Tomlin ldquoTargettracking and identity management in clutter for air trafficcontrolrdquo in Proceedings of the American Control Conference(AAC rsquo04) 2004

[29] K Bousson ldquoWaypoint-constrained free flight collision avoid-ancerdquo in Proceedings of the SAE Advances in Aviation SafetyConference 2003

[30] S Kahne and I Frolow ldquoAir trafficmanagement evolution withtechnologyrdquo IEEE Control Systems Magazine vol 16 no 4 pp12ndash21 1996

[31] M S Nolan Fundamentals of Air Traffic Control BrooksColeWadsworth Ohio USA 3rd edition 1998

[32] J K Kuchar and L C Yang ldquoA review of conflict detection andresolution modeling methodsrdquo IEEE Transactions on IntelligentTransportation Systems vol 1 no 4 pp 179ndash189 2000

[33] J Hu M Pradini and S Sastry ldquoOptimal coordinated maneu-vers for three-dimensional aircraft conflict resolutionrdquo Journalof Guidance Control and Dynamics vol 25 no 5 pp 888ndash9002002

[34] S R Wolfe F Y Enomoto P A Jarvis and M SierhuisldquoComparing route selection strategies in collaborative trafficflowmanagementrdquo in Proceedings of the IEEE Computer SocietyTechnical Committee on Intelligent Informatics (TCII rsquo07) pp59ndash62 November 2007

[35] S Yousaf N A Zafar and S A Khan ldquoFormal analysis ofdeparture procedure of air traffic control systemrdquo in Proceedingsof the 2nd International Conference on Software Technology andEngineering (ICSTE rsquo10) pp 301ndash305 October 2010

[36] N A Zafar and K Araki ldquoFormalizing moving block railwayinterlocking system for directed networkrdquo Research Reportson Information Science and Electrical Engineering of KyushuUniversity vol 8 no 2 pp 109ndash114 2003

[37] N A Zafar ldquoModeling and formal specification of automatedtrain control system using Z notationrdquo in Proceedings of theIEEE InternationalMultitopic Conference (INMIC rsquo06) pp 438ndash443 December 2006

[38] N A Zafar S A Khan and K Araki ldquoTowards the safetyproperties of moving block railway interlocking systemrdquo Inter-national Journal of Innovative Computing Information andControl vol 8 no 8 pp 5677ndash5690 2012

[39] N A Zafar ldquoSafety control management at airport taxiing totake-off procedurerdquo The Arab Journal of Science and Engineer-ing In press

[40] R Banach C Jeske A Hall and S Stepney ldquoRetrenchmentand the atomicity patternrdquo in Proceedings of the 5th IEEE

International Conference on Software Engineering and FormalMethods (SEFM rsquo07) pp 37ndash46 September 2007

[41] A C Garcia H Idris R Vivona and S Green ldquoCommonaircraft performancemodeling evaluation tools and experimentresultsrdquo in Proceedings of the 24th Digital Avionics SystemsConference (DASC rsquo05) pp 51ndash59 2005

[42] M Jamal and N A Zafar ldquoFormal model of computer-basedair traffic control system using Z notationrdquo in Proceedingsof the 17th International Conference on Computer Theory andApplications 2007

[43] M Jamal and N A Zafar ldquoRequirements analysis of airtraffic control system using formal methodsrdquo in Proceedingsof the International Conference on Information and EmergingTechnologies (ICIET rsquo07) pp 216ndash222 July 2007

[44] M Medina L Sherry and M Feary ldquoAutomation for taskanalysis of next generation air traffic management systemsrdquoTransportation Research C Emerging Technologies vol 18 no6 pp 921ndash929 2010

[45] S Pickin C Jard T Jeron J-M Jezequel and Y Le TraonldquoTest synthesis fromUMLmodels of distributed softwarerdquo IEEETransactions on Software Engineering vol 33 no 4 pp 252ndash2692007

[46] A M F Crespo C V Aquino B B Souza L Weigang A CM A Melo A and D P Alves ldquoDistributed decision supportsystem applied to tactical air traffic flow management in caseof CINDACTA Irdquo Journal of the Brazilian Air TransportationResearch Society vol 4 no 1 pp 47ndash60 2008

[47] C Livadas J Lygeros and N A Lynch ldquoHigh-level modelingand analysis of the TrafficAlert andCollisionAvoidance System(TCAS)rdquo Proceedings of the IEEE vol 88 no 7 pp 926ndash9472000

[48] C Michael and S Steven ldquoManaging gate and ramp operationsto reduce delay fuel burn and costsrdquo in Proceedings of theIntegrated Communications Navigation and Surveillance Con-ference (ICNS rsquo12) 2012

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Abstract and Applied Analysis 3

decision is based on various factors for example gate pilotpreference and traffic size After reaching the runway theaircraft is put into the departure queue and then takes offafter the final permission To complete this whole procedurethe surface management system collects information fromvarious sources and then flight plan including gate leavingapron area occupation taxiway entering departure time andrunway assignment route is prepared

It is noted that the departure runway might be assignedafter pushback request is received This is because thedeparture runway can only be predicted if we are able topredict the time between pushback and the takeoff Variousfactors are involved assigning departing aircraft to a runwayFor example how the airport runways are configured forarriving and departing traffic which totally depends on theairport From gate to take-off few major reasons for delayin a flight are as follows (i) unoptimized calculation ofdeparture sequence because of various airport states causingstate space explosion (ii) inefficient push back proceduresbecause of dynamic change at airport (iii) revisiting routesequences because of accommodating priorities and (iv)apron controllers do not have full support to accommodateairline priorities because of lack of automated functioningsupport As a result it causes an irregular operation of apronand gate controllers

In our model a formal approach is developed to expediteairport traffic from gate to apron and taxiways throughintegration of various controllers It is noted that detailedinformation for example weather conditions wind speedand direction which may change the runway configurationin reality is not considered in our model in defining routesequence Further aircraft type and weight are also notconsidered In this way same length of route is assumed forevery type of an aircraft in our model In the model twoseparate queues are maintained each one for entering apronarea and taxiways Aircraft position taxiway location andrunway are provided by the surface surveillance systemwhichis usually integrated with GIS Such integration issues are alsoout of the scope of this research

In static part of the model the airport surface is dividedinto different regions and then transformed into a graph Inthe transformation a small unit (block) of airport surface isrepresented as a node and connectivity between two blocksis assumed as an edge in the graph As we have supposeddifferent routes for take-off and landing procedures in ourmodel hence the resultantmodel is a directed graph relationHowever a gate can be used for both incoming and departingflightsThe objective is to find and assign an appropriate routefrom gate to taxiing an aircraft Assigning gates and definingaprons and connectivity from apron to active area for taxiingare three main activities addressed in the dynamic part ofsystem

In the operational system initially an aircraft sendsa pushback request to the gate controller The pushbackoperation is executed after having a clearance from the aproncontroller Next the aircraft sends a request for taxi clearanceThe clearance is awarded to the aircraft for taxiing aftercommunication of apron controller and the air traffic controltower

4 Formal Modelling Using Z Notation

Safety and efficiency are two core requirements in safeand normal operation of an ATC system Safety requires awell-defined sequence of patterns whereas efficiency needsexpeditious movement of aircrafts In this section formalprocedure of aircrafts movement from gate to active areafor taxiing is described Formal rules are defined to preventcollisions and expedite the flow of traffic by maintaining aqueue of aircrafts using Z notation

41 Static Model First of all formal specification of airportsurface is described based on the graph relationThe smallestsurface unit of the airport is represented by a Block which isnode in the graph relation The connectivity of two blocksis represented by a link which is an edge in the graph Theordered pair (119906 V) in the edge-set means an aircraft canmovefrom node 119906 to node V

[Block] 119871119894119899119896119904 == 119909 119910 119861119897119900119888119896 | 119909 = 119910 ∙ (119909 119910)

Formal specification of the graph relation is describedby the schema Graph The schema consists of two partsdivided in horizontal form definition and predicate parts Infirst part of the schema variables definitions are given andinvariants are described in predicate part of the schema Theschema consists of two components that is block-set andlink-setThe block-set is defined as a finite power set of BlockThe link-set is a finite power set of Links which is in fact theset of all the possible edges of the graph relation

In predicate part it is stated that both ends of any edge arenodes which is a natural constraint in graph relation Furtherevery block is an end of an edge that is there is no isolatedblock Finally for any two blocks there is a path in the graphrelation because it is supposed that it is possible tomove fromone block to any other block at the airport surface

blocks FBlock

links FLinks

forallb1 b2 blocks ∙ path seq Blockexist

Graph

forallb1 b2 Block | (b1 b2) isin links ∙ b1 isin blocks and b2isin blocks

existforallb blocks ∙ b1 b2 Block | (b1 b2) isin links∙ b = b1 or b = b2

∙ foralli N | i ge 1 and i lt path ∙ (path i path (i + 1))isin links

Passenger gate is represented by the Gate schema con-stituted by two components that is gate identifier and gatestate The state variable has values clear or occupied Theset of gates is defined by the partial function gates from gateidentifier to Gate schema The Gates schema is a set of all thegates at airports which can be assigned to an aircraft

Gategateid Blockgatestate State

State= CLEAR | OCCUPIED

4 Abstract and Applied Analysis

gates Block Gate↛

Gates

forallgid Block gate Gate | (gid gate) isin gates∙ gid = gate middot gateid

Apron area is used for preflight activities includingparking waiting andmaintenance As there is an associationrelationship between apron area and gate hence apron isneeded to be defined as a separate entity which consistsof apron identifier and its state The identifier is assumedas a block The set of aprons is a partial function fromapron identifier to apron schema In predicate part it isstated that for every apron identifier apid and schema apronthe ordered pair (apid apron) is in the domain of apronsfunction

Apronapid Blockstate State

aprons Block ↛ Apron

∙ apid = apron middot apid

Aprons

forallapid Block apron Apron | (apid apron) isin aprons

Taxiway is a path on an airport connecting an apron areato a runway through various other services In our modeltaxiway is defined as a schema consisting of taxiway identifierand a sequence of blocks defining a well-defined path

Taxiway

seq Blockpathtaxiwayid TaxiwayId

[TaxiwayId]

The Taxiways schema contains two components namelytaxiways and taxiingA The first one taxiways is a functionfrom taxiway identifier to TaxiwayThe second one taxiingAis a partial function from taxiway identifier to aircraftidentifier occupying the taxiway In predicate part it is statedthat the domain of taxiingA is contained in the domain oftaxiways function

taxiways TaxiwayId rarr Taxiway

taxiingA TaxiwayId AircraftId

∙ tid = taxiway middot taxiwayid

dom taxiingA sube dom taxiways

Taxiways

foralltid TaxiwayId taxiway Taxiway | (tid taxiway)isin taxiways

[AircraftId]

The airport topology consists of four schemas defin-ing graph gates aprons and taxiways In predicate partit is stated that every block in the domain of gates andaprons functions belongs to the node-set The intersection

of domains of gates and aprons functions is empty Furtherit is stated that every block of gate and apron area isconnected to a taxiwayThe paths in taxiways are representedas a sequence of blocks satisfying the invariants of theconnectivity relation It is stated that every element of a pathsequence is a block in the graph relation Any two consecutiveelements in path sequence constitute an edge in the graphrelation

Graph Gates Aprons Taxiways

foralltw ran taxiways

forallb1 dom gates cup dom aprons

∙ tw ran taxiways ∙ b2 ran tw middot pathexist exist

∙ (tw middot path i tw middot path (i + 1)) isin links

∙ (route i route (i + 1)) isin links

AirportTopology

dom gates cap dom aprons =

forallb Block gate Gate | (b gate) isin gates∙ gate middot gateid isin blocks

forallb Block apron Apron | (b apron) isin aprons∙ apron middot apid isin blocks

∙ path1 seq Block | w middot path = path1exist t

∙ foralli N | i isin dom path1 and i isin 1 path1 minus 1

∙ route seq Block ∙ foralli N | ge 1 and i lt routeexist i

An aircraft is specified by a schema Aircraft whichconsists of two components that is aircraft identifier and itssafe area The set of all permissible aircrafts at the airportis defined as a mapping from aircraft identifier to AircraftIn predicate part of the Aircrafts schema it is stated thatan intersection of safe areas of any two aircrafts is alwaysempty

Aircraftaircraftid AircraftIdsafeArea seq Block

aircrafts AircraftId rarr Aircraft

∙ aid = acr middot aircraftid

Aircrafts

forallac1 ac2 ran aircrafts ∙ ac1 middot safeArea capac2 middot safeArea =

forallaid AircraftId acr Aircraft | (aid acr)isin aircrafts

The gate controller defined below consists of four com-ponents The first one is Gates schema which is alreadydefined The second component is gatesR representing theaircrafts which have requested a gate The gatesR componentis defined as a sequence type to provide the service on firstcome and first serve basis The gatesA is the third componentrepresenting mapping from aircraft identifier to gateThe last

Abstract and Applied Analysis 5

one is pushbackR which is the set of aircrafts which haverequested for pushback from the gate

It is mentioned that relationship among all the compo-nents of the gate controller is defined in terms of propertiesTo capture invariants for completeness of the specificationeach component of the gate controller was selected and thenit identified any relationship if exists with the rest of thecomponents

Gates

gatesR seq AircraftId

↛gatesA AircraftId Gate

pushbackR F AircraftId

forallgate ran gates

∙ gate isin ran gatesA rArr gate middot gatestate =

OCCUPIED and

gate notin ran gatesA rArr gate middot gatestate = CLEAR

pushbackR sube dom gatesA

GateController

ran gatesR cap dom gatesA =

Invariants are as follows (i) if a gate is assigned to anaircraft it must be in the occupied state otherwise it is inthe clear state (ii) if a gate is assigned to an aircraft theaircraft cannot be in the list of aircrafts which have requesteda gate If an aircraft has requested a gate it cannot be in thelist of aircrafts which are assigned a gate (iii) if an aircrafthas requested pushback then aircraft must be in the list ofaircrafts which are assigned the gates

It was possible to specify gate and apron controllers usingthe same schema however we have defined it separatelybecause of the simplicity of the model The apron controllerconsists of aprons set of aircrafts which have requested forpushback clearance pushbackC sequence of aircrafts whichare in apron area apronQ and sequence of aircrafts whichhave requested for taxiing taxiingR Formal specificationof the apron controller is described below following theinvariants

Aprons

pushbackC FAircraftIdapronQ seq AircraftIdtaxiingR seq AircraftId

forallaid ran taxiingR ∙ aid isin ran apronQ and aidnotin pushbackC

forallaid pushbackC ∙ aid notin ran apronQ ran taxiingRcup

ApronController

forallaid ran apronQ ∙ aid notin pushbackC

Invariants are as follows (i) any aircraft which hasrequested pushback clearance cannot be in the list of aircraftsin the apron area (ii) if an aircraft is in the apron area

it has not requested the pushback clearance (iii) if anaircraft has requested taxiing it is in the apron area butnot in the list of aircrafts which has requested pushbackclearance

42 Dynamic Model Formal specification of operationsrequired for moving aircrafts from gate to taxiways isdescribed in this section The model is a part of the take-off procedure from gate to taxiing for updating state spaceof the airport There are three main facilities namely gatesaprons and taxiways which are managed by gate and aproncontrollers At first an aircraft is entered from gate to apronarea by communication of gate and apron controller After anaircraft is entered from apron area to taxiway it is controlledby the local controller

First of all an operation for gate request is defined belowAn aircraft sends a request for gate to the gate controllerby showing its identity After verifying the identity thegate controller accepts the request and adds the aircraftin the waiting list gatesR The operation is described bythe schema RequestGate which contains ΞApronControllerΔGateController and aircraft identifier aid as inputs Thestate of gate controller is updated by verifying the propertiesas pre- and postconditions It is noted that postconditionmust be satisfied after the successful execution of the oper-ation The symbol Ξ used in the schema shows that state ofapron controller is not changed The symbol Δ shows thatstate of gate controller is changed The symbol after aidvariable represents that it is an input variable The schemacomponents are put in first part and pre-postconditions aredescribed in second part of the schema

ΞApronController

ΔGateController

aid AircraftId

gatesA998400 = gatesA

pushbackR998400 = pushbackR

gatesR998400 = gatesR ⟨aid⟩

RequestGate

aid isin ran apronQ

aid notin ran gatesR

Pre-postconditions are as follows (i) the requesting air-craftmust be in the apron area (apronQ) (ii) the aircraft is notin the list of waiting list (gatesR) (iii) if the above conditionsare satisfied then aircraft is added to the waiting list (iv)the other two variables of gate controller are unchangedThe symbol ldquo 1015840 rdquo decorating a variable is used for its newstate

Formal definition of the gate assignment operation is pro-vided by the AssignGate schema The schema contains threecomponents namely ΔGateController aircraft identifier andgate as inputs in first part of the schemaThe gate is assignedby the gate controller in terms of pre- and postconditions inthe predicate part of the schema

6 Abstract and Applied Analysis

ΔGateController

aid AircraftIdgate Gate

aid isin ran gatesR

aid notin dom gatesA

gate isin ran gates

gate notin ran gatesA

gatesR998400 = gatesR

pushbackR998400 = pushbackR

gatesA998400 = gatesA cup (aid gate)↦

AssignGate

Pre-postconditions are as follows (i) the aircraftmust bein the waiting list of aircrafts (ii) the aircraft is not assigned agate (iii) the input gate belongs to the valid list of gates (iv)the gate is not assigned to any other aircraft (v) if the aboveconditions are satisfied then aircraft is assigned the gate (vi)the other two variables gateR and pushbackR of gate controllerare unchanged

The pushback request procedure is denoted by the Push-backRequest schema The schema consists of ΔApronCon-troller ΔGateController and aircraft identifier The schemadefinition is given below following pre-postconditions forupdating state space of gates

ΔApronController

ΔGateController

aid AircraftId

aid isin dom gatesA

aid notin pushbackR cap pushbackC

pushbackC998400 = pushbackC cup aid

pushbackR998400 = pushbackR cup aid

gatesA998400 = gatesA

gatesR998400 = gatesR

apronQ998400 = apronQ

taxiingR998400 = taxiingR

PushbackRequest

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate before sending a pushback request (ii)the aircraft neither has requested for pushback nor has apushback clearance (iii) the aircraft is added in the pushbackrequest of gate controller and pushback clearance list of aproncontroller (iv) the other variables gatesA and gatesR of gatescontroller and apronQ and taxiingR of apron controller areunchanged

The pushback procedure is denoted by Pushback schemaconsisting of five components namely ΔGateControllerΔApronController aircraft identifier apron identifier and

apron as given below The schema definition is given belowfollowing the pre-postconditions

ΔGateController

ΔApronController

aid AircraftIdapid Blockapron Apron

aid isin dom gatesA

aid isin pushbackR cap pushbackC

(apid apron) isin aprons

gatesR998400 = gatesR

taxiingR998400 = taxiingR

gatesA998400 = aid gatesA⩤

apronQ998400 = apronQ ⟨aid⟩

Pushback

aprons998400 = aprons cup (apid apron)↦

pushbackC998400 = pushbackCaid

pushbackR998400 = pushbackRaid

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate (ii) it is in the lists of pushback requestsand pushback clearance (iii) the aircraft is removed from thegate list (iv) the aircraft is removed from the pushback andclearance lists (v) the aircraft is allowed to enter the apronarea (vi) the rest of the variables of gate and apron controllersare unchanged

The taxi request procedure is defined below by usingTaxiRequest schema consisting of ΔApronController andaircrafts identifier The schema definition is given belowfollowing the informal description

ΔApronController

aid AircraftId

aid = apronQ 1

apronQ998400 = apronQ

pushbackC998400 = pushbackC

aid notin ran taxiingR

taxiingR998400 = taxiingR ⟨aid⟩

TaxiRequest

Pre-postconditions are as follows (i) the aircraft whichhas requested for taxiing is the first one in the queue inapron area (ii) the aircraft does not belong to the listof aircrafts waiting for taxiing (iii) the aircraft is addedin the list of aircrafts waiting for taxiing (iv) the othertwo variables apronQ and pushbackC of apron controllerremained unchanged

Finally formal procedure of leaving the apron area for anaircraft and entering into taxiway is described usingEnterTaxi

Abstract and Applied Analysis 7

schema which consists of ΔApronController ΔTaxiways air-craft taxiway identifier and taxiway The aircraft is removedfrom the waiting list of aircrafts by using the filter ldquordquooperation

ΔApronController

ΔTaxiways

acr Aircrafttid TaxiwayIdtaxiway Taxiway

acr middot aircraftid isin ran taxiingR

acr middot aircraftid = apronQ 1

taxiingR998400

apronQ998400

pushbackC998400 = pushbackC

taxiways998400 = taxiways

middot aircraftid ∙ i(i acr middot aircraftid) notin taxiingR and aid acrne

middot aircraftid ∙ i(i acr middot aircraftid) notin apronQ and aid acrne

taxiingR

apronQ

EnterTaxi

taxiingA998400 = taxiingA cup (tid acr middot aircraftid)↦

(tid taxiway) isin taxiways

= i N aid AircraftId | i isin dom taxiingR and

= i N aid AircraftId | i isin dom apronQand

Pre-postconditions are as follows (i) the aircraft musthave taxiing permission (ii) the aircraft which has requestedfor taxiing is the first one in the queue in the apron area(iii) after the aircraft has taxied it is removed from the listof aircrafts having permission for taxiing and from the apronarea (iv) the rest of the variables of apron controller remainedunchanged

5 Model Analysis

In this section formal analysis of the specification is providedusing ZEves toolset Aswe know there does not exist any realcomputer tool which may assure complete correctness of for-mal specificationThat means even if the formal specificationis written well it may cause potential errors Hence an art ofwriting formal specification does not provide any guaranteeabout correctness of the model If the formal specification ofa system is analysed with a computer tool it improves theconfidence by identifying errors if it exists in the model

The ZEves is a powerful tool used here for analysing theformal specification of a part of the air traffic control systemresponsible for aircraftmovement from gate to the active areafor taxiing Some schemas of the formalmodel are checked tobe correct while the others are proved by reduction techniqueavailable in the tool

Table 1 Results of model analysis

Schema Name Syntax typecheck

Domaincheck Reduction Proof by

reductionGraph Y Y Ylowast YGate Gates Y Y NA YApron Aprons Y Y NA YTaxiway Taxiways Y Y NA YAirportTopology Y Y Ylowast YAircraft Aircrafts Y Y NA YGateController Y Y NA YApronController Y Y NA YRequestGate Y Y Ylowast YAssignGate Y Y NA YPushbackRequest Y Y NA YPushback Y Y Ylowast YTaxiRequest Y Y Ylowast YEnterTaxi Y Y Ylowast Y

Summary of the results is provided in Table 1 In firstcolumn of the table name of the schema is provided Thesecond column is used for syntax and type checking Thedomain checks proofs in the tool guarantees the consis-tency of the formal specifications for axiomatic declarationsDomain checking is done in column 3 Proof by reductionis a technique in which equivalent simpler combinations oftactics is substituted Reduction and proof by reduction arerepresented in columns 4 and 5 respectively The symbolldquoYrdquo in the table indicates that all schemas are proved to becorrect automatically The symbol ldquoYrdquo annotated with ldquolowastrdquoshows that the schema is proved to be correct by reductiontechnique The symbol ldquoNArdquo in 4th column is used to meanthat reduction is not required on the predicates and hencethe formal specification is proved to be written well andmeaningful

6 Conclusion

In this paper we have described a formal procedure forair traffic flow management from gate to taxiing in airtraffic control (ATC) system Initially we have describedfundamental components for description of the requiredsystemThe airport surface is represented using graph theoryas a part of static model We observed that graph modelwas an effective one for defining connectivity relation andappropriate taxing routs Dynamic model is described formanipulating critical information based on the static modelSafety properties are described in terms of invariants overthe components in the static model Pre- and postconditionsare used to define safety criteria in the operational system toavoid any unwanted situation Z notation is applied becauseof its rigorous and abstract nature for formal analysis of thiscritical system

We observed that the complexity of the ATC system wasreduced by decomposing into its components The use ofschema structure in Z notation facilitated both in the static

8 Abstract and Applied Analysis

and dynamic parts of the model Systematic developmentfrom abstraction to detailed model made it easy to proposea simple and abstract model

There exists much work on modelling of ATC systemhowever it needs more research to address next generationautomated systems achieving the required level of safety andefficiency The work of Michael and Steven is close to this inwhich gate management and ramp operations are analysedfor reducing delay time fuel burning and other costs [48]In their work the approach is fairly conservative based onobservations and results are not fully verified and established

Various benefits describing formal specification ofthe system were observed For example modelling ofcomponent-based system provided us with a completecharacterization at a higher level of abstraction On theother hand if the system was specified at a more detailedlevel intuition may have been lost Compositional approachenabled us to give reasoning about the components andsubsequently the entire system Further advantages of aformal model can be observed after refinement The detailedmodel can be achieved after a series of refinements whileguaranteeing the transformation of syntax and semanticsrules

A clear scope and set of assumptions were definedbefore producing a mathematical model of the system It ismentioned that this formal model can be applied to an ATCsystem after a further refinement and analysisThis is becausewe have defined the properties based on the requirements ofa real ATC system

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

References

[1] J VilliersERASMUSmdashAFriendlyWay for Breaking the CapacityBarrier ITA 2004

[2] H Erzberger ldquoTransforming the NAS the next generationair traffic control systemrdquo in Proceedings of the InternationalCongress of the Aeronautical Sciences 2004

[3] H Erzberger ldquoAutomated conflict resolution for air trafficcontrolrdquo in Proceedings of the 25th International Congress of theAeronautical Sciences 2006

[4] H Erzberger and K Heere ldquoAlgorithm and operational conceptfor resolving short range conflictsrdquo Journal of Aerospace Engi-neering vol 224 pp 225ndash243 2009

[5] T Farley and H Erzberger ldquoFast time air traffic simulation of aconflict resolution algorithm under high air traffic demandrdquo inProceedings of the USA Europe ATM Seminar 2007

[6] J Hu M Prandini and S Sastry ldquoOptimal maneuver formultiple aircraft conflict resolution a braid point of viewrdquo inProceedings of the 39th IEEE Confernce on Decision and Controlvol 4 pp 4164ndash4169 December 2000

[7] S T Shorrock and B Kirwan ldquoDevelopment and application ofa human error identification tool for air traffic controlrdquo AppliedErgonomics vol 33 no 4 pp 319ndash336 2002

[8] N E Debbache ldquoToward a new organization for air trafficcontrolrdquo Aircraft Engineering and Aerospace Technology vol 73no 6 pp 561ndash567 2001

[9] W Marshall and W I Joseph ldquoAirport movement area safetysystemrdquo in Proceedings of the IEEE Digital Avionics SystemsConference pp 549ndash552 1992

[10] Y Guo X Cao and J Zhang ldquoConstraint handling based mul-tiobjective evolutionary algorithm for aircraft landing schedul-ingrdquo International Journal of Innovative Computing Informationand Control vol 5 no 8 pp 2229ndash2238 2009

[11] G J Couluris R K Fong M B Downs et al ldquoA new modelingcapability for airport surface traffic analysisrdquo in Proceedings ofthe IEEEAIAA 27th Digital Avionics Systems Conference (DASCrsquo08) pp E41ndashE411 October 2008

[12] J M SpiveyThe Z Notation A Reference manual Prentice HallLondon UK 1992

[13] European Electro-Technical Standardization ldquoRailway applica-tions communications signaling and processing systems soft-ware for railway control and protection systemsrdquoThe EuropeanStandard BS EN 50128 2001

[14] J Garcıa A Berlanga J M Molina J A Besada and J RCasar ldquoPlanning techniques for airport ground operationsrdquo inProceedings of the 21st Digital Avionics Systems Conference 2002

[15] P M Moertl J M Hitt II S Atkins C Brinton and D HWalton ldquoFactors for predicting airport surface characteristicsand prediction accuracy of the surface management systemrdquoin Proceedings of the IEEE International Conference on SystemsMan and Cybernetics pp 3798ndash3803 October 2003

[16] T T B Hanh and D V Hung ldquoVerification of an air trafficcontrol system with probabilistic real-time model checkingrdquoTech Rep 355 UNU-IIST 2007

[17] G J M Koeners E P Stout and R M Rademaker ldquoImprovingtaxi traffic flow by real-time runway sequence optimizationusing dynamic taxi route planningrdquo in Proceedings of the 30thIEEEAIAA Digital Avionics Systems Conference (DASC rsquo11)October 2011

[18] G J M Koeners and R M Rademaker ldquoAnalyze possiblebenefits of real-time taxi flow optimization using actual datardquoin Proceedings of the 30th Digital Avionics Systems Conference(DASC rsquo11) Fremont Calif USA October 2011

[19] S Amy J S Philip and B Charles Ramp Control Issues inthe Design of a Surface Management System Cognitive SystemsEngineering Laboratory The Ohio State University 2002

[20] M Kwiatkowska G Norman J Sproston and F Wang ldquoSym-bolic model checking for probabilistic timed automatardquo in JointConference on Formal Modeling and Analysis of Timed Systemsand Formal Techniques in Real-Time and Fault Tolerant Systemsvol 3253 of Lecture Notes in Computer Science pp 293ndash208Springer 2004

[21] M Nguyen-Duc J-P Briot A Drogoul and V Duong ldquoAnapplication of multi-agent coordination techniques in air trafficmanagementrdquo in Proceedings of the IEEEWIC InternationalConference on Intelligent Agent Technology pp 622ndash628 Octo-ber 2003

[22] L C Yang and J K Kuchar ldquoPrototype conflict alerting systemfor free flightrdquo Journal of Guidance Control and Dynamics vol20 no 4 pp 768ndash773 1997

[23] D P Alves L Weigang B Bueno and B B Souza ldquoReinforce-ment learning to support meta-level control in air traffic man-agementrdquo in Reinforcement Learning Theory and Applicationspp 357ndash372 ARS Publishing 2008

Abstract and Applied Analysis 9

[24] L Weigang M V P Dib D P Alves and A M F CrespoldquoIntelligent computingmethods in air traffic flowmanagementrdquoTransportation Research C Emerging Technologies vol 18 no 5pp 781ndash793 2010

[25] A Cavcar and M Cavcar ldquoImpact of aircraft performance dif-ferences on fuel consumption of aircraft in air of managementenvironmentrdquo Aircraft Engineering and Aerospace Technologyvol 76 no 5 pp 502ndash515 2004

[26] I Hwang andC Tomlin ldquoProtocol-based conflict resolution forfinite information horizonrdquo inProceedings of the IEEEAmericanControl Conference (ACC rsquo02) pp 748ndash753 Piscataway NJUSA May 2002

[27] I Hwang J Hwang andC Tomlin ldquoFlight-mode-based aircraftconflict detection using a residual-mean interacting multiplemodel algorithmrdquo in Proceedings of the AIAA Guidance Navi-gation and Control Conference 2003

[28] I Hwang H Balakrishnan K Roy and C Tomlin ldquoTargettracking and identity management in clutter for air trafficcontrolrdquo in Proceedings of the American Control Conference(AAC rsquo04) 2004

[29] K Bousson ldquoWaypoint-constrained free flight collision avoid-ancerdquo in Proceedings of the SAE Advances in Aviation SafetyConference 2003

[30] S Kahne and I Frolow ldquoAir trafficmanagement evolution withtechnologyrdquo IEEE Control Systems Magazine vol 16 no 4 pp12ndash21 1996

[31] M S Nolan Fundamentals of Air Traffic Control BrooksColeWadsworth Ohio USA 3rd edition 1998

[32] J K Kuchar and L C Yang ldquoA review of conflict detection andresolution modeling methodsrdquo IEEE Transactions on IntelligentTransportation Systems vol 1 no 4 pp 179ndash189 2000

[33] J Hu M Pradini and S Sastry ldquoOptimal coordinated maneu-vers for three-dimensional aircraft conflict resolutionrdquo Journalof Guidance Control and Dynamics vol 25 no 5 pp 888ndash9002002

[34] S R Wolfe F Y Enomoto P A Jarvis and M SierhuisldquoComparing route selection strategies in collaborative trafficflowmanagementrdquo in Proceedings of the IEEE Computer SocietyTechnical Committee on Intelligent Informatics (TCII rsquo07) pp59ndash62 November 2007

[35] S Yousaf N A Zafar and S A Khan ldquoFormal analysis ofdeparture procedure of air traffic control systemrdquo in Proceedingsof the 2nd International Conference on Software Technology andEngineering (ICSTE rsquo10) pp 301ndash305 October 2010

[36] N A Zafar and K Araki ldquoFormalizing moving block railwayinterlocking system for directed networkrdquo Research Reportson Information Science and Electrical Engineering of KyushuUniversity vol 8 no 2 pp 109ndash114 2003

[37] N A Zafar ldquoModeling and formal specification of automatedtrain control system using Z notationrdquo in Proceedings of theIEEE InternationalMultitopic Conference (INMIC rsquo06) pp 438ndash443 December 2006

[38] N A Zafar S A Khan and K Araki ldquoTowards the safetyproperties of moving block railway interlocking systemrdquo Inter-national Journal of Innovative Computing Information andControl vol 8 no 8 pp 5677ndash5690 2012

[39] N A Zafar ldquoSafety control management at airport taxiing totake-off procedurerdquo The Arab Journal of Science and Engineer-ing In press

[40] R Banach C Jeske A Hall and S Stepney ldquoRetrenchmentand the atomicity patternrdquo in Proceedings of the 5th IEEE

International Conference on Software Engineering and FormalMethods (SEFM rsquo07) pp 37ndash46 September 2007

[41] A C Garcia H Idris R Vivona and S Green ldquoCommonaircraft performancemodeling evaluation tools and experimentresultsrdquo in Proceedings of the 24th Digital Avionics SystemsConference (DASC rsquo05) pp 51ndash59 2005

[42] M Jamal and N A Zafar ldquoFormal model of computer-basedair traffic control system using Z notationrdquo in Proceedingsof the 17th International Conference on Computer Theory andApplications 2007

[43] M Jamal and N A Zafar ldquoRequirements analysis of airtraffic control system using formal methodsrdquo in Proceedingsof the International Conference on Information and EmergingTechnologies (ICIET rsquo07) pp 216ndash222 July 2007

[44] M Medina L Sherry and M Feary ldquoAutomation for taskanalysis of next generation air traffic management systemsrdquoTransportation Research C Emerging Technologies vol 18 no6 pp 921ndash929 2010

[45] S Pickin C Jard T Jeron J-M Jezequel and Y Le TraonldquoTest synthesis fromUMLmodels of distributed softwarerdquo IEEETransactions on Software Engineering vol 33 no 4 pp 252ndash2692007

[46] A M F Crespo C V Aquino B B Souza L Weigang A CM A Melo A and D P Alves ldquoDistributed decision supportsystem applied to tactical air traffic flow management in caseof CINDACTA Irdquo Journal of the Brazilian Air TransportationResearch Society vol 4 no 1 pp 47ndash60 2008

[47] C Livadas J Lygeros and N A Lynch ldquoHigh-level modelingand analysis of the TrafficAlert andCollisionAvoidance System(TCAS)rdquo Proceedings of the IEEE vol 88 no 7 pp 926ndash9472000

[48] C Michael and S Steven ldquoManaging gate and ramp operationsto reduce delay fuel burn and costsrdquo in Proceedings of theIntegrated Communications Navigation and Surveillance Con-ference (ICNS rsquo12) 2012

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

4 Abstract and Applied Analysis

gates Block Gate↛

Gates

forallgid Block gate Gate | (gid gate) isin gates∙ gid = gate middot gateid

Apron area is used for preflight activities includingparking waiting andmaintenance As there is an associationrelationship between apron area and gate hence apron isneeded to be defined as a separate entity which consistsof apron identifier and its state The identifier is assumedas a block The set of aprons is a partial function fromapron identifier to apron schema In predicate part it isstated that for every apron identifier apid and schema apronthe ordered pair (apid apron) is in the domain of apronsfunction

Apronapid Blockstate State

aprons Block ↛ Apron

∙ apid = apron middot apid

Aprons

forallapid Block apron Apron | (apid apron) isin aprons

Taxiway is a path on an airport connecting an apron areato a runway through various other services In our modeltaxiway is defined as a schema consisting of taxiway identifierand a sequence of blocks defining a well-defined path

Taxiway

seq Blockpathtaxiwayid TaxiwayId

[TaxiwayId]

The Taxiways schema contains two components namelytaxiways and taxiingA The first one taxiways is a functionfrom taxiway identifier to TaxiwayThe second one taxiingAis a partial function from taxiway identifier to aircraftidentifier occupying the taxiway In predicate part it is statedthat the domain of taxiingA is contained in the domain oftaxiways function

taxiways TaxiwayId rarr Taxiway

taxiingA TaxiwayId AircraftId

∙ tid = taxiway middot taxiwayid

dom taxiingA sube dom taxiways

Taxiways

foralltid TaxiwayId taxiway Taxiway | (tid taxiway)isin taxiways

[AircraftId]

The airport topology consists of four schemas defin-ing graph gates aprons and taxiways In predicate partit is stated that every block in the domain of gates andaprons functions belongs to the node-set The intersection

of domains of gates and aprons functions is empty Furtherit is stated that every block of gate and apron area isconnected to a taxiwayThe paths in taxiways are representedas a sequence of blocks satisfying the invariants of theconnectivity relation It is stated that every element of a pathsequence is a block in the graph relation Any two consecutiveelements in path sequence constitute an edge in the graphrelation

Graph Gates Aprons Taxiways

foralltw ran taxiways

forallb1 dom gates cup dom aprons

∙ tw ran taxiways ∙ b2 ran tw middot pathexist exist

∙ (tw middot path i tw middot path (i + 1)) isin links

∙ (route i route (i + 1)) isin links

AirportTopology

dom gates cap dom aprons =

forallb Block gate Gate | (b gate) isin gates∙ gate middot gateid isin blocks

forallb Block apron Apron | (b apron) isin aprons∙ apron middot apid isin blocks

∙ path1 seq Block | w middot path = path1exist t

∙ foralli N | i isin dom path1 and i isin 1 path1 minus 1

∙ route seq Block ∙ foralli N | ge 1 and i lt routeexist i

An aircraft is specified by a schema Aircraft whichconsists of two components that is aircraft identifier and itssafe area The set of all permissible aircrafts at the airportis defined as a mapping from aircraft identifier to AircraftIn predicate part of the Aircrafts schema it is stated thatan intersection of safe areas of any two aircrafts is alwaysempty

Aircraftaircraftid AircraftIdsafeArea seq Block

aircrafts AircraftId rarr Aircraft

∙ aid = acr middot aircraftid

Aircrafts

forallac1 ac2 ran aircrafts ∙ ac1 middot safeArea capac2 middot safeArea =

forallaid AircraftId acr Aircraft | (aid acr)isin aircrafts

The gate controller defined below consists of four com-ponents The first one is Gates schema which is alreadydefined The second component is gatesR representing theaircrafts which have requested a gate The gatesR componentis defined as a sequence type to provide the service on firstcome and first serve basis The gatesA is the third componentrepresenting mapping from aircraft identifier to gateThe last

Abstract and Applied Analysis 5

one is pushbackR which is the set of aircrafts which haverequested for pushback from the gate

It is mentioned that relationship among all the compo-nents of the gate controller is defined in terms of propertiesTo capture invariants for completeness of the specificationeach component of the gate controller was selected and thenit identified any relationship if exists with the rest of thecomponents

Gates

gatesR seq AircraftId

↛gatesA AircraftId Gate

pushbackR F AircraftId

forallgate ran gates

∙ gate isin ran gatesA rArr gate middot gatestate =

OCCUPIED and

gate notin ran gatesA rArr gate middot gatestate = CLEAR

pushbackR sube dom gatesA

GateController

ran gatesR cap dom gatesA =

Invariants are as follows (i) if a gate is assigned to anaircraft it must be in the occupied state otherwise it is inthe clear state (ii) if a gate is assigned to an aircraft theaircraft cannot be in the list of aircrafts which have requesteda gate If an aircraft has requested a gate it cannot be in thelist of aircrafts which are assigned a gate (iii) if an aircrafthas requested pushback then aircraft must be in the list ofaircrafts which are assigned the gates

It was possible to specify gate and apron controllers usingthe same schema however we have defined it separatelybecause of the simplicity of the model The apron controllerconsists of aprons set of aircrafts which have requested forpushback clearance pushbackC sequence of aircrafts whichare in apron area apronQ and sequence of aircrafts whichhave requested for taxiing taxiingR Formal specificationof the apron controller is described below following theinvariants

Aprons

pushbackC FAircraftIdapronQ seq AircraftIdtaxiingR seq AircraftId

forallaid ran taxiingR ∙ aid isin ran apronQ and aidnotin pushbackC

forallaid pushbackC ∙ aid notin ran apronQ ran taxiingRcup

ApronController

forallaid ran apronQ ∙ aid notin pushbackC

Invariants are as follows (i) any aircraft which hasrequested pushback clearance cannot be in the list of aircraftsin the apron area (ii) if an aircraft is in the apron area

it has not requested the pushback clearance (iii) if anaircraft has requested taxiing it is in the apron area butnot in the list of aircrafts which has requested pushbackclearance

42 Dynamic Model Formal specification of operationsrequired for moving aircrafts from gate to taxiways isdescribed in this section The model is a part of the take-off procedure from gate to taxiing for updating state spaceof the airport There are three main facilities namely gatesaprons and taxiways which are managed by gate and aproncontrollers At first an aircraft is entered from gate to apronarea by communication of gate and apron controller After anaircraft is entered from apron area to taxiway it is controlledby the local controller

First of all an operation for gate request is defined belowAn aircraft sends a request for gate to the gate controllerby showing its identity After verifying the identity thegate controller accepts the request and adds the aircraftin the waiting list gatesR The operation is described bythe schema RequestGate which contains ΞApronControllerΔGateController and aircraft identifier aid as inputs Thestate of gate controller is updated by verifying the propertiesas pre- and postconditions It is noted that postconditionmust be satisfied after the successful execution of the oper-ation The symbol Ξ used in the schema shows that state ofapron controller is not changed The symbol Δ shows thatstate of gate controller is changed The symbol after aidvariable represents that it is an input variable The schemacomponents are put in first part and pre-postconditions aredescribed in second part of the schema

ΞApronController

ΔGateController

aid AircraftId

gatesA998400 = gatesA

pushbackR998400 = pushbackR

gatesR998400 = gatesR ⟨aid⟩

RequestGate

aid isin ran apronQ

aid notin ran gatesR

Pre-postconditions are as follows (i) the requesting air-craftmust be in the apron area (apronQ) (ii) the aircraft is notin the list of waiting list (gatesR) (iii) if the above conditionsare satisfied then aircraft is added to the waiting list (iv)the other two variables of gate controller are unchangedThe symbol ldquo 1015840 rdquo decorating a variable is used for its newstate

Formal definition of the gate assignment operation is pro-vided by the AssignGate schema The schema contains threecomponents namely ΔGateController aircraft identifier andgate as inputs in first part of the schemaThe gate is assignedby the gate controller in terms of pre- and postconditions inthe predicate part of the schema

6 Abstract and Applied Analysis

ΔGateController

aid AircraftIdgate Gate

aid isin ran gatesR

aid notin dom gatesA

gate isin ran gates

gate notin ran gatesA

gatesR998400 = gatesR

pushbackR998400 = pushbackR

gatesA998400 = gatesA cup (aid gate)↦

AssignGate

Pre-postconditions are as follows (i) the aircraftmust bein the waiting list of aircrafts (ii) the aircraft is not assigned agate (iii) the input gate belongs to the valid list of gates (iv)the gate is not assigned to any other aircraft (v) if the aboveconditions are satisfied then aircraft is assigned the gate (vi)the other two variables gateR and pushbackR of gate controllerare unchanged

The pushback request procedure is denoted by the Push-backRequest schema The schema consists of ΔApronCon-troller ΔGateController and aircraft identifier The schemadefinition is given below following pre-postconditions forupdating state space of gates

ΔApronController

ΔGateController

aid AircraftId

aid isin dom gatesA

aid notin pushbackR cap pushbackC

pushbackC998400 = pushbackC cup aid

pushbackR998400 = pushbackR cup aid

gatesA998400 = gatesA

gatesR998400 = gatesR

apronQ998400 = apronQ

taxiingR998400 = taxiingR

PushbackRequest

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate before sending a pushback request (ii)the aircraft neither has requested for pushback nor has apushback clearance (iii) the aircraft is added in the pushbackrequest of gate controller and pushback clearance list of aproncontroller (iv) the other variables gatesA and gatesR of gatescontroller and apronQ and taxiingR of apron controller areunchanged

The pushback procedure is denoted by Pushback schemaconsisting of five components namely ΔGateControllerΔApronController aircraft identifier apron identifier and

apron as given below The schema definition is given belowfollowing the pre-postconditions

ΔGateController

ΔApronController

aid AircraftIdapid Blockapron Apron

aid isin dom gatesA

aid isin pushbackR cap pushbackC

(apid apron) isin aprons

gatesR998400 = gatesR

taxiingR998400 = taxiingR

gatesA998400 = aid gatesA⩤

apronQ998400 = apronQ ⟨aid⟩

Pushback

aprons998400 = aprons cup (apid apron)↦

pushbackC998400 = pushbackCaid

pushbackR998400 = pushbackRaid

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate (ii) it is in the lists of pushback requestsand pushback clearance (iii) the aircraft is removed from thegate list (iv) the aircraft is removed from the pushback andclearance lists (v) the aircraft is allowed to enter the apronarea (vi) the rest of the variables of gate and apron controllersare unchanged

The taxi request procedure is defined below by usingTaxiRequest schema consisting of ΔApronController andaircrafts identifier The schema definition is given belowfollowing the informal description

ΔApronController

aid AircraftId

aid = apronQ 1

apronQ998400 = apronQ

pushbackC998400 = pushbackC

aid notin ran taxiingR

taxiingR998400 = taxiingR ⟨aid⟩

TaxiRequest

Pre-postconditions are as follows (i) the aircraft whichhas requested for taxiing is the first one in the queue inapron area (ii) the aircraft does not belong to the listof aircrafts waiting for taxiing (iii) the aircraft is addedin the list of aircrafts waiting for taxiing (iv) the othertwo variables apronQ and pushbackC of apron controllerremained unchanged

Finally formal procedure of leaving the apron area for anaircraft and entering into taxiway is described usingEnterTaxi

Abstract and Applied Analysis 7

schema which consists of ΔApronController ΔTaxiways air-craft taxiway identifier and taxiway The aircraft is removedfrom the waiting list of aircrafts by using the filter ldquordquooperation

ΔApronController

ΔTaxiways

acr Aircrafttid TaxiwayIdtaxiway Taxiway

acr middot aircraftid isin ran taxiingR

acr middot aircraftid = apronQ 1

taxiingR998400

apronQ998400

pushbackC998400 = pushbackC

taxiways998400 = taxiways

middot aircraftid ∙ i(i acr middot aircraftid) notin taxiingR and aid acrne

middot aircraftid ∙ i(i acr middot aircraftid) notin apronQ and aid acrne

taxiingR

apronQ

EnterTaxi

taxiingA998400 = taxiingA cup (tid acr middot aircraftid)↦

(tid taxiway) isin taxiways

= i N aid AircraftId | i isin dom taxiingR and

= i N aid AircraftId | i isin dom apronQand

Pre-postconditions are as follows (i) the aircraft musthave taxiing permission (ii) the aircraft which has requestedfor taxiing is the first one in the queue in the apron area(iii) after the aircraft has taxied it is removed from the listof aircrafts having permission for taxiing and from the apronarea (iv) the rest of the variables of apron controller remainedunchanged

5 Model Analysis

In this section formal analysis of the specification is providedusing ZEves toolset Aswe know there does not exist any realcomputer tool which may assure complete correctness of for-mal specificationThat means even if the formal specificationis written well it may cause potential errors Hence an art ofwriting formal specification does not provide any guaranteeabout correctness of the model If the formal specification ofa system is analysed with a computer tool it improves theconfidence by identifying errors if it exists in the model

The ZEves is a powerful tool used here for analysing theformal specification of a part of the air traffic control systemresponsible for aircraftmovement from gate to the active areafor taxiing Some schemas of the formalmodel are checked tobe correct while the others are proved by reduction techniqueavailable in the tool

Table 1 Results of model analysis

Schema Name Syntax typecheck

Domaincheck Reduction Proof by

reductionGraph Y Y Ylowast YGate Gates Y Y NA YApron Aprons Y Y NA YTaxiway Taxiways Y Y NA YAirportTopology Y Y Ylowast YAircraft Aircrafts Y Y NA YGateController Y Y NA YApronController Y Y NA YRequestGate Y Y Ylowast YAssignGate Y Y NA YPushbackRequest Y Y NA YPushback Y Y Ylowast YTaxiRequest Y Y Ylowast YEnterTaxi Y Y Ylowast Y

Summary of the results is provided in Table 1 In firstcolumn of the table name of the schema is provided Thesecond column is used for syntax and type checking Thedomain checks proofs in the tool guarantees the consis-tency of the formal specifications for axiomatic declarationsDomain checking is done in column 3 Proof by reductionis a technique in which equivalent simpler combinations oftactics is substituted Reduction and proof by reduction arerepresented in columns 4 and 5 respectively The symbolldquoYrdquo in the table indicates that all schemas are proved to becorrect automatically The symbol ldquoYrdquo annotated with ldquolowastrdquoshows that the schema is proved to be correct by reductiontechnique The symbol ldquoNArdquo in 4th column is used to meanthat reduction is not required on the predicates and hencethe formal specification is proved to be written well andmeaningful

6 Conclusion

In this paper we have described a formal procedure forair traffic flow management from gate to taxiing in airtraffic control (ATC) system Initially we have describedfundamental components for description of the requiredsystemThe airport surface is represented using graph theoryas a part of static model We observed that graph modelwas an effective one for defining connectivity relation andappropriate taxing routs Dynamic model is described formanipulating critical information based on the static modelSafety properties are described in terms of invariants overthe components in the static model Pre- and postconditionsare used to define safety criteria in the operational system toavoid any unwanted situation Z notation is applied becauseof its rigorous and abstract nature for formal analysis of thiscritical system

We observed that the complexity of the ATC system wasreduced by decomposing into its components The use ofschema structure in Z notation facilitated both in the static

8 Abstract and Applied Analysis

and dynamic parts of the model Systematic developmentfrom abstraction to detailed model made it easy to proposea simple and abstract model

There exists much work on modelling of ATC systemhowever it needs more research to address next generationautomated systems achieving the required level of safety andefficiency The work of Michael and Steven is close to this inwhich gate management and ramp operations are analysedfor reducing delay time fuel burning and other costs [48]In their work the approach is fairly conservative based onobservations and results are not fully verified and established

Various benefits describing formal specification ofthe system were observed For example modelling ofcomponent-based system provided us with a completecharacterization at a higher level of abstraction On theother hand if the system was specified at a more detailedlevel intuition may have been lost Compositional approachenabled us to give reasoning about the components andsubsequently the entire system Further advantages of aformal model can be observed after refinement The detailedmodel can be achieved after a series of refinements whileguaranteeing the transformation of syntax and semanticsrules

A clear scope and set of assumptions were definedbefore producing a mathematical model of the system It ismentioned that this formal model can be applied to an ATCsystem after a further refinement and analysisThis is becausewe have defined the properties based on the requirements ofa real ATC system

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

References

[1] J VilliersERASMUSmdashAFriendlyWay for Breaking the CapacityBarrier ITA 2004

[2] H Erzberger ldquoTransforming the NAS the next generationair traffic control systemrdquo in Proceedings of the InternationalCongress of the Aeronautical Sciences 2004

[3] H Erzberger ldquoAutomated conflict resolution for air trafficcontrolrdquo in Proceedings of the 25th International Congress of theAeronautical Sciences 2006

[4] H Erzberger and K Heere ldquoAlgorithm and operational conceptfor resolving short range conflictsrdquo Journal of Aerospace Engi-neering vol 224 pp 225ndash243 2009

[5] T Farley and H Erzberger ldquoFast time air traffic simulation of aconflict resolution algorithm under high air traffic demandrdquo inProceedings of the USA Europe ATM Seminar 2007

[6] J Hu M Prandini and S Sastry ldquoOptimal maneuver formultiple aircraft conflict resolution a braid point of viewrdquo inProceedings of the 39th IEEE Confernce on Decision and Controlvol 4 pp 4164ndash4169 December 2000

[7] S T Shorrock and B Kirwan ldquoDevelopment and application ofa human error identification tool for air traffic controlrdquo AppliedErgonomics vol 33 no 4 pp 319ndash336 2002

[8] N E Debbache ldquoToward a new organization for air trafficcontrolrdquo Aircraft Engineering and Aerospace Technology vol 73no 6 pp 561ndash567 2001

[9] W Marshall and W I Joseph ldquoAirport movement area safetysystemrdquo in Proceedings of the IEEE Digital Avionics SystemsConference pp 549ndash552 1992

[10] Y Guo X Cao and J Zhang ldquoConstraint handling based mul-tiobjective evolutionary algorithm for aircraft landing schedul-ingrdquo International Journal of Innovative Computing Informationand Control vol 5 no 8 pp 2229ndash2238 2009

[11] G J Couluris R K Fong M B Downs et al ldquoA new modelingcapability for airport surface traffic analysisrdquo in Proceedings ofthe IEEEAIAA 27th Digital Avionics Systems Conference (DASCrsquo08) pp E41ndashE411 October 2008

[12] J M SpiveyThe Z Notation A Reference manual Prentice HallLondon UK 1992

[13] European Electro-Technical Standardization ldquoRailway applica-tions communications signaling and processing systems soft-ware for railway control and protection systemsrdquoThe EuropeanStandard BS EN 50128 2001

[14] J Garcıa A Berlanga J M Molina J A Besada and J RCasar ldquoPlanning techniques for airport ground operationsrdquo inProceedings of the 21st Digital Avionics Systems Conference 2002

[15] P M Moertl J M Hitt II S Atkins C Brinton and D HWalton ldquoFactors for predicting airport surface characteristicsand prediction accuracy of the surface management systemrdquoin Proceedings of the IEEE International Conference on SystemsMan and Cybernetics pp 3798ndash3803 October 2003

[16] T T B Hanh and D V Hung ldquoVerification of an air trafficcontrol system with probabilistic real-time model checkingrdquoTech Rep 355 UNU-IIST 2007

[17] G J M Koeners E P Stout and R M Rademaker ldquoImprovingtaxi traffic flow by real-time runway sequence optimizationusing dynamic taxi route planningrdquo in Proceedings of the 30thIEEEAIAA Digital Avionics Systems Conference (DASC rsquo11)October 2011

[18] G J M Koeners and R M Rademaker ldquoAnalyze possiblebenefits of real-time taxi flow optimization using actual datardquoin Proceedings of the 30th Digital Avionics Systems Conference(DASC rsquo11) Fremont Calif USA October 2011

[19] S Amy J S Philip and B Charles Ramp Control Issues inthe Design of a Surface Management System Cognitive SystemsEngineering Laboratory The Ohio State University 2002

[20] M Kwiatkowska G Norman J Sproston and F Wang ldquoSym-bolic model checking for probabilistic timed automatardquo in JointConference on Formal Modeling and Analysis of Timed Systemsand Formal Techniques in Real-Time and Fault Tolerant Systemsvol 3253 of Lecture Notes in Computer Science pp 293ndash208Springer 2004

[21] M Nguyen-Duc J-P Briot A Drogoul and V Duong ldquoAnapplication of multi-agent coordination techniques in air trafficmanagementrdquo in Proceedings of the IEEEWIC InternationalConference on Intelligent Agent Technology pp 622ndash628 Octo-ber 2003

[22] L C Yang and J K Kuchar ldquoPrototype conflict alerting systemfor free flightrdquo Journal of Guidance Control and Dynamics vol20 no 4 pp 768ndash773 1997

[23] D P Alves L Weigang B Bueno and B B Souza ldquoReinforce-ment learning to support meta-level control in air traffic man-agementrdquo in Reinforcement Learning Theory and Applicationspp 357ndash372 ARS Publishing 2008

Abstract and Applied Analysis 9

[24] L Weigang M V P Dib D P Alves and A M F CrespoldquoIntelligent computingmethods in air traffic flowmanagementrdquoTransportation Research C Emerging Technologies vol 18 no 5pp 781ndash793 2010

[25] A Cavcar and M Cavcar ldquoImpact of aircraft performance dif-ferences on fuel consumption of aircraft in air of managementenvironmentrdquo Aircraft Engineering and Aerospace Technologyvol 76 no 5 pp 502ndash515 2004

[26] I Hwang andC Tomlin ldquoProtocol-based conflict resolution forfinite information horizonrdquo inProceedings of the IEEEAmericanControl Conference (ACC rsquo02) pp 748ndash753 Piscataway NJUSA May 2002

[27] I Hwang J Hwang andC Tomlin ldquoFlight-mode-based aircraftconflict detection using a residual-mean interacting multiplemodel algorithmrdquo in Proceedings of the AIAA Guidance Navi-gation and Control Conference 2003

[28] I Hwang H Balakrishnan K Roy and C Tomlin ldquoTargettracking and identity management in clutter for air trafficcontrolrdquo in Proceedings of the American Control Conference(AAC rsquo04) 2004

[29] K Bousson ldquoWaypoint-constrained free flight collision avoid-ancerdquo in Proceedings of the SAE Advances in Aviation SafetyConference 2003

[30] S Kahne and I Frolow ldquoAir trafficmanagement evolution withtechnologyrdquo IEEE Control Systems Magazine vol 16 no 4 pp12ndash21 1996

[31] M S Nolan Fundamentals of Air Traffic Control BrooksColeWadsworth Ohio USA 3rd edition 1998

[32] J K Kuchar and L C Yang ldquoA review of conflict detection andresolution modeling methodsrdquo IEEE Transactions on IntelligentTransportation Systems vol 1 no 4 pp 179ndash189 2000

[33] J Hu M Pradini and S Sastry ldquoOptimal coordinated maneu-vers for three-dimensional aircraft conflict resolutionrdquo Journalof Guidance Control and Dynamics vol 25 no 5 pp 888ndash9002002

[34] S R Wolfe F Y Enomoto P A Jarvis and M SierhuisldquoComparing route selection strategies in collaborative trafficflowmanagementrdquo in Proceedings of the IEEE Computer SocietyTechnical Committee on Intelligent Informatics (TCII rsquo07) pp59ndash62 November 2007

[35] S Yousaf N A Zafar and S A Khan ldquoFormal analysis ofdeparture procedure of air traffic control systemrdquo in Proceedingsof the 2nd International Conference on Software Technology andEngineering (ICSTE rsquo10) pp 301ndash305 October 2010

[36] N A Zafar and K Araki ldquoFormalizing moving block railwayinterlocking system for directed networkrdquo Research Reportson Information Science and Electrical Engineering of KyushuUniversity vol 8 no 2 pp 109ndash114 2003

[37] N A Zafar ldquoModeling and formal specification of automatedtrain control system using Z notationrdquo in Proceedings of theIEEE InternationalMultitopic Conference (INMIC rsquo06) pp 438ndash443 December 2006

[38] N A Zafar S A Khan and K Araki ldquoTowards the safetyproperties of moving block railway interlocking systemrdquo Inter-national Journal of Innovative Computing Information andControl vol 8 no 8 pp 5677ndash5690 2012

[39] N A Zafar ldquoSafety control management at airport taxiing totake-off procedurerdquo The Arab Journal of Science and Engineer-ing In press

[40] R Banach C Jeske A Hall and S Stepney ldquoRetrenchmentand the atomicity patternrdquo in Proceedings of the 5th IEEE

International Conference on Software Engineering and FormalMethods (SEFM rsquo07) pp 37ndash46 September 2007

[41] A C Garcia H Idris R Vivona and S Green ldquoCommonaircraft performancemodeling evaluation tools and experimentresultsrdquo in Proceedings of the 24th Digital Avionics SystemsConference (DASC rsquo05) pp 51ndash59 2005

[42] M Jamal and N A Zafar ldquoFormal model of computer-basedair traffic control system using Z notationrdquo in Proceedingsof the 17th International Conference on Computer Theory andApplications 2007

[43] M Jamal and N A Zafar ldquoRequirements analysis of airtraffic control system using formal methodsrdquo in Proceedingsof the International Conference on Information and EmergingTechnologies (ICIET rsquo07) pp 216ndash222 July 2007

[44] M Medina L Sherry and M Feary ldquoAutomation for taskanalysis of next generation air traffic management systemsrdquoTransportation Research C Emerging Technologies vol 18 no6 pp 921ndash929 2010

[45] S Pickin C Jard T Jeron J-M Jezequel and Y Le TraonldquoTest synthesis fromUMLmodels of distributed softwarerdquo IEEETransactions on Software Engineering vol 33 no 4 pp 252ndash2692007

[46] A M F Crespo C V Aquino B B Souza L Weigang A CM A Melo A and D P Alves ldquoDistributed decision supportsystem applied to tactical air traffic flow management in caseof CINDACTA Irdquo Journal of the Brazilian Air TransportationResearch Society vol 4 no 1 pp 47ndash60 2008

[47] C Livadas J Lygeros and N A Lynch ldquoHigh-level modelingand analysis of the TrafficAlert andCollisionAvoidance System(TCAS)rdquo Proceedings of the IEEE vol 88 no 7 pp 926ndash9472000

[48] C Michael and S Steven ldquoManaging gate and ramp operationsto reduce delay fuel burn and costsrdquo in Proceedings of theIntegrated Communications Navigation and Surveillance Con-ference (ICNS rsquo12) 2012

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Abstract and Applied Analysis 5

one is pushbackR which is the set of aircrafts which haverequested for pushback from the gate

It is mentioned that relationship among all the compo-nents of the gate controller is defined in terms of propertiesTo capture invariants for completeness of the specificationeach component of the gate controller was selected and thenit identified any relationship if exists with the rest of thecomponents

Gates

gatesR seq AircraftId

↛gatesA AircraftId Gate

pushbackR F AircraftId

forallgate ran gates

∙ gate isin ran gatesA rArr gate middot gatestate =

OCCUPIED and

gate notin ran gatesA rArr gate middot gatestate = CLEAR

pushbackR sube dom gatesA

GateController

ran gatesR cap dom gatesA =

Invariants are as follows (i) if a gate is assigned to anaircraft it must be in the occupied state otherwise it is inthe clear state (ii) if a gate is assigned to an aircraft theaircraft cannot be in the list of aircrafts which have requesteda gate If an aircraft has requested a gate it cannot be in thelist of aircrafts which are assigned a gate (iii) if an aircrafthas requested pushback then aircraft must be in the list ofaircrafts which are assigned the gates

It was possible to specify gate and apron controllers usingthe same schema however we have defined it separatelybecause of the simplicity of the model The apron controllerconsists of aprons set of aircrafts which have requested forpushback clearance pushbackC sequence of aircrafts whichare in apron area apronQ and sequence of aircrafts whichhave requested for taxiing taxiingR Formal specificationof the apron controller is described below following theinvariants

Aprons

pushbackC FAircraftIdapronQ seq AircraftIdtaxiingR seq AircraftId

forallaid ran taxiingR ∙ aid isin ran apronQ and aidnotin pushbackC

forallaid pushbackC ∙ aid notin ran apronQ ran taxiingRcup

ApronController

forallaid ran apronQ ∙ aid notin pushbackC

Invariants are as follows (i) any aircraft which hasrequested pushback clearance cannot be in the list of aircraftsin the apron area (ii) if an aircraft is in the apron area

it has not requested the pushback clearance (iii) if anaircraft has requested taxiing it is in the apron area butnot in the list of aircrafts which has requested pushbackclearance

42 Dynamic Model Formal specification of operationsrequired for moving aircrafts from gate to taxiways isdescribed in this section The model is a part of the take-off procedure from gate to taxiing for updating state spaceof the airport There are three main facilities namely gatesaprons and taxiways which are managed by gate and aproncontrollers At first an aircraft is entered from gate to apronarea by communication of gate and apron controller After anaircraft is entered from apron area to taxiway it is controlledby the local controller

First of all an operation for gate request is defined belowAn aircraft sends a request for gate to the gate controllerby showing its identity After verifying the identity thegate controller accepts the request and adds the aircraftin the waiting list gatesR The operation is described bythe schema RequestGate which contains ΞApronControllerΔGateController and aircraft identifier aid as inputs Thestate of gate controller is updated by verifying the propertiesas pre- and postconditions It is noted that postconditionmust be satisfied after the successful execution of the oper-ation The symbol Ξ used in the schema shows that state ofapron controller is not changed The symbol Δ shows thatstate of gate controller is changed The symbol after aidvariable represents that it is an input variable The schemacomponents are put in first part and pre-postconditions aredescribed in second part of the schema

ΞApronController

ΔGateController

aid AircraftId

gatesA998400 = gatesA

pushbackR998400 = pushbackR

gatesR998400 = gatesR ⟨aid⟩

RequestGate

aid isin ran apronQ

aid notin ran gatesR

Pre-postconditions are as follows (i) the requesting air-craftmust be in the apron area (apronQ) (ii) the aircraft is notin the list of waiting list (gatesR) (iii) if the above conditionsare satisfied then aircraft is added to the waiting list (iv)the other two variables of gate controller are unchangedThe symbol ldquo 1015840 rdquo decorating a variable is used for its newstate

Formal definition of the gate assignment operation is pro-vided by the AssignGate schema The schema contains threecomponents namely ΔGateController aircraft identifier andgate as inputs in first part of the schemaThe gate is assignedby the gate controller in terms of pre- and postconditions inthe predicate part of the schema

6 Abstract and Applied Analysis

ΔGateController

aid AircraftIdgate Gate

aid isin ran gatesR

aid notin dom gatesA

gate isin ran gates

gate notin ran gatesA

gatesR998400 = gatesR

pushbackR998400 = pushbackR

gatesA998400 = gatesA cup (aid gate)↦

AssignGate

Pre-postconditions are as follows (i) the aircraftmust bein the waiting list of aircrafts (ii) the aircraft is not assigned agate (iii) the input gate belongs to the valid list of gates (iv)the gate is not assigned to any other aircraft (v) if the aboveconditions are satisfied then aircraft is assigned the gate (vi)the other two variables gateR and pushbackR of gate controllerare unchanged

The pushback request procedure is denoted by the Push-backRequest schema The schema consists of ΔApronCon-troller ΔGateController and aircraft identifier The schemadefinition is given below following pre-postconditions forupdating state space of gates

ΔApronController

ΔGateController

aid AircraftId

aid isin dom gatesA

aid notin pushbackR cap pushbackC

pushbackC998400 = pushbackC cup aid

pushbackR998400 = pushbackR cup aid

gatesA998400 = gatesA

gatesR998400 = gatesR

apronQ998400 = apronQ

taxiingR998400 = taxiingR

PushbackRequest

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate before sending a pushback request (ii)the aircraft neither has requested for pushback nor has apushback clearance (iii) the aircraft is added in the pushbackrequest of gate controller and pushback clearance list of aproncontroller (iv) the other variables gatesA and gatesR of gatescontroller and apronQ and taxiingR of apron controller areunchanged

The pushback procedure is denoted by Pushback schemaconsisting of five components namely ΔGateControllerΔApronController aircraft identifier apron identifier and

apron as given below The schema definition is given belowfollowing the pre-postconditions

ΔGateController

ΔApronController

aid AircraftIdapid Blockapron Apron

aid isin dom gatesA

aid isin pushbackR cap pushbackC

(apid apron) isin aprons

gatesR998400 = gatesR

taxiingR998400 = taxiingR

gatesA998400 = aid gatesA⩤

apronQ998400 = apronQ ⟨aid⟩

Pushback

aprons998400 = aprons cup (apid apron)↦

pushbackC998400 = pushbackCaid

pushbackR998400 = pushbackRaid

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate (ii) it is in the lists of pushback requestsand pushback clearance (iii) the aircraft is removed from thegate list (iv) the aircraft is removed from the pushback andclearance lists (v) the aircraft is allowed to enter the apronarea (vi) the rest of the variables of gate and apron controllersare unchanged

The taxi request procedure is defined below by usingTaxiRequest schema consisting of ΔApronController andaircrafts identifier The schema definition is given belowfollowing the informal description

ΔApronController

aid AircraftId

aid = apronQ 1

apronQ998400 = apronQ

pushbackC998400 = pushbackC

aid notin ran taxiingR

taxiingR998400 = taxiingR ⟨aid⟩

TaxiRequest

Pre-postconditions are as follows (i) the aircraft whichhas requested for taxiing is the first one in the queue inapron area (ii) the aircraft does not belong to the listof aircrafts waiting for taxiing (iii) the aircraft is addedin the list of aircrafts waiting for taxiing (iv) the othertwo variables apronQ and pushbackC of apron controllerremained unchanged

Finally formal procedure of leaving the apron area for anaircraft and entering into taxiway is described usingEnterTaxi

Abstract and Applied Analysis 7

schema which consists of ΔApronController ΔTaxiways air-craft taxiway identifier and taxiway The aircraft is removedfrom the waiting list of aircrafts by using the filter ldquordquooperation

ΔApronController

ΔTaxiways

acr Aircrafttid TaxiwayIdtaxiway Taxiway

acr middot aircraftid isin ran taxiingR

acr middot aircraftid = apronQ 1

taxiingR998400

apronQ998400

pushbackC998400 = pushbackC

taxiways998400 = taxiways

middot aircraftid ∙ i(i acr middot aircraftid) notin taxiingR and aid acrne

middot aircraftid ∙ i(i acr middot aircraftid) notin apronQ and aid acrne

taxiingR

apronQ

EnterTaxi

taxiingA998400 = taxiingA cup (tid acr middot aircraftid)↦

(tid taxiway) isin taxiways

= i N aid AircraftId | i isin dom taxiingR and

= i N aid AircraftId | i isin dom apronQand

Pre-postconditions are as follows (i) the aircraft musthave taxiing permission (ii) the aircraft which has requestedfor taxiing is the first one in the queue in the apron area(iii) after the aircraft has taxied it is removed from the listof aircrafts having permission for taxiing and from the apronarea (iv) the rest of the variables of apron controller remainedunchanged

5 Model Analysis

In this section formal analysis of the specification is providedusing ZEves toolset Aswe know there does not exist any realcomputer tool which may assure complete correctness of for-mal specificationThat means even if the formal specificationis written well it may cause potential errors Hence an art ofwriting formal specification does not provide any guaranteeabout correctness of the model If the formal specification ofa system is analysed with a computer tool it improves theconfidence by identifying errors if it exists in the model

The ZEves is a powerful tool used here for analysing theformal specification of a part of the air traffic control systemresponsible for aircraftmovement from gate to the active areafor taxiing Some schemas of the formalmodel are checked tobe correct while the others are proved by reduction techniqueavailable in the tool

Table 1 Results of model analysis

Schema Name Syntax typecheck

Domaincheck Reduction Proof by

reductionGraph Y Y Ylowast YGate Gates Y Y NA YApron Aprons Y Y NA YTaxiway Taxiways Y Y NA YAirportTopology Y Y Ylowast YAircraft Aircrafts Y Y NA YGateController Y Y NA YApronController Y Y NA YRequestGate Y Y Ylowast YAssignGate Y Y NA YPushbackRequest Y Y NA YPushback Y Y Ylowast YTaxiRequest Y Y Ylowast YEnterTaxi Y Y Ylowast Y

Summary of the results is provided in Table 1 In firstcolumn of the table name of the schema is provided Thesecond column is used for syntax and type checking Thedomain checks proofs in the tool guarantees the consis-tency of the formal specifications for axiomatic declarationsDomain checking is done in column 3 Proof by reductionis a technique in which equivalent simpler combinations oftactics is substituted Reduction and proof by reduction arerepresented in columns 4 and 5 respectively The symbolldquoYrdquo in the table indicates that all schemas are proved to becorrect automatically The symbol ldquoYrdquo annotated with ldquolowastrdquoshows that the schema is proved to be correct by reductiontechnique The symbol ldquoNArdquo in 4th column is used to meanthat reduction is not required on the predicates and hencethe formal specification is proved to be written well andmeaningful

6 Conclusion

In this paper we have described a formal procedure forair traffic flow management from gate to taxiing in airtraffic control (ATC) system Initially we have describedfundamental components for description of the requiredsystemThe airport surface is represented using graph theoryas a part of static model We observed that graph modelwas an effective one for defining connectivity relation andappropriate taxing routs Dynamic model is described formanipulating critical information based on the static modelSafety properties are described in terms of invariants overthe components in the static model Pre- and postconditionsare used to define safety criteria in the operational system toavoid any unwanted situation Z notation is applied becauseof its rigorous and abstract nature for formal analysis of thiscritical system

We observed that the complexity of the ATC system wasreduced by decomposing into its components The use ofschema structure in Z notation facilitated both in the static

8 Abstract and Applied Analysis

and dynamic parts of the model Systematic developmentfrom abstraction to detailed model made it easy to proposea simple and abstract model

There exists much work on modelling of ATC systemhowever it needs more research to address next generationautomated systems achieving the required level of safety andefficiency The work of Michael and Steven is close to this inwhich gate management and ramp operations are analysedfor reducing delay time fuel burning and other costs [48]In their work the approach is fairly conservative based onobservations and results are not fully verified and established

Various benefits describing formal specification ofthe system were observed For example modelling ofcomponent-based system provided us with a completecharacterization at a higher level of abstraction On theother hand if the system was specified at a more detailedlevel intuition may have been lost Compositional approachenabled us to give reasoning about the components andsubsequently the entire system Further advantages of aformal model can be observed after refinement The detailedmodel can be achieved after a series of refinements whileguaranteeing the transformation of syntax and semanticsrules

A clear scope and set of assumptions were definedbefore producing a mathematical model of the system It ismentioned that this formal model can be applied to an ATCsystem after a further refinement and analysisThis is becausewe have defined the properties based on the requirements ofa real ATC system

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

References

[1] J VilliersERASMUSmdashAFriendlyWay for Breaking the CapacityBarrier ITA 2004

[2] H Erzberger ldquoTransforming the NAS the next generationair traffic control systemrdquo in Proceedings of the InternationalCongress of the Aeronautical Sciences 2004

[3] H Erzberger ldquoAutomated conflict resolution for air trafficcontrolrdquo in Proceedings of the 25th International Congress of theAeronautical Sciences 2006

[4] H Erzberger and K Heere ldquoAlgorithm and operational conceptfor resolving short range conflictsrdquo Journal of Aerospace Engi-neering vol 224 pp 225ndash243 2009

[5] T Farley and H Erzberger ldquoFast time air traffic simulation of aconflict resolution algorithm under high air traffic demandrdquo inProceedings of the USA Europe ATM Seminar 2007

[6] J Hu M Prandini and S Sastry ldquoOptimal maneuver formultiple aircraft conflict resolution a braid point of viewrdquo inProceedings of the 39th IEEE Confernce on Decision and Controlvol 4 pp 4164ndash4169 December 2000

[7] S T Shorrock and B Kirwan ldquoDevelopment and application ofa human error identification tool for air traffic controlrdquo AppliedErgonomics vol 33 no 4 pp 319ndash336 2002

[8] N E Debbache ldquoToward a new organization for air trafficcontrolrdquo Aircraft Engineering and Aerospace Technology vol 73no 6 pp 561ndash567 2001

[9] W Marshall and W I Joseph ldquoAirport movement area safetysystemrdquo in Proceedings of the IEEE Digital Avionics SystemsConference pp 549ndash552 1992

[10] Y Guo X Cao and J Zhang ldquoConstraint handling based mul-tiobjective evolutionary algorithm for aircraft landing schedul-ingrdquo International Journal of Innovative Computing Informationand Control vol 5 no 8 pp 2229ndash2238 2009

[11] G J Couluris R K Fong M B Downs et al ldquoA new modelingcapability for airport surface traffic analysisrdquo in Proceedings ofthe IEEEAIAA 27th Digital Avionics Systems Conference (DASCrsquo08) pp E41ndashE411 October 2008

[12] J M SpiveyThe Z Notation A Reference manual Prentice HallLondon UK 1992

[13] European Electro-Technical Standardization ldquoRailway applica-tions communications signaling and processing systems soft-ware for railway control and protection systemsrdquoThe EuropeanStandard BS EN 50128 2001

[14] J Garcıa A Berlanga J M Molina J A Besada and J RCasar ldquoPlanning techniques for airport ground operationsrdquo inProceedings of the 21st Digital Avionics Systems Conference 2002

[15] P M Moertl J M Hitt II S Atkins C Brinton and D HWalton ldquoFactors for predicting airport surface characteristicsand prediction accuracy of the surface management systemrdquoin Proceedings of the IEEE International Conference on SystemsMan and Cybernetics pp 3798ndash3803 October 2003

[16] T T B Hanh and D V Hung ldquoVerification of an air trafficcontrol system with probabilistic real-time model checkingrdquoTech Rep 355 UNU-IIST 2007

[17] G J M Koeners E P Stout and R M Rademaker ldquoImprovingtaxi traffic flow by real-time runway sequence optimizationusing dynamic taxi route planningrdquo in Proceedings of the 30thIEEEAIAA Digital Avionics Systems Conference (DASC rsquo11)October 2011

[18] G J M Koeners and R M Rademaker ldquoAnalyze possiblebenefits of real-time taxi flow optimization using actual datardquoin Proceedings of the 30th Digital Avionics Systems Conference(DASC rsquo11) Fremont Calif USA October 2011

[19] S Amy J S Philip and B Charles Ramp Control Issues inthe Design of a Surface Management System Cognitive SystemsEngineering Laboratory The Ohio State University 2002

[20] M Kwiatkowska G Norman J Sproston and F Wang ldquoSym-bolic model checking for probabilistic timed automatardquo in JointConference on Formal Modeling and Analysis of Timed Systemsand Formal Techniques in Real-Time and Fault Tolerant Systemsvol 3253 of Lecture Notes in Computer Science pp 293ndash208Springer 2004

[21] M Nguyen-Duc J-P Briot A Drogoul and V Duong ldquoAnapplication of multi-agent coordination techniques in air trafficmanagementrdquo in Proceedings of the IEEEWIC InternationalConference on Intelligent Agent Technology pp 622ndash628 Octo-ber 2003

[22] L C Yang and J K Kuchar ldquoPrototype conflict alerting systemfor free flightrdquo Journal of Guidance Control and Dynamics vol20 no 4 pp 768ndash773 1997

[23] D P Alves L Weigang B Bueno and B B Souza ldquoReinforce-ment learning to support meta-level control in air traffic man-agementrdquo in Reinforcement Learning Theory and Applicationspp 357ndash372 ARS Publishing 2008

Abstract and Applied Analysis 9

[24] L Weigang M V P Dib D P Alves and A M F CrespoldquoIntelligent computingmethods in air traffic flowmanagementrdquoTransportation Research C Emerging Technologies vol 18 no 5pp 781ndash793 2010

[25] A Cavcar and M Cavcar ldquoImpact of aircraft performance dif-ferences on fuel consumption of aircraft in air of managementenvironmentrdquo Aircraft Engineering and Aerospace Technologyvol 76 no 5 pp 502ndash515 2004

[26] I Hwang andC Tomlin ldquoProtocol-based conflict resolution forfinite information horizonrdquo inProceedings of the IEEEAmericanControl Conference (ACC rsquo02) pp 748ndash753 Piscataway NJUSA May 2002

[27] I Hwang J Hwang andC Tomlin ldquoFlight-mode-based aircraftconflict detection using a residual-mean interacting multiplemodel algorithmrdquo in Proceedings of the AIAA Guidance Navi-gation and Control Conference 2003

[28] I Hwang H Balakrishnan K Roy and C Tomlin ldquoTargettracking and identity management in clutter for air trafficcontrolrdquo in Proceedings of the American Control Conference(AAC rsquo04) 2004

[29] K Bousson ldquoWaypoint-constrained free flight collision avoid-ancerdquo in Proceedings of the SAE Advances in Aviation SafetyConference 2003

[30] S Kahne and I Frolow ldquoAir trafficmanagement evolution withtechnologyrdquo IEEE Control Systems Magazine vol 16 no 4 pp12ndash21 1996

[31] M S Nolan Fundamentals of Air Traffic Control BrooksColeWadsworth Ohio USA 3rd edition 1998

[32] J K Kuchar and L C Yang ldquoA review of conflict detection andresolution modeling methodsrdquo IEEE Transactions on IntelligentTransportation Systems vol 1 no 4 pp 179ndash189 2000

[33] J Hu M Pradini and S Sastry ldquoOptimal coordinated maneu-vers for three-dimensional aircraft conflict resolutionrdquo Journalof Guidance Control and Dynamics vol 25 no 5 pp 888ndash9002002

[34] S R Wolfe F Y Enomoto P A Jarvis and M SierhuisldquoComparing route selection strategies in collaborative trafficflowmanagementrdquo in Proceedings of the IEEE Computer SocietyTechnical Committee on Intelligent Informatics (TCII rsquo07) pp59ndash62 November 2007

[35] S Yousaf N A Zafar and S A Khan ldquoFormal analysis ofdeparture procedure of air traffic control systemrdquo in Proceedingsof the 2nd International Conference on Software Technology andEngineering (ICSTE rsquo10) pp 301ndash305 October 2010

[36] N A Zafar and K Araki ldquoFormalizing moving block railwayinterlocking system for directed networkrdquo Research Reportson Information Science and Electrical Engineering of KyushuUniversity vol 8 no 2 pp 109ndash114 2003

[37] N A Zafar ldquoModeling and formal specification of automatedtrain control system using Z notationrdquo in Proceedings of theIEEE InternationalMultitopic Conference (INMIC rsquo06) pp 438ndash443 December 2006

[38] N A Zafar S A Khan and K Araki ldquoTowards the safetyproperties of moving block railway interlocking systemrdquo Inter-national Journal of Innovative Computing Information andControl vol 8 no 8 pp 5677ndash5690 2012

[39] N A Zafar ldquoSafety control management at airport taxiing totake-off procedurerdquo The Arab Journal of Science and Engineer-ing In press

[40] R Banach C Jeske A Hall and S Stepney ldquoRetrenchmentand the atomicity patternrdquo in Proceedings of the 5th IEEE

International Conference on Software Engineering and FormalMethods (SEFM rsquo07) pp 37ndash46 September 2007

[41] A C Garcia H Idris R Vivona and S Green ldquoCommonaircraft performancemodeling evaluation tools and experimentresultsrdquo in Proceedings of the 24th Digital Avionics SystemsConference (DASC rsquo05) pp 51ndash59 2005

[42] M Jamal and N A Zafar ldquoFormal model of computer-basedair traffic control system using Z notationrdquo in Proceedingsof the 17th International Conference on Computer Theory andApplications 2007

[43] M Jamal and N A Zafar ldquoRequirements analysis of airtraffic control system using formal methodsrdquo in Proceedingsof the International Conference on Information and EmergingTechnologies (ICIET rsquo07) pp 216ndash222 July 2007

[44] M Medina L Sherry and M Feary ldquoAutomation for taskanalysis of next generation air traffic management systemsrdquoTransportation Research C Emerging Technologies vol 18 no6 pp 921ndash929 2010

[45] S Pickin C Jard T Jeron J-M Jezequel and Y Le TraonldquoTest synthesis fromUMLmodels of distributed softwarerdquo IEEETransactions on Software Engineering vol 33 no 4 pp 252ndash2692007

[46] A M F Crespo C V Aquino B B Souza L Weigang A CM A Melo A and D P Alves ldquoDistributed decision supportsystem applied to tactical air traffic flow management in caseof CINDACTA Irdquo Journal of the Brazilian Air TransportationResearch Society vol 4 no 1 pp 47ndash60 2008

[47] C Livadas J Lygeros and N A Lynch ldquoHigh-level modelingand analysis of the TrafficAlert andCollisionAvoidance System(TCAS)rdquo Proceedings of the IEEE vol 88 no 7 pp 926ndash9472000

[48] C Michael and S Steven ldquoManaging gate and ramp operationsto reduce delay fuel burn and costsrdquo in Proceedings of theIntegrated Communications Navigation and Surveillance Con-ference (ICNS rsquo12) 2012

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

6 Abstract and Applied Analysis

ΔGateController

aid AircraftIdgate Gate

aid isin ran gatesR

aid notin dom gatesA

gate isin ran gates

gate notin ran gatesA

gatesR998400 = gatesR

pushbackR998400 = pushbackR

gatesA998400 = gatesA cup (aid gate)↦

AssignGate

Pre-postconditions are as follows (i) the aircraftmust bein the waiting list of aircrafts (ii) the aircraft is not assigned agate (iii) the input gate belongs to the valid list of gates (iv)the gate is not assigned to any other aircraft (v) if the aboveconditions are satisfied then aircraft is assigned the gate (vi)the other two variables gateR and pushbackR of gate controllerare unchanged

The pushback request procedure is denoted by the Push-backRequest schema The schema consists of ΔApronCon-troller ΔGateController and aircraft identifier The schemadefinition is given below following pre-postconditions forupdating state space of gates

ΔApronController

ΔGateController

aid AircraftId

aid isin dom gatesA

aid notin pushbackR cap pushbackC

pushbackC998400 = pushbackC cup aid

pushbackR998400 = pushbackR cup aid

gatesA998400 = gatesA

gatesR998400 = gatesR

apronQ998400 = apronQ

taxiingR998400 = taxiingR

PushbackRequest

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate before sending a pushback request (ii)the aircraft neither has requested for pushback nor has apushback clearance (iii) the aircraft is added in the pushbackrequest of gate controller and pushback clearance list of aproncontroller (iv) the other variables gatesA and gatesR of gatescontroller and apronQ and taxiingR of apron controller areunchanged

The pushback procedure is denoted by Pushback schemaconsisting of five components namely ΔGateControllerΔApronController aircraft identifier apron identifier and

apron as given below The schema definition is given belowfollowing the pre-postconditions

ΔGateController

ΔApronController

aid AircraftIdapid Blockapron Apron

aid isin dom gatesA

aid isin pushbackR cap pushbackC

(apid apron) isin aprons

gatesR998400 = gatesR

taxiingR998400 = taxiingR

gatesA998400 = aid gatesA⩤

apronQ998400 = apronQ ⟨aid⟩

Pushback

aprons998400 = aprons cup (apid apron)↦

pushbackC998400 = pushbackCaid

pushbackR998400 = pushbackRaid

Pre-postconditions are as follows (i) the aircraft mustbe assigned a gate (ii) it is in the lists of pushback requestsand pushback clearance (iii) the aircraft is removed from thegate list (iv) the aircraft is removed from the pushback andclearance lists (v) the aircraft is allowed to enter the apronarea (vi) the rest of the variables of gate and apron controllersare unchanged

The taxi request procedure is defined below by usingTaxiRequest schema consisting of ΔApronController andaircrafts identifier The schema definition is given belowfollowing the informal description

ΔApronController

aid AircraftId

aid = apronQ 1

apronQ998400 = apronQ

pushbackC998400 = pushbackC

aid notin ran taxiingR

taxiingR998400 = taxiingR ⟨aid⟩

TaxiRequest

Pre-postconditions are as follows (i) the aircraft whichhas requested for taxiing is the first one in the queue inapron area (ii) the aircraft does not belong to the listof aircrafts waiting for taxiing (iii) the aircraft is addedin the list of aircrafts waiting for taxiing (iv) the othertwo variables apronQ and pushbackC of apron controllerremained unchanged

Finally formal procedure of leaving the apron area for anaircraft and entering into taxiway is described usingEnterTaxi

Abstract and Applied Analysis 7

schema which consists of ΔApronController ΔTaxiways air-craft taxiway identifier and taxiway The aircraft is removedfrom the waiting list of aircrafts by using the filter ldquordquooperation

ΔApronController

ΔTaxiways

acr Aircrafttid TaxiwayIdtaxiway Taxiway

acr middot aircraftid isin ran taxiingR

acr middot aircraftid = apronQ 1

taxiingR998400

apronQ998400

pushbackC998400 = pushbackC

taxiways998400 = taxiways

middot aircraftid ∙ i(i acr middot aircraftid) notin taxiingR and aid acrne

middot aircraftid ∙ i(i acr middot aircraftid) notin apronQ and aid acrne

taxiingR

apronQ

EnterTaxi

taxiingA998400 = taxiingA cup (tid acr middot aircraftid)↦

(tid taxiway) isin taxiways

= i N aid AircraftId | i isin dom taxiingR and

= i N aid AircraftId | i isin dom apronQand

Pre-postconditions are as follows (i) the aircraft musthave taxiing permission (ii) the aircraft which has requestedfor taxiing is the first one in the queue in the apron area(iii) after the aircraft has taxied it is removed from the listof aircrafts having permission for taxiing and from the apronarea (iv) the rest of the variables of apron controller remainedunchanged

5 Model Analysis

In this section formal analysis of the specification is providedusing ZEves toolset Aswe know there does not exist any realcomputer tool which may assure complete correctness of for-mal specificationThat means even if the formal specificationis written well it may cause potential errors Hence an art ofwriting formal specification does not provide any guaranteeabout correctness of the model If the formal specification ofa system is analysed with a computer tool it improves theconfidence by identifying errors if it exists in the model

The ZEves is a powerful tool used here for analysing theformal specification of a part of the air traffic control systemresponsible for aircraftmovement from gate to the active areafor taxiing Some schemas of the formalmodel are checked tobe correct while the others are proved by reduction techniqueavailable in the tool

Table 1 Results of model analysis

Schema Name Syntax typecheck

Domaincheck Reduction Proof by

reductionGraph Y Y Ylowast YGate Gates Y Y NA YApron Aprons Y Y NA YTaxiway Taxiways Y Y NA YAirportTopology Y Y Ylowast YAircraft Aircrafts Y Y NA YGateController Y Y NA YApronController Y Y NA YRequestGate Y Y Ylowast YAssignGate Y Y NA YPushbackRequest Y Y NA YPushback Y Y Ylowast YTaxiRequest Y Y Ylowast YEnterTaxi Y Y Ylowast Y

Summary of the results is provided in Table 1 In firstcolumn of the table name of the schema is provided Thesecond column is used for syntax and type checking Thedomain checks proofs in the tool guarantees the consis-tency of the formal specifications for axiomatic declarationsDomain checking is done in column 3 Proof by reductionis a technique in which equivalent simpler combinations oftactics is substituted Reduction and proof by reduction arerepresented in columns 4 and 5 respectively The symbolldquoYrdquo in the table indicates that all schemas are proved to becorrect automatically The symbol ldquoYrdquo annotated with ldquolowastrdquoshows that the schema is proved to be correct by reductiontechnique The symbol ldquoNArdquo in 4th column is used to meanthat reduction is not required on the predicates and hencethe formal specification is proved to be written well andmeaningful

6 Conclusion

In this paper we have described a formal procedure forair traffic flow management from gate to taxiing in airtraffic control (ATC) system Initially we have describedfundamental components for description of the requiredsystemThe airport surface is represented using graph theoryas a part of static model We observed that graph modelwas an effective one for defining connectivity relation andappropriate taxing routs Dynamic model is described formanipulating critical information based on the static modelSafety properties are described in terms of invariants overthe components in the static model Pre- and postconditionsare used to define safety criteria in the operational system toavoid any unwanted situation Z notation is applied becauseof its rigorous and abstract nature for formal analysis of thiscritical system

We observed that the complexity of the ATC system wasreduced by decomposing into its components The use ofschema structure in Z notation facilitated both in the static

8 Abstract and Applied Analysis

and dynamic parts of the model Systematic developmentfrom abstraction to detailed model made it easy to proposea simple and abstract model

There exists much work on modelling of ATC systemhowever it needs more research to address next generationautomated systems achieving the required level of safety andefficiency The work of Michael and Steven is close to this inwhich gate management and ramp operations are analysedfor reducing delay time fuel burning and other costs [48]In their work the approach is fairly conservative based onobservations and results are not fully verified and established

Various benefits describing formal specification ofthe system were observed For example modelling ofcomponent-based system provided us with a completecharacterization at a higher level of abstraction On theother hand if the system was specified at a more detailedlevel intuition may have been lost Compositional approachenabled us to give reasoning about the components andsubsequently the entire system Further advantages of aformal model can be observed after refinement The detailedmodel can be achieved after a series of refinements whileguaranteeing the transformation of syntax and semanticsrules

A clear scope and set of assumptions were definedbefore producing a mathematical model of the system It ismentioned that this formal model can be applied to an ATCsystem after a further refinement and analysisThis is becausewe have defined the properties based on the requirements ofa real ATC system

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

References

[1] J VilliersERASMUSmdashAFriendlyWay for Breaking the CapacityBarrier ITA 2004

[2] H Erzberger ldquoTransforming the NAS the next generationair traffic control systemrdquo in Proceedings of the InternationalCongress of the Aeronautical Sciences 2004

[3] H Erzberger ldquoAutomated conflict resolution for air trafficcontrolrdquo in Proceedings of the 25th International Congress of theAeronautical Sciences 2006

[4] H Erzberger and K Heere ldquoAlgorithm and operational conceptfor resolving short range conflictsrdquo Journal of Aerospace Engi-neering vol 224 pp 225ndash243 2009

[5] T Farley and H Erzberger ldquoFast time air traffic simulation of aconflict resolution algorithm under high air traffic demandrdquo inProceedings of the USA Europe ATM Seminar 2007

[6] J Hu M Prandini and S Sastry ldquoOptimal maneuver formultiple aircraft conflict resolution a braid point of viewrdquo inProceedings of the 39th IEEE Confernce on Decision and Controlvol 4 pp 4164ndash4169 December 2000

[7] S T Shorrock and B Kirwan ldquoDevelopment and application ofa human error identification tool for air traffic controlrdquo AppliedErgonomics vol 33 no 4 pp 319ndash336 2002

[8] N E Debbache ldquoToward a new organization for air trafficcontrolrdquo Aircraft Engineering and Aerospace Technology vol 73no 6 pp 561ndash567 2001

[9] W Marshall and W I Joseph ldquoAirport movement area safetysystemrdquo in Proceedings of the IEEE Digital Avionics SystemsConference pp 549ndash552 1992

[10] Y Guo X Cao and J Zhang ldquoConstraint handling based mul-tiobjective evolutionary algorithm for aircraft landing schedul-ingrdquo International Journal of Innovative Computing Informationand Control vol 5 no 8 pp 2229ndash2238 2009

[11] G J Couluris R K Fong M B Downs et al ldquoA new modelingcapability for airport surface traffic analysisrdquo in Proceedings ofthe IEEEAIAA 27th Digital Avionics Systems Conference (DASCrsquo08) pp E41ndashE411 October 2008

[12] J M SpiveyThe Z Notation A Reference manual Prentice HallLondon UK 1992

[13] European Electro-Technical Standardization ldquoRailway applica-tions communications signaling and processing systems soft-ware for railway control and protection systemsrdquoThe EuropeanStandard BS EN 50128 2001

[14] J Garcıa A Berlanga J M Molina J A Besada and J RCasar ldquoPlanning techniques for airport ground operationsrdquo inProceedings of the 21st Digital Avionics Systems Conference 2002

[15] P M Moertl J M Hitt II S Atkins C Brinton and D HWalton ldquoFactors for predicting airport surface characteristicsand prediction accuracy of the surface management systemrdquoin Proceedings of the IEEE International Conference on SystemsMan and Cybernetics pp 3798ndash3803 October 2003

[16] T T B Hanh and D V Hung ldquoVerification of an air trafficcontrol system with probabilistic real-time model checkingrdquoTech Rep 355 UNU-IIST 2007

[17] G J M Koeners E P Stout and R M Rademaker ldquoImprovingtaxi traffic flow by real-time runway sequence optimizationusing dynamic taxi route planningrdquo in Proceedings of the 30thIEEEAIAA Digital Avionics Systems Conference (DASC rsquo11)October 2011

[18] G J M Koeners and R M Rademaker ldquoAnalyze possiblebenefits of real-time taxi flow optimization using actual datardquoin Proceedings of the 30th Digital Avionics Systems Conference(DASC rsquo11) Fremont Calif USA October 2011

[19] S Amy J S Philip and B Charles Ramp Control Issues inthe Design of a Surface Management System Cognitive SystemsEngineering Laboratory The Ohio State University 2002

[20] M Kwiatkowska G Norman J Sproston and F Wang ldquoSym-bolic model checking for probabilistic timed automatardquo in JointConference on Formal Modeling and Analysis of Timed Systemsand Formal Techniques in Real-Time and Fault Tolerant Systemsvol 3253 of Lecture Notes in Computer Science pp 293ndash208Springer 2004

[21] M Nguyen-Duc J-P Briot A Drogoul and V Duong ldquoAnapplication of multi-agent coordination techniques in air trafficmanagementrdquo in Proceedings of the IEEEWIC InternationalConference on Intelligent Agent Technology pp 622ndash628 Octo-ber 2003

[22] L C Yang and J K Kuchar ldquoPrototype conflict alerting systemfor free flightrdquo Journal of Guidance Control and Dynamics vol20 no 4 pp 768ndash773 1997

[23] D P Alves L Weigang B Bueno and B B Souza ldquoReinforce-ment learning to support meta-level control in air traffic man-agementrdquo in Reinforcement Learning Theory and Applicationspp 357ndash372 ARS Publishing 2008

Abstract and Applied Analysis 9

[24] L Weigang M V P Dib D P Alves and A M F CrespoldquoIntelligent computingmethods in air traffic flowmanagementrdquoTransportation Research C Emerging Technologies vol 18 no 5pp 781ndash793 2010

[25] A Cavcar and M Cavcar ldquoImpact of aircraft performance dif-ferences on fuel consumption of aircraft in air of managementenvironmentrdquo Aircraft Engineering and Aerospace Technologyvol 76 no 5 pp 502ndash515 2004

[26] I Hwang andC Tomlin ldquoProtocol-based conflict resolution forfinite information horizonrdquo inProceedings of the IEEEAmericanControl Conference (ACC rsquo02) pp 748ndash753 Piscataway NJUSA May 2002

[27] I Hwang J Hwang andC Tomlin ldquoFlight-mode-based aircraftconflict detection using a residual-mean interacting multiplemodel algorithmrdquo in Proceedings of the AIAA Guidance Navi-gation and Control Conference 2003

[28] I Hwang H Balakrishnan K Roy and C Tomlin ldquoTargettracking and identity management in clutter for air trafficcontrolrdquo in Proceedings of the American Control Conference(AAC rsquo04) 2004

[29] K Bousson ldquoWaypoint-constrained free flight collision avoid-ancerdquo in Proceedings of the SAE Advances in Aviation SafetyConference 2003

[30] S Kahne and I Frolow ldquoAir trafficmanagement evolution withtechnologyrdquo IEEE Control Systems Magazine vol 16 no 4 pp12ndash21 1996

[31] M S Nolan Fundamentals of Air Traffic Control BrooksColeWadsworth Ohio USA 3rd edition 1998

[32] J K Kuchar and L C Yang ldquoA review of conflict detection andresolution modeling methodsrdquo IEEE Transactions on IntelligentTransportation Systems vol 1 no 4 pp 179ndash189 2000

[33] J Hu M Pradini and S Sastry ldquoOptimal coordinated maneu-vers for three-dimensional aircraft conflict resolutionrdquo Journalof Guidance Control and Dynamics vol 25 no 5 pp 888ndash9002002

[34] S R Wolfe F Y Enomoto P A Jarvis and M SierhuisldquoComparing route selection strategies in collaborative trafficflowmanagementrdquo in Proceedings of the IEEE Computer SocietyTechnical Committee on Intelligent Informatics (TCII rsquo07) pp59ndash62 November 2007

[35] S Yousaf N A Zafar and S A Khan ldquoFormal analysis ofdeparture procedure of air traffic control systemrdquo in Proceedingsof the 2nd International Conference on Software Technology andEngineering (ICSTE rsquo10) pp 301ndash305 October 2010

[36] N A Zafar and K Araki ldquoFormalizing moving block railwayinterlocking system for directed networkrdquo Research Reportson Information Science and Electrical Engineering of KyushuUniversity vol 8 no 2 pp 109ndash114 2003

[37] N A Zafar ldquoModeling and formal specification of automatedtrain control system using Z notationrdquo in Proceedings of theIEEE InternationalMultitopic Conference (INMIC rsquo06) pp 438ndash443 December 2006

[38] N A Zafar S A Khan and K Araki ldquoTowards the safetyproperties of moving block railway interlocking systemrdquo Inter-national Journal of Innovative Computing Information andControl vol 8 no 8 pp 5677ndash5690 2012

[39] N A Zafar ldquoSafety control management at airport taxiing totake-off procedurerdquo The Arab Journal of Science and Engineer-ing In press

[40] R Banach C Jeske A Hall and S Stepney ldquoRetrenchmentand the atomicity patternrdquo in Proceedings of the 5th IEEE

International Conference on Software Engineering and FormalMethods (SEFM rsquo07) pp 37ndash46 September 2007

[41] A C Garcia H Idris R Vivona and S Green ldquoCommonaircraft performancemodeling evaluation tools and experimentresultsrdquo in Proceedings of the 24th Digital Avionics SystemsConference (DASC rsquo05) pp 51ndash59 2005

[42] M Jamal and N A Zafar ldquoFormal model of computer-basedair traffic control system using Z notationrdquo in Proceedingsof the 17th International Conference on Computer Theory andApplications 2007

[43] M Jamal and N A Zafar ldquoRequirements analysis of airtraffic control system using formal methodsrdquo in Proceedingsof the International Conference on Information and EmergingTechnologies (ICIET rsquo07) pp 216ndash222 July 2007

[44] M Medina L Sherry and M Feary ldquoAutomation for taskanalysis of next generation air traffic management systemsrdquoTransportation Research C Emerging Technologies vol 18 no6 pp 921ndash929 2010

[45] S Pickin C Jard T Jeron J-M Jezequel and Y Le TraonldquoTest synthesis fromUMLmodels of distributed softwarerdquo IEEETransactions on Software Engineering vol 33 no 4 pp 252ndash2692007

[46] A M F Crespo C V Aquino B B Souza L Weigang A CM A Melo A and D P Alves ldquoDistributed decision supportsystem applied to tactical air traffic flow management in caseof CINDACTA Irdquo Journal of the Brazilian Air TransportationResearch Society vol 4 no 1 pp 47ndash60 2008

[47] C Livadas J Lygeros and N A Lynch ldquoHigh-level modelingand analysis of the TrafficAlert andCollisionAvoidance System(TCAS)rdquo Proceedings of the IEEE vol 88 no 7 pp 926ndash9472000

[48] C Michael and S Steven ldquoManaging gate and ramp operationsto reduce delay fuel burn and costsrdquo in Proceedings of theIntegrated Communications Navigation and Surveillance Con-ference (ICNS rsquo12) 2012

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Abstract and Applied Analysis 7

schema which consists of ΔApronController ΔTaxiways air-craft taxiway identifier and taxiway The aircraft is removedfrom the waiting list of aircrafts by using the filter ldquordquooperation

ΔApronController

ΔTaxiways

acr Aircrafttid TaxiwayIdtaxiway Taxiway

acr middot aircraftid isin ran taxiingR

acr middot aircraftid = apronQ 1

taxiingR998400

apronQ998400

pushbackC998400 = pushbackC

taxiways998400 = taxiways

middot aircraftid ∙ i(i acr middot aircraftid) notin taxiingR and aid acrne

middot aircraftid ∙ i(i acr middot aircraftid) notin apronQ and aid acrne

taxiingR

apronQ

EnterTaxi

taxiingA998400 = taxiingA cup (tid acr middot aircraftid)↦

(tid taxiway) isin taxiways

= i N aid AircraftId | i isin dom taxiingR and

= i N aid AircraftId | i isin dom apronQand

Pre-postconditions are as follows (i) the aircraft musthave taxiing permission (ii) the aircraft which has requestedfor taxiing is the first one in the queue in the apron area(iii) after the aircraft has taxied it is removed from the listof aircrafts having permission for taxiing and from the apronarea (iv) the rest of the variables of apron controller remainedunchanged

5 Model Analysis

In this section formal analysis of the specification is providedusing ZEves toolset Aswe know there does not exist any realcomputer tool which may assure complete correctness of for-mal specificationThat means even if the formal specificationis written well it may cause potential errors Hence an art ofwriting formal specification does not provide any guaranteeabout correctness of the model If the formal specification ofa system is analysed with a computer tool it improves theconfidence by identifying errors if it exists in the model

The ZEves is a powerful tool used here for analysing theformal specification of a part of the air traffic control systemresponsible for aircraftmovement from gate to the active areafor taxiing Some schemas of the formalmodel are checked tobe correct while the others are proved by reduction techniqueavailable in the tool

Table 1 Results of model analysis

Schema Name Syntax typecheck

Domaincheck Reduction Proof by

reductionGraph Y Y Ylowast YGate Gates Y Y NA YApron Aprons Y Y NA YTaxiway Taxiways Y Y NA YAirportTopology Y Y Ylowast YAircraft Aircrafts Y Y NA YGateController Y Y NA YApronController Y Y NA YRequestGate Y Y Ylowast YAssignGate Y Y NA YPushbackRequest Y Y NA YPushback Y Y Ylowast YTaxiRequest Y Y Ylowast YEnterTaxi Y Y Ylowast Y

Summary of the results is provided in Table 1 In firstcolumn of the table name of the schema is provided Thesecond column is used for syntax and type checking Thedomain checks proofs in the tool guarantees the consis-tency of the formal specifications for axiomatic declarationsDomain checking is done in column 3 Proof by reductionis a technique in which equivalent simpler combinations oftactics is substituted Reduction and proof by reduction arerepresented in columns 4 and 5 respectively The symbolldquoYrdquo in the table indicates that all schemas are proved to becorrect automatically The symbol ldquoYrdquo annotated with ldquolowastrdquoshows that the schema is proved to be correct by reductiontechnique The symbol ldquoNArdquo in 4th column is used to meanthat reduction is not required on the predicates and hencethe formal specification is proved to be written well andmeaningful

6 Conclusion

In this paper we have described a formal procedure forair traffic flow management from gate to taxiing in airtraffic control (ATC) system Initially we have describedfundamental components for description of the requiredsystemThe airport surface is represented using graph theoryas a part of static model We observed that graph modelwas an effective one for defining connectivity relation andappropriate taxing routs Dynamic model is described formanipulating critical information based on the static modelSafety properties are described in terms of invariants overthe components in the static model Pre- and postconditionsare used to define safety criteria in the operational system toavoid any unwanted situation Z notation is applied becauseof its rigorous and abstract nature for formal analysis of thiscritical system

We observed that the complexity of the ATC system wasreduced by decomposing into its components The use ofschema structure in Z notation facilitated both in the static

8 Abstract and Applied Analysis

and dynamic parts of the model Systematic developmentfrom abstraction to detailed model made it easy to proposea simple and abstract model

There exists much work on modelling of ATC systemhowever it needs more research to address next generationautomated systems achieving the required level of safety andefficiency The work of Michael and Steven is close to this inwhich gate management and ramp operations are analysedfor reducing delay time fuel burning and other costs [48]In their work the approach is fairly conservative based onobservations and results are not fully verified and established

Various benefits describing formal specification ofthe system were observed For example modelling ofcomponent-based system provided us with a completecharacterization at a higher level of abstraction On theother hand if the system was specified at a more detailedlevel intuition may have been lost Compositional approachenabled us to give reasoning about the components andsubsequently the entire system Further advantages of aformal model can be observed after refinement The detailedmodel can be achieved after a series of refinements whileguaranteeing the transformation of syntax and semanticsrules

A clear scope and set of assumptions were definedbefore producing a mathematical model of the system It ismentioned that this formal model can be applied to an ATCsystem after a further refinement and analysisThis is becausewe have defined the properties based on the requirements ofa real ATC system

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

References

[1] J VilliersERASMUSmdashAFriendlyWay for Breaking the CapacityBarrier ITA 2004

[2] H Erzberger ldquoTransforming the NAS the next generationair traffic control systemrdquo in Proceedings of the InternationalCongress of the Aeronautical Sciences 2004

[3] H Erzberger ldquoAutomated conflict resolution for air trafficcontrolrdquo in Proceedings of the 25th International Congress of theAeronautical Sciences 2006

[4] H Erzberger and K Heere ldquoAlgorithm and operational conceptfor resolving short range conflictsrdquo Journal of Aerospace Engi-neering vol 224 pp 225ndash243 2009

[5] T Farley and H Erzberger ldquoFast time air traffic simulation of aconflict resolution algorithm under high air traffic demandrdquo inProceedings of the USA Europe ATM Seminar 2007

[6] J Hu M Prandini and S Sastry ldquoOptimal maneuver formultiple aircraft conflict resolution a braid point of viewrdquo inProceedings of the 39th IEEE Confernce on Decision and Controlvol 4 pp 4164ndash4169 December 2000

[7] S T Shorrock and B Kirwan ldquoDevelopment and application ofa human error identification tool for air traffic controlrdquo AppliedErgonomics vol 33 no 4 pp 319ndash336 2002

[8] N E Debbache ldquoToward a new organization for air trafficcontrolrdquo Aircraft Engineering and Aerospace Technology vol 73no 6 pp 561ndash567 2001

[9] W Marshall and W I Joseph ldquoAirport movement area safetysystemrdquo in Proceedings of the IEEE Digital Avionics SystemsConference pp 549ndash552 1992

[10] Y Guo X Cao and J Zhang ldquoConstraint handling based mul-tiobjective evolutionary algorithm for aircraft landing schedul-ingrdquo International Journal of Innovative Computing Informationand Control vol 5 no 8 pp 2229ndash2238 2009

[11] G J Couluris R K Fong M B Downs et al ldquoA new modelingcapability for airport surface traffic analysisrdquo in Proceedings ofthe IEEEAIAA 27th Digital Avionics Systems Conference (DASCrsquo08) pp E41ndashE411 October 2008

[12] J M SpiveyThe Z Notation A Reference manual Prentice HallLondon UK 1992

[13] European Electro-Technical Standardization ldquoRailway applica-tions communications signaling and processing systems soft-ware for railway control and protection systemsrdquoThe EuropeanStandard BS EN 50128 2001

[14] J Garcıa A Berlanga J M Molina J A Besada and J RCasar ldquoPlanning techniques for airport ground operationsrdquo inProceedings of the 21st Digital Avionics Systems Conference 2002

[15] P M Moertl J M Hitt II S Atkins C Brinton and D HWalton ldquoFactors for predicting airport surface characteristicsand prediction accuracy of the surface management systemrdquoin Proceedings of the IEEE International Conference on SystemsMan and Cybernetics pp 3798ndash3803 October 2003

[16] T T B Hanh and D V Hung ldquoVerification of an air trafficcontrol system with probabilistic real-time model checkingrdquoTech Rep 355 UNU-IIST 2007

[17] G J M Koeners E P Stout and R M Rademaker ldquoImprovingtaxi traffic flow by real-time runway sequence optimizationusing dynamic taxi route planningrdquo in Proceedings of the 30thIEEEAIAA Digital Avionics Systems Conference (DASC rsquo11)October 2011

[18] G J M Koeners and R M Rademaker ldquoAnalyze possiblebenefits of real-time taxi flow optimization using actual datardquoin Proceedings of the 30th Digital Avionics Systems Conference(DASC rsquo11) Fremont Calif USA October 2011

[19] S Amy J S Philip and B Charles Ramp Control Issues inthe Design of a Surface Management System Cognitive SystemsEngineering Laboratory The Ohio State University 2002

[20] M Kwiatkowska G Norman J Sproston and F Wang ldquoSym-bolic model checking for probabilistic timed automatardquo in JointConference on Formal Modeling and Analysis of Timed Systemsand Formal Techniques in Real-Time and Fault Tolerant Systemsvol 3253 of Lecture Notes in Computer Science pp 293ndash208Springer 2004

[21] M Nguyen-Duc J-P Briot A Drogoul and V Duong ldquoAnapplication of multi-agent coordination techniques in air trafficmanagementrdquo in Proceedings of the IEEEWIC InternationalConference on Intelligent Agent Technology pp 622ndash628 Octo-ber 2003

[22] L C Yang and J K Kuchar ldquoPrototype conflict alerting systemfor free flightrdquo Journal of Guidance Control and Dynamics vol20 no 4 pp 768ndash773 1997

[23] D P Alves L Weigang B Bueno and B B Souza ldquoReinforce-ment learning to support meta-level control in air traffic man-agementrdquo in Reinforcement Learning Theory and Applicationspp 357ndash372 ARS Publishing 2008

Abstract and Applied Analysis 9

[24] L Weigang M V P Dib D P Alves and A M F CrespoldquoIntelligent computingmethods in air traffic flowmanagementrdquoTransportation Research C Emerging Technologies vol 18 no 5pp 781ndash793 2010

[25] A Cavcar and M Cavcar ldquoImpact of aircraft performance dif-ferences on fuel consumption of aircraft in air of managementenvironmentrdquo Aircraft Engineering and Aerospace Technologyvol 76 no 5 pp 502ndash515 2004

[26] I Hwang andC Tomlin ldquoProtocol-based conflict resolution forfinite information horizonrdquo inProceedings of the IEEEAmericanControl Conference (ACC rsquo02) pp 748ndash753 Piscataway NJUSA May 2002

[27] I Hwang J Hwang andC Tomlin ldquoFlight-mode-based aircraftconflict detection using a residual-mean interacting multiplemodel algorithmrdquo in Proceedings of the AIAA Guidance Navi-gation and Control Conference 2003

[28] I Hwang H Balakrishnan K Roy and C Tomlin ldquoTargettracking and identity management in clutter for air trafficcontrolrdquo in Proceedings of the American Control Conference(AAC rsquo04) 2004

[29] K Bousson ldquoWaypoint-constrained free flight collision avoid-ancerdquo in Proceedings of the SAE Advances in Aviation SafetyConference 2003

[30] S Kahne and I Frolow ldquoAir trafficmanagement evolution withtechnologyrdquo IEEE Control Systems Magazine vol 16 no 4 pp12ndash21 1996

[31] M S Nolan Fundamentals of Air Traffic Control BrooksColeWadsworth Ohio USA 3rd edition 1998

[32] J K Kuchar and L C Yang ldquoA review of conflict detection andresolution modeling methodsrdquo IEEE Transactions on IntelligentTransportation Systems vol 1 no 4 pp 179ndash189 2000

[33] J Hu M Pradini and S Sastry ldquoOptimal coordinated maneu-vers for three-dimensional aircraft conflict resolutionrdquo Journalof Guidance Control and Dynamics vol 25 no 5 pp 888ndash9002002

[34] S R Wolfe F Y Enomoto P A Jarvis and M SierhuisldquoComparing route selection strategies in collaborative trafficflowmanagementrdquo in Proceedings of the IEEE Computer SocietyTechnical Committee on Intelligent Informatics (TCII rsquo07) pp59ndash62 November 2007

[35] S Yousaf N A Zafar and S A Khan ldquoFormal analysis ofdeparture procedure of air traffic control systemrdquo in Proceedingsof the 2nd International Conference on Software Technology andEngineering (ICSTE rsquo10) pp 301ndash305 October 2010

[36] N A Zafar and K Araki ldquoFormalizing moving block railwayinterlocking system for directed networkrdquo Research Reportson Information Science and Electrical Engineering of KyushuUniversity vol 8 no 2 pp 109ndash114 2003

[37] N A Zafar ldquoModeling and formal specification of automatedtrain control system using Z notationrdquo in Proceedings of theIEEE InternationalMultitopic Conference (INMIC rsquo06) pp 438ndash443 December 2006

[38] N A Zafar S A Khan and K Araki ldquoTowards the safetyproperties of moving block railway interlocking systemrdquo Inter-national Journal of Innovative Computing Information andControl vol 8 no 8 pp 5677ndash5690 2012

[39] N A Zafar ldquoSafety control management at airport taxiing totake-off procedurerdquo The Arab Journal of Science and Engineer-ing In press

[40] R Banach C Jeske A Hall and S Stepney ldquoRetrenchmentand the atomicity patternrdquo in Proceedings of the 5th IEEE

International Conference on Software Engineering and FormalMethods (SEFM rsquo07) pp 37ndash46 September 2007

[41] A C Garcia H Idris R Vivona and S Green ldquoCommonaircraft performancemodeling evaluation tools and experimentresultsrdquo in Proceedings of the 24th Digital Avionics SystemsConference (DASC rsquo05) pp 51ndash59 2005

[42] M Jamal and N A Zafar ldquoFormal model of computer-basedair traffic control system using Z notationrdquo in Proceedingsof the 17th International Conference on Computer Theory andApplications 2007

[43] M Jamal and N A Zafar ldquoRequirements analysis of airtraffic control system using formal methodsrdquo in Proceedingsof the International Conference on Information and EmergingTechnologies (ICIET rsquo07) pp 216ndash222 July 2007

[44] M Medina L Sherry and M Feary ldquoAutomation for taskanalysis of next generation air traffic management systemsrdquoTransportation Research C Emerging Technologies vol 18 no6 pp 921ndash929 2010

[45] S Pickin C Jard T Jeron J-M Jezequel and Y Le TraonldquoTest synthesis fromUMLmodels of distributed softwarerdquo IEEETransactions on Software Engineering vol 33 no 4 pp 252ndash2692007

[46] A M F Crespo C V Aquino B B Souza L Weigang A CM A Melo A and D P Alves ldquoDistributed decision supportsystem applied to tactical air traffic flow management in caseof CINDACTA Irdquo Journal of the Brazilian Air TransportationResearch Society vol 4 no 1 pp 47ndash60 2008

[47] C Livadas J Lygeros and N A Lynch ldquoHigh-level modelingand analysis of the TrafficAlert andCollisionAvoidance System(TCAS)rdquo Proceedings of the IEEE vol 88 no 7 pp 926ndash9472000

[48] C Michael and S Steven ldquoManaging gate and ramp operationsto reduce delay fuel burn and costsrdquo in Proceedings of theIntegrated Communications Navigation and Surveillance Con-ference (ICNS rsquo12) 2012

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

8 Abstract and Applied Analysis

and dynamic parts of the model Systematic developmentfrom abstraction to detailed model made it easy to proposea simple and abstract model

There exists much work on modelling of ATC systemhowever it needs more research to address next generationautomated systems achieving the required level of safety andefficiency The work of Michael and Steven is close to this inwhich gate management and ramp operations are analysedfor reducing delay time fuel burning and other costs [48]In their work the approach is fairly conservative based onobservations and results are not fully verified and established

Various benefits describing formal specification ofthe system were observed For example modelling ofcomponent-based system provided us with a completecharacterization at a higher level of abstraction On theother hand if the system was specified at a more detailedlevel intuition may have been lost Compositional approachenabled us to give reasoning about the components andsubsequently the entire system Further advantages of aformal model can be observed after refinement The detailedmodel can be achieved after a series of refinements whileguaranteeing the transformation of syntax and semanticsrules

A clear scope and set of assumptions were definedbefore producing a mathematical model of the system It ismentioned that this formal model can be applied to an ATCsystem after a further refinement and analysisThis is becausewe have defined the properties based on the requirements ofa real ATC system

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

References

[1] J VilliersERASMUSmdashAFriendlyWay for Breaking the CapacityBarrier ITA 2004

[2] H Erzberger ldquoTransforming the NAS the next generationair traffic control systemrdquo in Proceedings of the InternationalCongress of the Aeronautical Sciences 2004

[3] H Erzberger ldquoAutomated conflict resolution for air trafficcontrolrdquo in Proceedings of the 25th International Congress of theAeronautical Sciences 2006

[4] H Erzberger and K Heere ldquoAlgorithm and operational conceptfor resolving short range conflictsrdquo Journal of Aerospace Engi-neering vol 224 pp 225ndash243 2009

[5] T Farley and H Erzberger ldquoFast time air traffic simulation of aconflict resolution algorithm under high air traffic demandrdquo inProceedings of the USA Europe ATM Seminar 2007

[6] J Hu M Prandini and S Sastry ldquoOptimal maneuver formultiple aircraft conflict resolution a braid point of viewrdquo inProceedings of the 39th IEEE Confernce on Decision and Controlvol 4 pp 4164ndash4169 December 2000

[7] S T Shorrock and B Kirwan ldquoDevelopment and application ofa human error identification tool for air traffic controlrdquo AppliedErgonomics vol 33 no 4 pp 319ndash336 2002

[8] N E Debbache ldquoToward a new organization for air trafficcontrolrdquo Aircraft Engineering and Aerospace Technology vol 73no 6 pp 561ndash567 2001

[9] W Marshall and W I Joseph ldquoAirport movement area safetysystemrdquo in Proceedings of the IEEE Digital Avionics SystemsConference pp 549ndash552 1992

[10] Y Guo X Cao and J Zhang ldquoConstraint handling based mul-tiobjective evolutionary algorithm for aircraft landing schedul-ingrdquo International Journal of Innovative Computing Informationand Control vol 5 no 8 pp 2229ndash2238 2009

[11] G J Couluris R K Fong M B Downs et al ldquoA new modelingcapability for airport surface traffic analysisrdquo in Proceedings ofthe IEEEAIAA 27th Digital Avionics Systems Conference (DASCrsquo08) pp E41ndashE411 October 2008

[12] J M SpiveyThe Z Notation A Reference manual Prentice HallLondon UK 1992

[13] European Electro-Technical Standardization ldquoRailway applica-tions communications signaling and processing systems soft-ware for railway control and protection systemsrdquoThe EuropeanStandard BS EN 50128 2001

[14] J Garcıa A Berlanga J M Molina J A Besada and J RCasar ldquoPlanning techniques for airport ground operationsrdquo inProceedings of the 21st Digital Avionics Systems Conference 2002

[15] P M Moertl J M Hitt II S Atkins C Brinton and D HWalton ldquoFactors for predicting airport surface characteristicsand prediction accuracy of the surface management systemrdquoin Proceedings of the IEEE International Conference on SystemsMan and Cybernetics pp 3798ndash3803 October 2003

[16] T T B Hanh and D V Hung ldquoVerification of an air trafficcontrol system with probabilistic real-time model checkingrdquoTech Rep 355 UNU-IIST 2007

[17] G J M Koeners E P Stout and R M Rademaker ldquoImprovingtaxi traffic flow by real-time runway sequence optimizationusing dynamic taxi route planningrdquo in Proceedings of the 30thIEEEAIAA Digital Avionics Systems Conference (DASC rsquo11)October 2011

[18] G J M Koeners and R M Rademaker ldquoAnalyze possiblebenefits of real-time taxi flow optimization using actual datardquoin Proceedings of the 30th Digital Avionics Systems Conference(DASC rsquo11) Fremont Calif USA October 2011

[19] S Amy J S Philip and B Charles Ramp Control Issues inthe Design of a Surface Management System Cognitive SystemsEngineering Laboratory The Ohio State University 2002

[20] M Kwiatkowska G Norman J Sproston and F Wang ldquoSym-bolic model checking for probabilistic timed automatardquo in JointConference on Formal Modeling and Analysis of Timed Systemsand Formal Techniques in Real-Time and Fault Tolerant Systemsvol 3253 of Lecture Notes in Computer Science pp 293ndash208Springer 2004

[21] M Nguyen-Duc J-P Briot A Drogoul and V Duong ldquoAnapplication of multi-agent coordination techniques in air trafficmanagementrdquo in Proceedings of the IEEEWIC InternationalConference on Intelligent Agent Technology pp 622ndash628 Octo-ber 2003

[22] L C Yang and J K Kuchar ldquoPrototype conflict alerting systemfor free flightrdquo Journal of Guidance Control and Dynamics vol20 no 4 pp 768ndash773 1997

[23] D P Alves L Weigang B Bueno and B B Souza ldquoReinforce-ment learning to support meta-level control in air traffic man-agementrdquo in Reinforcement Learning Theory and Applicationspp 357ndash372 ARS Publishing 2008

Abstract and Applied Analysis 9

[24] L Weigang M V P Dib D P Alves and A M F CrespoldquoIntelligent computingmethods in air traffic flowmanagementrdquoTransportation Research C Emerging Technologies vol 18 no 5pp 781ndash793 2010

[25] A Cavcar and M Cavcar ldquoImpact of aircraft performance dif-ferences on fuel consumption of aircraft in air of managementenvironmentrdquo Aircraft Engineering and Aerospace Technologyvol 76 no 5 pp 502ndash515 2004

[26] I Hwang andC Tomlin ldquoProtocol-based conflict resolution forfinite information horizonrdquo inProceedings of the IEEEAmericanControl Conference (ACC rsquo02) pp 748ndash753 Piscataway NJUSA May 2002

[27] I Hwang J Hwang andC Tomlin ldquoFlight-mode-based aircraftconflict detection using a residual-mean interacting multiplemodel algorithmrdquo in Proceedings of the AIAA Guidance Navi-gation and Control Conference 2003

[28] I Hwang H Balakrishnan K Roy and C Tomlin ldquoTargettracking and identity management in clutter for air trafficcontrolrdquo in Proceedings of the American Control Conference(AAC rsquo04) 2004

[29] K Bousson ldquoWaypoint-constrained free flight collision avoid-ancerdquo in Proceedings of the SAE Advances in Aviation SafetyConference 2003

[30] S Kahne and I Frolow ldquoAir trafficmanagement evolution withtechnologyrdquo IEEE Control Systems Magazine vol 16 no 4 pp12ndash21 1996

[31] M S Nolan Fundamentals of Air Traffic Control BrooksColeWadsworth Ohio USA 3rd edition 1998

[32] J K Kuchar and L C Yang ldquoA review of conflict detection andresolution modeling methodsrdquo IEEE Transactions on IntelligentTransportation Systems vol 1 no 4 pp 179ndash189 2000

[33] J Hu M Pradini and S Sastry ldquoOptimal coordinated maneu-vers for three-dimensional aircraft conflict resolutionrdquo Journalof Guidance Control and Dynamics vol 25 no 5 pp 888ndash9002002

[34] S R Wolfe F Y Enomoto P A Jarvis and M SierhuisldquoComparing route selection strategies in collaborative trafficflowmanagementrdquo in Proceedings of the IEEE Computer SocietyTechnical Committee on Intelligent Informatics (TCII rsquo07) pp59ndash62 November 2007

[35] S Yousaf N A Zafar and S A Khan ldquoFormal analysis ofdeparture procedure of air traffic control systemrdquo in Proceedingsof the 2nd International Conference on Software Technology andEngineering (ICSTE rsquo10) pp 301ndash305 October 2010

[36] N A Zafar and K Araki ldquoFormalizing moving block railwayinterlocking system for directed networkrdquo Research Reportson Information Science and Electrical Engineering of KyushuUniversity vol 8 no 2 pp 109ndash114 2003

[37] N A Zafar ldquoModeling and formal specification of automatedtrain control system using Z notationrdquo in Proceedings of theIEEE InternationalMultitopic Conference (INMIC rsquo06) pp 438ndash443 December 2006

[38] N A Zafar S A Khan and K Araki ldquoTowards the safetyproperties of moving block railway interlocking systemrdquo Inter-national Journal of Innovative Computing Information andControl vol 8 no 8 pp 5677ndash5690 2012

[39] N A Zafar ldquoSafety control management at airport taxiing totake-off procedurerdquo The Arab Journal of Science and Engineer-ing In press

[40] R Banach C Jeske A Hall and S Stepney ldquoRetrenchmentand the atomicity patternrdquo in Proceedings of the 5th IEEE

International Conference on Software Engineering and FormalMethods (SEFM rsquo07) pp 37ndash46 September 2007

[41] A C Garcia H Idris R Vivona and S Green ldquoCommonaircraft performancemodeling evaluation tools and experimentresultsrdquo in Proceedings of the 24th Digital Avionics SystemsConference (DASC rsquo05) pp 51ndash59 2005

[42] M Jamal and N A Zafar ldquoFormal model of computer-basedair traffic control system using Z notationrdquo in Proceedingsof the 17th International Conference on Computer Theory andApplications 2007

[43] M Jamal and N A Zafar ldquoRequirements analysis of airtraffic control system using formal methodsrdquo in Proceedingsof the International Conference on Information and EmergingTechnologies (ICIET rsquo07) pp 216ndash222 July 2007

[44] M Medina L Sherry and M Feary ldquoAutomation for taskanalysis of next generation air traffic management systemsrdquoTransportation Research C Emerging Technologies vol 18 no6 pp 921ndash929 2010

[45] S Pickin C Jard T Jeron J-M Jezequel and Y Le TraonldquoTest synthesis fromUMLmodels of distributed softwarerdquo IEEETransactions on Software Engineering vol 33 no 4 pp 252ndash2692007

[46] A M F Crespo C V Aquino B B Souza L Weigang A CM A Melo A and D P Alves ldquoDistributed decision supportsystem applied to tactical air traffic flow management in caseof CINDACTA Irdquo Journal of the Brazilian Air TransportationResearch Society vol 4 no 1 pp 47ndash60 2008

[47] C Livadas J Lygeros and N A Lynch ldquoHigh-level modelingand analysis of the TrafficAlert andCollisionAvoidance System(TCAS)rdquo Proceedings of the IEEE vol 88 no 7 pp 926ndash9472000

[48] C Michael and S Steven ldquoManaging gate and ramp operationsto reduce delay fuel burn and costsrdquo in Proceedings of theIntegrated Communications Navigation and Surveillance Con-ference (ICNS rsquo12) 2012

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Abstract and Applied Analysis 9

[24] L Weigang M V P Dib D P Alves and A M F CrespoldquoIntelligent computingmethods in air traffic flowmanagementrdquoTransportation Research C Emerging Technologies vol 18 no 5pp 781ndash793 2010

[25] A Cavcar and M Cavcar ldquoImpact of aircraft performance dif-ferences on fuel consumption of aircraft in air of managementenvironmentrdquo Aircraft Engineering and Aerospace Technologyvol 76 no 5 pp 502ndash515 2004

[26] I Hwang andC Tomlin ldquoProtocol-based conflict resolution forfinite information horizonrdquo inProceedings of the IEEEAmericanControl Conference (ACC rsquo02) pp 748ndash753 Piscataway NJUSA May 2002

[27] I Hwang J Hwang andC Tomlin ldquoFlight-mode-based aircraftconflict detection using a residual-mean interacting multiplemodel algorithmrdquo in Proceedings of the AIAA Guidance Navi-gation and Control Conference 2003

[28] I Hwang H Balakrishnan K Roy and C Tomlin ldquoTargettracking and identity management in clutter for air trafficcontrolrdquo in Proceedings of the American Control Conference(AAC rsquo04) 2004

[29] K Bousson ldquoWaypoint-constrained free flight collision avoid-ancerdquo in Proceedings of the SAE Advances in Aviation SafetyConference 2003

[30] S Kahne and I Frolow ldquoAir trafficmanagement evolution withtechnologyrdquo IEEE Control Systems Magazine vol 16 no 4 pp12ndash21 1996

[31] M S Nolan Fundamentals of Air Traffic Control BrooksColeWadsworth Ohio USA 3rd edition 1998

[32] J K Kuchar and L C Yang ldquoA review of conflict detection andresolution modeling methodsrdquo IEEE Transactions on IntelligentTransportation Systems vol 1 no 4 pp 179ndash189 2000

[33] J Hu M Pradini and S Sastry ldquoOptimal coordinated maneu-vers for three-dimensional aircraft conflict resolutionrdquo Journalof Guidance Control and Dynamics vol 25 no 5 pp 888ndash9002002

[34] S R Wolfe F Y Enomoto P A Jarvis and M SierhuisldquoComparing route selection strategies in collaborative trafficflowmanagementrdquo in Proceedings of the IEEE Computer SocietyTechnical Committee on Intelligent Informatics (TCII rsquo07) pp59ndash62 November 2007

[35] S Yousaf N A Zafar and S A Khan ldquoFormal analysis ofdeparture procedure of air traffic control systemrdquo in Proceedingsof the 2nd International Conference on Software Technology andEngineering (ICSTE rsquo10) pp 301ndash305 October 2010

[36] N A Zafar and K Araki ldquoFormalizing moving block railwayinterlocking system for directed networkrdquo Research Reportson Information Science and Electrical Engineering of KyushuUniversity vol 8 no 2 pp 109ndash114 2003

[37] N A Zafar ldquoModeling and formal specification of automatedtrain control system using Z notationrdquo in Proceedings of theIEEE InternationalMultitopic Conference (INMIC rsquo06) pp 438ndash443 December 2006

[38] N A Zafar S A Khan and K Araki ldquoTowards the safetyproperties of moving block railway interlocking systemrdquo Inter-national Journal of Innovative Computing Information andControl vol 8 no 8 pp 5677ndash5690 2012

[39] N A Zafar ldquoSafety control management at airport taxiing totake-off procedurerdquo The Arab Journal of Science and Engineer-ing In press

[40] R Banach C Jeske A Hall and S Stepney ldquoRetrenchmentand the atomicity patternrdquo in Proceedings of the 5th IEEE

International Conference on Software Engineering and FormalMethods (SEFM rsquo07) pp 37ndash46 September 2007

[41] A C Garcia H Idris R Vivona and S Green ldquoCommonaircraft performancemodeling evaluation tools and experimentresultsrdquo in Proceedings of the 24th Digital Avionics SystemsConference (DASC rsquo05) pp 51ndash59 2005

[42] M Jamal and N A Zafar ldquoFormal model of computer-basedair traffic control system using Z notationrdquo in Proceedingsof the 17th International Conference on Computer Theory andApplications 2007

[43] M Jamal and N A Zafar ldquoRequirements analysis of airtraffic control system using formal methodsrdquo in Proceedingsof the International Conference on Information and EmergingTechnologies (ICIET rsquo07) pp 216ndash222 July 2007

[44] M Medina L Sherry and M Feary ldquoAutomation for taskanalysis of next generation air traffic management systemsrdquoTransportation Research C Emerging Technologies vol 18 no6 pp 921ndash929 2010

[45] S Pickin C Jard T Jeron J-M Jezequel and Y Le TraonldquoTest synthesis fromUMLmodels of distributed softwarerdquo IEEETransactions on Software Engineering vol 33 no 4 pp 252ndash2692007

[46] A M F Crespo C V Aquino B B Souza L Weigang A CM A Melo A and D P Alves ldquoDistributed decision supportsystem applied to tactical air traffic flow management in caseof CINDACTA Irdquo Journal of the Brazilian Air TransportationResearch Society vol 4 no 1 pp 47ndash60 2008

[47] C Livadas J Lygeros and N A Lynch ldquoHigh-level modelingand analysis of the TrafficAlert andCollisionAvoidance System(TCAS)rdquo Proceedings of the IEEE vol 88 no 7 pp 926ndash9472000

[48] C Michael and S Steven ldquoManaging gate and ramp operationsto reduce delay fuel burn and costsrdquo in Proceedings of theIntegrated Communications Navigation and Surveillance Con-ference (ICNS rsquo12) 2012

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of


Recommended