Air traffic control system

Abstract

To reduce the risk that a ground control operator of a remote monitoring target drone embeds a defect although the operator is intended to perform recovery control.SOLUTION: A control device 11 defines as a control target machine body a machine body of which autonomously operates so as to satisfy a goal constraint condition while satisfying an invariable constraint condition, collects a present state value vector, a scheduled state value vector sequence, the goal constraint condition and the invariable constraint condition for each of a plurality of control target machine bodies and comprises a function for determining any competition factor of a first competition of the invariable constraint condition of a first machine body and the invariable constraint condition of a second machine body, a second competition of the goal constraint condition of the first machine body and the invariable constraint condition of the second machine body or a third competition of the goal constraint condition of the first machine body and the goal constraint condition of the second machine body.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an air traffic control device for a large number of unmanned autonomous flying aircraft. [Background Art]

[0002] When operating drones suitable for medium-sized inter-facility logistics with a load capacity exceeding 100 kg on a scale of more than 100,000 units, a mechanism that facilitates large-scale operation by allowing a small number of operators to control a large number of drones is required. It is desirable that the integrated work from loading, wide-area information collection, route calculation, takeoff permission, takeoff, climbing, stable navigation, descending, landing, unloading, or relaying be automated as much as possible. On the other hand, a division of labor system is required in which operators normally only engage in monitoring or policy determination for exception handling.

[0003] Operators are subject to the obligation of safe navigation, and thus have the following obligations. • Confirming that countermeasures against known hazard scenarios have been implemented through cooperation between the aircraft and the ground control side. • When exception handling requiring manual intervention is requested, immediately grasping the situation to at least prevent hazards caused by misjudgment.

[0004] An autonomously operating aircraft sets a minimum control problem unit represented by calculating an operation plan solution that satisfies a goal condition under safety constraints, and periodically executes a basic internal processing system for calculating the satisfying solution. If a single aircraft cannot obtain a satisfying solution, the safety constraint conflicts with the goal condition, and in most cases, relaxation or modification of the goal condition is required.

[0005] When a plurality of such aircraft gather and operate in parallel within controlled airspace, any of the following conflicts will cause a loss of functional integrity hazard. (a) Conflict between goal conditions (b) Conflict between a goal condition of one aircraft and a safety constraint of another aircraft (c) Conflict between safety constraints

[0006] In this case, the exclusive resource subject to competition is a convex closed region (a region without depressions enclosed by a half-plane) within the flight airspace. At a minimum, competition for the convex closed region, which is an argument to the goal conditions and safety constraints, can cause functional mismatch errors. Unless each aircraft has its own exclusive control function, functional mismatch errors must be detected correctly. As the number of aircraft sharing airspace increases, the frequency of functional mismatch errors increases combinatorially. This problem becomes apparent when a large number of aircraft are heading towards a limited number of landing ports. Landing port control operators are obligated to prevent crashes caused by aircraft collisions, but they cannot simultaneously control individual aircraft and enforce mutual exclusion between them. Therefore, there is a need for a system that enables the parallel operation of multiple aircraft in a mechanically feasible manner, thereby achieving a safe navigation system through mutual exclusion control.

[0007] Patent Document 1 discloses an operation management system that performs the following steps (1) to (4). (Step 1) Collect the drone's location information, flight status information, and aircraft status. (Step 2) Set the collision zone to be determined as a collision state and detect the interference state. (Step 3) The system determines that the drone is in a collision situation and notifies the flight manager of a collision warning. (Step 4) Instruct the drone to hover in mid-air. In a broad sense, this corresponds to (c) a design that avoids conflicts between safety constraints, but (b) means for detecting functional mismatch errors originating from conflicts between the goal conditions of the first aircraft and the safety constraints of the second aircraft, and means for resolving conflicts are not disclosed.

[0008] Patent Document 2 describes a system for assigning arrival sequences to aircraft, which adjusts the arrival times of each aircraft to comply with air traffic control constraints based on the position, speed, aircraft-specific characteristic information, and flight plan of the aircraft. The design, which attempts to avoid conflicts at landing ports at the time of flight plan clearance, does not function when exceptions occur that deviate from those constraints. In fact, flight delays and temporary acceptance due to the closure of adjacent landing ports can cause conflict situations that require the aforementioned exclusive control, but the specific processing procedures are not mentioned.

[0009] Patent Document 3 refers to a data representation that assigns binary labels to distinguish between the inside and outside as a binary vector model format. [Prior art documents] [Patent Documents]

[0010] [Patent Document 1] Japanese Patent Publication No. 2022-147583 [Patent Document 2] Japanese Patent Publication No. 2011-170502 [Patent Document 3] Japanese Patent Publication No. 2022-035526 [Overview of the project] [Problems that the invention aims to solve]

[0011] Each autonomous aircraft is equipped with numerous external measurement sensors, and the process of processing multi-input, multi-output data flows can lead to complex situations requiring operator exception handling. When such a functional mismatch error occurs, it is necessary to acquire and interpret data from the internal motion planning system to identify the cause of the malfunction.

[0012] However, the aircraft is constantly moving, and as flight time increases, the risk of running out of fuel and crashing at the landing port increases. Generally, it is difficult to remotely assess the situation in a short time and reset the goal conditions as intended, and therefore the psychological burden on the operator is high. If individual aircraft are operated by an organization different from air traffic control, access to the aircraft itself may not be possible. In addition, each aircraft has limitations in communication bandwidth and measurement limits for its external environment measurement system. Because drones have limited computing power and memory bandwidth to prioritize the continuation of flight operations, it is also difficult to have multiple drones cooperate and handle conflict processing.

[0013] In this situation, there is a risk that the ground control operator of a remotely monitored drone may inadvertently introduce a malfunction while attempting to recover control. Furthermore, if the operator's failure to recover control leads to a persistent state of functional inconsistency error and the risk of an accident materializes, and the only means available is to reprogram each individual aircraft, the operator will not be able to verify the safety of their work, and there will be a lack of means to detect and address specific malfunctions. [Means for solving the problem]

[0014] To solve the aforementioned problem, this Disclosure The control system has the following features: Book Disclosure The controlled aircraft is defined as an aircraft that operates autonomously while satisfying the goal constraints while satisfying the invariant constraints. For each of the multiple aircraft under control, collect the current state value vector, the planned state value vector sequence, the goal constraints, and the invariant constraints. Based on whether or not the closed regions defined by the aforementioned goal constraint and invariant constraint intersect, It has a function to determine any of the following conflict factors: a first conflict between the invariant constraints of the first aircraft and the invariant constraints of the second aircraft, a second conflict between the goal constraint of the first aircraft and the invariant constraints of the second aircraft, or a third conflict between the goal constraint of the first aircraft and the goal constraint of the second aircraft. death, The current state value vector is a state quantity vector of the current state, including the current position of the aircraft under control. The aforementioned planned state value vector sequence is a time-series state quantity vector sequence representing the planned trajectory of the controlled aircraft, The aforementioned goal constraints include conditions such as reaching the landing reference point of the landing port or remaining within the area where the aircraft should stay. The aforementioned invariant constraint is a condition that encompasses the current position of the controlled aircraft, indicated by the current state value vector, and the planned trajectory of the controlled aircraft, indicated by the planned state value vector sequence, and defines a closed region with a safety margin, and is represented by a data point cloud in binary vector model format. characterized thereby. Other means will be described later. Effects of the Invention

[0015] According to the present invention, it is possible to reduce the risk that a ground control operator of a remotely monitored drone embeds a malfunction even though the operator intended to perform recovery control. Furthermore, even when a functional inconsistency error state continues due to a failure of the operator's recovery control and the risk of an accident becomes actualized, specific failure detection and coping means are provided for the operator to verify work safety. Brief Description of the Drawings

[0016] [Figure 1] It is a configuration diagram of a ground-side control system according to the present embodiment. [Figure 2] It is a hardware configuration diagram of a control device according to the present embodiment. [Figure 3] It is a flowchart showing processing of the control device according to the present embodiment. [Figure 4] It is an explanatory diagram showing a data structure handled by the control device according to the present embodiment. [Figure 5] It is an explanatory diagram showing an aircraft occupation area R of each aircraft according to the present embodiment. [Figure 6] It is an explanatory diagram showing a situation where no data consistency error has occurred in each aircraft heading to a landing port according to the present embodiment. [Figure 7] It is an explanatory diagram showing a situation where a data consistency error has occurred in the aircraft P3 of FIG. 6 according to the present embodiment. [Figure 8] It is an explanatory diagram showing a situation where the data consistency error of the aircraft P3 of FIG. 7 has been resolved according to the present embodiment. [Figure 9] It is an explanatory diagram showing an example of a planned trajectory of the aircraft P3 of FIG. 6 according to the present embodiment. [Figure 10] It is an explanatory diagram showing an example of a convex closed region of the aircraft P3 calculated from the planned trajectory of FIG. 9 according to the present embodiment. [Figure 11] This is an explanatory diagram showing a situation in which no functional mismatch errors have occurred in each of the units in Figure 6 of this embodiment. [Figure 12] This is an explanatory diagram showing the situation in which a functional mismatch error occurs in each unit of Figure 6 in this embodiment. [Figure 13] This table shows an example of a competition graph constructed by the control system according to this embodiment. [Figure 14] This is an explanatory diagram illustrating a situation in which a functional mismatch error occurs between the goal condition of aircraft P1 and the invariant condition of aircraft P2 in Figure 6 of this embodiment. [Figure 15] This is an explanatory diagram illustrating a situation in which a functional mismatch error occurs between the goal conditions of aircraft P1 and aircraft P2 in Figure 6 of this embodiment. [Modes for carrying out the invention]

[0017] Examples of the present invention are shown.

[0018] Figure 1 is a diagram showing the configuration of the ground-side control system 10. The ground-side control system 10 consists of a control control unit 11, a terminal information receiving unit 14, a control information transmission unit 12, and a wide-area surveillance radar unit 13. An operator 19 at the control center 100 remotely monitors the processing flow of the control control unit 11, which resolves conflicts between aircraft. The control device 11 transmits control commands (such as landing order commands) to individual aircraft (multiple controlled aircraft) via the control information transmission unit 12. The control device 11 collects the following information from individual aircraft via the terminal information receiving unit 14. • The aircraft's current state (current state value vector) • Vector sequence of planned aircraft status values • The constraints on the aircraft are defined as goal conditions (goal constraints) and invariant conditions (invariant constraints) in the form of a binary vector model.

[0019] Furthermore, since the system is not limited to aircraft capable of hovering near a fixed point, the terminal information receiving unit 14 collects at least two types of information from each aircraft, namely (first collected information) and (second collected information), instead of the current status, in the case of fixed-wing aircraft. (First collected information) Time-series planned trajectory of the dwelling while waiting to land. During the landing waiting phase, each aircraft obtains its relative position to the port reference point from an ILS (Instrument Landing System) or similar device and calculates its estimated self-position. Since fixed-wing aircraft need to continue turning, the aircraft's motion planning system calculates a time-series coordinate point cloud corresponding to the planned trajectory in addition to the current state.

[0020] (Second Collection Information) Function of invariant conditions used by the action planning system The invariant condition is a binary function with the position and velocity of the surrounding moving objects, which change over time, as undetermined variables, and specifies a separation boundary 30 (Figure 6) that divides the interior and exterior with a safety margin. However, no data structure other than that based on convex closed region partitioning is known that can use an arbitrarily shaped closed region in a real-time control system. Furthermore, since it is difficult to analytically describe the calculation formula for the compatibility determination used in the conflict determination, the internal / external separation boundary for the same compatibility determination is constructed using a data representation based on convex closed region partitioning, and the motion planning system uses the internal / external separation boundary as a constraint condition. The boundaries of each convex closed region obtained by convex closed region partitioning using a specified data point cloud are perpendicular bisectors of adjacent data point pairs. Therefore, instead of a specific geometric structure of the separation boundary 30, it can be automatically constructed if a representative data point cloud is available. In this example, each representative data point is assigned a binary label that distinguishes the interior from the exterior, and an interior / exterior separation boundary is constructed for determining whether the invariant condition is met. This data representation of the interior / exterior separation boundary based on convex closed region partitioning is called a binary vector model format (see Patent Document 3). In this example, each aircraft constructs invariant conditions using at least a sequence of data points obtained by linearly extrapolating the relative trajectories (relative position and relative velocity) of surrounding moving objects acquired from the external measurement system, and its own trajectory (position and velocity). Therefore, it is sufficient to have a data point set that represents the invariant condition function, which serves as an argument for constructing the invariant conditions. If it is desired to reuse the results of already performed convex closed region division, a convex closed region in the coordinate system relative to the port reference point may be specified.

[0021] The control device 11 constructs an invariant condition function by sequentially substituting the planned trajectory (first collected information) into the undetermined variables of the invariant condition function (second collected information). As a result, the control device 11 sets a convex closed region so as to include the region in the time-series coordinate point cloud (sequence of self-position prediction values) that has been increased by the safety margin of the invariant condition function (second collected information) (see Figure 10 for details). The separation boundary 30 in Figure 6 shows the result of dividing the entire airspace controlled by the takeoff and landing port into a convex closed region as a separation boundary 30, so that the aircraft-occupied area R of each aircraft and the area near the landing reference point H (the coordinate point that serves as the reference for landing within the landing port 22) are separated. In Figure 6, which will be described later, a simplified representation of the separation boundary 30, which serves as a criterion for instructing each aircraft to remain within a single convex closed region, is shown. The data point cloud collected from all aircraft through the above process is divided into convex closed regions (S204 in Figure 3) to construct the region.

[0022] Figure 2 is a hardware configuration diagram of the control and control device 11. The control device 11 is configured as a computer 900 having a CPU 901, RAM 902, ROM 903, data storage 904, communication I / F 905, input / output I / F 906, and media I / F 907. The communication interface 905 is connected to an external communication device 915. The input / output interface 906 is connected to the input / output device 916. The media interface 907 reads and writes data to the recording medium 917. Furthermore, the CPU 901 improves and controls each processing unit by executing a program (also called an application or app) loaded into the RAM 902. This program can also be distributed via a communication line or by recording it on a recording medium 917 such as a CD-ROM and distributing it that way.

[0023] Figure 3 is a flowchart showing the processing of the control device 11. The following is an overview of each process shown in Figure 3. The control system 11 obtains goal conditions and invariant conditions (conditions indicating safety constraints, conditions indicating performance limits, etc.) in binary vector model format from all aircraft to be controlled registered in the aircraft group list 301 in Figure 4 (S201). The control system 11 obtains the aircraft occupied area R of each aircraft, converted to binary vector model format, from the wide-area surveillance radar unit 13 (S202, see Figure 5 for details). The control system 11 detects an aircraft experiencing a data integrity error (loss of data integrity) and notifies the operator 19 of the detection result (S203, see Figures 6 and 7 for details). The aircraft notified in S203 are those whose current status, as notified by the aircraft, is not within the aircraft-occupied area R.

[0024] Figure 4 is an explanatory diagram showing the data structure handled by the control and control device 11. The air traffic control device 11 is configured to allow data access from a memory unit that stores the aircraft group list 301, the landing order partial order graph 302, and the landing order queue 303. Data access is possible, for example, by using an internal memory unit (such as the data storage 904) of the air traffic control device 11, or by using an externally connected memory unit. The aircraft group list 301 registers the aircraft group (aircraft P1, P2, P3) detected by the wide-area surveillance radar unit 13. The control and control unit 11 constructs a landing order partial order graph 302 in the order of aircraft adjacent to the convex closed region containing the landing reference point H. For example, the landing order partial order graph 302 in Figure 4 indicates that aircraft P1 and P2 will land first, followed by aircraft P3, starting from the head. Note that the landing order of aircraft P1 and P2 within the same item is not specified. Next, the control unit 11 creates a landing order queue 303 by sequentially processing the landing order partial order graph 302 to resolve conflicts in the goal conditions. For example, the landing order queue 303 in Figure 4 indicates that aircraft P1 → P2 → P3 should land in that order. Alternatively, the control center 100 (operator 19) may manually control (edit) the landing order queue 303. For example, when operator 19 receives notification of fuel shortage from aircraft P3, they modify the landing order queue 303 to give the highest priority to aircraft P3's landing order, move at least one of aircraft P1 or P2, which is blocking the landing route, away from the landing reference point H, perform convex closed region division again, and issue a move command so that aircraft P3 is adjacent to the head entry in the landing order partial order graph.

[0025] Returning to Figure 3, the control device 11 presents the competing aircraft pairs to the operator 19 as functional mismatch errors (S204). The competition to be detected in S204 is a process to detect competition A between invariant conditions belonging to each aircraft, which is constructed in binary vector model format using the following data point cloud. • Data point cloud used to construct the aircraft-occupied region R (representing the aircraft-occupied regions P1R, P2R, and P3R, which serve as the separation boundaries in Figure 6) • The collected data point cloud M (representing the convex closed regions P1Y, P2Y, and P3Y that serve as separation boundaries in Figure 11) constitutes the invariant conditions for each controlled aircraft. • Data point cloud W is a merged data point cloud of data point cloud M and landing reference point H. Furthermore, determining the presence or absence of an intersection region between pairs of arbitrarily shaped internal and external separation boundaries requires a large amount of computation. If the internal and external separation boundaries are given in the form of a binary vector model representing a connection of convex closed regions, the problem can be reduced to determining the intersection region of pairs of convex closed regions. The control device 11 can solve the reduced intersection region determination of pairs of convex closed regions at high speed. In addition, if the invariant conditions are given in the form of a binary vector model, the computational load on the aircraft's motion planning system, which has limited computational resources, is also reduced.

[0026] The control device 11 determines in S204 whether or not a competitor A has been detected (S211). If the answer in S211 is Yes (competitor A has been detected), the process proceeds to S212; otherwise, it proceeds to S213. The control device 11 registers the group of aircraft X (aircraft P1 and aircraft P2 in Figure 6) located in the convex closed region adjacent to the convex closed region with landing reference point H as the representative point in the landing order partial order graph 302 (S212), and removes the invariant conditions associated with the group of aircraft X from the data point cloud W.

[0027] The control device 11 detects the following competing aircraft pairs {aircraft P, aircraft Q} within the same group, starting from the first entry in the landing order partial order graph 302, and constructs a competition graph (Figure 13) from the results (S213). The invariant conditions for aircraft P and the goal conditions for aircraft Q conflict. The goal conditions for aircraft P and aircraft Q conflict.

[0028] The control system 11 determines whether or not there is an aircraft P that does not conflict with the goal conditions (S214). If the answer in S214 is Yes (aircraft P exists), the system proceeds to S215. If the answer is No, the control system 11 notifies the operator 19 of a conflict such as a deadlock (S217). • Bidirectional race: This occurs when the goal conditions of aircraft P and aircraft Q conflict. For example, when multiple aircraft have goal conditions set to land towards the same landing port 22. In this case, the control center 100 issues an order to rewrite one of the goal conditions from "to land towards landing port 22" to "stay put" (the order to rewrite the landing order queue 303 in Figure 4). • One-way competition (deadlock): This occurs when the goal conditions of aircraft P and the invariant conditions of aircraft Q conflict, and a cycle is formed by constructing a competition graph. For example, this is a situation where a stationary aircraft P is encroaching on a convex closed region that points to an invariant condition belonging to aircraft Q. This is dealt with by the control center 100 issuing an order to rewrite the goal conditions of one of the aircraft (an order to rewrite landing order queue 303 in Figure 4).

[0029] Furthermore, the control device 11 may classify and handle the following four types of conflicts (both race and deadlock) that result in functional mismatch errors, as a formalized method for determining whether or not they are conflicts. The priority between aircraft is set as follows: the first aircraft (for example, aircraft P1 in Figure 6) = high priority, and the second aircraft (for example, aircraft P2 in Figure 6) = low priority. (Classification a) Competition between the goal conditions of the first aircraft and the goal conditions of the second aircraft. This competition is a race that occurs when the first and second aircraft are heading towards the landing reference point H at the same time. (Category b) Conflict between the goal conditions of the first aircraft and the invariant conditions of the second aircraft. This conflict occurs when the path taken by the first aircraft toward landing port 22 encroaches on the territory of the second aircraft. If there are no problems with the planned trajectory of the first aircraft, (Category b) occurs due to strong winds or other external factors. A possible solution is to issue a command to move the territory of the second aircraft away from landing port 22.

[0030] (Category c) Conflict between the invariant conditions of the first aircraft and the goal conditions of the second aircraft. This conflict does not occur in principle. When each aircraft is registered in the landing order queue 303 and the goal conditions are set according to the procedure in Figure 3, the goal conditions of the second aircraft are set so as not to conflict with the goal conditions or invariant conditions (safety constraints, etc.) of the first aircraft. If (Category c) occurs, the control system 11 considers it an exception and prompts the operator 19 to take action. (Classification d) Conflict between the safety constraints of the first aircraft and the safety constraints of the second aircraft. This conflict is conflict A, mentioned in S211 in Figure 3. If the aircraft is registered in the landing order queue and the goal conditions are set using the disclosure procedure, the conflict will be resolved and will not occur.

[0031] The control system 11 registers aircraft P from S214 as the tail of the landing order queue 303 (S215), and removes aircraft P from the conflict graph and the landing order partial order graph 302. The control system 11 determines whether the landing order partial order graph 302 is empty or not (S216). If the answer in S216 is Yes (it is empty), the process ends; otherwise, it returns to S213.

[0032] The following explains the details of the process shown in Figure 3. In S201, goal conditions and invariants in binary vector model format are obtained from all aircraft within the control zone. Invariants can generally be divided into safety constraints with surrounding moving objects as arguments and aircraft-specific performance limits, but since they all share the common characteristic of having to continue satisfying both conditions at any given time, they are collectively referred to as invariants.

[0033] In the process of collecting planned trajectories (first collected information) from individual aircraft, the wide-area surveillance radar unit 13 attached to the control and control device 11 checks whether the current position matches the estimated self-position transmitted by the aircraft (S202). For this reason, the control and control device 11 notifies the wide-area surveillance radar unit 13 of the scan range and obtains an aircraft-occupied area map from the wide-area surveillance radar unit 13. Since the single point of failure for this control method is whether or not the estimated self-position deviates from the actual flight position, the control device 11 performs calculations to determine whether or not the deviation from the current position is within the acceptable error range. The radar 21 irradiates each aircraft with a beam and receives the reflected waves from each aircraft. Because the reflected waves returning from moving aircraft are diffused, errors are inherent. Therefore, the control system 11 determines whether this data consistency error occurs based on the inclusion relationship between the finite-volume aircraft-occupied area R and the separation boundary 30 of the allowable error centered on the estimated self-position. If the overlap rate is small, especially if the intersection (common set) of the closed area inside the aircraft-occupied area R and the separation boundary 30 is an empty set, the control system 11 determines that there is a data consistency error.

[0034] If the control system 11 detects a data integrity error, the aircraft immediately notifies the operator 19 (S203). By viewing the S203 screen, which visualizes the three-dimensional flight space, the operator 19 can immediately confirm that there is a discrepancy between the estimated self-position collected from the aircraft and the aircraft position captured by the wide-area radar system, and the geometric calculation basis for this discrepancy is also easy to understand. The ground control system 10 then overwrites and corrects the estimated self-position held by the aircraft. Since the authority to authorize light access from the control side to the aircraft is a single point of failure, it is best to limit this to when the aircraft is within the controlled area and to implement cybersecurity measures such as mutual authentication between the control and control devices 11 to authorize light access.

[0035] In S204, the control system 11 performs a conflict determination for pairs of invariant conditions between aircraft. Specifically, the control system 11 sequentially substitutes the planned trajectory (first collected information) into the undetermined variables of the invariant condition function (second collected information) to construct an invariant condition function, and then determines whether the intersection of the pair of closed regions pointing inside the separation boundary 30 of the two invariant condition functions is an empty set. Generally, an invariant condition function is a closed region extended by the amount of the safety margin with the aircraft position as an argument, and is interpreted as the safety margin. Therefore, the control system 11 determines whether the set is empty for the two aircraft, and if it is not an empty set, it means that the safety margin is insufficient. The control device 11 immediately detects the conflict A between these invariant conditions and notifies the operator 19.

[0036] If there is no conflict A, the control device 11 uses the collected (first collected information) and (second collected information) to merge the data point cloud M used to construct the invariant condition function with the spatial coordinate position of the landing port 22, thereby performing a convex closed region division in one go. As a result of the convex closed region division, the control device 11 acquires a separation boundary 30 that separates the lingering flight paths of each aircraft (Figure 6). The vertical half-plane P3L of adjacent data point pairs (Figure 5), which is a component of this separation boundary 30, is formed by connecting data point pairs belonging to different aircraft. This separation boundary 30 indicates the area within which aircraft are permitted to remain while waiting to land. Each aircraft's external measurement system has observation limits. The control system 11 is only obligated to observe within this separation boundary 30 and to detect and avoid anomalies, thereby preventing competition between aircraft and defining the scope of responsibility for each aircraft. The operator 19 can understand that as long as each aircraft remains within the calculated separation boundary 30, no competition between invariants will occur.

[0037] In addition to the observation limits of each aircraft's external measurement system, conflicts between invariant conditions arising from inter-aircraft communication and negotiation present problems such as the reliability of the communication itself, the polynomial increase in computational complexity with respect to the number of negotiating aircraft, and the problem of a single point of failure due to malfunction of the aircraft itself. Therefore, the ground-based control device 11 is superior in that it first detects conflicts between invariant conditions between aircraft, calculates the dwelling airspace w by spatially dividing the airspace in this way, and simultaneously resolves the conflicts. Once processing S211 is complete, the process proceeds to S213.

[0038] For example, in the initial stage of Figure 6, aircraft P1 and P2, which belong to the adjacent convex closed region to the landing port 22, will experience competition A as long as they are heading toward the landing port 22. Therefore, the air traffic control system 11 registers the two aircraft involved in competition A in the landing order partial order graph 302 (S212), and then removes the data point clouds belonging to aircraft P1 and P2 from the data point cloud M. The air traffic control system 11 repeats steps S204 and S212 until all aircraft within the controlled area are registered in the landing order partial order graph 302. This landing order partial order graph 302 indirectly shows the geometric proximity that is mechanically calculated from the adjacency relationship with the landing port 22 after the separation boundary 30 of the stagnant airspace has been calculated.

[0039] In S213, the control system 11 attempts to resolve conflicts between goal condition pairs of aircraft of the same rank, and between invariant conditions and goal conditions, in the order registered in the landing order partial sequence graph 302. In the initial stage shown in Figure 6, a conflict in goal conditions occurs for aircraft P1 and aircraft P2 heading towards landing port 22. Furthermore, if aircraft P3 attempts an emergency landing due to fuel shortage and crosses the separation boundary 30 of aircraft P1 or aircraft P2, this corresponds to a situation where the goal conditions of aircraft P3 conflict with the invariant conditions of aircraft P1 or aircraft P2.

[0040] At stage S213, when all aircraft have remained in the stagnant airspace, no goal condition conflicts have occurred, so the control device 11 proceeds to S215, registers either aircraft P1 or aircraft P2 in the landing order queue 303, and removes it from the landing order partial order graph 302. Operator 19 may choose which aircraft P1 or P2 to prioritize, or they may use initial logic. Prioritization may be based on the aircraft with the shorter remaining dwell time, or on the aircraft with greater mass and therefore greater risk of damage upon fall. The control system 11 repeats the process from S213 until there are no more registration entries in the landing order partial sequence graph 302 (S216).

[0041] If there are multiple landing ports 22, the air traffic control system 11 does not need to register all entries in the landing order queue 303. Instead, it can maintain a landing order partial order graph 302 and select aircraft that are immediately available for landing as appropriate. The air traffic control system 11 may also add exception handling, such as transmitting the scheduled landing start time to all aircraft and changing the priority if any aircraft exceeds the permitted stay time. If sequential landing order cannot be achieved, a deadlock situation occurs, and the air traffic control system 11 immediately notifies the operator 19 (S217).

[0042] The following are examples of competitive relationships: • When the goal conditions conflict between two aircraft, P and Q. - One-way competition, especially when the goal condition of aircraft P conflicts with the invariant condition of aircraft Q, which has higher priority. • When a cyclical structure is created between three or more aircraft that causes a priority reversal. Deadlocks inherently possess combinatorial complexity, making it difficult to define general solution procedures. In practice, algorithms are known that either involve providing priority change logic for operator 19 to select from, or reducing the deadlock resolution logic to a maximum satisfiability (MAXSAT) problem.

[0043] As shown in Figure 2 above, the control device 11 has the following three characteristics. The first characteristic is that once the aircraft reaches the control zone of the landing port, it aggregates the data necessary for constructing a model of the entire system's operating environment into the ground control system 10 (S201). The autonomously operating drone transmits a data point cloud that characterizes the operating environment, as well as invariant conditions and goal conditions that constitute the smallest control problem unit. The goal condition at landing port 22 is to remain stationary under fuel constraints and land within the given time.

[0044] The invariant conditions use binary functions that point to a closed region with a safety margin, where the current position and planned trajectory are undetermined variables. Aside from convex closed region partitioning, no data structure is known that allows for the use of arbitrarily shaped closed regions in a real-time control system, enabling the control system 11 to easily determine functional mismatch errors (conflicts) (S204). Since the aircraft's moving planned trajectory can take on an arbitrary shape, analytical functions such as the square norm are inconsistent, making it even more difficult to analytically describe the conditions for determining whether a conflict occurs. Therefore, the control system 11 aggregates representative points from all aircraft to represent the constraints (invariant conditions and goal conditions) used by each aircraft's motion planning system when calculating its planned trajectory.

[0045] The second feature is that the control device 11 merges the representative point cloud and the ground-side surveillance radar system data, and collectively divides and assembles the convex-closed region using the control-side high-performance computer to calculate the convex-closed region where each aircraft should stay, and the dwelling boundary that does not cause a functional mismatch error. If there is a discrepancy between the aircraft position identified by the ground-based surveillance radar system and the estimated self-position notified by the aircraft, the control and control system 11 can immediately detect a data consistency error (S203). If the estimated self-position is incorrect, there is no guarantee that the aircraft will remain within the stagnant boundary. Therefore, this single point of failure (a point where the entire system will fail if a single point does not work) must be detected immediately. Subsequently, the ground control system 10 overwrites and corrects the estimated self-position held by the aircraft. Since the authority to authorize light access from the control side to the aircraft is also a single point of failure, it is done after implementing cybersecurity protection measures.

[0046] Even when a large number of aircraft are gathered, the control system 11 can similarly reconstruct the operating environment model in the form of convex closed region division, and if it becomes impossible to calculate the dwelling boundary, it can identify pairs of aircraft whose invariant conditions conflict. If the dwelling boundary can be calculated, the control system 11 only needs to monitor that each aircraft remains within it. In this way, the control system 11 can visualize and understand the situation of the entire controlled area around the landing port and provide the operator 19 with a screen that allows them to discover conflicting constraint pairs that cause data consistency errors and functional inconsistency errors. Since the landing port itself is an exclusive resource, a mechanism for mutual exclusion is required.

[0047] As a third feature, the control device 11 performs the following: The landing order of aircraft belonging to the group of convex closed regions adjacent to the landing site is registered in the landing order partial order graph 302 in order to avoid competition of invariant condition pairs (S212). • Following the priority specified by operator 19, the goal conditions are sequentially resolved in an order that resolves conflicts (especially deadlocks) and registered in the landing order queue 303 (S215). • Notify each aircraft of the convex closed region space where it will be staying.

[0048] Operator 19 only needs to confirm this decision process and, based on its consistency with the actual operational status visualized within the stagnant boundary, verify that the aircraft lands in the calculated order and remains within the stagnant boundary. Furthermore, the monitoring itself is simplified, as the ground-side control system 10 only needs to determine whether the aircraft is inside or outside the stagnant boundary. By assigning at least a portion of the legal responsibility for any accidents caused by an aircraft deviating from the stabling boundary, the legal responsibility of the operator can be divided between air traffic control and the aircraft, thereby limiting the operator's responsibility.

[0049] The control device 11 described above provides a means for presenting the operational status of the controlled object in a way that makes it easy for the operator 19 to understand the situation remotely, and a remote control means that allows the operator to confirm that the safety of the recovery control trial can be guaranteed. The ground-side control system 10 (control device 11), which aggregates the aircraft's flight information, calculates the dwelling airspace for each aircraft by dividing it into convex and closed regions, and determines the landing order by prioritizing aircraft based on the airspace division structure of the convex and closed regions in order of proximity to the landing port 22. Furthermore, the control and control system 11 notifies the aircraft of any discrepancy between its estimated self-position reported by the aircraft and the position acquired by the ground control radar as a data consistency error, and takes measures to address this single point of failure.

[0050] This allows for the resolution of conflicts between aircraft within the controlled airspace, avoiding hazards caused by conflicts during landing, instead of relying on unreliable mediation between aircraft in terms of communication, computation, and external measurement systems. Furthermore, in the event of an exception, operator 19 can quickly become aware of the conflict situation.

[0051] Furthermore, the control device 11 has the following first to third effects. The first effect is that by transmitting only the data point cloud to be passed to the convex closed region division process, communication bandwidth on the aircraft side, computational power to calculate the dwelling boundaries of individual aircraft while avoiding conflicts, and memory bandwidth are saved, allowing the ground control system 10 to control multiple aircraft in parallel. A second benefit is that the ground control system 10 will be able to identify critical runtime errors caused by conflicts between different aircraft. As a third effect, the mutual exclusion control process that avoids the aforementioned runtime error can be transferred to the control device 11, simplifying the operator 19's setup work.

[0052] The following describes the scenarios for each aircraft controlled by the control device 11, with reference to Figures 5 to 15. Figure 5 is an explanatory diagram showing the aircraft-occupied area R of each aircraft. The positions L1-L6 of each radar 21 are an example of a data point cloud used to construct the aircraft-occupied region R in S204. The control and control system 11 can obtain range information (showing areas with high reflection intensity as clouds) of the current position of the aircraft P3 from the reflected waves of the beams irradiated from the positions L1-L6 of each radar 21 toward the aircraft P3, including errors. The control and control system 11 then calculates the aircraft-occupied region P3R of the aircraft P3 that encompasses the range information of the current position of the aircraft P3.

[0053] The control system 11 similarly calculates the aircraft-occupied area P2R for aircraft P2 and the aircraft-occupied area P1R for aircraft P1. Furthermore, the aircraft-occupied area P3R of the aircraft P3 is constructed such that a vertical half-plane P3L, perpendicular to the connecting line between two points (the position of the aircraft P3 and the position L5 of the radar 21), serves as the separation boundary. This allows for mechanical and memory-efficient division of a convex closed region. In addition, the data representation held by the wide-area surveillance radar unit 13 uses, for example, a Density map function: (3D+time)->[0-1].

[0054] Figure 6 is an explanatory diagram showing a situation where no data integrity errors have occurred in any of the aircraft heading to landing port 22. For each of the following four spaces separated by the separation boundary 30, there exists one region. • Area including landing port 22 • The area including the aircraft-occupied area P1R of aircraft P1 • The area including the aircraft-occupied area P2R of aircraft P2 • The area including the aircraft-occupied area P3R of aircraft P3

[0055] Figure 7 is an explanatory diagram showing the situation in which a data integrity error occurred in aircraft P3 shown in Figure 6. The current position P3A, which aircraft P3 reported to the control and control system 11, is not included in the aircraft-occupied area P3R measured by the wide-area surveillance radar unit 13 (multiple radars 21). As shown in Figure 7, the control device 11 displays both the self-reported current position P3A and the aircraft's occupied area P3R, thereby allowing the operator 19 to recognize data consistency errors regarding the aircraft's P3. Furthermore, the control device 11 may also display auxiliary information such as the estimated position P3B of the aircraft P3 (for example, the center of gravity of the aircraft's occupied area P3R) and a vector representation P3C showing the deviation from the current position P3A to the estimated position P3B. This helps the operator 19 issue new instructions such as "correct the current position P3A of the aircraft P3 so that it becomes the estimated position P3B."

[0056] Figure 8 is an explanatory diagram showing the situation after the data integrity error in aircraft P3 in Figure 7 has been resolved. In order to resolve the data integrity error recognized by the screen display in Figure 7, operator 19 causes the control control device 11 to send a control command to aircraft P3 via the control information transmission unit 12, for example, to correct the current position P3A of aircraft P3 to the estimated position P3B.

[0057] This allows aircraft P3 to properly correct its self-reported current position P3A. The following is an example of how to resolve data integrity errors. Once the aircraft enters the landing port control area, it is considered that the aircraft's reported position is incorrect. The ground radar system's value is treated as the true value, and the aircraft's fleet operator is notified of the data integrity error, requesting permission to temporarily overwrite the aircraft's position. The aircraft's fleet operator then overwrites the program state of the aircraft's position (via an encrypted communication path). • Design the landing port and a predetermined protocol, and include a command within that protocol to override the aircraft's own positional data.

[0058] Figure 9 is an explanatory diagram showing an example of the planned trajectory for aircraft P3 in Figure 6. Aircraft P3 receives an air traffic control order to wait around its current position until another aircraft lands. It then creates a planned trajectory P3X that starts from its current position P31, passes through positions P32, P33, P34, and P35 in that order, and returns to its current position P31. Each of the positions P31 to P35 is a coordinate component of the planned state value vector sequence.

[0059] Figure 10 is an explanatory diagram showing an example of a convex closed region of the aircraft P3 calculated from the planned trajectory in Figure 9. Centered around positions P31 to P35, which are the spatial coordinate positions of state value vector 0, regions corresponding to invariant conditions (such as safety margins defined for each aircraft type), illustrated by dashed rectangles, are formed. These regions illustrated by dashed rectangles are the internal and external separation boundaries of the invariant conditions that take state value vector 0 of aircraft P3 as an argument. The control device 11 takes the aircraft's planned trajectory P3X (a sequence of coordinates over time) as an argument and calculates a convex closed region P3Y that encompasses the region (a sequence of closed regions) that corresponds to the invariant condition. The convex closed region P3Y also encompasses the aircraft's occupied region P3R at each position P31 to P35 (only the region at position P31 is shown in Figure 10).

[0060] Figure 11 is an explanatory diagram showing the situation in which no functional mismatch errors occur in each of the aircraft in Figure 6. Figure 11 shows the relative coordinate position from the landing reference point H received by the control and control device 11 from the aircraft P3 via the terminal information receiving unit 14. Each of the following convex closed regions does not overlap with any other convex closed region. • The convex closed region P1Y of the aircraft P1 (calculated from the planned trajectory P1X when the aircraft P1 is to land) • The convex closed region P2Y of the aircraft P2 (calculated from the planned trajectory P2X when the aircraft P2 is kept stationary) • The convex closed region P3Y of the aircraft P3 (calculated from the planned trajectory P3X when the aircraft P3 is stationary). Note that in Figure 11, only the area corresponding to the invariant condition (dashed rectangle) is shown inside the convex closed region P3Y, but similarly, the areas corresponding to the invariant condition may also be shown for the other convex closed regions P1Y and P2Y. Furthermore, in each figure from Figure 12 onward, the areas corresponding to the invariant condition may also be shown inside the convex closed region. The control device 11 can display Figure 11 on its screen, allowing the operator 19 to visually confirm that no functional mismatch errors have occurred.

[0061] Figure 12 is an explanatory diagram showing the situation in which a functional mismatch error occurred in each of the aircraft in Figure 6. In comparison with the planned trajectory P2X of aircraft P2 in Figure 11, in Figure 12, the planned trajectory P2X2 of aircraft P2 extends beyond the separation boundary 30 and into the aircraft P3 side. Therefore, an overlapping region occurs between the convex closed region P2Y2 calculated from the planned trajectory P2X2 of aircraft P2 and the convex closed region P3Y of aircraft P3. The control device 11 displays Figure 12 on its screen, allowing the operator 19 to visually confirm that a functional mismatch error (conflict A between aircraft P2 and aircraft P3) has occurred.

[0062] Functional inconsistency errors can be resolved, for example, by following these steps: (Step 1) Essentially, abandon the goal conditions and adhere to the invariant conditions (such as maintaining a safety margin), then raise an alert and notify both the aircraft's flight operator and ground control. (Step 2) Similar to the method for resolving data integrity errors, the settings are changed according to the agreed-upon division of legal responsibilities. For example, an aircraft requests an increase in priority in landing queue 303, and air traffic control center 100 approves the request and prioritizes the landing of the requested aircraft.

[0063] Figure 13 is a table showing an example of a competition graph constructed by the control device 11 through the processing of S213. This table is used to indicate whether a conflict has occurred ("Conflict") or not (blank) for each combination of aircraft registered in the aircraft group list 301. The control system 11 displays Figure 12 on the screen, allowing the operator 19 to see which of the many aircraft pairs has experienced a functional mismatch error.

[0064] Figure 14 is an explanatory diagram illustrating a situation where a functional mismatch error occurs between the goal conditions of aircraft P1 in Figure 6 and the invariant conditions of aircraft P2. The planned trajectory P1X2 for landing aircraft P1 differs from the planned trajectory P1X in Figure 12, as it enters the convex closed region P2Y of aircraft P2. The control system 11 displays Figure 14 on its screen, allowing the operator 19 to visually confirm the functional mismatch error in Figure 14.

[0065] Figure 15 is an explanatory diagram illustrating a situation where a functional mismatch error occurred between the goal conditions of aircraft P1 and aircraft P2 in Figure 6. The planned trajectory P1X for landing aircraft P1, The planned trajectory P2X3 for landing aircraft P2 is heading towards the same landing port 22, and if this continues, there is a concern that the two aircraft may collide near landing port 22. The control system 11 displays Figure 15 on the screen, allowing the operator 19 to visually confirm the functional mismatch error in Figure 15.

[0066] The control device 11 of this embodiment described above has the following functions 1 to 3. The basic function inconsistency determination function (function 1) of the control control device 11 defines an aircraft that operates autonomously while satisfying the goal constraints as the aircraft to be controlled. For each of the multiple aircraft under control, collect the current state value vector, the planned state value vector sequence, the goal constraints, and the invariant constraints. This function determines whether there is a conflict between the invariant constraints of the first aircraft and the invariant constraints of the second aircraft (first conflict), the goal constraint of the first aircraft and the invariant constraint of the second aircraft (second conflict), or the goal constraint of the first aircraft and the goal constraint of the second aircraft (third conflict).

[0067] The control control device 11's notification function (function 2) is a function that notifies a data consistency error if the aircraft position captured by the wide-area surveillance radar unit 13 attached to the aircraft under control does not match the current status of the aircraft under control. The system includes an operational status presentation means that presents to the operator 19 a pair of constraint conditions that cause a first, second, or third conflict, and a pair of aircraft to which each constraint condition belongs.

[0068] The control function (function 3) of the air traffic control device 11 for resolving conflicts includes a function to calculate the landing order of the controlled aircraft to resolve the first or second conflict, and to construct a landing order partial order graph 302 based on the calculation result, This function constructs a landing order queue 303 that indicates the landing order of controlled aircraft to prevent third-party conflicts, based on the landing order partial order graph 302 and according to the operator-specified priority setting method, and then outputs a control command to safely descend and land according to that landing order queue 303.

[0069] Furthermore, the present invention is not limited to the embodiments described above, and it goes without saying that various other applications and modifications can be taken as long as they do not depart from the gist of the present invention as described in the claims. For example, the embodiments described above describe the configuration of the control device 11 in detail and specifically in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those that include all the components described. Also, it is possible to replace a part of the configuration of one embodiment with a component of another embodiment. It is also possible to add a component of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, replace, or delete other components for a part of the configuration of each embodiment.

[0070] Furthermore, some or all of the above configurations, functions, and processing units may be implemented in hardware, for example, by designing them as integrated circuits. Broadly defined processor devices such as FPGAs (Field Programmable Gate Arrays) and ASICs (Application Specific Integrated Circuits) may be used as hardware. Furthermore, each component of the control device 11 according to the above-described embodiment may be implemented on any hardware, as long as the respective hardware can send and receive information from each other via a network. Also, the processing performed by a certain processing unit may be implemented by a single piece of hardware, or by distributed processing by multiple pieces of hardware. [Explanation of Symbols]

[0071] 10 Ground-based control systems 11. Control and Control System 12. Control Information Transmission Unit 13 Wide-Area Surveillance Radar Unit 14 Terminal Information Receiving Unit 19 Operators 21 Radar 22 Landing Ports 30 separation boundary 100 Control Center List of 301 aircraft 302 Landing Order Partial Order Graph 303 Landing queue P1 aircraft (first aircraft) P2 Unit (Second Unit)

Claims

1. The aircraft that operates autonomously while satisfying the goal constraints while satisfying the invariant constraints is defined as the aircraft to be controlled. For each of the multiple aircraft under control, collect the current state value vector, the planned state value vector sequence, the goal constraints, and the invariant constraints. The system has a function to determine whether or not the closed regions defined by the goal constraint and invariant constraint intersect, specifically a first conflict between the invariant constraint of the first aircraft and the invariant constraint of the second aircraft, a second conflict between the goal constraint of the first aircraft and the invariant constraint of the second aircraft, or a third conflict between the goal constraint of the first aircraft and the goal constraint of the second aircraft. The current state value vector is a state quantity vector of the current state, including the current position of the aircraft under control. The aforementioned planned state value vector sequence is a time-series state quantity vector sequence representing the planned trajectory of the controlled aircraft, The aforementioned goal constraints include conditions such as reaching the landing reference point of the landing port or remaining within the area where the aircraft should stay. The aforementioned invariant constraint is a condition that encompasses the current position of the controlled aircraft, indicated by the current state value vector, and the planned trajectory of the controlled aircraft, indicated by the planned state value vector sequence, and defines a closed region with a safety margin, and is characterized by being represented by a data point cloud in binary vector model format. Air traffic control system.

2. The system includes a function to notify a data consistency error if the aircraft position captured by the wide-area surveillance radar unit attached to the controlled aircraft does not match the current status of the controlled aircraft, and an operational status presentation means that presents to the operator the constraint condition pairs that cause the first, second, or third conflicts, and the aircraft pairs to which each constraint condition belongs. The aforementioned pair of constraints is a pair of constraints belonging to the first aircraft and constraints belonging to the second aircraft. The aforementioned pair of aircraft is characterized by being a pair consisting of the first aircraft and the second aircraft. The control device according to claim 1.

3. A function to calculate the landing order of the controlled aircraft that resolves the first or second conflict, and to construct a landing order partial order graph based on the calculation result, The system has a function to construct a landing order queue indicating the landing order of the controlled aircraft in accordance with the operator-specified priority setting method, based on the landing order partial order graph, so as to prevent the third conflict from occurring, and to output a control command to safely descend and land according to the landing order queue. The aforementioned landing order partial order graph is a graph that represents the landing order as a partial order, The landing order queue is characterized by being a sequential landing sequence. The control device according to claim 2.

Images