NBSIR 76-1067

Mathematical Approaches To

Evaluating Aircraft Vertical

Separation Standards

Judith F. Gilsinn

Douglas R. Shier

Operations Research Section

Applied Mathematics Division

Institute for Basic Standards

National Bureau of Standards

Washington, D. C. 20234

May 1976

Issued August 1 976

Technical Report to: Aeronautical Satellite Division

Office of Systems Engineering Management

Federal Aviation Administration

Washington, D. C. 20591

NBSIR 76-1067

MATHEMATICAL APPROACHES TO

EVALUATING AIRCRAFT VERTICAL

SEPARATION STANDARDS

Judith F. Gilsinn

Douglas R. Shier

Operations Research Section

Applied Mathematics Division

Institute for Basic Standards

National Bureau of Standards

Washington, D. C. 20234

May 1976

Issued August 1 976

Technical Report to: Aeronautical Satellite Division

Office of Systems Engineering Managennent

Federal Aviation Administration

Washington, D. C. 20591

U.S. DEPARTMENT OF COMMERCE, Elliot L. Richardson, Secretary

Edward O. Vetter, Under Secretary

Dr. Betsy Ancker-Johnson, Assistartt Secretary for Science and Technology

NATIONAL BUREAU OF STANDARDS. Ernest Ambler. Acting Director

ABSTRACT

Above Flight Level 290, current regulations require aircraft to

be separated vertically by at least 2000 feet. Because of increased traffic

desiring to fly at these altitudes, the possibility of reducing the required

separation (while maintaining acceptable safety levels) is under study.

This report details many of the components of vertical position error and

classifies them into three major categories: static pressure system error,

altimeter instrument error, and pilot response error. Two models for use

in evaluating separation standards, the root sum of squares (RSS) approach

and the Reich collision risk model, are described together with their re- spective advantages and disadvantages. A final section includes recommendations for a carefully designed data collection effort and discusses potentially important considerations for such a design.

Key Words : Aircraft; air transportation; air traffic control models; altimetry;

altitude; aviation; collision risk; error analysis; mathematical models;

safety; separation; vertical separation.

ACKNOWLEDGMENTS

We wish to thank Dr. Peter Heydemann, Chief of the Pressure and Vacuum

Section, National Bureau of Standards, for his technical advice and assistance

in performing this study. Dr. James Filliben of the NBS Statistical Engineering

Laboratory has also been most helpful, both in advising on statistical

questions and in providing computer programs for the statistical analyses

of Section 3. Our work has greatly benefited from discussions with people at

the Federal Aviation Administration, including Vianna Briscoe and John Parry

of the Office of Systems Engineering Management, John Hendrickson of the

Systems Research and Development Service, and Jack Shrager and Gunther Christianson of the National Aviation Facilities Experimental Center.

TABLE OF CONTENTS

Page

1. Introduction 1

2. Component Errors 7 2.1 Static Pressure System Errors 7 2.2 Altimeter Instrument Errors 9

2.3 Pilot Response 11

2.4 Additional Factors. . 12

2.5 Estimates of Error Size 13

3. Modeling Approaches 19

3.1 The Root Sum of Squares (RSS) Approach 19

3.2 The Reich Approach 22

3.3 Analysis of the Tails of Distributions 24

3.4 Convolution of Distributions 25

3.5 Examination of the Model Assumptions 28

3.6 Choice of Model 29

4. Data Requirements 31

4.1 Avoiding Possible Problems 31

4.2 Consideration of Factors Causing Systematic Errors 32

4.3 Testing Model Assumptions 36

5. Conclusion 37

6. References 39

Appendix A. Comparisons of Tail Lengths of Distributions 42

i
LIST OF TABLES

Page

1. Ranges of Values (in Feet) of Static Pressure System Errors

at FL300 15

2. Ranges of Values (in Feet) of Altimeter Instrument Errors

at FL300 16

3. Ranges of Values (in Feet) of Pilot Response Errors at FL300 17

4. Ranges of Values (in Feet) of Additional Error Factors at FL300... 17

5. Factors Which Can Cause Systematic Errors 33

LIST OF FIGURES

Page

1. Diagram of Aircraft Height-keeping System 4

2. Subsystem Errors Involved in Vertical Position Error 5

3. Possible Distributions for Component Errors 14

4. Two Distributions Having the Same Mean and Standard Deviation 21

5. Convolution of Two Rectangular Distributions 26

ii
1 . INTRODUCTION

Safety of aircraft flight is of great concern to all those connected

with aviation. The Department of Transportation's Federal Aviation Administration (FAA) has a major responsibility for the maintenance and improvement

of flying safety through, for example, certification of pilots and equipment, the establishment of an air traffic control system, and the dissemination of rules and regulations to ensure orderly flow of traffic. This report

will be concerned with aspects of the latter function: specifically, rules

pertaining to the safe separation of aircraft and, more particularly, separation of aircraft in the vertical dimension.

The scope of the present study includes only level flight — above

Flight Level (FL) 290. At and above 29,000 feet internationally and 18,000 feet^

in the Eastern United States, "altitude" is measured not by actual elevation

above sea level but rather in terms of pressure altitude based on a standard

sea level pressure of 29.92 inches of mercury (1013.25 mb.) and a standard

temperature gradient. Pressure altitude in hundreds of feet is then referred

to as Flight Level . Thus Flight Level 290 is approximately 29,000 feet above

sea level, depending on the actual barometric pressure at sea level and other

factors. We initially focus on altitudes at and above FL290 since at these

altitudes terrain considerations can be ignored; Mount Everest rises 29,028

feet above sea level, but apart from the Himalayas no mountains are this

high. Moreover, current regulations require 1000-foot separation between

aircraft below FL290 and require 2000-foot separation above FL290 . We

consider only level flight, excluding ascents and descents, both because the

separation rules in question address this portion of flight and because level

flight permits simpler analytical treatment than do other maneuvers.

Separation of aircraft laterally, longitudinally and vertically is designed to enhance safety by providing enough airspace surrounding each

aircraft to allow for errors in its nominal position. The separation standards

are established in such a manner that separation in any one of the three

dimensions itself provides a measure of safety. This is required because in

order to use airspace efficiently it may frequently be necessary to assign

aircraft to parallel tracks (where only lateral separation applies), to the same track (where only longitudinal separation applies) or to adjacent flight

levels on the same route (where only vertical separation applies) . The

present report will be concerned primarily with this latter case, but it must

always be kept in mind that any measure of safety must take into account all

three dimensions and the relative frequency with which separation in each

will provide the sole safety margin.

"Safety" is a concept which is very difficult to define with sufficient

precision to allow its quantification. Nevertheless it is essential to have

such a measure in order to evaluate the effects of proposed system changes

on safety as a basis for justifying (or rejecting) those changes. As parts

Units customarily used in aviation ~ feet, nautical miles, knots and Mach

number — will be used in this report for ease of assimilation by an aviation

reader.
of the system become saturated and changes in rules are proposed which would

alleviate congestion, the probable effects on safety must be evaluated using

some numerical measure of the respective risks under the original and

modified rules. On the one harid, the flying public wants maximal safety

guaranteed by the procedures governing air traffic control. On the other hand,

airline "operators are not only concerned with safety, but also want procedures

to allow efficient use of their aircraft. Since aircraft are designed

to operate most efficiently within a rather narrow altitude range, this results

in a large number of aircraft desiring to fly at the same altitude. Both

passengers and airline operators want reduced delays. Some measure which

can be used to quantify the risks in flying, as related to the characteristics

of aircraft equipment and flying procedures, is needed to aid in rule-setting.

An "ideal" measure may be impossible in principle and is certainly beyond

present abilities to quantify, but some surrogate measure, recognized as not

wholly adequate but designed to reflect those properties of safety which

can be quantified, may well be attainable.

It is therefore desirable to quantify the risk of collision between two

aircraft resulting from a loss in vertical separation between those aircraft,

and to do so in a manner that permits evaluating the impact upon safety of

changes in the rules or equipment of the system. Above fL29C) accidents

have three primary causes: collision between two aircraft, equipment failure,

and weather effects. The first of these is of most interest in evaluating

separation standards, but the effects of the latter two must also be considered.

In designing a safety measure for flight at or above FL290, it is necessary

to resolve several questions:

Do we simply count the aircraft involved or should the number of

passengers in the aircraft be reflected in the measure?

Does one consider collisions only, or should near-misses also

affect the measure?

Should the measure concern number of incidents per flight, per flying

period (hour, day, week, or year?), per distance flown, per passenger

flying period or per passenger distance flown?

The safety measure chosen deals with aircraft rather than passengers,

primarily because aircraft are elements over which the present air traffic

control system (or its likely successors) has some control. System improvements will affect aircraft directly or will affect the monitoring and navigation equipment which in turn affects aircraft. At the altitudes of

interest here (FL290 and above), most of the traffic is commercial jet

aircraft and any collision is likely to result in death for all persons on board, so that aircraft collisions are the most relevant factor. Near-misses

certainly contribute to a perceived degradation of safety, but it is difficult

to obtain reliable information about them, since only some are actually

reported and what was viewed as a near-miss by one pilot may not have appeared

a hazardous situation to the other.

Since flights differ greatly in length, the length of exposure to

collision varies from flight to flight. A better measure of the risk of

collision is the number of collisions per time period or per distance flown.

Most of the aircraft flying at an altitude of 29,000 feet or more are in

-2-
en route airspace and fly at a speed of about 0.8 Mach or greater, so that

time and distance are directly related; but since airline crew staffing and

aircraft maintenance procedures rely on cumulative flying time, time-related

figures are ^ore readily available than those on the number of aircraft

miles flown. Thus the unit chosen in this report (as well as elsewhere)

for measuring the safety of aircraft flight is the number of collisions per

flying hour. This measure has been called [36] the collision risk to which

an aircraft is exposed.

Loss of vertical separation results from a discrepancy between the as- signed flight level and the actual altitude flown (or possibly from an improperly assigned flight level, but this contingency will not be included

in the error analysis below) . The discrepancy between assigned and actual

altitude will be called "total vertical position error". Figure 1 contains

a diagram of the height-keeping system: the subsystems subject to error

are designated by hexagonal boxes and the relevant outputs of these subsystems are displayed in rectangular boxes. As indicated by the figure,

the three main subsystems contributing to vertical position error are:

1) the static pressure system , which senses the ambient air pressure,

2) the altimeter instrument system , which translates (mechanically and

possibly electronically) the pressure sensed by the pitot-static

system into a flight level indicated on a guage in the cockpit (for

a more complete description of the operation of an altimeter, the

reader is referred to [13] and [16]), and

3) the pilot response , which reflects the ability of the pilot to

maintain a desired gauge reading.

We also consider a fourth category, that of "miscellaneous" error sources. Included in this category are errors in the Mode C transponder system by

which the altimeter reading is automatically transmitted to the air traffic

controller; these become especially important if controller decisions rely

on the erroneous data. It is important, in this regard, to realize that

total failure of the altimetry system can be readily identified and appropriate safety precautions applied by cooperation between pilot and the controller. Problems arise with less readily noticed system failure.

Errors in the three major subsytems listed above would appear to have

relatively little effect upon one another, since such errors result from

physically separate processes. With reference to Figure 2, the static

pressure system error is represented by the difference between the actual

pressure altitude flown and the pressure measured by that system. The

The use of accidents per miles flown may be misleading, as noted by G.

Raisbeck, B. 0. Koopman, S. F. Lister and A. S. Kapadia, A Study of Air

Traffic Control System Capacity, Report Number FAA-RD-70-70, Authur D.

Little, Inc. Cambridge, Mass. 02140, Oct. 1970, pp. 57-58.

-3-
FIGURE 1

DiaRram of Aircraft Height-keeping System

ACTUAL

AMBIENT

AIR PRESSURE

STATIC

PRESSURE

SYSTEM

/

PRESSURE

MEASURED

N ALTIMETER

INSTRUMENT

SYSTEM

\ /

COCKPIT

ALTITUDE

DISPLAYED

\

PILOT

RESPONSE

ACTUAL

HEIGHT

FLOWN

MODE C

TRANSPONDER

SIGNAL

MODE C

TRANSPONDER

SYSTEM

X

MODE C

CONTROLLER

READ-OUT

-4-

\
FIGURE 2

Subsystem Errors Involved In Vertical Position Error

assigned altitude

displayed altitude

PILOT RESPONSE

ERROR

r

I

ALTIMETER INSTRUMENT

ERROR

measured altitude > f

actual altitude

i

y

iSTATIC PRESSURE SYSTEM

ERROR

TOTAL VERTICAL

POSITION ERROR

-5-
I altimeter instrument error corresponds to the difference between the measured

pressure altitude and the altitude displayed in the cockpit, while the pilot

response error corresponds to the difference between the displayed altitude

and the altitude assigned to the aircraft. Total vertical error is the

algebraic sum of the errors in the three subsystems, and these latter errors

are expected to be relatively uncorrelated with one another. The as- sumptions involved in this simple model of total vertical error are discussed

in Section 3.5.

The body of this report is divided into three sections. The first of

the following sections discusses factors contributing to the errors in each

of the above categories, and provides estimates of the magnitudes and

statistical distributions of the error factors. The second section focuses on models of total vertical error and on the calculation of collision risk.

Two notable approaches taken by previous investigators are given, the root sum of squares approach and the Reich collision risk model, and various

assumptions underlying those approaches are examined. The final section

discusses the data needed to verify and analyze an appropriate model together with its assumptions. Emphasis is placed on the relationship between the characteristics of the data set and the model analysis, rather

than on questions of feasibility or practicality. An appendix contains

mathematical analyses comparing tail lengths (i.e. comparing frequencies

of rare events) for some of the combinations of distributions discussed

in Section 3.

-6-
2. COMPONENT ERRORS

In this section we will examine various factors and errors contributing

to the three major error categories: static pressure system error, altimeter

instrument error, and errors in pilot actions. A miscellaneous category will

also be included to cover factors not falling naturally under one of the other

three headings.

2 . 1 Static Pressure System Errors

An altimeter is essentially a device for sensing the ambient air pressure

outside the aircraft and translating the pressure measurement into an equivalent altitude, using physical relations such as that equating pressure with

the weight of the column of air above. The pitot-statlc system embodies the

air pressure sensing devices; it consists of various orifices and tubes which

allow air (at pressure) outside the aircraft's skin to be transmitted to the

altimeter diaphragm within the aircraft. Clearly, since the aircraft itself

disturbs the air surrounding it, the location of the static pressure source

on the aircraft skin is critical 113]. In addition, the attitude or angle

of attack of the aircraft affects the direction of the airstream flowing past

or into the static pressure source, Influencing the measured air pressure.

The speed of the aircraft (measured as Mach number) also affects the airstream

passing the static pressure sensor, as does local deformation of the aircraft

skin near the sensor. Factors affecting static pressure system error — the

discrepancy between the ambient atmospheric pressure and the pressure measured

by the pitot-static system — are listed and described below.

A. Factors varying during flight

1. Altitude : The relationship between pressure and altitude is quite

nonlinear, so that an exact correspondence between pressure and

altitude may not be possible using existing equipment. Thecefore,

errors in the altitude measurement may depend on the altitude itself.

2. Mach number : Aircraft speed affects the speed of the airstream moving

past the static pressure source and thus the pressure measurement.

3. Angle of attack : The attitude of the aircraft can affect the movement of the airstream past the static pressure opening and thus influence the measured air pressure.

B. Factors varying among aircraft

1. Location of sensor : The airstream flow in the neighborhood of the

static pressure source differs depending on where the source is located

on the aircraft's hull. Different locations react differently to

flying maneuvers and thus entail different pressure measurement

characteristics.

-7-
2. Skin deformation : Any dent in the aircraft skin near the static

pressure source affects the local airstream characteristics. In

addition, normal skin deformation in the region near the sensor location changes during flight and consequently affects the pressure

measurement

.

3. Leaks in the pitot-static system : If there are any leaks in the

pitot-static system, an incorrect pressure will be transmitted to

the altimeter diaphragm.

A. Aircraft type : Different aircraft have different shapes and weights,

thus disturbing the atmosphere in different ways. Different aircraft

types also may be equipped with different altimeters and have different

sensor locations, as well as different pitot-static configurations

(separate pilot and co-pilot sensors versus a common one, for example).

All of these variations may lead to differences in measurement capability.

5. Calibration test procedures ; Initial static pressure system performance is verified by trailing cone tests during aircraft certification and is subsequently tested for leaks only at two year

intervals. Actual tolerances and test intervals (less than the

two year minimum) may vary from operator to operator.

C . Time-varying factors

1. Calibration test interval : Since the calibration procedures are

set up separately by each airline or owner, the interval between

tests may vary up to a maximum interval set by the certifying

authority. If the performance of the instrument typically degrades over the interval between calibrations, then the time since

the last test will affect the accuracy of the measurements.

2. Age of the pitot-static system : The pitot-static system may deteriorate with time, thus affecting the accuracy of pressure

measurement.

D. Meteorological effects

1. Density and temperature : The density and temperature of the atmosphere may differ from those assumed for the standard atmosphere,

so that the actual relationship between pressure and altitude may

differ from that assumed. This may cause the actual distance between flight levels to be less than (or greater than) the separation standard.

2. Turbulence, wind and other weather conditions : The measurement

of air pressure in turbulent air is difficult because of the un- stable conditions. Strong winds may also affect the pressure J readings

.

-8-
2.2 Altimeter Instrument Errors

The altimeter instrument measures the pressure transmitted by the

pitot-static system and translates that pressuee into an equivalent altitude

displayed to the pilot. The altimeter instrument errors listed below con- tribute to discrepancy between the pressure measured by the pitot-static system

and the equivalent flight levil indicated on the pilot's altimeter gauge.

A. Mechanical

1. Diaphragm error : Equal changes in atmosjiheric pressure at different

heights can produce different diaphragm deflections, as a result of

the physical properties and construction of the aneroid-linkage

system.

2. Hysteresis error : Hysteresis is the phenomenon in which the reaction

of a system to changes is dependent upon its past reactions to change.

In the altimeter, the diaphragm deflection depends upon whether the

current altitude was reached from above or from below.

3. Drift error ; There is a tendency to deviate from a constant altitude

reading over long (1 to 4 hours) exposure to that altitude.

4. Friction error : Friction occurs in transmission of diaphragm movement to the pointers and in the temperature compensating pins. This

can cause small deviations in altitude to go unrecorded, contributing

to a loss in precision of the instrument.

5. Backlash error ; Motion is lost in the gear transmission between the

pressure and altitude scales.

6. Instability error : Changes occur in the altimeter indication following consecutive ascents and descents.

7. Temperature error : Temperature in the instrument panel can affect the

altimeter indication.

8. Scale error : This error is due to the inability to match exactly

the movement of the altitude pointer with the deflection of the

aneroid-linkage mechanism.

B. Readability

1. Pressure setting error : The pressure scale can only be set to an accuracy determined by its graduation interval, so that the altitude

readings are accurate only to an equivalent precision.

2. Altitude reading error ; The height scale of the altimeter can only

be read to a precision determined by tts graduation interval.

-9-
C . Errors Arising From Nonstandard Setting^ (i . e . Using Other than the

Standard Atmosphere Reference Pressure )

1. Coordination error : A complete coordination between the graduations of pressure and height scales becomes impossible.

2. Balance error : The state of balance of all moving parts of the altimeter changes when rotated from the calibration position.

3. Zero-setting error ; The calibration correction at certain heights

should be different if a nonstandard reference pressure datum is used.

4. Incorrect local barometric pressure : The pilot receives groundlevel barometric pressure information from ground stations and resets

his pressure gauge accordingly. If an incorrect pressure is transmitted or the value garbled, the pilot may be using an erroneous

local barometric pressure setting.

D. Calibration procedures

1. Installation error : The altimeter may register incorrectly if the

instrument is installed in the aircraft improperly, or if irregularly

standardized reference equipment or inappropriate procedures are used during calibration.

2. Calibration frequency : The frequency of calibration tests is to some extent under the control of the owner and will thus vary among owners.

3. Procedural error : When an altimeter without automatic compensation

for calibration discrepancies is used, the pilot must apply calibration corrections (primarily to adjust for scale error) listed on a cockpit card. Clearly this is a source for error, particularly if

the pilot has a Mode C transponder, since the transponder will transmit the uncorrected flight level to the controller who will then

perceive the aircraft at a slightly "improper" altitude.

4. Calibration adjustment error : A residual error may remain after the

calibration corrections have been applied to the altimeter system,

since the instrumentation may be unable to account for all nonlinearities .

E. Other

1. Altimeter type : There are three categories of altimeters:

Type I - a mechanical instrument ("pressure sensitive"

Type II - an improved mechanical instrument ("precision

altimeter)

Type III - an altimeter with servo-correction facilities

These errors do not apply to flight above FL290, since the standard atmospheric

setting of 29.92 inches of mercury is used in this altitude range.

altimeter)

pressure"

-10-
Types II and III are the ones of greatest interest, because they are probably the only ones found in aircraft flying above FL290.

Differences in mechanical and calibration errors exist among the

three types.

2. Aging : Since mechanical components are subject to wear and deterioration, altimeters can develop a systematic deterioration in accuracy

between overhauls.

2 . 3 Pilot Response

The pilot reads the altitude displayed on the altimeter gauge in the

cockpit, and uses that information to guide the aircraft relative to the as- signed flight level. This task may be performed well or poorly. Different

pilots may perceive the necessity of adhering to assigned altitude as more

or less Important, and may allow different margins for error.

Human errors in the assignment of altitude, the setting of the value of

the standard atmosphere on the altimeter pressure gauge, or the reading of the

altimeter gauge may also contribute to altitude error. Sloppy and inattentive

flying may to some extent be corrected through the use of altitude-hold equipment whereby the autopilot attempts to maintain altitude, but even here there

may be errors in initiating the correct altitude. Also, the altitude-hold

feature is usually disengaged under turbulent weather conditions. Human errors leading to discrepancy between the altitude displayed on the pilot's altimeter gauge and the altitude to which he was assigned are described below.

A. Flight technical error . This term usually applies to a collection of human

errors which manifest themselves in altitude variations during supposedly

level flight. Several causes are given below.

1. Sloppy flying : Pilots have many duties to perform and thus attention

cannot be focused solely on altitude maintenance. In addition, pilots

perceive some variation from the assigned altitude as acceptable

without degrading safety, because of inherent errors in the altimeter

system.

2. " Blunders " : Several outright errors in procedure may contribute to

altitude errors. They include

- failure to apply the calibration corrections when required,

- misreading the altimeter gauge,

- missetting the standard atmosphere on the pilot's pressure gauge,

3. Altimeter discrepancy : Differences in the readings of the pilot's

and co-pilot's altimeter displays contribute to the pilot's perception

of allowable altitude variation and thus may be a source of error.

-11-
B. Altitude-hold equipment

1. Malfunction of altitude-hold equipment : As with any device, the

altitude-hold mechanism may malfunction, causing an altitude error which may or may not be caught and corrected by the pilot.

2. Turbulence : Turbulence involves sharp pressure changes. During such

situations the altitude-hold mechanism, which seeks to maintain a given altitude (that is, to follow an equal-pressure contour), will

tend to move the aircraft rapidly up or down — clearly an undesirable

practice. Therefore altitude-hold is usually disengaged during

turbulent weather conditions.

2.4 Additional Factors

Several additional factors not appearing in the above lists also contribute

to errors in the vertical separation of aircraft.

A. Size of aircraft . Since aircraft occupy space, two aircraft whose centers

are 2000 feet apart are actually separated by less than 2000 feet, when

the distance between the top of the lower aircraft and the bottom of the

upper one is measured. Thus the separation between aircraft is reduced by

the height of an aircraft itself.

B. Different reference pressures . In lower altitudes and at the interface of

FL290, aircraft at adjacent altitude levels or in the same area may be using

different reference pressure data. The use of different reference pressures

leads to differences in altitude measurement which may reduce the separation between the aircraft.

C. Mode C altitude . A discrepancy between the flight level indicated on the

altimeter gauge in the aircraft and that read by the controller on the

ground may result from defects in any of several procedures, including

encoding of the Mode C altitude in the aircraft,

transmission of the Mode C response (garbling)

,

decoding of the Mode C response on the ground.

In addition, as noted above, since some altimeters require ca.'' ibration

corrections to be applied by the pilot and the display does not reflect these

corrections, the Mode C altitude indicated to the controller may show the

pilot to be at an improper flight level when in fact the aircraft is actually

flying the assigned level. It has been suggested that some pilots fly without applying the corrections in order to maintain the appropriate Mode C readout rather than the correct altitude. Controllers are required to verify on initial contact that the Mode C reported altitude is within + 300 feet of the

cockpit altimeter altitude. If that correspondence is not established the

pilot is requested to turn off the Mode C report. After verification is made,

if the controller observes a discrepancy of + 300 feet from designed altitude

he is required to notify the pilot. Smaller errors need not be reported. Thus

large errors, such as those that might result from total failure of the altimetry

system, can be readily identified and appropriate safety precaution applied by

-12-
cooperation between the pilot and controller. Less than complete failure

may be more ditticuit to recognize.

2 . 5 Estimates of Error Sizes

The errors described above have been discussed in several publications

[23, 25, 36, 41], and estimates have also been made for the error magnitudes

and their statistical distributions.

Four probability distributions, representative examples of which appear in

Figure 3, have been used to describe the errors. They are the normal (Gaussian),

the rectangular (uniform) , the limit (2-point discrete uniform) , and the constant

(degenerate point) distributions. Any component error following a constant

distribution is simply a variable that takes a single fixed value. Such errors (e.g. aircraft size) can be considered to reduce directly the effective

nominal spacing between aircraft; once the appropriate adjustment has been made,

these errors can be ignored.

The other distributions are all generally assumed to have a mean of 0, cor- responding to the notion that positive and negative error deviations in some sense balance one another. With one parameter (namely, the mean) fixed in

value, only one other parameter must be known before the distributions of

Figure 3 are completely specified. The standard deviation of an error distribution having finite limits (rectangular, limit or constant) is easily ex- pressed in terms of the maximum possible deviation or "tolerance' , as shown

in Figure 3. By making an estimate of this maximum deviation, a procedure

followed in [25], an estimate can thus be found for the standard deviation of

any of these three distribution types. In the case of a normal distribution,

however, there are no finite limits to the values possible. Accordingly, it

is usually assumed that + three standard deviations adequately delimits the

maximum deviation, since for a normal distribution 99.7% of the observations

fall within three standard deviations of the mean.

Tables 1 through A below contain observed values, or estimates, taken

from these publications for many of the error components. The tables provide,

for each component or combination of components, the source reference of the

data, the distribution assumed for that component, the standard deviation of

the distribution and a maximum deviation. Some error components described above

do not appear below because we found no reference to quantitative estimates

for them. The values in these tables are included mainly as an indication of

the relative magnitude of errors, and no endorsement of validity or usefulness

is implied. _ . . 1_

Values in parentheses in Tables 1 to 4 refer to a Type III altimeter,

while the others refer to a Type II altimeter. The numbers under "Source

of Data" refer to the references in Section 6 of this document. These

sources range from one as early as 1956 to several only a few months old, and

many of the larger error values are found in the older sources. Some of the

documents use slightly different data categorizations from those used here and

The term "maximum tolerance", which has been used [25] in discussing the

numerical magnitude of error components, is not intended to convey the

meaning of "permissible" or "allowable". Rather, this usage denotes the maximum possible magnitude of an error which can be expected to be observed.

-13-
FIGURE 3

Possible Distributions for Component Errors

NORMAL

Standard

Deviation

a -

RECTANGULAR

Standard

Deviation

A/JT -A

LIMIT

Standard

Deviation

CONSTANT

Standard

Deviation

0

-A

-lA-
TABLE 1

Ranges of Values (in Feet) of Static Pressure System Errors

at FL 300

Component

Fixed

(A.l, A. 2, A. 3, B.l*)

Variable

(B.2, B.4, B.5, C.l,

C.2)

TOTAL: I + II

Density

(D.l)

Maximum

Deviation

50

(15)

250

(250)

330

(110)

200

Standard

Deviation

29

(9)

83

(83)

Assumed

Distribution

RECTANGULAR

GAUSSIAN

CONSTANT

CONSTANT

21

Source

of Data

23,41

23,41

25

42

25

42

A.l etc. refer to the listing of the component errors in Section 2.1, The categorization used here, which differs from that used in the text in Section 2.1, follows

that found in those sources reporting values for the error components.

-15-
TABLE 2

Ranges of Values (in Feet) of Altimeter Instrument Errors

at FL 300

Component

Mechanical

DIAPHRAGM (A.l)

HYSTERESIS (A. 2)

L

DRIFT(A. 3) J

FRICTION

(A. 4)

BACKLASH

(A. 5)

INSTABILITY

(A. 6)

TEMPERATURE

(A. 7)

Maximum

Deviation

180-510

(70)

20-75

(20)

10

(10)

35-75

(35)

10-35

(35)

Standard

Deviation

60

(23)

7-25

(7)

10

(10)

12-25

(12)

3-12

(12)

Assumed

Distribution

CONSTANT [25]

GAUSSIAN [23]

GAUSSIAN

LIMIT

GAUSSIAN

GAUSSIAN

Source

of Data

23,25

23,25

23,25

23,25

23,25

II . Readability

PRESSURE

(B.l)

ALTITUDE

(B.2)

TOTAL: I + II

III. Nonstandard

IV.

Setting

COORDINATION (C.l)

BALANCE (C.2)

ZERO-SETTING (C. 3)

Calibration

ADJUSTMENT

(D.4)

15

(15)

20

(20)

25

20

30

-180 to +80

(120)

9

(9)

12

(12)

64

RECTANGULAR

RECTANGULAR

GAUSSIAN

GAUSSIAN

CONSTANT

23,25

23,25

41

25

25

25

8

-16-
TABLE 3

Ranges of Values (in Feet) of Pilot Response Errors

at FL 300

I.

II.

Ill,

Component

Sloppy Flying (A.

Blunders (A. 2)

Maximum

Deviation

1

Altimeter Discrepancy

(A. 3)

TOTAL: I + II + III 200-270

Standard

Deviation

47

42

90

Assumed

Distribution

GAUSSIAN

[23, 41]

Source

of Data

42

42

7,23,41

IV. Altitude-Hold

50

(B.l, B.2)

TOTAL: I + II + III + IV 360-750

29 RECTANGULAR

120-250 GAUSSIAN

41

1,23,25,41

TABLE 4

Ranges of Values (in Feet) of Additional Error Factors

at FL 300

Component

I. Aircraft Size (A)

II. Pressure Datum (B)

III. Mode C (C)

Maximum

Deviation

50-75

200

100

Standard

Deviation

Assumed

Distribution

CONSTANT

CONSTANT

Source

of Data

23,25,41

25

10

-17-
supply estimates only for the total group; such grouped values are also indicated in the tables.

\

-18-
3. MODELING APPROACHES

Several different methods for evaluating vertical separation standards

have been used in the past. The two most notable approaches taken In previous

studies to the evaluation of safe vertical separation standards for use above

FL290 are described below. The first is a procedure in which information

about component errors is combined to produce a probability distribution

for total errors. Assumptions about the shape of that distribution and an acceptable frequency of rare events are then used in evaluating a separation

standard. The second approach is a method in which the collision risk is

related to the frequencies of planes being less than an aircraft dimension

apart (in any of the three directions) and to the probability of simultaneously

overlapping in the other two directions. These frequencies and probabilities

are, in turn, based on the distributions of total error in each direction.

A collision risk equation is then used to determine a separation standard which

meets an acceptable level of risk determined by historically calculated

collision risk factors. This section will also contain a discussion of

other possible approaches and the assumptions upon which the models are based.

3 . 1 The Root Sum of Squares (RSS) Approach

This method [42] arrives at a total vertical error distribution by

combining the distributions of certain component errors believed to make up

the total error. In particular, each component is assxamed to follow some distribution, usually taken to be symmetric and with mean 0. Generally, in

the past, the distributions of individual component errors have been chosen

from among the four given in Figure 3 of Section 2.5. However, the RSS procedure will work equally well if other distributions are used.

The problem now is to describe the distribution of total error, given

the distributions for the individual component errors. Assume that the

individual errors can be considered as simultaneous contributions that add

to one another independently in producing the total error. Then the combined

error distribution will have a standard deviation equal to the square root

of the sum of the squared component standard deviations. Accordingly, this

method is called the root sum of squares (RSS) method . More precisely, if

X^, X , . .

. ,X are independent random variables with mean 0 and standard

deviations a^, o^,,..,o then the variable X = X^ + X^ +. . .+X^ will have

mean 0 and standard deviation

2 2 2 a = \^12 a- + a_ +. . . + an This method for finding the standard deviation of the total error distribution

will be valid as long as the following assumptions are met:

(1) The individual errors are independent.

(2) The individual errors combine simultaneously and additively to

produce the total error.

(3) All of the individual errors that comprise the total error have

been included.

(4) The standard deviation of each individual error is known.

-19-
Note that no assumptions hav-e to be made concerning the particular shapes of

the distributions for the indivi^iual errors. ,

At this point certain information about the total error distribution has

been obtained: namely its mean (=0) and its standard deviation (a).

Knowledge of these two parameters is sufficient for many statistical purposes,

but it is not sufficient for the analysis of collision risk. Indeed, there are

a multitude of distributions (Figure 4 shows just two of them) that possess

the same mean and the same standard deviation. These alternative distributions will in general provide quite different answers to questions about

collision risk; for collision risk analysis by its very definition deals with

events that are infrequent and altitude deviations that are extreme (i.e. far

removed from the mean). As can be seen from Figure A, the proportion of times

a deviation greater than D is observed can be quite different for the two

distributions, even though they possess the same mean and the same standard

deviation.

In the RSS method, this problem is resolved by making the additional

assumption that

(5) The total error is normally distributed.

This assumption is not unreasonable in light of the Central Limit Theorem,

which essentially states that under fairly general conditions the sum of a sufficiently large number of independent random variables is closely approximated by a normal random variable. With this assumption, the total error distribution is now completely specified, since a normal distribution

determined by its mean (0) and its standard deviation (a)

.

A rather crude idea of "safe separation" can now be found using the probabilities of extreme deviations for normal variables. (A more detailed analysis

would need to include effects related to the traffic pattern and density of

a given airspace.) Consider two aircraft whose nominal altitudes are separated

by a distance S and both of which have a normally distributed vertical position

error with standard deviation a. Then actual separation between the2two

aircraft follows a normal distribution having mean S and variance 2a (or

standard deviation a) . Since we are interested in situations for which this

altitude difference becomes small, we are concerned only with the left-hand

tail of this distribution. To assume that three standard deviations provide

adequate safety is equivalent to assuming for this case that the risk of col-^

lision will be acceptably low when the probability is less than 0.135 percent

that vertical separation between aircraft, nominally separated by S, is reduced

to zero. Thus the RSS method per se does not directly lead to a collision risk

measure as defined above. However the assumption of normality of the error distribution can readily be combined with analyses such as that described

below to give such a measure. The correctness of the normality assumption

This numerical value derives from the fact that .00135 is the probability

that a normal random variable is smaller than its mean by more than three

standard deviations. This value applies only if the standard deviation o

is known.

-20-
FIGURE 4

Two Distributions Having the Same Mean and

Standard Deviation

0 D

-21-
is critical, and must be validated against actual data.

3.2 The Reich Approach

A detailed collision risk model for analyzing the effects of separation

standards was proposed in 1966 by Reich [32, 33, 34] and has been subsequently

modified by others for use in the parallel tracking system over the North

Atlantic [15, 43]. This model requires, as input, estimates of such parameters

as the physical dimensions of the aircraft, the average relative speeds

between aircraft in the three directions and the amount of congestion within

the traffic region. In addition, the model requires the probabilities of

overlap in the vertical, lateral and longitudinal directions, such values

being related to the appropriate separation standard under consideration. As

output, the model produces a value for the collision risk, measured as the

expected number of fatal accidents per flying hour (where each collision is

counted as two fatal accidents). It is the variation of collision risk, as

a function of the separation standard being studied, that is of major interest

in the evaluation of safe separation standards.

As considered in this model, each aircraft is represented as a rectangular

box having the given aircraft's maximum dimensions of length, width and

height. A collision is considered to have occurred between two aircraft when

they are flying in overlap in two directions (i.e. they are separated by

less than an aircraft's dimension in those directions) and an overlap then

occurs in the third direction. One such possibility is accounted for by the

term N P , where P is the probability of overlap in both the lateral and

X yz yz vertical directions and where N is the number of times an overlap occurs

X

in some time period with regard to the longitudinal direction. Implicit in

this expression, already, is the assumption that position in the x direction

is independent of that in the y and z directions. If one further assumes that

all three coordinates of position are independent, then the above expression

simply becomes N P P , where P indicates the probability of overlap in the

r direction. Becai^se there are two other possibilities that result in a collision, the collision risk between a pair of aircraft is given by the sum

of three terms:

(1) Collision Risk =NPP+NPP+NPP. xyz yxz zxy

Each P needs to be estimated from the observed distributions of positions

r in the r direction. What further complicates the matter is the fact that

the N values depend not only on the flying errors in direction r, but also

on their rates of change. This added dependence is intuitively reasonable

since the number of overlaps depends on both the probability that an overlap

occurs and the average duration of an overlap. Under the assumption that

the velocity r in direction r follows a distribution which is symmetric

about 0, and that position and velocity are independent, Reich derives the

approximation

(2) N - r 2X

r

where | f | is the average relative speed between two aircraft in direction r.
and \ is the dimension of the aircraft in direction j: . For simnliciLy, it is r assumed here that all aircraft have the same dimension A ; one could also

interpret X as an average aircraft dimension. By virtue of (2), equation (1)

becomes

(3) Collision Risk ^ P P P (JIh.+ .EL + / • X y z 2a /a za X y z

If estimates for the average relative velocities | f f and the aircraft

dimensions A are given, then all that remains to be estimated are the overlap

probabilities P . These probabilities are in turn derived from the total error distributions for each of the three directions. Just as in the RSS

method, the value of P (especially the overlap probability in the direction

corresponding to the separation standard being considered) depends crucially

upon the form assumed for the total error distribution. That is to say,

observations in the "tails" of the total error distribution (extreme deviations)

are overwhelmingly important in the calculation of these overlap probabilities.

The approach taken by Reich proceeds by first making a conservative estimate

of the tail area of the distribution. Reich then models the shape of the

tails in three alternative ways:

(a) The pessimistic spike, which places the en±ire tail area at a single point corresponding to the intended flight path of the

neighboring aircraft,

(b) The (conservative) level tails, in which large errors are assumed

to be uniformly distributed (all equally likely from some point on)

,

with the limits of the uniform distribution chosen to maximize

the probability of overlap,

(c) The exponential decay, in which the relative frequencies of large errors are assumed to decrease exponentially with magnitude.

These assumptions about the shape of the tails (together with a fixed

assumption about the distribution of small errors) then allow overlap probabilities, and thereby collision risk, to be calculated for each of the

three alternative models. (An example of how such probabilities can be derived from the total error distribution is given in Section 3.3) The estimates

obtained under assumptions (a) -(c) then provide a range of values for the

collision risk. In common with the RSS approach, knowledge about the precise

shape of the total error distribution, and in particular, the shape of the

tails, is required before confident statements can be made about the actual

magnitude of the collision risk.

As it stands, the expression (3) for collision risk is appropriate

only for a pair of aircraft, whose respective flying errors are assumed to

be independent of one another. Reich also extended the analysis from a pair

of aircraft to an entire traffic region, using assumptions about the airspace configuration and traffic densities. The result of this extension

turns out to be the adjunction of another multiplicative factor to the expression

in (3).

-23-
Although the RSS and Reich methods seem to be two entirely different and

separate approaches, they are not necessarily inconsistent. In fact some combination of the best features of both methods may be possible, since they

address different parts of the problem. The RSS method focuses on the calculation of the distribution of total vertical error from component errors. Tl Reich model focuses on the evaluation of collision risk from knowledge of the

distributions of errors in each of the three directions. One could therefore

use the RSS method (or some other method of combining individual component

errors) to calculate the vertical error distribution, and then use that

distribution as input to the Reich collision risk analysis. Such a procedure

capitalizes on advantages inherent in both methods: namely, it relates the

risk of collision to component errors, thus allowing the evaluation of changes

in the performance of components, and it contains a direct and specific

analysis leading to the calculation of collision risk (unlike the RSS method)

.

This hybrid approach also tends to avoid the failings of the two individual

methods, and is therefore a strong candidate for further investigation once data concerning the error distributions are available.

3 . 3 Analysis of the Tails of Distributions

As noted previously, the RSS and Reich approaches are actually complementary. The, first attempts to synthesize a total error distribution from

component errors. The second approach requires as input the total error distribution and produces information about the risk of aircraft collision.

In both cases it becomes apparent that it is the extreme deviations (out in

the tails of the distribution) that are important, and not the small or moderate-sized deviations.

Another way to see that the effect of the tail shape can be crucial

is by considering two aircraft over the same geographic point on the earth

and nominally separated by S feet in the vertical direction. Suppose further,

as seems reasonable, that both aircraft are subject to the same total vertical

error distribution f (x) . Then the probability of vertical overlap (i.e. the

probability that the separation between the two aircraft is less than h, the

vertical dimension of an average aircraft) is given by • t+h

P(h) =_/ f(t) [^/^ f(y-S) dy] dt,

which upon using the substitution v = -y+t+S becomes

S+h

P(h) = _/ f(t) [ g/^ f(t-v)dv] dt.

Since h is small relative to S, the term in brackets above can be approximated

by 2h f(t-S) and so

00 P(h) ^ 2h / f (t) f (t-S) dt.

—00

If the distribution f is only moderately spread out relative to S, then at

least one of the values of t and t-S which appear in the product will be out

-24-
in a tail of the distribution. In other words, the shape defined by the tails

of the distribution will have a considerable effect on the value of P(h),

the overlap probability.

It has been reported by several sources [29], [30] that the observed t.iils

appear to be fatter than one would expect from a normal distribution. If this

is the case, assumption (5) of Section 3.1 does not hold and the 3 standard

deviations used by the RSS method may contain significantly less of the total

distribution than the 99.7 percent contained within 3 standard deviations

from the mean of a normal distribution. To obtain an equivalent proportion

of a fatter-tailed distribution, it would be necessary to include more than

3 standard deviations, thus increasing (perhaps critically) the acceptable

separation standard. However, in order to assess the appropriate factor by

which to multiply the standard deviation in order to include 99.7 percent of

the distribution, it is necessary to know what the distribution is. This negates one of the advantages claimed for the RSS approach, namely not having to

know the actual distribution. A more thorough study of the tails of the error distribution is clearly necessary since so much of the analysis depends on this critical information.

3 . 4 Convolution of Distributions

In describing the RSS method, it was noted that the precise shapes or forms of the component distributions are not required. Rather, only the

values of the component error standard deviations are needed, together with the

requirement that there be "enough" component errors for the Central Limit

Theorem to apply. The result is that the total error distribution is approximately normal, with a calculable mean and standard deviation.

There has been some concern that the total error is not in practice

normally distributed. Therefore it is appropriate to consider, as an alternative, combining known component distributions to give an analytic description

of the total error distribution. The statistical method for doing this is

termed the method of convolution [18, pp. 187-188],

This procedure makes use of the precise (assumed) forms of the component

distributions in producing an exact expression for the total error distribution

Again, certain assumptions must obtain before the method can be used; namely,

assumptions (1) through (3) of Section 3.1 are presumed to hold, and in place

of assumption (4) the following stronger assertion is made:

(4*) The distribution of each individual error is known.

To illustrate the method, consider the case of two component errors X

and X- having distributions f, (x) and f^{x), respectively. Then the probability density function f for the variable X=X^+X is called the convolution, of

f^ and f2 and is given (assuming independence) By

00 f(x) = / f, (t) f„(x-t) dt.

_oo X I This relation can be generalized so that the distribution for X=Xt+X„+. . .+X

1 2 n will be found using repeated convolution operations. For example, the con- volution of two rectangular distributions is found to be in general a trapezoidal distribution (see Figure 5). Also, the convolution of two normal

-25-
FIGURE 5

Convolution of Two Rectangular Distributions

-B 0 B

X,

-A

-A-B -A+B A-B A+B
J isLr ilnitions is again a normal d Lstr Unit ion

.

Ifhen the component distributions are more complex and when a number of

component distributions must be combined by convolution, it is difficult to

find an exact analytical form for the composite error. An alternative procedure is to use Monte Carlo methods to sample from the individual distributions and thus generate an approximation to the total error distribution. We did this using representative values for the parameters of the

component distributions (with shapes as specified by the Panel on Vertical

Separation of Aircraft [25]). The resulting combined distribution appeared

for all purposes to be normal. In fact, a number of statistical tests for

normality were applied^and none of these gave any reason to reject the hypothesis of normality. Moreover, the total error was fitted by a normal

distribution better than any other chosen from a large family of possible

symmetric distributions (including the logistic, double exponential and

Cauchy distributions). These observations remained true for different

choices of parameter values, taken from the ranges given in Tables 1-4 of

Section 2.5.

To explore by Monte Carlo methods the effects of convoluting distributions of the types shown in Figure 3, several computer runs were made con- voluting a single normal distribution with a single rectangular distribution,

varying the ratio of the standard deviations of the two distributions. As

long as the standard deviation of the rectangular distribution was approximately

equal to or less than that of the normal distribution (ratios of 1, 1/2, 1/4,

1/8, 1/164 were tried), then the resulting distribution was essentially

normal. When the standard deviation of the rectangular was increased to be

significantly greater than that of the normal (ratios of 2 and 4 were run)

,

the convolution was not normal but had shorter tails than a normal distribution.

More emphatically, it is shown in Appendix A that, according to the

definition used there for comparing tail lengths, the convolution of a normal

and a rectangular distribution must have shorter tails than normal. Moreover,

the general result given in Appendix A guarantees that the convolution, of

a normal difetribution with any bounded probability density function having

a finite range also must have shorter tails than normal. In particular, this

result implies that if the distributions to be convoluted consist primarily

of normal and rectangular distributions (as is assumed in most of the ICAO

documentation) , then the resulting distribution will either be approximately

normal or have shorter tails than a normal distribution (with the same standard

deviation)

.

The processes most likely to introduce distributions with longer tails than

normal are the human actions in which large blunders might occur , including

The statistical computer programs used are more fully described in James

J. Filliben, "DATAPAC: A Data Analysis Package", to appear in Proceedings of

Computer Science and Statistics (9th Symposium on Interface), April 1976,

Harvard University, Cambridge, Mass.

-27-
inattentive flying procedures by the pilot and missetting of the standard

atmosphere by the pilot. The first of these, usually called "flight technical error", refers to the pilot's ability and inclination to maintain the

assigned altitude. This error is decreased when altitude-hold equipment

is used, since pilot inattentiveness is no longer a factor. As already

noted, however, there may be errors when altitude-hold is initiated, and

altitude-hold is usually disengaged during turbulent conditions. The

second factor, missetting the standard atmsophere, is often considered part

of pitot-static error, but is included here because it too is a human

failure which can result in gross position error.

3 . 5 Examination of the Model Assumptions

From the previous section it can be seen that the assumption of normality

used in the RSS method appears to be consistent with the Monte Carlo results

based on parameter values from Tables 1-A, the other assumptions on which

this convolution approach is based namely (1) , (2) , (3) , (4*) are correct. Since some evidence exists [29, 30] to suggest that the total error distribution is not in practice normally distributed (especially in the tail

areas), it is necessary to examine the validity of these assumptions and see whether alternative ones are more reasonable.

Assumption (1), the assumption that the component errors are distributed

independently of one another, may not necessarily hold. In fact, it does not seem unlikely that some of the errors referring to the more detailed components

of the height-keeping system are dependent e.g. the friction and backlash

errors. It would be quite difficult, without much more information, to

model mathematically the effects of such possible dependencies. Accordingly,

a more reasonable approach is to combine together certain groups of errors

in order to obtain a collection of errors that are for the most part independent. For example, aggregation into the broad categories of static pressure

system error, altimeter error and pilot response error would achieve a fairly

high degree of independence. Moreover, it is probable that data on heightkeeping errors could for the most part be obtained at roughly this level of

aggregation, rather than a finer one.

Assumption (2) reflects the belief that individual errors combine

simultaneously and additively. While such an assumption about the errors appears to be a good initial approximation to the truth, there are alternative

approaches to modeling the combination of errors. Several of these are mentioned

below:

(a) Errors may vary from aircraft to aircraft and crew to crew. For

example, any individual aircraft may experience a total error which is distributed normally with mean 0 and standard deviation

-28-
a. Yet the parameter a may vary from one aircraft/crew configuration

to another, and so it may be reasonable to assume that o itself

follows a probability distribution [5, 27]. The resulting observed

error distribution, based on a sample of different aircraft, may

not resemble the error distribution of any individual aircraft.

(b) The total error may in fact be a mixture of several parts. For

example, total error might be considered as normally distributed

under usual conditions. Furthermore, suppose there is some probability of a blunder occurring, where the magnitude of the blunder

follows some other distribution. Then the distribution of total

error will be determined by a weighted average of the two given

distributions [11, 26].

(c) It is possible that certain error components are in fact timevarying quantities. For example, some of the errors may occur only

during certain phases of flight or may be applicable only while

certain equipment is operating (or not operating)

.

Assumptions (3) and (4*) are also important, requiring that all reasonable

sources of error have been identified and that knowledge about their probabilistic behavior is available. A carefully designed data collection effort

(especially one geared toward the measurement of somewhat aggregated error

components) can help to ensure that these assumptions hold, at least approximately.

3 . 6 Choice of Model

It is clear from the discussion above that further modeling awaits a structured planned data collection effort designed to permit fuller understanding of the actual shapes of the tails of the vertical error distribution

and the tail distributions of the larger error components, particularly flight

technical and other human errors. A review of previous attempts at gathering

data for this purpose shows many pitfalls, among them the difficulty in

identifying (after the fact) the assigned altitude and when an aircraft is

actually in level flight, the problem of identifying actual pressure altitude,

and the need for collecting a large sample of data which covers a variety

of aircraft types and crews.

Once such a data sample is available, choice of model may in part be

determined by measures of fit to these data. One might, for example, choose

the totfil error distribution based on one of the following families of

distributions: Johnson S^, Pearson Type VII, Tukey X or generalized exponential. All of these families include a variety of individual distributions,

with differing characteristics obtained by varying parameters in the distribution [17, 18]. In each case, the particular member of the family represented

by the observations may be found by estimating the values of those parameters

best fitting the data.

-29-
Two other modeling approaches, also involving data fitting, have been

proposed. The first involves imagining two types of flights, having two

distinct error distributions. One is the usual flight where some errors occur but nothing untoward happens, and whose error distribution is normal.

The other is a "blunder flight" whose error distribution is totally different,

perhaps bimodal, and has a much greater standard deviation. Blunder flights occur a certain (determined from observed data) fraction of the time. The

total distribution becomes a weighted average of the two types of distributions

(weighted by the fraction of flights falling into each category). ^

In the second approach, it is assumed that all aircraft errors follow

the same type distribution, usually the normal, but that one of the parameters,

say the standard deviation, varies from aircraft to aircraft following a second distribution. For example, the Burgerhout distribution results when

the individual aircraft errors are normal with mean 0 and standard deviation

a and when a itself varies according to a folded normal distribution [17]

with mean p and standard deviation a^. Other combinations of distributions

are possible, and if the data were available one might determine the most

desirable distribution type, again by applying data fitting techniques to

select a "best" member from some general family of distributions.

-30-
In order to test model assumptions and to evaluate the reasonableness of

the various modeling approaches, it will be necessary to obtain additional

data, since currently available sources are inadequate for these tasks. More

specifically, a data collection effort is needed in order to specify the distributions of

total vertical error,

static pressure system error,

altimeter instrument error, and

pilot response error.

It may be possible to obtain static pressure system error and altimeter

instrument error data from controlled laboratory experiments, since both

are basically errors in equipment performance. By contrast, the total error

and the pilot response error will require field observations using airborne

aircraft. Since information is required on extreme or gross deviations,

the set of observations must be quite large in order to provide enough data

points in the tails of the distributions to allow estimating the size and

shape of those tails. This implies that data collection will unavoidably be

expensive. Careful design of the data gathering effort will thus be necessary,

to permit collection of sufficient data at a reasonable cost. Precautions

must be taken to ensure the usefulness of each piece of data collected, and

to ensure that no important factors are overlooked. The data collection must

also be designed to aid in further modeling and choice of model, by facilitating the checking of model assumptions.

This section will include a discussion of many of the issues which

should be considered in the design of a data collection effort. These

issues are presented from the point of view of the analyst who desires as complete and carefully specified a data set as possible, and this section

does not explicitly address the budgetary or feasibility problems of obtaining such data. Thus these remarks describe an ideal goal towards which

any data collection effort should strive. Such remarks should serve as a vehicle to stimulate discussion of the kinds of data needed and possible

methods of obtaining them, but they should not be taken as requirements.

Rather a careful design must balance the desirable characteristics described

below against technical feasibility and budgetary and manpower constraints,

with the objective of finding an acceptable middle ground.

4 . 1 Avoiding Possible Problems in Data Collection

Previous data collection efforts have encountered several problems in

obtaining the desired numbers and in interpreting the information after it was

gathered.

One of these problems is the identification of the flight level to which

a given aircraft was actually assigned. Actual flight level flown and

assigned flight level must be obtained from separate data sources, and the

two pieces of information must be coordinated in time. Analyses which infer

assigned flight level from that actually flown (by using the closest 1000 foot

level) will fail to capture truly gross deviations from assigned flight level.

It is therefore necessary to collect flight level assignments along with

actual height flown in order to assess error magnitudes accurately.

Similarly, those analyses which infer controller intervention if aircraft depart significantly from planned course or flight level will also miss

gross deviations. For example, aircraft flying at an even flight level (odd

flight levels are usually assigned above FL290) cannot be presumed to have

been assigned there by a controller. Again it is necessary to know what the

controller's actions are, and therefore it is valuable to collect data both

on actual performance and on the controller's directions to pilots.

-31-
Several other pieces of information must be collected about each flight

for which height-keeping performance is to be analyzed. In particular, aircraft type and altimeter type must be recorded in order to evaluate the effects

of differences in performance among aircraft on the error distributions. It

is also desirable to know whether the altitude-hold equipment was or was

not in force, since pilot response error will be affected by the use of such

equipment. Further, it is useful to know if weather conditions are stable

or changing, and if barometric pressure is varying, thus causing variation

in pressure altitude. When turbulence exists, as in a thunderstorm, then this

condition will affect ability to measure pressure accurately and to maintain an equal pressure contour. All of these auxiliary data factors should be collected in conjunction with and at the same time as the actual aircraft altitude,

to permit evaluating the (possibly systematic)ef f ects of these factors. (Other

such systematic error factors are discussed in the next section.)

A final problem in collecting data is the difficulty of identifying the

pressure altitude flown. Although ground stations can monitor actual altitude

(height above sea level) quite accurately using radar, the aircraft is not

assigned to an actual height but rather to an equivalent pressure altitude.

The two would be the same only if the standard atmospheric pressure were the

true reference pressure. Obtaining actual ambient air pressure at the aircraft's altitude appears to require special instrumentation whose use is not

only expensive but also defeats the aim of obtaining data on the usual re- sponse of pilots (who therefore should not know they are being specially

monitored) . Some method must be devised for obtaining the actual barometric

pressure at given altitudes in order to establish true pressure altitude

flown

.

None of these problems should prove insurmountable, but all require

careful consideration and should be taken into account in designing the data

collection effort. Anticipation of these problems and provision, prior to

data gathering, of means for overcoming them will contribute greatly to the success of the collection task and the usefulness of its product.

4 . 2 Consideration of Factors Causing Systematic Errors

As noted above, the design of the data collection effort must take into

account subsidiary factors which can systematically influence the results.

Data should be recorded over the whole range of values for such a factor,

to ensure that the observations recorded are properly representative. A preliminary list of such factors appears in Table 5, in approximately their

expected order of importance or effect.

The type of altimeter certainly has an effect on instrument performance,

and so it is necessary to include data gathered from the different altimeter

types in use above FL290, at the least Types II (precision) and III (servocorrected) which are described in Section 2. There may also be some variation

by manufacturer, so data should be taken from several manufacturers' instruments. If altimeter type is the same for all of a particular model of aircraft

(or aircraft type and airline) , one need consider only the latter in the

design of the data collection. Aircraft type must, however, be taken into

account since different aircraft have different shapes and different locations

for the static pressure sources, leading possibly to different error character-

-32-
TABLE 5

Factors Uhich Can Cause Systematic Errors

1. Altimeter type

2. Aircraft type

3. Altitude-hold equipment In use

4. Meteorological conditions

5. User class

6. Crew and aircraft variability

7. Altitude

8. Calibration cycle

9. Age of aircraft

10. Surveillance/control system

11. Traffic density

-33-
istics. Care must be taken that the aircraft types sampled are representative

of those generally found above FL290.

Since altitude-hold eliminates many of the human error sources, it is

desirable to have data collected both with and without this equLpmonL in

operation. Furthermore, it is desirable that the two situations be represented

in the data set according to their relative frequencies of occurrence, or at

least one should be able to estimate what these relative frequencies are.

Meteorological conditions, particularly any turbulence or abrupt changes

in barometric pressure, also affect altitude measurements. Altitude-hold

is usually disengaged during turbulence, since this equipment's efforts to

follow an equal pressure contour may lead under such conditions to rather

large height fluctuations in a short time span. Poor weather conditions

require greater attention by the pilot to his instruments, providing less

opportunity for attentiveness to any one of them and perhaps leading to greater

altitude deviations. On the other hand, since good weather allows visual

observation of other aircraft, pilots may be less attentive under such conditions than at times when visibility is poor. These various speculations

highlight the necessity for data to be gathered under varying meteorological

conditions to ensure that effects of those conditions can be evaluated .

The majority of aircraft at altitudes above FL290 are those of commercial

air carriers, but military aircraft also operate in these altitudes as do some general aviation aircraft. Each user class is likely to have its own equipment and procedures for calibrating that equipment. In addition there are likely to be differences in pilot flying hours and flight frequency.

All these differences combine to suggest possible systematic variation in

height-keeping error among the three classes of users.

In an effort to collect data on actual vertical errors it is desirable

to take into account the variability among equipment and crews: in particular,

the variability for the same crew on different flights and the variability

for the same aircraft with different crews. It will of course not be sufficient

to have data relating only to one crew or only to one aircraft. Thus, for

instance, a design which relies on a single heavily instrumented aircraft will

not provide sufficient data to resolve the many questions about altitude error.

Another factor to be considered in planning the data collection effort

is altitude itself. Clearly all data must refer to aircraft flights whose

assigned altitude is above FL290, but it is desirable that several different

altitudes within that range are represented. For example, each aircraft type

is designed to operate most efficiently in a particular altitude range,

and thus the pilot usually requests clearance to fly at an assigned altitude

in that range. In addition, air traffic control procedures assign aircraft

flying in opposite directions to different flight levels. Accordingly, if data

are recorded only on aircraft flying at one flight level (and hence in only

one direction) the effects of prevailing wind patterns (such as the jet stream)

may not properly be accounted for. Therefore several altitude levels should

be represented in the data set.

-34-
/

The precision of most equipment deteriorates with age. Calibration Is

designed to reverse this process, at least partially, by resetting the instrument so that certain test measurements are made accurately. The calibration cycle (i.e., the time between successive calibration tests) thus

has an effect on the magnitude of instrument errors. Since calibration procedures are largely a matter of the individual owner's choice (as long as minimum standards are met), the actual calibration practices can affect the

quality of height-keeping. Therefore it is desirable that the data set include operators with different calibration procedures, and aircraft at different

points in the calibration cycle.

The age of the aircraft itself may have some effect on height-keeping

error. As noted in Section 2's description of the static pressure system,

skin deformations or dentjs in the neighborhood of the static pressure opening

can significantly affect the pressure measurement; such deformations become

more likely with age. To the extent that aircraft types change with time,

aircraft type may be a fairly good indication of the age, so that data on age of specific aircraft may not be required.

The presence or absence of an independent surveillance system can affect

the pilot's perception of acceptable height deviations and thus influence the

magnitude of pilot response errors. Radar surveillance covers all of CONUS

(Continental U. S.) but high-traffic oceanic areas, such as the North Atlantic

or the area between the West Coast of the U.S. and Hawaii, do not have radar

coverage; controllers must rely on pilot position reports in these regions.

Different lateral and longitudinal separations are required over the ocean,

but the vertical separation rules are the same in all areas, regardless of the

availability of surveillance and navigational systems. En route radar displays

have flight level appearing on the radar scope for any aircraft with an operating Mode C transponder, but controllers do not continuously monitor altitude

as they do position. Their intermittent and advisory monitoring may, however,

aid in preventing gross altitude deviations and situations in which collision

is imminent. Thus it is reasonable to expect that the presence or absence of a surveillance system may affect the distribution of vertical position error,

and should be considered in the data collection design.

Traffic density is ultimately reflected in the Reich model through the

factors P , P and P , since the probability of losing separation in one of

the three^dir^ctions^is in part a function of how often aircraft are directly

behind one another on the sam.e track, pass on adjacent tracks, or pass on adjacent flight levels of the same track.

In addition to these effects of traffic density, the pilot's knowledge of

the proximity of other aircraft, from radio reports or sightings, may affect

his attentiveness and adherence to assigned flight level. Therefore traffic

density can have an effect on the error magnitudes, and data on this factor

will be required for use in the Reich model.

The various factors listed in Table 5 can each cause systematic variations

in the distribution of vertical position error and in one or more of the com- ponent error factors. Thus a good data collection design will ensure that

-35-
the effort includes representative values for each tacLcir ,iiul comb i n.i L i ons

of factors that are important at the altitudes of interest .

While it may be economically prohibitive to include all relevant factors

in the experimental design, at least the three major ones — aircraft type,

altitude-hold in use, and meteorological conditions — should be addressed.

Surrogates for factors not included directly (airline and aircraft type for

altimeter type, as an instance) can perhaps be used when necessary to ensure representation of other factors, and biases in the collected data set should

be recognized during analysis of those data.

4 . 3 Testing Model Assumptions

The data, once collected, must be analyzed to determine how representative

a sample has been drawn. In particular, it can be judged how well the data

reflect the types of situations usually encountered in the environment being

considered and to what extent the various modeling assumptions noted earlier

hold. The two main model assumptions to be tested are: that component errors

are independent, and that the distribution of total error (and in particular

its tails) is normal. As a first test for the independence of the three

component errors ( i.e., to check that the errors in one component are not

associated with errors in another) , one would compute the correlation co- efficients between all pairs of components. If a coefficient is near +1

or -1, the two factors display a high degree of linear association; if the

coefficient is near 0, the two factors display very little association or correlation with one another. Other statistical measures or tests may also

be used to establish the degree of association between the component errors.

The assumption of normality of the tails may be investigated by plotting

the distribution on probability graph paper and comparing the resulting

curve with a straight line. Several test statistics, such as the ratio of

the mean deviation to the standard deviation, the sample skewness and the sample

kurtosis [17] can be computed and compared with known values of those statistics for a normal distribution. In addition, one may use regression to

fit the observed total error distribution within a general family of distributions that includes the normal distribution for certain values of the parameters, and see how closely the "best-fit" parameter values resemble the

"normal distribution" values. Most of these procedures are easily available

using present statistical computation packages, so that testing for independence

of the component errors and ixormality of the total (or a component) error distribution is a relatively straightforward task once data are available.

Thus a variety of statistical procedures can be performed on the data set once it is collected, and before it is used in modeling.

-36-
5. CONCLUSION

In this report we have discussed several approaches to evaluating vertical

separation standards for use above FL290. Various models have been proposed

to aid such an evaluation; choice among them rests in part on how well they

meet the following criteria:

1. The model should be capable of reflecting changes in the system.

2. The model should relate system characteristics, including separation

standards, to some measure of system safety.

3. The model must be "computable", relying on quantifiable measures

and functions.

4. The data required as model input must be collectable with a reasonable

effort.

5. The model must reflect actual error distributions found, instead of

those most easily handled mathematically.

Two models which have been proposed for this application were described

in Section 3. The first is the RSS approach, which combines characteristics

of individual error components into an estimate of total vertical position

error. The second model, originally formulated by Reich, combines characteristics of the error distributions in each of the three coordinate directions

(along track, across track, and vertical) into a measure of collision risk.

Neither of these approaches meets all five of the criteria listed above.

The RSS method does not meet criterion 2, since it does not relate directly

to a safety measure, and it also fails criterion 5 since it relies heavily on

the normal distribution even though a fatter-tailed distribution may apply.

The Reich model does not meet criterion 1, since there is no way to relate

system characteristics, other than the total error distributions in each of

the coordinate directions, to the collision risk. Both approaches do involve

computable models whose data are collectable, meeting criteria 3 and 4.

Since neither model is wholly satisfactory, this report has contained

suggestions for modifying and combining the two approaches into one which would

meet all five criteria. Such an approach would rely either on a modified RSS

method or on convolution of individual error distributions for obtaining the

distribution of vertical position error, and then use that distribution

as input to the Reich collision risk calculations. Other approaches listed

in Sections 3.5 and 3.6 might also be examined in future work.

In Section 2 of the report we discussed in detail many of the component

errors which contribute to vertical position error. The detailed component

errors were then combined into 4 categories:

1. static pressure system errors,

2. altimeter instrument errors.

-37-
3. pilot response errors, and

4. other errors.

The error distributions for these categories, if known, would be input to a RSS or convolution model of the total vertical position error. It is assumed

for this process that these errors are independent and additive, with known

standard deviations (for the RSS approach) or known distributions (for the

convolution approach)

.

Section 4 of the report discussed the collection of data on the component

and total vertical position error distributions. Existing data have proved

inadequate for determining these distributions; much previous modeling has

been based on assumptions that distribution types are of a particularly

tractable form, rather than whether they are suitable or appropriate for the

actual data. Auxiliary factors whose neglect might create systematic bias

in a collected data set have also been discussed.

Because of the size of the data set required to estimate the tails of

the distributions. Section 4 stresses the importance of a well-designed plan

for collecting the data, taking into account the various factors which could

bias the results. The collection of such a data set will clearly provide a more solid basis for evaluating alternative approaches to modeling aircraft

vertical separation above FL290.
6 . REFERENCES

Accuracy of Aircraft Height Keoiiin)^, 1 CAO RCCSP CWP-68 , 1 974.

Altimetry and the Vertical Separation of Aircraft, International Air

Transport Association (Jan. 1960).

Analysis of a Limited Amount of Data on Height Keeping from AIDS

Recordings in B-747 and DC-10 Aircraft, Nationaal Lucht-En Ruimtevaartlaboratorium, Report number 106.510 (Feb. 18, 1975).

E. W. Anderson, Is the Gaussian Distribution Normal?, J . Inst . of Nav

.

, Vol. 18, No. 1 (Jan. 1965), pp. 65-71.

E. W. Anderson and D. M. Ellis, Error Distributions in Navigation,

J. Inst, of Nav. , Vol. 24, No. 4 (Oct. 1971), pp. 429-442.

R. G. Anderson, Survey of the Errors of Pressure Measuring Instruments

in Relation to Air Traffic Separation Standards, Royal Aircraft Establish

ment Technical Report No. 65262 (Dec. 1965).

F. J. Arnold, Variation From Nominal Cruising Level Due to Flight Technical Error, ICAO RGCSP CWP-62, 1974.

F. J. Arnold, Difficulties in Assessing the Accuracy and Reliability of

Altimeters, ICAO RGCSP CWP-95, 1975.

Th. J. Burgerhout, A Class of Probability Distributions with Application

to Aircraft Flight Path Analysis, Technometrics , Vol. 15, No. 2 (May

1973) , pp. 365-378.

G. J. Couluris, Analysis of Automatic Aircraft Altitude Reporting Using

the Air Traffic Control Radar Beacon System, FAA-RD-73-44 , Stanford

Research Institute, 1973.

C. S. Durst, Abnormal Errors and Aircraft Separation over the North

Atlantic, J. Inst, of Nav. , Vol. 12, No. 1 (Jan. 1959), pp. 41-49.

William Gracey, The Measurement of Pressure Altitude on Aircraft,

National Advisory Committee for Aeronautics, Technical Note 4127

(Oct. 1957).

William Gracey, Survey of Altitude-Measuring Methods for the Vertical

Separation of Aircraft, NASA Technical Note D-738 (March 1961).

A. L. Haines, B. M. Horowitz, and A. P. Smith, A General Model for

Separation Standard Assessment, MITRE Report No. MTR-6909, MITRE Corp.,

McLean, Va. 22101 (May 1975).

Ronald Hershkowitz, Collision Risk Model for NAT Region, Report No.

DOT-TSC-FAA-71-6 (May 1971).
[16] Instrument Flying Handbook, FAA Flight Standards Service (1966),

pp. 37-60.

[17] N. L. Johnson and S. Kotz, Continuous Univariate Distributions, Vols. 1 and 2, Houghton Mifflin Co., Boston, 1970.

[18] M. G. Kendall and A. Stuart, The Advanced Theory of Statistics, Vol. 1,

Charles Griffin and Co., London, 1963.

[19] J. F. Koetsch, A Three Dimensional Mathematical Model of the Air Traffic

Control Separation Problem, Presented at the International Aviation

Research and Development Symposium, Atlantic City, N.J. (Apr. 10-14, 1961).

[20] Joseph J. Kolnick and Barbara S. Bentley, Random Deviations from Stabilized Cruise Altitudes of Commerical Transports at Altitudes up to 40,000

Feet With Autopilot in Altitude Hold, NASA Technical Note D-1950 (July

1963)

.

[21] D. E. Lloyd, Mathematical Studies on Separation Standards, J. Inst, of

Nav. , Vol. 24, No. 4 (Oct. 1971), pp. 456-458.

[22] B. L. Marks, Air Traffic Control Separation Standards and Collision Risk,

Royal Aircraft Establishment Technical Note No. Math 91 (Feb. 1963).

[23] Mathematical Methods Relating to the Vertical Separation Problem, ICAO

Circular 106-AN/80 (1972).

[24] Methodology for the Derivation of Separation Minima Applied to the

Spacing Between Parallel Tracks in ATS Route Structures, ICAO Circular

120-AN/89 (1974).

[25] Panel on Vertical Separation of Aircraft, First Interim Report of the

Panel, ICAO Doc. 7672-AN/80, 1956.

[26] J. B. Parker, The Effect of Blunders on Collision Risk Calculations,

J. Inst, of Nav. , Vol. 11, No. 1 (Jan. 1958), pp. 29-33.

[27] J. B. Parker, Error Distributions in Navigation, J. Inst . of Nav. , Vol.

25, No. 2 (Apr. 1972), pp. 250-252.

[28] A. Pool and Th. J. Burgerhout , A Few Notes on the Determination of Acceptable Values for the Vertical Separation Between the Cruising Levels

of Commerical Aircraft, National Lucht-En Ruimtevaartlaboratorium,

Report V. 1920 (May 27, 1964).

[29] A. Pool and Th. J. Burgerhout, Vertical Separation of Civil Aircraft

During Cruising, Nationaal Lucht-En Ruimtevaartlaboratorium, Report V.

1930 (Sept. 28, 1964).

[30] P. Puvrez, Mathematical Aspects of the Work of the Vertical Separation

Panel, Appendix to ICAO document AN-WG/ALT/10 (Mar. 20, 1963).

-40-
p. G. Reich, A Theory of Safe Separation Standards for Air Traffic

Control, Royal Aircraft Establishment Technical Report No. 64041

(Nov. 1964),

P. G. Reich, Analysis of Long-Range Air Traffic Systems, J. Inst, of

Nav. , Vol. 19, No. 1 (Jan. 1966), pp. 88-98.

P. G. Reich, Analysis of Long-Range Air Traffic Systems, J. Inst, of

Nav. , Vol. 19, No. 2 (Apr. 1966), pp. 169-193.

P. G. Reich, Analysis of Long-Range Air Traffic Systems, J. Inst, of

Nav., Vol. 19, No. 3 (July 1966), pp. 331-347.

P. G. Reich and R. G. Anderson, Specifying the Calibration of Static

Pressure Systems for the Safe Use of 1000 ft. Vertical Separation Standard

in North Atlantic Jet Traffic, Royal Aircraft Establishment Technical Report No. 66156 (May 1966).

Review of the General Concept of Separation Panel, Third Meeting, ICAO

RGCSP-WP/63, 1975.

A. P. Smith, An Assessment of Separation Methodologies Applicable to

Future Oceanic ATC Systems, MITRE Technical Report MTR-6767, MITRE Corp.,

McLean, Va. 22101 (Feb. 1975).

Survey of Trailing Cone Test Data Produced By lATA Member Airlines1965 to 1970, presented at ICAO Review of the General Concept of Separation

Panel Working Group 'C', Eleventh Meeting, Paris (May 1975).

Warren Taylor, A Probability Model of the Aircraft Separation Problem,

Bureau of Research and Development, FAA (Apr. 11, 1960).

K. H. Treweek, An Approach to the Problem of Estimating Safe Separation

Standards for Air Traffic, J. Inst, of Nav. , Vol. 18, No. 3 (July 1965),

pp. 285-296.

Vertical Separation, ICAO RGCSP CWP-46, 1974.

F. A. White and D. E. Lloyd, Components of Height-Keeping Error, ICAO

RGCSP CWP/104, 1975.

F. A. White and D. E. Lloyd, Allowable Height Deviations for 300 Metres

Vertical Separation, ICAO RGCSP CWP/84, 1975.
APPENDIX A.

COMPARISONS OF TAIL LENGTHS OF DISTRIBUTIONS

This appendix provides a formal justification of the observation, made

in Section 3.4 on the basis of Monte Carlo simulations, that the convolution

of (zero-mean) normal and rectangular distributions cannot yield a distribution with longer-than-normal tails. In fact, a much more general result

is shown to obtain: namely, the convolution of a normal distribution with a continuous distribution defined over a finite range cannot have longer-thannormal tails.

It is assumed that the random variables X,Y,Z,... under consideration

have distributions with mean 0 and finite variance. For such random

variables, the following definitions for judging relative tail lengths seem quite reasonable.

DEFINITION. Suppose X and Y have the same mean and same variance. Then the

random variable X is longer tailed than random variable Y if there exists

t >0 such that

o Prob { |x| > t} > Prob { |y| > t}

for all t > t . o

DEFINITION. Given a random variable X, let Y be the normal random variable

having the same variance as X. We say X has shorter tails than normal

if Y has a longer tail than X.

We now show that if X is normal and Y is a continuous random

variable defined over a finite range (both variables being independent) , then

the variable Z = X + Y has shorter tails than normal. In other words, it is

impossible to obtain a distribution with longer-than-normal tails by convoluting

a continuous distribution having a finite range with a normal distribution. To

demonstrate this, suppose that X and Y are independent random variables with

mean 0. Let g(t) be the probability density fun-^tion for Y, where g(t) = 0

outside [-B,A], and the standard deviation of Y as a. Without loss of

generality, it may be assumed that X follows a normal distribution with unit

standard deviation. By the convolution formula given in Section 3.4, the

probability density function of Z = X + Y is

A

(A.l) f(x) =_/k exp{-(x-t)^/2} g(t) dt,

-1/2

where the abbreviation k = (2tt) is used. Since Y has standard deviation

1, it follows from the RSS formula that Z has standard deviation

2 1/2

(A. 2) a = (1 + a ) 0

The tails of f (x) are to be compared with those of the normal distribution

having the same standard deviation a^, namely

-42-
(A. 3) f (x) = (k/a ) exp{-x2/2a2} . O 0 0

It will be shown below that

(A. 4) f(x)/f^(x) ^ 0 as X 0°

, and this implies that f^Cx) has longer tails than f(x).

For the proof of (A. 4), first observe that

-(x-t)2/2 = -x2/2 + xt - t2/2 <_ -x2/2 + xt ,

so it follows from (A.l) that

A

(A. 5) f(x) = k { exp{-(x-t)2/2} g(t> dt

f

< k exp{-x2/2} -L exp{xt} g(t) dt . — D

Since g(t) is continuous over the closed interval [-B,A], it attains a finite

fnaximi

(A. 5)

maximum on that interval: that is, g(t) _< g^ for all -Bj<t_<A. Thus, using

f(x) < kg exp{-x2/2} 4 exp{xt} dt

-B

= kg^ exp{-x^/2} (exp{Ax} - exp{-Bx})/x .

From this and (A. 3) , we have for x > 0

(A. 6) f(x)/f (x) < a g exp{-ax2/2} (exp{Ax})/x , o o o where a = 1-1/a^ > 0 because of (A. 2). Since the right-hand side of (A. 6)

goes to 0 as X 5^ the truth of (A. 4) is readily established.

In particular, the above result shows that the convolution of a normal

and a rectangular distribution yields a distribution having shorter tails than

normal. Moreover, the result implies that the repeated convolution of a normal with any number of rectangular distributions is again shorter-tailed

than normal. Actually, the assumption of continuity is not crucial for the

result to hold; rather, it is only necessary that the probability density

function (which encloses unit area) be bounded. For example, it can be shown

that the convolution of a normal distribution with a limit (two-point discrete)

distribution — it does not have (and is not well-approximated by distributions

having) a bounded density — yields a distribution that has longer (not

shorter) taiils than normal. However, since the convolution of a rectangular

and a limit distribution does have a bounded probability density function, the

convolution of a number of normal, rectangular and limit distributions cannot

have longer-than-normal tails

.

-43-
Mbil 14A (Rt V. I. is)

U.S. DEPT. OF COMM.

mm lOHRAPHir data

SHEET

1. PIIMLK ATION OR RIvPORT NO.

NBSIR 76-1067

2. Gov't Accession 3. Recipient's Accession Nu.

4. 11 1 1 I- .XNO .siiH i rn.i: Mathematical Approaches to Evaluating Aircraft Vertical

Separation Standards

5. Publication Date

6. Performing Organization Code

7. AUTHOR(S) Judith F. Gilsinn & Douglas R. Shier

8. Performing Organ. Report No.

9. PERFORMING ORGANIZATION NAME AND ADDRESS

NATIONAL BUREAU OF STANDARDS

DEPARTMENT OF COMMERCE

WASHINGTON, D.C. 20234

10. Project/Task/Work Dnit No. DOT-FA76WAI-594

11. C-ontract /Cirant No.

12. Sponsoring Organization Name and Complete Address (Street, City, State, ZIP)

Aeronautical Satellite Division

Office of Systems Engineering Management

Federal Aviation Administration

Washington, D.C. 20.591

13. Type of Report & Period Covered

FINAL OCT 7 5 - MAY 76

14. Sponsoring A^incy Code

15. SUPPLEMENTARY NOTES

16. ABSTRACT (A 200-word or less (actual summary of most significant information. If document includes a significant

bibliography or literature survey, mention it here.)

Above Flight Level 290, current regulations require aircraft to be

separated vertically by at least 2000 feet. Because of increased traffic

desiring to fly at these altitudes, the possibility of reducing the required

separation (while maintaining acceptable safety levels) is under study.

This report details many of the components of vertical position error and

classifies them into three major categories: static pressure system error,

altimeter instrument error, and pilot response error. Two models for use

in evaluating separation standards, the root sum of squares (RSS) approach

and the Reich collision risk model, are described together with their re- spective advantages and disadvantages. A final section includes recommendations for a carefully designed data collection effort and discusses potentially important considerations for such a design.

17. KEY WORDS (six to twelve entries; alphabetical order; capitalize only the first letter of the first key word unless a proper name; separated by semicolons)

Aircraft; air transportation; air traffic control models; altimetry;

altitude; aviation; collision risk; error analysis; mathematical models; safety;

sep/^ratinn; vertical separati nn . 18. AVAILABILITY [x] Unlimited

For Official Distribution. Do Not Release to NTIS

Order From Sup. of Doc, U.S. Government Printing Office Washington, D.C. 20402, SD Cat. No. C13

[ yl Order F rom National Technical Information Service (NTIS)

Springfield, Virginia 22151 USCOMW-DC 29042-P7i

19. SECURITY CLASS

(THIS REPORT)

UNCL ASSIFIED

21. NO. OF PAGES

49

20. SECURITY CLASS

(THIS PAGE)

UNCLASSIFIED

22. Price

$4.00