# Invulnerability Analysis and Optimization Strategy of Sector Network Using Cascading Failure Model

Authors: Haijun Liang; Jingyu Lu; Nan Chen
Journal: Complexity
 (2022)

---

## Abstract

Resolving the challenge of flight delays caused by air traffic congestion renders it necessary to explore the mode of congestion propagation. By applying complex network theory, this article establishes a complex network structure where airspace sectors act as nodes, and the edges represent traffic flow relationships between sectors. In addition, a cascading failure model is proposed to analyze the airspace sector network’s invulnerability. The critical threshold and the sector abnormality rate are determined according to the cascading failure measurement indexes. Based on the remaining capacity of sector nodes, two optimization strategies are proposed: adjacent load redistribution strategy and local load redistribution strategy. The simulation results demonstrate that the local load redistribution strategy greatly improves the airspace sector network’s invulnerability to cascading failure.


---

## Body

## 1. Introduction

An airspace sector is a basic unit of air traffic control, and an airspace sector network is a complex infrastructure system that supports air traffic activities and assures their safe execution and order. Before the pandemic in 2019, China’s civil aviation industry has developed rapidly. Since 2015, the air traffic control bureau has begun to optimize the national airspace as a whole. In 2019, a total of 52 sectors in North China Airspace were adjusted. The flight procedures of 18 civil aviation transport airports in North China have been changed, especially with the operation of Beijing Daxing International Airport. 119 civil routes and 237 new waypoints were planned, which greatly increased the complexity of sector network. At the same time, with the gradual improvement of the epidemic situation, the rapid development of the Chinese air transport industry and the growing demand for air transport services lay increasing stress on the safe operation of the airspace sector network, thus setting higher standards for network resilience and operational efficiency in emergencies. In addition, adverse weather conditions and frequent military activities in Chinese airspace aggravate traffic congestion and render airspace sector operation less efficient. Inefficient operations or low capacity of an airspace sector may cause congestion in a large airspace area, causing significant flight delays. Therefore, the safety and operational efficiency of the airspace sector have attracted a lot of attention from researchers in various domains [1–3].The complex network theory has a mature methodology that enables the systematic and scientific study of airspace sector networks and provides an effective way to reduce the impacts of sector failure [4, 5]. Invulnerability analysis is one of the primary applications of complex network theory. It stems from the pioneering work of Albert et al. [6], who evaluated networks’ error tolerance and attack vulnerability. In the early stages, the research on complex network invulnerability was primarily conducted under static conditions, without considering the effect of failed nodes (edges) on other nodes (edges). However, upon attack, one must not only consider the changes in the performance due to failed nodes but also pay attention to the effect of changes in the fail nodes’ load transfer on the actual network. When a node is under attack, the state of other nodes in the network also changes as the load of the failed node is transferred. The load transfer may cause more node failures, further transferring the load and causing additional failures [7]. This process is called the cascading failure of complex networks. It is a dynamic process, more complicated than static attacks [8].Theoretical modeling and simulation analysis are important strategies to study cascading failure. Examples of cascading failure models include load-capacity models, coupled image grid models, binary influence models, optimal power algorithm (OPA) models, sandpile models, and CASCADE models [9]. Motter and Lai first established the linear relationship between initial load and capacity, deriving the cascading failure model called the ML model. This model applies betweenness to define the load and uses the relative value of the network’s largest connected component to measure the network stability [10]. Since removing nodes from the network is not practical in real-world applications, Crucitti et al. proposed a dynamic model based on the edge transmission efficiency, the Crucitti-Latora-Marchiori (CLM) model. CLM considers the dynamic behaviors of both nodes and edges in the network. Instead of deleting the edges between nodes directly when the nodes are overloaded, CLM adopts a strategy to reduce the transmission efficiency of the edges [11]. Among the cascading failure models, the ML model is most widely used in real-world applications, such as grid systems [12], transportation systems [13], and information communication systems [14].The cascading failure model is also suitable for studies of complex networks in aviation. In 2011, Eusgeld et al. presented evaluation methods for different scenarios of transportation networks. In their work, the author accounted for the interactions between systems while assessing the network vulnerability and reliability after different failures and attacks [15]. In 2018, Clark et al. defined the robustness of the U.S. national airspace system airport network (NASAN) as loss of critical functions owing to perturbations. They developed and demonstrated an approach to characterize network robustness quantitatively and selected the most efficient and effective posthazard recovery strategies [16]. Recently, Cumelles et al. presented an algorithm to evaluate the effectiveness of several rules for selecting alternate departure and arrival airports to affected flights to reduce the impact of the cascading failure. The algorithm was applied to the Oceanic Airport Network to assess the impact of several incidents, demonstrating that rules for selecting arrival airports have a significant impact on reducing the effect of incidents affecting major airports [17]. In summary, the complex network theory and cascading failure theory have been widely adopted to derive effective approaches for addressing various problems in aviation networks. However, few studies systematically analyze the airspace sector network’s invulnerability to cascading failure from the perspective of air traffic control to formulate air traffic congestion optimization strategies.This study builds on the traditional load-capacity model to develop an improved load-capacity model for analyzing and optimizing airspace sector networks’ invulnerability to cascading failure. A cascading failure process model is built for the airspace sector network, and an index is introduced to quantify the airspace sector network invulnerability to cascading failure. Finally, from the standpoint of air traffic control operations, airspace sector strategies of redistributing the adjacent and local loads are proposed and validated via simulations.The paper is organized as follows. Section2 briefly introduces the cascading failure invulnerability and presents the developed cascading failure model with measurement indicators. The optimization strategy for cascading failure invulnerability of airspace sector network is presented in Section 3. Then, the airspace sector network in Northern China is studied as an example to verify the feasibility of the proposed strategy. Finally, Section 5 concludes the paper by summarizing the contributions and discussing the directions for future work.


## 2. Cascading Failure Invulnerability of Airspace Sector Networks

### 2.1. Construction of Airspace Sector Network

As the smallest air traffic control units, sectors are the basic units to ensure aircraft safety, smoothness, and order. Meanwhile, they are the basic spatial units managed by air traffic controllers. The sectors are closely connected, not only spatially but also in aeronautical information sharing. The connections and interactions between sectors give rise to an airspace sector network comprising multiple cooperative sectors. From the perspective of air traffic control, this work constructs an airspace sector network by regarding control sectors as the network notes and the edges as traffic flows between sectors. The adjacency matrixaijN×N represents the spatial sector network containing N sectors. If there is a direct flight connection between sector i and sector j, the adjacency matrix elements are set as aij=aji=1. Otherwise, the elements are aij=aji=0.An example of airspace sector structure is shown in Figure1. The airspace is divided into five control sectors. Sectors B, C, D, and E comprise airspace below 20700 feet, while the airspace above 20700 feet is governed by the high-altitude control sector A. Flights connect all sectors except sectors A and B (i.e., there is no direct flight connection between sector A and sector B). Following the aforementioned method, a network of airspace sectors can be built as in Figure 2, and its adjacency matrix is(1)0011100111110111110111110.Figure 1
Diagram of airspace sector structure.Figure 2
Airspace sector network.Severe weather conditions, military activities, equipment failures, and other unexpected circumstances may cause network nodes to fail, and the airspace sector network may consequently enter an abnormal state. Flights in or flying to the failed sector must return, alternate, or detour and be reallocated to one of the surrounding sectors. However, congestion occurs when the traffic volume is greater than the surrounding sectors’ capacity, triggering new failures. This phenomenon causes the redistribution of the flight traffic in the entire airspace sector network, leading to congestion in multiple sectors and even the sector network’s failure. This process is called the cascading failure of the airspace sector network [18].The airspace sector network’s invulnerability to cascading failure is the ability of the sector network to reduce congestion by dredging flight traffic after a cascading failure so that the network can still maintain an acceptable level of air traffic control operations.


### 2.2. Load and Capacity of Airspace Sector Network Nodes

This paper uses an improved load-capacity model (the ML model) [19] to study the cascading failure of airspace sector networks. Unlike the definition of sector capacity and controller workload in the traditional sense of civil aviation, a sector node’s load and capacity are related to the actual workload of the single sector’s controller and the flight flow that the sector can accommodate. Furthermore, the two aspects are combined to determine the load and capacity of the airspace sector network node and its influence on the overall network.Different statistical indicators are used to describe the complex sector network. Furthermore, they are combined with the actual operation of air traffic control to give them practical value. The indicators’ definitions and meanings are as follows:(i)
Degree, denoted byki, refers to the total number of edges connected to node i and reflects the node’s importance to the network to a certain extent. Within this work, degree ki is the number of sectors that are geographically adjacent to sector i and have a direct flight connection. Thus, the degree reflects the number of sectors that have a handover agreement with sector i.(ii)
StrengthSi is calculated as(2)Si=∑j∈ViWij,whereVi is the set of sectors adjacent to sector i, and Wij is the number of flights from sector i to sector j. The controllers provide air control services for flights in the sector. Thus, Si reflects the busyness of the sector and is the most important indicator when studying air traffic congestion.(iii)
Load of the sector nodei is denoted by Li and calculated as(3)Li=kiSi,whereki is the degree of sector node i, and Si is the strength of sector i. Furthermore, l denotes the average distance between all sectors. The correlation analysis demonstrates that the sector strength is mostly affected by the regional economic level (passenger demand) and route layout, and it is unrelated to do the degree value. Therefore, the two can be used together as parameters affecting the sector network nodes’ load.(iv)
Capacity of the sector nodei is calculated as(4)Ci=Li+μLiθ,whereμ is the extra margin parameter greater than 0, and θ is the extra margin differentiation parameter between 0 and 1. The capacity of a network node is the maximum load that the node can handle. The sector’s capacity is the number of flights that the controller can handle when the work reaches a certain higher load state, and the actual flow is below the capacity under normal operation. As seen in (4), the load of the sector node in the normal state and the extra margin determine the sector node’s capacity C, which represents the controller’s ability to handle the load under normal conditions.In the traditional ML model, the capacity is proportional to the load. Nevertheless, the sectors’ actual capacity is severely restricted by various factors such as airspace capacity, navigation equipment, and controller workload. In a sector node with a small load, the airspace resources and the controller’s work capacity are often not fully utilized, and usually have a large extra margin. In contrast, when a sector node has a large load, the airspace utilization rate and the controller’s work load are very large. The extra margin of these sector nodes is small, which is close to the capacity. The improved ML model adjusts the extra margin differentiation parametersθ, enabling the differentiation of the different load sector nodes’ extra margin. When θ is smaller, the extra margin of the heavily loaded sector node is smaller, and its load is closer to the capacity.


### 2.3. Modeling the Cascading Failure Process of a Spatial Sector Network

In their research on network cascading failure models, scholars mostly use “normal” and “failure” to describe the status of network nodes [20]. If the node is in the “failure” state, the node is directly removed from the network, and the network load is redistributed. After the load redistribution, the node whose capacity is lower than the load also obtains the “failure” status. As these nodes are removed, a new round of cascading failure is triggered. This kind of network model that continuously changes its structure along with the cascading failure process is widely used in power [21] and information network [22] research.However, in airspace sector networks, it is extremely rare that the sector completely “fails” due to excessive flight traffic. Usually, it only leads to air traffic congestion in the control sector, increasing the controller’s workload, lowering the service capacity, and decreasing the number of acceptable flights. When the sector is in the “normal” state, its load is below the capacity, and its control function can be fully exercised. In contrast, the sector node in the “failure” state is the source of cascading failure. The capacity of such as sector node drops to zero, and the original load is redistributed to the surrounding sectors. When a sector network node’s load is greater than or equal to its capacity, the sector is reserved in the network, and the sector enters the third state called the “congestion” state. The sectors in this state cannot continue to receive the redistributed load from other sector nodes and only allows the internal load to flow out to other sectors. The outflow process continues until the sector’s load is equal to the capacity, and the load is maintained at a state equal to capacity during the cascading failure. The “failure” and “congested” states can be collectively referred to as “abnormal” states.Within this work, the following assumptions are made about the cascading failure of the airspace sector network:(1)
During the connection failure period, the sectors’ capacity is fixed;(2)
During the cascading failure, once a sector enters the “abnormal” state, it no longer changes its state;(3)
The airspace sector network utilizes an equal load redistribution method in which the load exceeding the sector node’s capacity is evenly distributed to the adjacent sector nodes.Based on the presented analysis and assumptions, the cascading failure process of an airspace sector network is divided into the following four stages.(1)
Normal stage: each sector node’s load is lower than the capacity, and all nodes are in the “normal” state.(2)
Initial failure stage: when an emergency occurs, and a sector is temporarily closed, the corresponding sector network node enters the “failure” state. This sector’s traffic and its functions in the sector network are distributed to surrounding sectors (i.e., the sector node’s load is distributed to adjacent sector nodes).(3)
Failure propagation stage: due to the newly added load, several surrounding sector nodes’ load may become greater than or equal to their inherent capacity, changing these nodes’ states from “normal” to “congestion.” As the node enters the “congestion” state, it distributes the load exceeding its capacity to the adjacent sector nodes in the “normal” state. Then, a new round of failure propagation commences.(4)
Failure ending stage: spreading the cascading failure over the airspace sector network is terminated when one of the following situations is encountered: (a) a balanced state is reached. The load of all sector nodes is below their capacity, and no further load redistribution processes occur. (b) The network is judged to be in a state of collapse. A certain sector node’s load exceeds its capacity, and all adjacent sectors are in an “abnormal” state. Thus, the load exceeding the node’s capacity cannot be redistributed to other sectors.Based on the assumptions and analysis of the cascading failure process, the airspace sector network’s cascading failure process is constructed as follows:Step 1.
In the normal stage, each sector node’s load and capacity satisfyLi<Ci.Step 2.
A certain sector enters the “failure” state.Step 3.
According to the equal load redistribution method, the load of the node in the failed sector is evenly distributed to all adjacent sectors, reducing the load and capacity of the node in the failed sector to zero.Step 4.
In the failure propagation stage, the sector nodes that have changed from “normal” to “congested” are detected, and the load exceeding their capacity is evenly redistributed to the adjacent sector nodes in the “normal” state. These loads of these sector nodes increases as:(5)ΔL=Li−CiNi,where Ni is the number of adjacent sectors in the “normal” state.Step 5.
The relationship between the load and capacity of all sector nodes in the “normal” state is determined. If there is a sector node for whichLi≥Ci and Ni>0, the sector’s state changes from “normal” to “congestion,” and the process returns to Step 4. Otherwise, Step 6 is executed.Step 6.
In the failure ending stage, if there are sector nodes for whichL>C and N=0, the airspace sector network is in a state of collapse. In contrast, if L≤C for all sector nodes, the airspace sector network reached a balanced state.


### 2.4. Cascading Failure Invulnerability Index

According to the established relationship between the sector node’s load and capacity (equation (4)), μ reflects the sector node’s ability to handle the load when θ is constant. The larger the μ, the smaller the cascading failure influence. When μ is sufficiently large, the sector node’s capacity is much larger than the load, and any sector failure does not cause a cascading failure. In contrast, if μ is small, the extra margin of all sector nodes is very small, and a failure of a sector node with a small load can cause cascading failure or even the entire network collapse. Adjusting parameter μ, one can obtain the critical threshold μτ. Namely, when μ≥μτ, the failure of the sector node with the largest load does not cause the collapse of the entire network. However, when μ<μτ and the sector node with the largest load fails, the entire network collapses. Thus, critical threshold μτ evaluates the airspace sector network’s invulnerability to the cascading failure. Under the premise of preventing the network collapse, when μτ is smaller, the requirement for the additional margin of the sector node capacity is lower. When the sector node’s capacity is small, the equipment, personnel, and economic costs invested in the sector are low, and the network cascading failure is more resilient.The critical threshold can be used to evaluate the network’s invulnerability to cascading failure only from the final state of the system. For actual control work, airspace sectors usually have greater redundancy to deal with emergencies and ensure safety. Therefore, the situation where the overall control system collapses is very rare. When the cascading failure does not cause the network collapse (i.e., whenμ>μτ), another measurement index—the sector abnormality rate (SAR)—is used to evaluate the invulnerability. SAR is the ratio of the number of sectors in an “abnormal” state to the total number of sectors in the normal phase of the airspace after a cascading failure of the airspace sector network. Thus,(6)SAR=N∗N,where N∗ denotes the number of “abnormal” sectors and N is the total number of sectors. When the airspace sector network system is in a balanced state, a smaller SAR implies that more sectors are in a “normal” state, available to be used by the controller when clearing congestion. Consequently, the network operation is smoother and the cascading failure resilience is higher.


## 2.1. Construction of Airspace Sector Network

As the smallest air traffic control units, sectors are the basic units to ensure aircraft safety, smoothness, and order. Meanwhile, they are the basic spatial units managed by air traffic controllers. The sectors are closely connected, not only spatially but also in aeronautical information sharing. The connections and interactions between sectors give rise to an airspace sector network comprising multiple cooperative sectors. From the perspective of air traffic control, this work constructs an airspace sector network by regarding control sectors as the network notes and the edges as traffic flows between sectors. The adjacency matrixaijN×N represents the spatial sector network containing N sectors. If there is a direct flight connection between sector i and sector j, the adjacency matrix elements are set as aij=aji=1. Otherwise, the elements are aij=aji=0.An example of airspace sector structure is shown in Figure1. The airspace is divided into five control sectors. Sectors B, C, D, and E comprise airspace below 20700 feet, while the airspace above 20700 feet is governed by the high-altitude control sector A. Flights connect all sectors except sectors A and B (i.e., there is no direct flight connection between sector A and sector B). Following the aforementioned method, a network of airspace sectors can be built as in Figure 2, and its adjacency matrix is(1)0011100111110111110111110.Figure 1
Diagram of airspace sector structure.Figure 2
Airspace sector network.Severe weather conditions, military activities, equipment failures, and other unexpected circumstances may cause network nodes to fail, and the airspace sector network may consequently enter an abnormal state. Flights in or flying to the failed sector must return, alternate, or detour and be reallocated to one of the surrounding sectors. However, congestion occurs when the traffic volume is greater than the surrounding sectors’ capacity, triggering new failures. This phenomenon causes the redistribution of the flight traffic in the entire airspace sector network, leading to congestion in multiple sectors and even the sector network’s failure. This process is called the cascading failure of the airspace sector network [18].The airspace sector network’s invulnerability to cascading failure is the ability of the sector network to reduce congestion by dredging flight traffic after a cascading failure so that the network can still maintain an acceptable level of air traffic control operations.


## 2.2. Load and Capacity of Airspace Sector Network Nodes

This paper uses an improved load-capacity model (the ML model) [19] to study the cascading failure of airspace sector networks. Unlike the definition of sector capacity and controller workload in the traditional sense of civil aviation, a sector node’s load and capacity are related to the actual workload of the single sector’s controller and the flight flow that the sector can accommodate. Furthermore, the two aspects are combined to determine the load and capacity of the airspace sector network node and its influence on the overall network.Different statistical indicators are used to describe the complex sector network. Furthermore, they are combined with the actual operation of air traffic control to give them practical value. The indicators’ definitions and meanings are as follows:(i)
Degree, denoted byki, refers to the total number of edges connected to node i and reflects the node’s importance to the network to a certain extent. Within this work, degree ki is the number of sectors that are geographically adjacent to sector i and have a direct flight connection. Thus, the degree reflects the number of sectors that have a handover agreement with sector i.(ii)
StrengthSi is calculated as(2)Si=∑j∈ViWij,whereVi is the set of sectors adjacent to sector i, and Wij is the number of flights from sector i to sector j. The controllers provide air control services for flights in the sector. Thus, Si reflects the busyness of the sector and is the most important indicator when studying air traffic congestion.(iii)
Load of the sector nodei is denoted by Li and calculated as(3)Li=kiSi,whereki is the degree of sector node i, and Si is the strength of sector i. Furthermore, l denotes the average distance between all sectors. The correlation analysis demonstrates that the sector strength is mostly affected by the regional economic level (passenger demand) and route layout, and it is unrelated to do the degree value. Therefore, the two can be used together as parameters affecting the sector network nodes’ load.(iv)
Capacity of the sector nodei is calculated as(4)Ci=Li+μLiθ,whereμ is the extra margin parameter greater than 0, and θ is the extra margin differentiation parameter between 0 and 1. The capacity of a network node is the maximum load that the node can handle. The sector’s capacity is the number of flights that the controller can handle when the work reaches a certain higher load state, and the actual flow is below the capacity under normal operation. As seen in (4), the load of the sector node in the normal state and the extra margin determine the sector node’s capacity C, which represents the controller’s ability to handle the load under normal conditions.In the traditional ML model, the capacity is proportional to the load. Nevertheless, the sectors’ actual capacity is severely restricted by various factors such as airspace capacity, navigation equipment, and controller workload. In a sector node with a small load, the airspace resources and the controller’s work capacity are often not fully utilized, and usually have a large extra margin. In contrast, when a sector node has a large load, the airspace utilization rate and the controller’s work load are very large. The extra margin of these sector nodes is small, which is close to the capacity. The improved ML model adjusts the extra margin differentiation parametersθ, enabling the differentiation of the different load sector nodes’ extra margin. When θ is smaller, the extra margin of the heavily loaded sector node is smaller, and its load is closer to the capacity.


## 2.3. Modeling the Cascading Failure Process of a Spatial Sector Network

In their research on network cascading failure models, scholars mostly use “normal” and “failure” to describe the status of network nodes [20]. If the node is in the “failure” state, the node is directly removed from the network, and the network load is redistributed. After the load redistribution, the node whose capacity is lower than the load also obtains the “failure” status. As these nodes are removed, a new round of cascading failure is triggered. This kind of network model that continuously changes its structure along with the cascading failure process is widely used in power [21] and information network [22] research.However, in airspace sector networks, it is extremely rare that the sector completely “fails” due to excessive flight traffic. Usually, it only leads to air traffic congestion in the control sector, increasing the controller’s workload, lowering the service capacity, and decreasing the number of acceptable flights. When the sector is in the “normal” state, its load is below the capacity, and its control function can be fully exercised. In contrast, the sector node in the “failure” state is the source of cascading failure. The capacity of such as sector node drops to zero, and the original load is redistributed to the surrounding sectors. When a sector network node’s load is greater than or equal to its capacity, the sector is reserved in the network, and the sector enters the third state called the “congestion” state. The sectors in this state cannot continue to receive the redistributed load from other sector nodes and only allows the internal load to flow out to other sectors. The outflow process continues until the sector’s load is equal to the capacity, and the load is maintained at a state equal to capacity during the cascading failure. The “failure” and “congested” states can be collectively referred to as “abnormal” states.Within this work, the following assumptions are made about the cascading failure of the airspace sector network:(1)
During the connection failure period, the sectors’ capacity is fixed;(2)
During the cascading failure, once a sector enters the “abnormal” state, it no longer changes its state;(3)
The airspace sector network utilizes an equal load redistribution method in which the load exceeding the sector node’s capacity is evenly distributed to the adjacent sector nodes.Based on the presented analysis and assumptions, the cascading failure process of an airspace sector network is divided into the following four stages.(1)
Normal stage: each sector node’s load is lower than the capacity, and all nodes are in the “normal” state.(2)
Initial failure stage: when an emergency occurs, and a sector is temporarily closed, the corresponding sector network node enters the “failure” state. This sector’s traffic and its functions in the sector network are distributed to surrounding sectors (i.e., the sector node’s load is distributed to adjacent sector nodes).(3)
Failure propagation stage: due to the newly added load, several surrounding sector nodes’ load may become greater than or equal to their inherent capacity, changing these nodes’ states from “normal” to “congestion.” As the node enters the “congestion” state, it distributes the load exceeding its capacity to the adjacent sector nodes in the “normal” state. Then, a new round of failure propagation commences.(4)
Failure ending stage: spreading the cascading failure over the airspace sector network is terminated when one of the following situations is encountered: (a) a balanced state is reached. The load of all sector nodes is below their capacity, and no further load redistribution processes occur. (b) The network is judged to be in a state of collapse. A certain sector node’s load exceeds its capacity, and all adjacent sectors are in an “abnormal” state. Thus, the load exceeding the node’s capacity cannot be redistributed to other sectors.Based on the assumptions and analysis of the cascading failure process, the airspace sector network’s cascading failure process is constructed as follows:Step 1.
In the normal stage, each sector node’s load and capacity satisfyLi<Ci.Step 2.
A certain sector enters the “failure” state.Step 3.
According to the equal load redistribution method, the load of the node in the failed sector is evenly distributed to all adjacent sectors, reducing the load and capacity of the node in the failed sector to zero.Step 4.
In the failure propagation stage, the sector nodes that have changed from “normal” to “congested” are detected, and the load exceeding their capacity is evenly redistributed to the adjacent sector nodes in the “normal” state. These loads of these sector nodes increases as:(5)ΔL=Li−CiNi,where Ni is the number of adjacent sectors in the “normal” state.Step 5.
The relationship between the load and capacity of all sector nodes in the “normal” state is determined. If there is a sector node for whichLi≥Ci and Ni>0, the sector’s state changes from “normal” to “congestion,” and the process returns to Step 4. Otherwise, Step 6 is executed.Step 6.
In the failure ending stage, if there are sector nodes for whichL>C and N=0, the airspace sector network is in a state of collapse. In contrast, if L≤C for all sector nodes, the airspace sector network reached a balanced state.


## 2.4. Cascading Failure Invulnerability Index

According to the established relationship between the sector node’s load and capacity (equation (4)), μ reflects the sector node’s ability to handle the load when θ is constant. The larger the μ, the smaller the cascading failure influence. When μ is sufficiently large, the sector node’s capacity is much larger than the load, and any sector failure does not cause a cascading failure. In contrast, if μ is small, the extra margin of all sector nodes is very small, and a failure of a sector node with a small load can cause cascading failure or even the entire network collapse. Adjusting parameter μ, one can obtain the critical threshold μτ. Namely, when μ≥μτ, the failure of the sector node with the largest load does not cause the collapse of the entire network. However, when μ<μτ and the sector node with the largest load fails, the entire network collapses. Thus, critical threshold μτ evaluates the airspace sector network’s invulnerability to the cascading failure. Under the premise of preventing the network collapse, when μτ is smaller, the requirement for the additional margin of the sector node capacity is lower. When the sector node’s capacity is small, the equipment, personnel, and economic costs invested in the sector are low, and the network cascading failure is more resilient.The critical threshold can be used to evaluate the network’s invulnerability to cascading failure only from the final state of the system. For actual control work, airspace sectors usually have greater redundancy to deal with emergencies and ensure safety. Therefore, the situation where the overall control system collapses is very rare. When the cascading failure does not cause the network collapse (i.e., whenμ>μτ), another measurement index—the sector abnormality rate (SAR)—is used to evaluate the invulnerability. SAR is the ratio of the number of sectors in an “abnormal” state to the total number of sectors in the normal phase of the airspace after a cascading failure of the airspace sector network. Thus,(6)SAR=N∗N,where N∗ denotes the number of “abnormal” sectors and N is the total number of sectors. When the airspace sector network system is in a balanced state, a smaller SAR implies that more sectors are in a “normal” state, available to be used by the controller when clearing congestion. Consequently, the network operation is smoother and the cascading failure resilience is higher.


## 3. Optimization of the Cascading Failure Invulnerability

When a sector node fails, it is necessary to optimize the cascading failure process to reduce its destructiveness, reduce the probability of the network collapse, and minimize the number of congested sectors. In general, there are two main optimization methods for the network’s invulnerability to cascading failure:(1)
Change the network topology by adding or deleting edges (points). Increasing the number of edges homogenizes the network structure, whereas reducing the edges directs the transmission path [23].(2)
Optimize the load redistribution strategy. According to the network node information, the load is distributed in a specific proportion to fully utilize the resources [24].Due to the civil aviation transportation particularities, it is difficult to optimize the network’s invulnerability to cascading failure by changing the network topology. Specifically, airspace sector structure and air routes are difficult to change. Further, since pilots must follow the controller’s instructions to fly along the designated air routes, it is impossible to increase the edges (points) of the network. Simultaneously, the distance scale of civil aviation is vast. The time and economic cost of closing a sector or an air route are huge. Thus, due to the difficulty and cost of closing a sector or an air route, it is impossible to reduce the network’s edge (point) [25].This work employs an optimized load redistribution strategy to optimize the airspace sector network’s resilience to cascading failure. This optimization method is direct and rapid. Furthermore, it is convenient for the controller to make a response plan when a sector failure first occurs, thus promptly reducing the destructiveness caused by cascading failure.When an airspace sector is in the “failure” or “congestion” stage, a good controller should not redistribute the flight traffic evenly to adjacent sectors. Instead, the controller should be acquainted with the surrounding sectors’ situation and allocate the flights according to a certain proportion based on the relationship between the sectors’ flow and capacity. In this manner, one can make full use of airspace resources and reduce the probability of “congestion” in other sectors [26, 27].This work adopts an adjacent load redistribution strategy based on the remaining capacity and a local load redistribution strategy to optimize the airspace sector network.


### 3.1. The Adjacent Load Redistribution Strategy

The sector controller obtains the adjacent sectors’ flight traffic situation, thereby determining the difference between the adjacent sector nodes’ capacity and load, i.e., the remaining capacityRi=Ci−Li. The remaining capacity represents the sector node’s capacity to accept additional load. The load is distributed according to the proportion of the adjacent nodes’ remaining capacities, thus utilizing the adjacent sectors’ space resources and preventing the load concentration in a certain sector while other sectors remain relatively idle. The described procedure is named the adjacent load redistribution strategy based on the remaining capacity of the sector nodes [28, 29].The strategy steps are as follows:(a)
Normal stage of the airspace: all sector nodes’ load and capacity satisfyLi<Ci.(b)
Initial stage of the cascading failure: the capacity of the sector in the “failure” state drops to zero. According to the proportion of the adjacent sectors’ remaining capacity, the load (L) of the failed sector node is distributed to all adjacent sectors, and the adjacent sector node’s load increases as ΔLif=LfCi−Li/∑n∈AjCn−Ln, where Aj is the set of all sectors adjacent to the failed sector.(c)
Propagation stage of the cascading failure: the sector nodes that change the state from “normal” to “congestion” distribute the load exceeding their capacity to the adjacent sector nodes in the normal state. These sector nodes’ loads increase asΔLim=Cm−LmCi−Li/∑n∈Aj∗Cn−Ln, where Aj∗ is the set of “normal” sectors adjacent to the “congestion” sector.(d)
Ending stage of the cascading failure: if there are sector nodes for whichL>C and N=0, the airspace sector network collapses. Otherwise (i.e., if all sector nodes L≤C), the airspace sector network reaches a balanced state.The specific implementation flowchart of the adjacent load redistribution strategy based on the nodes’ remaining is shown in Figure3.Figure 3
The flowchart of the adjacent load redistribution strategy based on the nodes’ remaining capacity.


### 3.2. Prejudged Partial Load Redistribution Strategy Based on Remaining Capacity

The controllers cannot only assess the adjacent sectors’ situation but also learn the traffic and capacity status of multiple sectors in the surrounding airspace through the control center’s announcements. When congestion occurs in the surrounding sectors, the flights entering the congested area should follow the flow control strategies implemented in advance to alleviate the congestion [31].Unlike the adjacent load redistribution strategy, the distribution range of the prejudged partial load redistribution strategy based on the sector nodes’ remaining capacity is not limited to adjacent nodes. Rather, it comprises all normal sectors in the local airspace whose distance (i.e., the shortest path length) to the failed or congested sector is not greater thanl. Thus, l is the distribution radius. Note that air controllers can distribute the load to the sector nodes more than one sector away (i.e., l>1). The controller issues an announcement when the sector enters an “abnormal” state. The surrounding sectors’ controllers then command and control the flights about to enter the “abnormal” sector, directing them to enter “normal” sectors more than one sector away, bypass the congestion, or return to alternate landings. The prejudged partial load redistribution strategy greatly reduces the sector network’s cascading failures and improves the network invulnerability [32].However, due to the limitations in predictive ability, information flow delays, and bypass cost restrictions, the controller’s ability to allocate flights based on the adjacent sectors’ conditions is greater than that of allocating flights based on the nonadjacent sectors’ situation.Once sectorj enters the “abnormal” state, the load is distributed to all normal sector nodes within the distribution radius based on the distance-related distribution ratio denoted by Rij. The specific distribution ratio formula is as follows [33–35]:(7)Rij=Ci−Li/lijα∑g∈Nlj∗Cs−Ls/ligα,where lij represents the shortest distance between sectors, α is an adjustable parameter greater than 1, Ci−Li/lijα is the remaining capacity that node i can allocate, and ∑g∈Nlj∗Cs−Ls/ligα is the sum of the remaining capacities that can be allocated locally in the failed node’s surroundings. Now, ΔLij is the load distributed by node i within the failed node’s distribution radius:(8)ΔLij=Lj−CjCi−Li/lijα∑g∈Nlj∗Cs−Ls/ligα.The strategy steps are as follows:(a)
Normal stage of the airspace: all sector nodes satisfyLi<Ci.(b)
Initial stage of the cascading failure: the capacity of the sector node in the failure state equals zero. According to the remaining capacities of the sectors within the distribution radiusl, the failed sector node’s load (L) is distributed, and the receiving nodes’ load increases ΔLij.(c)
Propagation stage of the cascading failure: the sector nodes that change from “normal” to congested state distribute the load exceeding its capacity to the normal sector nodes within the surrounding distribution radiusl. These nodes’ loads increase as ΔLij=Lj−CjCi−Li/lijα/∑g∈Nlj∗Cs−Ls/ligα.(d)
Ending stage of the cascading failure: ifL>C and N=0 for a sector node, the airspace sector network collapses. If all sector nodes meet the L≤C requirement, the airspace sector network reaches a balanced state [36].The specific implementation flowchart of the prejudged partial load redistribution strategy based on the nodes’ remaining capacity is shown in Figure4.Figure 4
The flowchart of the prejudged partial load redistribution strategy based on the nodes’ remaining capacity.


## 3.1. The Adjacent Load Redistribution Strategy

The sector controller obtains the adjacent sectors’ flight traffic situation, thereby determining the difference between the adjacent sector nodes’ capacity and load, i.e., the remaining capacityRi=Ci−Li. The remaining capacity represents the sector node’s capacity to accept additional load. The load is distributed according to the proportion of the adjacent nodes’ remaining capacities, thus utilizing the adjacent sectors’ space resources and preventing the load concentration in a certain sector while other sectors remain relatively idle. The described procedure is named the adjacent load redistribution strategy based on the remaining capacity of the sector nodes [28, 29].The strategy steps are as follows:(a)
Normal stage of the airspace: all sector nodes’ load and capacity satisfyLi<Ci.(b)
Initial stage of the cascading failure: the capacity of the sector in the “failure” state drops to zero. According to the proportion of the adjacent sectors’ remaining capacity, the load (L) of the failed sector node is distributed to all adjacent sectors, and the adjacent sector node’s load increases as ΔLif=LfCi−Li/∑n∈AjCn−Ln, where Aj is the set of all sectors adjacent to the failed sector.(c)
Propagation stage of the cascading failure: the sector nodes that change the state from “normal” to “congestion” distribute the load exceeding their capacity to the adjacent sector nodes in the normal state. These sector nodes’ loads increase asΔLim=Cm−LmCi−Li/∑n∈Aj∗Cn−Ln, where Aj∗ is the set of “normal” sectors adjacent to the “congestion” sector.(d)
Ending stage of the cascading failure: if there are sector nodes for whichL>C and N=0, the airspace sector network collapses. Otherwise (i.e., if all sector nodes L≤C), the airspace sector network reaches a balanced state.The specific implementation flowchart of the adjacent load redistribution strategy based on the nodes’ remaining is shown in Figure3.Figure 3
The flowchart of the adjacent load redistribution strategy based on the nodes’ remaining capacity.


## 3.2. Prejudged Partial Load Redistribution Strategy Based on Remaining Capacity

The controllers cannot only assess the adjacent sectors’ situation but also learn the traffic and capacity status of multiple sectors in the surrounding airspace through the control center’s announcements. When congestion occurs in the surrounding sectors, the flights entering the congested area should follow the flow control strategies implemented in advance to alleviate the congestion [31].Unlike the adjacent load redistribution strategy, the distribution range of the prejudged partial load redistribution strategy based on the sector nodes’ remaining capacity is not limited to adjacent nodes. Rather, it comprises all normal sectors in the local airspace whose distance (i.e., the shortest path length) to the failed or congested sector is not greater thanl. Thus, l is the distribution radius. Note that air controllers can distribute the load to the sector nodes more than one sector away (i.e., l>1). The controller issues an announcement when the sector enters an “abnormal” state. The surrounding sectors’ controllers then command and control the flights about to enter the “abnormal” sector, directing them to enter “normal” sectors more than one sector away, bypass the congestion, or return to alternate landings. The prejudged partial load redistribution strategy greatly reduces the sector network’s cascading failures and improves the network invulnerability [32].However, due to the limitations in predictive ability, information flow delays, and bypass cost restrictions, the controller’s ability to allocate flights based on the adjacent sectors’ conditions is greater than that of allocating flights based on the nonadjacent sectors’ situation.Once sectorj enters the “abnormal” state, the load is distributed to all normal sector nodes within the distribution radius based on the distance-related distribution ratio denoted by Rij. The specific distribution ratio formula is as follows [33–35]:(7)Rij=Ci−Li/lijα∑g∈Nlj∗Cs−Ls/ligα,where lij represents the shortest distance between sectors, α is an adjustable parameter greater than 1, Ci−Li/lijα is the remaining capacity that node i can allocate, and ∑g∈Nlj∗Cs−Ls/ligα is the sum of the remaining capacities that can be allocated locally in the failed node’s surroundings. Now, ΔLij is the load distributed by node i within the failed node’s distribution radius:(8)ΔLij=Lj−CjCi−Li/lijα∑g∈Nlj∗Cs−Ls/ligα.The strategy steps are as follows:(a)
Normal stage of the airspace: all sector nodes satisfyLi<Ci.(b)
Initial stage of the cascading failure: the capacity of the sector node in the failure state equals zero. According to the remaining capacities of the sectors within the distribution radiusl, the failed sector node’s load (L) is distributed, and the receiving nodes’ load increases ΔLij.(c)
Propagation stage of the cascading failure: the sector nodes that change from “normal” to congested state distribute the load exceeding its capacity to the normal sector nodes within the surrounding distribution radiusl. These nodes’ loads increase as ΔLij=Lj−CjCi−Li/lijα/∑g∈Nlj∗Cs−Ls/ligα.(d)
Ending stage of the cascading failure: ifL>C and N=0 for a sector node, the airspace sector network collapses. If all sector nodes meet the L≤C requirement, the airspace sector network reaches a balanced state [36].The specific implementation flowchart of the prejudged partial load redistribution strategy based on the nodes’ remaining capacity is shown in Figure4.Figure 4
The flowchart of the prejudged partial load redistribution strategy based on the nodes’ remaining capacity.


## 4. Simulation Analysis

The airspace under the jurisdiction of the North China Regional Control Center was selected to derive the empirical data sample. More precisely, the network of North China control sectors (see Figure5). was constructed based on the flight data of one day during peak hours in 2019 (see Figure 6).Figure 5
Structure of the North China controlled airspace sector.Figure 6
The North China controlled airspace sector network.Through software simulation and statistics, the North China sector network was found to have a total of 23 nodes and 53 edges, with relatively close connections between different sectors. The average clustering coefficient of the North China sector network equalsC = 0.465, meaning that the average probability of a connection between any two sectors is 46.5%. Using the Warshall–Floyd algorithm, the average path length of the North China sector network is calculated as L = 2.581, indicating that a flight from any sector of North China passes through three sectors on average or receives the services of three controllers to reach the destination sector [37, 38].


### 4.1. Cascading Failure Simulation Analysis

First, the degree and strength of each sector in the North China sector network were calculated, and each sector’s load was obtained according to the relationship between the load and these two parameters (equation (4)). The results are shown in Table 1.Table 1
Statistical characteristics of the North China sector network.
No.SectorDegreeIntensityLoad1Hohhot 01428311322Hohhot 0232617833Taiyuan 01344713414Taiyuan 02547523755Taiyuan 0332567686Taiyuan 04727219047Beijing 01882365848Beijing 025192396159Beijing 036626375610Beijing 047708495611Beijing 054343137212Beijing 064406162413Beijing 073378113414Beijing 083924277215Beijing 095884442016Beijing 104636254417Beijing 116623373818Beijing 123456136819Beijing 134544217620Beijing 143578173421Beijing 1541203481222Beijing 1641656662423Beijing 17413205280As seen in the table, the Beijing 02 sector has the largest load, and its failure has the greatest impact on the network’s cascading failure. Therefore, this work explores the North China sector network’s invulnerability to cascading failures due to the Beijing 02 sector’s failure. Takingθ=0.9,μ=2.7 as examples, when the Beijing 02 sector node “fails,” its load is evenly redistributed to Taiyuan 02, Taiyuan 04, Beijing 01, Beijing 03, and Beijing 04, increasing their loads by 1923. However, loads of Beijing 03 and Beijing 04 sectors exceed their capacity, and “congestion” occurs. The excess load is distributed to the “normal” sector nodes adjacent to them, namely Taiyuan 01, Taiyuan 03, Beijing 01, Beijing 03, and Beijing 10. Upon redistribution, most of these sector nodes’ loads do not exceed their capacity, and the network is rebalanced. However, the load of Beijing 03 exceeds its capacity. After additional redistribution, the network reaches balance [39]. Here,(9)SAR=423=0.174.By adjusting the sector nodes’ extra margin differentiation parametersθ in the simulation, one can study the parameter’s effect on the network’s cascading failure performance. The following values were selected: 0.9, 0.8, and 0.7 (Figure 7). As shown in Figure 7, when parameter μ is small, the extra margin of each sector node is minimal. Once the sector node with the largest load fails, a large load flows to the surrounding sector nodes. With the propagation of the cascading failure, the load locally converges to one sector node as its surrounding sectors enter the “congested” state. Unable to relieve the additional load, the entire network collapses.Figure 7
Simulation analysis diagram of the cascading failure.SAR corresponding to each critical threshold μτ in the figure is not high. However, even when most of the sectors are in the “normal” state, the network may collapse. This result indicates the network’s inability to smooth out the local load, which is the main reason for the cascading failure and collapse of the airspace sector network [40].


### 4.2. Simulation Exploration of Optimization Strategy

When a sector fails, the equal distribution strategy is typically adopted. Following this approach, the sector traffic is evenly distributed to sectors adjacent to the failed node. Within this work, two strategies simulating the cascading failure process are adopted and compared with the equal distribution strategy [25, 26].Figure8 shows the cascading failure results of the North China sector network before and after the optimization strategy is adopted upon the failure in the Beijing 02 sector. The parameters of prejudged partial load redistribution are set to l=2,α=4. Adopting either the adjacent or the local load redistribution strategies improves the network’s situation compared to the one yielded by the equal distribution. Similarly, critical threshold μτ is reduced, with the critical threshold of the prejudged local load redistribution strategy being smaller than that of adjacent allocation. The prejudged local load redistribution strategy distributes the excess load to more peripheral sector nodes, making full use of local airspace resources. With μ>μτ, the network reaches a balanced state. At this time, the sectors directly allocated by the failed sector are all in a congested state. At the critical threshold, the network will collapse only when more nodes are congested, and the sector abnormality rate is relatively high.Figure 8
SAR value under different allocation strategies. (a)θ = 0.6, (b) θ = 0.7, (c) θ = 0.8.
(a)(b)(c)Overall, the adjacent and prejudged local load redistribution strategies improve the sector network’s invulnerability to cascading failure compared to the equal distribution strategy, and the effect of the prejudged local load redistribution strategy is more pronounced.


## 4.1. Cascading Failure Simulation Analysis

First, the degree and strength of each sector in the North China sector network were calculated, and each sector’s load was obtained according to the relationship between the load and these two parameters (equation (4)). The results are shown in Table 1.Table 1
Statistical characteristics of the North China sector network.
No.SectorDegreeIntensityLoad1Hohhot 01428311322Hohhot 0232617833Taiyuan 01344713414Taiyuan 02547523755Taiyuan 0332567686Taiyuan 04727219047Beijing 01882365848Beijing 025192396159Beijing 036626375610Beijing 047708495611Beijing 054343137212Beijing 064406162413Beijing 073378113414Beijing 083924277215Beijing 095884442016Beijing 104636254417Beijing 116623373818Beijing 123456136819Beijing 134544217620Beijing 143578173421Beijing 1541203481222Beijing 1641656662423Beijing 17413205280As seen in the table, the Beijing 02 sector has the largest load, and its failure has the greatest impact on the network’s cascading failure. Therefore, this work explores the North China sector network’s invulnerability to cascading failures due to the Beijing 02 sector’s failure. Takingθ=0.9,μ=2.7 as examples, when the Beijing 02 sector node “fails,” its load is evenly redistributed to Taiyuan 02, Taiyuan 04, Beijing 01, Beijing 03, and Beijing 04, increasing their loads by 1923. However, loads of Beijing 03 and Beijing 04 sectors exceed their capacity, and “congestion” occurs. The excess load is distributed to the “normal” sector nodes adjacent to them, namely Taiyuan 01, Taiyuan 03, Beijing 01, Beijing 03, and Beijing 10. Upon redistribution, most of these sector nodes’ loads do not exceed their capacity, and the network is rebalanced. However, the load of Beijing 03 exceeds its capacity. After additional redistribution, the network reaches balance [39]. Here,(9)SAR=423=0.174.By adjusting the sector nodes’ extra margin differentiation parametersθ in the simulation, one can study the parameter’s effect on the network’s cascading failure performance. The following values were selected: 0.9, 0.8, and 0.7 (Figure 7). As shown in Figure 7, when parameter μ is small, the extra margin of each sector node is minimal. Once the sector node with the largest load fails, a large load flows to the surrounding sector nodes. With the propagation of the cascading failure, the load locally converges to one sector node as its surrounding sectors enter the “congested” state. Unable to relieve the additional load, the entire network collapses.Figure 7
Simulation analysis diagram of the cascading failure.SAR corresponding to each critical threshold μτ in the figure is not high. However, even when most of the sectors are in the “normal” state, the network may collapse. This result indicates the network’s inability to smooth out the local load, which is the main reason for the cascading failure and collapse of the airspace sector network [40].


## 4.2. Simulation Exploration of Optimization Strategy

When a sector fails, the equal distribution strategy is typically adopted. Following this approach, the sector traffic is evenly distributed to sectors adjacent to the failed node. Within this work, two strategies simulating the cascading failure process are adopted and compared with the equal distribution strategy [25, 26].Figure8 shows the cascading failure results of the North China sector network before and after the optimization strategy is adopted upon the failure in the Beijing 02 sector. The parameters of prejudged partial load redistribution are set to l=2,α=4. Adopting either the adjacent or the local load redistribution strategies improves the network’s situation compared to the one yielded by the equal distribution. Similarly, critical threshold μτ is reduced, with the critical threshold of the prejudged local load redistribution strategy being smaller than that of adjacent allocation. The prejudged local load redistribution strategy distributes the excess load to more peripheral sector nodes, making full use of local airspace resources. With μ>μτ, the network reaches a balanced state. At this time, the sectors directly allocated by the failed sector are all in a congested state. At the critical threshold, the network will collapse only when more nodes are congested, and the sector abnormality rate is relatively high.Figure 8
SAR value under different allocation strategies. (a)θ = 0.6, (b) θ = 0.7, (c) θ = 0.8.
(a)(b)(c)Overall, the adjacent and prejudged local load redistribution strategies improve the sector network’s invulnerability to cascading failure compared to the equal distribution strategy, and the effect of the prejudged local load redistribution strategy is more pronounced.


## 5. Conclusion

Building on the complex network theory, this paper represents control sectors as nodes and establishes the edges based on the flight connections between adjacent sectors to construct a control sector network. Through modeling, the cascading failure and invulnerability optimization strategy of the airspace sector network is analyzed, yielding the following breakthroughs and achievements.(1)
This work presents the first study of the airspace sector network’s cascading failure invulnerability. The cascading failure process in sector nodes is represented using three states (“normal,” “failure,” and “congested”), and the process is analyzed over four stages. The analysis of the changes in the airspace sector network’s cascading failure invulnerability index revealed the bottleneck of air traffic congestion. Furthermore, the optimization strategy is proposed.(2)
The strategies of adjacent load redistribution and prejudged local load redistribution are proposed to improve the network’s cascading failure invulnerability. With the increase in margin parameterμ, the effectiveness of the local load redistribution strategy increases, improving the network failure invulnerability.This work is the first to establish a control sector network model and analyze its characteristics from the air traffic management perspective. While verifying the network reliability, we also found some loopholes in the current network structure, that is, even if the overall network capacity is sufficient, the network’s inability to smooth out the local load will still lead to cascading failure. The cascading failure risk caused by the failure of key nodes is greater. Therefore, for key sectors, making emergency plans corresponding to the sector with the help of load redistribution strategy can effectively help air traffic controllers deal with emergencies. As a result, the paper proposes suggestions for solving air traffic congestion. This paper also has some limitations. This paper focuses on the static index of SAR to evaluate the cascading failure model, but transient dynamics also plays an important role in network quality evaluation. Therefore, in future research, on the one hand, we will study the role of transient dynamics on the quality of network [40]. On the other hand, research efforts will be directed at expanding the sample size, improving the cascading failure model’s validity to closely match the operation of air traffic control and simulating the propagation mechanism of air traffic congestion more realistically.



---

*Source: 5388630-2022-03-23.xml*