Using agent-based modeling to determine collision risk in complex TMA environments: the turn-onto-ILS-final safety case

The continuously growing traffic demand1,2,3 in civil aviation forces the ATM system to utilize existing airport infrastructure and surrounding airspace at its best. Increasing traffic volumes impose additional approach and departure capacities concentrating at the runway or runway system. These may induce higher workloads for both air traffic controllers (ATCO) and pilots as the highly efficient use of pre-set sequencing and spacing constraints becomes crucial while they are also considering environmental issues such as noise abatement. While introducing important measures to minimize aircraft emissions and maximize throughput, the current high safety standards in aviation must not be compromised, but instead, pushed further in order to compensate numerically the projected traffic growth. The performance-based navigation concept,4 which is based on the RNP/RNAV philosophy, is a promising innovation. The European SESAR2020 project PJ01 03 focuses particularly on dynamic and enhanced routes and airspace by, for example, investigating PBN for parallel approaches. PBN allows for a more flexible route design, e.g., circumnavigating densely populated or other noise-sensitive areas during intermediate and even final approach by introducing procedure legs such as “turn to fix” or “radius to fix.” Since those new procedures will have to demonstrate equivalent safety standards compared to conventional procedures, in the course of this paper, we first present these reference values through an analysis of conventional procedures and published safety cases. Depending on the airport runway operation mode (segregated or mixed), individual requirements have been established by ICAO to assure safe operations. However, these safety measures are somehow “static” and do not foresee specific adjustments to local conditions because no explicit cause-to-risk correlations exist in current guidance material except for the final approach segment.5 To overcome this lack of cause-and-effect reasoning, the present project investigates pair wise aircraft collision risk modeling (CRM), also explicitly taking controllers and flight crews into account, modelled mathematically as so-called agents. The case study assumes radar vectoring towards the final ILS approach, laterally intercepting localizer (LOC) and subsequently the glide slope (G/S) until the aircraft has crossed the runway threshold. The following four sections summarize and present (in Section 4) the results of a literature review regarding current regulations and the scientific state-of-the-art knowledge in the field of assessing operational safety during independent parallel approach procedures. We make conclusions about input parameters of the model and summarize on CRM Acceptance Criteria as the output of the model. In Section 5, we specify how the fast-time model is integrated into the overall architecture and explain how the agents are modeled. In Section 6, we transfer the specification into software in order to calculate safety and capacity metrics (i.e., probability of separation infringements and the nuisance breakout rates as detailed in Section 4.D) for various scenarios depicting traffic, runway/airspace layout and agent behavior (i.e., procedures and hazards as detailed in Section 7.A). In Section 7, we discuss the model verification concept and the results gained.


Introduction
The continuously growing traffic demand 1,2,3 in civil aviation forces the ATM system to utilize existing airport infrastructure and surrounding airspace at its best. Increasing traffic volumes impose additional approach and departure capacities concentrating at the runway or runway system. These may induce higher workloads for both air traffic controllers (ATCO) and pilots as the highly efficient use of pre-set sequencing and spacing constraints becomes crucial while they are also considering environmental issues such as noise abatement. While introducing important measures to minimize aircraft emissions and maximize throughput, the current high safety standards in aviation must not be compromised, but instead, pushed further in order to compensate numerically the projected traffic growth. The performance-based navigation concept, 4 which is based on the RNP/RNAV philosophy, is a promising innovation. The European SESAR2020 project PJ01 03 focuses particularly on dynamic and enhanced routes and airspace by, for example, investigating PBN for parallel approaches. PBN allows for a more flexible route design, e.g., circumnavigating densely populated or other noise-sensitive areas during intermediate and even final approach by introducing procedure legs such as "turn to fix" or "radius to fix." Since those new procedures will have to demonstrate equivalent safety standards compared to conventional procedures, in the course of this paper, we first present these reference values through an analysis of conventional procedures and published safety cases.
Depending on the airport runway operation mode (segregated or mixed), individual requirements have been established by ICAO to assure safe operations. However, these safety measures are somehow "static" and do not foresee specific adjustments to local conditions because no explicit cause-to-risk correlations exist in current guidance material except for the final approach segment. 5 To overcome this lack of cause-and-effect reasoning, the present project investigates pair wise aircraft collision risk modeling (CRM), also explicitly taking controllers and flight crews into account, modelled mathematically as so-called agents. The case study assumes radar vectoring towards the final ILS approach, laterally intercepting localizer (LOC) and subsequently the glide slope (G/S) until the aircraft has crossed the runway threshold. The following four sections summarize and present (in Section 4) the results of a literature review regarding current regulations and the scientific state-of-the-art knowledge in the field of assessing operational safety during independent parallel approach procedures. We make conclusions about input parameters of the model and summarize on CRM Acceptance Criteria as the output of the model. In Section 5, we specify how the fast-time model is integrated into the overall architecture and explain how the agents are modeled. In Section 6, we transfer the specification into software in order to calculate safety and capacity metrics (i.e., probability of separation infringements and the nuisance breakout rates as detailed in Section 4.D) for various scenarios depicting traffic, runway/airspace layout and agent behavior (i.e., procedures and hazards as detailed in Section 7.A). In Section 7, we discuss the model verification concept and the results gained.

State-of-the-art in safety assessment focusing on the approach segment A. Independent parallel approach, safety
The FAA began research in the field of independent approaches to parallel runways as early as the 1960s. Since then, the MITRE Corporation in particular has progressed in developing and conducting simulations aiming at reducing runway separation requirements. 6,7 Besides developing technology like high update rate radars (down to 1 Hz), the FAA also started three major research programs: The Multiple Parallel Approach Program, 8 the Precision Runway Monitoring (PRM) Demonstration Program 9 and the Converging Approach Standards Technical Working Group (CASTWG). For the purposes of the MPAP and CASTWG, the FAA created a fast-time model called Airspace Simulation and Analysis for TERPS (ASAT). An ASAT study is split into the two stages of real-time, human-in-the-loop and fast-time computer-only simulation. Otherwise hard-to-reach human factors (reaction times, workload, etc.) and aircraft behavior data (e.g., roll rate, climb rate, airspeed, etc.) is acquired in the first stage. This empirical data is statistically fitted and transferred into continuous probability density functions (PDF). By means of Monte-Carlo simulation, this data is recombined with additional data from technical specifications (e.g., radar errors) while a vast amount of simulation runs helps to increase statistical significance and sharpen the confidence interval. 10 Along MPAP, which was started in the late 1980s, 8 ASAT has been used to investigate simultaneous parallel approach scenarios with dual, triple and even quadruple runway configurations within the US. Rare blunder situations (see Section 4.C) were the main interest due to the great safety impact. Therefore, the blunder occurrence probability (or blunder rate) was the central hazard for collision risk with aircraft operating on the adjacent approach track and not taking any evasive actions. To efficiently collect the most relevant data focus was merely put on such blunder-evader constellations solely along the project's

B. Intercept of the final approach
Published studies regarding the final approach segment always assume that separation requirements will be met during the intercept maneuver even though workload is considerably high and accepted as relevant during this flight segment and important changes in the aircraft guidance mode are necessary for safe operations. As the aircraft's headings converge, violations of separation standards could (in theory) occur suddenly and without meaningful precursor events, e.g., in case of a late or incorrect turn anticipation by the flight crew or degraded/misconfigured aircraft guidance systems. The literature does, however, not yield any safety or human factor considerations concerning these potential issues. [6][7][8][9][10][11][12] Therefore, we can only take note of the fact that conservative procedure design usually foresees a vertical buffer, e.g., by displaced runway thresholds, thereby safeguarding the intercept against these and any other connected issues.

C. The blunder hazard
In the scope of independent parallel approaches, so-called "blunder" events require special attention. 6 A blunder describes an unexpected deviation of an aircraft from its intended flight path (e.g., the final approach track) that does not result from ubiquitous navigational errors or could otherwise be attributed to the total system error in general, but from human error or improper functionality of technical equipment. The extent of the initial deviation from the desired track forms the blunder angle. Immediately after detection of such abnormal behavior, ATC will issue a correction advisory to the crew. In case of a non-responsive evasive aircraft, this one is called a worst-case blunder. Any potentially threatened aircraft on the adjacent approach track will receive a breakout command to relax the situation and avoid a collision (the so-called evader). By searching the FAA's Aviation System Performance Metrics database and reviewing nearly 1,000,000 approach reports from 2008 to 2010, the authors Massimini et al., 13 determined a blunder rate of 1/24,000 with a blunder angle not exceeding 29° and no occurrence of a single worst-case-blunder diverting by an angle of 30° or more.
As a blunder risk mitigation measure, ICAO calls for a 2,000 ft wide No Transgression Zone (NTZ, Figure 2) placed equidistantly between the two final approach tracks, starting laterally at the distance outbound where vertical separation is first lost and extending towards the first (if staggered) runway threshold. The remaining lateral space to each runway is called Normal Operating Zone (NOZ), starting longitudinally at the localizer intercept, extending towards the individual runway threshold. Consequently, the NOZ has no pre-defined width but depends entirely on the runway spacing while considering the pre-set NTZ width. This is not at all compliant to modern concepts (e.g., the PBN philosophy 4 ), indicating a necessity for further research. The NTZ dimensions are the result of a geometric construction of the flight paths of a worst-case blunder and an adjacently operating aircraft executing an evasive maneuver, which effectively dictate the minimum distance at the closest point of approach (CPA) for an aircraft pair. The case of dual blunders lies outside of this rationale and is therefore not part of this construction but rather a very rare though potentially risk-intensive corner-case.

D. Acceptance criteria
Obviously, safety acceptance especially of TMA procedures competes with both acceptable system capacity and also with emission abatement. Consequently, the relationship between a given CR and its implication on runway throughput is crucial for both the regulator and the operator. Therefore, we define different measures that allow an assessment of safety versus capacity.

Safety
In case of a blunder event, the risk of a collision is deter-mined by calculating the probability of two aircraft coming into physical contact. In general, this is the case if the slant range between the aircraft falls below a threshold defined by the aircraft's physical dimensions. This "conflict risk" approach was generalized and adopted by FAA/ MITRE and subsequently ICAO, and is defined as a threshold of 500ft as the 'hit' distance regardless of the orientation in 3D space. In ICAO's and-built on it-SESAR's safety regulation, the Target Level of Safety (TLS) concept, aims at defining, by means of mathematical proof, a Maximum Tolerable Frequency of Occurrence (MTFoO) for hazardous events concentrating on, but not being limited to, the 'fatal accident' category induced by a physical contact according ICAO Annex 13. 14 For independent parallel approaches, regulation requires less than 1 violation of the 500 ft. slant-range criterion in 56 million approaches, equaling a Near Mid-Air Collision (NMAC) rate of 1.8•10 -8 per approach. 15 Assuming a final approach segment length of 10 NM and an average final approach speed of 150 KIAS, the time per final approach is approx. 4 minutes, resulting in a "conflict" frequency of 2.7•10 -7 per flight hour. That NMAC may remain an incident but it might recur in different conditions and become an accident, depending on the moderating events and conditions. The ICAO TLS for fatal obstacle collision accidents during ILS final approaches is 1•10 -7 per approach. 5 A study from MITRE however proposes a much stricter target for NMAC rate in close-to-terrain operations, with a value as low as 1•10 -9 per approach even though a non-catastrophic consequence is associated to that hazard, argued with the fact that escape procedures are physically constrained downwards. 16 It is therefore important to stress that this value does not equal an accident-type TLS; historical incident data proves that only a small portion of slant-range violations indeed led to an accident, whereas the majority fell into the severe incident category according ICAO Annex 13. 14 Therefore, it is necessary to consult recent safety publications such as SESAR 17 for comparison and interpretation.

Capacity
During parallel approaches, a blunder should induce a breakout maneuver of an aircraft operating on the adjacent approach track, this one then following the published missed approach procedure. This scheme enforces safety at a minimal cost of capacity. Since aircraft are subjected to navigational tolerances, NTZ alerts may be triggered by aircraft deviating from but autonomously returning to their approach track. Nevertheless, the (automatically triggered) NTZ alert requires ATC to 'break' the adjacent aircraft 'out' of the approach. This is called a nuisance breakout in the sense of a false positive alert (see scenario A in Figure 2). The frequency of such events is called nuisance breakout rate (NBR) and forms a (lost) capacity measure. Fixing a general NBR target is however unrealistic since it depends on many factors, e.g., on the traffic mix and the given runway spacing.
To give indications about NBR estimates, we find in Massimini 7 that the NBR estimated is considerably below 5% of all approaches. In Mc Cartor & Ladecky, 12 aircraft performing an RNP 0.3 (non-precision) approach are observed to cause similar nuisance breakouts 2-4% of the time.

CRM model architecture A. Overview
The configuration of our integrated agent-based traffic simulation and collision risk estimation model, which studies though is not limited to the safety case of independent parallel approach operations ( Figure  3), comprises multiple interacting modules that are triggered repeatedly following a Monte-Carlo parameter variation scheme. Previous work in development and application of the model is described in. [18][19][20][21][22] For the safety case focused on in this paper, the following CRM parts were customized: the independent parallel approach configuration including all associated parameters (green colors in Figure 3), the definition and calculation of relevant metrics (blue) and customizations to the visualization. After a short introduction to the core model (traffic simulation, collision risk quantification, parameter variation, orange), these customizations are covered in detail, followed by geometric construction of the infrastructure and scenario definition descriptions.

B. CRM-agent based traffic simulation
The main idea of an agent-based model is creating software entities, which closely resemble real-world entities in terms of knowledge (information base), behavior (rules of deciding and acting) and communication (sensing the environment, interacting with other agents) without 'cheating' for the sake of efficient modeling or computing. The main benefit is emergent behavior, where a multiplicity of well-modeled software agents exhibit the same features as their realworld counterparts without the need for explicit modeling of complex traits. 1 Although getting the behavior 'right' is often troublesome, the major benefit is that the model is generative, meaning it is able to predict patterns outside the evident behavior specification which can be (and often are) 'wrong' but which may provide valuable insight into unforeseeable hazards; this is particularly relevant in the aviation domain. Except for the aircraft and flight guidance agents, all other work is purely event-driven (e.g., radar pattern detected, reaction/ reading time passed). The emergent behavior is the timed sequence of events shaping the synchronous aircraft movements, whereby the concept explicitly addresses the missing cause-to-effect relations as elaborated in Section 3 ( Table 1).

C. Agent action sequence for the blunder event
The agent logic is best understood following an assumed blunderevader constellation as depicted in Figure 2. Agent entities will be underlined in this sub-section. Initially, both aircraft are following their specific approach track. Upon blunder initiation, the blundering aircraft's flight guidance reverts to vectoring mode with a new heading given by the blunder angle and the initial approach track. It is reached by modeling a constant bank rate of 10 / s Φ =° by the autopilot either until reaching the bank limitation max 25 Φ =° 5 (for clean configuration) or the standard procedure turn rate of 3 / s Ψ =° . The final turn radius r and the required bank Φ for a procedure turn observing the bank limitation are calculated as follows: During the period of 'rolling up,' the aircraft will follow an EULER spiral (clothoid). The on-following curve with constant bank and speed is circular. It is correctly terminated by the autopilot with the appropriate ramp-down of the roll, resulting in a clothoid transition towards the anticipated blunder heading. While performing the described maneuver, the blunder position is radar-detected and passed on to the controller, upholding all performance assumptions (e.g., delay, resolution). Upon such 'evident' NTZ penetration, the according software module inside the controller agent will trigger the 'alert.' The behavior is pre-defined: break out of the (previously paired) aircraft on the adjacent approach track again by means of vectoring, optionally adding a vertical guidance and requesting the blunder aircraft to immediately return to its initial approach track. For the 'classic' ICAO SOIR blunder scenario, all reaction and communication times are subsumed by ICAO's original assumption of statically 8s. 15 This incorporates the controller's reaction time to the NTZ alert, voice-com and the pilot's reaction time until aircraft compliance with the advisory. Following ICAO's assumptions, we only assume 8s total reaction time from NTZ alert to aircraft reaction and procedure turns (i.e., no manual aircraft handling assumed). It is obvious, that this static assumption does not correctly reflect a humanmachine-system, which is always stochastic. The fixed value was chosen as an initial baseline for validation reasons.
To minimize time-based discretization effects induced by the Monte Carlo simulation engine, blunder events are also synchronized with the chosen simulation update period (e.g. 0.5s). When initiating the evasive maneuver, small corrections (<1 update cycle) are applied to compensate time-discretization errors (radar, controller reaction). By the more sophisticated design of our simulation system mostly overridden for this study, the controller reaction time would be built from a blocking resource model resembling the top-level task items of scanning the radar screen, conflict inspection, decision-making 23 and advisory transmission (including interruptible read-back and compliance monitoring). The advisory transmission would require a free voice-com channel and the utterance would be accounted for according to ACT-R 24 with syllable and word pause times, etc. Finally, the pilot reaction time will be modeled with a PDF evaluated in a previous human-in-the-loop study. 22 Using knowledge about human factors, the total reaction time could be estimated as: Let (1) be almost immediate due to uniqueness of the alert and the pre-defined actions, except for the necessity to look up the evader call sign at the radar screen (GOMS complex information look-up, 1200 ms). 25 (2) can be calculated by the syllable/word count of the advisory according to ICAO phraseology and phonetics and metrics from ACT-R, 24 e.g. air-line_1_2_3_turn_left_hea-ding_4_5_6_imme-diate.
15 syllables+10 word gaps+initiation+comprehension 15*50ms+10*100ms+150ms+180ms=2,080ms With 1,540ms and 0 to 2,000ms on average (depending on the input strategy), (3) and (4) can be adopted from Vogel et al., 22 where a pure human factors estimate is presented as well. In total, we can account for 5 to 7 s (4,820 to 6,820 ms on average) of the 8 s assumption without taking the radar update rate into account; this then appears roughly valid considering that much time can be saved by observing the controller's acute voicing in hazardous situations and early cue words in ICAO phraseology. Once configured by the pilot, the evader autopilot will initiate the same aircraft turn maneuver as described in the beginning of this sub-section. In parallel, a second controller who simultaneously monitors the blunder's approach track will initiate a comparable advisory to the blundering aircraft, whose pilot would subsequently start implementing the corrective maneuver ('normal' blunder) or fail to react ('worst case' blunder).

D. Aircraft navigation performance
With respect to the defined navigation aids, all trajectories produced by the traffic simulation are ideal and incorporate all of the features of the agents' decision-making including timing, which we call microscopic because of the fine-grained dependencies between agents (e.g., milliseconds of reaction time deciding upon which aircraft is being served first by ATC). In addition, all flight movements are known to exhibit a navigational error consisting of path definition, navigation system and flight technical errors. We handle these errors on a macroscopic level. By analyzing large radar data sets and filtering flights navigating autonomously only on flight guidance systems (no manual control, no active ATC advisories), and statistically fitting (often heavily tailed) PDF, all micro-effects stemming from weather (e.g., turbulent wind), control system dynamics, etc. can be summed up into one distribution (independently per axis of the trajectoryfixed coordinate system; i.e., cross-track, along-track, vertical-track tolerance, XTT, ATT, VTT). We refer to these PDF of navigational accuracy as actual navigation performance (ANP) equivalent, but not limited to, the term used in PBN. 26,27

E. Monte-Carlo evaluation and numeric complexity
We utilize pseudo-random variables in order to efficiently and reproducibly assess the influence of arbitrarily distributed stochastic parameters present in the form of aircraft pairing, navigation tolerances (ANP), radar accuracy and reaction times. Normally, to determine a risk of less than 10 -8 collisions per approach (due to blundering) with an accuracy of 5%, the simulation needs to span far more than 10 quadrillion approaches according to the Bernoulli Law of Large Numbers, as quantified by Chebyshev 's inequality in (3). Here, the simulation is considered a Bernoulli experiment (collision yes/no) which is repeated n times, in which a collision is recorded 1 n times. The type-I error probability is set to 1-P=0.05 and the probability estimation tolerance is set to The computational effort can, however, be reduced by focusing on approach "points of interest:" Assuming a blunder rate of 1/24,000 leads to 500 billion approaches to simulate. In contrast to this theoretic approximation, FAA conducted studies where a similar simulation was run 100,000 times. 9

A. Definition of metrics
First, we defined the assessment metrics, which we call acceptance criteria. For each such criterion, tool users have to define acceptance thresholds for the given ATM procedure design with regard to safety (collision probability) and capacity (aircraft throughput). According to historical models and studies, we adopt the concept of the number of Test Criteria Violations (TCV) to define a safety metric as outlined in Section 4.D, targeting severe incidents instead of a pure collision risk (CR). The latter can, however, be estimated by reducing the 'hit' distance to the aircraft's physical dimensions. The slant range between blunder-evader aircraft pairs is therefore continuously traced. If it falls below a given threshold, a TCV is recorded. Finally, the probability of a TCV based on its number of occurrence The widely accepted assumption of a fixed blunder probability Blunder P helps to increase computational efficiency. The blunderevader results are collated with inherently safe normal operations as a post-processing step. The NBR is also calculated analytically during post-processing using the NTZ penetration probability and the physical runway layout. Both approach tracks' NBR are calculated separately by integrating geometrically the cross-track ANP distribution function along the extended runway centerline, as shown in (5). Figure 4 illustrates this process. Yellow-grey areas under the Normal Distribution function depict NTZ penetration probabilities at single points as the integral of the cross-track deviation. The length of the final approach track along the NTZ boundary is denoted as l . The overall NBR is the counter-probability of the event that "on neither approach track, a nuisance breakout occurs." All NBR values depend on the current navigation accuracy.

B. Geometric design, stochastic variables
For the targeted safety case, airport, final approach configuration and runways are assumed to operate in single mode (approaches only) with guidance and surveillance equipment compliant to ICAO SOIR Mode 1 specifications. 15 A standard ILS final approach begins with intercepting the LOC. Then, a straight horizontal flight segment is followed for at least 2NM, allowing the aircraft to establish and stabilize laterally before vertically intercepting the G/S and start to further descent until touchdown. Aircraft approaching the same or the adjacent runway must maintain radar separation (3NM laterally or 1,000 ft vertically) at all times even though they are considered 'independent.' The angle between intercept vector and final approach course must not exceed 30°. 15 The model, however, allows for certain violations, thus reflecting navigational, control and human error. The actual LOC intercept point is subject to uncertainties (aircraft/pilot behavior) and variability's resulting from sequencing in a vectoring onto ILS environment. These, however, are not reported in the paper and will be modeled by an appropriate PDF.
Surveillance system requirements depend on the actual runway spacing: Between 3,400ft and 4,300ft (centerline to centerline), ICAO requires a radar update rate of every 2.5 seconds. The azimuthal accuracy of the recorded aircraft positions shall match a Normal Distribution with 0.06 σ =°. Beyond 4,300ft runway spacing, an update rate of only 5 seconds as well as an azimuthal accuracy of 0.3 σ =°is required. Aircraft speeds are also stochastically modeled.
While historical investigations by ICAO assume an unrealistic constant speed of 150 KIAS, our model is able to handle various distributions. Besides a static value, aircraft speeds may also be subjected to a Normal Distribution 2 ( , ) N µ σ  or following the ICAO approach category scheme. 5 Finally, blunder parameters are stochastic variables as well. Those are the distribution of blunder occurrence along the approach track, the blunder angle and the worst-case blunder rate.

C. Implementation of the turn-onto-final safety case
For each simulation run, blunder-evader pairs are positioned on the parallel approach tracks. First, the distance from threshold for the blundering aircraft is chosen randomly. Subsequently, based on the provided ANP function, cross-and vertical-track deviations are determined, assuring the necessary initial adherence to the NOZ before the actual blunder event. Additional stochastic parameters are speed, blunder angle and vertical blunder behavior (leveling-off due to lost G/S signal versus upholding the current rate of descent). Now, a deterministic blunder trajectory is generated. The crossing point with the adjacent approach track is calculated and forms the mid-point of the evader placing area, which extends, plus/minus, half of the required in-trail separation, thereby covering precisely the location of the most threatened aircraft for the independent parallel approach configuration. The assigned evader placement follows a uniform distribution. Once placed, the evader is shifted back in time in order to let blunder and evader enter the simulation at the same time. After having assigned the initial positions and all aircraft parameters, the simulation continues as described in Section III.C and stops as soon as the closest point of approach (CPA) has been passed. For the minimum distance, the TCV is evaluated.

D. Model limitations
We currently assume that human actions are purely event driven. The controller will initiate corrective commands only after receiving a NTZ alert. The pilot agent only consecutively intervenes after receiving a command. However, in reality, the controller will most likely detect deviations during the approach well prior NTZ alert and issue appropriate commands. Additionally, pilots may also be able to detect deviations and undertake corrective maneuvers without ATCO recall. The model therefore is rather conservative, probably too deterministic at this point. Furthermore, the distribution functions used to represent navigation tolerances presume a Brownian motion, flight mechanics are widely neglected. This theoretically allows an aircraft to suddenly change attitude in space between two simulation steps. At the same time, the employed ANP functions are considered to be independent while deviations from the flight path may not. ANP functions were deduced from recorded real flight paths and are therefore environment specific. Data contains environmental effects like winds, which will often be specific for the location, and the time the data was recorded. Therefore, reference data should contain a very large range of all external effects. Alternatively, locally fitted ANP functions should be developed and human reaction times modelled stochastically. The model is technically prepared to do so. We will consider these issues in consecutive research.

A. Model verification using the 'classic' ICAO Scenario
The fast-time model shows that results are comparable to those of previous simulation studies by ICAO. This is shown in the following, by running two exemplary use cases. While for intercept maneuvers there is no comparable study available, we configured the mode (final approach blunder, nuisance breakout and aircraft behavior modules) to be comparable with historical studies. Hence, we expect the model to remain valid and to deliver results that are directly comparable with the 'classic' baseline. Using these settings, multiple simulations, initialized with individual random 'seed' values, were conducted. Figure 5 visualizes the development of resulting probability over an increasing number of simulated blunder-evader pairings. The results stabilize at a probability of around (one TCV per 56 million approaches). 15 The remaining differences do result from implementation details (e.g. clothoid) and model parameterization (e.g. ILS deviations). Especially, we found high sensitivity to TCV probability towards the final approach length, which was set to 10 resp. 13.5NM for both runways to allow for immediate blundering towards NTZ. When applying 10NM for both runways, the probability drops significantly down to around TCV per approach. This ILS specific effect is subject to further research.

B. The turn-onto-final safety case
The 'novel' safety case now covers additionally the LOC intercept including the additional hazard of weak interception due to human error such as e.g., flight guidance mode-confusion. The model handles such events identically to those on final approach, with the difference that the blunder initiation is linked to the nominal intercept point and the 'blunder' heading is assumed to be already reached. In contrast to the 'classic' scenario, the NTZ, extending outwards until vertical separation is no longer granted, 15 does not cover that airspace entirely. Instead, vertical separation set to 1000ft. between left and right approach safeguards the intercept procedure. Following the stated assumptions, proactive controller interventions (without NTZ alert) are not considered. This is a rather weak assumption from reality. Therefore, the current agent behavior represents a conservative (static & worst-case) safety consideration. The resulting points of closest approach (slant distance color-coded) are shown in Figure 6.  shown below depicts the measured aircraft slant ranges and TCV violation threshold. Although the worst-case assumptions and visual images laid out above suggest a more critical behavior than in the 'classic' scenario, the opposite is true: due to the 1000ft. vertical separation set out until G/S intercept, no TCV occurred over the 10 million simulated pairings. Therefore, we cannot show any stabilization of TCV rate results as part of Figure 7. To investigate further, a more critical case lowering virtually vertical separation down to 800ft was selected. Figure 8 depicts the corresponding effects: The slant range distribution is shifting towards lower values (rightwards), TCVs do occur: Its rate now stabilizes similarly to Figure 5 at a value of 9 3.04 10 − ⋅ per approach. These kinds of procedure design studies, along with re-shaped (elongated) NTZ geometries, form potential future application of the presented model.

C. Discussion of runtime complexity and outlook
First, the quality of results does depend on the time discretization performed during all computer-numerical simulations. By applying corrections below one time increment (update period), we were able to compensate and stabilize the results ( Figure 9). Second, the runtime requirement certainly depends on the expected probability of 'positive' observations (e.g., NMACs). Running multiple simulations over a wide range of blunder events shows that results stabilize at around 3 million events, as depicted in Figure 5 & Figure 8. 100,000 simulation runs as published in 15 are, consequently, far too little for reliable results. Third, it is important to recall that the probability value for a TCV, as given by ICAO, does not represent an accident-type of TLS since historical incident data proves that only a small minority of slant-range violations indeed led to accidents, whereas the majority fall into the severe incident category (NMAC) of ICAO Annex 13. 14 Therefore, it is necessary to consult recent safety publications such as 17 for comparison and interpretation. The document offers a translation of a singular TLS value into seven incident/accident severity categories and correctly connects safety with reliability by declaring a "Maximum Tolerable Frequency of Occurrence" (MTFoO). (Bottom) Figure 9 Reduced influence of time stepping (simulation update period) on resulting TCV rate, with comparison to published value in ICAO SOIR. 15