，，，

1.School of Automation，Northwestern Polytechnical University，Xi’an 710072，P.R.China；2.School of Automation Science and Electrical Engineering，Beihang University，Beijing 100191，P.R.China

Abstract: Autonomous aerial refueling（AAR）has demonstrated significant benefits to aviation by extending the aircraft range and endurance. It is of significance to assess system safety for autonomous aerial refueling. In this paper，the reachability analysis method is adopted to assess system safety. Due to system uncertainties，the aerial refueling system can be considered as a stochastic system. Thus，probabilistic reachability is considered. Since there is a close relationship between reachability probability and collision probability，the collision probability of the AAR system is analyzed by using reachability analysis techniques. Then，the collision probability is accessed by using the Monte-Carlo experiment method. Finally，simulations demonstrate the effectiveness of the proposed safety assessment method.

Key words：aerial refueling；safety assessment；collision probability；probabilistic reachability；Monte-Carlo method

0 Introduction

Autonomous aerial refueling（AAR）is an im?portant method to increase the voyage and endur?ance of unmanned aerial vehicles and avoid the con?flict between the takeoff weight and the payload weight［1-2］. Among the aerial refueling methods in operation today，the probe-drogue refueling（PDR）［3-4］is the most widely adopted one，owing to its flexibil?ity and simple requirement for equipment. There is plenty of studies on the control design of AAR，such as linear quadratic regulator（LQR）［5］，Nonze?ro setpoint（NZSP）［6］，active disturbance rejection control（ADRC）［7］，adaptive control［8］，backstep?ping control［9］，etc.

However，AAR is one of the most dangerous operations in the aviation field. Safety hazards in aer?ial refueling mainly exist in the“unsafe contact”be?tween the receiver and the tanker. Under unsafe con?ditions，once the receiver and the tanker collide，the refueling equipment may be damaged. What is worse，the aircraft body may be damaged. During the aerial refueling，due to the close distance be?tween the receiver and the tanker，the aerodynamic disturbances are serious. As a result，the control de?sign is difficult and thus the collision probability is high. Therefore，it is necessary to evaluate system safety of the autonomous aerial refueling system in advance，which can guide the implementation of the aerial refueling mission.

Due to the influence of the environment，the state space of the AAR system can be divided into a safe area and an unsafe area as shown in Fig.1. In or?der to ensure safety，the system state should be kept outside of the unsafe area，and the control in?put should be selected to prevent the system from entering the unsafe area. Safety assessment can be divided into two categories：One is the worst-case setting，and the other is the stochastic setting［10］. In the worst environment，the system has bounded dis?turbance inputs，and the purpose of safety assess?ment is to prove that for all possible disturbance in?puts，the system will not enter the unsafe area. In the random environment，there is a random distur?bance in the system，and the purpose of safety as?sessment is to prove that the probability of the sys?tem entering the unsafe area is sufficiently small. A new solution to the problem of safety assessment is proposed in Ref.［11］，that is，the“barrier certifi?cate”is used to separate the safe area from the un?safe area. In the worst environment，this method does not need to calculate the reachable set and can be directly applied to continuous hybrid systems with nonlinearity，uncertainty and dynamic con?straints.In a random environment，the safety assess?ment problem of random continuous hybrid systems can be solved and the upper bound of the probability of the system reaching the unsafe area can be calcu?lated.

Fig.1 Airspace division for aerial refueling

Reachability is an important method to analyze system safety，which is commonly-used in air traffic management. Reachability analysis is to evaluate whether the system state can reach a specific set in a certain time range starting from given initial condi?tions and limited by control inputs. For a determinis?tic system，the motion characteristics of the system can be completely determined，and the reachability is a“0/1”binary problem. However，for a stochas?tic system，due to system uncertainties including modelling uncertainties，observation uncertainties and environmental uncertainties，etc.，different tra?jectories generated from each initial state have differ?ent probabilities. The probability of the system arriv?ing at the target set from an initial state with an ini?tial distribution is a kind of probabilistic reachability.When the system change is affected by some control inputs，the control inputs should be selected appro?priately to minimize the probability of the system state entering the unsafe area. For deterministic sys?tems，the reachable set can be calculated based on the system model，and the system safety can be as?sessed by the“model checking”method. The com?mon methods for calculating reachable sets are the Hamilton-Jacobi equation method and the approxi?mation method. The feasible state space of aircraft is analyzed by the Hamilton-Jacobi equation method in Ref.［12］，and the safe control range of quadrotor aircraft is studied by the reachable set analysis meth?od in Ref.［13］. For a stochastic system，the safety must be repeatedly assessed online according to the updated information of the system state，and the probability of the system state entering the unsafe ar?ea is taken as the criterion to measure the risk de?gree. The approximation theory related to the Mar?kov process can be used to calculate the probability of the system entering the unsafe area. In Refs.［14?15］，the over-approximation method is used to cal?culate the reachability of the system. The asymptot?ic approximation method based on the Markov pro?cess is used in Ref.［16］to calculate the reachability probability of the system.

The aerial refueling system is a complex sys?tem with a variety of uncertainties. The aerial refuel?ing process is abstracted into six maneuvers and six modes in Ref.［17］. Based on the relationship be?tween mode transition，a hybrid system model of the whole process of aerial refueling is established.Then，the capture set and the unsafe set are defined to solve the numerical solution of each maneuvering reachable set in the aerial refueling by the Hamilton-Jacobi equation method. The capture set and unsafe set can be used as a guide for the design of mode transition and safety assessment in different stages of aerial refueling. In addition，great progress has been made in assessing the safety of uncertain sys?tems based on the Monte Carlo method. The safety of robot trajectory in uncertain environment is stud?ied in Ref.［18］. The Monte-Carlo sampling method is used to calculate the collision probability between the robot and obstacles. In Ref.［19］，a Monte-Car?lo motion planning algorithm is designed，which can be used to evaluate the collision probability between the robot trajectory and obstacles. The algorithm re?duces Monte-Carlo variance by combining the sam?pling method and the control variable method，and also improves the calculation accuracy. The calcula?tion speed is improved to meet the real-time perfor?mance. On the whole，the safety of autonomous aer?ial refueling is rarely assessed in the existing re?search. Reachability calculations for automated aeri?al refueling have been conducted in Ref.［20］，but the Monte Carlo simulation method was not used.

In this paper，the safety assessment problem for the AAR system is solved by using the reachabil?ity analysis method. First，the trajectory space of the receiver can be determined based on the closedloop receiver model. Then，the collision model of aerial refueling is built according to the aircraft size and flight trajectory. Next，the reachability probabil?ity and the collision probability of the AAR system are obtained by the Monte-Carlo experiment meth?od，which can be used to assess the system safety of the AAR system.

The main contribution of this paper is that the safety assessment of the AAR system can be con?ducted based on the reachability probability and the collision probability. Monte?Carlo simulation is ad?opted to investigate the collision probability by us?ing reachability analysis. The analysis results can provide guidance in advance to decide whether au?tonomous aerial refueling should be carried out. The proposed method is simple and effective.

The paper is organized as follows. Estimation of collision probability based on the Monte-Carlo method is presented in section 1. Section 2 gives the reachability analysis for the aerial refueling system.Illustrative simulations are provided in section 3 to show the effectiveness of the proposed method. Sec?tion 4 concludes the paper.

1 Estimation of Collision Probabili?ty Based on Monte?Carlo Method

In practical engineering，there is a close rela?tionship between reachability probability and colli?sion probability. For evaluating the path reachabili?ty，given the initial state and target state，if the sys?tem can safely transit from the initial state to the tar?get state，the system is reachable. If the system col?lides during the transition，we consider the system to be unreachable. Similarly，for stochastic sys?tems，due to the existence of system uncertainties，the occurrence of collision is stochastic. Collision probability can be analyzed by using reachability analysis techniques.

For stochastic systems，it is necessary to ana?lyze the reachability from the perspective of proba?bility. The Monte-Carlo method is usually used to approximate the mathematical expectation of func?tions containing random variables. Consider a ran?dom variableX∈Rn，and a bounded functionf：Rn→R，formindependent and identically distribut?ed samples of the random variable {X(i)}m i=1. Ac?cording to the central limit theorem，whenm→∞

Let the random variableXrepresent the trajec?tory of the receiver，Aa collision event，andfthe in?dicator function to indicate that there is a collision，thenf(A)=1. Therefore， Eq.（2） can be ex?pressed as

The collision probability is expressed aspand it can be estimated by

Thenτ2can be estimated according to the sam?pling variance off(X(i))，namely，whenm→∞

The uncertainty ofp? can be quantified by ap?proximating the variance of the collision probability estimatep?. Therefore，the Monte-Carlo method can be used to estimate the collision probability of the given trajectory by sampling the motion trajectory of the considered plant.

2 Reachability Analysis for the AAR System

Reachability can be divided into two types，namely forwards reachable set（FRS） and back?wards reachable set（BRS）. FRS refers to the state set that the system can reach in a certain period of time from a given initial state set. BRS is the set of all initial states that can be controlled to a given tar?get state set in a certain period of time. In this part，F(xiàn)RS is considered.

For AAR，due to the existence of system un?certainties，the trajectory of the receiver will deviate from the nominal trajectory，as shown in Fig.2. In order to compensate the system uncertainties，a con?troller needs to be designed to make the receiver track the nominal trajectory quickly［21］. It is worth noting that the controller can only suppress the sys?tem uncertainty to some extent，rather than elimi?nate it completely. When the system uncertainties are very serious，it may lead to an uncontrollable system. Therefore，it is of significance to evaluate system safety based on reachability probability and collision probability.

Fig.2 Influence of system uncertainties on a trajectory

2.1 Closed?loop model of the receiver

In the aerial refueling system，the dynamic equation of the receiver is expressed as

wherexr∈R12is the state of the receiver；ur∈R4the input of the receiver；andd∈Rdthe uncertainty of the system，including modelling uncertainties and environmental disturbances.

The linear model is obtained by linearizing Eq（.6）at the equilibrium point，and it is ob?tained as

where the matricesA，B，Care the obtained linear?ized matrices. The output vectory? is the trajectory of the receiver；is the lumped disturbance of the system. Noteworthy，dˉ can be modelled based on experience or can be esti?mated by an observer. The reference trajectory of the receiver generated by the trajectory generator is expressed asand the actual trajectory of the receiver is，so the tracking error can be written as

whereKx∈R4×12，Ke∈R4×3. By substituting Eq.（9）into the dynamic equation of the receiver，the closed-loop model of the receiver can be ob?tained as

Fig.3 Aerial refueling process

2.2 Collision model of the AAR system

The complete aerial refueling process is shown in Fig.3，including the forward flight process from position 0 to position 1，the side flight process from position 1 to position 2，the docking process from position 2 to position 3，the retreat process from po?sition 3 to position 4，and the side flight process from position 4 to position 5. During the whole flight process，the receiver may collide with the tanker or the refueling equipment. In order to facili?tate the evaluation of collision probability，the fol?lowing assumption is assumed.

Assumption 1 The collision range of the re?ceiver and the tanker is regarded as a circle on a twodimensional plane，the center of mass is the center of the circle，and the radius isr1andr2，as shown in Fig.4.

Fig.4 Collision range of the receiver and the tanker

Assume that the position of the center of mass of the receiver ispr= [xryr]Tin the tanker coor?dinate system at timet，the collision range of the re?ceiver is

The collision range of the refueling equipment can be regarded as a rectangle with the width ofw0.Suppose that the longitudinal maximum distance（otxtdirection）from the drogue to the center of mass of the tanker isl0，then the collision range of the refueling equipment is

In the tanker coordinate system，the center of mass of the tanker is the origin，so the collision range of the tanker is

Based on the above analysis，the collision range of the tanker system is

Trajectory space of the receiver is the set of all paths satisfying the closed-loop model of the receiv?er in Eq.（10），namely

Define collision eventA.Within timet∈[0，T]，the receiver moves along the nominal trajectory（i. e.，reference trajectory），and the collision range of the receiver intersects with that of the tank?er system，which is written in the mathematical form as

It should be noted that the relationship between the actual trajectory of the receiver and its nominal trajectory meets the closed-loop model of the receiv?er in Eq.（10）.

2.3 Collision detection of the AAR system

The relative position and related parameters of the receiver system and the tanker system are shown in Fig.5. The center of mass of the tanker is the originotof the tanker coordinate system，and the collision range of the tanker isr2. The center of mass of the receiver isor，and the two-dimensional coordinates in the tanker coordinate system are(xr，yr). The tanker collision range isr1. The colli?sion detection can be divided into two parts：One is the collision detection between the receiver and the tanker，and the other is the collision detection be?tween the receiver and the refueling equipment.

Fig.5 Collision detection of the aerial refueling system

The distance between the center of mass of the receiver and the center of mass of the tanker isdoo.The collision will occur if and only if

Then，the collision detection between the re?ceiver and the refueling equipment is analyzed. Be?fore docking，the receiver is located at the left side of the tanker，namely the forward flight process from position 0 to position 1 and the side flight pro?cess from position 1 to position 2 in Fig.3. The colli?sion range of the receiver is generally much larger than the longitudinal length of the refueling equip?ment，i.e.，there is a relationshipr1?l0-r2. Un?der the circumstance，only the distance from the center of mass of the receiver to the edge of the colli?sion range of the refueling equipment needs to be considered，that isd1in Fig.5. The collision will oc?cur if and only if

2.4 Algorithm design of collision probability es?timation

According to the idea of the Monte-Carlo simu?lation，the random variabley?rrepresents the trajec?tory of the receiver，Adenotes a collision event，andfis an indicator function to indicate that a colli?sion has occurred，namelyf(A)=1. On the con?trary，f(Aˉ)=0 withAˉbeing the mutually exclu?sive event ofA，which means no collision occurs.Therefore， the collision probability can be ex?pressed asBased onmMonte-Carlo simulation experiments，the collision probability can be estimated by

Algorithm

Step 1Give a set of system uncertainty pa?rametersd～N(μ，Σ)，or the level of wind distur?bance. Initialize the nominal trajectoryand the number of collision count=0.

Step 2Carry outmMonte-Carlo simulation experiments，andi=1，2，…，mfor each simula?tion. The obtained trajectory corresponds to an actu?al trajectory(i).

Determine whether there is a collision accord?ing to the collision detection model：

（1） If there is a collision，count=count+1.

（2）If there is no collision，the next simulation experiment needs be carried out.

Sclectnwaypoints as samples equidistantly on the nominal trajectory，and mark the waypoints before the collision as 0 and the way?points after the collision as 1.

Step 3Calculate the collision probability of the whole trajectory by

Step 4The reachability probability of each waypoint is

The corresponding algorithm flow chart is shown in Fig.6.

Fig.6 Algorithm flow chart

3 Simulation

In the simulation，the influence of wind distur?bances and the tail vortex of the tanker are consid?ered. The simulation conditions are set as follows：The initial position of the receiver ispr0=[-30 -30]Tas shown in Fig.7. There are three levels of wind disturbances：（1）The probability of exceedance intensity is 10-2，which is called as“Class II turbulence”；（2）the probability of exceed?ance intensity is 10-3，which is called as“Class III turbulence”；（3）the probability of exceedance in?tensity is 10-5，which is called as“Level IV turbu?lence”. The trajectory of the receiver is along theotxtdirection，flying straight and level for 20 m at a speed of 2 m/s. Other parameters are set asr1=8 m，r2=21 m，l0=25 m，w0= 5 m，simula?tion timesm=100.

Fig.7 Nominal trajectory of the receiver

（1）Simulation results under level II turbulence

Fig.8 is the statistical histogram of the frequen?cy of collisions under the level II turbulence. A total of three collisions have occurred. Based on the colli?sion time of these three collisions，the achievable probability distribution diagram is shown in Fig.9. If the safety threshold is set as 0.9，under the level II turbulence，the receiver is in the safe area all the time.

Fig.8 Statistical histogram of the frequency of collisions un?der the level II turbulence

Fig.9 Distribution diagram of reachability probability under the level II turbulence

（2）Simulation results under level III turbu?lence

Fig.10 is the statistical histogram of the fre?quency of collisions under the level III turbulence. A total of 14 collisions have occurred. Based on the collision time of these 14 collisions，the achievable probability distribution diagram is shown in Fig.11.Under the level III turbulence，the receiver is in the safe area for the beginning 14.3 s，after which the reachability probability of the receiver drops below the safety threshold.

Fig.10 Statistical histogram of the frequency of collisions under the level III turbulence

Fig.11 Distribution diagram of reachability probability un?der the level III turbulence

（3）Simulation results under level IV turbu?lence

Fig.12 shows the statistical diagram of the colli?sion number under the level IV turbulence. A total of 68 collisions have occurred，and the reachable probability distribution diagram is shown in Fig.13.The receiver is in the safe area for the beginning 9 s，and in the dangerous area after 9 s.

In summary，as the intensity of turbulence in?creases，the collision probability between the receiv?er and the tanker increases.

Fig.12 Statistical histogram of the frequency of collisions under the level IV turbulence

Fig.13 Distribution diagram of turbulent reachability proba?bility under the level IV turbulence

4 Conclusions

The safety assessment problem for the autono?mous aerial refueling system is solved by the reach?ability analysis method. The main contribution of this paper is that the reachability probability and the collision probability can be obtained by using the Monte-Carlo experiment method. The analysis re?sults can provide guidance in advance to decide whether autonomous aerial refueling should be car?ried out. The proposed method is simple and effec?tive.Simulation results show that the method can as?sess system safety properly. We will try more com?putational efficient methods to calculate the reach?able sets without the need for computationally inten?sive Monte Carlo simulations in the context of aerial refueling operation in future work.