# Traffic, disturbances and capacity: stages 4–6

Engine: `traffic-reference-0.2.0` implemented 2026-09-23; the current engine is `traffic-reference-0.7.0` (see the reference notes at the end).

This is a bounded research model using the continuous trajectory geometry from stages 0–3. The Traffic & capacity workspace and `scripts/traffic.cjs` use the same configuration, planner, world and statistical reducer. It is not calibrated supplier performance or an operational safety approval.

**The separate REQ-4.1 acceptance run of ten million actual simulated flight hours has not been completed.** A smaller measured benchmark accompanies the implementation. The older snapshot benchmark is not evidence for this engine.

## Using it

1. Open **Traffic & capacity**. The reference has two crossing routes and two height layers.
2. Set offered demand and its generation period. The additional drain period lets late departures finish; it adds actual flight time, not additional offered traffic.
3. Run traffic. Inspect offered/accepted/completed flights, delays, contacts, NMAC intervals, CA, violations, queues and events. Select an aircraft or event to inspect its actual altitude and speed.
4. Toggle DCB and DAA independently. Change sensing or disturbances and rerun with the same seed.
5. Run a capacity study: compare levels, refine sampled pass/fail transitions and confirm the selected level using fresh seeds.

**Use current U-plans** copies routes into a prescribed corridor schedule, with their speeds, heights, waypoint sequences, selected protective radius, vertical separation setting and geofences. The earliest departure becomes time zero. Heights are explicitly interpreted as flat-ground AGL. The source Scenario and A/n results are not mutated. Schedules run as individual experiments; a Poisson demand model is required for rate sweeps.

The validated JSON editor exposes network, profile, contingency, obstacle and intruder inputs. Exported runs freeze the effective seed and rate. Capacity exports retain every replicate summary and seed; Inspect run reconstructs a selected replicate. Changed inputs, cancellation and rejected imports are identified in the status.

```sh
node scripts/traffic.cjs --output traffic-result.json
node scripts/traffic.cjs --scenario traffic-result.json --output replay.json
node scripts/traffic.cjs --scenario examples/traffic-01-corridors.json --capacity --output capacity.json
node scripts/traffic.cjs --scenario examples/traffic-01-corridors.json --benchmark --replicates 100 --max-seconds 60 --output benchmark.json
```

Output files must be new. The website needs no server-side Node installation.

## E4: traffic and DCB

The network contains directed corridors, nodes and layers. Each generic route leg selects one layer. Terminal delivery itineraries combine outbound/return grid routes and explicit vertical/off-grid access legs; arbitrary transfer corridors inside the cruise network are not implemented. See DELIVERY_MODEL.md. Corridors define width, simultaneous capacity, entry headway, minimum sensor range and eligible aircraft profiles. Layers define altitude, vertical band and simultaneous capacity.

Demand is an explicit schedule or a homogeneous Poisson arrival process. Inter-arrival seconds are `−ln(1−U) / (ratePerHour / 3600)`. Origins/destinations and fleet entries use independent weighted draws. Schedules can prescribe corridor sequences to retain route detours.

Arrival, OD, fleet, sensing, false-alarm, first-failure, navigation and urgent-geofence streams are keyed separately by seed and mission identity. Exploration levels share underlying arrival/fleet draws: scaling unit-exponential arrival times preserves the Poisson distribution at each level. Levels are correlated comparisons, not independent evidence across levels.

Dn is not converted into an assumed OD matrix: spatial position density does not uniquely identify trips. Actual occupancy is measured as integrated airborne seconds in 100 m cells. Continuous cell-boundary crossings make this independent of trace frames. The existing Dn redistribution is not applied again to these flights.

DCB orders requests by requested departure, then mission ID. It considers bounded short eligible routes and departure delays at the configured slot spacing. Every candidate checks physical-body clearance against the airspace, known restrictions and solids; corridor eligibility and protective width; layer/corridor capacity and headway; and continuous protection against previously committed missions, including geometric corridor crossings. Capacity reservations include every network volume traversed, even another route's corridor at a crossing. Planning and executed-occupancy checks share this geometry.

Waiting is on the ground. This is a finite first-come-first-served policy, not a globally optimal scheduler. No eligible route, maximum delay, missing drain time, restrictions and exhausted search budgets produce explicit rejection reasons. Resource limits never silently discard demand.

With DCB off, eligibility still applies but strategic reservations/restriction avoidance are skipped. Sensor capability requirements remain corridor attributes even when DAA execution is disabled for comparison.

Every offered flight retains a decision. Emergencies can withdraw accepted ground flights; these remain rejected requests and retain their earlier waiting time. Offered demand balances rejected, completed, collided and unfinished demand flights. Original/revised arrival predictions, remaining revised plans, final flight status and events are retained. Cancelled and unresolved flights have no predicted arrival. Actual layer/corridor volume occupancy is checked separately from admission. Occupancy uses aircraft centres; protection and physical clearance use their own extents.

## E5: sensing, avoidance and disturbances

### Sensors and cooperation

Each aircraft has its own sensor/CA parameter structure. Structures share the reference vertical avoidance policy and ideal cooperative communications; they are not independently validated vendor algorithms.

FoV is a horizontal bearing cone around flight direction. Heading at rest uses prior motion or the first leg. Range is 3D distance; static-obstacle range uses the bounding-cylinder centre. Pd is one Bernoulli trial per visible target per fixed sensor scan. Per-aircraft visible-sample and detection counts expose the trial denominator. Pd = 0 gives no real detections; a separately enabled false-alarm process can still operate.

Position error is independent uniform error in ±positionErrorMetres **per coordinate axis**; velocity is exact. Observation age delays delivery of a captured observation. Response latency is the additional delay from alert to maneuver start. CA predicts constant velocity from timestamped observations; it does not receive an intruder's future path. Undetected solids still participate in independent physical truth. Sensed obstacle geometry carries the configured measurement error.

A seeded master is held through each cooperative pair episode, including its re-attempts; a failed aircraft is not selected as a functioning master, and the other functional aircraft can take over. Only the master maneuvers. Overlapping coordination and actual groups of three or more remain visible coverage failures. Arbitrary multi-aircraft avoidance is not claimed.

### Paths and physical truth

Piecewise constant-acceleration motion uses the shared geometry kernel. Physical body size, NMAC and protection are distinct. Body contact retires affected aircraft. Polygon-prism solids use a conservative cylindrical body envelope for contact; flat-ground contact is also terminal. Geofence overlap is a restriction breach, not physical contact.

CA adds a bounded vertical offset and a continuous return. Candidates check speed, acceleration, climb, known restrictions and predicted separation. Infeasible maneuvers and interrupted/censored returns remain outputs.

A fault expands protection into a sphere using hoverCageScale. Mixed sphere/cylinder proximity encloses the cylinder in a sphere, a conservative approximation that can flag additional proximity. Exported protection history prevents faults from retroactively changing earlier encounters.

### Stochastic processes and contingencies

- **Tracking:** bounded smooth vertical excursions during level coasts, with a configured minimum correlation/hold time. Offsets return to zero before nominal turns or acceleration. Total kinematic limits are checked. Arbitrary lateral navigation error and wind are not modeled.
- **False alarms:** exponential times per airborne hour. A synthetic track enters the same controller. Feasible unnecessary maneuvers execute; unavailable or suppressed alarms remain logged. False tracks cannot themselves cause a physical contact.
- **Onboard failure:** a first-failure hazard, at most one fault per mission. The multirotor brakes, hovers and attempts a bounded rejoin. Hold time is an assumed recovery duration. Fleet/schedule entries can override common hazard, hold, cage scale and search limits.
- **Strategic recovery:** published cooperative intentions inform updates to affected active and ground flights. Active recovery is braking/waiting/rejoin, subject to known restrictions and kinematic limits. Delivery recovery retains pending service and remaining waypoints; generic non-delivery recovery rejoins its final destination; it may leave the original corridor. Ground rescheduling rechecks separation, capacity and headway. Exhausted recovery remains unresolved and counts against completion.
- **Urgent geofences:** Poisson announcements at uniformly selected network nodes, with configurable footprint, heights, notice and lifetime. Planning can use a restriction only after announcement; truth checks it from activation. It may be impossible to avoid in time.
- **Non-cooperative aircraft:** prescribed multirotor paths, including unannounced turns, participate in contacts, NMAC, exposure and group flags. Their future plans are not shared with DAA or strategic recovery. This is a bounded behavior library expressed as waypoint routes.

Geofence policy first tries compliant CA. Avoid-collision-first may relax a restriction only if observations predict physical contact and no compliant candidate exists. Policy use and actual violations are recorded. Physical solids and the airspace envelope are never relaxed.

Only stop/hover-capable multirotor dynamics are represented. Fixed-wing dynamics, terrain, arbitrary emergency maneuvers and incompatible vendor protocols remain outside this model.

## E6: statistics and capacity

Replicates within a traffic level are independent. Counts retain their proper denominators:

- Exposure H is summed actual airborne seconds divided by 3600.
- Collision, NMAC and CA rate are event count divided by H.
- Completion/rejection fractions divide by **offered** demand; admitted-flight delay is reported alongside rejection.
- Completed flights per generation hour describes a finite offered cohort, including completions during drain time. It is not steady-state throughput.
- Efficiency compares completed planned/executed 3D paths. Partial crashed flights are not rewarded as short efficient trips.
- Inverse collision-rate ALS is H / contacts when contacts exist; zero contacts gives null rather than proof of infinite safety.

Operational criteria use pooled results per level: completion, rejection, delay, contacts, NMAC, boundaries, actual network capacity and unresolved recovery/coordination. Count limits are totals across that level's replicates; defaults require zero adverse counts. Zero traffic or zero completion cannot establish capacity.

The search evaluates every configured level and refines intervals where adjacent sampled outcomes differ. It does not assume monotonicity. The highest passing level with complete reference-model coverage gets fresh-seed confirmation. Failed confirmation is reported; lower levels are not quietly retested using the same holdout. A passing highest tested level is a tested lower bound, not a located capacity maximum.

Operational acceptance, model coverage and statistical collision evidence remain separate. A passing operational study is not safety certification.

Descriptive 95% intervals bootstrap whole runs, resampling counts and exposure together. Aircraft/frames within a run are not independent samples. Small replicate sets are flagged. General methodology: [NIST bootstrap description](https://www.itl.nist.gov/div898/handbook/eda/section3/eda334.htm).

A separate zero-contact diagnostic is upper95 = −ln(0.05) / H. It assumes a homogeneous Poisson collision process, not established by this simulator. A 10⁻⁷/flight-hour target needs approximately 29.96 million zero-contact hours under that assumption. A zero-event bootstrap interval must not be read as zero risk. Reference: [NIST zero-failure exposure bound](https://www.itl.nist.gov/div898/handbook/apr/section4/apr451.htm).

The generic study collision target uses combined modeled aircraft exposure, including declared intruders. Separate CS25/other TLS metadata is preserved, but CS25-specific populations and safety assessment are not implemented.

## Reproducibility and scaling

Modules separate configuration/random streams, planning, the common world, statistics and UI. Rendering does not schedule sensing or failures. Exact swept-axis lower bounds accelerate distant-segment rejection without dropping potential contacts.

Validated limits are now a 48-hour horizon, 2,000 flights per replicate, 12,500 nodes, 100,000 corridors, 12 layers, 32 aircraft/sensor profiles and 20 prescribed intruders (0.2.0 allowed two hours, 128 nodes and 512 corridors). Poisson demand whose expected count plus five standard deviations exceeds the flight limit is rejected before any replicate runs. Explicit search/event budgets flag or abort exhaustion. These are engineering limits, not capacity estimates.

Benchmarks use the full non-visual world, unique replicate seeds and actual exposure. They record runtime, machine/Node details and whether requested work finished. A time limit produces an explicitly incomplete result; small runs are never extrapolated into evidence. Exposure across correlated traffic levels is reported as simulation work and never pooled as independent TLS evidence.

```sh
node scripts/traffic.cjs --scenario examples/traffic-01-corridors.json --benchmark --target-hours 10000000 --max-seconds 604800 --output ten-million-hour-benchmark.json
```

This is a reproducible protocol, not an achieved result. The ten-million-hour acceptance run needs further performance work or compute resources. Independent expert/model validation also remains open.

Measured software verification and the frozen example capacity study are recorded in [benchmarks/README.md](benchmarks/README.md).

## Requirement coverage

| Requirements | Implemented increment | Boundary |
| --- | --- | --- |
| 2.1, 2.4 | Layered routes, time reservations, demand, queues and prescribed/updated U-plans | One area, no inter-layer transfer scheduler or optimal DCB |
| 2.5, 2.7 | Per-aircraft FoV, Pd, range, age, latency, error and false-alarm parameters | Common reference CA policy |
| 2.11, 3.2, 3.7 | First-failure hazard, brake/hover/rejoin, expanded protection, affected-plan updates | Multirotors and bounded recovery |
| 3.3, 3.6 | Executed false-alarm maneuvers, sensed solids and non-cooperative paths | Conservative solids and limited intruder behavior |
| 4.2, 4.3, 4.6 (geofence priority) | Multi-encounter flags, continuous violations, urgent restrictions and explicit priority | Complex coordination is flagged, not solved |
| 1.3, 1.4, 4.5 | Replay/exports, CA statistics, actual exposure, executed efficiency and comparisons | Model-conditional evidence |
| 2.8, 4.4 | Consistent targets and separate operational/coverage/statistical status | No CS25-specific or real-world TLS validation |
| 4.1 | Accelerated CLI batches, capacity studies and measured benchmark reporting | Ten-million-hour acceptance remains open |

## Geographic integration (24 September)

Engine 0.3.0 adds an explicit `shortest-available` geographic network policy and includes prescribed schedules alongside Poisson demand. Existing studies with empty Poisson schedules retain their prior semantics. Generated IDs use a reserved `demand-` prefix. The main product uses the shared three-step workflow documented in [INTEGRATED_MODEL.md](INTEGRATED_MODEL.md). Reference fixture pages are retired; their engines and CLI inputs remain available. Sensor observations can be recorded for inspection without changing random draws or physical outcomes.

## Reference 0.5: reservation revisions

Changed published paths refresh volume and directed-entry reservations. Initial planning, airborne rejoin and ground rescheduling share the capacity/headway/separation predicate. After CA or contingency, active plans are checked in a bounded pass and waiting departures are re-reserved in order. Unresolved active coordination remains explicit. Actual corridor headway is audited from executed segments alongside layer/corridor occupancy and terminal movements. The capacity table reports Operational pass, separately from statistical safety evidence. See [MODEL_VALIDATION.md](MODEL_VALIDATION.md) for regression fixtures and limitations.

## Reference 0.7: CA re-attempts, master selection and demand headroom

Within a cooperative episode the same master now re-attempts CA while the conflict remains predicted, after an unavailable maneuver, a cleared alert, a blocked command or a completed maneuver. Overlapping-avoidance warnings are reported once per episode. A conflict no longer predicted at command time is `alertCleared`, not `avoidanceUnavailable`. Batches and pooled levels aggregate `avoidanceUnavailable` (encounters) and `repeatedAvoidanceUnavailable` (failed re-attempts). The master draw mixes all key bits (see TRAJECTORY_MODEL.md, reference 0.4).

Aircraft profiles accept an optional `verticalAccelerationMetresPerSecondSquared`. Acceleration is checked separately horizontally and vertically, so CA can begin while a route brakes or accelerates. Contingency braking and vertical tracking excursions respect the vertical limit. With the default, equal to the horizontal limit, nominal paths are unchanged.

Demand headroom is checked when a study is validated and, for capacity studies, at the highest tested level. Previously such demand aborted the batch partway through.