Runway Takeoff-Hold Lights.
A Surveillance-Driven Safety Logic

XPGuard · technical white paper · THL / RWSL

1. Architecture and scope

A THL is red if and only if the runway is armed and activated:

where,

The logic consumes one observation per track per surveillance update — geodetic position, reported altitude, ground speed, and true heading. The two predicates separate cleanly. Armed is a property of a single aircraft (is anyone in takeoff position?); activated is a property of the traffic ahead of that aircraft (is the runway it would roll into unsafe?). Both are recomputed from the current track set on every update; the only state kept between updates is a short per-track speed history (for the acceleration estimate, §2) and a brief per-runway alarm hold (the dwell, §2.3). Each runway end is treated as an independent monitor.

The remainder is organized bottom-up: the surveillance and estimation layer (§2), the geometry (§3), the two predicates (§4–§7), and the system that carries the decision into the simulator (§10).

2. Surveillance and state estimation

An observation of a track is the tuple

2.1 Acceleration estimate

The predictions of §5–§7 need an along-track acceleration a, but differentiating a single update is noisy. Each track instead keeps a short history of (t, v) over a trailing window W and estimates a as the secant slope across that window:

where,

where t_k is the latest sample and t_j the oldest still inside [t_k−W, t_k]. The window (W = 6 s) is long enough to smooth surveillance jitter yet short enough to catch a rejected takeoff within a second or two of brake application. With fewer than two samples in the window — or all sharing one timestamp — the estimate is forced to zero rather than dividing by zero, so a long-stationary track reports a ≈ 0. This single estimator drives every prediction: the special-departure “not braking” test (§5.1), the crosser entry time (§5.2), and the crosser's latest window exit (§7).

2.2 Track lifetime

A track is created on first observation and dropped when no fresh data has arrived for T_stale (= 12 s); this bounds memory and prevents a vanished target from haunting a runway. The history is also pruned to the window W each update, so a track stationary for minutes still reports a ≈ 0 rather than a stale slope.

2.3 Temporal hysteresis (dwell)

Surveillance feeds are not uniform — a public datafeed may update only every several seconds — so a raw activation can flicker across a gap in the data. The alarm is therefore latched: once activation fires it is held on for a dwell T_d (= 3 s) past the last active update. The hold carries the armed/hazard identities with it, so the displayed cause is stable; it only ever extends a red phase, never creates one, so it cannot mask a genuine all-clear beyond T_d.

3. Runway-local frame, projection, and light placement

Each runway end is treated independently. We place the origin O at the runway threshold and define a right-handed runway-local frame: ξ is the longitudinal coordinate (positive toward the far end), η the signed lateral coordinate. The runway unit vector u and bearing ψ_R come from the two threshold endpoints b (far minus near, in the local east/north metric):

where,

A track at (λ, φ) is carried to the local east/north offsets (x, y) from the threshold by an equirectangular projection and then onto the runway axes; we write (s, t) for (lateral, longitudinal) in the implementation:

where,

so t ≡ ξ is distance down the runway and s ≡ η is signed offset from the centerline. The differentiated form gives the along/across velocity split used throughout,

where,

All bearings are true. The runway has half-width h (defaulting to 25 m when the field width is unknown) and length ℓ_R; the corridor treated as “on the runway” — the band — is |η| ≤ h + e with a small side extension e. The equirectangular approximation is exact to better than a metre over a runway-sized neighborhood, far below the band tolerance. Two lateral tolerances follow: the tighter |η| ≤ h gates the in-position / arming test (§4), while the wider band |η| ≤ h + e decides whether a hazard counts as “on the runway” (§5).

The THLs are, physically, a double row of in-pavement fixtures along the runway centerline, beginning a short distance ahead of the runway threshold and extending downfield (the row/fixture layout is a rendering detail, §10; the safety logic here yields only the lit longitudinal extent). In the runway-local frame the array occupies

where,

with start ℓ₀ = 114 m (375 ft) and length L = 457.2 m (1500 ft), per ATC-206 [1]. A departing aircraft holds at ξ ≈ 0 and sees the lit array stretching ahead of it. The array is the visual cue; whether, and how far, it is lit is decided by §4–§9.

4. The armed condition

An aircraft is in position (and the runway thereby armed) when it lies in the arming region 𝒜, is aligned with the runway, and is at or below the in-position speed:

where,

The region runs from a small margin B (= 40 m, for aircraft length and position jitter) behind the threshold out to the far end of the array, capped so that at least ℓ_ahead (= 300 m) of runway remains in front:

Alignment uses a generous tolerance Θ = 65° so an aircraft still swinging onto the centerline arms; the speed gate V₀ = 35 kt admits a rolling line-up but excludes a committed departure. When several aircraft satisfy the predicate, the protected aircraft A is the trailing-most (smallest ξ_A) — the one most in need of protection; an aircraft lined up further down is then a hazard for A (§9).

5. The activation (hazard) condition

Given an armed aircraft A at ξ_A, a candidate hazard B is considered only if it is ahead of A (by a small guard, ξ_B > ξ_A + 30 m), within the runway length, and on the ground:

where,

The ground test is a height gate: a target whose reported altitude differs from the armed aircraft's by more than z_g = 50 ft is climbing out or overflying and is not a surface hazard. Using A's own altitude as the datum makes the test a relative one, robust to local pressure setting. Each qualifying B falls into exactly one regime; the runway is activated if any flags a hazard, and the lit array stops at the nearest one (§9).

5.1 In-trail occupancy and the special-departure rule

When B lies within the band (|η_B| ≤ h + e) it is physically on A's runway and is a hazard unless it is a prior departure clearly clearing. Decompose its velocity into along- and across-runway components and form the clear-time t_c, the time to reach the clear distance ξ_c at the along-runway speed (the denominator carries a small floor v_min to avoid division by zero near rest):

where,

Following the special-departure rule of ATC-206 [1, §2.2.8], B clears only when it is moving predominantly down the runway, fast, committed, and far enough along:

where,

i.e., moving along not across, faster than the clearing speed, not braking, and reaching the clear distance within the anticipation lead. The clearing speed V_d = 75 kt is deliberately high: a normal departure is well past it by the clear distance ξ_c = 762 m, so the gate never delays a real takeoff, but it excludes the line-up/early-roll band where an abort is still likely. The braking test is the key safety feature: a rejected takeoff, whose estimated acceleration turns below −a_RTO (= −0.5 m·s⁻²), is flagged the instant it begins to brake — whatever its current speed — because commitment, not velocity, decides whether the runway ahead will clear. A stationary, slow, crossing, or rejecting aircraft fails the test and remains a hazard.

5.2 Predicted crosser

When B is outside the band but within a lateral sanity bound (|η_B| < η_max = 1000 m), the logic does not wait for it to arrive. Its closure — the component of velocity toward the centerline, with n the runway normal — is

where,

and only a positive, significant closure (c > 0.5 m·s⁻¹) is treated as approaching. The closure and the lateral acceleration then give a time-to-enter τ_in, the smallest non-negative root of

where,

solved by the primitive of §6 (the lateral acceleration η̈ is the along-track acceleration projected onto the runway normal, taking the heading as fixed over the short horizon). B is a hazard if τ_in < τ_H (= 12 s): the light leads the entry, so a taxiing aircraft crossing the runway triggers the hazard warning before it reaches the surface, not after. The horizon τ_H is the principal sensitivity control: a controller can set it anywhere from 3 to 30 s from the EuroScope or vatSys plugin, trading earlier warning against fewer marginal activations.

(a) PGT25R brakes and holds short of the runway edge — τ_in stays above τ_H, so the THL stays off and THY5PG is clear to depart.

(b) PGT25R approaches fast — τ_in < τ_H = 12 s before it enters, so the THL lights and holds THY5PG.

5.3 Intersecting-runway conflict

A target traveling along a runway that crosses A's is excluded from the band rules above (at a shallow crossing angle they would misread it as an in-trail departure) and routed to the dedicated intersection-window model of §7. A track is classified as cross-runway traffic for A when it lies on some other runway r_B (within that runway's band and length) and is aligned with it to within Δψ_dep = 20°, and r_B geometrically crosses r_A. The whole array lights for such a conflict.

6. Kinematic primitives

Two constant-acceleration solvers underlie every prediction. The first returns the smallest non-negative time to cover a distance d from speed v₀ at acceleration a:

where,

It is used with the net closing distance and rate; if the discriminant is negative — the body decelerates to a stop short of d — the time is taken as +∞, which in the crosser and window tests means “never enters” or “stops inside and occupies” as appropriate. The second is a piecewise model that accelerates from v₀ at a up to a cap v_m and then travels with constant velocity:

where,

for the constant-velocity branch (d > d_a, the distance to reach the cap); below d_a it reduces to the accelerating form of the first solver.

7. The intersection-window model

Where runway r_B crosses r_A, conflict is decided not by position but by timing: would the protected aircraft A and the crosser B occupy the shared crossing region at the same time?

7.1 Crossing geometry

The runways cross only if they are not near-collinear — |sin θ| ≥ 0.17 (θ ≳ 10°) — and if r_B's two ends fall on opposite sides of r_A's centerline (s₀·s₁ < 0). The crossing point along r_A follows by linear interpolation of the lateral offset:

where,

The shared region is a parallelogram; its half-extent along each runway includes the other runway's width projected through the crossing angle, half the host runway's width, and a spatial pad:

where,

The 1/sin θ factor widens the window at shallow crossings, and the pad W_pad = 40 m adds a fixed margin at each edge.

7.2 Window-occupancy intervals and overlap

A's occupancy of the window is uncertain because its takeoff acceleration is unknown; its interval is taken over the whole airliner range (§8), earliest entry with the fastest acceleration and latest exit with the slowest:

where,

B's interval uses its measured approach: its earliest entry is propagated from its current closing speed at an assumed crossing-departure acceleration via the capped solver of §6; its latest exit uses B's own acceleration through the uncapped quadratic — which diverges to +∞ if B would stop inside the window, so a stalled crosser is treated as a standing occupant. The runway is unsafe when the two intervals overlap within a margin μ:

where,

A fast crosser that will clear the window before A could arrive produces no overlap and the lights stay off; a slow or stalling one keeps them red.

8. Anticipated separation and the acceleration window

In every regime the lights extinguish before the hazard is fully clear, the moment a safe gap is assured — the property the FAA calls anticipated separation [2]. In the occupancy rule this is the clear distance ξ_c reached with the lead τ_AS = 3.5 s; in the crosser rule it is the horizon τ_H; in the intersection rule it is the interval-overlap test itself.

where,

9. Per-fixture truncation under multiple line-up

When the nearest hazard B is itself lined up within the array — on the centreline (|η_B| ≤ h), aligned (|Δψ| ≤ Θ), and slow (v ≤ V₀) — the runway between A and B is unsafe but the runway beyond B is B's own to depart into. The lit set is truncated at the front aircraft:

where,

A crossing or rolling hazard does not truncate — the whole array lights — so only a stationary, aligned occupant shortens the array. The leading aircraft therefore always sees the clear pavement ahead and can depart while the trailing aircraft is held. This per-fixture lit extent is carried end-to-end (controller plugin → server → simulator) so the truncation is reflected fixture-by-fixture in the sim.

10. System realization in XPGuard

The logic above is a self-contained, dependency-free monitor: pure math on the observation tuple, with no network, simulator, or sector-file coupling. XPGuard realises it as a distributed pipeline so that controllers drive the surveillance and pilots see the result.

11. Parameters