atc1

8/3/2019 atc1

1/20

Kuchar and drumm

The Trafc Alert and Collision Avoidance System

VOLUME 16, NUMBER 2, 2007 LINCOLN LABORATORY JOURNAL 277

tinuously on a jet transport aircraft in todays environ-

ment could expect to survive more than 11,000 years oftravel before becoming the victim of a mid-air collision.This accomplishment has only recently been realized.

As shown in Figure 1, the number of hours flown annu-ally by jet transport aircraft has more than quadrupledsince 1970, but the rate of mid-air collisions over thatperiod of time has dropped by an order of magnitude.The result is that today we can expect one mid-air colli-sion every 100 million flight hours. Such an exceptionalsafety level was achieved through advances in air traf-fic surveillance technology and relentless attention toimproving operational procedures. But as the Septem-

ber 2006 mid-air collision between a Boeing 737 andan Embraer Legacy 600 business jet over the Amazon

jungle in Brazil demonstrates, maintaining safety is anever present challenge. This challenge has been eased,but not eliminated, with the development and deploy-ment of TCAS.

TCAS is one component of a multi-layered defenseagainst mid-air collisions. The structure of airspace and

Acollision between aircraft is one of the

most sudden and catastrophic transportationaccidents imaginable. These tragic events are

rarely survivablehundreds of people may die as thetwo aircraft are destroyed. In response to this threat,Lincoln Laboratory has been pursuing surveillance andalerting system technologies to protect aircraft opera-tions both on the ground and in the air. Recent devel-opments in the Runway Status Lights Program, for ex-ample, greatly reduce airport-surface collision risk dueto runway incursions [1]. In the air, other systems havebeen developed and are currently in use to prevent mid-air collisions. This article focuses on the widely fielded,

crucial technology called the Traffic Alert and CollisionAvoidance System (TCAS). In the context of integratedsensing and decision support, TCAS illustrates the par-ticular challenge of developing effective decision aidsfor use in emergency situations involving extreme timepressure.

Despite the terrifying prospect of a mid-air collision,aviation travel is incredibly safe. A person who flew con-

The Traffic Alert and Collision

Avoidance SystemJames K. Kuchar and Ann C. Drummn The Traffic Alert and Collision Avoidance System (TCAS) has had

extraordinary success in reducing the risk of mid-air collisions. Now mandated on

all large transport aircraft, TCAS has been in operation for more than a decade

and has prevented several catastrophic accidents. TCAS is a unique decision

support system in the sense that it has been widely deployed (on more than

25,000 aircraft worldwide) and is continuously exposed to a high-tempo, complex

air traffic system. TCAS is the product of carefully balancing and integrating

sensor characteristics, tracker and aircraft dynamics, maneuver coordination,operational constraints, and human factors in time-critical situations. Missed

or late threat detections can lead to collisions, and false alarms may cause pilots

to lose trust in the system and ignore alerts, underscoring the need for a robust

system design. Building on prior experience, Lincoln Laboratory recently

examined potential improvements to the TCAS algorithms and monitored

TCAS activity in the Boston area. Now the Laboratory is pursuing new collision

avoidance technologies for unmanned aircraft.

8/3/2019 atc1

2/20

Kuchar and drumm


278 LINCOLN LABORATORY JOURNAL VOLUME 16, NUMBER 2, 2007

operational procedures provide the first, strategic layerof protection. Traffic flows are organized along airwaysat segregated altitudes to aid air traffic controllers (ATC)in managing aircraft and predicting potential conflicts

well before problems arise. Aircraft are normally keptthree to five miles apart laterally or 1000 ft vertically,to provide sufficient safety margins. Air traffic controlensures that separation minima are not violated by is-suing tactical commands (including altitude restrictionsand heading change vectors) to the pilots in response tonearby traffic. Should these nominal traffic separation

processes fail, the TCAS system aids pilots in visuallyacquiring potential threats and, if necessary, provideslast-minute collision avoidance guidance directly to theflight crew.

It is obviously imperative that TCAS alert the flightcrew early enough that evasive action can be taken. Butit is also important that TCAS not alert unnecessarily.Collision avoidance alerts represent high-stress, time-critical interruptions to normal flight operations. Theseinterruptions, in addition to distracting the aircraftscrew, may lead to unnecessary maneuvering that dis-rupts the efficient flow of traffic and may over time also

cause pilots to distrust the automation.This article outlines some of the challenges in achiev-

ing this balance. A critical aspect is the need to accu-rately model sensors, system dynamics, and human in-volvement in the collision avoidance process. The widedeployment of TCAS provides a wonderful opportunityto collect feedback on performance and to understandthe environment in which the system operates. It also

highlights the fact that TCAS does notoperate in a vacuum and any technologi-cal progress needs to mesh into a contin-

uously operating environment.histoy

Interest in development of a collisionavoidance system dates back to at leastthe mid-1950s, when a mid-air collisionoccurred between two U.S. air carrier air-craft over the Grand Canyon. For severaldecades thereafter, a variety of approach-es to collision avoidance were explored,until 1974, when the Federal Aviation

Administration (FAA) narrowed its fo-cus to the Beacon Collision AvoidanceSystem (BCAS), a transponder-based

airborne system. In 1978, a second mid-air collisionoccurred near San Diego between an air carrier and ageneral-aviation aircraft, leading to the expansion ofthe BCAS effort; in 1981, the name was changed to theTraffic Alert and Collision Avoidance System (TCAS).

A third mid-air collision in 1986 near Cerritos, Cali-fornia, prompted Congress in 1987 to pass legislationrequiring the FAA to implement an airborne collisionavoidance system by the end of 1992. The mandate ap-plied to all large (more than 30 passenger seats) turbine-powered aircraft in the United States. A subsequent law

extended the original deadline by one year to the end of1993. The first commercial TCAS systems began flyingin 1990.

Monitoring and safety assessments led to a series ofchanges resulting in an international version of TCASreferred to as Version 7, or the Airborne Collision

Avoidance System (ACAS). Starting in January 2003,the International Civil Aviation Organization mandatedthe use of ACAS worldwide for all turbine-powered air-craft with passenger capacity of more than 30 or withmaximum take-off weight exceeding 15,000 kg. In Jan-uary 2005, that mandate was extended to cover aircraft

with more than 19 passenger seats or maximum take-offweight of more than 5700 kg. Today, more than 25,000aircraft worldwide are equipped with TCAS.

Lincoln Laboratorys involvement in BCAS/TCASdates back to 1974, when the FAA tasked the Labora-tory to develop the surveillance subsystem and MITRECorp. to develop the collision avoidance algorithms,also known as the threat logic. Lincoln Laboratorys sur-

FIGURE 1. Worldwide annual flight hours and mid-air collision rate (collisionrate based on a ten-year moving average). Flight hour data are from Boeing.

1990 2004

10

0

20

30

40

199519851980197519700

0.02

0.04

0.06

0.08

0.10

2000

Mid-air collision rate(per million flight hours)

Worldwide annualjet transport flight hours

(millions)

Year

8/3/2019 atc1

3/20

Kuchar and drumm



veillance activities continued throughout the next threedecades; significant development took place during theBCAS-to-TCAS transition and during the design ofTCAS Version 7 [2].

Lincoln Laboratory was involved in two additionalTCAS activities besides surveillance development. In themid-1970s the Laboratory, using first a Lincoln Labora-torydeveloped prototype Mode S sensor and then FAAproduction Mode S sensors, began TCAS-related moni-toring of aircraft in the Boston airspace. Early monitor-ing focused on identifying transmitted data errors that

would impact the performance of a collision avoidancesystem, such as garbled aircraft-reported altitude. Latermonitoring focused on assessing the appropriateness ofcollision avoidance advisories and the impact of theseadvisories on airspace operation.

In the mid-1990s, the Laboratory undertook a thirdarea of activityassessing the threat logic. Because ofthe growing complexity of the threat logic, LincolnLaboratory and the FAA William J. Hughes TechnicalCenter began developing simulation and analysis toolsto perform specific types of threat-logic assessment. This

work was a precursor to the much more complex Lin-coln Laboratory simulation tool that we describe later.

how TcaS Woks

TCAS processes are organized into several elements, asshown in Figure 2. First, surveillance sensors collect state

information about the intruder aircraft (e.g., its relativeposition and velocity) and pass the information to a setof algorithms to determine whether a collision threat ex-ists. If a threat is identified, a second set of threat-reso-lution algorithms determines an appropriate response.If the intruder aircraft also has TCAS, the response iscoordinated through a data link to ensure that eachaircraft maneuvers in a compatible direction. Collisionavoidance maneuvers generated and displayed by TCASare treated as advisories to flight crews, who then takemanual control of the aircraft and maneuver accord-ingly. Pilots are trained to follow TCAS advisories unless

doing so would jeopardize safety. The following sectionsprovide more detail on the methods used to performsurveillance, threat detection, and threat resolution.

Surveillance

Surveillance of the air traffic environment is based onair-to-air interrogations broadcast once per second fromantennae on the TCAS aircraft using the same frequen-

Threat

resolution

CoordinationResponseselection

Pilot

Trafficdisplay

Threatdetection

Trajectoryextrapolation

Surveillance

Time to collision

ReplyInterrogation

Intruder aircraft

TCAS

Range,

bearing,

altitude

Flightcontrols

Other information sources(ATC, visual acquisition)

Maneuvertemplates

Resolutionadvisory display

FIGURE 2. TCAS relies on a combination of surveillance sensors to collect data on the state of intruder aircraftand a set of algorithms that determine the best maneuver that the pilot should make to avoid a mid-air collision.

8/3/2019 atc1

4/20

Kuchar and drumm



cy (1030 MHz) and waveform as ground-based air traf-fic control sensors [3]. Transponders on nearby intruderaircraft receive these interrogations and send replies at

1090 MHz. Two types of transponders are currently inuse: Mode S transponders, which have a unique 24-bitidentifier, or Mode S address, and older Air Traffic Con-trol Radar Beacon System (ATCRBS) transponders,

which do not have unique addressing capability. To track ATCRBS intruders, TCAS transmits ATCRBS-onlyall-call interrogations once per second; all ATCRBSaircraft in a region around the TCAS aircraft reply. Incontrast, Mode Sequipped intruders are tracked witha selective interrogation once per second directed at thatspecific intruder; only that one aircraft replies. Selectiveinterrogation reduces the likelihood of garbled or over-lapping replies, and also reduces frequency congestionat 1030/1090 MHz.

Replies from most ATCRBS and all Mode S tran-sponders contain the intruders current altitude abovesea level. TCAS computes slant range on the basis ofthe round-trip time of the signal and estimates the bear-ing to the intruder by using a four-element directionalantenna. Alpha-beta and non-linear filters are used toupdate range, bearing, and altitude estimates as well asto estimate range rate and relative-altitude rate. Mode Stransponders also provide additional data-link capabili-

ties. All aircraft with TCAS are equipped with Mode Stransponders so that this data link can coordinate colli-sion avoidance maneuvers.

One of the most difficult challenges in the develop-ment of TCAS is balancing the surveillance require-ments of TCAS and air traffic control ground sen-sorsin particular, managing their shared use of the1030/1090 MHz frequencies. As the density of TCAS-equipped aircraft grows, transponders in an airspace areinterrogated by more and more TCAS units. As a result,transponders now devote more of their time to respond-ing to TCAS and less of their time responding to groundinterrogations. Because of concerns about frequencycongestion, TCAS uses interference-limiting algorithmsto reduce competition between TCAS and ground sen-sors. Each second, TCAS determines the number anddistribution of other TCAS units in its vicinity. Withthat information, TCAS can reduce its maximum trans-mit power (i.e., reduce its surveillance range)limitingthe impact on the victim transponders and, in turn, onthe ground sensors.

National and international requirements in this areaare quite strict. Interference limiting is intended to en-sure that for any given transponder, no more than 2% ofits available time is consumed in communications withall nearby TCAS units. Because TCAS requires a mini-

mum surveillance range to provideadequate collision avoidance protec-

tion, however, a limit is imposed onhow much the TCAS transmit pow-er can be reduced. As a result, it ispossible for a transponder to exceedthe 2% utilization figure in high-density airspace. Transponder uti-lization due to TCAS has been thefocus of worldwide monitoring, andmonitoring results continue to mo-tivate the development of innova-tive TCAS surveillance techniques.Many such techniques were devel-

oped for Version 7, including usingMode S interrogation schemes thatare different for distant, non-threat-ening intruders than for potentialthreats, and transmitting sequencesof variable-power ATCRBS interro-gations to reduce garble, or overlap,among concentrations of ATCRBS

FIGURE 3. TCAS is an advisory systemi.e., it tells the pilot what to do to avoid

collision but does not take control of the aircraft. Here, a TCAS traffic display(left) indicates that a threatening intruder aircraft is approximately 14 nauticalmiles ahead and to the right of the TCAS aircraft; this aircraft is 100 ft above theTCAS aircraft and is descending. A second, non-threatening intruder aircraft lo-cated about 22 nautical miles ahead is flying level 2500 ft above the TCAS aircraft.The Resolution Advisory (RA) display (right) indicates that the aircraft is flyinglevel (i.e., vertical speed of 0). TCAS is instructing the pilot to climb at a rate of1500 to 2000 ft/min, as shown by the green arc. The red arc on the display indi-cates vertical rates that do not comply with the RA.

8/3/2019 atc1

5/20

Kuchar and drumm



intruders. In addition, standards are nearing completionfor TCAS Hybrid Surveillance. This is a new techniquethat allows TCAS to make use of passive (Automatic

Dependent SurveillanceBroadcast, or ADS-B) trans-missions, thereby reducing TCAS interrogation rates.Two other issues affect the ability of TCAS to track

intruders. First, some older transponders do not reportaltitude information when interrogated. TCAS can notgenerate collision avoidance commands against thesethreats. (Large aircraft, aircraft flying in the vicinity oflarge airports, and aircraft flying above 10,000 ft are re-quired to be equipped with altitude-reporting transpon-ders.) Second, aircraft without a functioning transpon-der cannot be detected or tracked by TCAS at all. Somesmall aircraft, such as gliders or ultralights, may notcarry any electronic equipment or transponders. Pilotstherefore must take the responsibility to see and avoidsuch traffic.

Threat Detection and Display

TCASs complex threat-detection algorithms begin byclassifying intruders into one of four discrete levels [4].To project an aircrafts position into the future, the sys-tem performs a simple linear extrapolation based on theaircrafts estimated current velocity. The algorithm thenuses several key metrics to decide whether an intruderis a threat, including the estimated vertical and slant-range separations between aircraft. Another parameter,

called tau, represents the time until the closest point ofapproach between aircraft.

A display in the cockpit depicts nearby aircraft, in-dicating their range, bearing, and relative altitude; anarrow indicates whether the intruder is climbing or de-scending. Such traffic display information aids the pi-lot when attempting to visually acquire traffic out the

windscreen. Distant, non-threatening aircraft appear ashollow diamond icons. Should the intruder close withincertain lateral and vertical limits, the icon changes toa solid diamond, alerting the flight crew that traffic isproximate but is not yet a threat.

If a collision is predicted to occur within the next 20to 48 seconds (depending on altitude), TCAS issues atraffic advisory (TA) in the cockpit. This advisory comesin the form of a spoken message, traffic, traffic. Thetraffic icon also changes into a solid yellow circle. TheTA alerts the pilot to the potential threat so that thepilot can search visually for the intruder and commu-nicate with ATC about the situation. A TA also serves

as a preparatory cue in case maneuvering becomes re-quired. If the situation worsens, a resolution advisory(RA) warning is issued 15 to 35 seconds before collision

(again depending on altitude). The RA includes an auralcommand such as climb, climb and a graphical displayof the target vertical rate for the aircraft. A pilot receiv-ing an RA should disengage the autopilot and manuallycontrol the aircraft to achieve the recommended verticalrate. Figure 3 shows both the traffic and RA displays.

Threat Resolution

Once the criteria for issuing an RA have been met,TCASs threat-resolution algorithms determine whatmaneuver is appropriate to avoid a collision. First,the algorithm decides the vertical sense of the maneu-verthat is, whether the aircraft needs to climb or todescend. Second, the system figures the strength of theRAthat is, how rapidly the plane needs to change itsaltitude. TCAS works only in the vertical direction; itdoes not select turning maneuvers, because bearing ac-curacy is generally not sufficient to determine whether aturn to the left or right is appropriate.

Figure 4 shows a simplification of the sense-selectionprocess. In general, two maneuver templates are exam-ined: one based on a climb, and one based on a descent.Each template assumes a 5 sec delay before a responsebegins, followed by a 0.25 g vertical acceleration untilreaching a target vertical rate of 1500 ft/min. In the

meantime, the intruder aircraft is assumed to continuein a straight line at its current vertical rate. The TCASalgorithm selects the maneuver sense providing the larg-est separation at the predicted closest point of approach.In the situation shown in Figure 4, TCAS would on thebasis of these criteria advise the aircraft to descend.

If the intruder is also TCAS equipped, the sense ofthe RA is coordinated through the Mode S data link toensure that both aircraft do not select the same verti-cal sense. Should both aircraft simultaneously select thesame sensesay, both select a climb RAthe aircraft

with the lower numerical-valued Mode S address has

priority and will continue to display its climb RA. Theaircraft with the higher Mode S address will then reverseits sense and display a descend RA.

Once the sense has been selected, the strength of theRA maneuver is determined by using additional maneu-ver templates (Figure 5). Each template again assumesa 5 sec delay, followed by a 0.25 g acceleration to reachthe target vertical rate. TCAS selects the template that

8/3/2019 atc1

6/20

Kuchar and drumm



requires the smallest vertical-rate change that achievesat least a certain minimum separation. In the exampleshown in Figure 5, the TCAS aircraft is currently de-scending at a rate of 1000 ft/min when an RA is issued.Five maneuver templates are examined, with each tem-plate corresponding to a different target vertical rate.The minimum-strength maneuver that would providethe required vertical separation of at least 400 ft wouldbe to reduce the descent rate to 500 ft/min; the pilot

would receive an aural message stating that instruction.Descent rates exceeding 500 ft/min would appear in redon the RA display. Note that in Figure 5 if the intruder

were 100 ft higher, then the selected RA would insteadbe dont descend. If the intruder were another 100 fthigher still, the selected RA would be climb.

Due to TCASs 1 Hz update rate and filtering lags,its estimates may lag the actual situation during peri-ods of sudden acceleration. This lag may in turn lead

to an inappropriate RA sense or strength. To help allevi-ate this problem, TCAS refrains from issuing an RA ifthere are large uncertainties about the intruders track.

TCAS also includes algorithms that monitor the evolu-tion of the encounter and, if necessary, issue a modifiedRA. The strength of an RA can be increasedfor ex-ample, changing from dont descend to climb (targetrate of 1500 ft/min) to increase climb (target rate of2500 ft/min). Under certain conditions, if it becomesclear that the situation is continuing to degrade, TCAScan even reverse the sense of the RA, from climb to de-scend, or vice versa. Coordination of this reversal with aTCAS-equipped intruder aircraft will also be performedthrough the Mode S data link. Sense reversal is especial-ly challenging because only a few seconds may remainbefore collision. Any latencies involved in pilot and air-craft response could result in an out-of-phase responsethat further reduces separation.

Pefoe assesset

The main functions of TCAS are to identify a poten-

tial collision threat, communicate the detected threat tothe pilot, and assist in the resolution of the threat byrecommending an avoidance maneuver. As an alerting

FIGURE 5. Once TCAS determines whetherto advise an aircraft to climb or to descend, itcalculates the speed at which the plane mustmaneuver to avoid collision. TCAS selectsthe template that requires the smallest change

in vertical rate that achieves the requiredseparation.

Own TCAS

Vertical separation (feet)at closest point of approach

600

500

400 Requiredminimumseparation300

200

100

Res

ulto

f clim

b

Resultoflimitdescent1000ft/min

Resu

ltoflimitdescent2000ft/m

in

Resultoflimitdescent500ft/m

in

Resultof

dontdescend

Resulto

fclim

b

Resultofdescend

CPA

Descend

sense

selected

Own TCAS

FIGURE 4. The TCAS algorithm selects themaneuver sensethat is, whether to climbor descendthat provides the largest separa-tion at the predicted closest point of approach(CPA). In the scenario shown here, the correctmaneuver would be to descend.

8/3/2019 atc1

7/20

Kuchar and drumm



system, TCAS operates quietly in the background mostof the time. When the algorithms determine that actionis needed, TCAS interrupts the flight crew to bring the

threat to their attention. This interruption may be vi-tally important if the pilots are not aware of the threat.In some situations, however, aircraft may operate safelyclose together; in those cases, the TCAS alerts are moreof a nuisance than a help. An example is during an ap-proach to closely spaced parallel runways. In good vis-ibility conditions, pilots can be given the authority tomaintain separation from parallel traffic by monitoringnearby aircraft visually through the windscreen. TCAS,however, does not know that visual separation is beingused and may issue a TA or an RA, thus introducinga distraction on the flight deck when pilots should beespecially focused on performing their approach proce-dures. TCAS does inhibit issuing RAs when an aircraftis less than 1000 ft above the ground, both to reducenuisances at low altitude and to help ensure that anyTCAS advisories do not conflict with potential terrainhazards.

TCAS operates in a complex, dynamic environment.Each decision maker (Air Traffic Control, pilots, TCASitself) uses different information sources and operatesunder different constraints and with different goals.TCAS may have more accurate range or altitude in-formation about an intruder than flight crews or ATCdo. But TCAS cannot observe all the factors affecting

a traffic encounter, such as the location of hazardousweather, terrain, aircraft without transponders, or ATCinstructionsa major reason that TCAS is certified tooperate only as an advisory system. Pilots are ultimately

responsible for deciding on the correct course of action,weighing TCAS alerts with the other information avail-able to them.

TCAS is extremely successful in providing a last-re-sort safety net, and does not necessarily need to operateperfectly to be effective. Still, it is important to iden-tify situations where TCAS may have difficultyand,if possible, modify the logic to better handle suchcircumstances.

Lessos fo disste

On the night of 1 July 2002, a Boeing B-757 oper-ated by the cargo carrier DHL collided with a RussianTu-154 passenger jet at 34,940 ft over the small townof berlingen, Germany (Figure 6). The accident de-stroyed both aircraft and killed all 71 crew members andpassengers aboard the two planes. What was especiallytroubling about this accident is that both aircraft wereequipped with TCAS.

As with most aviation accidents, a string of eventsoccurred leading up to the collision. First, the nominalseparation standards between aircraft were lost througha combination of problems and errors at the air trafficcontrol facility monitoring the aircraft. As a result, thetwo aircraft were on a collision course much closer to-gether than is normal while cruising at 36,000 ft.

Figure 7 schematically summarizes the event. Forty-three seconds before the collision, ATC instructed the

Russian aircraft to descend because of the traffic con-flict. Before the controller finished his verbal instruc-tion, however, TCAS on the Russian aircraft issued anRA advising the pilot to climb. A coordinated descend

Russian

Tu-154

DHL B-757

FIGURE 6. A mid-air collision over berlingen, Germany, in 2002 killed 71 peopleeven though both planes were equipped withTCAS. (Photograph source: German accident investigation report.)

8/3/2019 atc1

8/20

Kuchar and drumm



RA was issued on the DHL aircraft at the same time.The DHL pilots followed their RA and began to de-scend; the Russian flight crew followed the ATC instruc-tion and also descended. Shortly thereafter the RAs oneach aircraft were strengthened to increase climb onthe Russian aircraft and increase descent on the DHLaircraft. About 35 seconds after the TCAS RAs were is-sued, the aircraft collided.

One of the immediate causes for the accident, asdescribed in the German accident report, was the factthat the Russian flight crew chose to follow the ATCclearance to descend rather than follow the TCAS RAto climb [5]. The Russians choice to maneuver oppositeto the RA defeated the coordination logic in TCAS. Anadvisory system like TCAS cannot prevent an accident

if the pilots dont follow the systems advice. The DHLcrew, however, did follow the TCAS RA and yet theystill collided. The question thus arises: why didnt TCASreverse the sense of the RAs when the situation con-tinued to degrade? Had it done so, the Russian aircraft

would have received a descend RA, which presumably itwould have followed, since the crew had already decidedto descend in response to the ATC clearance. The DHLaircraft would have received a climb RA, which it like-

wise would have presumably followed, since its crew hadobeyed the original RA. This is not to say that a reversalis always a good idea, however. In many encounters, a

reversal would reduce separation and increase the riskof a collision. Because of sensor limitations and filteringlags, it turns out to be quite difficult to trigger reversals

when they are needed while avoiding them when theyare not needed.

A closer examination of the reversal logic revealedseveral areas in which earlier design assumptions provedinadequate in situations when one aircraft maneuvers

opposite to its RA. In order for an RA reversal to beissued, the Version 7 threat logic requires four basic con-ditions to be satisfied; these conditions are illustrated inFigure 8. First, a reversal will be triggered only by theaircraft with prioritythat is, the aircraft with the lowerMode S address. If the aircraft has a higher Mode S ad-dress than the intruder, the RA sense will be reversedonly when directed to do so by the priority aircraftthrough the data link. Second, the maneuver templatesprojecting the situation into the future need to predictthat insufficient separation between aircraft will oc-cur unless a sense reversal is issued. Third, a maneuvertemplate projecting the response to a reversed-sense RAneeds to predict adequate separation between aircraft.Fourth, the two aircraft in danger of colliding must be

separated by at least 100 ft vertically. (This last condi-tion is intended to prevent reversals from occurring justas aircraft cross in altitude.)

A closer look at the berlingen accident, as shown inFigure 9, reveals why TCAS did not issue an RA rever-sal. Responsibility for triggering the reversal rested withthe Russian aircraft, which had a lower Mode S address.The Russian aircraft was operating under an activeclimb RA. The climb-RA maneuver template predictedadequate separation between aircraft, at least until thefinal few seconds; therefore, TCAS did not issue an RAreversal. Since the Russian aircraft was not actually fol-

lowing the climb maneuver, of course, the templatespredictions were invalid.

What is startling, however, is that even if the DHLaircraft had the lower Mode S address (and thereforepriority), the planes still probably would have collided.In the hypothetical case in which the DHL aircraft hadpriority, three of the four conditions required to trig-ger a reversal, as shown in Figure 8, would have held:

FIGURE 7. The berlingen mid-air collision occurred after the Russian pilot decided to heed the airtraffic control instruction to descend rather than the TCAS advisory to climb.

Actualtrajectory

TCAS

trajec

tory

Climb, climb

Russian Tu-154

Descend, descend

DHL B-757

ATC instruction

to descend

8/3/2019 atc1

9/20

Kuchar and drumm



the DHL aircraft would have had priority; the DHLaircrafts descend RA would have shown that a collision

was still predicted; and the projection of a reversal-climbRA would have predicted adequate separation. How-ever, both aircraft remained within 100 ft vertically ofeach other throughout the encounter, and so this fourthcriterion for permitting a reversal still would not havebeen met.

To reduce the risk of this type of collision, research-ers funded by the European Organization for the Safe-ty of Air Navigation, or Eurocontrol, have proposed a

change to the TCAS threat logic. Eurocontrols proposalaims to improve reversal performance in encountersin which both aircraft become involved in a so-calledvertical chase, as occurred at berlingen. The proposalincludes two major components. First, when using ma-

neuver templates, TCAS would no longer assume thatthe TCAS aircraft would follow its RA. Instead, TCAS

would check the recent vertical motion of the aircraft; ifthis motion is not compatible with the RA that had beenissued, then TCAS would revert to models using theaircrafts current vertical rate instead of its predicted mo-tion in response to the RA. Second, the proposal wouldeliminate the 100 ft separation requirement, allowingTCAS to reverse sense in vertical-chase situations. Thecombination of these changes would have produced RAreversals in the berlingen accidentno matter which

aircraft had priority. Starting in 2004, the FAA fundedLincoln Laboratory to answer two fundamental ques-tions: how often do RA reversal problems occur in U.S.airspace, and how effective would the European changeproposal be?

FIGURE 8. In order for TCAS to reverse its maneuver instructione.g., from descend to climbfour con-ditions must hold. (1) The reversal can be triggered only by the aircraft with priority. (2) The maneuver templatemust predict that insufficient separation between aircraft will occur if the present RA is followed. (3) A maneu-ver template must predict that a reversed RA will result in adequate separation between aircraft. (4) The two air-craft in danger of colliding must be separated by at least 100 ft vertically.

4. Must currently be

separated by >100 ft 3. Reversed RA

is adequate

1. Has priority

2. Current RA

is not adequate

Descend, descend

Russian Tu-154TCAS trajectory

Climb, climb

Russian aircraft DHL aircraft

Descend, descend

DHL B-757

Descend, descend now Climb, climb now

FIGURE 9. The berlingen accident might have been averted if TCAS had issued an RA reversal as shown. Respon-sibility for triggering the reversal rested with the Russian aircraft, which had priority and which was operating under aclimb RA. But until the final few seconds, the climb RA maneuver template predicted adequate separation betweenaircraft; therefore, TCAS did not issue an RA reversal. Since the Russian aircraft was not actually following the climbmaneuver, but rather the air traffic control instruction to descend, the templates predictions were tragically invalid.

8/3/2019 atc1

10/20

Kuchar and drumm



TcaS moitoig

Following the berlingen accident, researchers set

about monitoring the European airspace to estimatehow common this type of situation was. A total of tenevents, including the berlingen accident, were posi-tively identified in which one aircraft flew opposite toits RA, a reversal did not occur, and either a collision ornear miss occurred. Eurocontrol estimated on the ba-sis of the number of flight hours examined that thesetypes of situations occur more than fifty times per yearin European skies, and that a mid-air collision in Eu-rope due to this problem might be expected once everyfour years.

In recent years, several countriesthe United States,Britain, France, Germany, and Japanhave been moni-toring TCAS to find out if the systems advisories areappropriate and to understand the impact that theseTCAS advisories have on airspace operation. All U.S.monitoring/analysis has been performed at LincolnLaboratory, using an FAA production Mode S sensorlocated in Lexington, Massachusetts. Following theberlingen accident, the FAA tasked Lincoln Labora-tory to begin monitoring for occurrences of the type ofsituation described above. To accomplish this, we passsensor data through a series of software tools (Figure 10)to examine the details of TCAS events occurring in theBoston area airspace.

Procedures for transmitting TCAS RA informationto Mode S ground sensors are a part of the basic Mode Sand TCAS designs. Whenever TCAS issues an RA to an

aircraft within the coverage area of a Mode S sensor, theaircrafts transponder automatically informs this groundsensor that information is available for read-out. Oneach radar sweep over the duration of the RA, the sensorrequests the aircrafts RA Report. This report containsthe Mode S address of the TCAS aircraft, the type ofRA, and (for TCAS Version 7) an identification of theintruder triggering the RA.

Correlation of RA Reports with the TCAS aircraftsurveillance data is performed via the aircrafts uniqueMode S address, which is present in both the RA reportsand the aircraft surveillance data, as well as via timestamps, which are applied by the sensor and show thetime of receipt for all communication and surveillancedata. All datacommunication and surveillancearerecorded for later playback and analysis.

As shown in Figure 10, Lincoln Laboratory per-forms four types of processing: statistics; pilot response(compliance with RAs); filtering for specific events; andplayback. We discuss the first three types in the follow-ing sections. The fourth, the playback feature, allowsdetailed review of the TCAS logic performance. The5 sec radar surveillance position reports are convertedto 1 sec inputs for TCAS. The data can then be playedthrough one of several different versions of the TCAS

FIGURE 10. A Lincoln Laboratory facility monitors TCAS operations in the United States to find out if the systemsadvisories are appropriate and to understand the impact that these TCAS advisories have on airspace operation.

Statistics

e.g., RA number, type

location, version

Playback Analysis

Playback radar

data through

selected TCAS

logic version

6.04A, 7, CP112E

Pilot response Filtering

Filter for close

encounters,

reversals

Encounter plots

OppositeProper

Partial

Data

recordingcomputer

RA reports

Mode S sensor

Comm data

Manually examineplots for safety issues

Surveillance data

8/3/2019 atc1

11/20

Kuchar and drumm



logic, allowing comparison of the performance of dif-ferent TCAS versions, or examination of the effect ofa proposed logic change. The playback can be stepped

through the encounter in 1 sec increments and allowsviewing of key TCAS logic parameters at each step.Figure 11 shows the location of RAs as recorded by

the Lincoln Laboratory monitoring program from June2005 through January 2006. Over this time period,monitoring took place for approximately 190 days, androughly 200,000 Mode S flight hours were observed

within the sensors 60-nautical-mile coverage area. Weobserved a total of 1725 RA events, corresponding toan average of 9 RAs per day, or about one RA every 116flight hours.

This RA rate is typically an order of magnitude largerthan that in European terminal airspace. The higherRA rate in Boston is thought to be due, at least in part,to U.S. air traffic control use of visual-separation pro-cedures when visual meteorological conditions (VMC)prevail, increasing the number of encounters in whichaircraft pass each other safely even though they are with-in TCAS RA thresholds. In particular, Figure 11 shows anumber of RAs along the parallel approaches to runways4L and 4R at Bostons Logan Airport. In VMC, aircraftmay be vectored onto final ap-proaches to these two runways asthe pilots accept responsibility ofmaintaining safe separation from

the parallel traffic. In some cases,TCAS may still alert because ofthe close proximity of aircraft.Many of the RAs elsewhere inthe airspace are due to the largedensity of small general-avia-tion aircraft in the United Statesthat may operate more closely toother air traffic in VMC than istypical in Europe.

When air traffic control al-lows use of visual-separation

procedures, pilots may ignore anRA, or move contrary to the RA,because the intruder aircraft is insight. Pilot non-compliance toan RA may not necessarily com-promise safety in a particular en-counter. It can, however, lead toa degrading situation in which a

FIGURE 11. The location of RA events as recorded by the Lincoln Laboratory monitor-ing program for the time period June 2005 through January 2006. Over this time peri-od, monitoring took place for approximately 190 days, and roughly 200,000 Mode S flighthours were observed within the sensors 60 nmi coverage area. We observed a total of1725 RA events, corresponding to an average of 9 RAs per day, or approximately one RAevery 116 flight hours.

reversal will not occur when necessary, such as at ber-lingen. Examination of pilot response is therefore a keycomponent of the Lincoln Laboratory monitoring.

As an example, Figure 12 shows pilot response toclimb RAs during the eight-month period from June2005 through January 2006. For a climb RA, TCAS ex-pects the pilot to begin to maneuver within 5 sec andto achieve a 1500 ft/min vertical rate. If the aircraft isalready climbing faster than 1500 ft/min, the RA isinstead maintain climb, and the pilot is expected tocontinue at the current rate. The delay in pilot response

was estimated as the time required for the vertical rate tochange by at least 400 ft/min.

Examination of the data shown in Figure 12 indi-cates that only 13% of pilot responses met the assump-tion used by TCAS: pilot responses within 5 secondsand achieving a 1500 ft/min vertical rate. In 63% ofthe cases, the pilots maneuvered in the proper directionbut were not as aggressive or prompt as TCAS assumed.Pilots maneuvered in the opposite direction to the RAin 24% of the cases. Some of these opposite responsesare believed to be due to visual acquisition of the in-truder aircraft and the pilots decision that following theRA was not necessary. Although such a decision may

8/3/2019 atc1

12/20

Kuchar and drumm



be reasonable in certain cases, the fact remains that ma-neuvering opposite to the TCAS RA invites exactly thekind of vertical chase that happened at berlingen. The

European change proposal would provide an additionalsafety net should such a vertical chase occur and aircraftcontinue to move on a collision course.

detetig revesl Pobles

A key part of Lincoln Laboratory monitoring effortssince mid-2004 has been to find instances of RA rever-sal problems in the Boston airspace. Automated toolsextract encounters in which a TCAS RA occurs and sep-aration between aircraft is small. These encounters arethen examined to find those in which the two aircraftmoved in the same vertical direction after the start of

the RA event.The Lincoln Laboratory monitoring program detect-

ed two RA reversal problem events. Figure 13 diagramsone of these encounters, in which a TCAS-equipped air-craft came within 0.3 nmi horizontally and 100 ft ver-tically of another aircraft that did not have TCAS. Asthe aircraft neared each other, TCAS issued a descendRA, which the pilot followed. At about the same time,

however, the non-TCAS aircraft also began a descent,presumably on the basis of visual identification of theTCAS aircraft and an attempt to avoid a collision.

TCAS then issued an increase descent RA, which thepilot again followed. At the same time, the non-TCASaircraft also increased its descent rate. TCAS maintainedthe descend sense even after the non-TCAS aircraft haddropped below the TCAS aircraft. TCAS did eventuallyissue a reversal, instructing the aircraft to climb. How-ever, this reversal occurred essentially as the two aircraftpassed each other and was too late to be of benefit. Thisencounter, which took place in April 2005, is of thesame general type as that in the berlingen accident inthat an RA reversal should have been issued earlier. Thefindings of the Lincoln monitoring program indicate

that RA reversal problems occur in U.S. airspace at arate comparable to that in Europe.

assessig Sfety

Safety analysis of TCAS is based in part on a compre-hensive, statistically valid set of data describing TCASperformance across a wide range of encounter situations.Specific problem situations also need to be identified

FIGURE 12. Pilot compliance with climb RAs. Each circle corresponds to oneRA event for a TCAS aircraft. The green-shaded region indicates responses thatachieved the intended vertical rate; the yellow segment indicates responses thatwere in the correct direction but did not achieve the intended vertical rate; the redshading indicates responses that were in the wrong direction.

5000 4000 3000 2000 1000 1000 2000 3000 4000 50000

Vertical rate prior to RA (ft/min)

5000

4000

3000

2000

1000

1000

2000

3000

4000

5000

0

VerticalrateduringRA(

ft/min

)

< 5 sec

510 sec

> 10 sec

Pilot response delay

8/3/2019 atc1

13/20

Kuchar and drumm



and judged as to their criticality and likelihood. Exten-sive flight testing is required to support modeling sen-sor performance, automation, human interaction withTCAS advisories, and flight characteristics. However,flight tests alone cannot provide enough data to makea complete system assessment. Thus a combination of

modeling based on flight experience and fast-time simu-lation of many encounters is needed.

A key performance metric is the reduction in colli-sion risk achieved by equipping with TCAS. This risk isexpressed in terms of Near Mid-Air Collision (NMAC)events, defined to occur when separation between twoaircraft is less than 100 ft vertically and 500 ft hori-zontally. The probability of Near Mid-Air Collision isP(NMAC). The ratio ofP(NMAC) when TCAS is usedto P(NMAC) without TCAS is commonly referred toas the risk ratio. Changes in TCAS algorithms, such asthose included in the European change proposal, can be

evaluated by examining their effect on risk ratio.Assessment of safety requires more than simply the

application of a single analytical model. Several toolsmust be brought to bear, each focusing on a different as-pect of the overall system. In particular, the collision riskproblem can be partitioned into two regimes: an outerloop that encompasses system failures and events thatlead up to a critical close-encounter event, and an inner

loop that covers the second-by-second details of an en-counter in a dynamic analysis, given the conditions that

were defined in the outer-loop regime (Figure 14).A fault tree is typically used to model the outer-loop

system failures or events that in turn define the envi-ronment for a fast-time inner-loop simulation of a close

encounter. For example, the probability that a transpon-der will fail to provide altitude information can be es-timated in the fault tree, and P(NMAC) for that typeof encounter can be computed in a detailed fast-timesimulation. Results are then combined in the fault tree

with corresponding performance data and probabilitiesfor other conditions, leading to a global estimate of sys-tem safety. Researchers can perform sensitivity studiesby modifying event probabilities in the fault tree andobserve their impact on overall risk, without requiringnew fast-time simulations.

The outer-loop regime defines what conditions apply

to the set of close encounters that are dynamically simu-lated in the inner loop. Outer-loop conditions includeairspace environment (e.g., low altitude, high altitude,U.S. airspace, European airspace); encounter charac-teristics (e.g., speeds, geometry of encounter), intruderaircraft equipage (e.g., transponder-equipped, TCAS-equipped); system component failures; pilot response toTCAS RAs (e.g., failure to respond, normal response);

FIGURE 13. In this encounter, a TCAS-equipped aircraft came within 0.3 nmi horizontally and100 ft vertically of another aircraft that did not have TCAS. The RA reversal came too late.

DescendRA

D

D

D

CC

C

C

Reversal:climb RA

2000

2100

2200Altitude(ft) 2300

2400

2500

20 15 10 5 0 5 10 15 20

Descend RA Climb RA

Time from closest point of approach (sec)

25

Intruder (without TCAS)

TCAS aircraft

8/3/2019 atc1

14/20

Kuchar and drumm



environmental conditions; and finally, ATC involvement in resolving theclose encounter.

The outer-loop modeling requiresa valid model of the types of closeencounters that may occur. This so-called encounter model specifies anumber of variables that are selectedrandomly in every fast-time simula-tion run. Key variables include thegeometry of the encounter, aircraftspeeds, and vertical accelerations. Theencounter modeling process beginsby collecting thousands of hours ofair traffic radar data and using a set offilters to extract from these data anyclose encounters between aircraft. Thecharacteristics of each close encoun-ter are then compiled into a statisticaldistribution describing the likelihoodsthat various conditions are present. When generatingencounter scenarios, separate software randomly selectsparameter values from these distributions, computes theinitial conditions for the simulation, and stores the re-sults in an input file.

The inner-loop dynamic simulation takes the statusof system components and the environment and com-putes P(NMAC) over a representative range of encoun-

ter situations. Each encounter scenario is executed oncewithout TCAS and once with TCAS. Additional runsmay be performed to compare the performance of dif-ferent TCAS algorithms. These runs, using identical ini-tial conditions, facilitate making direct estimates of thesafety provided by TCAS.

Liol Lbotoys Sfety assesset Tool

Lincoln Laboratory recently designed and implemented(using The MathWorks MATLAB, Simulink, and RealTime Workshop software packages) a fast-time MonteCarlo simulation capability called the Collision Avoid-

ance System Safety Assessment Tool. This system takesencounter model data as an input and simulates three-dimensional aircraft motion. The simulation includesseveral integrated sub-models, as shown in Figure 15.These sub-models include TCAS logic, a visual-acquisi-tion model, a pilot-response model, and a vehicle dy-namics model. A sensor noise model is also included.

A performance analysis module examines the aircraft

trajectories to determine miss distances and to computeP(NMAC). To reduce computation time, batch simu-lation runs are performed with Lincoln LaboratorysLLGrid parallel computing facility [6]. LLGrid enablessimulation of one million encounter situations in ap-proximately 3.5 hours, allowing enough flexibility tointeractively investigate changes to TCAS or other col-lision avoidance systems.

The simulation includes flight-certified TCAS codeobtained from a TCAS vendor. The logic in the simula-tion is thus identical to that in actual aircraft, provid-ing high fidelity and an ability to replicate the full rangeof logic behavior. Information from the TCAS logic ispassed to a pilot-response model (to respond to RAs),to a visual-acquisition model (triggering improved pilotvisual-search efficiency) and to the other aircrafts TCASunit (if equipped) to handle maneuver coordination.

A visual-acquisition model estimates the probabilitythat a pilot will see the other aircraft through the wind-screen. This model relies on a technique developed for

accident investigations, safety analyses, and regulatoryprocesses [7]. The models basis is that visual acquisitionis limited by target search time over a given volume ofspace. In the model, the probability of visually acquiringa threat during one time step is given by

=A

r2,

Outer loopEncounter

model

Systemfailures

Aircraftequipage

Encounterconditions

Inner-loop variations inencounter geometry

and sensor noise

Results

Outer-loopvariations in encounter conditions

Pilot-response

model

Inner loop

Fast-timesimulation

FIGURE 14. The aircraft mid-air collision risk problem has two parts: an outer loopthat encompasses system failures and events that lead up to a close encounter,and an inner loop that covers the second-by-second details of an encounter in adynamic analysis.

8/3/2019 atc1

15/20

Kuchar and drumm



where b is a constant,A is the visual area presented bythe target, and r is the range to the target. If the air-craft are on a collision course, rdecreases with time, so

the acquisition probability increases smoothly until thepoint of closest approach. The value ofA may vary asan aircraft changes orientation. The value ofbdependson visibility, contrast, the number of pilots searching,and whether those pilots have been cued by an ATC orTCAS traffic advisory. Values for bhave been validatedin flight experiments. The visual-acquisition model es-timates the probability of a pilot visually detecting an-other aircraft by a certain time and thus helps identifyencounters that might be avoided by visual acquisition.

Aircraft motion normally follows a scripted set ofmaneuvers as specified by the encounter model. Thesemaneuvers can include vertical or lateral accelerationsuch as a level-off or turn, plus changes in airspeed. Ifa TCAS RA is issued, the motion transitions to a newset of control behaviors as defined by a pilot-responsemodel. We use different models to explore a variety ofpossible pilot behaviors, including pilots who respondexactly as TCAS assumes as well as pilots who respondslowly, move more aggressively than expected, maneuverin the opposite direction as the RA calls for, or make nomaneuver at all.

Eope cgeFo te Bette?

Between 2004 and 2006, the FAA and Eurocontrol

conducted an international study to assess the perfor-mance of the European change proposal [8]. Figure 16shows data from Lincoln Laboratory simulations, as

part of this study, that demonstrate how the Europeanchange proposal would affect the measured vertical missdistance between aircraft in encounters similar to ber-

lingenthat is, when both aircraft are equipped withTCAS but when one aircraft does not follow its RA.Clearly, the European proposal would in a vast ma-

jority of cases affected by the proposal92%result inan increase in vertical separation. A full 22% of the af-fected cases are considered saves; that is, a near mid-aircollision would have occurred with the current versionof TCAS but would not occur if the proposed change

were to be implemented. In only 2% of the affectedcases would the situation be reversed, with the proposedchange resulting in a near miss, while the current TCAS

would not.Lincoln Laboratory simulations were also run with

an encounter model representing European airspace. Inencounters involving two TCAS-equipped aircraft in

which both pilots respond appropriately to their RAs,TCAS provides a risk ratio of approximately 0.02. Thatis, if pilots obey the RA, the use of TCAS reduces therisk of mid-air collision by about a factor of 50. If in-stead one pilot does not respond to the RA, the risk ra-tio rises by an order of magnitude, to 0.23.

Figure 17 summarizes the overall impact of TCASaccording to the estimated number of years betweenmid-air collisions over Europe. These estimates, which

were based on the Lincoln Laboratory simulation stud-

ies, consider two factors: the likelihood with which pi-lots follow their RAs, and the type of TCAS logic be-ing used. With no TCAS at all, one mid-air collision

Radar

data

Pilot-response

model

Pilot-response

model

SimulationAirspace

encounter model

Filter

Randomsamples

Encountermodel

distributions

Metrics

Vertical

separation

Risk with TCAS

Risk without TCAS

Years betweencollisions

TCAS

TCAS

Aircraft

dynamicmodel

Aircraftdynamicmodel

FIGURE 15. A set of software modules implemented at Lincoln Laboratory simulates three-dimensional aircraft mo-tion based on data from encounter models. The fast-time simulator runs on the LLGrid parallel computing facility.

8/3/2019 atc1

16/20

Kuchar and drumm



could be expected over Europe approximately everythree years. With deployment of TCAS Version 7 (bluecurve), the years between collisions depend heavily

on how often crews conform to RAs. Safety increasessharply as more pilots follow their RAs. Introducing theEuropean change proposal should improve safety evenfurther (green curve). Clearly, aviation safety can be bestenhanced through a combination of measures: upgrad-ing the TCAS algorithms while also improving pilottraining and procedures to increase RA conformance.The FAA is considering the economic and safety trade-offs involved in mandating an upgrade to all TCASunits worldwide. Because of this analysis, it is possiblethat within the next year the FAA will issue directives re-quiring aircraft operators to implement new algorithms

incorporating the European change proposal.

Bette Sesig algoits

As the European change proposal illustrates, improve-ments are still possible and being investigatedas arecompletely new technologies for collision avoidance. Akey issue is how to best apply sensors, displays, auto-mation, procedures, and controls to enable operating a

complex collision avoidance system ata desired level of performance even asthe types of aircraft and procedures for

air traffic management change.Triggering an alert requires the auto-mation to determine on the basis of itsinternal models that intervention is re-quired. This decision may conflict withthe human operators mental model.Such tension is good when the humanneeds to be alerted to a problem thatrequires attention, but can be undesir-able if the human has access to infor-mation that disagrees with the need foran alert or for action. Along these lines,areas of potential improvement in col-lision avoidance system design includeenhanced surveillance information andmore sophisticated modeling and deci-sion-making algorithms.

TCAS can be only as good as thedata that it works fromparticularlythe estimates of an intruder aircraftsposition, velocity, and acceleration.Because position measurements are

updated only once a second, rapid changes in aircrafttrajectory cannot be detected or tracked immediately.

Acceleration information obtained directly from the

flight management system on the TCAS aircraft could

FIGURE 17. For a given rate of pilot conformance to TCASinstruction, the risk of collision would be lower under theproposed European change than with the current system.

FIGURE 16. Each data point represents one encounter that was simulated twice:once with the existing TCAS logic and once assuming adoption of the Europeanchange proposal. Encounters in which the proposed change does not affect thevertical miss distance lie on the diagonal line. Points above the line represent en-counters where the proposed change would increase separation; points belowthe line indicate encounters where the change would reduce separation.

0

5

10

15

20

0 0.2

Rate of conformance to TCAS

Current TCAS

No TCAS

Change proposal

Yearsbetweencollisions

0.4 0.6 0.8 1.0

0 200 400 600 800 1000 1200 14000

200

400

600

800

1000

1200

1400

Separation with current TCAS (ft)

Separationwithchangeproposal(ft)

8/3/2019 atc1

17/20

Kuchar and drumm



be used to provide lead information to the dynamicmodels that TCAS uses to determine whether an alertis needed or whether an RA is being followed. Access

to additional intent information from the intruder air-craft, such as the altitude at which it intends to level off,would also greatly improve TCASs ability to determinewhat type of RA should be issued, or if one should beissued at all.

Improvements are also possible for the trajectorymodel templates on which TCAS bases its predictions.TCAS uses a two-stage decision-making process. First,the system projects current traffic into the future onthe assumption that both aircraft continue in straightlines with no acceleration. The rationale behind usingthis nominal template is that alerts are issued only whenthey are necessary to avoid a collision. The accuracy oftrajectory prediction generally degrades into the future,so some cutoff or maximum look-ahead time is typicallyrequired to avoid nuisance alerts. That uncertainty pre-cludes TCAS from making accurate collision avoidancedecisions more than 30 to 40 seconds into the future.

If the first-stage modeling predicts insufficient sepa-ration between aircraft, TCAS then selects one of severalavoidance templates and instructs the pilot to make thisrecommended maneuver. The safety of the two-stagesystem is ensured by tuning the alerting parameters sothat, on balance, first-stage alerts are issued early enoughthat ample avoidance trajectories remain. Encounter

models and Monte Carlo simulations are integral to thisevaluation and tuning process.

A single integrated decision-making stage could fur-ther improve performance. A system that simultaneouslyexamined the nominal and avoidance templates wouldissue alerts only when they were necessary and likely tobe successful. Alert timing could then be tightened toensure that alerts would be issued only when both tem-plates showed that it was appropriate to do so.

TcaS fo ue aift

The increasing demand for unmanned aerial vehicles

(UAV) adds a new wrinkle to the task of collision avoid-ance. UAVs are being developed to serve a variety ofroles, including border patrol, sea-lane monitoring, ve-hicle tracking, environmental observation, cargo deliv-ery, and military surveillance. Many of these missionsrequire UAVs to coexist with civilian aircraft. Like pi-loted aircraft, UAVs are required to see and avoid otherair traffic.

TCAS was not designed to be a sole means for thesee-and-avoid directive, nor was it originally intendedfor use on UAVs. TCAS presumes the existence of con-

ventional separation processes, including air traffic con-trol and visual separation, and the surveillance, display,and algorithm designs of TCAS were developed andvalidated for aircraft with onboard pilots. Four issues inparticular are of special concern. First, TCAS can detectonly transponder-equipped aircraft, which means thatUAVs would be blind to small aircraft such as gliders,hot-air balloons, or ultralights they might encounter.Second, maneuvering is not permitted on the basis ofthe TCAS traffic display or TAs because of limited bear-ing accuracy and vertical rate information. Third, re-mote-control latencies in reacting to RAs may result inmaneuvers that induce collisions. Finally, it may be dif-ficult for a UAVs pilot to detect anomalous situationssuch as altitude-reporting errors or intruders that aremaneuvering in a manner incompatible with the RA.

Initial studies by Lincoln Laboratory have providedestimates on how command and control latency affectsTCAS performance on a particular UAV, the U.S. AirForces RQ-4A Global Hawk [9, 10]. Figure 18 showshow risk ratio increases with increasing latency whena pilot is responding to a TCAS RA on Global Hawk.Data are shown for five altitude bands representing dif-ferent mixes of aircraft and encounter characteristics.To arrive at these results, we adjusted the encounter

models to account for the unique flight characteristicsof Global Hawk, but no system failures were consid-ered. Nor did we consider issues related to the inabilityof Global Hawk to visually acquire threats. As Figure18 shows, risk ratios increase sharply if latencies exceed10 to 15 sec, especially at low altitudes. Performance atlower altitudes is a serious concern because that is whereTCAS may be needed the most: there is a higher po-tential for encountering aircraft not being managed by

ATC. Large latencies reduce TCAS performance to thepoint where it adds no value. And if latencies grow toolarge, TCAS may actually induce more risk than exists

without TCAS. In some cases, delayed RA reversals canbe generated that are out of phase with aircraft motion,potentially causing a collision.

We are pursuing further study into the performanceof TCAS on UAVs to address these concerns. We are alsoinvestigating the potential for autonomous response toRAs, which might significantly improve safety. Anotherimportant factor is the potential for additional sensor

8/3/2019 atc1

18/20

Kuchar and drumm



technologies to aid in detecting and avoiding air traf-fic that is not transponder equipped. Systems based onelectro-optical sensors or radar may fill this role, thoughhow these systems and their collision avoidance algo-rithms interact in the existing air traffic environmentneeds to be investigated. Such study would require thedevelopment of new encounter models for aircraft thatdo not have transponders as well as environmental mod-

els needed to evaluate electro-optical sensor performanceacross a range of conditions.

Fte clleges

TCAS represents a clear success story in aviation safety.Its successful design was achieved through detailed con-sideration of sensor characteristics and the coupled dy-namic interactions among pilots, air traffic controllers,and aircraft. The result is a fine balance that providessufficient time to take action and that minimizes alertrates. As the berlingen accident shows, however, safetycannot be taken for granted, and areas of improvement

will always exist in systems that rely on integrating hu-mans and automation for information processing anddecision making.

The future still holds several vital issues to be over-come. Remotely piloted or autonomous unmanned air-craft introduce a novel element into an already complexenvironment. Although the high degree of confidencein todays aviation system has been built on a founda-

tion of more than a hundred yearsof experience with manned air-craft, such a foundation does not

yet exist for unmanned aircraft.The prospect of an aircraft au-tonomously maneuvering to avoida passenger jet carrying hundredsof people requires intense scrutiny.Collision avoidance systems willbe a focal point of this concern.

At the same time, new tech-nologies are arriving that promiseto improve the ease with whichcollisions can be detected andavoided. These technologies makeuse not only of enhanced data linkcapabilities to provide informationon the intentions of an intrudingaircraft, but also additional mo-dalities such as visual, infrared,

or radar sensors. The optical environment, includinglighting, haze, clouds, and background clutter, repre-sents aspects that did not need to be considered withradio-frequency-based TCAS but that are now criticallyimportant. Fusing TCAS information with these othersurveillance sources represents an opportunity and achallenge. Extensive flight testing, modeling, and simu-lation need to be conducted to fully explore design is-

sues with these new technologies.The real challenge lies in integrating new collision

avoidance technologies with the existing systems andprocedures. The berlingen accident demonstrated thecatastrophic outcome that can result from dissonancebetween two different decision makers in a time-criti-cal situation: namely, an air traffic controllers decisionto request a descent and TCASs Resolution Advisoryto climb. While this specific problem is being solved byimproving pilot training to comply with RAs and refin-ing the TCAS algorithms, related problems are likelyto surface as unmanned aircraft and enhanced collision

avoidance technologies mix. Ensuring compatible op-eration also extends well beyond TCAS or aviation tomany integrated sensing and decision support systemapplications. Lincoln Laboratorys experience with sen-sor fusion, decision support, and systems prototyping

will greatly facilitate the path forward in these areas, andwe are continually exploring new areas of complex sys-tem design.

FIGURE 18. Impact of response latency on TCAS performance in an unmanned aerialvehicle (UAV) called Global Hawk. As response latency increases, so does a value

called risk ratio, which is defined as the probability of a collision with TCAS dividedby the probability of a collision without TCAS. The higher the risk ratio, the less effec-tive is TCAS.

0

0.5

1.0

1.5

2.5

2.0

3.0

0

RA response latency (sec)

29,50041,500 ft

21,50029,500 ft

13,50021,500 ft

500013,500 ft

< 5000 ft

No TCAS on Global Hawk

Normalizedriskratio

5 10 15 20

8/3/2019 atc1

19/20

Kuchar and drumm



akowlegets

TCASs development spans several decades and is the

product of contributions from many individuals. Wewould particularly like to acknowledge Thierry Arino,Ken Carpenter, Kathy Ciaramella, Roger Elstun, Ste-phen George, John Law, Paul Fontaine, Stuart Searight,

Andrew Zeitlin, Thomas Billingsley, Barbara Chludzin-ski, Garrett Harris, Val Heinz, Katherine Sinclair, andDavid Spencer. This work was funded by the Federal

Aviation Administration and by the U.S. Air Force.

REFERENCES

1. J.R. Eggert, B.R. Howes, M.P. Kuffner, H. Wilhelmsen, and

D.J. Bernays, Operational Evaluation of Runway StatusLights, Linc. Lab. J.16 (1), 2006, pp. 123146.

2. W.H. Harman, TCAS: A System for Preventing Midair Col-lisions, Linc. Lab. J.2 (3), 1989, pp. 437458.

3. V.A. Orlando, The Mode S Beacon Radar System, Linc.Lab. J.2 (3), 1989, pp. 345362.

4. Minimum Operational Performance Standards for TrafficAlert and Collision Avoidance System II (TCAS II) AirborneEquipment, RTCA/DO-185A, Washington, D.C., 16 Dec.1997.

5. Investigation Report AX001-1-2/02, Bundesstelle fr Flugun-falluntersuchung (BFU, German Federal Bureau of Aircraft

Accident Investigation), Braunschweig, Germany, May 2004.6. N.T. Bliss, R. Bond, J. Kepner, H. Kim, and A. Reuther, In-

teractive Grid Computing at Lincoln Laboratory, Linc. Lab.J. 16 (1), 2006, pp. 165216.

7. J.W. Andrews, Air-to-Air Visual Acquisition Handbook, ATC-151, Lincoln Laboratory, Lexington, Mass., 27 Nov.1991, DTIC #ADA-243807.

8. Safety Analysis of Proposed Changes to TCAS RA ReversalLogic, RTCA DO-298, Washington, D.C., 8 Nov. 2005.

9. J. Kuchar, Update on the Analysis of ACAS Performance onGlobal Hawk, Aeronautical Surveillance Panel, Internation-al Civil Aviation Organization (ICAO), SCRSP WG A/WP

A10-04, Montreal, 15 May 2006.10. T.B. Billingsley, Safety Analysis of TCAS on Global Hawk

Using Airspace Encounter Models, S.M. Thesis, MIT, Cam-bridge, Mass., June 2006.

8/3/2019 atc1

20/20

Kuchar and drumm



james k. kuchar

is an assistant leader in the Surveillance Systems group, where he overseessurveillance and safety programs spanning civil and homeland defense missionareas. From 1995 to 2003, he was an MIT faculty member in the Department

of Aeronautics and Astronautics. While at MIT, he focused on decision supportsystem research with topics including TCAS, parallel runway approaches, terrainavoidance displays, and automobile warning technologies. He has S.B, S.M., andPh.D. degrees in aeronautics and astronautics from MIT, and he has authored morethan sixty journal articles and refereed conference papers. He has been a privatepilot since 1995, and believes he has not yet triggered a TCAS alert.

ann c. Drumm

is a staff member in the Surveillance Systems group. She received a B.A. degreein mathematics and computer science from Miami University (Ohio) in 1969.She joined Lincoln Laboratory in 1969, and became a member of the Air TrafficControl division when it was formed in 1970. She was part of the team thatdeveloped the software for the FAAs first prototype Mode S sensor. She developedthe protocols for TCAS air-to-air coordination, a process used worldwide to ensurethat TCAS aircraft encountering one another select compatible maneuvers. She hasserved as technical lead for the Lincoln Laboratory FAA programs in Mode S DataLink, Automatic Dependent Surveillance-Broadcast (ADS-B), and TCAS. Hercurrent work involves airspace monitoring to assess the performance of TCAS in theUnited States and investigation of TCAS on unmanned aerial vehicles.

atc1

Documents

Transcript of atc1