Collision avoidance system

TCAS (Traffic alert and Collision Avoidance System) is an airborne system used to avoid collisions between aircraft. More details about TCAS can be found in chapter 10. 

Other reasons for the process models to diverge from the true system state may be more subtle. Information about the process state has to be inferred from measurements. For example, in the TCAS If aircraft collision avoidance system, relative range positions of other aircraft are computed based on round-trip message propagation time. The theoretical control function (control law) uses the true values of the controlled variables or component states (e.g., true aircraft positions). However, at any time, the controller has only measured values, which may be subject to time lags or inaccuracies. The controller must use these measured values to infer the true conditions in the process and, if necessary, to derive corrective actions to maintain the required process state. In the TCAS example, sensors include on-board devices such as altimeters that provide measured altitude (not necessarily true altitude) and antennas for communicating with other aircraft. The primary TCAS actuator is the pilot, who may or may not respond to system advisories. The mapping between the measured or assumed values and the true values can be flawed. 

In 2002, two aircraft collided over southern Germany. An important factor in the accident was the lack of coordination between the airborne TCAS (collision avoidance) system and the ground air traffic controller. They each gave different and conflicting advisories on how to avoid a colhsion. If both pilots had followed one or the other, the loss would have been avoided, but one followed the TCAS advisory and the other followed the ground air traffic control advisory. 

As another example of the relationship between hazards and system boundaries, consider the air traffic control system. If an accident is defined as a collision between aircraft, then the appropriate hazard is the violation of minimum separation between aircraft. The designer of an airborne collision avoidance system or a more general air traffic control system theoretically has control over the separation between aircraft, but may not have control over other factors that determine whether two aircraft that get close together actually collide, such as visibility and weather conditions or the state of mind or attentiveness of the pilots. These are under the control of other system components such as air traffic control in directing aircraft away from poor weather conditions or the control of other air transportation system components in the selection and training of pilots, design of aircraft, and so on. 

All that is being suggested here is that top-down system engineering is critical for engineering safety into complex systems. In addition, when a new component is introduced into an existing system, such as the introduction of a collision avoidance system in the aircraft, the impact of the addition on the safety of the aircraft itself as well as the safety of air traffic control and the larger air transportation system safety needs to be considered. 

One (but only one) of the controls used to avoid this type of accident is an airborne collision avoidance system like TCAS (Traffic alert and Colhsion Avoidance System), which is now required on most commercial aircraft. While the goal of TCAS is increased safety, TCAS itself introduces new hazards associated with its use. Some hazards that were considered during the design of TCAS are ... 

The final column of the table, Stopped Too Soon or Applied Too Long, is not applicable to the discrete interlock commands. An example where it does apply is in an aircraft collision avoidance system where the pilot may be told to climb or descend to avoid another aircraft. K the cUmb or descend control action is stopped too soon, the collision may not be avoided. 

A readable but formal and executable black-box requirements spedfication language was developed by the author and her students while helping the FAA specify the TCAS (Traffic Alert and Collision Avoidance System) requirements [123]. Reviewers can learn to read the specifications with a few minutes of instruction about the notation. Improvements have been made over the years, and it is being used successfully on real systems. This language provides an existence case that a... 

G1 Provide ajfordable and compatible collision avoidance system options for a broad spectrum of National Airspace System users... 

For safety-critical systems, constraints should be further separated into safety-related and not safety-related. One nonsafety constraint identified for TCAS, for example, was that requirements for new hardware and equipment on the aircraft be minimized or the airlines would not be able to afford this new collision avoidance system. Examples of nonsafety constraints for TCAS II are ... 

ATC Operations Management Provide procedures, train controllers, audit performance of controllers and of the overall collision avoidance system. 

All communications between the system and external components need to be described in detail, including the designed interfaces. The black-box behavior of each component also needs to be specified. This specification serves as the functional requirements for the components. What is included in the component specification will depend on whether the component is part of the environment or part of the system being constructed. Figure 10.12 shows part of the SpecTRM-RL description of the behavior of the CAS (collision avoidance system) subcomponent. SpecTRM-RL specifications are intended to be both easily readable with minimum instruction and formally analyzable. They are also executable and can be used in a... 

A SpecTRM-RL model of TCAS was created by the author and her students Jon Reese, Mats Heim-dahl, and Holly Hildreth to assist in the certification of TCAS II. Later, as an experiment to show the feasibility of creating intent specifications, the author created the level 1 and level 2 intent specification for TCAS. Jon Reese rewrote the level 3 collision avoidance system logic from the early version of the language into SpecTRM-RL. 

AC20-131B, March 1993. Airworthiness Approval of Traffic Alert and Collision Avoidance Systems (TCAS II) and MODE S Transponders. FAA, Washington. 

The first consideration of active safety in regulations is included in (EC) No. 78/2009[37], Chapter III Article 11. All vehicles equipped with collision avoidance systems may not have to fulfill the test requirements laid down in Sections 2 and 3 of Annex I in order to be granted an EC type-approval or a national type-approval for a type of a vehicle with regard to pedestrian protection, or to be sold, registered or to enter into service . It is required that [a]ny measures proposed shall ensure levels of protection which are at least equivalent, in terms of actual effectiveness, to those provided by Sections 2 and 3 of Annex I . Article 11 provides a legal basis for future fulfillment of the regulation by both active and passive safety devices, based on the effectiveness required. 

The term System as used throughout this paper includes equipment, people and procedures, in the context of a defined operational environment. In the case of ATM, the operational environment includes, the structure and rules of the airspace, pilots, aircraft, airborne electronic equipment (including collision-avoidance systems) etc. 

Creaser, J., Manser, M., Rakauskas, M. and Donath, M. 2010. Sign comprehension, considering rotation and location, using random gap simulator for cooperative intersection collision avoidance system—Stop sign assist CICAS-SSA Report 4 (CTS 10-34). Minneapolis, MN Center for Transportation Studies, University of Minnesota. 

University of Michigan Transportation Research Institute General Motors. 2005. Automotive collision avoidance system field operational test report Methodology and results. Report DOT HS 809 900. Washington DC U.S. Department of Transportation, National Highway Traffic Safety Administration. 

Restore, where the collision avoidance system gives back the control to the original controller/pilot. 

Jenie, Y.L, Van Kampen, E.-J., de Visser, C.C., Chu, Q.P. Selective Velocity Obstacle Method for Cooperative Antonomons Collision Avoidance System for Unmanned Aerial Vehicles. In AIAA Gnidance, Navigation, and Control (GNC) Conference. American Institute of Aeronautics and Astronantics (2013)... 

The modeled ENN is tested on a prototype power wheelchair for real-time navigation in an indoor environment. The power wheelchair is provided with a collision avoidance system and a shared control algorithm to avoid accidents during the testing. 

A near miss is the occurrence of an unplanned event that did not result in injury, illness, or damage, but had the potential to do so. Only a fortunate break in the chain of events prevented an injury, fatality, or damage. Related terms are incident, close call, near mishap or near collision. The term is often misunderstood and misused. An event is called a near miss to stress that not only did things go wrong,but that a catastrophe was barely missed. In the airline industry, if two airliners pass within a quarter mile of each other, this is by definition a near miss event. Some individuals feel it is a euphemistic term for a near hit. A near miss could be viewed as the partial actualization of a hazard, resulting in an incident rather than a mishap. It could also be a situation where only part of a hazard occurs for various reasons, such as operator alertness and counteraction, thus preventing a mishap event. For example, a collision avoidance system intended to prevent a collision between two aircraft in the same airspace may have failed without any warning, but an alert pilot saw the situation and took countermeasures to prevent a collision. 

Merz A. W., Karmarkar J. S. 1976 Collision Avoidance Systems and Optimal Turn Manoeuvres, The Journal of Navigation, Vol. 29, p. 160-174. 

---