Originally Posted by PBL
This is blue-sky hypothesising. As far as I can tell, none of these "low enough" "finite probabilities" have ever been estimated; neither is it clear that one could do so.
Originally Posted by FullWings
Exactly. So for practical operation of the aircraft, we ignore them.
I think you misunderstood. One cannot tell that these probablilities are "low enough" to disregard them. Since we do not know them, perhaps never will, they may be quite high.
That doesn't solve your problem. You need a provably correct implementation of the algorithm. Have the manufacturers "open-sourced" their code yet?
A provably correct implementation of a flawed algorithm won't help. First and foremost the algorithm needs to be proven correct. Methods to make a very-high confidence implementation of a specified algorithm are today available and well-understood, although they are neither trivial nor cheap.
The Tu-154 crew chose, or should I say "elected" to do something different. People died. I'm not saying they didn't have reason (their SOPs seem to have been at odds to everyone else's, for one thing) but the end result was disaster. You can "choose" to drive on the opposite side of the road to other people but I don't think you'll get much respect for it.
joernstu will remember the details by heart, and correct me if I'm wrong, but I think the Tupolev crew got the ATC instruction slightly before the RA. A case which is not considered in the ACAS specifications, as it assumes it is needed only when ATC separation has already failed. It does not take into account late ATC action, which I imagine happens frequently.
An avoidable disaster, one that TCAS was invented to prevent.
And yet, the Ueberlingen accident would not have happened, if neither aircraft had been equipped with TCAS. ATC was there to separate them. (Perhaps later than usual, but early enough.) Thus, the presence and operation of TCAS was a necessary causal factor in that accident, as has been shown clearly by Stuphorn's Why-Because Analysis.
Bernd