TCAS philosophies

[PBL]

alf,

Originally Posted by alf5071h

The safety certification should show that the probability of the collision scenario is sufficiently extreme to discount it; thence it meets an acceptable level of safety.

"Should" but rarely "does".

The quality of safety certification is a big issue. I have my problems with some of it (see my paper on the EUR-RVSM safety case). The big three issues concerning the U.S. and U.K. principals on certification of dependable-system SW are
* Explicit and accurate statements of dependability claims
* The provision of evidence sufficient to demonstrate those claims
* Transparency: public disclosure of the claims and evidence so that they can (one hopes) be checked through peer review

I just ran a panel session on this at SAFECOMP. It is a problem not just in aviation.

Let me add a bit of personal history for those who like gossip. Back in the days when I was a more assertive debater than the softie I have become , I got into a discussion on the Bluecoat list with an ex-MD avionics engineer name of Ray Hudson, who claimed he had seen enough in-flight evidence of the reliability of his systems to justify the usual 10^-9 claim. I said no, Ray, that is not possible and here are the scientific papers that show it definitively. He called me the usual non-pilot, non-avionics names as well as commented frequently on my ancestry; I said that whether or not he had evidence for his claims really didn't depend on how many legs my mother had. Result was that I was made a "participation offer" by Bill Bulfer that I couldn't accept, and departed.

Many years later, this theme has been the subject of a PhD dissertation at Cornell (John Downer) after I suggested it to Trevor Pinch; a main theme in the U.S. National Academy of Sciences Committee on Certifiably Dependable Software Systems recent report on just that; a major public concern of the U.K. principals in BSI oversight of IEC 61508 (the non-aviation international standard on functional safety of programmable electronic systems), and subject of concern in major non-aviation sectors (such as the automobile industry, which, in contrast to aviation, really does have kit that goes 10^9 operational hours - and sometimes more). As well as my panel at SAFECOMP. And Bluecoat appears moribund. Bad call by BB

PBL

[joernstu]

@bsieker

I think, the chances of your scenario leading to a mid-air collision will be rather low. As my knowledge on TCAS algorithms is mostly based on the Ueberlingen accident report, it is an educated guess, though.

This is how I think the system will work:

aircraft 1 (TCAS) get's RA descend.
aircraft 2 (ATC) get's instruction descend.

Both aircraft will descend following SOPs (1.25g, reaching approximately 1500ft/min descend rate).

TCAS onboard aircraft1 will monitor conflict situation. If aircraft 2 is lower than aircraft 1, TCAS will issue a Level off or perhaps a Reversal RA, if aircraft 1 is lower than aircraft 2, it will issue an Increase RA. In case the altitude of aircraft 1 and aircraft 2 are identical, I think TCAS would vote for an increase RA, as this would probably be more comfortable for the passengers and the course of action would be more straight forward (but this is only a guess).

In the Level off/Reversal RA scenario, aircraft 2 will continue its descend with 1500ft/min, aircraft 1 will reduce its descend rate. As aircraft 1 was above aircraft 2, the chances are, that both aircraft will avoid a mid-air.

In the Increase RA scenario, aircraft 1 will increase its decend rate following SOPs (1.25g, reaching approximately 2500ft/min). As aircraft 2 will continue its descend with 1500ft/min and aircraft 1 was lower than aircraft 2, chances are, that both aircraft will miss each other.

Both scenarios are based on the assumption, that ATC does not give further instructions to aircraft 2 after the first "descend" order.

If ATC was monitoring the situation, the controller could have noticed, that aircraft 1 was descending. In this case, the heshe could have issued a "level off" order to aircraft 2.

This case only has an impact on the "Level off/Reversal" Scenario above, where it would reduce the chances of both aircraft avoiding a mid-air.

But the premises for this last scenario would be rather high, as conflict recognition systems at ATC most probably will identify the conflict situation between aircraft 1 and 2, influencing the controller's actions.

[Bus14]

Peter,

Totally off-thread, but I'd rather follow a moribund thread on Bluecoat than a liveley one in this place. Isn't there enough water under the bridge for you and Rainman to come back, collectively or individually, to liven the old place up?

[bsieker]

Joern,

I agree with you that what you describe is a likely outcome. I don't think, particularly in crossing (as opposed to opposite) traffic, that the chances of a collision are very high, particularly if both aircraft manoeuvre.

But "rather low", as you put it, is not a level of probability I'd be comfortable with if it describes mid-air collisions. I'd prefer "extremely remote".

But we know that at Ueberlingen they did collide, and what makes my hypothetical setup sufficiently different from Ueberlingen that everyone seems to be confident it would not be a problem?

Yes, a lot of factors have to come together, such as land-communications failure, ground based collision warning system failure, high ATC workload, ...

But it does happen in real life. And who can put a number on its probability?

Or even give a sound argument why it is low enough to discount in the face of an actual occurrence?


Bernd

[PBL]

Bus14,

Ray lost the argument some years before he began it, so that's not an issue

The main points about Bluecoat and my participation are
* I spend much of my time thinking about and discussing accidents. That is a no-no on bluecoat.
* BB's participation philosophy includes careful control of discussion, and that was my real problem. My experience with technical on-line discussion groups, which extends over some 25 years now, is that they are fragile things whose worth is equally shared between the contributions of its "top" members and the occasional decisive intervention by chatterers. So I am not much into control of discussion because one loses the second of those factors.
* I am a bit out of touch now with people and developments in avionics (John Rushby, Paul Miner, Kevin Driscoll and co) and more in touch with rail and automobile people. The problems commercial aviation had, mildly, with digital avionics two decades ago are now beginning in spades with cars, but they are not the same issues. It turns out to be hard to specialise in both.

But I'll think about it.

PBL

[FullWings]

While it may be true that this particular accident could have been avoided, if both pilots had followed their respective TCAS RAs

Right. This is the reason we're having this discussion. Technically I agree with the "may" bit too as it covers probabilities down to "unlikely, even during the total lifespan of the universe". What Alf & I have been saying is that the aviation industry and regulators, using available data, are satisfied that TCAS provides the best protection in a very short-term conflict, if the commands are followed.

...the Bashkirian crew's action were rational in light of the perceived three-aircraft-conflict.

Great play is made of the "third aircraft" at Überlingen. After a quick skim through the report and voice transcripts, all I can find in terms of direct evidence is a call from the controller to the Tu-154: "...we have traffic at your... 2 o’clock", whereas radar replays show the traffic to have been at 10 o'clock. The Tu-154 would have been roughly at 2 o'clock, viewed from the 757, so from someone under stress, watching two blips on his radar merging into one, it's understandable that he got it the wrong way round. The report shows that both parties had been seen by each other some time before the collision, so the "third aircraft" conjecture was moot by then.

[joernstu]

After a quick skim through the report and voice transcripts, all I can find in terms of direct evidence is a call from the controller to the Tu-154: "...we have traffic at your... 2 o’clock", whereas radar replays show the traffic to have been at 10 o'clock.

If you look at the hard evidence, this radio call is the only indication for the three aircraft situation in the heads of the TU154 crew. But even the BFU investigating the accident assumed, that the TU154 crew was searching for traffic in the wrong sector.

[bsieker]

FullWings,

I notice that you still haven't addressed my main point:

Why is my modified scenario so different from Ueberlingen that it can be discounted as "extremely unlikely"?


The only reason I can imagine for your reluctance to address it is that you feel Ueberlingen was a fluke, it is considered that low "acceptable risk", and nothing needs to be done about it.

Is that it?


Bernd

[ATC Watcher]

1 in 10 million ?

Alf5071h :

The safety certification should show that the probability of the collision scenario is sufficiently extreme to discount it; thence it meets an acceptable level of safety. The principle of aviation safety is that it is not absolute; it accepts that rare events can occur, but the probability of them resulting in death has to be extremely remote (10-9).

Your approach appears to take the limit case as ‘the’ hazard without qualifying (bounding) it with the probability of its occurrence. Yes it is a real hazard, but if by following TCAS it only occurs in one manoeuvre in 10 million, then the industry accepts that following TCAS is the safer option.

I remember clearly the FAA initial “ marketing” speeches when introducing TCAS in the very early 80s: No safety case as we know today was made, it was a political decision that mandated TCAS in the USA , not a rational one.
An initial independent paper showed that in 100 encounters, TCAS will solve X number of cases , would not make any difference in X number but in 4 cases it “ could induce a collision “
But the system was judged extremely beneficial and it was mandated.

If you look carefully at the official TCAS II training manual you will find in a general text mentioning something like : “in rare cases the system might induce collisions “ ( I am overseas at the moment , with no access to my archives for correct text /references )
4% is far from 1 in 10 million , but to be fair the percentages were calculated with version 5.0, since then we had 6.0, 6.04, 6.04A and now 7.0, so the percentage should be (much) lower hopefully by now, but I do not know of any scientific study with new figures on the recent versions.

Bsieker :

The only reason I can imagine for your reluctance to address it is that you feel Ueberlingen was a fluke, it is considered that low "acceptable risk", and nothing needs to be done about it

I think you are correct in your assumption.Fullwings is unfortunately not the only one who believe this.
Whereas Ueberlingen ended in a real collision , there are many more Ueberlingen –type incidents on record , both before and after 2002.
Some were heavily mediatized ( like the JAL/JAL case in Japan ) most others were not.
A very recent one is a carbon copy but with Climb RA +ATC instruction to climb to teh other. Aircraft missed mostly because one of the aircraft was powerful and outclimbed the other one . As it has been said here already, it is extremely difficult to make 2 aircraft collide , even if you intend to . (Ask any Military interception controller about it ) It is not because there is actually no accident that we can disregard the issues. Believing that the problem dramatically illustrated in Uberlingen is unique is wishful thinking.

[alf5071h]

Bernd, I still believe that there are weaknesses in the development of your scenario (#101).
In particular the omission of the overall time frame, and I believe, a biased rational for the controller’s choice of action. Yes it can happen but is it realistic - probabilities?

Re your “But we know that at Ueberlingen they did collide, and what makes my hypothetical setup sufficiently different from Ueberlingen that everyone seems to be confident it would not be a problem?”
I don’t think that anyone is saying that they are confident it is not a problem just that it appears to be sufficiently improbable. The analogy is that aircraft are certificated as being safe to fly, but some crash, more often with human involvement. ATC Watcher, asked if Ueberlingen could happen again (#1), I replied yes.

I sense that I could become the focus of a pincer move between you and ATC Watcher; thus having identified conflicting traffic (in an uncontrolled environment), I now deviate from my flight path!

Peter, ATC Watcher, my description of safety certification was somewhat simplistic and is more related to aircraft certification and installed systems. In these instances the certification ‘does’ show the appropriate probability. However, for a combined ATC/TCAS system I would struggle to find any such rigorous analysis; and perhaps it is this aspect which is causing concern. Therefore in this discussion I believe the ‘safer’ option is for me to withdraw all numerical examples.
However, for Bernd’s scenario and Peter’s 3 aircraft problem, perhaps looking at such things as a probability density function for the risk of collision might identify non-perfect solutions but ones with acceptable risk?

Being sceptical of independent papers and manuals, I would ask if the rare case actually induced a collision or a only a flight path conducive to a collision, i.e. a change in the level of risk (relative vs absolute). Similarly, the ‘rare case’ would in my way of thinking require an associated probability.

The increasing concern may be heightened by ‘near miss’ reports and crew error in TCAS operation. Near misses are interesting, particularly if viewed from different areas. For ATC, anything less than 5nm and 1000ft is a cause for concern, whereas a pilot, 1nm of 500ft may appear safe, and more recently anything that does not result in a TA. So ATC quite rightly ask questions about the overall system, and pilots are currently happy with TCAS's anti collision qualities. ( I caution myself to be aware of “ a threat to safe operation, which … people did not believe existed (numerically), or did not whish to believe posed a significant risk” (#87))
I am not writing this problem off, nor would I be surprised to learn that the ATC/TCAS safety case was accepted directly from N America without proof, and perhaps it is only now that we find weaknesses or at least difficulties in providing data (probabilities) for proving a level of safety.
Of course the problem might actually be in the process of determining the safety level, what is the required value and how is such a system, with its many human contributions, to be certificated? ... Automation?

[CDN_ATC]

Is there a specific reason the rate of descent for an RA is 1500'/min?

Reason I ask, many commercial operators in regular arrival descents from cruise descend at 2500-3500 feet per minute depending, and I've seen 737NG's give 5500-6000'/min when asked to increase rate of descent to clear traffic.

So my obvious question since an RA means two airplanes are too close to each other, why not move in the appropriate direction as fast as safely possible, I mean passenger comfort is one thing, but I think they'd prefer a little upset stomach to the possible alternative?

Also scenario (Assume structured airspace):

Airplane 1 Proceeding AAA-BBB at FL360
Airplane 2 Proceeding AAA-BBB at FL350
Airplane 3 Proceeding AAA-BBB at FL340
(All three airplanes are vertically stacked on top of each other)

Airplane 4 Proceeding BBB-AAA at FL350

How would TCAS re-act to this scenario? Also what if the offending airplane has an older version of TCAS...

[bsieker]

alf,

I still believe that there are weaknesses in the development of your scenario (#101).

I was hoping for someone to point me to them.

In particular the omission of the overall time frame, and I believe, a biased rational for the controller’s choice of action. Yes it can happen but is it realistic - probabilities?

Well, I assume the same timing as at Ueberlingen.

As to the controllers choices of action: I guess he could have chosen lateral manoeuvering as well. Is that likely if the FL below the collision course is clear, also considering that a turn takes longer to initiate than a dive or a climb?

Is my notion about a preference for descend over climb correct? I figured, particularly at high altitudes, descending was quicker and more easily achieved for some aircraft than climbing.

I sense that I could become the focus of a pincer move between you and ATC Watcher; thus having identified conflicting traffic (in an uncontrolled environment), I now deviate from my flight path!

I'm glad you put the smiley there. I don't think it's likely to happen. I was looking forward to your answer, as you appear interested in a meaningful discussion and are not just defending a position of "you must always follow TCAS!". As I have indicated I lack inside information about TCAS algorithms. I rephrased my call for comments on my hypothetical(?) setup in an increasingly aggressive tone to provoke a reaction. I thank you, Joern and ATC Watcher for finally taking the bait

I think without data mining through huge data spaces (and I'm talking a lot more than the 2-day data set that Eurocontrol used; more like a year or two) we will not be able confidently to put a figure on the probability.


(and now for something completely different ...)

Originally Posted by CDN_ATC

Is there a specific reason the rate of descent for an RA is 1500'/min?

It is probably a compromise between (a) safely clearing your conflicting traffic by a comfortable margin on the one hand, and (b1) avoiding the creation of additional conflicts plus (b2) maintaining passenger comfort on the other hand.

A descent rate of, say, 6000ft/min would bust one flight level every 10 seconds! Sounds like an ATC nightmare in dense traffic.


Bernd

[CDN_ATC]

Normally yes, but if I ask for "A good rate of descent" and get 6000'/min, it's not my ears and guts that are bothering me...

[punkalouver]

Originally posted by CDN_ATC
So my obvious question since an RA means two airplanes are too close to each other, why not move in the appropriate direction as fast as safely possible, I mean passenger comfort is one thing, but I think they'd prefer a little upset stomach to the possible alternative?

Because it is not necessary. Enough time is given that you don't need to make abrupt manouvers. That is why on an initial RA you have 5 seconds just to start you evasive action at only 1/4 g added or subtracted to your load factor. Abrupt pullups at cruise altitude can be dangerous.
Going against the RA was not rational and a lot of people died because of it.

[PBL]

Originally Posted by punkalouver

Going against the RA was not rational

Given that there is a good argument in the public domain as to why it was rational, would you care to share both your reasons for thinking it was not, as well as show us the mistake in the argument?

Can you solve the decision problem that I posed?

PBL

[punkalouver]

We have already been through this. Please read or re-read post #50 from myself.
I find it amazing that a specialist on aircraft safety is telling us that if we end up in a similar scenerio as the one over Germany that night that we should ignore the RA and in fact go against it.

Please read more about sometimes trying to out-think the TCAS as you advocate.

http://www.asasi.org/papers/2005/Hir...in%20Japan.pdf

[PBL]

Originally Posted by punkalouver

We have already been through this. Please read or re-read post #50 from myself.

I read it when you wrote it and decided that you were confused and had not understood the problem.

Originally Posted by punkalouver

I find it amazing that a specialist on aircraft safety is telling us that if we end up in a similar scenerio as the one over Germany that night that we should ignore the RA and in fact go against it.

Which specialist would that be? I don't know of one.

PBL

[bsieker]

Originally Posted by punkalouver

I find it amazing that a specialist on aircraft safety is telling us that if we end up in a similar scenerio as the one over Germany that night that we should ignore the RA and in fact go against it.

I find it amazing that you make this statement.

Would you mind showing us the post where someone said that, when confronted with the Ueberlingen scenario, one should ignore the RA and go against it?

What I (and others) said was that the choice taken by the Bashkirian crew was (one of several) rational choices in the given situation. Namely assuming two intruders, one they can see, and one they cannot see, and being given ATC instructions before receiving the RA.

Rational choice means it can be defended as being thought through: Looking at the individual pieces of information presented to them, evaluating them and making an informed decision on the course of action.

That the choice to follow ATC instead of TCAS was a rational choice does not mean:

- that it was the only choice or
- that it was the only rational choice or
- that the crew actually decided rationally
[edit]
- it doesn't even mean that it was necessarily (in hindsight) the best choice
[/edit]

I second PBL's call to show us exactly why you think the choice made by the Tupolev crew was not rational.

-----
(And now for something completely different.)

Disclaimer: I do not have a degree in psychology or similar training, so I'm really asking this question out of curiosity.

As to the chances of avoiding traffic visually:

There is a phenomenon, well-known to Rally-drivers, that, if you're a proficient driver, you tend to steer towards the object that you look at. It seems that if you look at a tree, you're more likely to hit it than if you deliberately look beside it. Driving becomes completely skill-based, and without thinking you follow your eyes.

The effect can be observed even in a rally (or other racing) simulation on a computer.

I actually have no idea how much of this is applicable to aviation. Just a random thought.


Bernd

[ATC Watcher]

And now, For something completely different ...

Bsieker :

As to the chances of avoiding traffic visually:
There is a phenomenon, [...] you tend to steer towards the object that you look at.

Indeed , one can even try this on a bicycle .And this remark is very relevant in the case of Ueberlingen. I always thought that should both a/c had been IMC they most probably had missed. Looking at the last seconds on the FDR of the TU154 could confirm this. But I speculate and this is outside the TCAS debate.

But being also a glider pilot, I can confirm that visual avoidance do work in the air most of the time ! ( even last minute visual avoidance, mostly by turning sharply away from intruder ).
But we are far slower and far more manoeuvrable than a passenger jet.

[punkalouver]

O.K., here is my rational response based on this accident report. It is nightime, I am cruising along at high altitude in airspace where all aircraft are required to have transponders and most that do have transponders have two of them in case one fails. It is fairly quiet on the radio. My aircraft is equipped with an updated version of TCAS and I have been trained in how it works.
Therefore I know that they communicate with each other and in the event of a RA in my aircraft, the conflicting aircraft's TCAS will not give instructions to do the same evasive manouver. Because I follow aircraft incidents on PPrune and other forums, I am well aware that manouvering to follow an ATC instruction against the RA nearly caused the world's worst aviation disaster over Japan 18 months previously(link provided in my last post).

All of a sudden I get a TA with the TCAS display showing traffic at my altitude and converging from the left. Moments later ATC says traffic at two o'clock, descend immediately and nearly simultaneously, I get a RA saying to climb. There is no other traffic displayed on my TCAS display. I do the rational thing and follow the RA and everyone survives this conflict.

I know.......Maybe there is some military flight out there that has an emergency which just happens to be affecting his transponder at the very exact time that I am getting an RA. I'm sure there are all kinds of obscure scenarios that can be thought of. Conspiracy theorists do it all the time.
By the way, if in this scenario there actually was an intruder at my two o'clock with no altitude given as pointed out by ATC(perhaps due to mode C not working), I would not go opposite to the RA.

P.S. Sorry for calling you an aviation safety specialist. That was an error on my part.