TCAS on Unmanned Aerial Vehicles

Document Sample
TCAS on Unmanned Aerial Vehicles Powered By Docstoc



                        WORKING GROUP A

                       (Langen, November 2002)

                TCAS on Unmanned Aerial Vehicles:
                  Defining a Safety Analysis Plan

                      (Prepared by A. C. Drumm)


       As the use of Unmanned Aerial Vehicles (UAVs) increases in
   civil and military operations, there is increased interest in TCAS
   equipage on UAVs. Indeed, instances of such equipage have already
   occurred. This paper proposes that SCRSP consider definition of a
   safety analysis plan for TCAS equipage on UAVs. Execution of the
   plan elements could help to quantify the impact of TCAS-on-UAV
   operation and could direct efforts of the UAV community toward
   resolution of problems.

        The paper discusses possible TCAS-on-UAV implementation
   options. It reviews various types of safety analyses and suggests, for
   each implementation, which safety analyses would need to be
   performed to address concerns.

1. Introduction

        As the use of Unmanned Aerial Vehicles (UAVs) increases in civil and military
operations, there is increased interest in the installation of TCAS on UAVs. Stated
reasons for this interest include providing collision protection for the UAV, providing
situational awareness for the UAV ground pilot, and enabling airspace access by meeting
worldwide aircraft equipage requirements. The airspace access reasoning is based on
two primary factors: first, the largest UAVs (e.g., Global Hawk) meet the weight
requirements of the 2005 ICAO ACAS mandate; and second, acceptance of UAV
operation is considered more likely if the UAV can interact with the ATC system in the
same way as a standard aircraft (implying that the UAV should have the same equipage
as a standard aircraft).

        The idea of TCAS equipage on UAVs has been brought to SICASP and SCRSP
on a number of occasions, each time producing a consistent response. In May 1999
(Montreal), in response to a German paper [Ref. 1] , SICASP WG2 stated that the use of
ACAS on UAVs was unacceptable to WG2. In October 2001 (Paris), in response to a
U.S. paper [Ref. 2, 3], SCRSP WGA tasked its rapporteur to communicate concern about
TCAS equipage on UAVs to the USAF Global Hawk Program Office. The letter stated
that WGA did not endorse TCAS equipage on UAVs at that time and that such equipage
would only complicate and delay operation of UAVs in all classes of airspace worldwide.
WGA did encourage equipping UAVs with Mode S transponders with 25-ft altitude
reporting. Finally, in March 2002 (Kobe), in response to a U.K. paper [Ref. 4], WGA re-
affirmed its previous view and developed text for a note to be included in ICAO Annex 6
stating that the ICAO ACAS requirement does not apply to UAVs.

       Nevertheless, in at least one State, TCAS equipage on various types of UAVs is
proceeding. No concept of operations has been communicated to the SCRSP
community, but it is believed that TCAS usage at this time is intended to be restricted to
providing situational awareness.

        This paper proposes that it would be beneficial for SCRSP to provide specific
information/guidance to the UAV community explaining the rigorous safety studies and
analyses that are necessary to assess the safety impact of TCAS-on-UAV operation. In
addition, since TCAS is already present on some UAVs, it would seem beneficial to
recommend specific on-board data recording, so that relevant data could be available as
input to the safety studies and analyses.

  The term preferred by the U.S. military is Remotely Operated Aircraft (ROA). In this
paper, the term UAV has been used, simply because it has been the term more commonly
used in SCRSP. For this paper, ROA and UAV are considered synonymous.

        Section 2 of this paper presents possible implementation options and discusses
issues and/or concerns associated with each option. Section 3 reviews various safety
studies and associated tasks that have been used to date to assess the impact of TCAS
operation. Section 4 attempts to suggest which safety studies and tasks would be
necessary for each implementation option. Section 5 provides a summary.

2. Possible Implementation Options and Corresponding Issues/Concerns

       This section lists possible implementation options for TCAS on UAVs and
discusses issues/concerns associated with each option. The implementation options
considered are:

       1. TCAS II executing RAs autonomously
       2. TCAS II with ground pilot executing RAs
       3. TCAS II (TA/RA mode) with no execution of RAs
       4. TCAS II with procedural restrictions
       5. TA-only operation
          a. TCAS II in TA-only mode
          b. “TCAS 1.5”
          c. TCAS I
       6. Mode S only
       7. New TCAS system for UAVs

       2.1 TCAS II executing RAs autonomously

       A favorable aspect of this implementation is that the UAV would always execute
the TCAS RA, presumably with the correct timing and level of response. Issues to be
explored include: (1) whether the TCAS hardware and software and associated avionics
can be certified to the level of criticality needed for autonomous operation, and (2)
whether the reported altitude of intruders in the UAV environment is sufficiently reliable
and/or accurate to allow removal of a pilot reasonableness check.

       2.2 TCAS II with ground pilot executing RAs

        Implementations in which a ground pilot executes RAs generate a concern similar
to that of the autonomous implementation, in that the ground pilot may not have
sufficient situational awareness to provide a pilot reasonableness check. Pilot situational
awareness level would depend on the type of information provided to the ground pilot.
For example, simply downlinking the TCAS traffic display to the ground pilot would not
allow the pilot to recognize cases of incorrect altitude reporting.

       A second concern is the reliability and/or potential unavailability of the air-
ground-air data link. The communication protocols and the probability of successful

communication would have to be factored into TCAS safety studies. Degradation in link
performance would have to be detected and handled appropriately.

        A third concern is the pilot response delay introduced by the air-ground-air
communication link. Studies have shown that delayed responses degrade TCAS
performance [5]. Also of concern is the interaction of a delayed response with the
TCAS-TCAS reversal logic. Simulations have revealed encounters in which one
aircraft‟s delayed response to an RA leads to a sense reversal in both aircraft, potentially
causing altitude crossings at close range and decreasing separation.

        Two types of communication links can be considered: line of sight and beyond
line of sight. For either type, the maximum RA response time should be determined.
The concern, especially with beyond line of sight communication with multiple relays, is
that the RA response time assumed by TCAS may not be possible.

       2.3 TCAS II (TA/RA mode) with no execution of RAs

        In this implementation, TCAS II would be fully operational except that there
would be no response to TCAS RAs. This is not considered acceptable, since the UAV
would be reporting a fully operational TCAS II status to other TCAS-equipped aircraft.
In an encounter, this would cause the TCAS-TCAS coordination logic to be executed and
could limit maneuver refinement options for the other aircraft. If the goal is situational
awareness, a better option is described in section 2.5, TA-only operation.

       2.4 TCAS II with procedural restrictions

        This implementation considers a UAV equipped with TCAS II but with
procedural restrictions. Examples might include restriction of the UAV to special use
airspace for the climb and/or descent phases of flight, requirement for an escort aircraft in
certain airspace, or required selection of TA-only mode in phases of flight that are
deemed problematic for RA execution (e.g., when the UAV is beyond line-of-sight
communication from the ground pilot, or when crossing altitude encounters are very
likely to occur.) Presumably these restrictions would be initiated based on the results of
the safety analyses described in sections 3 and 4.

       2.5 TA-only operation

        Three different implementations are considered here: (1) TCAS II operating in
TA-only mode, (2) “TCAS 1.5,” i.e., TCAS II surveillance without RA capability, and
(3) TCAS I according to RTCA DO-197A. These implementations would be used for
situational awareness. The limited range capability of TCAS I would seem to make the
use of TCAS I less desirable than the other two options for the larger UAVs.

       The author is not aware of any safety concerns associated with the use of TA-only
operation for situational awareness.

         A concern would arise if a ground pilot were to attempt to maneuver based on
downlinked TCAS situational awareness information. If the intruder were TCAS-
equipped, an uncoordinated encounter would take place with the potential for decreased
aircraft separation. This is because the TCAS-equipped intruder will select an RA
assuming that the UAV will continue on its current flight path. If the ground pilot were
to initiate a maneuver, it could easily thwart the maneuver of the other aircraft. Even
when the intruder is not TCAS-equipped, a maneuver initiated by a ground pilot based on
downlinked TCAS information is not advised. Guidance material for both TCAS I and
TCAS II states that pilots should not maneuver based on a Traffic Advisory or
information shown on the traffic display unless the pilot has visually acquired the

       2.6 Mode S only

        The current recommendation from SCRSP is to equip UAVs with 25-ft altitude
reporting Mode S transponders. This would allow the UAV to be seen by both TCAS-
equipped aircraft and ground controllers. TCAS aircraft can thus issue RAs against the
UAV and resolve conflicts that arise.

        The drawback to this option is that the UAV is not protected against conflicts with
non-TCAS-equipped aircraft. Controllers can provide avoidance maneuvers in
encounters between controlled aircraft and UAVs, but this protection would not be
assured in encounters with non-controlled aircraft. The feasibility of this option depends
largely on the airspace in which the UAV intends to fly and the type of aircraft which the
UAV is likely to encounter.

       2.7 New TCAS system for UAVs

       Here the thought is that, based on the analyses in sections 3 and 4 below,
refinements to the UAV TCAS surveillance and/or CAS logic might be warranted or new
modules might be needed to compensate for loss of the on-board pilot. No detailed
consideration has been given to this implementation option in this paper.

3. Safety Analyses and Related Tasks

       This section discusses a variety of tasks that could be used to address the above
concerns. These tasks include:

       1. Generation of a UAV concept of operations
       2. Characterization of the UAV operational environment, including generation of
          a UAV encounter model
       3. Determination of a logic risk ratio using the encounter model
       4. Use of an „event tree‟ to calculate the risk of collision for the end-to-end UAV
          TCAS system
       5. Analysis of UAV-aircraft interaction in TCAS-TCAS coordinated encounters

       6. For autonomous RA response, development of ways to meet criticality

       3.1 Concept of Operations

        The Concept of Operations is necessary before any TCAS-on-UAV
implementation can be analyzed, as it provides inputs to the remaining tasks in this
section. Examples of information provided by the Concept of Operations include flight
characteristics of the UAV, implementation option selected (e.g., TCAS II executing RAs
autonomously, TA-only mode, Mode S only, etc.), communication protocols between
ground pilot and UAV, situational awareness available to ground pilot, identification of
the airspace used for different phases of flight (e.g., restricted military airspace for take-
off and landing), rate of climb to cruise altitude, cruise altitude, rate of descent, and
methods for handling error conditions (e.g., air-ground-air link problems and UAV flight

       3.2 UAV Encounter Model

        An encounter model is developed for use in calculating the logic risk ratio
(below). A number of encounter models exist for manned aircraft, including an ICAO
encounter model, a European ACAS safety encounter model, and a MITRE encounter
model. These models can be used as a guide for the development of a UAV encounter
model. The UAV encounter model would define the types of encounters expected and
the relative frequency of occurrence for each encounter type.

        An encounter model specific to UAVs is necessary for several reasons: (1) Flight
characteristics of UAVs may differ from those of manned aircraft. (2) Flight profiles
may differ; e.g., the largest UAVs typically fly at high altitudes and thus have relatively
long periods of climb and descent. (3) The flight environment may differ; e.g., UAVs
might take off from a remote area or a restricted airspace. Building the encounter model
typically requires analysis of a large number of actual encounters. Data for this purpose
could come from UAV on-board data recording or ATC radar observations of appropriate

       3.3 Logic Risk Ratio

        The concept of risk ratio is used to evaluate the relative effect of TCAS on system
safety. Risk ratio is defined as the risk of collision (or more typically a near-collision)
when equipped with TCAS, relative to the risk when not equipped with TCAS. The term
“logic risk ratio” limits the consideration to the effect of the CAS logic, omitting other
factors, e.g., surveillance performance, that could affect the safety of the end-to-end
TCAS system.

        Risk ratio is typically determined by executing large numbers of simulated two-
aircraft encounters. Each encounter is run twice, once with the “unit under test” equipped
with TCAS and once with the unit under test not equipped with TCAS. The vertical

separation of the two encounter aircraft at closest approach is the metric used to compare
risk of collision with and without TCAS.

        Note that although the CAS logic installed in a UAV might be identical to the
CAS logic in a standard aircraft, the performance of the CAS logic in the UAV could
differ due to various factors, e.g., pilot response delays or the unique UAV flight
envelope. Also, the weighting of the different encounter types, used in determining
overall logic risk ratio, could be quite different for a UAV as opposed to a standard
aircraft. For example, for the larger UAVs that fly at very high altitudes, the majority of
encounter geometries could involve a climbing or descending UAV. This could result in
a disproportionately large number of crossing RAs.

       3.4 Event Tree

        The event tree, or “fault tree,” provides both a qualitative and quantitative means
to identify and analyze failure modes in the end-to-end system. It identifies all possible
means by which a collision (or a near-collision) can occur, organizes them into a logical
structure to study the processes leading to failure, and systematically identifies the root
causes and interactions.

        An important consideration in the use of the event tree for UAVs is that the
branch normally present to address the effect of pilot visual acquisition will need to be
changed. TCAS event trees typically assume that if the pilot of the TCAS aircraft
visually acquires a conflicting aircraft, s/he will avoid it. Any resulting increase in
collision risk due to the lessened pilot visual acquisition may need to be addressed by
other means.

       3.5 UAV-Aircraft TCAS-TCAS Coordinated Encounters

        Of special concern, if a UAV ground pilot executes RAs, is the effect of any UAV
response delay on the current TCAS-TCAS reversal logic. Earlier versions of the TCAS
logic did not allow either aircraft in a coordinated encounter to reverse the RA sense
(up/down) once the sense was chosen. In the current logic (TCAS Change 7, equivalent
to the international ACAS), sense reversals are allowed and are controlled by the aircraft
whose Mode S transponder has the lower address. If the lower-address aircraft
determines that the selected sense is not working (due perhaps to a non-response,
contrary response, or late response by the other aircraft), the lower-address aircraft can
reverse its sense, causing a corresponding sense reversal in the higher-address aircraft.

        Simulations have shown that a late response on the part of one aircraft can
essentially cause the TCAS RA selection logic on both aircraft to become slightly out of
synch with the actual aircraft movement. This is due to tracker lag: just as the lower-
address aircraft determines that the other aircraft is not responding and issues a sense
reversal, the higher-address aircraft starts to respond to the original maneuver. This can
lead to multiple altitude crossings at close range and result in much-reduced vertical

       In past TCAS safety studies, separate studies have focused on TCAS-TCAS
coordinated encounters and characterized the performance of the TCAS-TCAS logic
under stressing conditions. These studies could be tailored to the specifics of UAV

       3.6 Criticality Requirements and Other Issues

        Because a UAV cannot presently depend on a pilot‟s visual acquisition and
subsequent maneuver decision-making to compensate for failures in the TCAS system,
TCAS components and aircraft systems that interface with TCAS may need to meet
more stringent standards for UAV installation than for standard aircraft installation. If
the presence of an on-board pilot has ensured an acceptably low safety risk, then other
techniques for risk mitigation (e.g., equipment redundancy, higher software certification
levels) may be required as identified by the event tree in section 3.4. No consideration is
given in this paper to the development of these other methods for risk mitigation.

        Also, note that this paper does not consider resolution of policy and regulatory
issues. These issues would include pilot/remote operator licensing, integration of UAV
operations into the civilian airspace system/airspace management, legal aspects of UAV
operations, and security requirements.

4. Mapping of Implementation Options and Safety Analyses

        The following table suggests which safety studies and/or tasks might be required
for each implementation option. Note that the omission of a particular analysis or task
for a given implementation option does not imply that the analysis or task is unnecessary,
only that it would not specifically assess the safety of TCAS-on-UAV operation.

 Implementation Option                 Applicable Safety Analyses & Tasks

TCAS II executing RAs         Concept of Operations
autonomously                  UAV Encounter Model
                              Logic Risk Ratio
                              Event Tree
                              Criticality Assessment
TCAS II with ground pilot     Concept of Operations
executing RAs                 UAV Encounter Model
                              Logic Risk Ratio
                              Event Tree
                              UAV-Aircraft TCAS-TCAS Coordinated Encounters
                              Criticality Assessment
TCAS II with procedural       Concept of Operations
restrictions                  UAV Encounter Model
                              Logic Risk Ratio
                              Event Tree
                              UAV-Aircraft TCAS-TCAS Coordinated Encounters (if
                              ground pilot is executing RAs)
                              Criticality Assessment (if executing RAs autonomously)
TA-only operation             Concept of Operations
(no pilot maneuvers based
on the traffic information
Mode S only

New TCAS system for           Concept of Operations
UAVs                          UAV Encounter Model
                              Logic Risk Ratio
                              Event Tree
                              UAV-Aircraft TCAS-TCAS Coordinated Encounters
                              Criticality Assessment

5. Summary

       This paper discusses possible TCAS-on-UAV implementation options and
suggests safety analyses and studies that would be necessary to understand the impact of
TCAS-on-UAV operation and to address concerns.

        It is proposed that the ACAS subgroup be tasked to further refine the ideas
presented in this paper. The goal would be a SCRSP-recommended safety analysis plan
for TCAS-on-UAV operation, which could then lead to an ICAO position concerning the
use of TCAS on UAVs.


1. Dietrich Grodd, “ATM for UAVs in NATO,” WP 760, SICASP WG2, May

2. Larry Nivert, “Proposed Use of ACAS on the Global Hawk Unmanned
   Aerial Vehicle,” Flimsy 1, SCRSP WGA, October 2001

3. Larry Nivert and Ken Carpenter, “Use of TCAS in UAVs,” Flimsy 2,
   SCRSP WGA, October 2001

4. Ken Carpenter, “Proposed Note to the standards requiring the carriage of
   ACAS relating to their application to UAVs,” SCRSP WP A/3-112, March

5. ACASA PROJECT, Work Package 1, “ Studies on the Safety of ACAS II in
   Europe,” ACASA/WP-1.8/210D, March 2002


Shared By: