Modeling for UAS Collision Avoidance

For UAS to be granted full access to civil airspace, their safety case must address collision avoidance, including the lack of an onboard pilot who could see-and-avoid other traffic, as on conventional aircraft. This paper discusses several methods and tools that have been accepted for modeling and evaluating the safety of collision avoidance for manned aircraft. Example results are illustrated. Issues and additional work for extending their use to UAS are discussed. Today, many manned aircraft are equipped with the Traffic Alert and Collision Avoidance System (TCAS II), the world standard system for collision avoidance. However, simply installing that system aboard UAS is problematic for a number of reasons affecting the safety calculation. Introduction It will be necessary to evaluate all aspects of safety in order to certify Unmanned Aircraft Systems (UAS) for access to civil airspace. One of the key safety concerns is collision risk. Wherever aircraft coexist in the airspace, some collision avoidance capability is required as a last-ditch safety measure. The UAS will need to provide some means of substituting for in-cockpit see-and-avoid capability, and its systems may also provide an automated detection and resolution function for impending collisions. This paper describes work being undertaken as part of the MITRE Research Program. The results should prove useful to the process of developing UAS Sense and Avoid standards within RTCA SC-203, as well as to certifying authorities within the Federal Aviation Administration. Need for Modeling The industry has tended to demonstrate candidate UAS collision avoidance technologies using flight trials. These typically are limited to small numbers of encounters with targets, and cannot explore a wide variety of conditions. It is easier to demonstrate target acquisition with a sensor than it is to flight test a complete end-to-end avoidance capability, and consequently the experience is especially thin regarding algorithmic or pilot performance. However, the regime of certifying safety drives the need to evaluate performance for all credible hazards, and to do so over the full range of credible conditions, from simple to stressing. Fault Tree Method One accepted means of evaluating the complexities of collision avoidance safety is to construct a fault tree and evaluate its elements. The tree structure provides the mathematical basis of combining the separate event probabilities to determine the overall risk. The fault tree method, which gained prominence within the nuclear power industry, was used for the acceptance of the Traffic Alert and Collision Avoidance System (TCAS), the worldwide standard system for manned aircraft above a specified passenger or cargo capacity. The method develops one or more fault trees for “top events”, and through deductive logic shows every condition or causal element that could lead to that event. The tree also shows the benefit of mitigating factors. Since encounters with various hazard types are essentially independent, the structure and mathematics of the evaluation is more straightforward, and allows each type to be explored separately. Figure 1 shows the top levels of a midair collision fault tree. The top event is divided into two main branches: midair collisions that are not prevented, and those that are created by a maneuver presumably intended to avoid the collision. Figure 2 begins to develop the “unresolved” portion of the tree. Further expansion of the tree (not shown) would develop causes for neither the pilot nor the collision avoidance system having avoided the event. MAC Midair collision