c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a19a18a7a20 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Accident models provide the basis for Investigating and analyzing accidents Preventing accidents Hazard analysis Design for safety Assessing risk (determining whether systems are suitable for use) Performance modeling and defining safety metrics c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a19a18a7a21 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Basic Energy Model Assumes accidents are the result of an uncontrolled and undesired release of energy. Use barriers or control energy flows to prevent them. Barrier ENERGY Energy flow SOURCE OBJECT Variations: Both (1) application of energy and (2) interference in normal exchange of energy. Energy transformation vs. energy deficiency. Action systems (systems that produce energy) vs. nonaction systems (systems that constrain energy) c a15a7a6a7a16a3a6a7a14a71a11a7a8a12a17a72a18a7a18a7a73a75a74a75a76a7a76 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Heinrich’s Domino Model of Accidents People, not things, are the cause of accidents. but said third was easiest to remove. Removing any of dominoes will break sequence, person Unsafe act or condition Accident Injury Fault of environment Ancestry, Social Focus on single causes. Chain?of?Events Models Explain accidents in terms of multiple events, sequenced as a forward chain over time. Events almost always involve component failure, human error, or energy?related event Form the basis of most safety?engineering and reliability engineering analysis: e.g., Fault Tree Analysis, Probabilistic Risk Assessment, FMEA, Event Trees and design: e.g., redundancy, overdesign, safety margins, ... a68a26a51a30a29 a40 a41a3a23a59a41 a40a26a43a26a44a42a40a37a66a33a40 a64 a55a53a34a39a51a26a52a69a23a26a70a26a27a28a50 a32a26a52a33a23 a43 a41 a36a48a27a37a36a38a29a31a23a26a32a37a41a53a50 a60a26a61 a23a59a41a3a51a33a25 a40 projected Equipment damaged Personnel injured Fragments a77a42a78 metal rupture a22a24a23a26a25a28a27a30a29a31a23a33a32a26a34a35a23a37a36a38a36a31a27a26a34a39a23 a40 a36a42a41 a40a26a43a26a44a45a40a26a46 a23a37a36a48a47 Weakened Tank CorrosionMoisture Operating pressure a83a63a84a19a85 a52 a23a28a47 a40a26a46 a49a12a36a31a23a33a25a26a23a37a36a48a50 a29a2a29 a40a26a43 a41 a49a48a36a48a23a59a36a2a41 a50 a23a30a36a2a36 a57a31a23a26a34a39a25a26a23a30a36a31a50 a46a26a43 a52a33a23a37a41 a61 a49a48a36a48a23a33a60a28a27a26a34 a36a2a41a54a25a28a50 a32a26a58a28a34 a40 a40a26a46 a52 a56a54a34a39a51a30a57a31a50 a25a26a23a33a52a33a23a30a36a31a58 a62a63a23a28a23a26a32a33a32a26a23a28a34 a36a31a51 a43a26a43 a23a26a61a53a55a53a34a39a51a26a52a61 a79 a40 a43 a40 a50 a41a41a3a51 a23a26a23a28a32a33a52a33a51a26a50 a36a2a41a53a27a28a34a35a23 a36a2a41a53a23a28a23a26a61a2a51a26a34a38a29a31a51 a41a72a51a30a55 a41a3a58a26a50 a29 a44a38a43 a23a30a36a2a36a42a36a48a51 a41a3a51a33a34a35a27a28a32a30a41a3a27a26a34a35a23a33a60a28a23a30a55a3a51a26a34a35a23a59a41 a40a26a43a28a44 a36a2a29a31a34a35a23a26a23 a43 a41a53a51a59a29a31a51 a43 a41 a40 a50 a43 a57a48a50 a29a31a50 a64a65a51a30a55a28a41 a40a28a43a26a44a63a66 a58a26a50 a61 a23 a44 a40 a43 a50a41a54a50a51a26a27a37a41a54a51a30a55a26a41 a40a26a43a28a44 a47 a32a26a61 a41a53a23a59a29 a34a39a60a26a51 a29a31a51a26a34a35a34a39a51a30a36a31a50 a51 a43a59a66 a50 a61 a61 a51a30a41 a25a26a51a28a23a30a36a31a80a26a32a26a34a39a23a30a57a31a23 a41a3a50 a43a26a46 a52a33a51a28a34a35a23 a32a28a51a30a36a2a36a48a50 a60a28a61 a23a59a55a53a34 a40a26a46 a52a33a23 a41 a36a48a47 a36a65a32a28a34a35a23a30a36a2a36a31a27a26a34a35a50 a67a31a23a26a25a28a47 a40 a40 a43 a43 a43 a43 a36a2a41a53a23a28a23a26a61a53a41a53a51a33a32a28a34a35a23a30a57a31a23 a41 a34a39a23a26a25a26a27a37a29a48a23a59a36a2a41a53a34a39a23 a41a53a58a59a41a3a51 a23a30a81a2a41a3a23 a36a31a50 a57a31a23a33a25 a52 a23 a43 a43a26a46 a43 a40 a40a28a46 a50 a61a29a31a51 a41 a40 a29a2a41 a50 a41a53a58 a55 a27a26a34a39a23a33a32a26a51a26a50 a41a54a25a26a27a28a34a35a50 a43a26a46 a40a26a43 a25a59a55a53a34 a40a26a46 a52a82a23 a43 a41 a40 a41a3a50 a51 a43 a47 a43 a66 a40 a43 a52a33a51a26a50 a36a2a41a3a27a26a34a35a23a28a47 a55a3a51a26a34a39a23a30a36a48a23a28a23 a60a28a61 a23a33a61 a50 a55a53a23a37a41a53a50 a52a33a23a28a47 a40 a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a76a136a74 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 c Chain?of?Events Example: Bhopal E1: Worker washes pipes without inserting slip blind E2: Water leaks into MIT tank E3: Explosion occurs E4: Relief valve opens E5: MIC vented into air E6: Wind carries MIC into populated area around plant c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a76a7a137 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Limitations of Event Chain Models: Social and organizational factors in accidents a133a134a118a33a113a33a96a33a101a2a89 a106a98a95a35a118a33a117a94a96a92a112a19a96a33a101a135a106a121a108a75a96a33a105a102a91a33a118a33a104a33a89a39a104a33a117a122a106a127a95a35a97a100a87a92a108a59a89a35a96a33a87a33a97a98a108a59a104a33a118a33a96a127a128a33a87a33a97a122a95a35a105a100a97a102a105a122a95a35a96a33a118a33a105a102a96a33a116 a87a98a89a124a108a75a91a33a104a33a115a33a117a33a91a120a108a75a91a33a96a120a108a75a96a33a105a102a91a33a118a33a104a33a89a39a104a98a117a59a106a127a109a94a87a59a106a129a128a33a96a120a130a131a96a33a89a39a89a102a113a33a96a92a112a72a96a33a89a39a104a59a90a92a96a33a113a94a89a35a104a33a118a33a117a94a128a33a96a33a132a7a104a33a101a2a96a120a108a75a91a33a96 a97a102a105a102a95a39a96a33a118a33a105a102a96a94a96a33a109a94a96a33a101a2a117a33a96a33a97a102a103a120a119a100a112a72a96a33a101a2a89 a106a98a95a35a118a33a117a94a96a92a112a72a96a33a101a53a106a121a108a75a96a33a105a102a91a33a118a33a95a35a105a122a87a33a89a102a104a33a101a123a105a102a95a124a112a72a95a39a89a102a97a72a106a98a97a107a108a75a96a33a109a125a95a39a97a126a87 a97a102a104a33a105a102a95a39a87a33a89a102a97a19a106a107a97a98a108a75a96a98a109a110a108a75a91a33a87a92a108a12a90a111a101a2a104a92a112a19a95a35a113a33a96a33a97a114a90a92a115a33a101a53a90a92a104a33a97a102a96a33a116a33a117a33a104a33a87a33a89a39a97a102a116a33a87a33a118a33a113a94a113a33a96a33a105a102a95a39a97a102a95a39a104a33a118a94a105a102a101a2a95a37a108a75a96a33a101a2a95a35a87a33a103 a86a88a87a33a89 a90a92a91a94a93a94a95a35a89a39a96a98a97a100a99a102a101a2a103 Models need to include the social system as well as the technology and its underlying science. System accidents Software error c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a76a7a138 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Limitations of Event Chain Models (2) Human error Deviation from normative procedure vs. established practice Cannot effectively model human behavior by decomposing it into individual decisions and actions and studying it in isolation from the physical and social context value system in which it takes place dynamic work process Adaptation Major accidents involve systematic migration of organizational behavior under pressure toward cost effectiveness in an aggressive, competitive environment. a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a76a7a139 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Design Vessel Design Shipyard Equipment load added Harbor Design Cargo Calais Zeebrugge Traffic Vessel Management Passenger Management Scheduling Operation Berth design Berth design Operations management Captain’s planning procedure to Zeebrugge Transfer of Herald heuristics Operations management procedure Unsafe patterns docking Standing orders Operations management Excess numbers Passenger management Capsizing Change of Crew working Stability Analysis Truck companies Impaired stability Excess load routines Docking c Time pressure Operational Decision Making: Accident Analysis: Combinatorial structure Decision makers from separate of possible accidents departments in operational context can easily be identified. very likely will not see the forest for the trees. c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a76a7a178a7a73a75a74a39a76a7a179 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 STAMP (Systems Theory Accident Modeling and Processes) To effect control over a system requires four conditions: Goal Condition: The controller must have a goal or goals (e.g., to maintain a setpoint) Action Condition: The controller must be able to affect the system state. Model Condition: The controller must be (or contain) a model of the system Observability Condition: The controller must be able to ascertain the state of the system. a176a123a151a71a152a102a154a148a142a45a147a148a147a126a168a157a152a102a164a45a142a156a165 a147a126a168a144a162a54a147a148a149a102a154a148a152a156a155a72a149a53a145a107a163a75a155a102a177 a159a160a142a102a161a156a162a45a163 a151a153a142a45a164a94a151a153a142a156a165 a145a45a149a166a163 a152a107a155a54a147a167a141a102a163a75a150a157a145a156a168a169a152a156a155a54a158a144a147a148a146a63a147a148a149a3a142a156a168a171a170a148a145a156a151a153a147 a172 a162a102a151a30a151a153a142a156a155a54a149a45a147a63a149a53a145a102a149a53a142a94a173a153a170a148a145a107a165a75a162a72a142a45a147a114a152a45a174a45a147a63a146a148a147a148a149a3a142a156a168a171a170a148a145a156a151a153a147a148a175 a140a111a141a54a142a144a143a134a145a102a146a148a147a114a149a2a141a72a142a94a150a45a151a153a152a45a154a148a142a102a147a148a147a114a154a148a145a156a155a157a154a42a141a54a145a156a155a54a158a102a142a144a147a148a149a3a145a45a149a3a142 Displays Controls inputs Process outputs Process Controlled Process variables Controlled InterfacesProcess Model of Model of variables (Controller) Human Supervisor Automation Model of Process Model of Measured SensorsActuators Automated Controller Disturbances c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a76a7a20 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 outputs Process variables Controlled variables Measured inputs Controlled Process and Decision Aiding Automated Display InterfacesProcess Model of Model of Process Model of Process Sensors Actuators Model of (Controller) Human Supervisor Automation Safety and the Process Models Accidents occur when the models do not match the process Wrong from beginning Missing or incorrect feedback so not updated Must also account for time lags Explains human/machine interaction problems Pilots and others are not understanding the automation What did it just do? Why won’t it let us do that? Why did it do that? What caused the failure? Disturbances c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a76a7a21 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 What will it do next? What can we do so it does not How did it get us into this state? happen again? How do I get it to do what I want? Don’t get feedback to update mental models or disbelieve it a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a76a7a18 a0a2a1a3a1a3a4 a5a124a6a7a8a7a9a7a10a48a11a7a5a124a6a7a13 a14 c A Systems Theory Model of Accidents Accidents arise from interactions among humans, machines, and the environment. Not simply chains of events or linear causality, but more complex types of causal connections. Safety is an emergent property that arises when components of system interact with each other within a larger environment. A set of constraints related to behavior of components in system enforces that property. Accidents when interactions violate those constraints (a lack of appropriate constraints on the interactions). Software as a controller embodies or enforces those constraints. c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a7a74a75a76 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 A Systems Theory Model of Accidents (2) Safety can be viewed as a control problem e.g. O?rings did not adequately control propellant gas release Software did not adequately control descent speed of MPL Safety management is a control structure embedded in an adaptive system. Events indirectly reflect the effects of dysfunctional interactions and inadequate control Need to examine control structure itself to understand accidents Result from: Inadequate enforcement of constraints At each level of socio?technical system controlling development and operations c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a7a74a7a74a75a73a136a74a7a74a75a137 SYSTEM DEVELOPMENT Congress and Legislatures Government Reports Legislation Lobbying Hearings and open meetings Accidents Government Regulatory Agencies Industry Associations, User Associations, Unions, Insurance Companies, Courts Regulations Certification Info. Standards Change reports Certification Whistleblowers Legal penalties Accidents and incidents Case Law Company Management Safety Policy Status Reports Standards Risk Assessments Resources Incident Reports Policy, stds. Project Management Hazard Analyses Safety Standards Safety?Related Changes Standards Safety Reports Test reports Review Results Hazard Analyses Progress Reports Hazard Analyses Design Rationale Documentation Hazard Analyses a0a38a1a71a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 SYSTEM OPERATIONS Congress and Legislatures Government Reports Legislation Lobbying Hearings and open meetings Accidents Government Regulatory Agencies Industry Associations, User Associations, Unions, Insurance Companies, Courts Regulations Standards Certification Legal penalties Case Law Accident and incident reports Operations reports Maintenance Reports Change reports Whistleblowers Company Management Safety Policy Operations Reports Standards Resources Operations Management Progress Reports Design, Documentation Safety Constraints Test Requirements Implementation and assurance Manufacturing Management Work safety reports Maintenance Procedures audits and Evolution work logs Incidents inspections Change Requests Manufacturing Performance Audits Problem reports Audit reports Work Instructions Change requests Physical Actuator(s) Problem Reports Hardware replacements Software revisions Operating Process Operating Assumptions Operating Procedures Revised operating procedures Automated Human Controller(s) Controller Sensor(s) Process c a15a7a6a7a16a3a6a7a14a71a11a7a8a12a17a102a74a7a74a75a138 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 GOAL: Provide a framework for classifying factors leading to accidents and a system engineering methodology for handling them. Some causes of dysfunctional interactions: Asynchronous evolution Inconsistent models inadequate or missing feedback time lags inadequate engineering design activities etc. Inadequate coordination among controllers and decision makers Boundary areas Overlap areas c a15a7a6a7a16a3a6a7a14a71a11a7a8a12a17a102a74a7a74a75a139 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Control Flaws Leading to Hazards Inadequate control actions (enforcement of constraints) Unidentified hazards Inappropriate, ineffective, or missing control actions for identified hazards Design of control algorithm (process) does not enforce constraints Process models inconsistent, incomplete, or incorrect (lack of linkup) Flaw(s) in creation process Flaws(s) in updating process (asynchronous evolution) Time lags and measurement inaccuracies not accounted for Inadequate coordination among controllers and decision?makers (boundary and overlap areas) Inadequate Execution of Control Action Communication flaw Inadequate actuator operation Time lag Inadequate or missing feedback Not provided in system design Communication flaw Time lag Inadequate sensor operation (incorrect or no information provided) c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a7a74a75a178 a0a2a1a3a1a3a4 a5a124a6a7a8a7a9a7a10a48a11a7a5a124a6a7a13 a14 Human Error Models Categorize errors by external manifestations Categorize by type of task Simple, vigilance, emergency response, control, complex Coordinating, scanning, recognizing, problem solving, planning ... Usually consider performance?shaping factors such as task structure, stress, design of displays and controls Categorize by cognitive mechanisms Instead of focusing on task and environment characteristics, consider psychological mechanisms used by operator in performing tasks. Interaction of psychological factors with features of work environment Requires only a limited number of basic concepts c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a7a74a75a179 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Common Features of Cognitive Models Most based on Bartlett’s ‘‘schemas’’ Internal representations of regularities of the world An organized structure of knowledge Our way of understanding and dealing with world Slips vs. Mistakes (Don Norman) Mistake is an error in intention (error in planning) Slip is error in carrying out the intention Human?Task Mismatch (Rasmussen) Errors are an integral part of learning Should be considered human?task or human?system mismatches Skill?Rules?Knowledge framework (Rasmussen) Human skills needed to solve problems also lead to errors If eliminate possibility of human error, may eliminate ability to solve problems. Rasmussen Model of Human?Task Mismatch a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a7a74a75a20 c a0a2a1a3a1a3a4 a5a124a6a7a8a7a9a7a10a48a11a7a5a124a6a7a13 a14 a180a166a181a37a182 a181a37a183a7a182 a184a185a30a186 a185a37a187a30a188a135a181a30a189a135a181a30a190 a191a30a192a135a181a30a189a135a181a30a186a37a182 a188a12a185a30a190a2a187 a191a30a193a30a192 a182 a188 a194 a186a30a181a37a191a30a195a19a196a37a191a30a182 a197a26a198a153a191a37a183a7a183a135a184 a199a37a181a30a186a30a182 a191a30a192a12a182 a184a200a63a184 a186a30a201 a202 a185a37a200a63a200a63a184 a188a135a188a135a184a185a30a186a63a185a30a187a37a181a30a203a135a182 a190a191a30a186a37a181a30a185a30a193a30a188a12a191a30a183a135a182 a202 a185a37a200a63a200a63a184 a188a135a188a135a184a185a30a186a63a185a30a187a37a181a30a190 a190a185a30a186a30a181a37a185a30a193a30a188a12a191a30a183a135a182 a204a166a204a148a205 a190a185a30a186a30a201a63a182 a184 a200a63a184 a186a30a201 a204a166a204 a184a186a30a191a30a183a135a183a135a193a30a190 a191a30a182a181a63a196a30a181a30a190 a187a185a30a190a200a63a191a30a186a30a183a135a181 a194 a196a30a181a37a183a7a184 a187 a184a181a37a199a63a182a191a37a188a7a195a12a186a30a185a37a182a30a196a30a181a37a190 a187a185a37a190 a200a63a181a30a199 a204a166a204 a185a30a200a63a184 a188a135a188a135a184a185a30a186a63a185a37a187a30a191a30a183a135a182 a206a63a191a30a186a30a191a37a201a30a181a30a200a63a181a37a186a30a182 a207a28a199a30a200a63a184 a186a37a184 a188a135a182 a190a191a30a182 a184a185a30a186 a206a63a191a30a184 a186a30a182a181a30a186a37a191a30a186a30a183a135a181a26a198a35a190 a181a30a196a37a191a30a184 a190a2a192a185a37a201a30a184 a188a135a182 a184 a183a7a188 a208a38a181a37a188a135a182a30a191a30a186a37a199a148a183a135a191a37a192 a184a209a30a190 a191a30a182 a184a185a30a186 a210 a196a30a181a37a190 a191a30a182 a184a185a30a186 a180a166a181a37a183a7a184 a188a7a184a185a30a186 a211a199a30a181a37a186a30a182 a184 a187 a184 a183a7a191a37a182 a184a185a37a186 a204a166a204 a188a135a181a37a192a181a30a183a135a182a30a201a30a185a37a191a30a192 a204a166a204 a188a135a181a37a192 a181a30a183a135a182a30a182 a191a30a190a201a37a181a30a182 a204a166a204 a188a135a181a37a192 a181a30a183a135a182a30a182 a191a30a188a135a195 a207a212a183a7a182 a184a185a37a186 a204a166a204 a185a37a196a30a181a30a190 a191a30a182 a184a185a30a186a30a191a37a192 a188a7a181a37a213a30a193a30a181a37a186a30a183a135a181 a204a166a204 a181a37a203a135a181a30a183a135a193a30a182 a184a185a30a186 a204a166a204 a183a135a185a37a200a63a200a63a193a30a186a30a184 a183a135a191a37a182 a184a185a37a186 a180a166a184 a188a135a183a135a190 a184a200a63a184 a186a30a191a30a182 a184a185a30a186 a204a166a204 a188a135a182a181a37a190 a185a30a182 a214a135a196a30a181a63a187 a184 a203a135a191a30a182 a184a185a30a186 a204a166a204 a187a191a37a200a63a184 a192 a184a191a37a190a38a188a135a197a37a185a30a190 a182 a183a135a193a30a182 a204a166a204 a188a7a182a181a30a190a181a30a185a30a182 a214a135a196a30a181a63a182 a191a30a195a135a181a30a185a37a189a7a181a37a190 a215a135a191a37a209a30a190 a184 a183a135a191a37a182 a184a185a37a186 a216a37a83a218a217a19a219 a77a42a78a212a220 a83a148a216a212a216a212a221a166a217a12a219a19a222 a84a136a223 a224a225a221 a78 a216 a77a42a78a12a226 a83a148a84a212a217a59a221a225a227 a206a63a181a30a186a30a182 a191a30a192a135a192a185a30a191a37a199a26a198a153a190 a181a30a188a135a185a30a193a30a190 a183a135a181a30a188 a194 a193a30a209a37a228 a181a30a183a135a182 a184a189a7a181a63a201a37a185a30a191a30a192 a188a19a191a30a186a37a199a63a184 a186a30a182a181a30a186a30a182 a184a185a37a186a30a188 a207a28a187 a187a181a37a183a7a182 a184 a189a135a181a63a187 a191a30a183a135a182 a185a37a190 a188 a220 a222a219a19a229a212a83a225a219a19a222 a77 a84a65a216a124a83a218a217a19a219 a77a42a78a212a220 a227 a208a2a191a30a188a135a195 a202 a197a30a191a30a190 a191a30a183a135a182 a181a37a190 a184 a188a135a182 a184 a183a135a188 a230a124a197a30a214a135a188a135a184 a183a135a191a30a192a38a231a37a186a30a189a135a184 a190a185a30a186a30a200a63a181a37a186a30a182 a232a45a185a37a190 a195a19a208a2a184 a200a54a181 a202 a197a30a191a30a190 a191a37a183a135a182 a181a37a190 a184 a188a135a182 a184 a183a7a188 a211a186a30a188a135a196a37a181a30a183a135a182 a184a185a30a186 a211a186a30a188a135a182 a191a30a192 a192a191a30a182 a184a185a30a186 a230a37a190a185a30a183a135a181a37a199a30a193a30a190 a181a63a199a37a181a30a188a135a184 a201a30a186 a231a37a213a30a193a37a184a196a30a200a63a181a30a186a37a182a30a199a30a181a37a188a135a184 a201a30a186 a83a225a233a37a233a212a234 a226 a83a148a239a166a216a212a229a19a84a136a217a19a219a19a222 a77 a84a12a227 a217a19a83a148a229 a220 a221 a220a82a77 a216a42a240a19a229 a226 a83a148a84 a226 a83a63a239a2a216a212a229a12a84a212a217a12a219a19a222 a77 a84a19a227 a226 a221a241a217a122a240a136a83a148a84a19a222 a220a148a226a12a220a33a77 a216a42a240a12a229 a226 a83a148a84 a226 a83a148a239a2a216a212a229a12a84a212a217a12a219a19a222 a77 a84a19a227 a221a166a242a225a219a19a221 a78 a84a212a83a148a239 a226a12a77 a85a12a221 a77 a216a226 a83a63a239a2a216a212a229a12a84a212a217a12a219a19a222 a77 a84a19a227 a222a84a212a219a19a221 a78 a84a212a83a148a239a59a240a12a229 a226 a83a148a84 a224a225a221 a78a212a220a218a77 a84a12a84a19a221a218a239a12a219a212a83 a220a148a243 a227 a204a166a204 a187a191a37a200a63a184 a192 a184a191a30a190a2a196a37a191a30a182 a182a181a37a190a186a63a186a30a185a37a182a30a190 a181a30a183a135a185a37a201a30a186a30a184 a244a135a181a30a199 a231a37a203a135a182 a181a30a190a186a37a191a30a192a135a181a30a189a135a181a30a186a30a182 a188 a204a166a204 a188a135a196a37a191a30a182 a184a191a30a192a135a200a63a184 a188a135a185a30a190 a184a181a30a186a30a182 a191a30a182 a184a185a30a186 a204a166a204 a200a63a185a37a182 a185a37a190a2a189a7a191a37a190 a184a191a30a209a37a184 a192 a184 a182 a214 a230a124a197a30a214a135a188a135a184 a183a135a191a30a192 a202 a185a30a185a30a190 a199a30a184a186a30a191a37a182 a184a185a30a186 a183a135a185a30a186a37a188a7a184 a199a30a181a30a190 a181a30a199 a204a166a204 a183a135a185a37a186a30a199a30a184 a182 a184a185a30a186a63a185a37a190a2a188a7a184 a199a30a181a63a181a30a187 a187a181a30a183a135a182a30a186a30a185a37a182 a211a186a30a187 a181a30a190a181a37a186a30a183a135a181 a204a166a204 a185a37a182a197a37a181a30a190a2a188a135a192 a184a196a63a185a30a187a37a200a63a181a30a200a63a185a30a190 a214 a204a166a204 a200a63a184 a188a7a182a191a30a195a135a181a63a191a37a192 a182a181a37a190a186a30a191a37a182 a184 a189a135a181a37a188 a204a166a204 a187a185a30a190a201a30a181a30a182a37a184 a188a135a185a30a192 a191a30a182a181a30a199a63a191a37a183a7a182 a17a166a181a37a183a7a191a37a192 a192 a204a166a204 a191a37a188a135a188a7a193a37a200a63a196a30a182 a184a185a30a186 a204a166a204 a200a63a184 a188a7a184a186a30a182 a181a30a190 a196a30a190 a181a30a182 a191a30a182 a184a185a30a186 a204a166a204 a184a186a30a187 a185a30a190 a200a63a191a30a182 a184a185a37a186a63a186a30a185a30a182a37a190 a181a30a183a135a181a30a184 a189a135a181a37a199 a211a186a30a196a37a193a30a182a26a211 a186a30a187 a185a30a190 a200a63a191a37a182 a184a185a30a186a42a230a37a190 a185a30a183a135a181a30a188a135a188a135a184 a186a30a201 a13a199a30a184 a188a135a182 a190a191a30a183a135a182 a184a185a30a186a28a198a153a181a30a182 a183a19a18 a14 a211a186a37a182 a190 a184a186a30a188a135a184a183a12a197a30a193a30a200a63a191a37a186a63a189a7a191a37a190 a184a191a30a209a37a184 a192 a184 a182 a214 a13 a188a135a184 a183a135a195a135a186a30a181a37a188a7a188a38a198a35a181a30a182 a183a24a18 a14 a210 a196a37a181a30a190 a191a30a182 a185a30a190a31a211a186a30a183a135a191a30a196a37a191a30a183a135a184 a182a191a30a182 a181a30a199 a181a30a182 a183a19a18 a14 a13 a187a185a30a190 a183a7a181a28a198a153a182 a184a200a63a181a26a198a35a195a7a186a37a185 a205 a192a181a30a199a37a201a30a181a26a198 a231a37a203a135a183a135a181a30a188a135a188a135a184 a189a135a181a63a182a191a37a188a135a195a19a199a30a181a37a200a63a191a30a186a30a199 a235a166a236a31a237a3a238 a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a7a74a75a21 a0a2a1a3a1a3a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Skill?Rules?Knowledge Hierarchy a246 a246a221 a236a166a233a37a238 a250 a247a166a246a225a253 a234 a237a53a236a166a249 a248 a238a23a20 a247a31a252a3a255 a20a53a238a225a234 a237a12a233a37a249 a250a37a249a252 a253 a237a3a236a166a238a153a227 a223 a247 a249 a253 a250 a11 a217a12a83a148a229 a220 a83a148a239a12a217 a77 a84a12a85a19a222 a219a72a222 a77 a84 a220 a84 a77 a219a42a217 a77 a84 a220 a222 a85a12a221 a78 a221a225a85 a220 a84 a77 a219a42a217 a77 a84 a220 a222 a85a12a221 a78 a221a225a85 a61a62 a51 a23a26a25 a225a60 a1a0 a23 a43 a66 a46 a60a26a23a26a58 a57a31a50 a51a26a34 a40 a22a59a27a26a61 a225a60 a2a0 a23 a36a31a23a26a25 a40 a60a26a23a26a58 a57a48a50 a51a28a34 a40 a216a212a222a242a225a83a225a219a19a222 a77 a84 a216a124a83 a226 a222a239a166a222 a83 a78a45a220 a240 a77a42a78 a219a212a217a59a229a212a219 a246 a247a225a248 a238a249a166a250a28a251 a220 a238 a247a225a248a236a166a235 a248 a252a2a253a236a166a250 a250a124a238 a249a166a238 a236a166a254 a238 a249a166a250a28a251 a83a225a250a124a250 a247 a233a28a234 a249a166a238a153a234 a247 a237 a78 a236a166a233 a247a166a255 a237a2a234 a238a35a234 a247 a237 a194 a184a201a30a186a37a188 a194 a214a7a200a54a209a30a185a30a192a188 a40 a36a48a23a28a25 a216a124a83 a222a84a136a217 a226 a216 a7 a247 a238 a247a225a248a9a8 a249a2a238 a238 a236 a248 a237a3a250 a83 a252 a238 a247 a7 a249a2a238a236a2a235a59a250a124a236a31a237a3a250 a247a225a248 a10a12a11 a194 a184 a201a30a186a37a191a30a192 a188 a207a212a183a135a182 a184a185a37a186a30a188 a194 a181a30a186a30a188a135a185a30a190 a214a122a211 a186a30a196a30a193a37a182 a216a124a236a2a249a166a238 a252a166a248 a236 a246 a247a225a248 a7 a249a166a238a153a234 a247 a237 a13 a194 a184 a201a37a186a30a188a15a14 a220 a219a19a221 a78 a221 a77 a219a212a245a148a224a225a221a24a219a212a83 a243 a221 a77 a6a3 a221 a78 a222 a235a166a236a225a237a53a238a35a234 a246 a234 a233a124a249a2a238a35a234 a247 a237 a233 a2a20 a247 a234 a233a37a236 a247a166a246 a238a249a2a250a212a251 a85a212a236a166a233a28a234 a250a212a234 a247 a237 a22a21 a224 a253a249a225a237a166a237a2a234 a237 a255 a11 a220 a222a85a12a221a33a221a225a216a212a216a212a221a241a217a19a219 a77a167a78 a223a42a221a166a219a65a222 a220a225a77 a239a53a83a225a219a19a221a218a85a65a222 a219a19a221 a226 a222 a220 a219a212a83 a243 a221a59a83 a226a48a77 a84a136a223 a78a83a148a239a3a219a19a221 a84a212a83a225a219a19a222 a3 a221 a220 a78a77a42a78a19a78 a221a166a217a12a219 a221a241a217a19a83a148a239a166a239 a222a226 a239a166a222 a83 a78 a83 a220a225a220a225a77 a217a122a222 a83a225a219a19a222 a77 a84a45a219 a78 a83a148a224 a61a16 a50 a61 a225a60 a0 a36a48a23a28a25 a44 a40 a222a226a12a77 a219 a4a3 a77a42a78 a83 a78 a225a222 a6a5 a83 a239a166a222 a219a212a245 a60a26a23a26a58 a57a48a50 a51a28a34 a40 a78a219 a77 a224 a77 a223 a83a148a224a225a240a12a222 a217 a222 a222a226 a220a225a77a42a78 a221a225a84a136a219a28a83a218a219a19a222 a77 a84 a77a220 a219a19a221 a78 a221 a219a212a245a148a224a225a221 a216a212a222a242a225a83a225a219a19a222 a77 a84 ABSENTMINDEDNESS LOW ALERTNESS c c a15a7a6a7a16a3a6a7a14a71a11a7a8a12a17a102a74a7a74a75a18 a0a38a1a3a1a71a4 a5a7a6a7a8a7a9a7a10a12a11a7a5a7a6a7a13 a14 Social Psychology Models Engineering models: look at human behavior in terms of tasks Psychology models: relate human cognition to performance Social Psychology models: include individual value systems and sense of personal responsibility c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a137a136a74 a25a19a26 a6a7a1a71a4 a27 a4 a1a29a28 a7a9 a4 a11a7a8a7a14 Safety Information System Studies have ranked this second in importance only to top management concern for safety. Contents Updated System Safety Program Plan Status of activities Results of hazard analyses Tracking and status information on all known hazards. Incident and accident information including corrective action. Trend analysis data. Information collection Information analysis Information dissemination c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a137a7a137 a25a19a26 a6a7a1a71a4 a27 a4 a1a29a28 a7a9 a4 a11a7a8a7a14 Intent Specifications Bridge between disciplines Support for human problem solving Traceability Support for upstream safety efforts Integration of safety information into decision?making environment Assistance in software evolution c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a137a7a138 a25a19a26 a6a7a1a71a4 a27 a4 a1a29a28 a7a9 a4 a11a7a8a7a14 Intent Specifications (2) Hierarchical abstraction based on ‘‘why’’ (design rationale) as well as what and how. Design decisions at each stage mapped back to to requirements and constraints they are derived to satisfy Earlier decisions mapped to later stages of process Results in record of progression of design rationale from high?level requirements to component requirements and designs. Provides traceability of intent information c a15a7a6a7a16a3a6a7a14a3a11a7a8a12a17a122a74a75a137a7a139 a25a19a26 a6a7a1a71a4 a27 a4 a1a29a28 a7a9 a4 a11a7a8a7a14 Intent Specifications Part?Whole Intent Operations Refinement Validation Verification Environment Operator System Representation Design System Purpose System Design Principles Representation Physical Behavior Blackbox Each level supports a different type of reasoning about system. Mappings between levels provide relational info necessary to reason across hierarchical levels. c a156 a115a34a157a29a115a34a123a29a121a34a122a38a158a160a159a162a161a34a163 a113a19a114a34a115a34a116a29a117 a118 a117 a116a29a119a34a120 a117 a121a34a122a34a123 a104a32a105a86a54a78a106 a107a22a108a86a105a86a109a110a52a6a105a86a111 a136a45a137a6a138 a111a34a52a37a109a140a139a6a105a86a141a110a142a6a108a86a109a110a143a86a108a135a105a86a52a6a105a86a111 a138a144 a143a135a52a37a107a22a139a6a111a34a108a86a107 a145a45a146a147a145 a72a34a73a6a91a37a48a6a73a6a65a38a67a23a65a32a64a58a73a37a67a50a79a32a80 a89a32a72a34a72a34a49a37a72a135a72a34a73a6a75a37a49a6a72a34a67a23a65a32a64a58a79a38a94a6a61a37a70a6a63a37a73 a85a135a72a34a61a37a68 a70a6a68 a70a37a63a62a47a62a61a6a67a23a73a6a72a34a68 a61a37a77 a65 a133a62a61a6a68 a70a37a67a50a73a37a70a6a61a6a70a37a79a38a73 a134 a75a37a73a6a72a34a61a6a67a23a49a6a72a86a47a62a61a6a70a37a48a6a61a6a77 a65 a75a6a72a34a49a6a79a38a73a37a84a6a48a6a72a34a73a37a65 a126a45a48a6a84a6a68 a67 a132a32a73a6a72a34a71a23a49a6a72a34a47a62a61a6a70a37a79a38a73 a47a62a49a37a70a6a68 a67a23a49a6a72a34a68 a70a6a63 a61a37a70a6a84a62a61a6a48a37a84a6a68 a67a23a65 a51a53a52a6a54a6a52a56a55a58a57 a30a32a31a34a49a58a59a60a41a6a36a38a46a6a47a62a61a37a35a6a61a6a63a37a41a6a47a62a41a6a35a37a46a6a39a6a40 a61a6a35a6a42a32a64a66a65a38a67a50a61a37a67a50a48a37a65a69a68 a70a37a71a50a49a37a72a34a47a62a61a6a67a23a68 a49a6a70a56a64a58a65a38a61a6a71a23a73a6a67a23a74a76a75a6a77 a61a37a70a78a64a58a73a37a67a50a79a32a80 a30a32a48a6a31a34a39a6a49a37a42a38a41 a43a45a44 a42a38a46a50a41a37a47 a51a53a52a6a54a6a52a56a55a6a83 a88 a49a6a70a6a65a38a67a23a72a34a61a6a68 a70a6a67a23a65 a126a45a65a38a65a38a48a6a47a62a75a37a67a50a68 a49a6a70a6a65 a97a98a2a99a100a72a34a73a6a91a6a48a37a68 a72a34a73a6a47a62a73a37a70a6a67a23a65 a101a78a73a6a91a37a48a6a68 a72a34a73a37a47a102a73a37a70a6a67a23a65 a101a56a73a6a65a38a75a6a49a37a70a6a65a38a68 a103a37a68 a77 a68 a67a23a68 a73a37a65 a79a38a49a37a70a6a65a38a67a23a72a34a61a6a68 a70a37a67a50a65a32a64a66a77 a68 a47a62a68 a67a23a61a6a67a23a68 a49a37a70a6a65 a72a34a73a6a91a6a48a37a68 a72a34a73a6a47a62a73a6a70a37a67a50a65a32a64a66a84a6a73a6a65a38a68 a63a6a70 a92 a74a38a65a38a67a50a73a37a47a93a63a37a49a6a61a6a77 a65a32a64a58a94a6a68 a63a6a94a6a95a32a77 a73a6a96a38a73a6a77 a124a78a61a37a125a38a61a6a72a34a84a62a126a45a70a6a61a37a77 a74a38a65a38a68 a65 a132a32a72a34a73a6a77 a68 a47a62a68 a70a37a61a6a72a34a74 a101a56a73a6a96a38a68 a73a37a129a130a65 a30a32a31a34a33 a35a37a36a38a33 a39a6a40 a41a6a42 a43a45a44 a42a38a46a23a41a6a47 a51a53a52a6a54a6a52a56a55a58a82 a68 a70a6a67a23a73a6a72a34a71a23a61a6a79a38a73a6a65 a89a32a90a38a67a50a73a37a72a34a70a6a61a6a77 a85a86a61a6a65a38a87a76a61a6a77 a77a49a6a79a38a61a6a67a23a68 a49a37a70 a88 a49a6a70a37a67a50a72a34a49a37a77 a65a32a64a58a84a37a68 a65a38a75a6a77 a61a37a74a38a65 a85a86a61a6a65a38a87a76a61a6a70a37a61a6a77 a74a38a65a38a73a37a65 a61a6a70a37a84a62a61a6a77 a77a49a6a79a38a61a6a67a23a68 a49a37a70 a71a50a48a37a70a6a79a38a67a23a68 a49a6a70a37a61a6a77a38a84a6a73a37a79a38a49a6a47a62a75a6a49a37a65a38a68 a67a23a68 a49a6a70 a128a6a49a37a63a6a68 a79a76a75a6a72a34a68 a70a6a79a38a68 a75a37a77 a73a6a65a32a64 a79a38a49a6a70a37a67a50a72a34a49a6a77a38a77 a61a6a129a130a65a32a64 a126a45a70a37a61a6a77 a74a38a65a38a68 a65 a92 a74a38a65a38a67a23a73a6a47a127a124a78a61a6a125a38a61a37a72a34a84 a61a6a70a37a84a62a72a34a73a6a65a38a48a6a77 a67a23a65a32a64 a131a45a61a6a77 a68a84a6a61a37a67a50a68 a49a6a70a62a75a6a77 a61a6a70 a51a53a52a6a54a6a52a56a55a58a81 a112a45a77 a61a6a79a38a87a38a103a6a49a37a90 a133a62a49a37a84a6a73a6a77 a65 a89a32a70a6a96a38a68 a72a34a49a6a70a6a47a62a73a37a70a6a67 a47a62a49a6a84a37a73a6a77 a65 a47a62a49a6a84a6a73a37a77 a65 a134 a75a6a73a37a72a34a61a6a67a23a49a6a72a86a85a135a61a37a65a38a87 a124 a88 a97a66a47a62a49a6a84a6a73a37a77 a65 a112a45a77 a61a6a79a38a87a38a103a37a49a6a90a76a71a50a48a37a70a6a79a38a67a23a68 a49a6a70a37a61a6a77 a47a62a49a37a84a6a73a6a77 a65 a97 a70a6a67a23a73a6a72a34a71a23a61a6a79a38a73a62a65a38a75a6a73a37a79a38a68 a71a23a68a79a38a61a6a67a23a68 a49a37a70a6a65 a92 a48a6a103a37a65a38a74a38a65a38a67a50a73a37a47 a124a78a61a37a125a38a61a6a72a34a84a62a126a45a70a6a61a37a77 a74a38a65a38a68 a65 a61a6a70a37a84a62a72a34a73a6a65a38a48a6a77 a67a23a65a32a64 a126a45a70a6a61a37a77 a74a38a65a38a68 a65a76a75a6a77 a61a6a70a6a65 a51a53a52a6a54a6a52a56a55a58a154 a101a56a73a6a75a78a80 a155a78a73a6a65a38a68 a63a37a70 a124 a88 a97a58a84a37a73a6a65a38a68 a63a37a70 a84a6a73a37a65a38a68 a63a6a70a62a65a38a75a37a73a6a79a38a65 a92 a49a6a71a23a67a23a129a130a61a6a72a34a73a62a61a37a70a6a84a62a94a6a61a37a72a34a84a6a129a130a61a37a72a34a73 a61a6a70a6a84a62a72a34a73a37a65a38a48a6a77 a67a23a65 a85a135a73a37a65a38a67a6a75a6a77 a61a6a70a6a65 a101a56a73a6a75a78a80 a132a32a94a6a74a38a65a38a68 a79a38a61a37a77 a51a53a52a6a54a6a52a56a55a58a153 a75a6a94a37a74a38a65a148a68 a79a38a61a6a77a38a79a38a49a6a70a37a67a50a72a34a49a37a77 a65 a149a151a150 a97a58a84a6a73a37a65a38a68 a63a6a70a56a64 a84a37a73a6a65a38a68 a63a37a70 a61a6a65a38a65a38a73a37a47a62a103a6a77 a74a76a68 a70a37a65a38a67a50a72a34a48a37a79a38a67a50a68 a49a37a70a6a65 a92 a49a37a71a50a67a23a129a130a61a37a72a34a73a62a79a38a49a6a84a6a73a56a64a58a94a6a61a37a72a34a84a6a129a130a61a37a72a34a73 a85a135a73a37a65a38a67a6a75a6a77 a61a6a70a6a65 a61a6a70a6a84a62a72a34a73a37a65a38a48a6a77 a67a23a65 a134 a75a37a73a6a72a34a61a6a67a23a68 a49a37a70a6a65 a51a53a52a6a54a6a52a56a55a58a152 Level 1: System Purpose Introduction Historical Perspective Environment Description Environment Assumptions Altitude information is available from intruders with a minimum precision of 100 feet. All aircraft have legal identification numbers. Environment Constraints The behavior or interaction of non?TCAS equipment with TCAS must not degrade the performance of the TCAS equipment. System Functional Goals Provide affordable and compatible collision avoidance system options for a broad spectrum of National Airspace System users. c a156 a115a34a157a29a115a34a123a29a121a34a122a38a158a160a159a162a161a34a165 a113a19a114a34a115a34a116a164a117 a118 a117 a116a29a119a34a120 a117 a121a34a122a34a123 Level 1: System Purpose (2) High?Level Requirements [1.2] TCAS shall provide collision avoidance protection for any two aircraft closing horizontally at any rate up to 1200 knots and vertically up to 10,000 feet per minute. Assumption: Commercial aircraft can operate up to 600 knots and 5000 fpm during vertical climb or controlled descent (and therefore the planes can close horizontally up to 1200 knots and vertically up to 10,000 fpm. Design and Safety Constraints [SC5] The system must not disrupt the pilot and ATC operations during critical phases of flight nor disrupt aircraft operation. [SC5.1] The pilot of a TCAS?equipped aircraft must have the option to switch to the Traffic?Advisory?Only mode where TAs are displayed but display of resolution advisories is prohibited. Assumption: This feature will be used during final approach to parallel runways when two aircraft are projected to come close to each other and TCAS would call for an evasive maneuver. c a156 a115a34a157a29a115a34a123a29a121a34a122a38a158a160a159a162a161a34a166 a113a19a114a34a115a34a116a164a117 a118 a117 a116a29a119a34a120 a117 a121a34a122a34a123 Example Level 1 Safety Constraints for TCAS SC?7 TCAS must not create near misses (result in a hazardous level of vertical separation) that would not have occurred had the aircraft not carried TCAS. SC?7.1 Crossing maneuvers must be avoided if possible. 2.36, 2.38, 2.48, 2.49.2 SC?7.2 The reversal of a displayed advisory must be extremely rare. 2.51, 2.56.3, 2.65.3, 2.66 SC?7.3 TCAS must not reverse an advisory if the pilot will have insufficient time to respond to the RA before the closest point of approach (four seconds or less) or if own and intruder aircraft are separated by less than 200 feet vertically when 10 seconds or less remain to closest point of approach. 2.52 a156 c a115a34a157a29a115a34a123a29a121a34a122a38a158a160a159a162a161a34a169 a113a19a114a34a115a34a116a164a117 a118 a117 a116a29a119a34a120 a117 a121a34a122a34a123 Level 1: System Purpose (3) System Limitations L.5 TCAS provides no protection against aircraft with nonoperational or non?Mode C transponders. Operator Requirements OP. 4 After the threat is resolved the pilot shall return promptly and smoothly to his/her previously assigned flight path. Human?Interface Requirements Hazard and other System Analyses a156c a115a34a157a29a115a34a123a29a121a34a122a38a158a160a159a162a167a34a168 a113a19a114a34a115a34a116a164a117 a118 a117 a116a29a119a34a120 a117 a121a34a122a34a123 Hazard List for TCAS H1: Near midair collision (NMAC): An encounter for which, at the closest point of approach, the vertical separation is less than 100 feet and the horizontal separation is less than 500 feet. H2: TCAS causes controlled maneuver into ground e.g. descend command near terrain H3: TCAS causes pilot to lose control of the aircraft. H4: TCAS interferes with other safety?related systems e.g. interferes with ground proximity warning c TCAS does not display a resolution advisory. TCAS unit is not providing RAs. <Self?monitor shuts down TCAS unit> Sensitivity level set such that no RAs are displayed. ... No RA inputs are provided to the display. No RA is generated by the logic Inputs do not satisfy RA criteria a156 a115a34a157a29a115a34a123a164a121a171a122a38a158a160a159a162a167a24a159 a113a170a114a34a115a34a116a29a117 a118 a117 a116a29a119a34a120 a117 a121a34a122a34a123 Surveillance puts threat outside corrective RA position. Surveillance does not pass adequate track to the logic <Threat is non?Mode C aircraft> L.5 1.23.1<Surveillance failure> to be calculated> Altitude reports put threat outside corrective RA position Altitude errors put threat on ground <Uneven terrain> <Intruder altitude error> <Own Mode C altitude error> <Own radar altimeter error> 2.19 1.23.1 1.23.1 Altitude errors put threat in non?threat position. ... <Intruder maneuver causes logic to delay RA beyond CPA> 2.35 SC4.2 ... <Process/display connectors fail> <Display is preempted by other functions> <Display hardware fails> 2.22 SC4.8 1.23.1 TCAS displays a resolution advisory that the pilot does not follow. Pilot does not execute RA at all. Crew does not perceive RA alarm. <Inadequate alarm design> <Crew is preoccupied> 1.4 to 1.14 2.74, 2.76 <Crew does not believe RA is correct.> OP.1 ... Pilot executes the RA but inadequately <Pilot stops before RA is removed> OP.10 OP.4 OP.10 <Pilot continues beyond point RA is removed> <Pilot delays execution beyond time allowed> c a156 a115a34a157a29a115a34a123a164a121a34a122a38a158a135a159a162a167a34a161 a113a170a114a34a115a34a116a29a117 a118 a117 a116a164a119a34a120 a117 a121a34a122a34a123 2.19 When below 1700 feet AGL, the CAS logic uses the difference between its own aircraft pressure altitude and radar altitude to determine the approximate elevation of the ground above sea level (see Figure 2.5). It then subtracts the latter value from the pressure altitude value received from the target to determine the approximate altitude of the target above the ground (barometric altitude ? radar altitude + 180 feet). If this altitude is less than 180 feet, TCAS considers the target to be on the ground ( 1.SC4.9). Traffic and resolution advisories are inhibited for any intruder whose tracked altitude is below this estimate. Hysteresis is provided to reduce vacillations in the display of traffic advisories that might result from hilly terrain ( FTA?320). All RAs are inhibited when own TCAS is within 500 feet of the ground. OWN TCAS Barometric Airborne Declared Radar Altimeter Value Altimeter Allowance on Ground Declared on Ground Declared 180?foot a210a211 c a156 a115a34a157a29a115a34a123a29a121a34a122a38a158a160a159a162a167a34a167 a113a19a114a34a115a34a116a164a117 a118 a117 a116a29a119a34a120 a117 a121a34a117 a122a34a123 Example Level?2 System Design for TCAS SENSE REVERSALS Reversal?Provides?More?Separation m?301 2.51 In most encounter situations, the resolution advisory sense will be maintained for the duration of an encounter with a threat aircraft. SC?7.2 However, under certain circumstances, it may be necessary for that sense to be reversed. For example, a conflict between two TCAS?equipped aircraft will, with very high probability, result in selection of complementary advisory senses because of the coordination protocol between the two aircraft. However, if coordination communications between the two aircraft are disrupted at a critical time of sense selection, both aircraft may choose their advisories independently. FTA?1300 This could possibly result in selection of incompatible senses. FTA?395 2.51.1 [Information about how incompatibilities are handled] a156 c a115a34a157a29a115a34a123a29a121a34a122a38a158a160a159a162a167a34a192 a113a19a114a34a115a34a116a164a117 a118 a117 a116a29a119a34a120 a117 a121a34a122a34a123 Level 3 Modeling Language Example a97 a172a130a85a173a101 a150 a155a130a89a45a101a130a80 a92 a85a135a126a45a85 a150a78a92 a85a86a94a6a72a34a73a6a61a37a67 a132a32a72a34a174a37a90a148a68 a175a62a61a6a67a23a73a6a95a32a85a86a72a34a61a6a71a23a71a50a68 a79 a134 a67a23a94a6a73a6a72a34a95a32a85a86a72a34a61a6a71a23a71a23a68 a79 a132a32a174a37a67a50a73a37a70a6a67a23a68 a61a6a77 a95a32a85a135a94a37a72a34a73a6a61a6a67 a85a135a94a37a72a34a73a6a61a6a67 a134 a67a23a94a6a73a37a72a34a95a32a85a135a72a34a61a6a71a23a71a23a68 a79 a180a173a181 a132a32a174a37a67a50a73a37a70a6a67a23a68 a61a6a77 a95a32a85a135a94a37a72a34a73a6a61a6a67a23a95 a88 a174a37a70a6a84a6a68 a67a50a68 a174a6a70 a132a32a72a34a174a37a90a38a68 a175a62a61a6a67a23a73a6a95a32a85a86a72a34a61a6a71a23a71a50a68 a79a38a95 a88 a174a6a70a37a84a6a68 a67a23a68 a174a37a70 a101a56a61a6a70a6a63a37a73a6a95a32a131a45a61a6a77 a68 a84 a126a45a77 a67a50a95a45a101a56a73a6a75a6a174a37a72a34a67a50a68 a70a6a63a176a106 a105a135a177 a138 a111a34a139a6a111a34a178a179a128a6a174a6a65a38a67 a182 a182 a182a183 a183 a182 a183 a183 a112a45a73a37a61a6a72a34a68 a70a37a63a6a95a32a131a45a61a6a77 a68 a84 a182 . . . . . . . . . . . . . . a182 a184a12a185a19a186a22a187a170a188 a189 a185a19a190a22a187a170a188 a189 a185a19a190a170a187a22a190 a134 a67a23a94a6a73a6a72a34a95a32a126a45a68 a72a34a79a38a72a15a61a37a71a50a67 a134 a70a37a95 a149 a72a34a174a37a191a6a70a6a84a106 a105a86a177 a138 a111a34a139a6a111a34a178 a189 a185a19a190a22a193a170a188 a212 a194a78a178 a138 a142a6a107a58a106 a143a86a111a24a106 a108a86a105a173a195 a126a215a67a23a94a37a72a15a73a37a61a6a67a37a68 a65a216a72a34a73a37a79a38a77 a61a6a65a38a65a38a68 a71a50a68 a73a6a84a62a61a6a65a76a174a6a67a23a94a6a73a37a72a135a67a23a72a34a61a6a71a23a71a23a68 a79a76a68 a71a6a68 a67a23a65a76a61a6a77 a67a23a68 a67a23a191a6a84a37a73a62a72a34a73a6a75a6a174a37a72a34a67a50a68 a70a6a63 a94a37a61a6a65a76a103a6a73a6a73a37a70a62a77 a174a6a65a38a67 a203 a204 a80a23a206a58a207a37a208 a61a37a70a6a84a62a73a6a68 a67a50a94a37a73a6a72a86a67a50a94a37a73a62a103a6a73a6a61a37a72a34a68 a70a6a63a62a174a37a72a135a72a34a61a37a70a6a63a6a73a62a68 a70a6a75a6a191a37a67a50a65a76a61a6a72a34a73a62a68 a70a6a96a38a61a6a77 a68 a84a78a209 a68 a71a6a68 a67a23a65a216a61a37a77 a67a23a68 a67a23a191a6a84a6a73a62a72a34a73a37a75a6a174a6a72a34a67a23a68 a70a37a63a62a94a6a61a6a65a76a103a6a73a37a73a6a70a62a77 a174a6a65a38a67a6a61a37a70a6a84a62a103a6a174a37a67a50a94a62a67a23a94a6a73a62a72a34a61a37a70a6a63a6a73a62a61a37a70a6a84a62a103a6a73a37a61a6a72a34a68 a70a37a63a62a61a6a72a34a73 a68a96a38a61a37a77 a84a62a103a37a191a6a67a6a70a37a73a6a68 a67a23a94a37a73a6a72a135a67a23a94a37a73a62a75a6a72a34a174a6a90a38a68 a175a62a61a37a67a50a73a62a70a37a174a62a72a135a75a37a174a6a67a23a73a6a70a6a67a23a68 a61a37a77a38a67a50a94a37a72a34a73a6a61a6a67a37a79a38a77 a61a6a65a38a65a38a68 a71a50a68a79a38a61a6a67a23a68 a174a6a70a62a79a38a72a34a68 a67a50a73a37a72a15a68 a61 a61a37a72a34a73a62a65a38a61a6a67a23a68 a65a38a71a23a68 a73a6a84a56a209a58a174a6a72a86a67a23a94a6a73a62a61a6a68 a72a34a79a38a72a34a61a6a71a23a67a6a68 a65a76a174a6a70a62a67a23a94a6a73a62a63a37a72a34a174a6a191a6a70a37a84 a203 a204 a80a23a206 a204 a208 . a196a197a139a6a143a86a143a198a106 a105a86a199a110a111a34a108a201a200a53a178a6a202a6a178a56a55a58a82a56a195 a204 a80 a204 a207a78a64 a204 a80 a204a6a205 a196a197a139a6a143a86a143a198a106 a105a86a199a110a111a34a108a201a200a53a178a6a202a6a178a56a55a58a154a56a195 a213 a80 a214a78a80a23a206a6a64a58a85a86a72a34a61a6a71a23a71a23a68 a79a38a95a32a126a45a84a6a96a38a68 a65a38a174a37a72a34a74