The shape, size and orientation of the protected volume of airspace generated by the airborne collision avoidance system currently known as TCAS II are derived. While based on constant-velocity aircraft flight paths the results are shown to have more general application. It is also shown how the essential features of the protected volume may be used to calculate alarm rates for some simple traffic patterns.

This paper, which was presented at a meeting of the Institute in London on 2o May 1981, with Captain R. Maybourn in the Chair, describes some studies of the conflicts arising between a multiplicity of aircraft in straight-line flight through a volume of airspace. Topics include the effect of coercing traffic to fly fixed routes, the direction from which a threat can be expected and the choice of alerting criterion for a groundbased advisory service or an airborne collision-warning system. There are some analogies, perhaps, with marine traffic problems.There exists, worldwide, a complex scheme for the segregation and control of various classes of air traffic. To fit into this scheme aircraft must make detours, horizontally and/or vertically, the cost of which in Europe alone must be at least £50M per annum. The cost of the rare failures in traffic management is higher still. To authors trained in electronic engineering it is therefore rather surprising that the published theory of air traffic management and control is still in a rather rudimentary form.

The standard height rules applied in off-route airspace are examined to assess the degree of intrinsic safety they provide, i.e. the reduction of conflicts without action being taken by pilots or ATC. The yardstick used is the conflict rate which would obtain if the aircraft were uniformly randomly distributed in the height dimension and flying straight and level on uniformly randomly distributed tracks. It is shown that the application of the standard rules can lead to a reduction in intrinsic safety unless significant height-keeping errors are present. An alternative height rule apparently having more desirable characteristics is examined on the same basis.i. I N T R O D U C T I O N . The height rules for air traffic management with which we are concerned here express a desired relationship between the height of an aircraft and the direction of its track. Such rules are used in both controlled and uncontrolled airspace and are well entrenched in the art of air traffic control. The fact that ATC has been more of an art than a science, although this situation is rapidly changing, perhaps explains why the rationale for the rules is difficult to find in the literature and the rule books for the subject. Indeed, the function of the rules may be different for the two basic categories of airspace -controlled and uncontrolled. For controlled airspace it could be that the rules are applied to facilitate the task of the air traffic controller in keeping aircraft safely separated. Thus it is the controller who achieves safe separation, and the rule is a tool for the purpose rather than a means of imposing an initial degree of protection which is then enhanced by the controller. This'is surmise, of course, and it needs to be made quite clear that this paper is in no way an examination or criticism of the rules and procedures in operation in controlled airspace.Our interest is in off-route airspace, where the situation is quite different. In a so-called 'open' Flight Information Region any air traffic control service offered is probably an advisory one and, when operating under visual flight rules (VFR), aircraft are not required to obey the height rule applicable to the region. They are, however, recommended to obey it, and this is important because of the implication that it will be safer to do so. This does not necessarily mean that the rules are thought to reduce the frequency of close encounters; it could be that it is considered that they enable pilots to operate the 'see-and-avoid' principle more effectively.A discussion of the absolute safety of flight in uncontrolled airspace 269

No abstract

AND SUMMARYRockwell's Ada symbolic debugging system (ASDS) is designed especially for use in debugging and testing embedded system software. ASDS uses a combination of software and special hardware to support unobtrusive monitoring, breakpoint and display facilities that can be applied during the development of an embedded system and during the 'downstream' stages of the embedded system life cycle associated with production and field unit testing. The ASDS software kernel executes on a stand-alone monitor processor with modest computational power (e.g. a personal computer), connected to the embedded target system via a target interface that allows the monitor to observe transactions on the target bus in real-time. The use of a monitor processor with modest power limits the degree of 'high level' monitoring support-though ASDS can detect the execution of a particular line of source code or access to a particular variable it contains no facilities for monitoring interactions between high-level dynamic objects such as tasks. However, the modest power required for the monitor also reduces its costs, with the result that ASDS debugging and test stations have been readily available to engineers working on system development, in production and in the field. Our description of the ASDS design and implementation focuses on its practical solutions to the problems associated with building and maintaining a symbolic debugging system to support embedded system development.