Sense and Avoid for Unmanned AircraftSystems: Ensuring Integrity and Continuityfor Three Dimensional Intruder Trajectories

Michael B. Jamoom∗, Mathieu Joerger† and Boris Pervan‡

Illinois Institute of Technology, Chicago, IL, 60616, USA

Abstract—This research aims at developing meth-ods to meet safety targets for sense and avoid (SAA)sensors of Unmanned Aircraft Systems (UAS) throughintegrity and continuity risk evaluation. The SAAproblem is presented as a three-dimensional, two-bodyproblem. A Kalman filter approach is introduced toaccommodate arbitrary sensor suites. Aircraft relativeposition and velocity estimates, referred to as trajec-tory state estimates, are transformed into hazard stateestimates, which are used to quantify integrity andcontinuity risks. A sensitivity analysis is performedbased on a set of representative, near-worst-case,three-dimensional intruder trajectories. The resultingimpact on integrity and continuity is quantified for acomposite nominal sensor. The concepts and methodsin this research are intended to be used as a tool forcertification authorities to set potential requirementsfor integration into the national airspace system.

INTRODUCTION

The Need for Sense and Avoid

In the last two decades, unmanned aircraft sys-tems (UAS) operated on a limited basis in theNational Airspace System (NAS) supporting mostlypublic functions [1]. However, UAS operations arerapidly encompassing more civil and commercialapplications [1]. With increased interest, the UnitedStates Congress mandated the Federal Aviation Ad-ministration (FAA), through the FAA Modernizationand Reform Act of 2012, to develop requirementsnecessary for broader UAS access into the NAS [2].

∗PhD Candidate, Department of Mechanical, Materials andAerospace Engineering†Research Assistant Professor, Department of Mechanical,

Materials and Aerospace Engineering‡Professor, Department of Mechanical, Materials and

Aerospace Engineering

To meet this mandate, the FAA must ensure an ac-ceptable level of safety. To do this, a UAS requires a“sense and avoid” (SAA) capability to provide self-separation and collision avoidance (CA) protectionbetween the UAS and other aircraft analogous to the“see and avoid” responsibility for pilots of mannedaircraft [1].

Depending on the airspace classification, if anintruder aircraft is cooperative, that is, employingan operating transponder or Automatic DependentSurveillance - Broadcast (ADS-B) [3], air trafficcontrol (ATC) may provide separation. Alterna-tively, a manned aircraft pilot could employ aTraffic Collision Avoidance System (TCAS) as asituational awareness aid to help the pilot detect theintruder then initiate an avoidance maneuver. Oth-erwise, if the intruder aircraft is non-cooperative,without an operating transponder or ADS-B, themanned aircraft pilot will not have the help ofATC or TCAS. In this manned aircraft case, it issolely the pilot’s responsibility to visually see theintruder and maneuver to maintain separation. SinceUAS will not have a pilot on board, it will have toreplicate the functionality of pilot vision throughan appropriate sensor. Detection of non-cooperativeaircraft will require, for example, an electro-optical(EO), infrared (IR) or radar sensor. This sensor mustadequately inform the UAS SAA system whether ornot a separation maneuver is required.

Self-Separation and Collision Avoidance

Although self-separation is a widely recognizedterm by the FAA and International Civil AviationOrganization (ICAO), it has never been fully cod-

ified [4]. “Well clear” is a subjective term in theright-of-way rules, 14 CFR 91.113 [5], [6]. In 2011,Weibel, et al., proposed well clear as an objectiveseparation standard [7]. In 2013, the Second FAASAA Workshop concluded that the concept of wellclear is an airborne separation standard [4]. Also in2013, Lee, et al., demonstrated a capability, usingthe NASA Airspace Concept Evaluation System(ACES) model, to determine the rate of well clearviolations for various well clear definitions [8]. InAugust 2014, the RTCA Special Committee-228(SC-228) Sense and Avoid Science and ResearchPanel (SARP) defined well clear as having a hori-zontal time to closest point of approach (CPA), τ ,of 35 seconds, a horizontal miss distance of 4000feet and a vertical miss distance of 700 feet [9].

When an intruder cannot remain well clear, aCA maneuver is required to avoid a near mid-aircollision (NMAC). NMAC boundaries are typically500 feet laterally and 100 feet vertically from theown aircraft [4]. If the intruder aircraft is non-cooperative, it is up to the UAS SAA system toprovide the appropriate CA maneuver.

Figure 1 depicts the conceptual difference be-tween the WCT and NMAC distance thresholds (notto scale and not accounting for τ ). For simplicity,we will concentrate on self-separation and WCT.The methodology is the same for CA and NMAC.

Problem Statement and Prior Work

SAA safety targets need to be met. This re-quires methods to quantify safety performance asa function of sensor uncertainty. In [10], the au-thors introduced and provided methods to evaluateintegrity risk and continuity risk as UAS SAA safetyperformance metrics. These methods can be usedto establish sensor performance requirements andcan apply to any candidate sensor or sensor suite.In this paper, we refine that work to accommodatethree dimensional intruder trajectories, which ischallenging because (a) the geometry of an intruderpenetrating the WCT cylinder from any directionmust be properly captured, and (b) the integrity andcontinuity risks vary over time as the intruder ap-proaches and additional sensor data are processed.

There have been several papers that provide

overviews of the SAA problem. In 2000, Kucharand Yang outlined an overview of air traffic con-flict detection and resolution models [11]. In 2004,Drumm, et al., reviewed the problem in terms of“remotely piloted vehicles in civil airspace” [12].In 2008, Dalamagkidis, et al., outlined UAS issues,challenges and restrictions for NAS integration [13].In 2012, Prats, et al., looked at requirements, chal-lenges and issues for UAS SAA [14]. Finally, in2015, Yu and Zhang presented the current scope ofthe entire SAA problem, describing current SAAsensors, decision algorithms, path planning, andpath following with a journal literature review [15].

Previous work has tended to focus on mirroringsafety studies applicable to the ubiquitous TCAS.McLaughlin and Zeitlin described a MITRE safetystudy that used encounter models to build collisionavoidance risk ratios to determine the safety ofTCAS version 6.4 [16]. Espindle, et al., describedan MIT Lincoln Lab safety study that used en-counter models to build collision avoidance riskratios to determine the safety of TCAS version 7.1[17]. The Second SAA Workshop determined, usingmethodology described in the International CivilAviation Organization (ICAO) Doc 9689, that UASSAA systems should have two target levels of safety(TLS) based on catastrophic collision risk ratios:10−9 midair collisions (MAC) per flight hour (FH)for cooperative airspace (where transponders arerequired) and 10−7 MAC/FH for all other airspace[4], [18]. Kim, et al., designed a 3D EO systemfor small UASs using a Kalman filter, Sequen-tial Quadratic Programming, and Linear ParameterVarying approaches for tracking and measurementerror reduction [19]. Kochenderfer, et al., developedan aircraft encounter model used to evaluate safetyof CA systems using NMAC rate and risk ratio,which is defined as the NMAC rate with the CA sys-tem divided by the NMAC rate without the CA sys-tem [20]. Kochenderfer, Chryssanthacopoulos, andBillingsley looked at state uncertainty of a collisionavoidance system, quantifying safety as probabilityof NMAC accounting for avoidance maneuvers, andapplying Markov decision processes for CA [21],[22]. Heisley, et al., developed an architecture witha future intent to test and certify SAA systems

4000’

700’

Well Clear Threshold

500’

100’

NMACOwn

Intruder

Fig. 1. Well Clear Threshold and Near Mid-Air Collision Distances (Not to Scale)

[23]. Lee, et al., constructed a distributed trafficmodel to enable a probabilistic approach to riskassessment by computing collision rates based onPredator training missions in the Grand Forks AirForce Base area [24]. Owen, et al., demonstratedand flight tested an approach to developing SAAradar models for requirements derivations that em-ployed a phased-array technology [25]. Edwardsand Owen validated a radar-based SAA conceptthrough modeling and flight test [26].

Our approach is different, focusing directly onthe accepted aviation navigation certification stan-dards that quantify integrity and continuity as safetyfactors [27]. For example, for the Local Area Aug-mentation System (LAAS), at near-zero visibility,navigation integrity requirements specify that nomore than one undetected hazardous navigationsystem failure is allowed in a billion approaches[28]. Kelly and Davis broke down their proposedTLS for required navigation performance (RNP)into accuracy, integrity, and continuity requirements[29], which are three of the four parameters thatquantify navigation system performance (the otherbeing availability) [29], [30]. This research focuseson integrity and continuity because they are themost difficult requirements for avionics systems toachieve.

Contributions of This Work

The SAA system needs to initiate a self-separation maneuver early enough to ensure theintruder aircraft remains outside the WCT. The hor-izontal tau self-separation threshold, τSS , represents

the minimum time required to initiate the self-separation maneuver to prevent a WCT violation.Spatially, the intruder trajectory must be withinboth the WCT horizontal and vertical miss distances(MD), rMD and zMD, to be considered a hazard.

The method established in this work provides themeans to set requirements on SAA sensors to ensureAPV safety during three-dimensional encounterswith intruder aircraft. This analysis identifies trade-offs between sensor characteristics and airspacecapacity while maintaining integrity and continuityrequirements.

Paper Outline

After this introductory section, the second sec-tion introduces the estimation model. The middlesections review the prior work methodology imple-menting SAA integrity and continuity. The sectionafter that includes a sensitivity analysis depictingthree dimensional intruder trajectories. The finalsection provides conclusions.

RELATIVE INTRUDER STATEESTIMATION

We present the SAA problem as a three dimen-sional, two-body problem. The two bodies are theown aircraft and the intruder aircraft. The coordi-nate frame will always be an own-aircraft-centeredbody frame. Figure 2 is a graphical depiction ofthe own aircraft and the intruder aircraft in thehorizontal and vertical planes. In the horizontalplane, we orient the x and y axes such that the x-axis is directly out of the nose of the own aircraft.

x

y

θ

z

xφ

Fig. 2. Horizontal and Vertical Position of the Intruder Aircraft

The azimuth, θ, is the angle counterclockwise fromthe x-axis to the horizontal range vector (from theorigin to the intruder position on the xy-plane). Theelevation, φ, is the angle from the xy-plane up to theslant range vector (from the origin to the intruderposition on the xz-plane). A particular sensor maymeasure the intruder’s relative position (with error)in spherical, Cartesian, or cylindrical coordinates.In this development, we assume measurement vec-tors and measurement error covariance matrices areconverted to Cartesian coordinates for processing.

Measurement Model

The own aircraft makes a measurement, zn, attime tn of the intruder position, [ xn yn zn ]T :

zn = Hxn + vn vn ∼ N(0,Vn) (1)

The constant observation matrix H is:

H =[

I3×3 03×3

](2)

The trajectory state vector, xn, is time variant, basedon current intruder position and velocity:

xn =[xn yn zn xn yn zn

]T(3)

N(a,B) represents a normal distribution withmean, a, and covariance, B. vn is the tn measure-ment error, which we assume is over-bounded in thecumulative distribution function (CDF) sense by aGaussian function with covariance matrix Vn [31],[32]. We also assume that a sample interval, ∆t,is selected large enough to ensure independence ofsequential sensor measurement errors.

The discrete-time process-noise-free state-transition equation is:

xn = Φx(n−1) (4)

where Φ represents the constant state-transitionmatrix for a constant relative velocity encounter.

Φ =

[I3×3 ∆tI3×3

03×3 I3×3

](5)

Kalman Filter Implementation

This subsection presents a Kalman filter imple-mentation to get the trajectory state estimate errorcovariance matrix. A Kalman filter approach ismore computationally efficient than the batch esti-mator implemented in prior work [10]. It also allowsfor easy integration of different types of sensors.The following equations show how we implementthe measurement and state transition equations, (1)and (4), in a Kalman filter. [33], [34].

We assume no prior knowledge on the trajectorystates. The state estimate prediction is:

xn = Φx(n−1) (6)

and the estimate error prediction covariance:

Pn = ΦP(n−1)ΦT (7)

The state estimate update is:

xn = xn + Kn(zn −Hxn) (8)

and the estimate error covariance is:

Pn = (I−KnH)Pn (9)

where the Kalman gain matrix is:

Kn = PnHT (HPnHT + Vn)−1 (10)

The 6 × 6 trajectory state covariance matrix, P,is used to determine hazard state variances in thenext section.

HAZARD STATESFor two-dimensional horizontal trajectories, the

hazard states that describe a potential hazard withan intruder aircraft are the horizontal time to CPA,τ , and horizontal distance from the own aircraftto CPA, rCPA. The left part of figure 3 is anoverhead depiction of the horizontal CPA. For aWCT violation, the intruder must be within theWCT. That means rCPA is smaller than or equalto the horizontal miss distance (MD), rMD.

x0

xn

rn

rMD

x

r CPA

z+

z−

WCT

z+z−

Fig. 3. Overhead and Side View of Hazard States

WCT

xCPA1

xCPA2

xCPA3

Fig. 4. Head-on Trajectories with 3D Closest Points ofApproach

For a 3D WCT, there are some trajectories whereeither the vertical distance at the 3D CPA or thevertical distance at the 2D horizontal CPA areoutside the WCT distance cylinder, but the intruderstill penetrates the WCT distance cylinder. Forexample, consider the head-on trajectories depictedin Figure 4. Because the WCT distance thresholdsdefine a cylinder and not a sphere, the trajectoryintercepting the WCT at the top-back has a 3DCPA, labeled xCPA1, which is outside the WCToccurring prior to WCT entry. Also, the trajectorythat intercepts the bottom-front edge of the WCThas a 3D CPA, labeled xCPA3, which is outsidethe WCT occurring after WCT entry.

To account for this, we add two vertical hazardstates, z+ and z−, depicted in figure 3. Giventhat the intruder trajectory penetrates the horizontalWCT circle, z+ is the vertical distance when theintruder trajectory enters the 2D horizontal WCTcircle and z− is the vertical distance when theintruder trajectory exits the 2D horizontal WCTcircle. Note if rCPA = rMD then z+ = z−.

Hazard State Equations

True τ (time to horizontal CPA) in terms of thetrajectory states is:

τn =−(xnxn + ynyn)

x2n + y2

n

(11)

Note this is a version of τ defined as true tau [35],as opposed to the alternate τ definitions of modifiedtau [35] and simplified tau [4]. For simplicity, then subscript is removed for the remainder of theequations.

The corresponding CPA horizontal range, rCPA,is:

rCPA =√

(x+ τ x)2 + (y + τ y)2 (12)

To get the vertical distances at the horizontalWCT entry and exit (z+ and z−), where rCPA =rMD, equation (12) is converted into a quadratic:

r2MD = (x+ xτ±)2 + (y + yτ±)2 (13)

Solving this quadratic for τ±, the time to entry, τ+,and time to exit, τ−, are:

τ+ = τ −√

(xx+yy)2−(x2+y2)(x2+y2−r2MD)

x2+y2

τ− = τ +

√(xx+yy)2−(x2+y2)(x2+y2−r2MD)

x2+y2

(14)The vertical distances at the WCT entry and exit,z+ and z− are then:

z+ = z + zτ+z− = z + zτ−

(15)

Hazard State Estimate Error Variances

To get hazard state estimate error variances,we first linearize equations (11), (12), and (15),which is described in the previous work [10]. Forexample, the τ transformation, aTτ , is the vectorof the Taylor Series partial derivatives of τ withrespect to trajectory states. The τ estimate errorvariance, σ2

τ , is determined by transforming Px

from equation (9):

σ2τ = aTτ Pxaτ (16)

Given zero-mean sensor measurement errors, theresulting distribution for the estimated τ is:

τ ∼ N(τ, σ2τ ) (17)

The distributions for the estimated parametersrCPA, z+, and z− are found the same way:

rCPA ∼ N(rCPA, σ2r) (18)

z+ ∼ N(z+, σ2+) (19)

z− ∼ N(z−, σ2−) (20)

The hazard state estimates (τ , rCPA, z+, and z−)are correlated.

INTEGRITY RISKHazardously misleading information (HMI) oc-

curs when a hazard exists, but that hazard is notsensed. This HMI leads the own aircraft to notmaneuver when a self-separation maneuver is war-ranted. To ensure there is an acceptable probabilityof HMI, PHMI , hazard thresholds (τSS , rMD,and zMD) are adjusted by adding multiples of thehazard state standard deviations. The self-separationintegrity risk is PHMI .

The probability of HMI in equation (21) reflectsthe probability of an imminent (at or within τSSseconds) intruder aircraft violation of the WCT.

PHMI = P (Sense No Hazard|Hazard Exists)(21)

Hazard Exists describes a condition where theintruder is within the horizontal time to CPA thresh-old on a trajectory that penetrates the WCT distancethreshold cylinder. This means the following con-ditions are occurring simultaneously:

• The actual time to closest approach, τ , is lessthan or equal to τSS

• AND the actual horizontal CPA distance,rCPA, is at or within rMD

• AND one of the following three conditions areoccurring:

– The intruder trajectory will enter or exitthe WCT cylinder from the side (|z+| ≤zMD ∪ |z−| ≤ zMD)

– OR the intruder trajectory will descendinto the WCT cylinder from the top andexit from the bottom (z+ > zMD ∩z− < −zMD)

– OR the intruder trajectory will climb intothe WCT cylinder from the bottom andexit from the top (z+ < −zMD ∩ z− >zMD)

In this case, the own aircraft should initiate a self-separation maneuver.

Hazard Exists =[τn ≤ τSS ∩ rCPA ≤ rMD ∩

( |z+| ≤ zMD ∪ |z−| ≤ zMD ∪[z+ > zMD ∩ z− < −zMD] ∪[z+ < −zMD ∩ z− > zMD] ) ]

(22)

Sense No Hazard (SNH) describes a case whereany one of the following events occurs:

• The estimated time to closest approach, τ , isgreater than the adjusted threshold τSS +kτστ

• OR the estimated horizontal CPA, rCPA, isbeyond the adjusted threshold rMD + krσr

• OR while the estimated horizontal CPA, rCPA,is at or within the adjusted threshold rMD +krσr:

– the estimated intruder trajectory will beabove the adjusted WCT cylinder

– OR the estimated intruder trajectory willbe below the adjusted WCT cylinder

The standard deviation coefficient, k, is defined laterin equation (25) for the τ hazard state. Any oneof these misleading estimates can cause HMI thatleads the own aircraft to not maneuver when a self-

separation maneuver is warranted.

SNH = [τn > τSS + kτστ ∪rCPA > rMD + krσr ∪[rCPA ≤ rMD + krσr ∩(z+ > zMD + k+σ+ ∩z− > zMD + k−σ−)] ∪[rCPA ≤ rMD + krσr ∩(z+ < −zMD + k+σ+ ∩z− < −zMD + k−σ−)] ]

(23)

PHMI must meet a predefined integrity riskrequirement, ISS . This can be broken down intoISS allocations for each hazard state. For example,for τ :

PHMI = Q(kτ ) = Iτ (24)

where Q(x) is the right tail probability of thestandard normal distribution. This is used to obtainkτ :

kτ = Q−1(Iτ ) (25)

kr is found in a similar way, detailed in the previouswork [10].

However, in the z direction, to determine k+ andk− is a bit more complicated. Given that the 2Dhorizontal intruder trajectory projection penetratesthe 2D WCT circle (rCPA ≤ rMD), figure 5shows the nine different ways the 3D intrudertrajectory can approach the WCT cylinder, basedon the values of z+ and z−. In the upper-rightsection, the intruder passes completely above theWCT (z+ > zMD ∩ z− > zMD). In the lower-left section, the intruder passes completely belowthe WCT (z+ < −zMD ∩ z− < −zMD). In theseven other cases, the intruder penetrates the WCT,representing a WCT violation. In the middle-top,middle-middle, and middle-bottom sections, the in-truder enters the WCT from the side (|z+| ≤ zMD).In the middle-left, middle-middle, and middle-rightsections, the intruder exits the WCT out of theside (|z−| ≤ zMD). In the lower-right section, theintruder descends through the WCT, entering fromthe cylinder’s top and exiting through the cylinder’sbottom (z+ > zMD ∩ z− < −zMD). In the upper-left section, the intruder climbs through the WCT,entering from the cylinder’s bottom and exiting

z+

z−

zMD

zMD

−zMD

−zMD

Fig. 5. Possible Intruder Trajectories in (z+; z−) Plane

through the cylinder’s top (z+ < −zMD ∩ z− >zMD).

Figure 6 relates the estimated (z+, z−) plane toHMI. Given that the intruder actually penetratesthe WCT cylinder, HMI would mean the sensorestimated the intruder trajectory to be completelyabove the cylinder (upper-right shaded area) orcompletely below the cylinder (lower-left shadedarea). In the left figure of figure 6, the unshadedareas in white represent areas where the hazard issensed.

The values of actual z+ and z− that maximizePHMI are somewhere on the border lines of theshaded areas of the left figure. Those borders rep-resent either z+ = zMD + k+σ+, z+ = −zMD −k+σ+, z− = zMD + k−σ−, or z− = −zMD −k−σ−. Since for each encounter, there will onlybe one actual z+ and one actual z−, there onlyneeds to be one worst case scenario considered todefine PHMI for the z direction. In the right figureof figure 6, we consider the z+ = z− = zMD

scenario for illustration purposes (where the jointnormal probability density ellipse is centered). Thisis a boundary case with an intruder trajectory atthe top border of the WCT cylinder. Computing theexact HMI requires an integration of the joint (z+,

z−) probability which is computationally expensive.Instead, we use bounds on both the top and bottomHMI’s. Depending on the orientation of the ellipse(which depends on the values of the (z+, z−)covariance matrix), z+ = z− = zMD may ormay not be the worst case scenario. However, thefollowing bound covers all PHMI boundaries, sothat the worst case scenario is covered:

PHMItop ≤Q(k+) +Q(k−)

2(26)

PHMIbot ≤Q(k+ + 2zMD

σ+

)+Q

(k− + 2zMD

σ−

)2

(27)These bounds include the excess light shaded areain the right figure of figure 6, as well as theoverlapped dark shaded area, which includes thePHMI we are interested in capturing. Putting themboth together:

PHMIz ≤ 12 (Q(k+) +Q(k−)

+Q(k+ + 2zMD

σ+

)+Q

(k− + 2zMD

σ−

)) ≤ Iz

(28)Where Iz is the integrity requirement in the zdirection. The k coefficients will be chosen toensure the inequality in equation (28) is true. Notean intruder trajectory at the bottom of the WCTcylinder (with a probability density ellipse centeredat (−zMD, −zMD)) would mirror the right figureof figure 6 and the resulting bounding would be thesame as in equation (28).

Figure 7 depicts a worst case 2D HMI scenario,where the actual rCPA is just within the rMD

but the estimate rCPA is just beyond the adjustedthreshold rMD + krσr. The adjusted threshold en-sures that this case occurs with a probability lessthan or equal to Ir (if we allocate Ir as an integrityrequirement specifically for rCPA).

To account for the correlation of hazard stateestimates, the total probability of HMI is boundedby the following:

PHMI ≤ Q(kτ ) +Q(kr) + 12 (Q(k+) +Q(k−)

+Q(k+ + 2zMD

σ+

)+Q

(k− + 2zMD

σ−

)) ≤ ISS

(29)This allows us to determine integrity coefficients(kτ , kr, k+, k−) based on an integrity risk re-

quirement, ISS . The previous work [10] has amore detailed explanation of the derivation of thismethodology.

CONTINUITY RISK

A false alert (FA) occurs when no hazard exists,but a hazard is falsely sensed. This FA leads theown aircraft to maneuver when a self-separationmaneuver is not warranted. To ensure there is anacceptable PFA, continuity buffers are added tothe integrity-adjusted distance thresholds. The alertto maneuver will still be based on the integrity-adjusted distance thresholds. The area inside eachcontinuity buffer is where false alerts can occurwith a probability higher than a given continuityrequirement. The self-separation continuity risk isPFA.

The probability of FA in equation (30) reflectsthe probability when no hazard exists, but a hazardis falsely sensed.

PFA = P (Sense Hazard|No Hazard Exists) (30)

No Hazard Exists describes a condition wherethe intruder trajectory is outside the WCT distancethreshold cylinder. This means any of the followingconditions occur:

• The actual time to closest approach, τ , isgreater than the threshold τSS

• OR the actual horizontal CPA, rCPA, is be-yond the threshold rMD

• OR while the actual horizontal CPA, rCPA, isat or within the threshold rMD:

– the actual intruder trajectory is above theWCT cylinder

– OR the actual intruder trajectory is belowthe WCT cylinder

No Hazard Exists =[τn > τSS ∪ rCPA > rMD

∪ [rCPA ≤ rMD

∩ (z+ > zMD ∩ z− > zMD)]∪ [rCPA ≤ rMD

∩ (z+ < −zMD ∩ z− < −zMD)] ]

(31)

Sense Hazard describes a case with the followingconditions:

z+

z−

(0, 0) zMD

zMD

−zMD

−zMD

PHMI

PHMI

k−σ−

k+σ+

k−σ−

k+σ+

Actual PHMI

z+

z−

(0, 0) zMD

zMD

−zMD

−zMD

PHMI

PHMI

k−σ−

k+σ+

k−σ−

k+σ+

Overbounded PHMI

Fig. 6. Integrity Risk Correlation Between z+ and z−

rMDkrσr

rCPA

rCPA

Fig. 7. Worst Case HMI Scenario for rCPA

• The estimated time to closest approach, τ , isless than or equal to the adjusted threshold,τSS + kτστ

• AND the estimated horizontal CPA distance,rCPA, is at or within the adjusted threshold,rMD + krσr

• AND one of the following three conditions isoccurring:

– The estimated intruder trajectory will en-ter or exit the adjusted WCT cylinder fromthe side (|z+| ≤ zMD +k+σ+ ∪ |z−| ≤zMD + k−σ−)

– OR the estimated intruder trajectory will

descend into the adjusted WCT cylinderfrom the top and exit from the bottom(z+ > zMD + k+σ+ ∩ z− < −zMD −k−σ−)

– OR the estimated intruder trajectory willclimb into the adjusted WCT cylinderfrom the bottom and exit from the top(z+ < −zMD − k+σ+ ∩ z− > zMD +k−σ−)

The own aircraft senses the need to initiate a self-separation maneuver when an actual hazard doesnot exist.

Sense Hazard =[τn ≤ τSS + kτστ ∩ rCPA ≤ rMD + krσr∩ ( |z+| ≤ zMD + k+σ+

∪ |z−| ≤ zMD + k−σ−∪ [z+ > zMD + k+σ+

∩ z− < −zMD − k−σ−]∪ [z+ < −zMD − k+σ+

∩ z− > zMD + k−σ−])](32)

Here, PFA must meet a predefined continuity riskrequirement, CSS . This can be broken down intoeach hazard state. For example, for τ :

PFA = Φ(−`τ ) = Cτ (33)

where Φ(x) is the cumulative distribution function.

This is used to obtain `τ :

`τ = −Φ−1(Cτ ) (34)

`r is found in a similar way detailed in the previouswork [10]. When τ is between τSS + kτστ andτSS + (kτ + `τ )στ , the own aircraft may FA with aprobability higher than the continuity requirement.This means that the lower limit on protectable τ isτSS + (kτ + `τ )στ . We will henceforth call this theprotection level.

To determine `+ and `−, we refer to the (z+, z−)planes in figure 8. In the left plane of figure 8, theshaded area reflects the PFA region for the intrudertrajectory at the top of the WCT cylinder. In theright plane of figure 8, the PFA region is over-bounded by the shaded area, with the overlappeddark shaded area counted twice. For a continuityrequirement in the z direction, Cz , the resultingbound becomes:

PFAz ≤ Φ(−`+) + Φ(−`−) ≤ Cz (35)

Figure 9 depicts a worst case FA scenario, wherethe actual rCPA is just beyond the protection levelrMD + krσr + `rσr while the estimate rCPA isjust within the integrity-adjusted threshold rMD +krσr. The continuity buffer ensures this case occurswith a probability less than or equal to Cr (if weallocate Cr as a continuity requirement specificallyfor rCPA).

The total probability of FA is bounded by thefollowing:

PFA ≤ Φ(−`τ )+Φ(−`r)2

+Φ(−`+) + Φ(−`−) ≤ CSS(36)

This allows us to select continuity coefficients (`τ ,`r, `+, `−) based on a continuity risk require-ment, CSS . Again, the previous work [10] has amore detailed explanation of the derivation of thismethodology.

RELATING INTEGRITY AND CONTINUITYTO SENSOR REQUIREMENTS

With a predefined integrity risk requirement, ISS ,and a predefined continuity requirement, CSS , theSAA system will alert and maneuver dependingon how large each hazard state standard deviation

(στ , σr, σ+, and σ−) is at each sampled time. Asthe SAA system gets more intruder measurements,each hazard state standard deviation will get smallerover time. Each hazard state’s protection level mustbe reasonably close to the original WCT before ahazard test can be executed. Otherwise, the resultingprotected separation distances can be very large,leading to ATC capacity issues. To mitigate this,a certification authority will need to determine anacceptable fractional margin, ε, on all three orig-inal hazard thresholds (τSS , rMD, and zMD) for(k + `)σ. This is expressed mathematically as:

ετ = (kτ+`τ )σττSS

εr = (kr+`r)σrrMD

εz = (k++`+)σ+

zMD= (k−+`−)σ−

zMD

(37)

Obviously, it is desirable that ε is small. However,achieving ε = 0 is impossible because it wouldrequire perfect sensors such that στ = σr = σ+ =σ− = 0. The fractional margin, ε, can then be usedto define practical operational limits on hazard statestandard deviations, σ’s. The hazard state standarddeviation operational limits are:

στ , ετSSkτ+`τ

, σr ,εrMDkr+`r

,

σ+ , εzMDk++`+

, σ− , εzMDk−+`−

(38)

At the aircraft, the SAA hazard detection test de-scribed in equation (21) can be carried out withrequired integrity and continuity when all hazardstate σ’s decrease below their respective operationallimits (σ’s).

While the intruder aircraft approaches the ownaircraft, the hazard state standard deviations willdecrease as the number of accumulated sensor mea-surements increases. Nevertheless, not all sensors orsensor-suites are capable of ensuring that the hazardstate standard deviations can reduce below theiroperational limits in time to perform a hazard de-tection test (with required integrity and continuity)before a hazard actually occurs. To identify sensorsthat can meet this requirement, operational limitson hazard states are set as follows:

ττ , (1 + ε)τSSr , (1 + ε)rMD

z , (1 + ε)zMD

(39)

z+

z−

(0, 0) zMD

zMD

−zMD

−zMD

PFA

k−σ−

`−σ−

k+σ+

` +σ+

k−σ−`−σ−

k+σ+

` +σ+

Actual PFA

z+

z−

(0, 0) zMD

zMD

−zMD

−zMD

k−σ−

`−σ−

k+σ+

` +σ+

k−σ−`−σ−

k+σ+

` +σ+

Overbounded PFA

Fig. 8. Continuity Risk Correlation Between z+ and z−

rMD

krσr

`rσr

rCPArCPA

Fig. 9. Worst Case FA Scenario for rCPA

The WCT distance threshold operational limits (rand z) can be translated to operational limits onτ because there is an associated time when theselimits are reached. Using the intruder’s estimatedprojected trajectory, we can determine the τ ’s whenr and z are estimated to cross their respectiveoperational limits (r, z). τ is the maximum of eachof the three hazard threshold τ ’s:

τ = max(ττ , τr, τz) (40)

For realistic WCT thresholds and aircraft velocities,τr and τz will typically be much lower than ττ . τwill usually be determined by ττ . However, for low

relative aircraft velocities, τr and τz will need to beconsidered.

Figure 10 depicts how the operational limit re-lates to sensor requirements. The plots representtwo different sensors. For a sensor to meet require-ments, each of its σ curves, for each of its hazardstates, must be less than its σ at a τ greater thanτ . In the plots, each curve is non-dimensionalizedby its σ, resulting in a common y-axis where therequired threshold is one. If a sensor σ/σ curvecrosses 1 at a τ less than τ , it will cross intothe gray shaded area, which indicates a sensor thatwill FA at a probability higher than the continuityrisk requirement and potentially violate integrityat a probability higher than the integrity risk re-quirement. In the figure, only Sensor A meets theintegrity and continuity risk requirements.

In order to apply this methodology, a sensormust have characteristics (sensor uncertainty, sen-sor range, and sample interval) to reduce eachhazard state σ-value below each σ (or its non-dimensionalized σ/σ-value below 1) prior to its τ ,as depicted in Figure 10. If a given sensor is notgood enough, sensor measurement uncertainty mustbe reduced, sensor range must be extended, and/orsample rate must be increased. During operation,once all hazard state σ’s are reduced below theircorresponding σ’s, there only needs to be one test.

τCPA τSS τ τ0

1

τ

σσ

Continuity/Integritynot met σ r

/σr

σ+/σ

+

σ−/σ−

στ/στ

Sensor A

τCPA τSS τ τ0

1

τ

σσ

Continuity/Integritynot met

σ r/σ r

σ+/σ+

σ−/σ−

στ/στ

Sensor B

Fig. 10. Applying Operational Limits to Sensor Requirements

From there, an alerted UAS can maneuver based ontiming: when τ < τ .

SENSITIVITY ANALYSISThis sensitivity analysis assumes a constant rel-

ative intruder velocity and addresses three dimen-sional intruder trajectories.

In [36], typical radar SAA sensors are describedas having an azimuth and elevation accuracy of 0.5◦

to 2◦, a range accuracy of 10 ft to 200 feet, anupdate rate of 0.2 Hz to 5 Hz, and a detectionrange of 5 nautical miles (NM) to 10 NM. In [26]and [37], a nominal radar SAA sensor is describedas having a range standard deviation (σρ) of 24.6feet, an azimuth standard deviation (σθ) of 0.24◦,an elevation standard deviation (σφ) of 0.72◦, anddetection range of 8 NM. Also, in [36], typical EOSAA sensors are described as having an azimuthand elevation accuracy of 0.1◦ to 0.5◦, an updaterate of 20 Hz, and a detection range of 2 NM to 5NM. As a result we use a composite nominal sensorhaving a σρ of 5 feet, a σθ of 0.05◦, a σφ of 0.05◦,a detection range of 8 NM, and an update rate of 5Hz.

For τ and rMD, the WCT established by theRTCA SC-228 SARP is used: τSS of 35 secondsand an rMD of 4000 feet [9]. Corresponding ετand εr of 10% are chosen leading to τ of 38.5seconds and r of 4400 feet. For zMD, 450 feet ischosen, denoting the 500 foot difference betweenVFR and IFR altitudes [38], [39]. The vertical

WCT established by the SC-228 SARP is selectedto be z = 700 feet [9], leading to εz = 56%.The desired integrity requirement, ISS = 10−6,and the continuity requirement, CSS = 10−3,are based on the FAA’s definition of major andminor failure conditions [40]. For simplicity, theintegrity and continuity risk coefficients are set tobe equal: kτ = kr = k+ = k− = 4.98 and`τ = `r = `+ = `− = 3.4.

Intruder Trajectories

The intruder trajectories analyzed are based onthe intruder being initially observed directly in frontof the own aircraft at the sensor range of 8 NM.In the x-y plane, the trajectories are based on theworst-case 2D trajectories analyzed in the previouswork [10], which were head-on and tangent to therMD circle. These 2D trajectories are depicted inthe right side of figure 11.

In the z direction, the intruder trajectory willeither climb, descend, or remain level at the top (orequivalently at the bottom) of the WCT cylinder. Aworst-case relative velocity of 500 knots is chosen,reflecting the closure of two aircraft at a maximumairspeed of 250 knots each. Aircraft are restrictedto 250 knots below 10,000 feet per 14 CFR 91.117[41]. The maximum relative descent rate of theintruder is based on the maximum descent rate ofa likely intruder in the NAS plus the maximumclimb rate of a high performing UAS. For thelikely intruder, according to Appendix A of Change

WCT

Fig. 11. Head-on Trajectories and 2D Trajectories

3 to FAA JO 7110.65V, the maximum descentfor a non-fighter, fixed-wing aircraft is the Boeing727 with a maximum descent of 4500 feet perminute (fpm) [42]. According to data synthesized in[43], the Global Hawk high-altitude long-endurance(HALE) UAV has an initial climb rate of 4000fpm at sea level, below 200 knots. This climb ratedecreases incrementally with altitude as its climbairspeed incrementally increases. Based on this, wewill conservatively assume a maximum climbingairspeed for the own aircraft of approximately 3500fpm. This leads to the assumed worst case relativeintruder descending vertical velocity of 8000 fpm.

The maximum relative climb rate of the intruderis found in a similar way. For the intruder, ac-cording to Appendix A of Change 3 to FAA JO7110.65V, the maximum climb for a non-fighter,fixed-wing aircraft is the Boeing 737-400 with amaximum climb of 6500 feet per minute (fpm) [42].According to data synthesized in [43], the GlobalHawk max descent rate is 4000 fpm. This leads tothe assumed worst case relative intruder climbingvertical velocity of 10,500 fpm.

From there, we chose eleven constant-velocity3D intruder trajectories:

• Head-on, direct collision course climbing.• Head-on, level at zMD (z+ = z− = zMD).• Tangent to the rMD circle, level at zMD (z+ =z− = zMD).

• Head-on, descending, intercepting the topWCT border at the back (z− = zMD).

• Head-on, climbing, intercepting the top WCT

border (zMD) at the front (z+ = zMD).• Tangent to the rMD circle, descending, inter-

cepting the top WCT border (z+ = z− =zMD).

• Tangent to the rMD circle, climbing, intercept-ing the top WCT border (z+ = z− = zMD).

• Head-on, descending, intercepting the bottomWCT border at the front (z+ = −zMD).

• Head-on, climbing, intercepting the bottomWCT border at the back (z− = −zMD).

• Tangent to the rMD circle, descending, inter-cepting the bottom WCT border (z+ = z− =−zMD).

• Tangent to the rMD circle, climbing, intercept-ing the bottom WCT border (z+ = z− =−zMD).

The six head-on trajectories are depicted in the leftside of figure 11.

Results

For the nominal sensor, all eleven trajectoriesmet requirements (by staying out of the upper-lefthand quadrant) in the στ vs τ and the σr vs τgraphs, as depicted in figure 12 and figure 13.However, the sensor did not meet requirements (bypenetrating the upper-left hand quadrant) in bothvertical directions: σ+ vs τ and σ− vs τ , as depictedin figure 14 and figure 15. Although most of thetrajectories were close to meeting requirements, forboth vertical directions, there were four trajectoriesthat were way off: both tangent climbing trajectories(depicted as green dashed lines) and, slightly better,

0 10 20 30 40 500

0.2

0.4

0.6

0.8

1

1.2

1.4

1.6

1.8

2

Nominal mo vs o

Time to CPA, o (seconds)o Sta

ndar

d D

evia

tion,

mo (s

econ

ds)

HO DirectHO Level TopT Level TopHO Dec TopHO Climb TopT Des TopT Climb TopHO Dec BotHO Climb BotT Des BotT Climb Bot

Fig. 12. Nominal Sensor στ vs τ

0 10 20 30 40 500

100

200

300

400

500

600

700

800

900

1000

Nominal mr vs o

Time to CPA, o (seconds)

r CPA

Sta

ndar

d D

evia

tion,

mr (f

eet)

HO DirectHO Level TopT Level TopHO Dec TopHO Climb TopT Des TopT Climb TopHO Dec BotHO Climb BotT Des BotT Climb Bot

Fig. 13. Nominal Sensor σr vs τ

both tangent descending trajectories (depicted asblue dashed lines). Reducing the climb and descentrates of these trajectories brings their respective σ+

vs τ and σ− vs τ curves to meet the other seventrajectories.

To meet integrity and continuity requirements,we needed to make three adjustments. σ+ and σ−were most sensitive to azimuth uncertainty and weimproved σθ by a factor of 10. Also, we increasedthe update rate to 8 Hz and improved σφ slightly

0 10 20 30 40 500

20

40

60

80

100

120

140

160

180

200

Nominal m+ vs o

Time to CPA, o (seconds)

z + Sta

ndar

d D

evia

tion,

m+ (f

eet)

HO DirectHO Level TopT Level TopHO Dec TopHO Climb TopT Des TopT Climb TopHO Dec BotHO Climb BotT Des BotT Climb Bot

Fig. 14. Nominal Sensor σ+ vs τ

0 10 20 30 40 500

20

40

60

80

100

120

140

160

180

200

Nominal m− vs o

Time to CPA, o (seconds)

z − S

tand

ard

Dev

iatio

n, m− (f

eet)

HO DirectHO Level TopT Level TopHO Dec TopHO Climb TopT Des TopT Climb TopHO Dec BotHO Climb BotT Des BotT Climb Bot

Fig. 15. Nominal Sensor σ− vs τ

to 0.03◦. These results are depicted in figure 16and figure 17. Although our adjustments to updaterate, azimuth uncertainty, and elevation uncertaintyresulted in the desired outcome, there are otheradjustments that could have been made to improvesensor performance. For example, increasing thesensor range beyond 8 NM would allow for moremeasurements prior to τ . Also, increasing eachthreshold’s ε would increase its σ (at the risk ofdecreasing airspace capacity). In addition, reallo-

0 10 20 30 40 500

20

40

60

80

100

120

140

160

180

200

8 Hz, me = 0.005°, m

q = 0.03°: m+ vs o

Time to CPA, o (seconds)

z + Sta

ndar

d D

evia

tion,

m+ (f

eet)

HO DirectHO Level TopT Level TopHO Dec TopHO Climb TopT Des TopT Climb TopHO Dec BotHO Climb BotT Des BotT Climb Bot

Fig. 16. Adjusted Sensor σ+ vs τ

0 10 20 30 40 500

20

40

60

80

100

120

140

160

180

200

8 Hz, me = 0.005°, m

q = 0.03°: m− vs o

Time to CPA, o (seconds)

z − S

tand

ard

Dev

iatio

n, m− (f

eet)

HO DirectHO Level TopT Level TopHO Dec TopHO Climb TopT Des TopT Climb TopHO Dec BotHO Climb BotT Des BotT Climb Bot

Fig. 17. Adjusted Sensor σ− vs τ

cating k’s and `’s unevenly among each hazardstate can slightly increase σ for more restrictivehazard states (such as z+ and z−) while decreasingσ for hazard states with more margin (such as τand rCPA). Finally, reevaluating the assumptionsthat led to the 10,500 fpm climb rate, 8000 fpmdescent rate, and 500 knot relative velocity wouldalso impact performance.

CONCLUSIONS

In this paper, we determined integrity and con-tinuity risk for intruder trajectories in three di-mensions. A sensitivity analysis was presented toexplore the sensor requirement trade space and an-alyze eleven restrictive 3D trajectories. The tangentclimbing and descending trajectories were most re-strictive. We were able adjust sensor characteristicsin the analysis to meet integrity and continuityrequirements. Our methodology can be used bya certification authority to certify potential SAAsensors.

ACKNOWLEDGMENTS

We would like to express our appreciation to PhilMaloney, UAS Certification Obstacle Team Leader,of the FAA Hughes Technical Center, for support-ing this research, which was awarded FAA Grant#14-G-018. However, the views expressed in thispaper are the authors’ alone and do not necessarilyrepresent the opinions of any other organization orperson.

References

[1] Federal Aviation Administration, “Integration of Civil Un-manned Aircraft Systems (UAS) in the National AirspaceSystem (NAS) Roadmap,” Nov 2013.

[2] US House of Representatives, “FAA Modernization andReform Act of 2012,” Feb 2012.

[3] Federal Aviation Administration TCAS Program Office,“Concept of Use for the Airborne Collision AvoidanceSystem XU,” Feb 2013.

[4] Federal Aviation Administration, “Sense and Avoid (SAA)for Unmanned Aircraft Systems (UAS), SAA WorkshopSecond Caucus Report,” Jan 2013.

[5] Anderson, E. E., Watson, W., Johnson, K., Kimber, N. R.,and Weiss, N. J., “A Legal Analysis of 14 C.F.R. Part91 See and Avoid Rules to Identify Provisions Focusedon Pilot Responsibilities to See and Avoid in the NationalAirspace System.” Tech. rep., University of North Dakota-U.S. Department of Transportation, Federal Aviation Ad-ministration, Dec 2013.

[6] 14 CFR 91.113, “Right-of-way Rules: Except Water Oper-ations,” Jul 2004.

[7] Weibel, R. E., Edwards, M. W. M., and Fernandes, C. S.,“Establishing a Risk-Based Separation Standard for Un-manned Aircraft Self Separation,” Ninth USA/Europe AirTraffic Management Research and Development Seminar,Berlin, Germany, Jun 2011.

[8] Lee, S. M., Park, C., Johnson, M. A., and Mueller, E. R.,“Investigating Effects of Well Clear Definitions on UASSense-And-Avoid Operations,” AIAA Aviation Technology,Integration, and Operations Conference, Los Angeles, CA,Apr 2013.

[9] Cook, S. P., Brooks, D., Cole, R., Hackenberg, D., andRaska, V., “Defining Well Clear for Unmanned AircraftSystems,” AIAA SciTech, Kissimmee, FL, Jan 2015.

[10] Jamoom, M. B., Joerger, M., and Pervan, B., “UnmannedAircraft System Sense and Avoid Integrity and Continu-ity Risk for Non-Cooperatve Intruders,” AIAA SciTech,Kissimmee, FL, Jan 2015.

[11] Kuchar, J. K. and Yang, L. C., “A Review of ConflictDetection and Resolution Modeling Methods,” IEEE Trans-actions on Intelligent Transportation Systems, Vol. 1, No. 4,Dec 2000, pp. 179–189.

[12] Drumm, A., Andrews, J., Hall, T., Heinz, V., Kuchar, J.,Thompson, S., and Welch, J., “Remotely Piloted Vehiclesin Civil Airspace: Requirements and Analysis Methods forthe Traffic Alert and Collision Avoidance System (TCAS)and See-And-Avoid Systems,” IEEE Digital Avionics Sys-tems Conference, Vol. 2, Oct 2004, pp. 12.D.1–1–14.

[13] Dalamagkidis, K., Valavanis, K., and Piegl, L., “On un-manned aircraft systems issues, challenges and opera-tional restrictions preventing integration into the NationalAirspace System,” Progress in Aerospace Sciences, Vol. 44,No. 7, Jul 2008, pp. 503–519.

[14] Prats, X., Delgado, L., Ramirez, J., Royo, P., and Pastor,E., “Requirements, Issues, and Challenges for Sense andAvoid in Unmanned Aircraft Systems,” AIAA Journal ofAircraft, Vol. 49, No. 3, May 2012, pp. 677–687.

[15] Yu, X. and Zhang, Y., “Sense and avoid technologies withapplications to unmanned aircraft systems: Review andprospects,” Progress in Aerospace Sciences, Vol. 74, Apr2015, pp. 152–166.

[16] McLaughlin, M. P. and Zeitlin, A. D., “Safety Study ofTCAS II for Logic Version 6.04,” Tech. rep., MITRECorporation-U.S. Department of Transportation, FederalAviation Administration, Jul 1992.

[17] Espindle, L., Griffith, J., and Kuchar, J., “Safety Analysisof Upgrading to TCAS Version 7.1 Using the 2008 U.S.Correlated Encounter Model.” Tech. rep., Lincoln Labora-tory, Massachusetts Institute of Technology, May 2009.

[18] ICAO 9689-AN/953, “Manual on Airspace PlanningMethodology for the Determination of Separation Min-ima,” Dec 1998.

[19] Kim, J.-H., Lee, D. W., Cho, K.-R., Jo, S.-Y., Kim, J.-H.,Min, C.-O., Han, D.-I., and Cho, S.-J., “Development of anelectro-optical system for small UAV,” Aerospace Scienceand Technology, Vol. 14, No. 7, Oct 2010, pp. 505–511.

[20] Kochenderfer, M. J., Edwards, M. W. M., Espindle, L. P.,Kuchar, J. K., and Griffith, J. D., “Airspace EncounterModels for Estimating Collision Risk,” AIAA Journal ofGuidance, Control, and Dynamics, Vol. 33, No. 2, Mar2010, pp. 487–499.

[21] Chryssanthacopoulos, J. P. and Kochenderfer, M. J.,“Accounting for State Uncertainty in Collision Avoid-ance,” AIAA Journal of Guidance, Control, and Dynamics,Vol. 34, No. 4, Jul 2011, pp. 951–960.

[22] Billingsley, T. B., Kochenderfer, M. J., and Chryssantha-copoulos, J. P., “Collision Avoidance for General Aviation,”

IEEE Aerospace and Electronic Systems Magazine, Vol. 27,No. 7, Jul 2012, pp. 4–12.

[23] Heisey, C. W., Hendrickson, A. G., Chludzinski, B. J.,Cole, R. E., Ford, M., Herbek, L., Ljungberg, M., Magdum,Z., Marquis, D., Mezhirov, A., Pennell, J. L., Roe, T. A.,and Weinert, A. J., “A Reference Software Architectureto Support Unmanned Aircraft Integration in the NationalAirspace System,” Journal of Intelligent & Robotic Sys-tems, Vol. 69, No. 1-4, Jan 2013, pp. 41–55.

[24] Lee, H.-T., Meyn, L. A., and Kim, S., “ProbabilisticSafety Assessment of Unmanned Aerial System Opera-tions,” AIAA Journal of Guidance, Control, and Dynamics,Vol. 36, No. 2, Mar 2013, pp. 610–616.

[25] Owen, M. P., Duffy, S. M., and Edwards, M. W. M., “Un-manned Aircraft Sense and Avoid Radar: Surrogate FlightTesting Performance Evaluation,” IEEE Radar Conference,Cincinnati, OH, May 2014, pp. 548–551.

[26] Edwards, M. W. M. and Owen, M. P., “Validating aConcept for Airborne Sense and Avoid,” American ControlConference, Portland, OR, Jun 2014, pp. 1192–1197.

[27] ICAO, “International Standards and Recommended Prac-tices,” July 2006.

[28] RTCA SC-159, “Minimum Aviation System PerformanceStandards for the Local Area Augmentation System,” 2004.

[29] Kelly, R. J. and Davis, J. M., “Required Navigation Per-formance (RNP) for Precision Approach and Landing withGNSS Application,” Navigation, Journal of the Institute ofNavigation, Vol. 41, No. 1, Spring 1994, pp. 1–30.

[30] Pullen, S., “What are the Differences Between Accuracy,Integrity, Continuity, and Availability, and How are theyComputed?” InsideGNSS, Sep-Oct 2008, pp. 20–24.

[31] DeCleene, B., “Defining Pseudorange Integrity - Over-bounding,” Institute of Navigation GPS Conference, SaltLake City, UT, Sep 2000, pp. 1916–1924.

[32] Rife, J., Pullen, S., Enge, P., and Pervan, B., “Paired Over-bounding for Non-ideal LAAS and WAAS Error Distri-butions,” IEEE Transactions on Aerospace and ElectronicSystems, Vol. 42, No. 4, Oct 2006, pp. 1386–1395.

[33] Gelb, A., editor, Applied Optimal Estimation, The MITPress, sixteenth ed., 2001.

[34] Bryson, A. E., Applied Linear Optimal Control, CambridgeUniversity Press, 2002.

[35] RTCA SC-147, “Minimum Operational Performance Stan-dards for Traffic Alert and Collision Avoidance System II,”2008.

[36] Chen, R. H., Gevorkian, A., Fung, A., Chen, W.-Z., andRaska, V., “Multi-Sensor Data Integration for AutonomousSense and Avoid,” AIAA Infotech@Aerospace, St Louis,MO, Mar 2011.

[37] Edwards, M., “A Safety Driven Approach to the Devel-opment of an Airborne Sense and Avoid System,” AIAAInfotech@Aerospace, Garden Grove, CA, Jun 2012.

[38] 14 CFR 91.159, “VFR cruising altitude or flight level,” Dec2003.

[39] 14 CFR 91.179, “IFR cruising altitude or flight level,” Jun2007.

[40] Federal Aviation Administration, “Advisory Circular25.1309-1A - System Design and Analysis,” Jun 1988.

[41] 14 CFR 91.117, “Aircraft Speed,” Aug 1993.[42] Federal Aviation Administration, “JO 7110.65V, Change 3,

Air Traffic Organization Policy,” Jun 2015.

[43] Billingsley, T. B., Safety Analysis of TCAS on GlobalHawk using Airspace Encounter Models, Master’s thesis,Massachusetts Institute of Technology, Jun 2006.