Automatic Dependent Surveillance. Initial Safety Analysis Report

Transcription

1 Copy No. Automatic Dependent Surveillance Initial Safety Analysis Report Prepared by Andy Whitehead & Philip Horswood TA Group Limited Date January 2000 TA Group Ltd i

2 APPROVAL AND AUTHORISATION Approved by: Signature Name A M Whitehead Title Project Manager Authorised by: Signature Name J H A Rowland Title Project Controller TA Group Ltd ii

3 DISTRIBUTION Copy No. EUROCONTROL TA Group Limited 1, 2 3, 4 TA Group Ltd iii

4 CONTENTS Section Page No. 1 EXECUTIVE SUMMARY 1 2 INTRODUCTION Background Scope 2 3 OBJECTIVES EATMP Safety Objective ADS Programme Objectives ADS Initial Safety Analysis Objectives 3 4 APPROACH Overview Baseline System Safety Future Surveillance User Safety Requirements Technical ADS Safety Analysis of Candidate Architectures 5 5 RESULTS Overview Baseline System Safety Future Surveillance User Safety Requirements Technical Safety Analysis of Candidate Architectures Summary of ADS Initial Safety Analysis Results 8 6 ISSUES FOR FUTURE STAGES Background Risk Criteria Safety Requirements ADS Security Surveillance Architecture ATM System Reversion Reliability Airborne versus Ground Situation Awareness ADS Data Users 15 7 CONCLUSION 16 REFERENCES 17 TA Group Ltd iv

5 ANNEXES A: ACRONYMS AND REFERENCE DOCUMENTATION B: BASELINE SURVEILLANCE SYSTEM SAFETY C: DERIVATION OF RISK CRITERIA D: FUTURE SURVEILLANCE SYSTEM QUESTIONNAIRE E: GROUND-BASED SURVEILLANCE SYSTEM HAZARD IDENTIFICATION F: AIRBORNE SITUATION AWARENESS HAZARD IDENTIFICATION G: TECHNICAL SAFETY ANALYSIS TA Group Ltd v

6 1 EXECUTIVE SUMMARY 1.1 The ADS Initial Safety Analysis (ISA) has been performed by TA Group on behalf of the EUROCONTROL ADS Programme. The ISA commenced June 1999 and was completed in December The ISA was principally concerned with setting a framework for future ADS safety analysis within the context of the EUROCONTROL ADS Programme. Therefore the work focused on the identification of those issues which it will be necessary to address in the future Programme activities. However, an initial "high level" safety analysis was performed as part of the task 1.3 The ISA highlighted the difficulty in performing a safety analysis of ADS. This is due to both the difficulties in obtaining information about the current surveillance infrastructure and the lack of definition of ADS implementation plans in ECAC. 1.4 However it has been possible to determine some findings, albeit subjective in nature. These identify that (illustrated below): certain ADS implementations are not perceived to be feasible for some scenarios due to the potential for degradation of current achieved safety performance. some implementations supporting specific scenarios show that safety can be enhanced through the use of ADS. Candidate Architectures ADS/ PR/ Mode S ADS/ Mode S ADS/ PR ADS Sole Airspace Types TMA - Take off En-Route - Low Density/Complexity??? En-Route - Oceanic? En-Route - High Density/Complexity TMA - Approach????? 1.5 This assessment is purely qualitative at this time, and the subjective nature is dependent upon many assumptions. These issues are thoroughly discussed in the main report. 1.6 The ADS safety analysis will be continued as part of the EUROCONTROL ADS Programme. TA Group Ltd 1

7 2 INTRODUCTION 2.1 Background EUROCONTROL are managing the ADS Programme to achieve the initial implementation and operational use of ADS in Europe The ADS Programme comprises four discrete stages. These are summarised in order to provide the context for this document as follows: 2.2 Scope Stage 0, is the initial stage of the Programme for which this report has been developed. This stage comprises the development of: an ECAC ADS initial strategy; an ADS initial concept; ADS initial requirements; an ADS Initial Safety analysis; an initial assessment of ADS technology. Stage 0 concludes with the development of an initial Cost Benefit Analysis to assess various aspects of ADS. Stage 0 is scheduled to complete in Stage 1 of the Programme aims at the completion of the strategy, concept and requirements. In addition the development of functional and performance specifications and the continued safety assessment and assessment of the various ADS systems will be performed. This is achieved through a variety of techniques including studies, prototyping and trials. Stage 1 concludes with the development of a business case for pre-operational development of ADS. Stage 1 is expected to be complete in Stage 2 focuses on pre-operational development in order to validate both technical and operational aspects of the proposed European ADS infrastructure. Stage 2 is expected to be complete in Stage 2 will result in a business case for local implementation of ADS. Stage 3 consists of Local Implementation - the responsibility of the national Administrations and Organisations - together with common maintenance and support as a centralised activity. The planning for this Stage is consistent with a first operational date of 2007, as required by the Surveillance Strategy This document has been produced during Stage 0 of the ADS Programme. TA Group Ltd 2

8 3 OBJECTIVES 3.1 EATMP Safety Objective The high level safety objective for the European Air Traffic Management Programme, of which the ADS Programme is a part, is as follows: To improve safety levels by ensuring that the number of ATM induced accidents and serious or risk bearing incidents do not increase and, where possible, decrease. [ATM Strategy] 3.2 ADS Programme Objectives The ADS Programme includes all necessary actions to achieve the initial implementation and operational use of ADS in Europe. The first objectives of the ADS Programme are to determine if ADS, as either sole means or in conjunction with other surveillance sources, can meet the operational requirements for surveillance for the medium and long-term. assess whether ADS as a concept and the various corresponding candidate ADS-B and ADS-C technologies are safe and cost-beneficial for deployment in ECAC airspace. This will be achieved through the development and evaluation of preoperational infrastructure The second objective of the Programme, subject to a positive business case, is the local implementation of operational systems and the maintenance and support activities for those systems The safety element of the overall ADS Programme Objectives is to assess whether ADS as a concept and the various corresponding candidate ADS-B and ADS-C technologies are safe and cost-beneficial for deployment in ECAC airspace. 3.3 ADS Initial Safety Analysis Objectives The relevant objectives of the ADS Initial Safety Analysis to satisfy the higher level objectives identified above were as follows: i) To establish the level of safety of the current surveillance system; ii) iii) iv) To establish the future surveillance system safety requirements; To establish the feasibility of the candidate surveillance architectures to satisfy the surveillance system safety requirements for a range of airspace scenarios; To establish the framework through which the safety case for ADS will be built in the future The ADS Initial Safety analysis is one task in the initial stage of the ADS Programme. Because the ADS Programme is in its early stages it should be emphasised that the results presented in this document have been derived based on qualitative rather than quantitative arguments. As the ADS Programme deliverables become available (e.g. concept, requirements, specifications) a more thorough quantitative analysis will be performed. TA Group Ltd 3

9 4 APPROACH 4.1 Overview The approach to the ADS Initial Safety Analysis was defined based on the objectives of the study. These are: To establish the level of safety of the current surveillance system; To establish the future surveillance system safety requirements; To establish the feasibility of the candidate surveillance architectures to satisfy the surveillance system safety requirements for a range of airspace scenarios These are discussed in the following sections. The additional objective (to establish the framework through which the safety case for ADS will be built in the future) of the study is detailed under separate cover The results of these actives is detailed in section Baseline System Safety This task was to utilise existing service dependability data, current surveillance safety documentation, or specifications from identifiable sources, to establish the expected and achieved current surveillance system safety performance The success of the task was dependent on the availability of suitable data with respect to the current surveillance system. Interpretation of current in-service performance, and the required service, was to take into account the interdependencies with the ATM Operational environment. 4.3 Future Surveillance User Safety Requirements This task was to identify the safety objectives and requirements of a set of ADS users; i.e. ADS system operators (e.g. ATCO/pilot) or technical functions (e.g. STCA) based on available existing material. Safety objectives and requirements for the overall future Surveillance system were to be established through consultation with interested parties who have documented information on work in this arena. This was performed in four stages The derivation of a risk framework, based in the EATMP ANS Safety Assessment Methodology [Ref. 3] The development of a questionnaire which was distributed in order to determine the extent to which safety requirements for future surveillance systems existed Performing hazard identification exercises to identify the hazards associated with the following Airspace Types (derived from the ADS scenarios document): Ground Movements. TMA - Take-off. En-route - Low Complexity/Low Density. En-route - Oceanic. En-route - High Density/High Complexity. TA Group Ltd 4

10 TMA - Approach. TAG/20229/R02 Issue: 1.0 The Hazard Identification exercise was performed relating to both a ground-based surveillance system focus (completed by TA Group) and an Airborne Situation Awareness Hazard Identification, driven by a meeting with stakeholders and EUROCONTROL on October 11, It should be noted that, due to time constraints, Ground Movements were not addressed within the Stage 0 work The final stage of the process was to identify the safety objectives from the Hazard Identification, utilising the Risk Criteria, against which the output of the technical safety analysis could be measured. 4.4 Technical ADS Safety Analysis of Candidate Architectures The Technical ADS Safety analysis was to investigate, at a high level, the hazards of proposed ADS architectures and investigate the potential failure modes inherent to those architectures The major architectural combinations to be addressed within the analysis (as derived from the ADS Scenarios) were: ADS in conjunction with Primary Surveillance Radar and Mode S Monopulse Secondary Surveillance Radar (ADS/PR/Mode S) ADS in conjunction with Mode S Monopulse Secondary Surveillance Radar (ADS/Mode S) ADS in conjunction with Primary Surveillance Radar (ADS/PR) ADS as sole means of Surveillance (ADS Sole) TA Group Ltd 5

11 5 RESULTS 5.1 Overview The results of each task within the ADS Initial Safety Analysis are contained within the following appendices: Baseline Surveillance System Safety: Annex B Future Surveillance User Safety Requirements: Annex C Derivation of Risk Criteria Annex D Future Surveillance System Questionnaire Annex E Ground-Based Surveillance System Hazard Identification Annex F Airborne Situation Awareness Hazard Identification Technical Safety Analysis: Annex G These results are discussed in Sections 5.2, 5.3 and 5.4 below. The results from these tasks are then drawn together within Section Baseline System Safety The objective to establish the level of safety of the current surveillance system in order to address the objectives of ATM that safety should be maintained or enhanced was planned to be addressed in two ways (see Annex B). These were: through the development of a questionnaire to Service providers requesting information on safety features of the surveillance system, and on the achieved level of safety. Unfortunately, no responses were returned. through inspection of available documentation including the Convergence Implementation Programme Status Report, CNS/ATM Architecture Paper, in order to determine the existing Surveillance systems and their safety features. This approach has had limited success. This is not due to errors within that documentation, but is due to the fact that consideration of safety features was not a prime objective in the creation of the documentation It has been concluded, therefore, that it has not been possible to establish the baseline surveillance system safety during Stage 0 of the ADS Programme Further work will be required during Stage 1 to determine if a practical means of achieving this objective does actually exist. 5.3 Future Surveillance User Safety Requirements It has been determined (see Annexes C to F) that the level of integrity required of ADS is dependent upon many issues, as illustrated in Table 1. Issue Surveillance configuration Description the degree of reliance placed upon ADS is dependent upon the overall surveillance configuration. For example, Mode-S in TA Group Ltd 6

12 Airspace density and complexity Separation Standards Degree of Pilot Autonomy Reversion/Contingency Capability Independence/availability of Safety Nets Quantified Risk Criteria TAG/20229/R02 Issue: 1.0 conjunction with ADS would result in less onerous integrity requirements upon ADS than for ADS sole means. this impacts the duration of time that loss of surveillance can be withstood before it has a detrimental effect on safety. For high density / high complexity airspace, the duration may be only tens of seconds, whereas for low density / low complexity (Oceanic being the extreme example), the duration may be several minutes. as with airspace density and complexity, this impacts the duration of time that loss of surveillance can be withstood before it has a detrimental effect on safety. Additionally, the separation standards may change for different capabilities of equipage, and the concept of airborne separation standards is now being introduced which needs to be carefully considered in conjunction with the ground separation standards. the introduction of Airborne Situation Awareness / Separation Assurance Systems during the initial phases enables the delegation of separation responsibility for specific manoeuvres. Longer term, the total delegation of separation responsibility to the aircraft (e.g. for free flight) will change the level of integrity requirements for the airborne side with pilot autonomy. In the event of problems with ADS, or indeed with the Surveillance function as a whole, the available reversion / contingency processes influence the reliance upon ADS. For example, if ADS-C is utilised in Oceanic with existing separation standards, then the reversion is to the current system of infrequent HF voice communications. However, there is increased reliance upon ADS in situations where its functionality is being utilised to reduce separations. In such cases the existing capabilities of alternate surveillance or voice communication means for reversion would not be able to maintain the separations in force in the event of an ADS failure. Although Safety Nets are not considered as control tools, their capabilities can be utilised for mitigation measures in extremis in order to avoid collisions rather than to maintain standard separations. However, consideration must be given to the level of independence in the implementations, and even whether safety nets will be universally available across the entire aircraft population. If this is incorrectly identified, then the required levels of integrity for ADS could either be too vigorous or too relaxed, with consequent impacts on the cost of over-engineering in the former case or failure to have an acceptable level of safety performance in the latter case Table 1 - Issues relating to Future Surveillance User Requirements It was not possible within Stage 0, and without the agreement of the Quantified Risk Criteria, to develop and agree User Safety Objectives for the Surveillance System and in particular User Safety Requirements for ADS. 5.4 Technical Safety Analysis of Candidate Architectures The level of integrity of an equipment based design is traditionally assessed through reliability analysis whose main influences are the architectural aspects (e.g. redundancy, commonality, diversity, segregation) and technology aspects (e.g. proven technology versus novel technology, use of software assured under TA Group Ltd 7

13 appropriate development lifecycle management - e.g. DO178B, amongst others). Given the dependent nature of ADS, the integrity of the airborne Navigation system also needs to be acknowledged as contributing to the overall Surveillance system In addition, for ADS, there are two other aspects that need to be considered, namely security and level of equipage amongst the aircraft population within the airspace The security aspect is related to the different nature of the ADS Broadcast service relative to either independent or co-operative independent surveillance services whereby it is possible for acts of sabotage to impact the safety of operations. The aspects include: Deliberate disabling of aircraft ADS system; Transmission of false reports; Session stealing; Flooding (multiple reporting); RF Jamming These are outside the normal scope of reliability analysis, but nevertheless could result in either loss of ADS transmissions or, more significantly, corruption of ADS transmissions The level of equipage aspect is related to the means of dealing with aircraft that either are not equipped or have suffered a failure of on-board equipment. Current ATC systems cope with individual failures of SSR Transponders today, but there may be problems associated with the evolving nature of controlled airspace. This is more difficult to establish in the absence of actual commercial implementations and so has to be considered conceptually in association with the overall design Given the lack of traceable quantified dependability data for component parts of the Surveillance system, it has not been possible, within Stage 0 of the ADS Programme, to determine a quantified conclusion as to whether the proposed surveillance implementations are tolerably safe. The analyses documented within Annex G of this report, namely the Failure Modes & Effects Analysis and the Fault Tree Analysis should be viewed as providing a framework only at this stage of the ADS Programme which provides a vehicle for developing such analysis into the future. 5.5 Summary of ADS Initial Safety Analysis Results Intuitively, the use of ADS is feasible if it augments the existing surveillance system while maintaining existing separation minima. For example, use of ADS-C within Oceanic Airspace would augment the existing facilities provided by HF voice communications and would enhance the safety of Oceanic operations; similarly, the use of ADS in areas that are currently without ground surveillance infrastructure would be of benefit However, ADS is not necessarily intended simply to augment the existing surveillance system, but is certainly intended to enhance it. One example is the reduction of separation minima, utilising the capabilities of ADS to provide accurate positional information both to the ground and to other aircraft. However, this needs a means of verifying the ADS data to protect against either corruption (not only within ADS, but potentially resulting from an aircraft Navigation system), or deliberate acts of sabotage. It must be recognised that the content of ADS transmissions results in TA Group Ltd 8

14 different modes of failure relative to the traditional surveillance methods of Primary Radar or Secondary Surveillance Radar and due account must be taken of the anomalous behaviour of the ADS system. Another aspect of separation minima reduction is the potential for autonomous operations and the linkage between the ground based separation minima and the airborne separation minima Although it has not been possible to perform a quantitative analysis of the candidate architectures, an attempt has been made to establish the potential acceptability of the candidate architectures to meet the needs of the airspace types. This is represented in Figure 5-1. Airspace Types TMA - Take off Candidate Architectures En-Route - Low Density/Complexity ADS/ PR/ Mode S ADS/ Mode S ADS/ PR?? ADS Sole? En-Route - Oceanic? En-Route - High Density/Complexity??? TMA - Approach?? Figure 5-1: Summary of ADS Initial Safety Analysis Results This assessment is purely qualitative at this time, and the subjective nature is dependent upon many assumptions. A number of issues are raised which are addressed in the next section of this document Addressing the above Figure by candidate architectures 1 : ADS / Primary Radar / Mode-S As previously stated, intuitively the use of ADS to augment an existing surveillance system is feasible since the integrity of surveillance provision can only be enhanced. Therefore this scenario is likely to be acceptable for all applicable airspace types (Oceanic deemed to be not applicable for this candidate architecture). ADS / Mode-S The use of ADS in combination with Mode-S is potentially feasible for all applicable airspace types. Some caution needs to be exercised for this candidate architecture (as denoted by the question marks in the table). The associated issues are related to the risk criteria to determine the integrity requirements; the degree of independence between ADS and Mode-S and thus whether ADS and Mode-S can both provide adequate mutual verification of each other s information and not interfere with transmissions in the event of anomalous behaviour or one system. 1 the analysis in support of Stage 0 of the ADS Programme has excluded Ground Movements TA Group Ltd 9

15 ADS / Primary Radar For low density / low complexity en-route airspace, this combination is likely to be acceptable. For high density / high complexity en-route airspace, and for TMA (both take-off and approach), this candidate architecture may suffice, but is again dependent upon several influences in a similar manner to above. Again, Oceanic airspace is not deemed applicable for this candidate architecture. ADS Sole Dependent upon issues related to potential reductions in separation minima, this candidate architecture is likely to be acceptable for Oceanic airspace. It is unlikely to be acceptable for high density / high complexity en-route airspace due to issues related to security. It is potentially acceptable for low density / low complexity enroute airspace, more so for those areas which currently have no surveillance provision It is acknowledged that the candidate architectures that have been agreed for consideration by the ADS Initial Safety Analysis represent a subset of the total range of architectures documented within the Eurocontrol ADS Scenarios paper [Ref.4]. It will be necessary to consider additional architectures (e.g. ADS in combination with Monopulse SSR) in future stages of the ADS Programme. TA Group Ltd 10

16 6 ISSUES FOR FUTURE STAGES 6.1 Background A number of issues remain after conducting the ADS Initial Safety Analysis. Some of these were known before the analysis began but were not resolved during the period available. Other issues arose during the ADS Initial Safety Analysis activity itself as the anticipated uses of ADS became better understood For the purposes of this Report, the issues have been grouped as follows, noting that a degree of overlap occurs between these groupings: Risk Criteria Safety Requirements ADS Security Surveillance Architecture ATM System Reversion Reliability Airborne versus Ground Situation Awareness ADS Data Users 6.2 Risk Criteria As previously identified, the quantification of risk criteria is fundamental to addressing the safety of any system. If it is too stringent, then there is a danger that the system will need to be over-engineered relative to what is actually required. Conversely, if it is too relaxed, then there is significant potential for the delivered system to be inadequate in supporting the provision of safe separation services The initial analysis has developed a draft quantified risk criteria paper that is included as Annex C. However, it remains in draft and still requires approval but who should approve the risk criteria? A further issue associated with the draft quantified risk criteria paper is that the scope of the criteria requires clarification. For example, is it against a single aircraft, the total aircraft population, the ECAC state volume of airspace, or a single ATC sector? TA Group consider that the absence of an agreed quantified risk criteria at this early stage of the ADS Programme supports the qualitative approach taken thus far rather than attempting to play the numbers game The Safety Regulation Unit (SRU) is looking into the issue of quantification of ATM safety minima against severity categorisation on behalf of the Safety Regulation Commission, but has yet to report. If the SRU is in a position to issue a mandate that is accepted by Eurocontrol and the ECAC states, then this issue will hopefully be resolved. However, the time scale for such resolution is currently unknown and the ADS Programme is, in the meantime, faced with the more immediate problem of determining the acceptability of candidate architectures for different airspace scenarios. A way ahead will need to determined in Stage 1 of the ADS Programme. TA Group Ltd 11

17 6.3 Safety Requirements There are three issues associated with the derivation of Safety Requirements all of which require the active involvement of the stakeholders in order to ensure that the Eurocontrol ADS Programme proceeds to satisfy the needs of all those stakeholders The first issue relates to the ATM Strategy which identifies the need to ensure that the number of ATM induced accidents and serious or risk bearing incidents do not increase and, where possible, decrease. While acknowledging that Surveillance is but one element of the ATM System, it is nevertheless important to attempt to determine the current surveillance system safety levels such that the requirements for the future surveillance system can be set to appropriate levels in order to satisfy the ATM Strategy. The attempts during the ADS Initial Safety Analysis to determine the current surveillance system levels of safety have been unsuccessful. Indeed, it is possible that the nature of safety monitoring currently employed within the ECAC states (generally limited to collection of Airprox statistics) is insufficient to enable the current surveillance system levels of safety to be determined The second issue relates to the derivation of the users safety requirements for surveillance. It was anticipated that this was to be achieved through the conduct of hazard identification brainstorming sessions with the stakeholders, but this was not achieved during the ADS Initial Safety Analysis activity. Equally, an alternative approach to produce a best guess hazard identification output for verification by stakeholders through document review has not been successful to date. It is acknowledged that the degree of reliance placed upon surveillance by the stakeholders is dependent upon what service is to be provided by the future surveillance system. Therefore, an iterative approach is required which initially makes assumptions about the capabilities and usage of the surveillance system that can be validated and amended during the Programme as more information becomes available The third issue relates to the apportionment of surveillance system safety requirements onto ADS itself. This is the final stage in the process of determining how safe should ADS be. It is dependent upon all the preceding issues relating to both Safety Requirements and to Risk Criteria, but again will require an iterative approach with stakeholders as the Programme proceeds. 6.4 ADS Security ADS Broadcast is intrinsically susceptible to acts of sabotage given its dependent nature (rather than the independent (Primary Radar) or co-operative independent (SSR) nature of surveillance that has previously been utilised to support the surveillance function of the ATM System) and its broadcast nature. This susceptibility raises two issues to be addressed in future stages of the ADS Programme The first issue is to determine if the intrinsic susceptibility to acts of sabotage can be reduced without reliance upon other systems. This would have significant benefits in improving the integrity of ADS itself and reducing the reliance upon other systems to improve the integrity of the overall surveillance function The second issue is to determine the level of independence that is required to provide verification of ADS-B transmissions. Although this aspect is highlighted under the TA Group Ltd 12

18 grouping of Security, it is also applicable in the event of failures of ADS, or indeed the systems feeding ADS including the airborne navigation system. The level of independence is dependent upon many factors, most significant is the complexity / density of airspace and the associated separation minima. There is little point in demanding full verification through, say, Mode-S if a simple triangulation system based upon the ADS-B transmissions themselves will satisfy the requirements. The degree of independence that is required is also linked to the first issue in the previous paragraph. 6.5 Surveillance Architecture As has been identified earlier in this paper, while the ADS Initial Safety Analysis is being conducted for the ADS Programme, the analysis has to consider the totality of the surveillance system of which ADS is but one part. There are certain architectural issues associated with the overall surveillance system that need to be considered which potentially go beyond the scope of the ADS Programme, but nevertheless should be highlighted in order that the associated bodies can co-operate and resolve at the higher level. The two main issues identified thus far are associated with levels of independence as follows The first issue relates to determining the impact of sharing transmission media. Most obvious is the potential implementation of ADS-B utilising the extended squitter which shares the same frequency as Mode-S SSR. The actual impacts have yet to be established it may prove not to be an issue in the longer term, but it warrants further investigation in the next stage of the ADS Programme The second issue 2 relates to questioning the level of independence required between the Airborne Collision Avoidance System (ACAS) and the surveillance system, including ADS. Again, the actual impacts have yet to be established and may prove not to be an issue in the longer term, but it warrants further investigation in the next stage of the ADS Programme. 6.6 ATM System Reversion At the ATM System level, it is appropriate to consider the effectiveness of reversion capability in the event of losses of ADS either at individual aircraft level, at the level of a localised geographical area or at a ground based Air Traffic Service Unit level. This can influence the degree of reliance placed upon ADS if an adequate level of reversion exists to maintain a safe separation service. The issues identified thus far are interrelated and must be considered within the context of the overall ATM System rather than purely at the ADS level The first issue relates to the existence of contingency procedures for ADS sole means. If adequate contingency procedures exist, then the reliance upon ADS as a sole means of providing the surveillance function can be reduced. This would be applicable in areas where no automated surveillance capability currently exists, and augmentation of the ATM System is achieved through the provision of ADS. The concern in such circumstances relates to the potential for separation minima to have been reduced as a result of introducing ADS whereby the pre-existing procedures may not be able to effectively maintain a safe separation service. (See related issue on separation minima below). 2 raised during the ADS Hazard Identification conducted with members of AIRSAW on 11 th October 1999 TA Group Ltd 13

19 6.6.3 The second issue relates to the potential reliance upon primary radar as a back-up for ADS. It is noted that the current plan is for Primary Radar to be phased out for all but Terminal Areas. However, it is a worthwhile avenue to follow in the event that it does provide a cost effective reversion means for ADS in certain areas (even if this means reversing the current plans). This could provide an effective reversion in the event of loss of ADS transmissions from an individual aircraft in a similar manner to failure of SSR transponder in today s environment. However, the loss of aircraft Identifiers in areas subject to ground ATM service provision is a significant limitation on the capability of the surveillance system to maintain a safe separation service, in a similar manner to today s Primary / Secondary Radar environment The third issue relates to the potential to utilise the capability of ADS to reduce the separation minima in any given airspace. The impact of such a reduction upon the effectiveness of reversion capability needs to be considered in conjunction with all other changes in order to ensure that the safety requirements for ADS are appropriately apportioned. 6.7 Reliability Although the ADS Initial Safety Analysis has performed only a qualitative analysis of the surveillance system, attempts were made to source reliability data of the various components of the surveillance system for future quantitative analysis. This identified a number of issues that need to be addressed in future stages of the ADS Programme The first issue relates to the validity of the reliability data that is available. There is a lack of traceability as to the source of data in order for that data to be substantiated, noting that this goes beyond just the ADS components of the surveillance system. This should be relatively straightforward to resolve in the longer term, but this was not possible during the ADS Initial Safety Analysis in support of Stage 0 of the ADS Programme The second issue relates to the integrity level of the software contained in the various surveillance system components. Airborne systems are generally assessed against RTCA / DO-178B, whereas modern ground-based systems are generally being assessed against IEC However, a significant content of the surveillance system comprises legacy systems that have not been retrospectively assessed, nor is sufficient and adequate in-service data available to make suitable claims as to the actual performance of those systems. Given the dependency upon the software element of surveillance systems, this is a significant constraint when performing quantitative analyses The third issue relates to the identification of common mode failure characteristics, either for the software, or for the implemented architecture. This issue is linked to the previous issue identified against the surveillance architecture (the potential sharing of transmission media for ADS and Mode-S). This issue also acknowledges that ADS is going to be dependent upon the airborne navigation systems which provide another potential common mode of failure, even though such failures are outside the scope of ADS The final issue relates to the potential impact of utilising novel technology for the implementation of ADS. There is a balance to be struck between the use of proven technology for which strong claims as to levels of integrity can be made based upon historical evidence and the use of novel technology which may provide enhanced TA Group Ltd 14

20 functionality/performance, cheaper or lighter implementations. The balance between conservatism and innovation must be based upon sound reasoning and be supportable for the purposes of creating a case for safety. 6.8 Airborne versus Ground Situation Awareness This aspect falls outside the direct scope of ADS, but does influence the safety requirements for ADS. Two issues were raised during the hazard identification brainstorming with members of AIRSAW The first issue relates to the different means of presentation of the air situation. For the ground based ATM surveillance system, the air situation is presented relative to the fixed ground. For the airborne based Airborne situation awareness, the air situation is presented relative to ones own aircraft. There exists a potential for the ground and airborne domains to have a different perception of the air situation and this needs to be considered when determining the integrity requirements upon ADS The second issue relates to the potential for there to be an actual disparity between the airborne and ground air situation pictures (rather than the potential for a perception disparity as identified in the first issue above). Again, although ADS is but one part of the systems involved, it can still influence the potential for disparity. 6.9 ADS Data Users ADS is anticipated to be utilised in several different ways. It is acknowledged that the actual method of utilisation is still fluid at this stage (which leads to the iterative approach to hazard identification mentioned earlier in this Paper). During the ADS Initial Safety Analysis, two issues have arisen The first issue relates to the need to ensure that all associated bodies are identified. This is not only in other areas of surveillance such as Surveillance Data Processing and Display and Mode-S, but also the Airborne Situation Awareness / Separation Assurance, the Navigation systems and those establishing future separation standards. Additionally, the research and development being conducted by individual stakeholders needs to be identified to ensure that a complete picture of the influences of ADS can be built up The second issue relates to the need to ensure that the work of all the associated bodies is co-ordinated. While it is acknowledged that this is occurring in many instances at the technical level, it is notable that safety aspects are not being consistently addressed by all bodies, if at all. This means that it is difficult for an individual component of the overall ATM system, such as ADS, to identify its role in the overall system from a safety perspective. Some of the issues identified earlier within this Paper would be resolved through the existence of a single body coordinating at an appropriate level. Whether that level should be for Surveillance or for the ATM System has yet to be determined, but there are benefits to be gained from having both. This body could then be responsible for considering the safety of the overall ATM System, identifying all the interactions and interdependencies, and working with the individual areas to ensure an appropriate allocation and apportionment of the overall safety objectives to components of the ATM System, such as ADS. TA Group Ltd 15

21 7 CONCLUSION 7.1 The ADS Initial Safety Analysis in support of Stage 0 of the ADS Programme has been constrained in its ability to succeed in achieving the original objectives. These constraints have been identified as the safety activities progressed and are collated as issues within Section 6 of this document. 7.2 The issues identified need to be resolved in the future stages of the ADS Programme, noting that certain issues are at the Surveillance, or even overall CNS/ATM, level and are thus beyond the direct scope of the ADS Programme itself. 7.3 At a qualitative level, it is concluded that ADS has a role in enhancing the safety of the ATM System in certain scenarios given specific implementations. Such findings have to be substantiated during the next stages of the ADS Programme. 7.4 The final output from the ADS Initial Safety Analysis is the draft Stage 1 Safety Analysis Task Plan. The Task Plan proposes a way forward in resolving the issues identified within this document to ensure that future results can be more rigorously substantiated. TA Group Ltd 16

22 REFERENCES 1. EUROCONTROL ADS Programme Safety Management Plan. SUR/ET3/ST /001, Edition 0.3, 22/03/ ADS Programme Initial Safety Analysis Task Plan TAG/20229/R01 Issue: Final, September EATMP Air Navigation System Safety Assessment Methodology SAF.ET1.ST MAN-01-00, Edition 0.5, 30/04/1999, Working Draft 4. EUROCONTROL ADS Programme Scenarios. SUR/ET3/ST /001, Edition 0.4, 01/09/ Minimum Aviation System Performance Specification - Required Navigation Performance for Area Navigation EUROCAE document ED-75, March TA Group Ltd 17