44TH ANNUAL CONFERENCE, Melbourne, Australia, 17-22 April 2005
WP No. 85
Investigate Navigation and Surveillance Provided by a Single Position Information System
Presented by TOC
1.1. Australia is implementing continent-wide ATC surveillance using Automatic Dependent Surveillance – Broadcast (ADS-B). Much of this area is outside of radar coverage and has virtually no ground-based navigation aids. Most aircraft will determine position using Global Navigation Satellite Systems (GNSS). The term used for the most common system is the Global Positioning System (GPS). This means that the pilot will navigate by GPS and ATC will rely on the transmitted GPS position in order to see where the aircraft is. It is expected that International Civil Aviation Organization (ICAO) will approve the used of 5 NM radar-like separation for ADS-B.
1.2. An outage of GPS information over a wide area (for example jamming of the GPS signal) would mean that the pilot’s ability to navigate would be severely impaired and that ATC would only have surveillance using pilot position reports (from pilots who are uncertain of position).
1.3. This paper addresses the following questions arising from ATC surveillance using ADS-B. Is it acceptable that navigation and surveillance are provided by one system, especially one solely dependent on GNSS? Is it acceptable that these systems will be used in reducing separation minima? How is the controller protected in case of failure?
2.1. Navigation and Surveillance provided by a single system
2.1.1. ICAO has been promoting the use of GNSS and has been working on problems associated with its implementation.
2.1.2. The first issue is navigation using a single system. At the ICAO 11th Air Navigation Conference (ANConf/11), ICAO acknowledged that a number of concerns have been raised over the years regarding the ability of GNSS to become the “sole-means” navigation system and so various back-up options have been proposed. The back-up of most interest for this working paper is ANConf/11 Recommendation 6/8 “GNSS/Inertial Navigation System (INS) integration – That ICAO develop provisions for the integration of GNSS/INS in order to reduce the vulnerability of GNSS to radio frequency (RF) interference…”. (ANConf/11 Working Paper 201) This means that the navigation is via GNSS however there is a self-contained navigation system (INS) that can continue with a high degree of accuracy if GNSS becomes unavailable.
2.1.3. The second issue is one of surveillance using navigation data from a single system. The ICAO Surveillance and Conflict Resolution Systems Panel (SCRSP) at its first Panel meeting addressed the issue of ADS-B surveillance. IFATCA’s SCRSP representative, Christoph Gilgen, reported the following from the Panel:
“In addition to the surveillance characteristics of accuracy, availability, reliability and update rate, the new surveillance system must be as robust as currently required by the system in place that will be replaced, namely:
a) Provide an adequate level of protection against common mode failures of surveillance, navigation and communication functions;
b) Provide fallback surveillance and/or operational procedures to accommodate the loss of the GNSS function in an individual aircraft
c) Provide backup or fallback means to accommodate the loss of the GNSS function over an extended area
d) Support validation of the reported ADS-B position as a means to reduce the probability of an operationally significant undetected failure by an airborne ADS-B system or the navigation data source
e) Provide surveillance in a mixed ADS-B/SSR environment for ACAS and ATC airborne and surface surveillance
f) In operational environments where the threat to safety is of significant concern, be able to delete and suppress the creation of tracks on ADS-B that contain intentionally incorrect position information
g) Be able to cope with the expected growth in traffic over the planned life span of the system.”
2.1.4. This at least shows that the keys areas that must be address have been identified and are being worked on. If these items were all appropriately addressed, then it would be acceptable to use navigation and surveillance based on a single system.
2.1.5. One way to achieve high navigation accuracy and reliability is to have two different navigation systems that cross-check each other, and this is why the ICAO consideration of integration of GNSS and INS is of particular interest.
2.1.6 It seems contradictory to talk of “sole-means” GNSS and then require two independent navigation systems, however it can be explained. What is proposed is that GNSS is the main navigation system, but in order to meet reliability and redundancy requirements there would be a backup system that is self-contained and not reliant on terrestrial or satellite systems.
2.1.7 Consider the example of time. GNSS provides a very accurate time signal. If the aircraft systems were designed only to use solely GNSS time then when GNSS was unavailable, then actual time would not be known. However digital watches, even inexpensive ones, have accuracy and reliability high enough for time keeping for the rest of the flight, and for much longer. The ideal system would therefore be a GNSS system (that is having the highest accuracy), but with a back up to something like digital watch accuracy for time when GNSS is not available. The “digital watch” would have been regularly updated with GNSS time prior to non-availability of GNSS time. Even when GNSS time is being used, the “digital watch” can be used to monitor GNSS time, so as to avoid gross errors.
2.1.8 Consider now inertial navigation, particularly Inertial Reference Systems (IRS). This could operate in a similar way as for time. GNSS, augmented as required or desired, would be the main navigation system. The fallback would be an IRS. The required accuracy of the IRS still needs to be determined, however there are significant improvements being made in costs, weight, size and accuracy of IRS. One factor has been the development of very cheap, highly stable lasers, which in turn has led to solid-state gyros that are highly accurate and decreasing in cost. Manufactures are already making combined GNSS/IRS products.
2.1.9 It should never be IFATCA’s role to push a particular technological solution. IFATCA can however be aware of technological developments and take this into account when formulating policy or when providing input to ICAO Panels, etc.
2.2. Reducing Separation Minima
2.2.1 The reduction of separation minima from procedural separation to a radar separation is a significant change.
2.2.2 ICAO has a procedure where new technology can be compared to an existing technology, and if the new technology can demonstrate at least the same accuracy, etc. of the existing technology, then the new technology can use the same separation minima as the existing technology. This is the first major use of this approach. This is a pragmatic approach to introducing new technology.
2.2.3. Regarding Australia’s ADS-B implementation, detailed trials have been conducted in comparing ADS-B to monopulse radar. In addition, safety cases, getting the national regulators authorization for using the standard in a trial, etc have been done. The reduction is not being done in isolation and is being monitored by several ICAO Panels, all with IFATCA representatives involved. ICAO documentation is being updated to reflect the changes. In short, a defined global procedure is being applied and monitored.
2.2.4. However the issue of this paper is navigation and surveillance being based on a single system. This is already the case today in procedural environments, but a great reduction in the separation standard is being proposed. The significant issues to be addressed, as far as this paper is concerned, is the ICAO SCRSP work on ADS-B addressing the issues of dependent surveillance (that is validation of reported position) and use of a single system (including individual and wide-spread failures).
2.2.5. Provided the SCRSP issues are addressed in addition to the comparison to existing systems, then it is reasonable to have a safe transition to a reduced separation minima.
2.3 Controller Protection in Case of Failure
2.3.1. Of course it is important to address the technical aspects of accuracy, availability, etc. – however the procedures and techniques of the controller are also important.
2.3.2 This is not simply using the controller as an undefined mitigator of system inadequacies. For example it is not simply “if it fails the controller will establish alternative separation as soon as possible”. Formal analysis, procedures and training will define what the controller is expected to do.
2.3.3 To explain further what these procedures mean, consider the case of the installation of a new radar where no ground-based navigation aids exist. If there is only one radar then different controller techniques are expected than if the aircraft is being detected by several radars.
2.3.4 For a single radar, It would be more reasonable to develop procedures and training that expect that the radar would fail at some time and so that normal operations would be more cautious. For example, even when duplicated equipment is in a radar installation, if the radar antenna gearbox was to fail then duplicated processing equipment and lines would be of no value.
2.3.5 Formal safety cases should establish traffic capacity levels applicable to the reliability of the system. Likewise controller procedures, such as the number of aircraft being vectored and/or using minimum radar separation, would be defined. Vertical separation may be more appropriate norm.
2.3.6 New systems always have unexpected failures, fortunately with careful preparation the number are reduced and the consequences minimized.
3.1 In relation to navigation and surveillance systems based on a single position information system:
a) ATC services can use such systems provided issues such as dependent surveillance (that is validation of reported position) and common point of failure (including individual and wide-spread failures) are addressed;
b) Reduced separation standards may be developed using approved ICAO global procedures; and,
c) Controllers must be protected not only by technically addressing issues, but also by procedures and training appropriate to the reliability of the system.
3.2 There is no need to propose policy at this time, as IFATCA does not develop policy if IFATCA agrees with ICAO’s actions. IFATCA should strongly support the ICAO work on ADS-B for ATC surveillance.
3.3. Safety cases should be developed to prove that the target level of safety for the surveillance and navigation functions can be met by the introduction of a single position information system.
3.4. In considering the various options, it appears that it will be difficult to meet accuracy and reliability requirements for both navigation and surveillance from a single position information system.
It is recommended that;
4.1. This paper be accepted as information material.
Last Update: September 29, 2020