EUROPEAN ORGANISATIONFOR THE SAFETY OF AIR NAVIGATION EUROCONTROL EUROCONTROL EXPERIMENTAL CENTRE. EEC Technical/Scientific Report No.

Transcription

1 EUROPEAN ORGANISATIONFOR THE SAFETY OF AIR NAVIGATION EUROCONTROL EUROCONTROL EXPERIMENTAL CENTRE OPERATIONAL CONCEPT & REQUIREMENTS FOR AIRPORT SURFACE SAFETY NETS EEC Technical/Scientific Reprt N Prject: Airprt Safety Nets fr Pilts and Cntrllers Issued: March 2010 The infrmatin cntained in this dcument is the prperty f the EUROCONTROL Agency and n part shuld be reprduced in any frm withut the Agency s permissin. The views expressed herein d nt necessarily reflect the fficial views r plicy f the Agency.

2

3 REPORT DOCUMENTATION PAGE Reference: EEC Technical/Scientific Reprt N Originatr: EEC Airprt Research Area Spnsr: Security Classificatin: Unclassified Originatr (Crprate Authr) Name/Lcatin: EUROCONTROL Experimental Centre B.P.15 F Brétigny-sur-Orge CEDEX FRANCE Telephne : +33 (0) Spnsr (Cntract Authrity) Name/Lcatin: TITLE: OPERATIONAL CONCEPT AND REQUIREMENTS FOR AIRPORT SURFACE SAFETY NETS Authr Date 03/10 Pages xi + 81 Figures Tables Appendix References EATCHIP Task Specificatin - Prject Task N. Spnsr - Perid Distributin Statement: (a) Cntrlled by: (b) Special Limitatins: Nne (c) Cpy t NTIS: YES / NO Descriptrs (keywrds): Abstract: This reprt describes a EUROCONTROL peratinal cncept fr Airprt Surface Safety Nets fr Pilts and Cntrllers. It prvides a descriptin f ptential peratinal cncepts and aims t prvide a starting pint fr the definitin f a validatin strategy fr such cncepts, using the Eurpean Operatinal Cncept Validatin Methdlgy (E-OCVM).

4 This dcument has been cllated by mechanical means. Shuld there be missing pages, please reprt t: EUROCONTROL Experimental Centre Publicatins Office B.P BRETIGNY-SUR-ORGE CEDEX France

5 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL TABLE OF CONTENTS LIST OF FIGURES...VII LIST OF FIGURES...VII REFERENCES...VIII ABBREVIATIONS...IX 1. INTRODUCTION GENERAL SCOPE STRUCTURE OF THE DOCUMENT BACKGROUND OPERATIONAL ISSUES Runways Taxiways Aprns JUSTIFICATION FOR CHANGE General Understanding the causes Understanding the types f cnflicts and alerts Understanding the impact f prviding alerts Understanding the influence f the peratinal envirnment Summary GENERAL BENEFITS, PROBLEMS, AND ASSUMPTIONS OPERATIONAL BENEFITS General perspective ATCO perspective Flight crew perspective PROBLEMS AND RISKS ASSUMPTIONS FRAMEWORK FOR DISCUSSION OF OPERATIONAL CONCEPTS CATEGORISATION ACTORS SYSTEM FUNCTIONALITY Nn-cnfrmance t ATC instructins and prcedures Cnflicting ATC clearances Infringement f restricted/clsed areas SYSTEM ARCHITECTURE CONSIDERATIONS Surces f input and lcatin f safety net functin Types f utputs DESCRIPTION OF OPERATIONAL CONCEPTS GENERAL MOBILE BASED Operatinal cntext Operatinal envirnment (Mbile 1) Nn-cnfrmance t ATC instructins and prcedures (Mbile 2) Cnflicting ATC clearances (Mbile 3) Infringement f restricted/clsed areas TOWER BASED Operatinal cntext Operatinal envirnment (ATCO 1) Nn-cnfrmance t ATC instructins and prcedures (ATCO 2) Cnflicting ATC clearances (ATCO 3) Infringement f restricted/clsed areas BOTH ENVIRONMENTS (TOWER AND MOBILE) General (Bth 1) Nn-cnfrmance t ATC instructins and prcedures (Bth 2) Cnflicting ATC clearances (Bth 3) Infringement f restricted/clsed areas DISCUSSION OF IDENTIFIED OPTIONS DIFFERENCES AND SIMILARITIES Main cncept ptins EEC Technical/Scientific Reprt n v

6 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Impact f input and safety net lcatin INTEGRATION OF CONCEPTS AND ROADMAP INITIAL REQUIREMENTS TECHNOLOGICAL ENABLERS EXISTING SAFEGUARDS Categry 1: Nn-cnfrmance t ATC instructins/prcedures Categry 2: Cnflicting ATC clearances Categry 3: Infringement f restricted r clsed areas TECHNICAL ENABLERS REQUIRED Grund systems Aircraft Systems MATURITY OF TECHNOLOGY OPTIONS IDENTIFIED OPERATIONAL CONCEPTS IN THE SESAR PERSPECTIVE The SESAR Cntext Airprt surface safety nets and SESAR Operatinal Imprvements (OIs) OPERATIONAL SCENARIOS CATEGORY 1: NON-CONFORMANCE TO ATC INSTRUCTIONS/PROCEDURES Scenari 1: Mbile B is nt stpping at the hlding pint Scenari 2: Deviatin frm a cleared taxiway rute Scenari 3: Nn-cnfrmance t ATC prcedures CATEGORY 2: CONFLICTING ATC CLEARANCES Scenari 1: Cnflicting clearances (tw aircraft invlved) CATEGORY 3: INFRINGEMENTS Scenari 1: Infringement f clsed runway Scenari 2: Infringement f restricted/clsed taxiways (areas) OPEN ISSUES vi EEC Technical/Scientific Reprt n

7 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL LIST OF FIGURES Figure 1: Event trees fr peratinal cncept categrisatin 15 Figure 2: Simplified architecture 18 Figure 3: The peratinal envirnment f mbiles - the flight crew's cckpit and driver's cab 22 Figure 4: Functinal architecture, Mbile 1 26 Figure 5: Functinal architecture, Mbile 3 30 Figure 6: The peratinal envirnment f twers the ATCO wrking psitin 31 Figure 7: Functinal architecture (ATCO 1) 34 Figure 8: Functinal architecture (ATCO 2) 37 Figure 9: Functinal architecture (ATCO 3) 39 Figure 10: Functinal architecture (Bth 1) 41 Figure 11: Functinal architecture (Bth 2) 44 Figure 12: Functinal architecture (Bth 3) 46 Figure 13: Relatinship between the Radmap and Operatinal Cncepts 52 Figure 14: Deviatin frm ATC clearance t stp at the hlding pint f taxiway B 66 Figure 15: Deviatin frm a clear rute n a taxiway 67 Figure 16: Excessive taxi speed 68 Figure 17: Aircraft clse t runway withut landing clearance 69 Figure 18: Taking ff withut the clearance 69 Figure 19: Cnflicting ATC clearances 72 Figure 20: Infringement f the clsed runway: aircraft landing 76 Figure 21: Infringement f the clsed runway: aircraft taking ff 76 Figure 22: Infringement f restricted/clsed taxiway 78 LIST OF TABLES Table 1: Categries f peratinal cncept identified Table 2: Summary f pssible ptins Table 3: Categries f Operatinal Cncepts t be cnsidered Table 4: Summarised technlgical enablers (Surce: updated Radmap) Table 5: Runway incursin technlgy enablers Table 6: SESAR OI Steps and Operatinal Cncepts EEC Technical/Scientific Reprt n vii

8 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets REFERENCES 1. NASA Cncepts help flight crews see thrugh the sup, May 1993, NASA Langley, 2. NAV3D Synthetic Visin Systems, 3. NASA Ames Human Factrs Research Centre, 4. Enhanced Traffic Situatinal Awareness n the Airprt Surface with Indicatrs and Alerts (ATSA SURF 1A) Operatinal Services and Envirnment Descriptin, Interim Draft Versin 1.3, August 2008, SC 186 Wrking Grup 1 Sub Grup ATSA SURF 1A (nt final draft), Cntact pmertl@mitre.rg r jim.duke@alpha.rg fr mre infrmatin 5. ICAO Dc 9889, Preliminary Editin 2007, Internatinal Civil Aviatin Organisatin, ICAO PANS-OPS Prcedures fr Air Navigatin Services Aircraft Operatins, Fifth Editin (Dc 8168). 7. ICAO PANS-ATM Air Traffic Management Prcedures fr Air Navigatin Services, Fifteenth Editin, (Dc 4444) 8. Rating Requirements fr Air Traffic ATCOs: Aerdrme Cntrl Visual, CAP 624 Part A, UK CAA, 2nd Issue, March 2003, d= Rating Requirements fr Air Traffic ATCOs: Aerdrme Cntrl Instrument, CAP 624 Part B, UK CAA, 2nd Issue, March 2003, d= Natinal Transprtatin Safety Bard, Mst Wanted Safety Imprvements in Aviatin, Manual n the preventin r runway incursins, Dc 9870, AN483, First Editin 2007, ICAO, Runway Safety, UK CAA, Radmap fr the Develpment f Airprt Surface Safety Nets, v2.0, EUROCONTROL, January Preventing runway incursins prtal f the EUROCONTROL Runway Safety prject, M. Schmidt, M. Rudlph, B. Werther, N. Fürstenau, Remte Airprt Twer peratin with Augmented Visin Vide Panrama HMI, Prc. 2nd Int. Cnf. Res. in Air Transprtatin (ICRAT 2006), Belgrade (2006), pp SESAR Definitin Phase D4, ATM Deplyment Sequence, SESAR Cnsrtium, DLM , January SESAR/EP3 Infrmatin Navigatr, EUROCONTROL, Jun SESAR/EP3 Infrmatin Navigatr, EUROCONTROL, Nvember viii EEC Technical/Scientific Reprt n

9 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL ABBREVIATIONS Abbreviatin 3D three dimensinal ADS-B Autmatic Dependent Surveillance-Bradcast AGL Aerdrme Grund Lighting ALCS Aerdrme Lighting Cntrl and Mnitring System ASAS Airbrne Separatin Assistance System A-SMGCS Advanced Surface Mvement Guidance & Cntrl System ATC Air Traffic Cntrl ATCO Air Traffic Cntrller ATIS Autmatic Terminal Infrmatin Service ATM Air Traffic Management ATSA-SURF Airbrne Traffic Situatinal Awareness n the airprt surface CAA Civil Aviatin Authrity CAATS Cntract based ATm System CDTI Cckpit Display f Traffic Infrmatin D-ATIS Digital Autmatic Terminal Infrmatin Service DCL Departure Clearance DMAN Departure Manager D-OTIS Digital Operatinal Terminal Infrmatin Service D-TAXI Data-link TAXI EASA Eurpean Aviatin Safety Agency EEC EUROCONTROL Experimental Centre EFB Electrnic Flight Bag EFMS Experimental Flight Management System EFPS Electrnic Flight Prgress Strips EFS Electrnic Flight Strips EMMA 2 Eurpean airprt Mvement Management by A-SMGCS, Part E-OCVM Eurpean Operatinal Cncept Validatin Methdlgy EUROCONTROL Eurpean Organisatin fr Safety f Air Navigatin EVS Enhanced Visin System FAA Federal Aviatin Administratin FIS Flight Infrmatin Service FLIR Frward Lking InfraRed GBAS Grund Based Augmentatin System GNSS Glbal Navigatin Satellite System GPS Glbal Psitining System HMI Human Machine Interface ICAO Internatinal Civil Aviatin Organizatin INS Inertial Navigatin System IP Implementatin Package JAR Jint Aviatin Regulatin KPA Key Perfrmance Area LC Lines f Changes EEC Technical/Scientific Reprt n ix

10 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets MLAT NEAN NOTAM NUP 2+ OI PAPI R&D R/T RTCA RWY SBAS SESAR SMR STCA SWIM TCAS TIS-B TWY VOLMET Multilateratin systems Nrth Eurpean ADS-B Netwrk Ntificatin t Airmen NEAN Update Prgramme Phase II+ Operatinal Imprvements Precisin Apprach Path Indicatr Research & Develpment Radi Telephny Radi Technical Cmmissin fr Aernautics Runway Satellite Based Augmentatin System Single Eurpean Sky ATM Research Surface Mvement Radar Shrt Term Cnflict Alert System Wide Infrmatin Management Traffic Alert & Cllisin Avidance System Traffic Infrmatin Service-Bradcast Taxiway meterlgical infrmatin fr aircraft in flight x EEC Technical/Scientific Reprt n

11 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Page intentinally left blank EEC Technical/Scientific Reprt n xi

12

13 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL 1. INTRODUCTION 1.1. GENERAL This reprt prvides a descriptin f ptential peratinal cncepts fr Airprt Surface Safety Nets and aims t prvide a starting pint fr the definitin f a validatin strategy fr such cncepts, using the Eurpean Operatinal Cncept Validatin Methdlgy (E-OCVM) SCOPE The fcus f this reprt is n airprt surface safety nets. Safety nets fr airprt surface mvements are defined as grund-based r airbrne system autmated applicatins that alert air traffic cntrllers, flight crews r airside vehicle drivers t ptentially hazardus situatins in an effective manner and with sufficient warning time fr the situatin t be reslved [13]. This reprt shuld be cnsidered within the cntext f previus and nging initiatives in the area f airprt surface safety nets. Particularly it shuld be cnsidered within the previus wrk n A-SMGCS level 2 and the Airprt Safety Net Radmap which builds n peratinal requirements laid ut by ICAO and is supprted by an peratinal analysis f the key hazardus situatins. The current reprt cnsiders varius airprt safety net cncepts, principally within the SESAR IP1 timeframe (althugh the exiting radmap extends t perid after 2013 as well). It is imprtant t highlight thugh that there has nt been any frmal pilt/flight crew input t the OpsCn and that this shuld be taken int cnsideratin fr further updates since the cncept wuld benefit frm review and feedback frm pilts STRUCTURE OF THE DOCUMENT The structure f the dcument is as fllws: Sectin 2 describes the backgrund t the issues with airprt surface safety and the justificatin fr the develpment f a cncept fr airprt surface safety nets. Sectin 3 prvides general benefits expected frm airprt safety nets intrductin, prblems and risks anticipated and general assumptins; Sectin 4 gives framewrk fr discussin f peratinal cncepts prpsed; In Sectin 5, descriptin f peratinal cncepts is develped int mre detail; Sectin 6 prvides a summary and further discussin f the ptins in terms f advantages and disadvantages, and als identifies ptential fr integratin f different cncepts; and Sectin 7 describes existing safety nets, technlgical enablers required t supprt airprt safety nets and maturity f technlgy ptins identified; Sectin 8 prvides the set f peratinal scenaris t demnstrate the different ptins; and Sectin 9 lists all pen issues. EEC Technical/Scientific Reprt n

14 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets 2. BACKGROUND 2.1. OPERATIONAL ISSUES The demand fr travel frm airprts acrss Eurpe ften means that traffic patterns at majr airprts tend t exhibit peaks and trughs ver a 24 hur perid. The ability f the airprt t accmmdate this varying demand will depend upn its capacity t accmmdate the traffic. Indeed at sme hub airprts where demand remains high fr extended perids f time the airprt runs at r near capacity fr the majrity f its peratinal hurs. Such situatins mean that space available fr surface traffic t mve acrss the runways, taxiways and aprns is ften limited. Prviding a high level f safety under such circumstances is the highest pririty and, based n experience ver the past years, a cnsiderable challenge. When cnsidering safety f peratins n the airprt surface, three distinct but clsely related mvement areas can be identified: runways, taxiways and aprns Runways Safety issues assciated with runway peratins are well-knwn; they predminantly fcus arund addressing runway incursins. This is an area f knwn relative high risk (with a prbability f cllisin higher than any ther phases f flight). This area has therefre been a pririty fr imprving safety in aviatin fr a lng time [10]. A runway incursin, as defined by ICAO, is Any ccurrence at an aerdrme invlving the incrrect presence f an aircraft, vehicle r persn n the prtected area f a surface designated fr the landing and take-ff f aircraft [11]. The distinctin frm the ld definitin is incrrect presence which replaces unauthrised r unplanned presence and cnsequently implies that incidents resulting frm Air Traffic Cntrl (ATC) errr will nw be captured as runway incursins. Fr example ccasins when a flight crew crrectly fllws the issued clearance, but the clearance itself is errneus and results in an incrrect presence n the runway, will nw be defined as runway incursins. This definitin als encmpasses situatins in which an aircraft takes ff (r lands) n the wrng runway. Althugh there are many causal factrs f runway incursins many can be traced back t human errr. Pr cmmunicatins, failure t fllw prcedures and ultimately a lack f situatinal awareness by actrs invlved will nrmally cntribute t it [12]. A number f actins have been taken with the aim t reduce the number f runway incursins, such as: identificatin f best practices fr safe runway peratins; awareness campaigns fcussing n the main cntributing factrs t the ccurrence f runway incursins, e.g. phraselgy; measures t imprve situatinal awareness f the actrs invlved, e.g. clear signage fr flight crew and vehicle drivers and a cmplete and crrect traffic verview based n high quality surveillance fr air traffic cntrllers (ATCOs). In additin t this, safety nets are being intrduced t assist in detecting any runway incursins as sn as they ccur, prviding mre time fr the safe reslutin f the prblem Taxiways A runway incursin has a relatively high safety criticality cmpared with ther peratins n the airprt surface (the latter generally invlve lwer relative speeds and therefre d nt present a high ptential threat t human life). This fact meant that effrts t enhance airprt surface safety 2 EEC Technical/Scientific Reprt n

15 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL have largely been fcused upn prtecting the runway envirnment. Cnsequently relatively little attentin was given t ATM systems that enhance the safety f airprt taxiways. The taxiway system f an airprt is a cmplex envirnment its layut is highly dependant n the lcal peratinal envirnment and with a high number f mvements n the taxiways accidents between tw aircraft, r between aircraft and vehicle d ccur. The severity f such accidents may typically be less than that f accidents due t runway incursins, but the damage t prperty and peratinal efficiency can lead t high csts fr airlines. It is relatively easy fr flight crews and vehicle drivers t becme disrientated n the surface f an airprt, particularly if they are nt familiar with the lcal prcedures r taxiway layut. The lack f features n an airprt surface, (which is generally a relatively barren envirnment) ften serves t cmpund the prblem, particularly in lw visibility cnditins. It is therefre vital that the flight crew can use surface lighting and signage t cnfirm their psitin n the airprt surface when these visual aids are available. A gd level f cmmunicatin between the flight crew and ATCO is vital t ensure that an instructin issued has been understd and is being fllwed. This is particularly imprtant in very lw visibility cnditins when the flight crew may rely n the ATCO t reprt their psitin, (as presented t them by a surveillance feed) and visa versa. The clse prximity (but generally slw speeds) f traffic n the airprt surface means that it can be very difficult t predict the immediate shrt term intent f mbiles. This is particularly the case with surface vehicles, which have a much higher agility then taxing aircraft (wh, fr example, may require a tw truck t reverse). As such, in relatin t surface safety nets, it can be very difficult fr an autmated system t determine when a cllisin between mbiles n the taxiway is imminent withut bmbarding the peratrs with multiple false alters. The difficultly centres n what set f alerting criteria t use t set the threshld fr triggering a shrt term cnflict alarm. Use f safety nets n taxiway systems is fr the mment nt very cmmn. A number f the actins that were mentined in relatin t runways als apply t taxiways: the smetimes cmplex taxiway system can be very disrienting and measures such as clear and unambiguus phraselgy and signage can help in reducing hazardus situatins Aprns Aprn peratins are distinct frm thse n the taxiway. The paths t be taken by surface mbiles are nt defined by strips f hard standing but instead by signage, surface markings and lighting systems. These references are used t rientate the mbiles as they mve acrss the expanse f the aprn. Typically a lcal set f prcedures dictates what areas particular mbiles can perate in. Operatins can be even mre space-cnstrained, then n taxiways with multiple aircraft and vehicles perating within a limited area, but typically at lwer speeds than n taxiways. This envirnment typically has a much higher vehicle ppulatin serving it (e.g. including catering, refuelling, de-icing, push-back, and passenger transfer vehicles). In additin, the aircraft are tightly packed tgether and their need t be pushed back frm the gate befre cmmencing n their ruting acrss the airprt surface must be crdinated with ther surface traffic. This is needed t ensure that aircraft are nt maneuvred int a situatin where they blck ne anther s path. At many airprts aprn mvements may be nt be cntrlled by Air Traffic Cntrl (ATC) at all as they are nt cnsidered as part f the maneuvring area. In ther instances, where a given EEC Technical/Scientific Reprt n

16 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets airline has exclusive use f a set f gates the aprn cntrl may be perfrmed by the airline, using tls such as Departure Manager (DMAN) t indicate t ATC when an aircraft is likely t be ready fr push back. Taking all f this int cnsideratin and the fact that it is very difficult t establish when the cnflict ccurs, it is necessary t highlight that inclusin f aprns in airprt safety nets is very difficult and ptentially impssible. Hwever, aprns are kept fr cnsideratin in this prject since there is a desire t cver as wide area as pssible JUSTIFICATION FOR CHANGE General A number f initiatives have already been taken t imprve airprt surface safety, in particular in relatin t the runway area. These initiatives address the full scpe f peple, prcedures and equipment thrugh awareness, best practices and infrmatin prvisin. Such initiatives fcus largely n preventin f hazardus situatins. The next step t take is t aim fr prviding warning t reslve the situatin nce a hazardus situatin has ccurred. The initial steps n the develpment f safety nets have been taken within the cntext f A- SMGCS. A-SMGCS Implementatin Levels 1 and 2 prvide ATCOs tw main services aiming at supplementing visual bservatin fr traffic situatinal awareness (surveillance service), at raising awareness f ptential hazardus situatins and supprting ATC cntrl actins (cntrl service). The Radmap fr Airprt Surface Mvement Safety Nets and hence this dcument build n tp A-SMGCS Level 2 a series f surface mvement safety nets aiming t: Increase the cverage f hazardus situatins fr surface mvements (cmpared t A- SMGCS Level 2); and Prvide direct alerts t flight crews and vehicle drivers (when relevant). Therefre, there is a need t address these issues and sme f the shrtcmings that still exist. This means mving twards a safety net functin that cvers the full airprt mvement area and imprves warnings t enable a safe reslutin f the situatin. T prvide a justificatin fr this, the causes f hazardus situatins n the airprt surface and the types f situatins need t be understd. In additin, it is necessary t assess the effect that alerts may have n the actrs invlved and sme further aspects f the peratinal envirnment that may affect the successful applicatin f safety nets Understanding the causes T define an peratinal cncept fr airprt surface safety nets, sme understanding f the causes leading t hazardus situatins is necessary. In principle, the cause f a hazardus situatin shuld nt affect the way any safety net perfrms, but understanding the causes may imprve the success rate f a safety net (in terms f enabling a safe reslutin). With sme level f understanding f the cause, typical actins leading t a specific situatin can be mre easily recgnised and likelihd f successful reslutin can be increased thrugh ptimised alerting. T clarify this further, the fllwing example shuld be cnsidered. 4 EEC Technical/Scientific Reprt n

17 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL A hazardus situatin is caused by a disriented flight crew that enters an active runway withut clearance. Prvisin f an alert t the flight crew t make them aware f this can be cnsidered as a cncept. If the alert can be presented t the flight crew in such a way that it prvides them with sufficient infrmatin t safely reslve the situatin, this may be a gd cncept. If, n the ther hand, an alert is likely t nly add t the cnfusin f the flight crew, an alternative cncept is preferable. A full analysis f all pssible causes wuld be t detailed fr the purpse f the current reprt; therefre the fcus is n the main high level issues which are cnsidered relevant in relatin t safety nets. The Preventing runway incursins prtal f the EUROCONTROL Runway Safety prject [14] names three main issues that lead t runway incursins: lss f situatinal awareness, breakdwn f cmmunicatins and errrs. These main categries are assumed t be applicable als utside the runway area, n the taxiways and aprns. Lss f situatinal awareness A mdern airprt can be a large and cmplex envirnment in which flight crew can get lst whilst trying t navigate their way frm parking stand t runway r vice versa. Similarly, during perids f high traffic lad, ATCOs are at risk f lsing the verview f which aircraft is ging where. This prblem can be exacerbated if the airprt has grwn ver the years and the available infrastructure was expanded accrdingly, leading t a sub-ptimal verall infrastructure. In additin, it is very cmmn that ATCOs view f the maneuvring area becmes bscured as a result f ad hc additins t airprt facilities blcking what was previusly a clear view. Lss f situatinal awareness des nt necessarily relate nly t lcatin and identificatin f mbiles, cnfusin abut clearance status can als ccur. This is particularly relevant t ATCOs wh have t keep track f status f multiple targets at the same time. Lss f situatinal awareness by a flight crew can lead t aircraft inadvertently mving nt the wrng taxiway r a runway, r int a restricted area. If an ATCO lses verview, there is a risk f aircraft being prvided with incrrect instructins. Breakdwn f cmmunicatins High lading f radi telephny (R/T) means sme cmmunicatins can be lst, missed r misunderstd. This can lead t unexpected behaviur f aircraft r vehicle, because flight crew r vehicle driver and ATCO have a different understanding f the status f the mbile (in terms f e.g. rute r clearance). Errrs Errrs are situatins in which a ATCO, flight crew r vehicle driver accidentally perfrms an incrrect actin, such as crssing a stp bar, issuing a wrng clearance r turning nt a wrng taxiway. Errrs are ften clsely related t the first tw categries: lss f situatinal awareness and breakdwn f cmmunicatins. Fr example, a clearance being prvided by an ATCO t the wrng aircraft, r a flight crew turning int a wrng taxiway culd als be attributed t a (mmentary) lss f situatinal awareness. EEC Technical/Scientific Reprt n

18 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets The first curse f actin in reducing the chance f ccurrence f the three main categries described here is thrugh preventin. Fr example, the main issue in addressing lss f situatinal awareness is thrugh prvisin f infrmatin t imprve situatinal awareness in general, and imprve the ability f all actrs t maintain gd situatinal awareness. When a safety net functin is then cnsidered as a next step, this ratinale shuld be extended t the safety net, if it is t address the hazardus situatin successfully: any alert r warning has t be presented in such a way that the details f the situatin (in particular mbiles invlved and their lcatin and directin f mvement) are presented in a clear and unambiguus way. Applying the same ratinale t breakdwn f cmmunicatins, there are areas that can be addressed t prevent these kinds f ccurrences, such as standardised phraselgy. In terms f safety nets, the situatin is als similar t lss f situatinal awareness, as sme part f the peratin has been missed r misunderstd, meaning it is imprtant t prvide all the crrect infrmatin as part f the safety net functin utput, t eradicate the infrmatin that was crrupted by the breakdwn f cmmunicatins Understanding the types f cnflicts and alerts The ICAO Eurpean Manual n Advanced Surface Mvement Guidance and Cntrl Systems (A-SMGCS) indicates that the fllwing shrt term alerts shuld be prvided within an adequate time t enable the apprpriate immediate actin: Shrt term cnflict alert, whereby an A-SMGCS triggers an alert when predicted separatin will be belw preset/predefined minima (nte: there are n separatin minima n taxiways); Area penetratin alert, whereby an A-SMGCS triggers an alert when a mvement is detected as likely t enter a critical r restricted area; Deviatin alert, whereby an A-SMGCS triggers an alert when cmputed deviatin will be mre than the preset/predefined maximum deviatin; Runway incursin alert, whereby an A-SMGCS triggers an alert when a mvement is detected as likely t enter an active runway (runway strip); and Taxiway (r an inactive runway being used as a taxiway) r aprn incursin alert, whereby an A-SMGCS triggers an alert when a mvement is detected as likely t enter a taxiway r aprn in use which des nt belng t his assigned rute. These five alerts were used as the starting pint fr the radmap [13] and will als be used here. Fr the purpse f the study, the generic definitins used by ICAO will be applied thrugh the fllwing, mre pragmatic interpretatins: A shrt term cnflict alert, similar t an airbrne STCA, relates t cnflicts due t a predicted r actual lss f separatin between tw aircraft r an aircraft and a vehicle. Examples are tw aircraft appraching the same taxiway junctin frm different directins, r a fast taxiing aircraft fllwing a slw taxiing aircraft n the same taxiway. An area penetratin alert aims t prtect any areas f the airprt that are safety critical r, either temprarily r permanently, restricted fr aircraft and/r vehicles, and the alert will be triggered if a mbile enters r is expected t enter such an area. A deviatin alert, where a mbile deviates frm a given ruting acrss a runway, taxiway r aprn is a mre cmplex situatin. This is because the safety net system is required t have sme level f awareness f the clearance status and cleared rute f the aircraft r vehicle. Examples f situatins where such an alert wuld be generated include instances when aircraft mve nt a taxiway that is nt part f the cleared rute, a pushback r taxing 6 EEC Technical/Scientific Reprt n

19 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL maneuvre is initiated withut a clearance r when taxing cntinues beynd the end f the cleared rute. A runway incursin alert warns actr(s) abut either a predicted r in-prgress runway incursin (as defined by ICAO). Finding the key t engineering and/r implementing such a system s that it prvides timely and useful alerts is difficult. This is typically because it is hard t establish whether a mbile mving nt the runway surface is a crrect actin (i.e. ne that was planned by the ATM system) r nt Understanding the impact f prviding alerts One f the challenges in prviding any type f alert in any envirnment is defining the crrect alerting cnditins. T identify a situatin as hazardus and requiring an alert t be raised t an actr, a safety net functin needs a defined set f parameters against which it can evaluate the situatin. If the evaluatin, based n the parameters, cnsiders that a cnstraint has been breached and a hazardus situatin is ccurring, an alert will be generated. The difficulty in this is setting the alerting parameters in such a way that an acceptable balance is achieved between: Setting the parameters tight enugh, s that whenever an alert is generated the situatin really is cnsidered in line with expectatins f the alert level, and there is sufficient time available t reslve the situatin withut leading t an accident; Nt setting the parameters t tight s that whenever a hazardus situatin ccurs and an alert is generated; therwise the ATCOs will becme desensitised t the alerts viewing them as an impediment t either capacity r safety and a benefit t neither. Within the cntext f these tw cmpeting nets it shuld be remembered that verall the safety net shuld allw the ATCOs t maintain capacity with the same r increased level f safety. If alerting parameters are nt tight enugh, a safety net functin may generate many false r nuisance alerts: alerts in relatin t situatin that are nt cnsidered as requiring an alert accrding t the actrs invlved. Such alerts will reduce acceptance f the safety net functin. All f the abve shuld be seen in relatin t the purpse f the alert r alert level (if the alert has different levels, e.g. amber and red): is it aimed at raising awareness and drawing attentin f the relevant actrs t a situatin which may develp int a hazardus situatin, r is it aimed at identifying actual hazardus situatins that require immediate actin? Understanding the influence f the peratinal envirnment The cncept fr safety nets n the airprt surface is quite different frm the safety nets in existence (and under develpment) fr airbrne aircraft. The mst bvius difference is the distance between aircraft (and, n the grund, vehicles). In the air, significant radar separatin is applied whereas n the grund aircraft mvements ften take place in clse prximity t each ther. This leads t a key difference in the timings f the alert, the time t clsest pint f apprach, and the timeliness f actin fr the flight crew r ATCO. Other clear differences can be fund in the relevant cnstraints: flying aircraft have a limited maneuvrability in terms f sudden changes in speed r directin f flight (i.e. aircraft are flying n a pre-defined path and prfile), making their future psitin relatively predictable, yet have a large degree f freedm in terms f taking evasive actin in a cnflict situatin. EEC Technical/Scientific Reprt n

20 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets On the grund, in relative terms, mvements are much mre flexible, directin f mvement can be changed quickly and speed can vary and includes the ptential t cme t a cmplete standstill. At the same time, the mvement f aircraft is nrmally limited t the system f available taxiways and runways. Aircraft shuld be fllwing ATC instructin while mving n the grund s their mvements shuld be easy t predict. Hwever, the flexibility in grund mvements mentined abve makes these mvements very difficult t predict withut infrmatin n intent: if an aircraft is mving twards a taxiway junctin, it is difficult t tell in advance whether the aircraft will turn left r right; if an aircraft is mving twards a stp bar, it is difficult t predict in advance whether the aircraft will stp r ignre the stp bar and cntinue taxiing. This lack f predictability, in cmbinatin with the clse prximity f mvements means that any deviatin f a rute can quickly develp int a hazardus situatin, and makes airprt surface safety nets a difficult issue t address. Visibility Safety nets shuld functin under different visibility cnditins. The varius cnditins can affect a number f different aspects f the safety nets: Safety margins and alerting rules. These are likely t differ between visibility cnditins, as larger margins are applied in lw visibility. Ability t act. During perids f lw visibility, the ability fr bth ATCOs and flight crews t visually bserve the traffic situatin changes. ATCOs becme highly dependent n surveillance infrmatin, but at least they will cntinue t have a glbal verview. Fr flight crews and vehicle drivers, the ability t bserve the surrundings f the aircraft, including any nearby traffic reduces with reducing visibility, ptentially limiting the ability t take the prper crrective actin in case f an alert being presented t them. Visibility f safety net equipment. If alerts are presented t flight crews thrugh equipment, mst prbably lighting, n the airfield, the ability t see this equipment may becme an issue in cnditins f very pr visibility. Layut Airprt layut will have an influence n the mst likely types f cnflicts that may ccur at the airprt, and therefre n the situatins that a safety net shuld fcus n. Examples are taxiway/runway crssings, crssing runways, cmplex taxiway junctins, presence f restricted areas. Therefre, alerting algrithms (r, at a higher level, alerting methdlgies) must be capable f being adapted t the lcal envirnment int which the surface safety net is implemented. Available systems and prcedures (grund and air) The systems available t flight crews and ATCOs and the prcedures, rles and respnsibilities applicable at an airprt can have a significant impact n the successful implementatin f an airprt safety net. Examples are the quality and cverage area f the surveillance system and the different cntrl psitins respnsible fr different areas f the airfield. Hwever, the cncepts under discussin in this reprt are cnsidered at a generic level and detailed systems and prcedures shuld nly be cnsidered when mving twards applying safety nets within a specific envirnment. 8 EEC Technical/Scientific Reprt n

21 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Summary In the intrductin f Sectin 2.2, expansin f the A-SMGCS level 2 cncept was mentined in tw areas: in terms f the actual area cvered, expanding frm runway nly t the full mvement area, and in terms f imprving the alerts that are prvided, t enable increased success rates in reslving hazardus situatins. Cvering the mvement area Initial fcus n the runway areas is justified by the number f incidents reprted in cmbinatin with the ptential disastrus cnsequences f a runway accident. With ever grwing traffic levels and pressure n efficient peratins during all phases f flight frm gate t gate, including befre take ff and after landing, increased fcus is required n maintaining safety level n the whle airprt surface. Therefre, there is nw a need t expand the fcus f safety nets t the taxiway and aprn areas and intrduce an integrated airprt surface safety net functin. Imprved alerting Develpments in relatin t A-SMGCS level 2 have shwn that, althugh a useful additin t the system, the relevant safety net functin is nt always sufficient. Further cncepts need t be explred t imprve verall alerting perfrmance (t be interpreted here as successful reslutin f a hazardus situatin being enabled by an alert). One bvius apprach is earlier alerting, hwever, frm Sectin it is clear that earlier alerting will nt always be pssible withut negative side effects. Therefre, a secnd apprach is creating a mre direct cmmunicatin between safety net functin and flight crews. EEC Technical/Scientific Reprt n

22 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets 3. GENERAL BENEFITS, PROBLEMS, AND ASSUMPTIONS The fllwing sectins prvide general view f benefits sught by intrductin f airprt safety nets [13], while mre specific benefits f each peratinal cncept prpsed will be given in Sectin 5. In additin this sectin addresses issues f false alerts and general issues related t the way in which alerts are given t ATCOs and mbiles. The sectin cncludes with a general list f assumptins taken int accunt in the develpment f the peratinal cncepts OPERATIONAL BENEFITS General perspective The preventin f the key hazardus situatins aims at mitigating the risk f cnflicts and cllisins between aircraft r between aircraft and vehicles. In additin, the use f safety nets may reduce ptential damage caused t aircraft r the risk f injury t aircraft crews, passengers and grund persnnel (e.g. in case f severe breaking actins during taxi r due t the effect f jet blast during surface mvements). Furthermre, the detectin f ptentially hazardus situatins cntributes t the efficiency f surface mvements and mitigates the risk f peratinal disruptins ATCO perspective Cmpared t A-SMGCS Level 2, the main peratinal advantage sught by ATCOs with new airprt surface mvement safety nets is increased time available t identify what actins need t be taken and instruct the cncerned flight crew r vehicle driver. The success f any interventin is imprved where the cntrller is made aware f the risk earlier Flight crew perspective The supprt frm autmatin t flight crews fr airprt surface mvement is aimed at increasing their situatinal awareness and preventing dramatic cnsequences f undetected hazards r peratinal errrs. Hwever, flight crews shall be kept as much as pssible ut f the lp f the ATC prcess f determining crrective actins (althugh nt emergency maneuvres). This is imprtant t avid their critique f the ATCO ptins r culd lead t missed messages due t heavy wrklad and a cnstant requirement fr head-dwn prcessing f infrmatin. The primary surce f infrmatin during surface mvements is visual bservatin. Hwever, autmated supprt may ffer benefits fr navigatin n cmplex airprt layuts, in degraded visibility cnditins (night, rain, lw visibility) r in case f high crew wrklad PROBLEMS AND RISKS False alerts. The EUROCONTROL A-SMGCS specificatin fr Level 2 recmmends a maximum false alert level f 3 per week (at level ALARM) fr runway cnflicts. Hwever, a different level f false alerts may need t be assessed fr hazardus situatins n taxiways due t the increased number f aircraft maneuvring simultaneusly n such area (cmpared t runways) and the fact that n separatin distance between aircraft is currently defined. As fr ATCOs, the rate f false alerts is a majr issue fr the acceptance f safety nets by flight crews. Ptentially higher integrity levels will be required fr n-bard applicatins cmpared t the A-SMGCS Level 2 alerting service (grund 10 EEC Technical/Scientific Reprt n

23 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL applicatin). This is because pilts d nt have the same level f situatin awareness as cntrllers. Segregatin f alerts. The pssibility f segregating grund and n-bard alerting functins with a different lk-ahead time is nt deemed feasible (there is n minimum separatin distance defined fr surface mvements and visual bservatin remains primary surce f infrmatin). This is a key difference cmpared t safety nets fr the airbrne phase (STCA and TCAS). On-bard safety nets. During the develpment f the prpsed n-bard safety nets, the issue f having nn-ambiguus and nn-cntradictry interpretatin f alerts prvided n ATCO side and mbile side needs t be further investigated. This includes: Detectin and alerting functins shuld be validated s that there are n cases where cntradictry infrmatin prvided t ATCOs, flight crews r vehicle drivers exist (e.g. hazard detected n ne side and n hazard detected n the ther side). The integrity f surveillance infrmatin available t aircraft frm multiple surces shuld be demnstrated (frm cperative r nn-cperative aircraft, vehicles, r using fr instance the traffic situatin picture prvided t ATCOs (A-SMGCS Level 1 system) ASSUMPTIONS Tw main assumptins related t rles and respnsibilities r the availability f ptential peratinal services within timeframe have been made: N changes t the current respective rles and respnsibilities f ATC cntrllers, flight crews and vehicle drivers fr airprt peratins are anticipated in the timeframe; and The prvisin f electrnic visin t flight crews (r vehicle drivers) is cvered by the Radmap but nt t the pint where the see and avid principle that prevails in Visibility Cnditins 1 and 2 is als applicable in Visibility Cnditins 3 (when flight crews cannt avid each ther using visual infrmatin). The assumptin with respect t the airprt technlgy is that: Develpment f airprt safety nets is based n A-SMGCS level 2. The assumptin with respect t airprt envirnment is that: The prpsed airprt safety nets prvide their rle under all visibility cnditins. The assumptin with respect t safety nets functinally is that: The detectin and alerting prcesses fr the key hazardus situatins cver the alerting f ATCOs (in all cases), flight crews (fr suitably equipped aircraft) and drivers (fr suitably equipped vehicles) abut a ptential hazard (i.e. situatin awareness) BUT NOT the prvisin f reslutin advisries. EEC Technical/Scientific Reprt n

24 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets The rle f n-bard surface mvement alerting functin(s) is assumed t increase the situatinal awareness f flight crews and vehicle drivers, prvided that the SAME situatinal awareness is presented t ATCOs. The recvery f the hazardus situatins is left t the ATCO, prvided that sufficient time is available t identify the required actin(s) and t instruct the flight crew/vehicle driver. Optin f recvery given t flight crew shuld be cnsidered nly fr emergency actins. Hwever, it is imprtant t nte that flight crew will take whatever actin they deem necessary fr the safe peratin f the aircraft and that this assumptin des nt verride their respnsibilities. 12 EEC Technical/Scientific Reprt n

25 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL 4. FRAMEWORK FOR DISCUSSION OF OPERATIONAL CONCEPTS This sectin presents the framewrk fr discussin f peratinal cncepts starting with the high level descriptin f peratinal scenaris fr airprt surface safety nets. This is fllwed by descriptin f actrs invlved, system functinality, and system architecture cnsideratins CATEGORISATION This sectin describes at a high level the general peratinal circumstances where it is expected that the airprt surface safety nets will play a rle in mitigating ptentially hazardus situatins. Identificatin f peratinal cncepts fr surface safety nets can be structured arund their definitin set ut in Sectin 1. Here they were defined as systems that prvide an autmated alert t either the flight crew, the air traffic cntrl fficer (ATCO), r the vehicle driver. It therefre naturally fllws that they shuld be cnsidered in terms f which actrs are alerted by their use; i.e. whether the safety net is aimed at: Flight crew and vehicle drivers (mbiles), ATCOs, and Bth mbiles and ATCOs. This same definitin ges nt describe the system functinality f a safety net as being ne that prvides an autmated alert t an actr f ptentially hazardus situatins. It is necessary t distinguish between different types (r categries ) f ptentially hazardus situatins fr which an autmated alert culd be prvided by a safety net system in rder t define a framewrk fr their discussin. This has been dne belw by defining three separate categries f situatins that are designed t be: Sufficiently brad s that between them they cver all majr types f ptentially hazardus situatins; Allw easy categrisatin f particular peratinal scenaris; and Prvide enugh granularity fr a strng cncept f hw they wuld perate t be defined. The three main categries are: Categry 1: Nn-cnfrmance t ATC instructins/prcedures In general, the causal factrs that create this categry f ptentially hazardus situatin are largely expected t be due t mbile peratr errr. This situatin is caused when traffic deviates frm its assigned 3D-trajectry (the tw dimensins n airprt surface and the assciated time dimensin); i.e. des nt adhere t the aprn/taxiway/runway ruting assigned t it. This categry includes situatins such as: Nn-cmpliance t the ATC clearances by flight crew and drivers in the prximity f active runways, e.g. aircraft/vehicle d nt stp at the runway hlding pint; Where a cmmunicatin misunderstanding ccurs between what is meant by the instructins f the ATCO and what is interpreted by the mbile peratr (e.g. as a EEC Technical/Scientific Reprt n

26 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets result f cmmunicatin break-dwn, thrugh say callsign/cnditinal clearances cnfusin, incrrect/missed read-backs, pr phraselgy, lack f R/T). This categry als cvers deviatins frm standards perating prcedures and practices by mbiles, such as aircraft taxiing with extreme taxi speed that can indicate fr example intentin t take-ff frm the taxiway. Categry 2: Cnflicting ATC clearances The causal factrs generating this categry f situatin will always reside with the ATCOs. This type f situatin is generated when ATC prvides mbiles with clearances that, if fllwed, wuld bring them int cnflict with ther mbiles. This categry includes situatins when: Cnflicting ATC clearances which culd result in a runway incursin, e.g. an aircraft is cleared t take ff and anther mbile is given a crssing clearance in frnt f the aircraft n the same runway; Aircraft fllw the clearances f ATC t find themselves facing each ther and unable t prceed withut assistance frm tugs. Fr example an aircraft may be instructed t push back frm a gate and in s ding prceeds t blcks a taxiway/aprn ruting until the ATCO gives further instructins. Categry 3: Infringement f restricted/clsed areas This categry refers t situatins when mbiles, whist cmplying with the clearances issued by ATC, are ruted thrugh restricted r clsed areas (which can be taxiways, runways r aprns). At the same time, these can refer t situatins where mbiles penetrate restricted r clsed areas withut authrisatin frm ATC. In these situatins mbiles are failing t cmply with airprt signage r published prcedures and this is likely t be as much f a cause f infringement as nt fllwing ATC instructin. Therefre ptentially hazardus situatins in this categry can be assigned bth t mbile r ATCO errr. Hwever, in general ptentially hazardus situatins in this categry are likely t be caused by ATCO errr i.e. aircraft cmplying with clearances that guide aircraft t an inaccessible area r blcked rute. This categry refers t fllwing situatins: It requires a ruting t be agreed between ATCO and flight crew and fr the flight crew nt t deviate frm it. Includes instances when the rute passes thrugh a restricted mvement area f the airprt surface r anther mbile (i.e. such that it is blcked). As such this categry includes thse safety nets that prvide prximity warnings t surrunding traffic. The abve three categries fr airprt safety nets are event driven ; the classificatin f a scenari as belnging t ne r the ther depends upn whether the ruting taken by the mbile at any given mment in time is that which the ATM system has planned fr it. A Categry 2 situatin will be created the instant that a cnflicting ATC clearance is issued by the ATCO and will persist even if a subsequent Categry 1 r 3 situatins is triggered. In situatins where bth Categry 1 and 3 events have ccurred, the scenari classificatin depends upn the rder f events. A situatin where a flight crew first deviates frm a cleared rute and then finds that this rute blcked wuld activate bth Categry 1 and Categry 3 (as the safety net is generated at the instant the aircraft mves ff rute and persists even when the Categry 3 situatin is generated). 14 EEC Technical/Scientific Reprt n

27 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL The cntrary situatin where flight crew finds his rute blcked (i.e. a Categry 1 situatin) but then prceeds t deviate frm his cleared rute is nt a credible peratinal scenari. This is because a flight crews peratinal prcedures d nt allw deliberate rute deviatin (e.g. taxing) withut first securing a prper clearance frm the ATCO. Therefre, fr example, if the taxiway is fund blcked the flight crew shuld call fr instructins. The classificatin applied t scenaris is illustrated belw in event trees. Ruting fllwed Nminal situatin (n safety net alert) Initial situatin: adherence t a clear rute Assigned ruting is clear Assigned ruting is blcked Deviatin Ruting fllwed Deviatin Categry 1 Categry 3 Nt credible (see abve) Clear rute Nminal situatin (n safety net alert) Rute fllwed Initial situatin: adherence t a clear rute Deviatin Blcked rute Clear rute Categry 3 Categry 1 Blcked rute Categry 1 and Categry 3 Figure 1: Event trees fr peratinal cncept categrisatin The nature f the alert (including any reslutin advisries prvided) will depend n the peratinal service and envirnment f the actr t which it is prvided. In ther wrds alert can be prvided t either the twer ATCO, the Mbile (either a flight crew r vehicle driver) r t bth parties. The table belw uses this discussin t islate nine independent peratinal cncepts, each f which will be investigated in turn. EEC Technical/Scientific Reprt n

28 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Categry Categry 1 Categry 2 Categry 3 Nn-cnfrmance t ATC instructins/prcedures Cnflicting ATC clearances Infringement f restricted/clsed areas Envirnment Mbile Mbile 1* Mbile 2* Mbile 3* Twer ATCO 1 ATCO 2 ATCO 3 Bth Bth 1 Bth 2 Bth 3 * = surface mbiles will be cnsidered alngside aircraft, with ntes added as apprpriate t accunt fr the differing handling, size characteristics, between them. Table 1: Categries f peratinal cncept identified 4.2. ACTORS Given that the main cncept ptins are defined arund the actrs invlved, it is useful t cnsider these actrs in a bit mre detail: ATCOs are respnsible fr ensuring the safe and expeditius flw f traffic n the airprt surface. As ATCOs with different rles and even frm different rganisatins can be respnsible fr different areas f the airprt, and cmmunicatins between these ATCOs can be an imprtant factr in bth cause and reslutin f a cnflict, the ATCO rle is brken dwn here int three further categries: Runway ATCOs, (knwn as the Twer service), wh are respnsible fr all mvements n the runway, i.e. landings and take-ffs but als crssing r taxiing as required. Typically, runway ATCOs will als be respnsible fr aircraft queuing fr departure at ne r mre runway entry pints. In sme cases, mbiles will be allwed nt a runway withut being n the runway ATCO frequency, but in such cases these mvements are expected t be clearly crdinated with the runway ATCO. Taxiway ATCOs, (knwn as the Grund ATCOs), respnsible fr all mvements n the taxiway system. (Optinally) Aprn managers, respnsible fr mvements n the aprns. Mre than ne ATCO f each rle can be active n an airprt at ne time, particularly where multiple runways exist. Similarly, different rles can be cmbined and perfrmed by a single persn. Flight crews, respnsible fr safely navigating the aircraft acrss the airprt surface accrding t established prcedures and the instructins and clearances prvided by air traffic cntrl. Vehicle drivers, wh similar t flight crews, are respnsible fr safely navigating their vehicles acrss the airprt surface accrding t established prcedures and the instructins and clearances prvided by ATC. 16 EEC Technical/Scientific Reprt n

29 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL 4.3. SYSTEM FUNCTIONALITY Nn-cnfrmance t ATC instructins and prcedures Mst surface safety nets tday wrk withut knwing intent in any way. They rely n shrt term vectr extraplatin and bundary infringement znes. Hwever in supprt f the peratinal cncept identified in Table 2 the surface safety net will require the fllwing infrmatin: The cleared ruting f the mbile(s) cncerned: Infrmatin abut this dynamic will mainly be cntained within the clearances issued by ATC t the mbiles n the airprt surface. As such it needs t be cnstantly updated in real time t reflect what the current cleared ruting fr the mbile is. Infrmatin needed will include: the start pint (e.g. runway exit); ruting (e.g. waypints and taxiways t be fllwed); the hld shrt f pints (hldbars) and stp bars; the final destinatin; and actins t take (e.g. line-up and hld, cmmence take-ff rll, stp at gate, park, seek clearance frm runway ATCO). The current lcatin f the mbile(s) cncerned: This will prvide the system with a picture f what mvements are currently taking place n the airprt surface in relatin t thse targets that present a risk t the system. The cleared ruting fr the mbiles can then be cmpared with their current lcatins/intentins t determine whether r nt a mbile is deviating frm its cleared rute (r if it intends t d s) Cnflicting ATC clearances This system safety net will require knwledge f what clearances have been issued by ATC and what the current lcatins f the mbiles n the airprt surface currently are. This will enable the system t determine what ruting has been assigned t each and every mbile t determine what cnflicts, if any, have been prduced by a given set f ATC clearances Infringement f restricted/clsed areas Fr this surface safety net t functin the fllwing infrmatin may need t be prvided t the system: The cleared ruting f the mbile(s) cncerned (as abve); The current lcatin f surface mbiles cncerned (as abve); The lcatin f restricted/clsed areas n the airprt surface: including areas cvered by restrictins and the perids when they are in frce (e.g. bundary infringement znes). EEC Technical/Scientific Reprt n

30 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets 4.4. SYSTEM ARCHITECTURE CONSIDERATIONS Surces f input and lcatin f safety net functin This subject is a cmbinatin f tw factrs that shuld be cnsidered interdependently t ne anther: the lcatin f the technical safety net functin itself, i.e. whether the safety net functin is part f the grund-based (ATC) system r f the nbard system; and the surce f infrmatin fr the safety net functin, i.e. hw the traffic infrmatin was gathered. The main characteristics f the surface safety net are therefre shwn in the fllwing figure (including the lcatin f the safety net, i.e. the utput). Input: traffic situatin Main functin: safety net Output: alert Figure 2: Simplified architecture Nte: utput will nly be generated if cnsidered necessary by the safety net functin Fr all three blcks presented in Figure 2, an ATC side and a mbile side ptin is available: Required infrmatin elements (these can include traffic infrmatin and pssibly ATCO clearances etc.) as input t the safety net functin. These can be gathered frm the ATC system as utput f the surveillance functin (e.g. via Traffic-Infrmatin-Service- Bradcast (TIS-B) functinality), r directly frm the mbiles n the airprt surface thrugh e.g. Autmatic Dependent Surveillance-Bradcast (ADS-B). The safety net functin can be part f the ATC system r f the nbard system f aircraft and/r vehicles. The utput f the safety net functin, as already indicated in Sectin 4.1, can be presented t ATCOs r t flight crews/vehicle drivers. Table 2 summarises the pssible utputs and examples f technlgical enablers. Twer (ATC side) Mbile (Aircraft/Vehicle side) Input Functin Output surveillance functin ADS-B (via TIS-B functinality) part f the grundbased ATC system nbard system f aircraft and vehicles ATCO flight crews/vehicle drivers Table 2: Summary f pssible ptins Hwever, nt all cmbinatins f input, functin and utput (i.e. having part f the chain n ne side and part n anther side ) are cnsidered realistic. As illustratin, an bvius example f an architecture that is nt cnsidered realistic is when input is received thrugh the ATC surveillance system and utput is presented t the ATCO, but the safety net functin 18 EEC Technical/Scientific Reprt n

31 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL is an nbard functin. This wuld lead t easily avidable equipage requirements, as well as unnecessary additinal data cmmunicatins. Therefre, with input frm and utput t the ATC side, nly a safety net as part f the ATC functin is cnsidered a realistic ptin. Lking at the different cmbinatins f surce f input data and presentatin f utput, the fllwing ptins are cnsidered credible (with the relevant ratinale): The situatin where input is prvided by the surveillance functin f the ATC system and utput is t the ATCO nly was discussed in the example abve. With this cmbinatin f input and utput, nly safety net as part f grund system are cnsidered t be realistic. The same argument can be applied fr gathering input n traffic situatin thrugh nbard systems and prviding utput t flight crew. In this instance nly safety net as part f nbard system is cnsidered realistic. If the input n traffic infrmatin is received thrugh nbard systems and the utput is presented t the ATCO, the safety net functin can in principle be part f the nbard system (in which case nly infrmatin n the alert itself is transmitted t the ATC system) r f the ATC system (in which case the aircraft transmits relevant data t the safety net functin, which then presents an alert t the ATCO if necessary). Hwever, in the latter case, the data transmitted by the nbard system shuld be related t infrmatin such as aircraft status, psitin, and such data is unlikely t be used directly by the ATC safety net functin. It is mre likely that such data will be received and prcessed by the ATC surveillance functin and then presented as input t the ATC safety net functin as part f the surveillance data input. This makes this ptin identical t the ptin discussed abve under the first bullet (safety net using surveillance functin input and presenting utput t ATCO) and therefre nly a safety net as part f the nbard system is cnsidered t be realistic fr this cmbinatin f input and utput. If traffic infrmatin is received thrugh the ATC system and utput is presented t flight crew, the safety net functin can be part f the nbard system r the ATC system. Hwever, flight crew alert in this case may be delayed. Bth ptins are cnsidered realistic. This leads t five ptins which are cnsidered realistic. These ptins will be cnsidered within the cntext f the cncepts described in Sectin 4. Additinal ptins culd be envisaged if the safety net alert if delivered t bth the ATCO and flight crew/vehicle driver (already suggested in Sectin 4.1 when aimed at bth flight crews/vehicle drivers and ATCOs was identified as ne f the main cncepts). Advantages and disadvantages f these ptins will als be discussed in Sectin 5 and Sectin 6. As a final cmment, it shuld be nted that the ptins f Sectin 4.1 are identified with the intentin t distinguish their peratinal characteristics and impact. The issues under discussin here shuld be seen in this cntext: at this stage the aim is nt t prvide significant detail n the technlgy and equipment required fr the inputs and utputs Types f utputs In terms f utputs, a number f alternatives may be cnsidered: Different levels f alert, depending n severity (e.g. cautin - yellw and warning red, as adpted in NUP II+); EEC Technical/Scientific Reprt n

32 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Identificatin f type f alert (e.g. runway incursin, deviatin); Identificatin f mbiles invlved; and Prvisin f reslutin advisry, traffic advisry (similar t TCAS), r actin t be taken. It shuld als be nted that utput t flight crew/vehicle driver des nt necessarily mean utput via an nbard system, e.g. airfield lighting gives a direct indicatin t a flight crew withut relying n equipage. The levels f alert raised t the ATCO, driver r flight crew by the safety net will depend n the mbile s psitin n the mvement area and the ruting/intent f the surrunding mbiles. It is envisaged that different alerts fr different situatins will be presented t the flight crew/driver r ATCO fllwing: Deviatin frm assigned rute r area penetratin; Runway mnitring and cnflict alert; and Runway incursin. These in turn can be mapped t the ICAO defined alerting system. The ICAO Eurpean Manual n Advanced Surface Mvement Guidance and Cntrl Systems (A-SMGCS) shrt term alerts were prvided in sectin Alerts are triggered dependent n scenari and are sensitive t varius factrs that include time t the cnflict, wnship peratin, mvement and psitin f the cnflict aircraft, available flight crew respnses, as well as the level f uncertainty. It is assumed that alerts are presented sequentially if mre than ne alert is prvided in a given scenari. The principles fr the presentatin f alerts including indicatin and altering principles - including when and hw these wuld be triggered are set ut in sectin 2.1 f [4]. 20 EEC Technical/Scientific Reprt n

33 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL 5. DESCRIPTION OF OPERATIONAL CONCEPTS 5.1. GENERAL Based n the framewrk develped in Chapter 3, this sectin develps detailed descriptins f the different types f peratinal cncept identified in sectin 4.1 (see Table 1). Mbile Twer All Operatinal Envirnment Operatinal Cncept Operatinal Envirnment Operatinal Cncept Operatinal Envirnment Operatinal Cncept Cckpit Cabin Mbile 1 Mbile 2 Mbile 3 Twer ATCO 1 ATCO 2 ATCO 3 Cckpit Cabin Twer All 1 All 2 All 3 Table 3: Categries f Operatinal Cncepts t be cnsidered In describing the peratinal cncept this sectin prvides a high level verview f the peratinal service and envirnment f the actrs invlved and examines the varius types f infrmatin available t them. The functinality f the system supprting the cncept will initially be discussed independent f the technlgy applied. Hwever the nature f the data prvided as inputs int the system (e.g. its quality, cmpleteness, level f detail) is highly dependant n the types f underpinning technlgy used t prvide it. Therefre, the peratinal cncept descriptin is extended t include a breakdwn f these technlgical enablers. NB: in the fllwing discussin and accmpanying descriptins all actrs are referred t as him fr ease f readability. EEC Technical/Scientific Reprt n

34 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets 5.2. MOBILE BASED Figure 3: The peratinal envirnment f mbiles - the flight crew's cckpit and driver's cab Operatinal cntext The peratinal service prvided by the flight crew r driver f a vehicle is the safe navigatin f his craft arund the airprt surface. The prvisin f safety net alerts are cnsidered t be the peratinal applicatin under cnsideratin. Imprtantly, mbile based surface safety nets are generally restricted in their scpe in nly prviding alerts relating t the safety f wnship nt the system as a whle. Flight crew and drivers when mving arund the airprt surface act n the instructins frm the aprn, grund r runway ATCO as apprpriate. This includes cmplying with any clearances r advisries issued t them by the ATCOs (see sectin 1.3 f [4]) Operatinal envirnment The cckpit/cab The flight crew gains situatinal awareness frm the peratinal envirnment; i.e. the instrumentatin panels in the cckpit and what visual clues he can glean frm a visual scan f the airprt surface. The crew principally seek infrmatin n: Lcatin, bth abslute and in relatin t the surrunding traffic; and What ruting he needs t be fllwed (generally taken frm signage n the airprt surface except in very lw visibility cnditins). Visual: The prevailing meterlgical cnditins will dictate what infrmatin can be gleaned by a visual check frm flight crews r drivers when mving arund the airprt surface. In high visibility cnditins they will be able t rientate themselves relative t ther mbiles and landmarks n the airprt surface. At night, surface lighting and illuminated signs are vital in this prcess. In sme situatins, situatinal awareness may be impaired by lw visibility, such that the likelihd f disrientatin r lss f awareness f ther traffic increases. In these cnditins drivers and flight crews becme mre reliant n thse bjects n the airprt surface that they can still see such taxiway markings, signage and lighting systems t prvide a visual cnfirmatin f their lcatin. In very lw visibility cnditins, when even 22 EEC Technical/Scientific Reprt n

35 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL these surface based visual cues can becme bscured, the flight crew r driver will becme mre dependent n in-cckpit r in-cab systems t determine his psitin, fr example heads-up displays. Audi: Cmmunicatins are received by mbile peratrs frm the ATCOs cntrlling the mvement f traffic arund the airprt surface. There will typically be mre than ne frequency fr ATC cmmunicatins. Mst airprts will have at least tw separate frequencies, ne fr grund and the ther fr the twer (r runway ) ATCO. In particularly cmplex peratinal envirnments areas f ATCO respnsibility will be further divided (with respnsibility fr the surface mvements n the varius taxiways delegated between ATCOs). It is therefre likely that the flight crew will nt be able t gain a full traffic picture by listening t a single frequency (althugh a reasnable situatinal awareness f the traffic perating in his immediate vicinity may be gleaned). Audi cmmunicatins are usually in the frm f requests fr and issuance f clearances and directins t varius hlding pints n the airprt surface (e.g. Taxi via Alfa and Brav t hlding pint RWY 27 ). Further hand-ver instructins i.e. fr the mbiles t cntact different radi frequencies are als prvided t the traffic as the mbiles mve frm ne area f respnsibility t anther. In lw visibility cnditins the flight crew may verbally reprt his psitin t the ATCO based upn infrmatin he gleans frm grund signage and lighting systems. Infrmatin abut the lcatin f restricted areas, such as thse f active runways and cnstructin sites that the flight crew r driver may encunter en-rute are generally cmmunicated as published traffic advisries rather than verbally. In-cckpit guidance - Heads dwn displays: These can include items such as airprt surface charts (in either paper-based r electrnic frms) and mving maps. Electrnic guidance systems in the aircraft cckpit are generally prvided thrugh Electrnic Flight Bags (EFBs) whereas GPS-based navigatin hand-held devices are used in the vehicles cabs. In bth cases, the display f the wnship psitin (via GPS) n the airprt surface (via an electrnic database) is the fundamental cmpnent f the guidance. Mre advanced systems may als display the psitin f surrunding traffic n the airprt surface relative t the wn ship psitin. The cmpleteness f this surveillance picture (i.e. % f traffic display) is dependent n the underpinning technlgy prviding it, and, as such, may nt be whlly accurate. Varius ther types f systems may attempt t supplement reality by using additinal data feeds frm sensrs attached t the aircraft (e.g. frward lking infrared [FLIR]). Text displays can als be used in particular t cnvey the messages bradcast by datalink t the flight crew. These may, fr instance, indicate the rute t be fllwed by a particular mbile. Heads up displays: These systems are currently nt widely deplyed n in-service cmmercial aircraft. Hwever in imprving the situatinal awareness f the mbile peratr n the airprt surface the develpment f such systems are seen as a vital step [1][2][3]. They may be used t cmmunicate the psitin f the aircraft and surrunding traffic n the airprt surface t the flight crew (augmenting reality) and advise f what steps the crew shuld take t reslve the any cnflicts encuntered. Aural alerts: shuld be intrduced in mbiles, flight crews and drivers will nt lk at the EFB/ Cckpit Display f Traffic Infrmatin (CDTI) at all the times. In vehicles audi alerts culd be cmbined with visual t vercme issues f nise generated frm the perating envirnment. EEC Technical/Scientific Reprt n

36 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Grund mvement phases: Vehicles Surface vehicles are typically cnfined t particular areas f the airprt surface, depending upn what rle they are required t perfrm. A particular grup f vehicles will be cncerned with the prcesses assciated with aircraft turn-arund. These will include, fr example, passenger shuttle transfer buses, refuelling trucks, catering vans and luggage trlleys. They will predminantly perate n the aprn area, adhering t limited rutings acrss it and will typically stay clse t the terminal buildings. Other vehicles will be required t ram further afield venturing ut nt the taxiway system and crssing airprt runways. Such vehicles may be engaged in bird scaring peratins, cllecting surface debris and de-icing peratins fr example. Twing vehicles may als be used t transprt aircraft t maintenance facilities. Grund mvement phases: Aircraft Aprn mvements: These areas f the airprt surface can be highly cngested; incidents cnnected t this area include wingtip cllisins, vehicle cllisins with parked aircraft, pushback cllisins (and entry int gate). Once pushed back frm the gate aircraft may nly mve in a frward directin unless they are under tw. Therefre, situatins where aircraft directly face each ther alng a single taxiway r cngested aprn can be reslved nly by twing. Taxiing: The size f mdern cmmercial air transprt aircraft means they carry with them significant mmentum when mving arund the airprt surface, and as such stpping may prve prblematic unless lw surface mvement speeds are used. These will generally be emplyed in areas f the taxiway system where multiple rutes intersect higher speeds may be used by aircraft when entering/exiting runways (t minimise their runway ccupancy time). Queues will tend t frm n the taxiway system arund the entry pints t runways. Take-ff rll: Multiple line ups may be used n the runway itself but nce an aircraft cmmences a take-ff r landing that runway shuld be vacated by all ther mbiles. Take-ff rll cvers the perid frm which an aircraft is lined up n the runway t the pint at which it lifts ff the airprt surface (i.e. the pint at which the aircraft reaches its rtatin speed, Vr, [velcity r ]: this is the speed at which the aircraft s nse wheel leaves the grund) (see [5] and [6]). Initial climb /Final Apprach: Mvements during this phase f flight may be cnsidered by runway incursin prtectin algrithms (i.e. triggering a warning when an aircraft has begun its climb away frm the surface r is yet t land and cnflicts with a mbile n the runway surface area). Landing rll: Perid f flight frm where the aircraft tuches dwn n the airprt surface until it exits the runway (its runway ccupancy n landing), either via a high r lw speed taxiway (see sectin 2.2 f [4] als references [5] and [6]). 24 EEC Technical/Scientific Reprt n

37 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL (Mbile 1) Nn-cnfrmance t ATC instructins and prcedures General descriptin and inputs The system warns the mbile when it has departed frm the rute assigned t it by the ATM system. This ruting will typically be specified by the instructins and clearances prvided by the ATCO. In additin, this ptin cvers nncnfrmance t prcedures. Input: The deviatin f a mbile frm a rute assigned t it by the ATM system includes situatins when the: Mbile mves withut receiving the apprpriate clearance; and Mbile navigates ff rute in errr. In additin, this ptin includes the deviatin f a mbile frm standard perating prcedures (e.g. excessive taxi speed). The detectin f deviatin frm clearances/prcedures will require the fllwing inputs t the system: The cleared ruting f the mbile; and The current lcatin f the mbile. Generic system architecture This sub-sectin prvides a generic, high-level and technlgy independent descriptin and diagram f a system architecture that culd supprt this cncept f peratin. The same template fr the system architecture is used in all the descriptins f all the peratinal cncepts thrughut this dcument t shw where the differences between them lie. The diagram specifies what infrmatin is cmmunicated, its surce (i.e. the entity n the airprt surface t which it relates) and final destinatin. This generic descriptin is then develped further in the next sub-sectin by specifying what systems, currently either in use r develpment tday, culd be used t enable the peratin f the cncept. The safety net functin in the mbile wrks by cmparing the cleared ruting as issued by ATC (either by vice r datalink cmmunicatin) t the current lcatin f the surface mbile (as determined by n-bard systems e.g. GPS r Inertial Navigatin System (INS)). The cmparisn perfrmed by the system between these tw infrmatin items is shwn in the diagram belw by the dashed blue bx that surrunds bth f them. N ther infrmatin elements (white bxes) r entities n the airprt surface (grey bxes), ther then the twer (which prvides ruting infrmatin t the mbile) and the mbile cncerned (Mbile 1 in this case, which determines its wn lcatin) are invlved. EEC Technical/Scientific Reprt n

38 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Figure 4: Functinal architecture, Mbile 1 The safety net which wuld detect the deviatin f a mbile frm standard perating prcedures (e.g. excessive taxi speed) requires the set f rules defining perating prcedures (e.g. nminal taxi speed n specific taxiway) t perate. Benefits General benefits in Sectin 3.4 apply t this cncept. Mre precisely, the benefit is reduced risk (thrugh apprpriate and timely mitigatin) and increased efficiency n the airprt surface. Rapid respnse. The main benefit f this peratinal cncept wuld be the rapid respnse f the actrs directly invlved. Presenting an alert directly t the flight crew is likely t lead t the quickest reactin t the hazardus situatin, as the flight crew/vehicle driver is the actr wh has t implement the required actin. Technlgical enablers This sub-sectin specifies what systems, currently either in use r develpment tday, culd be used t enable the peratin f the Mbile 1 cncept. Infrmatin required includes: The cleared ruting f the mbile via: Radi cmmunicatin clearances (e.g. vice recgnitin technlgy, flight crew input f clearances int electrnic flight management system); and Data-link TAXI (D-TAXI; pssibly a Cntract based ATm System - CAATS). The current lcatin f the mbile via: Inertial Navigatin System (INS); 26 EEC Technical/Scientific Reprt n

39 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Glbal Psitining System (GPS)/Glbal Navigatin Satellite System (GNSS)/Satellite Based Augmentatin System (SBAS)/Grund Based Augmentatin System (GBAS), with a mving map n bard; TIS-B transmissin frm Surface Mvement Radar (SMR) and/r multilateratin systems (MLAT). Cnstraints and limitatins It can be assumed that human factr issues typical f such systems will cntinue t exist (e.g. wrng data input). Befre the system becmes peratinal, safety cases shuld identify a range f ptential hazards and ways in which they can be mitigated. Several cnstraints and limitatins are identified within this cncept: Lcal view nly. Flight crew nly has a lcal verview f the situatin, meaning there is n guarantee that they will fllw a curse f actin that is the verall best slutin t the hazardus situatin. Althugh the main aim is t safely reslve the hazardus situatin, even if this is nt thrugh the verall best slutin, there is a minr risk that the flight crew s chice may lead t a new hazardus situatin, e.g. the aircraft might divert frm its curse t avid a hazardus situatin and mve int the path f anther mbile. Equipage requirement. Presentatin t flight crew/vehicle drivers puts requirements n aircraft/vehicle equipage. The visibility n the airprt surface will impact the ability f the mbile peratrs t see any warning issued t them frm the surface lighting system. Assumptins General assumptins in Sectin 3.4 apply t this cncept. Prblems and risks identified Cnsistency f alerts presented t different actrs. As there are ptentially several flight crews and vehicle drivers active n the airprt mvement area at any ne time during peratinal hurs, alerts may be presented in mre than ne mbile. If a cnflict invlves mre than ne mbile, several situatins may ccur: All flight crews and drivers are alerted by a cnsistent alert. Althugh this is likely t be the desirable situatin, there is still a small chance that they will take cnflicting actins. Alerts prvided t flight crews and drivers invlved are nt cnsistent. Befre cnsequences f this situatin are cnsidered in mre detail, further study int the level f incnsistency may be necessary: alerts are unlikely t present cmpletely different pictures f the situatin. Alert is nt presented t all flight crews and drivers invlved. This situatin can have several cnsequences: n the ne hand, at least ne f the mbiles invlved will nt be alerted t a particular situatin and therefre is unlikely t react t reslve the hazardus situatin, n the ther hand the likelihd f mbiles taking cntradicting actin is lwer. Althugh the frmer f these tw pints is likely t be mre significant, further study will be required t determine the exact impact f this situatin EEC Technical/Scientific Reprt n

40 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets In relatin t this pint, the practical implementatin f this cncept may be cnsidered: One ptin is t present the alert thrugh lighting systems n the airprt surface. This has the benefit f all mbiles invlved receiving a cnsistent alert, there is n need fr any nbard equipage, but the reliance n equipment n the airprt surface may limit the number f areas cvered by the system. The amunt f infrmatin that can be prvided will als be limited. The ther ptin is t present the alert in the cckpit r vehicle cab. In this case, the risk f incnsistency exists, there is a dependency n equipage, but n the ther hand the area and types f cnflicts that can be cvered will be much higher, and depending n level f sphisticatin f the implementatin, additinal infrmatin can be presented t help safely reslve the situatin. On-bard alerting systems. Very high integrity required by pilts, cnsequence f false alerts (abrted take-ff, missed apprach) is a majr cncern. Integratin. Integratin f A-SMGCS and AGL will impse significant csts in terms f: the cst f technical interface with A-SMGCS t prvide alerts; the cst f develping/revising peratinal prcedures; and the cst f training fr cntrllers/flight crew/vehicle drivers (Mbile 2) Cnflicting ATC clearances An ptin f airprt a safety net which warns the mbile, when a clearance by ATC addressed t it cnflicts with anther clearance previusly issued t anther surface mbile, is nt realistic. This was decided in the stakehlder wrkshp which discussed the peratinal cncept, requirements and typical peratinal scenaris fr airprt surface safety nets (Mbile 3) Infringement f restricted/clsed areas General descriptin and inputs The system warns the mbile peratr that either a cleared rute r a current psitin is nt safe (e.g. because the rute travels thrugh a restricted part f the surface). It is imprtant t pint ut that this ptin is mre pertinent t vehicles than aircraft. Input: A restrictin n the surface prevents the cleared rute frm being fllwed. This includes situatins where the mbile: Enters int a restricted area, Cmes int cnflict with anther mbile thrugh: The presence f anther mbile, r The cnflicting intent f anther mbile. 28 EEC Technical/Scientific Reprt n

41 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL The detectin f infringement will require the fllwing inputs t the system: The cleared ruting f mbile(s) cncerned; The current lcatin and/r intent f mbile(s) cncerned; The current lcatin and/r intent f surrunding surface traffic; and The lcatin f inaccessible areas n airprt surface. Generic system architecture The safety net wuld wrk by either: Cmparing the current lcatin and shrt term intent f the mbile t: the lcatin f restricted areas; and/r the surrunding traffic psitin. Cmparing the cleared ruting t the lcatin f restricted areas (NB: it is thught t be an impractical prpsitin fr a safety net t be based n a cmparisn between a cleared ruting f a mbile and the current surrunding traffic psitin because the latter quantity is highly dynamic). The cmparisns between these different infrmatin surces are shwn diagrammatically by the blue dashed bxes surrunding sme f the infrmatin elements in Figure 5 belw. As in the previus functinal architecture diagram (Figure 4) nly infrmatin abut the mbile s cleared ruting is prvided by the twer t the n-bard safety net system. Infrmatin abut the restricted areas n the airprt surface and the lcatin/shrt intent f surrunding traffic is als cmmunicated t the mbile cncerned. It shuld be re-emphasised at this pint that the generic functinal architecture nly specifies what the infrmatin relates t (its surce ) and what the final destinatin f that piece f infrmatin is. Hw it is cmmunicated thrugh the system is nt specified. Therefre, fr example: Infrmatin abut the lcatin/shrt intent f the surrunding traffic may be gleaned by SMR radar returns which upn being transmitted t the ATC system in the twer are relayed via datalink back ut t safety net systems in the mbiles mving n the airprt surface. Similarly infrmatin abut restricted areas n the airprt surface may well riginate frm the twer (infrmatin n the area and duratin cvered by the restrictin culd be held in an ATC database, fr example). Hwever it culd als be cnceived that this infrmatin might be prvided by a transmitter placed n the airprt surface that directly bradcasts this infrmatin t all traffic. EEC Technical/Scientific Reprt n

42 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Figure 5: Functinal architecture, Mbile 3 Benefits See sectin Technlgical Enablers This sub-sectin specifies what systems, currently either in use r develpment tday, culd be used t enable the peratin f the Mbile 3 cncept. In additin t the infrmatin elements required fr the Mbile 1 cncept current lcatin f surrunding traffic and the lcatin f inaccessible areas n the airprt surface are required. The current lcatin f surrunding surface traffic: TIS-B uplink feed frm grund surveillance systems (e.g. SMR r MLAT systems): SMR will detect all mbiles regardless f transpnder equipage as radar is based n primary returns frm aircraft (i.e. reflectins frm the aircraft s skin), and MLAT tracking f transpnder equipped aircraft and vehicles n airprt surface. ADS-B enables mbiles equipped with ADS-B t be detected and identified by all parties capable f receiving them. Standards fr Airbrne Traffic Situatinal Awareness n the airprt surface (ATSA- SURF) via a CDTI using ADS-B are currently under develpment [4]. The lcatin f inaccessible areas n the airprt surface: Database system blcking ut areas f the airprt surface; Transpnder returns (f vehicles perating in restricted area, e.g. cnstructin vehicles); and D-ATIS data linked infrmatin abut inaccessible areas n the airprt surface (textural advisry). 30 EEC Technical/Scientific Reprt n

43 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Cnstraints and limitatins See sectin and: Exclusin criteria. The system needs t exclude all maintenance vehicles (e.g. wrking n the clsed runway) frm the cnstant Levels 1 and 2 alerts. Assumptins General assumptins in Sectin 3.4 apply t this cncept. Prblems and risks identified In additin t sectin : Impact f flight crew r ATCO errr. Independent f whether the alert is the result f a mbile r ATCO errr, the effect f presenting an alert t a mbile will depend n the ability f the flight crew/vehicle driver t recgnise the details f the errr. If it is clear that, fr example, the aircraft under their cntrl is abut t enter a restricted area r cme int cnflict with anther mbile, the flight crew will be well placed t address the situatin. If it is nt clear what the prblem is, it may be mre difficult. Operatinal issues: Rate f false/nuisance alerts: due t incrrect detectin f aircraft mvements (turns), and Determining the threshld between the triggering f Level 1 and Level 2 alarm TOWER BASED Figure 6: The peratinal envirnment f twers the ATCO wrking psitin EEC Technical/Scientific Reprt n

44 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Operatinal cntext The cntrllers maintain a cntinuus watch n all flight peratins n and in the vicinity f an aerdrme as well as vehicles and persnnel n the maneuvring area. This is carried ut thrugh visual bservatin, augmented as necessary by a suitable surveillance system. The twer ATCO is respnsible fr peratins n the runway and aircraft flying within the area f respnsibility f the aerdrme cntrl twer. The grund ATCO is respnsible fr traffic n the maneuvring area with the exceptin f runways [7]. Cnsequently, ATCO based surface safety nets are system wide alerts i.e. they include all airprt traffic perating n the airprt surface (hwever they may be limited t given critical areas f the airprt surface r t areas f respnsibility). In respnding t an alert frm an airprt surface safety net the ATCO is required t: Detect the alert (by aural and displayed alert, regardless f visibility); Identify situatin cncerned and mbiles invlved (including their identificatin/call sign); Reslve cnflicts; and Implement f the reslutin thrugh the prvisin f necessary instructins t the actrs invlved (nte: the ATCO taking n actin may be a valid reslutin) Operatinal envirnment The Twer Visual: The mst imprtant aspect f the envirnment used by ATC t cntrl traffic n the airprt surface is still direct visual cntact. Hwever, cnsidering the scale f sme mdern airprts, even the direct view f the maneuvring area can have shrtcmings, e.g. due t distance r airprt cnstructins bscuring part f the relevant area. A very imprtant aspect f visual cncept is the visibility cnditin at the airprt, i.e. meterlgical cnditins can severely reduce the ability t directly bserve the airprt surface. In sme cases, there may be cameras at remte lcatins n the airfield t help with this (e.g. at runway ends). Virtual twer (heads up) displays may als help t prvide additinal situatinal awareness t the ATCO [15]. Any safety net must wrk the same way regardless f visibility. The mdern way f cntrlling grund traffic is t have a radar display where yu can cncentrate n all yur traffic at the same time and nt lking ut s much in different directins. Lking ut f the windw is mre fr twer ATCOs. Grund lighting (taxiway-sectins, directins and intensity) shuld be displayed in twer (n a special screen r integrated n the traffic display screen). Heads dwn displays: In additin t visual bservatin, the traffic situatin will typically be presented n the traffic display f the ATCO wrking psitin, using data frm the airprt s surveillance system as input. Different technlgies are available fr the surveillance system, and each technlgy can have different characteristics in terms f available data (e.g. mbile psitin, identificatin) and data quality (e.g. accuracy and integrity f the psitin reprt). Flight prgress bard with electrnic strips are tday very cmmn and culd have simple safety net functinality. The electrnic strips culd als reflect the traffic display and vice versa, i.e. 32 EEC Technical/Scientific Reprt n

45 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL input n an electrnic strip will trigger the same infrmatin n the label and label input will update electrnic strip. HMI Alert types: Audi, Visual, Audi and Visual, reslutin advisries. NUP II+ simulatins have shwn that aural alert must be implemented t alert the ATCO. Many situatins ccur in lw traffic when ATCOs are less active/bservant than under nrmal situatins. Other displays and future develpments: ATC will als have additinal infrmatin available n individual flights, in particular the high level intent f mvements (e.g. which parking stand r departure runway an aircraft is mving twards) and which clearances have been issued. The level f sphisticatin f the technlgy behind such infrmatin may vary, in particular in terms f hw far systems are autmated and integrated this may include aspects f System Wide Infrmatin Management (SWIM). Grund mvement phases Aprn mvements: Aprn ATCOs are respnsible fr navigating aircraft frm the departure gate ut t the taxiway system whilst safety negtiating ther surrunding mbiles. Taxiing: Grund ATCOs crdinate mvements acrss the taxiways. They principally issue rutings t aircraft taxing ut r returning frm the runway hwever his area f respnsibility als cvers the crdinatin f mbiles transiting acrss taxiways (including surface vehicles and aircraft). Nte: the grund ATCO may als be respnsible fr aprn mvements depending n the cmplexity and density f the traffic flw acrss the airprt surface. Final Apprach/Landing Take-ff Initial climb: The runway ATCO is respnsible fr issuing landing, line-up and hld and take-ff clearances. They are als respnsible fr issuing runway crssing clearances. These may be crdinated by the traffic cntacting the ATCO directly n a different frequency than the grund ATCO r by the ATCOs crdinating runway crssings in the twer (see sectins 1.3 and 2.2 [4], [6], [7], [8] and [9]) (ATCO 1) Nn-cnfrmance t ATC instructins and prcedures General descriptin and inputs The system warns the ATCO that a mbile is deviating frm the ruting issued t it by the ATM system (generally specified by the ATCO s instructins) by detecting when a mbile has departed frm the rute assigned t it. In additin, system warns ATCO that a mbile is in nn-cnfrmance t perating prcedures. The standard prcedures used by ATCOs when mving traffic arund surface (specified by the lcal peratins manual) will dictate what clearances are issued and at what time. Inputs: The deviatin f a mbile frm a rute assigned t them by the ATCO includes situatins when the: Mbile mves withut receiving the apprpriate clearance; and Mbile navigates ff rute in errr. EEC Technical/Scientific Reprt n

46 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets In additin, this ptin includes the deviatin f a mbile frm standard perating prcedures (e.g. excessive taxi speed). The detectin f deviatin frm clearances/prcedures will require the fllwing inputs t the system: The cleared ruting issued by the ATCO; and Current psitin f surface mbiles (i.e. surveillance data f airprt surface traffic) with which clearances can be crrelated. The alert will be presented either t a single actr with a glbal verview r pssibly many ATCOs if the scpe f the safety net cvers multiple areas f respnsibility. Areas n the airprt surface that transcend multiple areas f ATCO respnsibility include, fr example, the interface between the runways and surrunding taxiways. This cncept will be achieved by cmparing the ruting issued by the ATCO (r ATM system) with the cleared ruting as reprted back by the mbile (verificatin f what was cmmunicated). Generic System architecture The safety net functin wrks by cmparing the cleared ruting as issued by ATC t the flight crew (either by vice r datalink cmmunicatin) t the current lcatin f the mbile. This requires the ATCO t input the cleared rute int a twer based safety net system (a prcess which culd be facilitated via an autmatic vice recgnitin system fr example). The current psitin f the surface traffic must be prvided t the safety net as well. This infrmatin culd, fr example, be gathered frm SMR returns r via MLAT surveillance. The safety net functin is shwn in the diagram belw by the dashed blue bx surrunding bth f these infrmatin elements in the twer. Figure 7: Functinal architecture (ATCO 1) 34 EEC Technical/Scientific Reprt n

47 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Benefits General benefits in Sectin 3.4 apply t this cncept (i.e. the benefit is reduced risk and increased efficiency n the airprt surface). Glbal verview. Presenting the alert t smene with a glbal verview, wh can therefre als decide n a glbally ptimal slutin, i.e. there is limited r n risk f actins being taken that lead t new hazardus situatins. Cnsistency f alerts presented t single actr. Cnsistency f alerting is nt expected t be a very large prblem if the alert is presented t the ATCO. Technlgical Enablers This sub-sectin specifies what systems, currently either in use r develpment tday, culd be used t enable the peratin f the ATCO 1 cncept. The ruting issued by: ATCO tls (displaying suggested rute fr mbile n airprt surface t the ATCO). These can be based n either surface mvement ptimisatin algrithms r ATCO inputs (e.g. the use f Electrnic Flight Strips - EFS). The cleared ruting f the mbile(s) cncerned: Radi cmmunicatin clearances read back (e.g. vice recgnitin technlgy, flight crew input int electrnic flight management system); and D-TAXI. The current lcatin f surface mbile(s) cncerned: Fused r single surce surveillance feed frm: SMR that will detect all mbiles regardless f transpnder equipage as radar is based n primary returns frm aircraft (i.e. reflectins frm the aircraft s skin), and/r MLAT systems that is tracking f transpnder equipped aircraft and vehicles n airprt surface. GPS/GNSS/SBAS/GBAS and ADS-B; Radi cmmunicatin clearances (e.g. vice recgnitin technlgy, flight crew input int electrnic flight management system). Cnstraints and limitatins ATCOs wrklad. Intrductin f this cncept may require f ATCO sme additinal cmmunicatin since they will be required t prvide reslutin advisries t the flight crews/vehicle drivers invlved. Hence, this may ptentially impact ATCOs wrklad. Assumptins General assumptins in Sectin 3.4 apply t this cncept. In additin, with regards t EFS system, the fllwing set f preliminary assumptins applies: EEC Technical/Scientific Reprt n

48 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets All cntrller instructins/clearances are imputed in the EFS system. Otherwise the prpsed slutin (independent frm thers) will be futile; and There are established peratinal prcedures fr input f taxiway clearances int EFS. Prblems and risks identified Cnflict invlving mre than ne ATCO. There is a need t further investigate an issue when the hazardus situatin invlves mbiles under the respnsibility f different ATCOs (hwever, this may be cnsidered as minr issue). Need fr additinal cmmunicatin. Presenting an alert t a cntrller means that the system des nt directly warn the mbiles invlved. This means that there is a need t cmmunicate required reslutin advisries t the actrs capable f perfrming actins befre the safety net can take effect. This culd ptentially be a relatively time cnsuming prcess that will delay any actin being taken t reslve situatin and culd therefre make it mre critical. Additinal step required fr ATCO cmmunicating any actins t the flight crews/vehicle drivers invlved, may impact ATCOs wrklad. Impact f ATCO errr. It is difficult t say at a generic level what the effect f presenting t an ATCO will be if the alert is caused by an ATCO errr. The ATCO may immediately recgnise the errr and crrect it, he might als have difficulty identifying the prblem as all mbiles are likely t behave as expected. Integratin. Integratin f A-SMGCS and EFS will impse significant csts in terms f: the cst f installatin f vehicle transpnders; the cst f technical interface with A-SMGCS t prvide the ATC clearances; the cst f develping/revising peratinal prcedures; and the cst f training fr cntrllers. Impact f flight crew/vehicle driver errr. If the alert is caused by a mbile errr, the ATCO shuld be well placed t reslve the situatin, as the errr shuld be recgnisable as a deviatin frm the expected traffic situatin, the ATCO s mental picture. Hwever, in rder fr ATCO t take necessary actin timeliness f the alert is essential (ATCO 2) Cnflicting ATC clearances General descriptin and inputs The system warns the ATCO that tw r mre mbiles have been prvided with cnflicting clearances. The system detects a) what clearances have been given and b) whether they cnflict r nt. Parameters fr triggering the safety net alerting functinality will depend n the lcal envirnment i.e. the layut f taxiways. The safety net will need t be capable f determining what rute the mbiles will take t meet the clearances issued. Inputs: The detectin f cnflicting ATC clearances will require the fllwing inputs t the system: 36 EEC Technical/Scientific Reprt n

49 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Clearances issued by ATCO t all traffic; and Current psitin f surface mbiles (i.e. surveillance data f airprt surface traffic) with which clearances can be crrelated. The alert will be presented either t a single actr with a glbal verview r pssibly many ATCOs if the scpe f the safety net cvers multiple areas f respnsibility. Generic system architecture The safety net functin wrks by crrelating the current psitin f the surface mbiles, determining their cleared ruting (as issued by ATC), cmparing all f them t ne anther and highlighting cnflicts. This requires the ATCO t input the cleared rute int a twer based safety net system (a prcess which culd be facilitated via an autmatic vice recgnitin system fr example). The current psitin f the surface traffic t be must als be prvided t the safety net. This infrmatin culd, fr example, be gathered frm surface mvement radar returns r via MLAT surveillance. The safety net functin is shwn in the diagram belw by the dashed blue bx surrunding bth f these infrmatin elements in the twer. Figure 8: Functinal architecture (ATCO 2) NB: this has the same architecture as the ATCO 1 peratinal cncept, hwever in this cncept the safety net system cmpares ATC clearances with ne anther (t check fr cnflicts). By cntrast the cmparisn perfrmed by the safety net in the ATCO 1 peratinal cncept is ne between current lcatin f the aircraft and the ruting that it has been cleared t fllw. Benefits See sectin EEC Technical/Scientific Reprt n

50 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Technlgical enablers See sectin Cnstraints and limitatins See sectin Assumptins See sectin Prblems and risks identified See sectin (ATCO 3) Infringement f restricted/clsed areas General descriptin and inputs The system warns ATCO that either a current psitin r a shrt intent f a mbile is nt safe (e.g. because anther mbile blcks it, r because the rute travels thrugh a restricted part f the surface). Input: A restrictin n the surface prevents the cleared rute frm being fllwed. This includes situatins where the mbile: Enters int a restricted area, Cmes int cnflict with anther mbile thrugh: The presence f anther mbile, r The cnflicting intent r ruting f anther mbile. The detectin f infringement will require the fllwing inputs t the system: The cleared ruting f mbile(s) cncerned; The current lcatin and/r intent f mbile(s) cncerned; The current lcatin and/r intent f surrunding surface traffic; and The lcatin f inaccessible areas n airprt surface. Generic system architecture The safety net wuld wrk by either: Cmparing the current lcatin and shrt term intent f the mbile t the lcatin f restricted areas; Cmparing the cleared ruting t the lcatin f restricted areas; and 38 EEC Technical/Scientific Reprt n

51 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Cmparing the current lcatin and shrt term intent f all traffic (t determine whether any mbile is in cnflict with anther). These cmparisns are shwn by the blue dashed bxes in the functinal architecture diagram belw. As with the previusly described peratinal cncept (ATCO 1) the current lcatin/shrt intent f the mbiles n the airprt surface culd be prvided by central ATC surveillance systems (e.g. SMR r MLAT). Similarly the ruting issued by the ATCO culd be determined using vice recgnitin technlgy. Infrmatin n restricted areas might, as mentined in the Mbile 1 peratinal cncept, be held within an ATC database r bradcast frm a transmitter situated n the restricted area itself. Benefits See sectin Technlgical enablers Figure 9: Functinal architecture (ATCO 3) This sub-sectin specifies what systems, currently either in use r develpment tday, culd be used t enable the peratin f the ATCO 3 cncept. In additin t the infrmatin elements required fr the ATCO 1 cncept, current lcatin f surrunding traffic and the lcatin f inaccessible areas n the airprt surface are required. The cleared ruting f the mbile(s) cncerned: See sectin The current lcatin and/r intent f surface mbile(s) cncerned: See sectin EEC Technical/Scientific Reprt n

52 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets The current lcatin and/r intent f surrunding surface traffic: See sectin under the current lcatin and/r intent f surface mbiles cncerned. The lcatin f inaccessible areas n the airprt surface: Database system blcking ut areas f the airprt surface n the SMR HMI; SMR/transpnder returns (f vehicles perating in restricted area, e.g. cnstructin vehicles). Cnstraints and limitatins See sectin and: Exclusin criteria. The system needs t exclude all maintenance vehicles (e.g. wrking n the clsed runway) frm the cnstant Levels 1 and 2 alerts. Assumptins See sectin Prblems and risks identified See sectin and: Operatinal issues: Rate f false/nuisance alerts due t incrrect detectin f aircraft mvements (turns), and Determining the threshld between the triggering f Level 1 and Level 2 alarm BOTH ENVIRONMENTS (TOWER AND MOBILE) General This sectin describes the peratinal cncept fr a single and harmnised safety net functinality that prvides utputs t multiple actrs. This is distinct frm but similar t a situatin where multiple individual safety net cncepts perated tgether in parallel (Bth 1) Nn-cnfrmance t ATC instructins and prcedures General descriptin and inputs The system warns the ATCO, the deviating mbile itself and the surrunding mbiles that a mbile is deviating frm the ruting issued t it by the ATM system (generally specified by the ATCO s instructins) by detecting when a mbile has departed frm the rute assigned t it. In additin, this ptin cvers nn-cnfrmance t prcedures. 40 EEC Technical/Scientific Reprt n

53 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Inputs: The deviatin f a mbile frm a rute assigned t him by the ATCO includes situatins when the: Mbile mves withut receiving the apprpriate clearance; and Mbile navigates ff rute in errr. In additin, this ptin includes the deviatin f a mbile frm standard perating prcedures (e.g. excessive taxi speed). The detectin f deviatin frm clearances/prcedures will require the fllwing inputs t the system: The cleared ruting issued by the ATCO; and Current psitin f surface mbiles (i.e. surveillance data f airprt surface traffic) with which clearances can be crrelated. Generic system architecture The system architecture (inputs, infrmatin flw and infrmatin cmparisns) fr this cncept is an amalgamatin f the system architecture frm the Mbile 1 and ATCO 1 peratinal cncepts. The tw sets f infrmatin flws will need t be cnsistent with ne anther t ensure that all actrs receive timely, relevant and reliable alerts that they can be sure have been drawn frm a cmmn situatinal awareness picture. Benefits Figure 10: Functinal architecture (Bth 1) Distributin f rles and respnsibilities. This ptin aims t use the advantages f bth previus ptins, whilst addressing and mitigating the disadvantages. EEC Technical/Scientific Reprt n

54 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Impact f flight crew r ATCO errr. This cncept ensures each actr remains in the lp in terms f situatinal awareness. This mitigates the risk f a single actr making an undetected errr. Technlgical enablers Currently, a surface lighting mvement guidance system presents alerts t flight crew, vehicle drivers and cntrllers. The visibility n the airprt surface will impact the ability f the mbile peratrs t see the warning issued t them frm the surface lighting system. The ATCO will be alerted by the lighting cntrl panel in the twer shwing what lighting sequences have been triggered by a safety net functinality. These systems can be cnfigured t prvide guidance alng a cleared rute. This sub-sectin specifies what systems, currently either in use r develpment tday, culd be used t enable the peratin f the Bth 1 cncept. The cleared ruting f all surface mbile(s): Radi cmmunicatin clearances (e.g. vice recgnitin technlgy, flight crew input int EFMS); D-TAXI (pssibly a CAATS system); ATCO tls (displaying suggested rute fr mbile n airprt surface t the ATCO based n either surface mvement ptimisatin algrithms r ATCO inputs e.g. the use f EFS). The current lcatin all surface mbile(s): Fused r single surce surveillance feed e.g. frm: SMR that will detect all mbiles regardless f transpnder equipage as radar is based n primary returns frm aircraft (i.e. reflectins frm the aircraft s skin), and/r MLAT systems that are tracking f transpnder equipped aircraft and vehicles n airprt surface. GPS/GNSS/SBAS/GBAS and ADS-B; INS; ADS-B that enables mbiles equipped with ADS-B squirting transpnders t be detected and identified by all parties capable f receiving them. Airbrne Separatin Assistance System (ASAS) n the airprt surface (delegatin f separatin respnsibility frm ATCO t flight crew) data linked t twer and cleared t perfrm such delegated maneuvres. Cnstraints and limitatins The visibility n the airprt surface will impact the ability f the mbile peratrs t see the warning issued t them frm the surface lighting system. Assumptins General assumptins in Sectin 3.4 apply t this cncept. 42 EEC Technical/Scientific Reprt n

55 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Prblems and risks identified Distributin f rles and respnsibilities. Clear prcedures and rles and respnsibilities are required, as the issues relating t verview f the situatin and early reactin seem t cntradict. The ATCO has the glbal verview f the situatin and will be best placed t define the reslutin t a hazardus situatin. At the same time, the flight crew r mbile peratr is required t implement a reslutin. This leads t a dilemma: If the flight crew r mbile peratr takes actin immediately after receiving an alert, the added benefit f presenting the alert t the ATCO with the glbal verview is lst. If, after receiving an alert, the flight crew r mbile peratr have t wait fr instructins frm the ATCO, the added benefit f presenting the alert t the flight crew wh can take early actin is lst. Operatinal cnstraints: the use f electrnic strips shall be systematic and the cntent f strips shall be un-ambiguusly interpreted by the autmated system (all clearances fr aircraft in r at the prximity f active runways) [13]. Integratin f A-SMGCS and AGL. Integratin f A-SMGCS and AGL will impse significant csts in terms f: the cst f technical interface with A-SMGCS t prvide alerts; the cst f develping/revising peratinal prcedures; and the cst f training fr cntrllers/flight crew/vehicle drivers. Integratin f A-SMGCS and EFS. Integratin f A-SMGCS and EFS will impse significant csts in terms f: the cst f installatin f vehicle transpnders; the cst f technical interface with A-SMGCS t prvide the ATC clearances; the cst f develping/revising peratinal prcedures; and the cst f training fr cntrllers (Bth 2) Cnflicting ATC clearances General descriptin and inputs The system warns the ATCO and the threatened mbiles (i.e. thse in a ptentially hazardus situatin ) that mbiles will cme int cnflict if they fllw the clearances given t them by ATC. Inputs: The detectin f cnflicting ATC clearances will require the fllwing inputs t the system: Clearances issued by ATCO t all traffic; and Current psitin f surface mbiles (i.e. surveillance data f airprt surface traffic) with which clearances can be crrelated. EEC Technical/Scientific Reprt n

56 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets The alert will be presented either t a single actr with a glbal verview r pssibly many ATCOs if the scpe f the safety net cvers multiple areas f respnsibility. Generic System architecture The system architecture (inputs, infrmatin flw and infrmatin cmparisns) fr this cncept is an amalgamatin f the system architecture frm the Mbile 2 and ATCO 2 peratinal cncepts. The tw sets f infrmatin flws will need t be cnsistent with ne anther t ensure that all actrs receive timely, relevant and reliable alerts that they can be sure have been drawn frm a cmmn situatinal awareness picture. Figure 11: Functinal architecture (Bth 2) Benefits See sectin Technlgical Enablers See sectin Cnstraints and limitatins See sectin Assumptins See sectin Prblems and risks identified See sectin EEC Technical/Scientific Reprt n

57 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL (Bth 3) Infringement f restricted/clsed areas General descriptin and inputs The system warns the ATCO, the threatened mbile themselves and the surrunding traffic either a cleared rute r a current psitin f a mbile is nt safe (e.g. because the rute travels thrugh a restricted part f the surface). Input: A restrictin n the surface prevents the cleared rute frm being fllwed. This includes situatins where the mbile: Enters int a restricted area, Cmes int cnflict with anther mbile thrugh: The presence f anther mbile, r The cnflicting intent r ruting f anther mbile. The detectin f infringement will require the fllwing inputs t the system: The cleared ruting f mbile(s) cncerned; The current lcatin and/r intent f mbile(s) cncerned; The current lcatin and/r intent f surrunding surface traffic; and The lcatin f inaccessible areas n airprt surface. Generic System architecture The system architecture (inputs, infrmatin flw and infrmatin element cmparisns) fr this cncept is an amalgamatin f the system architecture fr the Mbile 3 and ATCO 3 peratinal cncepts. The tw sets f infrmatin flws will need t be cnsistent with ne anther t ensure that all actrs receive timely, relevant and reliable alerts that they can be sure have been drawn frm a cmmn situatinal awareness picture. EEC Technical/Scientific Reprt n

58 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Figure 12: Functinal architecture (Bth 3) Benefits See sectin Technlgical Enablers Surface lighting mvement guidance system presents alerts t the pilt, vehicle driver and the cntrller (althugh visibility cnditins will determine hw clearly this is presented t the mbile peratrs). These systems can be set up t prtect a given area such as that surrunding an active runway r clsed taxiway. Current state f the art systems include aircraft mvement activated stp bars and runway entry warning lights that illuminate when an aircraft incurs upn it. This sub-sectin specifies what systems, currently either in use r develpment tday, culd be used t enable the peratin f the Bth 3 cncept. The cleared ruting f all surface mbile(s): See sectin The current lcatin and/r intent f all mbiles: See sectin The lcatin f inaccessible areas n the airprt surface: Database system blcking ut areas f the airprt surface n the SMR HMI; SMR/transpnder returns (f vehicles perating in restricted area, e.g. cnstructin vehicles); D-ATIS data linked infrmatin abut inaccessible areas n the airprt surface (textural advisry); 46 EEC Technical/Scientific Reprt n

59 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL TIS-B data linked infrmatin (e.g. SMR reflectins) f inaccessible areas n the airprt surface (gegraphical lcatin). Assumptins See sectin Prblems and risks identified See sectin EEC Technical/Scientific Reprt n

60 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets 6. DISCUSSION OF IDENTIFIED OPTIONS This sectin summarises the identified ptins in terms f differences and similarities and advantages and disadvantages. In additin, it gives infrmatin abut integratin f ptins and what is their relatin t the Radmap DIFFERENCES AND SIMILARITIES Main cncept ptins This sub-sectin summarises the main differences between the eight cncepts described in the previus sectin. The cncepts are discussed based n the actr r actrs t whm the alert is presented, in line with Sectins 5.2, 5.3 and 5.4, and fr each f these the effect f the tw categries f situatins is discussed as relevant. Presentatin f alert t flight crew r vehicle driver nly Lcal view nly. Flight crew nly has a lcal verview f the situatin, meaning there is n guarantee that he will fllw a curse f actin that is the verall best slutin t the hazardus situatin. Althugh the main aim is t safely reslve the hazardus situatin, even if this is nt thrugh the verall best slutin, there is a minr risk that the flight crew s chice may lead t a new hazardus situatin, e.g. the aircraft might divert frm its curse t avid a hazardus situatin and mve int the path f anther mbile. Quick actin by actrs directly invlved. Presenting an alert directly t the flight crew is likely t lead t the quickest reactin t the hazardus situatin, as the flight crew is the actr wh has t implement the required actin. Equipage requirement. Presentatin t flight crew r vehicle driver puts requirements n aircraft/vehicle equipage. Cnsistency f alerts presented t different actrs. As there are several flight crews and vehicle drivers active n the airprt mvement area at any ne time during peratinal hurs, alerts may be presented in mre than ne mbile. If a cnflict invlves mre than ne mbile, several situatins may ccur: All flight crews and drivers are alerted by a cnsistent alert. Althugh this is likely t be the desirable situatin, there is still a small chance that they will take cnflicting actins. Alerts prvided t flight crews and drivers invlved are nt cnsistent. Befre cnsequences f this situatin are cnsidered in mre detail, further study int the level f incnsistency may be necessary: alerts are unlikely t present cmpletely different pictures f the situatin. Alert is nt presented t all flight crews and drivers invlved. This situatin can have several cnsequences: n the ne hand, at least ne f the mbiles invlved will nt be alerted t a particular situatin and therefre is unlikely t react t reslve the hazardus situatin, n the ther hand the likelihd f mbiles taking cntradicting actin is lwer. Althugh the frmer f these tw pints is likely t be mre significant, further study will be required t determine the exact impact f this situatin In relatin t this pint, the practical implementatin f this cncept may be cnsidered: One ptin is t present the alert thrugh lighting systems n the airprt surface. This has the benefit f all mbiles invlved receiving a cnsistent alert, there is n need fr any 48 EEC Technical/Scientific Reprt n

61 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL nbard equipage, but the reliance n equipment n the airprt surface may limit the number f areas cvered by the system. The amunt f infrmatin that can be prvided will als be limited. The ther ptin is t present the alert in the cckpit r vehicle cab. In this case, the risk f incnsistency exists, there is a dependency n equipage, but n the ther hand the area and types f cnflicts that can be cvered will be much higher, and depending n level f sphisticatin f the implementatin, additinal infrmatin can be presented t help safely reslve the situatin. Impact f flight crew r ATCO errr. Independent f whether the alert is the result f a flight crew r ATCO errr, the effect f presenting an alert t a flight crew will depend n the ability f the flight crew t recgnise the details f the errr. If it is clear that, fr example, the wn aircraft is abut t enter a restricted area r cme int cnflict with anther mbile, the flight crew will be well placed t address the situatin. If it is nt clear what the prblem is, it may be mre difficult. Presentatin f alert t ATCO nly Glbal verview. Presenting the alert t smene with a glbal verview, wh can therefre als decide n a glbally ptimal slutin, i.e. there is limited r n risk f actins being taken that lead t new hazardus situatins. Cnflict invlving mre than ne ATCO. Pssible exceptin t the previus pint might be if the hazardus situatin invlves mbiles under the respnsibility f different ATCOs (hwever, this may be cnsidered as minr issue). Need fr additinal cmmunicatin. Additinal step required fr ATCO cmmunicating any actins t the flight crews/vehicle drivers invlved, which will take up sme time in a situatin where quick actin may be critical. Cnsistency f alerts presented t single actr. Cnsistency f alerting is nt expected t be a very large prblem if the alert is presented t the ATCO. Impact f ATCO errr. It is difficult t say at a generic level what the effect f presenting t a ATCO will be if the alert is caused by a ATCO errr. The ATCO may immediately recgnise the errr and crrect it, he might als have difficulty identifying the prblem as all mbiles are likely t behave as expected. Impact f flight crew/vehicle driver errr. If the alert is caused by a flight crew errr, the ATCO shuld be well placed t reslve the situatin, as the errr shuld be recgnisable as a deviatin frm the expected traffic situatin, the ATCO s mental picture. Hwever, in rder fr ATCO t take necessary actin timeliness f the alert is essential. Presentatin f alert t bth ATCO and flight crew/vehicle driver Distributin f rles and respnsibilities. This ptin aims t use the advantages f bth previus ptins, whilst addressing the disadvantages. T achieve this gal, clear prcedures and rles and respnsibilities are required, as the issues relating t verview f the situatin and early reactin seem t cntradict: As a ATCO has the glbal verview f the situatin, he will be best placed t define the reslutin t a hazardus situatin, but at the same time, the flight crew is the ne wh has t implement a reslutin. This leads t a dilemma: If the flight crew takes actin immediately after receiving an alert, the added benefit f presenting the alert t the ATCO with the glbal verview is lst. EEC Technical/Scientific Reprt n

62 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets If, after receiving an alert, the flight crew has t wait fr instructins frm the ATCO, the added benefit f presenting the alert t the flight crew wh can take early actin is lst. Impact f flight crew r ATCO errr. This effectively mitigating against a single actr making an errr by raising the situatinal awareness f all actrs Impact f input and safety net lcatin Identificatin f advantages and disadvantages as presented in the previus sectin can nt been seen cmpletely independently frm the architecture and implementatin f the safety net. Sme examples were already addressed in the previus sectin, e.g. whether an alert is presented t a flight crew via nbard equipment r warning lights placed n the airprt surface. Fcussing n the simplified architecture f the surface safety net (Figure 1): Input used Cnsidering safety net functins that are part f nbard systems tw input ptins can be cnsidered: Use f ATC surveillance functin infrmatin Single cnsistent view. A single view f traffic infrmatin will be used by all actrs invlved. Multiple inputs frm different systems/technlgies can be used t develp this view. Quality f infrmatin. The quality f the traffic infrmatin depends n the lcal surveillance system and may suffer frm any shrtcming this may have: lack f cverage, lack f certain data (e.g. identificatin), degradatin f service. Limited dependency n aircraft equipage. The ATC surveillance functin will have a limited dependency n equipage (pssibly, an airprt multilateratin system will require transpnder equipage). Use f mbile-t-mbile traffic infrmatin. (assumed t be nly relevant fr nbard systems) Ptentially incnsistent view. There is a risk f incnsistency f traffic infrmatin used by different mbiles. Equipage. This apprach requires a certain level f equipage f mbiles, with any mbiles that are nt prperly equipped nt being included in the traffic infrmatin used by the safety net functin. Use f bth mbile-t-mbile and ATC surveillance traffic infrmatin was nt cnsidered a separate ptin as generally the surveillance picture presented t ATC will be the mre cmplete. A safety net functin that is part f the ATC system is assumed t always use ATC surveillance data as its input. When cnsidering nly nbard systems, data can be gleaned either frm the sensrs nbard the aircraft r frm a central ATC surce. The use f ATC surveillance data by all nbard safety nets allws the use f the same traffic infrmatin thereby increasing prbability f cnsistent alerting. Hwever if the nbard safety net functins rely n different alerting criteria there is still a chance f incnsistent alerting even with the same inputs. 50 EEC Technical/Scientific Reprt n

63 Airprt Surface Safety Nets fr Pilts and Cntrllers EUROCONTROL Lcatin f safety net functin Safety net as part f the ATC system Cnsistency. In this ptin, there is a single safety net functin with single utput. Flexibility. Safety net parameters can be set in a flexible way in relatin t airprt peratinal circumstances, e.g. lw visibility. Infrmatin n envirnment. A safety net that is part f the ATC system wuld have easy access t ther infrmatin n the peratinal envirnment that may be relevant t the safety net, e.g. active runways, (temprary) restricted areas. Safety net as part f the nbard system Ptential incnsistency. Ptentially large number f safety net functins active n the airprt surface, ptentially using different sets f inputs. Different functins can cme t different cnclusins regarding level f hazard f a specific situatin (even when functins use the same inputs: different algrithms r parameters settings may apply). Equipage. The system wide effectiveness f the safety net requires as clse t 100% equipage as pssible. Further, althugh the safety f any given mbile n the surface may be enhanced by their wn equipage (e.g. by raising the situatinal awareness f the peratr) this prtectin will be limited. The need fr high equipage will be particularly driven by safety net functin that requires a psitin feed frm all surface threats (mbiles) (e.g. via ADS-B). Use f multiple safety nets at ne lcatin. As mentined abve this situatin culd ultimately lead t incnsistent alerting and reslutin advisries being issued t varius different actrs either because f differences in the surveillance data feed prvided t it r differences in the cntrl algrithms. Ultimately the ccurrence f such a situatin wuld have t be allwed fr in the lcal prcedures emplyed n the airprt surface. These prcedures wuld need t detail which reslutin advisry t fllw e.g. that issued by a) the mbile s warning system r b) that ffered by the ATCO INTEGRATION OF CONCEPTS AND ROADMAP Relatinship f stepped develpment f the candidate safety nets, prpsed within the Radmap, and peratinal cncepts prpsed in Sectin 5 is shwn in Figure 13. Fr example, Grund-Based categry presents an extensin f A-SMGCS Level 2 system, making detectin f runway incursin precursrs and hazardus situatins n taxiways pssible. Alerts are presented t ATCOs and direct ntificatin f alerts t mbiles is given by airprt grund lighting (AGL) system. Therefre this safety net will be cvered by cnsidering cmbinatin f all Mbile and ATCO cncepts. This was just an example t shw that the different cncepts discussed d nt necessarily lead t a single ptimal directin fr develpment. Situatins such as a cmbined implementatin f cmplementary ptins, r an evlutinary develpment in which initially a higher mature but lwer perfrmance cncept is chsen, are pssible. EEC Technical/Scientific Reprt n

64 EUROCONTROL Operatinal cncept & requirements fr airprt surface safety nets Figure 13: Relatinship between the Radmap and Operatinal Cncepts 6.3. INITIAL REQUIREMENTS Initial requirement may include: Cnsistency f alerting Requirement: Single safety net functin fr whle airprt Ntes: Individual safety nets fr individual aircraft/vehicles result in a risk f incnsistency. Sme mitigatin f this risk may be available in that, unlike sme ther ptins, all aircraft use the same input (as prvided by the grund system). Glbally ptimal slutin Requirement: Single system ensuring a safe, rderly and expeditius flw f surface traffic (f which a surface safety net wuld be a part). Ntes: Multiple decisin makers are invlved in cntrlling surface vehicles (ATCOs, flight crews and vehicle drivers). Sme mitigatin in the fact that they will all base their decisins n the same traffic infrmatin, but nt necessarily n the same alert (in fact it is nt even guaranteed they will all get an alert at all). Time frm alert t reslutin Requirement: There needs t be an apprpriate time frm incident t alert s that peratr can take aviding actin. Ntes: Alerts t ATCOs are time cnsuming due t the intermediate step (cmmunicatin f actins frm ATCO t flight crew) being required. Cmparatively, alerts presented t mbile peratrs allw a relatively quick respnse. 52 EEC Technical/Scientific Reprt n