Analysis of anomalies in ADS B and its GPS data

Transcription

1 GPS Solutions The Journal of Global Navigation Satellite Systems Springer Verlag Berlin Heidelberg /s Original Article Analysis of anomalies in ADS B and its GPS data (1) (2) Busyairah Syd Ali 1, 2, Wolfgang Schuster 2, Washington Ochieng 2 and Arnab Majumdar 2 Department of Software Engineering, University of Malaya, Kuala Lumpur, Malaysia Centre for Transport Studies, Department of Civil and Environmental Engineering, Imperial College London, London, UK Busyairah Syd Ali busyairah@um.edu.my Received: 11 August 2014 Accepted: 21 March 2015 Published online: 28 March 2015 Abstract Traditionally, the surveillance component of the air traffic management system has been based on radar, which consists of two separate systems: primary radar and secondary radar, which both enable the measurement of the aircraft range and bearing to the radar station. Primary radar is based on signals emitted by a ground station simply being reflected off an object and detected by a ground based receiver. Secondary radar also emits signals, but relies upon a transponder onboard the aircraft to emit a signal itself, modulated among others by a four digit aircraft identity (Mode A), aircraft altitude (Mode C) and/or 24 bit unique address (Mode S). Typical accuracies of secondary radar are of the order of 0.03 NM in range and 0.07 in azimuth. However, no position integrity report is provided. Air traffic density is expected to significantly increase in the future. In order to maintain or enhance air travel efficiency, while maintaining safety, more accurate surveillance systems, with the required integrity, will be required /fulltext.html 1/24

2 Automatic dependent surveillance broadcast (ADS B) is a new aviation surveillance system, envisioned to overcome the limitations of radar and to enhance surveillance performance and thereby increase airspace capacity. However, its high dependence on external systems such as onboard navigation and communication systems also increases the number of potential points of failure. It is important to understand and mitigate these failure modes before the system can reliably be implemented. The present study emerged as an exploratory research as part of a safety assessment framework development for the ADS B system. It reviews the ADS B failure modes, data collection and analysis of ADS B and its corresponding onboard GPS data. The study identifies a set of failures common to certain aircraft models, with consistent error patterns. A key failure mode was found to be associated with the navigation data from the onboard GPS. We discuss the identified failure modes and investigate the nature and causes of these failures. The findings highlight some of the deficiencies of the current ADS B system, which will need to be addressed before the ADS B system can reliably be implemented. Keywords ADS B GPS Integrity Failure Position jumps Abbreviations ADD 24 bit ICAO aircraft address ADS B Automatic dependent surveillance broadcast ATC Air traffic control ATM Air traffic management CPR Compact position reporting FL Flight level FMS Flight management system GALT Geometric altitude GS Ground speed GV Ground vector HFOM Horizontal figure of merit HPE /fulltext.html 2/24

3 Horizontal position error HPL Horizontal protection level LAT Latitude LONG Longitude NAC Navigational accuracy category NIC Navigational integrity category NUC Navigational uncertainty category SAC System area code SIC System identification code TA Track angle TID Target identification TOD Time of day TRD Target report descriptor Dr. Busyairah Syd Ali is a Senior Lecturer at the Department of Software Engineering, University of Malaya. She has recently completed her PhD at the Centre for Transport Studies, Department of Civil and Environmental Engineering at Imperial College London. She investigated the impacts of a new surveillance technology called automatic dependent surveillance broadcast (ADS B) on air traffic management operations. She worked as an operation and maintenance engineer for air traffic control systems at Kuala Lumpur International Airport for 5 years. Dr. Wolfgang Schuster is the Director of the air traffic management (ATM) and intelligent transport system (ITS) groups. He is a Research Fellow (Assistant Professor) in positioning and navigation systems and /fulltext.html 3/24

4 ATM. He is an Associate Fellow of the Royal Institute of Navigation, senior member of the American Institute for Aeronautics and Astronautics (AIAA) and Member of the Royal Aeronautical Society. Professor Washington Ochieng holds the chair in positioning and navigation systems in the Department of Civil and Environmental Engineering at Imperial College London. He is also the Director of the ICEGG and the Departmental Master of Science programmes. He is a Fellow and Member of Council of the Royal Institute of Navigation and Member of the US Institute of Navigation. Dr. Arnab Majumdar is The Lloyds Register Educational Trust (LRET) Lecturer in transport risk management and the Director of the Transport Risk Management Centre (TRMC) at the Centre for Transport Studies, Imperial College London. He has spent over 20 years researching air transport. Introduction The automatic dependent surveillance broadcast (ADS B) system is a new generation surveillance system. It consists of two primary components (Fig. 1): the ADS B Out component and the ADS B In component, linked by the propagation medium. The ADS B Out component is aircraft based and is an ADS B emitter/ads B capable transponder, which consists of a message generation unit, interfaced to external systems, and a transmitter. External systems provide aircraft state and trajectory intent information to the message generation unit which merges and encodes this data. The transmitter periodically broadcasts this information, to the ground and other ADS B equipped aircraft within the coverage area, using one of three types of datalinks currently in use: Mode S extended squitter (1090ES), universal access transceiver (UAT) and VDL Mode 4, of which 1090ES is the most widely deployed and receives the support by the ICAO. The ADS B In component consists of a receiver, a message processing unit and a surveillance data processing system, with the relevant interfaces to external applications. This component is aircraft based. The receiver captures ADS B messages from all aircraft, and the message processing unit generates messages for external surveillance applications /fulltext.html 4/24

5 Fig. 1 High level architecture of ADS B (ICAO 2003) Thus, unlike radar, which relies on noncooperative independent approaches to surveillance, ADS B is cooperative and dependent. It incorporates communication requirements to provide surveillance and relies on the onboard navigation equipment to provide aircraft position information. Therefore, there is a strong dependency between the surveillance, navigation and communication functions. Figure 2 shows a context diagram illustrating the data sources, elements and data flows. The onboard global navigation satellite system (GNSS) receiver provides aircraft position, speed, a position accuracy indicator (horizontal figure of merit, HFOM) and a position integrity indicator (horizontal protection level, HPL) to the ADS B emitter. It also transmits the aircraft position to the flight management system (FMS). The pilot keys in the flight callsign into the FMS or transponder control panel, which is then transmitted to the emitter with other relevant information such as aircraft intent. The barometric altimeter provides the flight level information. The emitter derives a position accuracy indicator referred to as navigational accuracy category (NAC) from the HFOM value provided by the GNSS. It also outputs a position integrity indicator: the navigational uncertainty category (NUC) (for ADS B system certified under DO 260) or navigational integrity category (NIC) (for ADS B system certified under DO 260B), derived from HPL value from the GNSS. It then encodes all the data into ASTERIX category 21 format and transmits it to the ADS B In component /fulltext.html 5/24

6 Fig. 2 Context diagram for ADS B data source, element and flow Each of the components of the ADS B system is prone to failures, and in order to assure safety, a detailed understanding of each of the failure modes is required. Initial findings by the authors suggested anomalies not only in the ADS B Out component, but also in the GPS data that were fed to the ADS B Out component. Various studies, such as by Airservices Australia (2007, 2012) and the FAA (2013), have investigated the operational ADS B system performance. However, no detailed studies of the failure modes have been carried out to date. Our work addresses this gap by carrying out a more in depth study of the ADS B system errors, including the analysis of the onboard GPS data feed. The next section describes the data collected, followed by its analysis and finally concludes in the last section. Data /fulltext.html 6/24

7 ADS B data from ADS B ground stations and aircraft FMS and corresponding onboard navigation data were collected from traffic of opportunity in the London terminal maneuvering area (LTMA) for 57 aircraft equipped with ADS B. The study incorporates different aircraft makes and models as well as avionics types in the sample. Two types of data were collected: Surveillance data recorded from ADS B ground stations (ASTERIX CAT021) Navigation data from onboard aircraft navigation systems (GPS) The data for this work were obtained from the CRISTAL UK Project by NATS, UK. The GPS positioning data from aircraft were obtained from British Airways, recorded within the same time interval as the data collected from the ADS B ground stations. Two different sets of data were collected at different time intervals, on January 10, 2011, between 00:00:00 and 23:48:29 and on May 23, 2011, between 9:13:14 and 11:42:14. Initially, a statistical analysis was carried out to identify the percentage of fields recorded in the ASTERIX category 021 message by the ground stations used in this study for each of the aircraft state parameters of interest. The results are shown in Table /fulltext.html 7/24

8 Table 1 Analysis of fields present in ADS B report (ASTERIX category 021) Data fields in ADS B data Percentage of field presence (%) Air speed 0 Barometric vertical rate 0 Flight level 100 NUC 100 Geometric altitude Geometric vertical rate 100 Ground vector 100 Magnetic heading 0 Position latitude 100 Position longitude 100 Rate of turn 100 Roll angle 100 Time of day (TOD) 100 Trajectory intent 0 True air speed 0 Velocity accuracy 100 As shown in Table 1, nine of the 16 parameters are always present, whereas five are never present. Furthermore, the geometric altitude was present approximately 74 % of the time. The data fields present in the ADS B message depend on the ADS B avionics make and model and /fulltext.html 8/24

9 also on the performance mandated for the system. The ADS B avionics used in this study are certified to RTCA DO 260 standards (RTCA 2003). The reason for this choice, as opposed to the latest RTCA DO 260B standard (RTCA 2011), is that at the time of this study, data from aircraft certified to the DO 260B standard were not available. Table 2 describes the data fields present in the ADS B message. A detailed description of each data field is available in the EUROCONTROL standard document for surveillance data exchange Cat 021 ADS B messages (EUROCONTROL 2003) /fulltext.html 9/24

10 Table 2 ADS B data field description for DO 260 Data Description System area code (SAC) An area identifier code, unique to a specific area, usually a whole country, displayed in decimal, however, usually displayed in hexadecimal, the UK is allocated 34 and 35 (Hex) System identification code (SIC) A unique identifier code allocated to each radar/surveillance system, the Cristal ADS B system is counted as one consolidated surveillance source and hence is allocated one SIC code Target report descriptor (TRD) Each of these items reports on the type and quality of the data received from the aircraft, for example, ARC refers to the altitude reporting capability of the aircraft, when aircraft report their altitude in the 1090 MHz extended squitter, it is quantized into either 100 ft or 25 ft bands, and the ARC reports which of these bands are being used Time of day (TOD) Time of day in seconds after midnight (UTC) Latitude (LAT), longitude (LONG) Latitude and longitude in WGS 84 format displayed in decimal degrees ADD The aircraft s unique ICAO 24 bit address in hexadecimal, most registered aircraft in the world and all registered aircraft in the UK have a unique address that is hard coded into the Mode S transponder GALT Geometric height in feet from a plane tangent to the earth s ellipsoid Ellipsoid reference for GALT is WGS 84 Flight level (FL) The flight level of the aircraft, which is the altitude of the aircraft expressed at a standard pressure setting of 1013 Mb and rounded to the nearest 100 ft. This is used by en route aircraft flying IFR to ensure all aircraft fly at the same relative altitudes and thus retain vertical separation. This is as opposed to flying on local QNH pressure settings generally used during VFR flight GV GS Ground vector ground speed GV TA Ground vector track angle, direction the aircraft is heading Target identification (TID) This is the callsign or registration of the aircraft Position reference data (obtained from the aircraft GPS navigation system) from British Airways /fulltext.html 10/24

11 include the following fields: time, latitude and longitude in WGS84, geometric altitude (usually called as height), computed air speed and ground speed. Identification of errors Various errors were identified in the datasets, some of which were found to be common to a given aircraft and avionics type, while others were found to be random and/or observed across all aircraft types. Specific errors Aircraft and avionics specific errors are found in the onboard GPS data. These errors include in the GPS clock, positioning information update interval and position jumps. GPS clock For A319, A320 and A321 aircraft using Thales TLS755 MMR, after the 59th second, the minute did not increase by one, e.g., the epoch after 10:48:59 was 10:48:00, instead of 10:49:00. The GPS position update interval was consistent at 1 s. However, for aircraft B and B using the Rockwell Collins GLU920 MMR, duplicate and missing time information without any deterministic pattern were found in the GPS time data. GPS update interval For the B Rockwell Collins GLU920 MMR, GPS latitude and longitude were provided every 4 s, rather than the mandated s. For the B using Honeywell Mercury Card equipped EGPWC MkV, GPS latitude and longitude values were provided individually every 2 s. GPS position jumps Latitude and longitude position jumps were found in the GPS data for all B aircraft. The height of the spikes was approximately 0.1 for both latitude and longitude. The latitude jumps were consistent at every 50, 100 or 200 s, while that for the longitude were random. All of the affected aircraft used the Honeywell GNSSU GPS receiver. The corresponding ADS B data did /fulltext.html 11/24

12 not record these jumps, which were therefore discarded by either the ADS B emitter onboard the aircraft or by the ADS B ground station. Figures 3, 4, 5 and 6 show the GPS latitude (degree) and longitude (degree) position jumps over the flight time (s) for four B aircraft. According to Airservices Australia (2009), for Australian ADS B ground stations, if the ground station detects unreasonable position jumps in the ADS B position data, the NUC value (position integrity quality indicator) for the corresponding position transmitted to ATC is forced to zero (so that the position is not used by the ATC system). However, this was not the case in this study for NATS s ADS B ground stations in the LTMA, in which the whole string of data was found to be missing from the ADS B message. The cause for this anomaly is still under investigation in collaboration with British Airways. The position jumps can result from avionic faults and sometimes for unknown reasons at the edge of coverage (Askew 2002). Fig. 3 GPS latitude and longitude indicating position jumps for B aircraft /fulltext.html 12/24

13 Fig. 4 GPS latitude and longitude indicating position jumps for B aircraft 2 Fig. 5 GPS latitude and longitude indicating position jumps for B aircraft 3 Fig. 6 GPS latitude and longitude indicating position jumps for B aircraft 4 General errors The general errors identified in the datasets are in the ADS B messages. These include missing flight level data, duplicate messages, outliers in the message update interval, position jumps and error in the position integrity indicator values included in the ADS B message /fulltext.html 13/24

14 Missing flight level information In the first set of ADS B data, three aircraft (two A319 and one B ) had no flight level (barometric altitude) information. Instead, only the geometric altitude information was available. However, in the second data set, none of the 31 aircraft had flight level information. The missing flight level information in the three aircraft in the first dataset can be attributed to a fault in the FMS data processing or ADS B emitter data processing and transmission. On the other hand, the unavailability of flight level information in the second dataset is most likely associated with a problem in the data collection process at the ADS B ground station. It is unlikely to be a problem at aircraft level because, if barometric altitude is not available, the aircraft would be placed out of service. Duplicate ADS B messages Duplicate ADS B messages for random aircraft were identified. Further investigation showed that the aircraft was detected by more than one ground stations within its coverage at the same time. The central processing unit for the ground station failed to remove the duplicate messages. Obvious outliers in the ADS B message update interval An extensive ADS B update interval analysis showed that on average, approximately 15 % of ADS B messages were recorded at the ground stations with update intervals that were larger than the minimum ADS B update interval required of 2 s. The factors that influence the outliers will be investigated in the second part of this study. Figure 7 shows examples of this performance for aircraft 405EE0 and 4009D with update intervals faster than 2 s and % of the time, respectively /fulltext.html 14/24

15 Fig. 7 Percentage of ADS B messages received in <2 s for aircraft 405EE0 and 4009D, respectively /fulltext.html 15/24

16 ADS B position jump No position jumps were identified in the ADS B datasets analyzed. The jumps were found to be discarded, by the ADS B emitter onboard or ADS B ground station. An analysis by Airservices Australia (2007, 2012) reported jumps in longitude when aircraft are very close to a transition latitude within 5 m (Marshall 2009). The error was justified due to the use of the early compact position reporting (CPR) encoding algorithm (Marshall 2009). The CPR is used to decode the ADS B position (latitude and longitude) to reduce the bits to be broadcast. Figure 8 shows such jump. The FAA also reported on ADS B position jumps during the early stages of the ADS B implementation. The cause was also identified as being a position encoding issue (Walker 2011). Furthermore, Airservices Australia identified backward jumps with some aircraft. The jump was of the order of 0.6 NM in the direction of the aircraft track. This was attributed to a fault in the extrapolation process of the position between updates from the position source. Airservices Australia has implemented a mechanism called reasonableness test to detect sudden discontinuities in position to deal with this problem (Airservices Australia 2007). However, the mechanism did not identify the cause. In this study, it was found that all the position jumps identified in this study are the result of errors in the outputs from the onboard navigation system (GPS). Fig. 8 Longitude jump at transition latitude (Airservices Australia 2007) Position integrity indicator error /fulltext.html 16/24

17 Navigational uncertainty category (NUC) encodes the integrity bound, on the basis of HPL provided by the GPS receiver (for avionics based on DO 260), as a numerical value, from 0 to 9. The higher the value, the higher the position integrity. For aircraft certified with DO 260B, the indicator is known as navigation integrity code (NIC). The NUC or NIC value is the only indication of the aircraft position integrity. The reliability of this quality indicator value is key. It is critical to verify this value before the aircraft position information is used for any air traffic control application. The error in the position integrity indicator (NUC) included in the ADS B message is determined by checking whether the NUC value is assigned correctly or incorrectly. For example, if the actual HPL was 10 NM, then the NUC value should be assigned as 1. A higher or lower NUC value would be an incorrect assignment of the NUC value to indicate the ADS B position integrity. It is important to note that the HPL value is not included in the ADS B data. Therefore, to identify the HPL value for each epoch, reference has to be made to Table 3, using the corresponding NUC value included in the ADS B data. However, what if the NUC value was assigned incorrectly by the ADS B system? /fulltext.html 17/24

18 Table 3 ADS B position integrity indicator (RTCA 2003) NUC in DO 260 HPL in DO NM 1 <20 NM 2 <10 NM 3 <2.0 NM 4 <1.0 NM 5 <0.5 NM 6 <0.2 NM 7 <0.1 NM 8 <25 m 9 <7.5 m In order to check for such error, horizontal position error (HPE) for each epoch has to be measured. If the HPE (measured in meters or NM) exceeds the HPL bound (as defined by the NUC value in the ADS B data), then the NUC value is incorrectly assigned in the ADS B data. Else if the HPE is less than the HPL bound, then the NUC value is correctly assigned. A method to measure HPE for ADS B horizontal positioning data is proposed by Syd Ali et al. (2014a, b). GPS data collected from the aircraft navigation system is used to derive the reference position against which the ADS B horizontal position data are compared. The GPS horizontal positions are then extrapolated to the exact time at which the corresponding ADS B data are received at the ADS B ground station. The extrapolated GPS horizontal position is used as the reference (or TRUTH) to measure the HPE for each ADS B horizontal position. HPE value was measured (Syd Ali et al. 2014a, b) for each aircraft epoch. Table 4 tabulates the root mean square (RMS) HPE computed for the aircraft /fulltext.html 18/24

19 Table 4 Root mean square (RMS) horizontal position error (HPE) (Syd Ali et al. 2014a, b) Aircraft ID Aircraft type HPE (m) 40608F A A48 A A26 A A A B A319 14, B4 A F2 A A The percentages of correct assignment of NUC and incorrect assignment of NUC and integrity failure rate for each aircraft throughout the sampling time (flight duration) are measured in this work. The results are summarized in Table 5. It is found that the three aircraft indicate 100 % incorrect assignment of NUC. Aircraft shows 99.8 % correct assignment and 0.2 % incorrect assignment of NUC. Aircraft shows 91.2 % correct assignment and 8.8 % incorrect assignment of NUC. Figure 9 plots HPE and the HPL bound (as defined by the NUC) for aircraft and The plots indicate that there are HPE values exceeding the HPL bound assigned to the aircraft horizontal positions. Incorrect assignment of NUC is critical, as ATC and other aircraft in the vicinity rely on the NUC/NIC values provided by the ADS B system to ensure aircraft separation. The integrity failure rate of aircraft 40608F, 400A26 and 40087B was found to be 1.0. The values for aircraft and were found to be 2.0 and , respectively. These values are higher than the required performance value of /fulltext.html 19/24

20 Table 5 ADS B integrity quality indicator validation Aircraft ID Correct assignment of NUC (%) Incorrect assignment of NUC (%) Integrity failure rate 40608F A A B B F /fulltext.html 20/24

21 Fig. 9 HPE and HPL bound (as defined by the NUC) for aircraft and The three aircraft indicating 100 % incorrect assignment of NUC in Table 5 are A318, A320 and A319 make models, all using the Honeywell TRA 67A transponder. The error identified in the NUC may be due to the decoding process in the ADS B transmission subsystem. However, the actual cause of the error is unknown given that other aircraft equipped with the same transponder did not experience this type of error. Hence, it is crucial to establish a validation mechanism at the ADS B ground station to avoid such errors from impacting the ATC operations. Such mechanism will also aid the air navigation service providers (ANSPs) to inform the airline on problems detected in the avionics. An analysis by the Federal Aviation Administration (FAA) also identified a similar error without further details on the aircraft type or avionics (Walker 2011) /fulltext.html 21/24

22 Discussion The errors identified are the results of extensive analysis of ADS B ASTERIX Cat 21 data collected from the ADS B ground stations and its corresponding GPS data collected from the aircraft FMS. The GPS data are fed to the ADS B system onboard to provide aircraft state vector information. Therefore, the integrity of the ADS B positioning information includes the integrity level of the onboard GPS system. This also applies to any GNSS system used as onboard navigation system. The errors identified within the onboard GPS system are specific to aircraft make model. These errors may be due to the faults in the system settings or avionics faults. The GPS position jumps identified is a critical error that needs to be rectified. These positions are transmitted to the ADS B system for surveillance operations and hence jeopardize safety. All the aircraft included in this study use GPS enabled with RAIM, GBAS and SBAS. However, the errors still exist. Schuster et al. (2012) developed enhanced integrity monitoring algorithm which addresses very stringent integrity requirement for aircraft surface movement. Such stringent algorithm needs to be applied to the onboard navigation system before the positioning information is fed to the ADS B system. This is crucial for ATC operation safety. In addition, it is also crucial to validate the position integrity quality indicator derived by the ADS B system and transmitted to the ATC for surveillance operation. The authors have developed a comprehensive failure mode register for ADS B system based on the potential failures of each components within the system and external systems integrated to it (Syd Ali et al. 2014a, b). Conclusions We have identified various anomalies in the ADS B system, including the onboard GPS system. The study identified that some of the errors are specific to certain aircraft makes and models. For example, all B analyzed in this study indicated similar position jump patterns. The specific cause of this error is still under investigation. Less specific errors include missing flight level information, duplicate ADS B messages, outliers in the ADS B message update interval and position integrity indicator errors. It was also found that the ADS B emitter discarded the position jumps without rectifying the error. As a result, no aircraft state information is provided to the user at that point in time. The findings in this study are important in that they provide /fulltext.html 22/24

23 evidence of potential unreliability in the ADS B system. It is vital that these anomalies are fully understood and appropriate monitoring and mitigation mechanisms put in place to assure the reliable implementation of the ADS B system. References Airservices Australia (2007) ADS B issues. Seoul Airservices Australia (2009) ADS B Performance:transponder and MMR products. Melbourne Airservices Australia (2012) ADS B avionics issues experienced. Republic of Korea, Jeju Askew P (2002) Evaluation of ADS B at heathrow for The EUROCONTROL ADS Programme Report. NATS, UK, London EUROCONTROL (2003) EUROCONTROL standard document for surveillance data exchange part 12: Cat 021 ADS B messages vol SUR.ET1.ST STD EUROCONTROL, Brussels Federal Aviation Administration (2013) Report of FAA ADS B activities. Kolkata, India ICAO (2003) ADS B concept of use (working paper 6 Appendix. In: 11th air navigation conference (ICAO). Montreal, Canada, 2003 Marshall A (2009) An expanded description of the CPR algorithm. Sensis Corporation, New York RTCA (2003) Minimum operational performance standards for 1090 MHz extended squitter automatic dependent surveillance broadcast (ADS B) RTCA (2011) Minimum operational performance standards for 1090 MHz extended squitter automatic dependent surveillance broadcast (ADS B) and traffic information services broadcast (TIS B) Schuster W, Bai J, Feng S, Ochieng W (2012) Integrity monitoring algorithms for airport surface movement. GPS Solut 16(1):65 75 CrossRef /fulltext.html 23/24

24 Syd Ali B, Schuster W, Ochieng W, Chiew TK, Majumdar A (2014a) Framework for ADS B performance assessment: the London TMA case study. J Inst Navig 61(1):39 52 CrossRef Syd Ali B, Ochieng W, Majumdar A, Schuster W, Chiew TK (2014b) ADS B system failure modes and models. J Navig 67(1): CrossRef Walker D (2011) Early implementation experiences. Federal Aviation Administration, Missouri Over 9 million scientific documents at your fingertips Springer International Publishing AG, Part of Springer Science+Business Media /fulltext.html 24/24