Operational Safety Study: Risk of operation without a transponder or with a dysfunctional one

Transcription

1 Network Maager omiated by the Europea Commissio EUROCONTROL Operatioal Safety Study: Risk of operatio without a traspoder or with a dysfuctioal oe Editio 1.0 Editio date: 07/10/2014 Status: Released Issue Iteded for: Geeral Public

2

3 DOCUMENT APPROVAL The followig table idetifies all maagemet authorities who have successively approved the preset issue of this documets. Authority Name ad sigature Date Project Maager NMD/NOM/SAF Staislaw Drozdowski 07/10/2014 Operatioal Safety Coordiator, DNM/NOM/SAF Mr. Tzetomir Blajev 07/10/2014 Head of Safety Uit, DNM, NOM Mr. Atoio Licu 07/10/2014 Head of Network Operatios Maagemet Divisio Mrs. Nicola Cooper 15/10/2014 Director NM TIT Mr. Joe Sultaa 22/10/2014 Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio 1.0 3

4 DOCUMENT CHANGE RECORD The followig table records the complete history of the successive editios of the preset documet. Editio Number Editio Date Reaso for chage Pages affected /10/2014 Released versio All TIT 4

5 TABLE OF CONTENTS DOCUMENT APPROVAL 3 DOCUMENT CHANGE RECORD 4 EXECUTIVE SUMMARY 7 CHAPTER 1 - INTRODUCTION What is the purpose of this documet? What are the Network Maager Top 5 ATM Operatioal Safety Priorities for 2013? How did we idetify the Top 5? 9 CHAPTER 2 - THE GENERIC PROCESS: OVERVIEW 10 CHAPTER 3 - GENERIC SCENARIOS How should geeric operatioal scearios defied? Aalytical decostructio of operatioal scearios Selectio of specific failure modes for further aalysis Assessig the effect usig a geeric barrier model Sceario derivatio 17 CHAPTER 4 - SPECIFIC METHODOLOGY ASPECTS Assessig the barriers impacted Operatioal cotext Methodology for barrier effectiveess 20 CHAPTER 5 - FAILURE MODE T1: TOTAL LOSS Sceario derivatio (failure mode T1: total loss of traspoder) List of resultat scearios (failure mode T1) Barriers to mitigate total loss (failure mode T1) Matrix of scearios ad barrier effectiveess (failure mode T1) Summary of mitigatig barriers (failure mode T1) 27 CHAPTER 6 - FAILURE MODES A, S AND C Sceario derivatio (failure modes A, S ad C) Scearios for failure mode A3: Corrupted Mode A Scearios for failure mode C2: Itermittet Mode C Scearios for failure mode S4: Duplicated Mode S 24-bit address List of resultat scearios (failure modes A, S ad C) Barriers to mitigate corrupt Mode A code (failure mode A3) Barriers to mitigate itermittet Mode C (failure mode C2) Barriers to mitigate duplicated Mode S 24-bit address (failure mode S4) Matrix of scearios ad barrier effectiveess (failure modes A, S ad C) Summary of mitigatig barriers (failure modes A, S ad C) 40 Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio 1.0 5

6 CHAPTER 7 - CONCLUSIONS AND RECOMMENDATIONS Coclusios 41 APPENDIX A - EXAMPLES OF INDUCED RISK FROM TRANSPONDER FAILURES 43 Itroductio 43 Example A 43 Example B 44 Example C 45 Example D 45 Example E 45 Example F 45 Example G 45 APPENDIX B - SUMMARY OF MITIGATING BARRIERS 46 APPENDIX C - GLOSSARY AND ABBREVIATIONS 47 Glossary 47 Acroyms ad Abbreviatios 48

7 EXECUTIVE SUMMARY The EUROCONTROL Safety Improvemet Sub-Group (SISG), reportig to the EUROCONTROL Safety Team, was tasked to idetify the Top 5 ATM Operatioal Safety Priorities. SISG performed a review durig summer 2012 ad ivolved a series of dedicated workshops with 6 ANSPs, represetig a large part of Europea air traffic. Comprehesive barrier models - Safety Fuctios Maps (SAFMAPs) - were developed ad populated with represetative data from the participatig ANSPs. The icidet data is for high severity (classified as A ad B ) evets, which are o oe side thoroughly ivestigated ad o the other side - highly iformative because the icidet scearios test the majority of the available safety barriers. As a result of the SAFMAP aalysis the Top 5 priority areas were suggested, agreed by SISG ad edorsed by the Safety Team: Risk of operatio without traspoder or with a dysfuctioal oe Ladig without ATC clearace Detectio of occupied ruway Blid spot iefficiet coflict detectio with the closest aircraft Coflict detectio with adjacet sectors This purpose of this report is twofold: To documet the operatioal safety study o oe of the Top 5 Network Maager operatioal safety priorities for 2013 Risk of operatio without traspoder or with a dysfuctioal oe. To serve as a referece for the Network actors i case they udertake operatioal safety aalysis ad improvemet activities regardig the risk of the operatio of a aircraft without a traspoder or with a dysfuctioal oe. The priorities were reviewed by SISG with SAFMAP aalysis of the data for year 2013 ad re-cofirmed as Top 5 priorities for The methodology employed was as follows: Geerate a set of geeric scearios that could pose a safety risk due to the operatio of a aircraft without a fuctioig traspoder or with a dysfuctioal oe. Cosider what barriers exist that if implemeted ad deployed could mitigate the result of a aircraft operatig without a traspoder or a dysfuctioal oe causig a operatioal impact leadig to a risk. Aalysis each geeric sceario agaist the potetial barriers to establish which of these barriers could be effective over the whole rage of scearios. Review a set of actual evets ad plausible scearios to cofirm that the barriers suggested by the geeric aalysis to validate that the same barriers should be the most effective i the live eviromet. A series of coclusios are draw regardig the effectiveess of the idetified barriers. Further work will be ecessary to validate these coclusios. Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio 1.0 7

8 CHAPTER 1 - INTRODUCTION 1.1 What is the purpose of this documet? This purpose of this report is twofold: Documetig ad commuicatig To documet the operatioal safety study o oe of the Top 5 Network Maager operatioal safety priorities for 2013 Risk of operatio without traspoder or with a dysfuctioal oe. To serve as a referece for the Network actors i case they udertake operatioal safety aalysis ad improvemet activities regardig the risk of the operatio of a aircraft without a traspoder or with a dysfuctioal oe. 1.2 What are the Network Maager Top 5 ATM Operatioal Safety Priorities for 2013? Risk of operatio without traspoder or with a dysfuctioal oe Ladig without ATC clearace Detectio of occupied ruway Blid spot - iefficiet coflict detectio with the closest aircraft Coflict detectio with adjacet sectors Operatios without traspoder or with a dysfuctioal oe costitute a sigle threat with a potetial of passig through all the existig safety barriers up to see ad avoid. For various reasos, aircraft sometimes lad without ATC clearace resultig i Ruway Icursios that are ofte oly resolved by providece. Some Ruway Icursio icidets could have bee preveted if cotrollers had had better meas to detect that the ruway was occupied at the time of issuig clearace to the ext aircraft to use the ruway. Loss of separatio Blid Spot evets are typically characterised by the cotroller ot detectig a coflict with the closest aircraft. They usually occur after a descet clearace ad i the cotext of a rapidly developig situatio ofte whe the coflictig aircraft are 1000ft ad 15 m apart. Losses of Separatio i the E-Route eviromet sometimes ivolve iadequate coordiatio of clearace with a adjacet sector. These typically ivolve either a early (premature) trasfer of cotrol to or from the eighbourig sector. 8

9 1.3 How did we idetify the Top 5? The Network Maager idetifies Network safety issues to eable aviatio stakeholders to mitigate existig hazards ad aticipate ew operatioal risks The first step was to defie broad priority areas for further prioritisatio Our ultimate goal is to keep the Network safe ad able to icrease its capacity ad efficiecy. The EUROCONTROL Safety Improvemet Sub-Group (SISG), reportig to the EUROCONTROL Safety Team, was tasked to idetify the Top 5 ATM Operatioal Safety Priorities. I 2012, the SISG followed a structured two-step process of operatioal safety prioritisatio. Firstly SISG idetified a list of priority areas. The agreed list cotais work priority areas addressig operatioal threats, safety precursors or udesired safety outcomes. The list icludes: Airspace Ifrigemet Ruway Icursio Loss of Separatio ATC sector overloads Level Bust Severe Weather Risk Air Groud commuicatios Ruway Excursio The list of agreed priority areas cotais issues that are too broad to be a part of a focussed work program. There was a eed to get more graularity ad select some of the areas for a detailed review. Based o the availability of reliable safety iformatio, two of the risk areas were selected for detailed review: The secod step was a detailed review with SAFMAPS. The priorities were re-cofirmed for 2014 Ruway Icursio ad Loss of Separatio E-Route. The review was performed durig summer 2012 ad ivolved a series of dedicated workshops with 6 ANSPs, represetig a large part of Europea air traffic. Comprehesive barrier models Safety Fuctios Maps (SAFMAPs) - were developed ad populated with represetative data from the participatig ANSPs. The icidet data is for high severity (classified as A ad B ) evets, which are o oe side thoroughly ivestigated ad o the other side highly iformative because the icidet scearios test the majority of the available safety barriers. As a result of the SAFMAP aalysis the Top 5 priority areas were suggested, agreed by SISG ad edorsed by the Safety Team: Risk of operatio without traspoder or with a dysfuctioal oe Ladig without ATC clearace Detectio of occupied ruway Blid spot iefficiet coflict detectio with the closest aircraft Coflict detectio with adjacet sectors The priorities were reviewed by SISG usig the same approach of aalysig the high severity icidet with SAFMAPs. As a result SISG re-cofirmed the Top 5 priorities for Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio 1.0 9

10 CHAPTER 2 - THE GENERIC PROCESS: OVERVIEW The figure below provides a overview of the geeric steps i the Operatioal Safety Study BARRIERS SCENARIOS ANALYSIS CONCLUSIONS OPERATIONAL CONTEXT This particular Top 5 study is uique, i that it refers to a series of techical failure modes which lead to a operatioal evet. The geeric process is still followed, but the scearios relate to the specific failure modes of a traspoder ad the impact o the various operatioal risk cotrols (barriers) applicable for a ATS provider. The barrier aalysis the looks at how these risk cotrols ca be repaired, reiforced, or whether ew barriers ca be idetified. A assessmet of the effectiveess of these risk cotrols is carried out ad preseted i a matrix, with a series of recommedatios ad coclusios draw from the results. 10

11 CHAPTER 3 - GENERIC SCENARIOS BARRIERS SCENARIOS ANALYSIS CONCLUSIONS OPERATIONAL CONTEXT Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

12 3.1 How should geeric operatioal scearios be defied? Geeric operatioal scearios are used to help reduce the complexity of the subsequet aalysis. Sceario defiitio is by story tellig, specific to help assess the effectiveess of the proposed safety barriers ad geeric eough to keep their umber relatively small. The scearios draw upo two sources of iformatio: Combiatio of top-dow ad bottom-up approaches A systematic aalytical de-costructio of each failure mode ad its impact o the operatioal uses of surveillace (traspoder-based) iformatio. This is based o all theoretically possible combiatios of sceario (1) failure modes, (2) mechaisms (impacts o the barrier model) ad (3) outcomes. A review of the publicly available iformatio from ivestigatio reports of accidets ad serious icidets ivestigated followig the provisios of ICAO Aex 13, ad cofidetially provided data i respect of less sigificat icidets. 3.2 Aalytical decostructio of operatioal scearios Traspoders failure ca occur from a umber of reasos. These ca iclude icorrect iput data, electrical faults, ad simple commuicatio problems, such as a bit flip. Sceario Sources The cause of the failure of the traspoder is outside of the scope of this report. The report focuses o the differet types of failure ad ways these ca be detected ad mitigated agaist. Importatly, this study does ot aim to repeat the other reports lookig at the cotroller s ability to detect ad resolve coflicts operatioally (e.g. blid spot). The operatioal barriers, o-specific to a traspoder failure, are dealt with i those studies. It is recommeded that itegratio of the coclusios is carried out i a future step to give a full picture of the iteractios at equipmet, huma ad procedural level. Four potetial traspoder iformatio failures have bee idetified. This report will review the failures of: Failure Elemet Mode A code oly (Aircraft Idetifier) Mode C iformatio oly (Altitude data) Mode S 24-bit address oly Total failure (A, C & S) Note that because the study focuses o traspoder geerated issues, the loss or corruptio of positio iformatio derived by the Secodary Surveillace Radar has ot yet bee cosidered. Of course, positio could be lost as a kock-o effect of the loss of all data, or i some cases, through a dropped track. 12

13 Give the iformatio elemets above, there are a umber of failure types (characteristics) which have bee see. These iclude: Failure Type Sceario Eviromet Possible Failure Modes Loss Itermittet Corrupted Duplicated Failure types are oly applicable to certai failure elemets. For example, it is o-logical to have duplicated Mode C. Full defiitios of each type are show below. The scearios will look at two eviromets: The Termial Cotrol Area (TMA), ad E-route. A umber of operatioal cotexts are the applied to uderstad the effectiveess of various barriers. These are summarised i Sectio 5. This gives a umber of possible failure modes, summarised i Table 3 1. Type: Elemet: Loss Itermittet Corrupt Duplicated Mode 3/A code oly A1 A2 A3 A4 Mode C oly C1 C2 C3 Mode S 24 bit adress oly S1 S2 S3 S4 Total failure T1 T2 Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

14 3.3 Selectio of specific failure modes for further aalysis The potetial failure modes have bee dow-selected i this aalysis to focus o areas where operatioal examples exist through icidet reports, or where expert judgemet assessed them as leadig to the greatest risk. These dow-selected failure modes were preseted to the SISG i 2013, ad the iitial list was agreed. The failure modes ot aalysed i this versio could be assessed i future iteratios. The specific failure modes addressed are: Total loss of traspoder (T1) Corrupted Mode A (A3) Itermittet Mode C (C2) Duplicated Mode S (S4) Defiitios for each of the failure modes are as follows: Total loss: There is o traspoder-based data received at the CWP. For the purposes of this study, it is assumed that the loss is maitaied through a etire sector or multiple sectors. Corrupted Mode A: Iformatio received at the CWP is icorrect, primarily due to a error iput ito the traspoder, or the processig ad trasmissio of the Mode A code by the traspoder. Whilst errors leadig to a icorrect Mode A code could occur i the groud ATM system, they are ot the focus of this study. Itermittet Mode C: Traspoder-based altitude iformatio is lost from the CWP for short periods of time, log eough to cause the ed effect (risk), for example 1-2 miutes. This is assumed to be due to traspoder-based errors or detectio failures, rather tha groud system processig failures. Duplicated Mode S 24-bit address: Two aircraft are operatig with the same aircraft ID, specifically the same Mode S 24-bit address. The aircraft would usually eed to be proximate for this to have a sigificat safety impact e.g. withi the same sector or adjoiig sectors although it is recogised that the resultig potetially uexpected trajectory may cause cofusio eve where aircraft are ot proximate. These failure modes are the used to derive the scearios below. Note: whilst earlier versios of this study differetiated cotroller detectio withi the scearios, it was felt that this was better examied withi the barriers (ad effectiveess) themselves. Therefore, all scearios are ow idepedet of cotroller detectio. 14

15 3.4 Assessig the effect usig a geeric barrier model I order to assess the effect of the specific failures modes outlied above, a geeric barrier model has bee used. This model outlies the operatioal risk cotrols which exist i Air Traffic Services provisio, ad is based o that used for the SAFMAP developmets. Seve high level barriers are idetified, withi which several detailed tools or techiques may exist. Traffic plaig ad sychroisatio Tactical coflict maagemet Sice this is a operatioal safety study, ad traspoder failure is a techical issue, all the barriers examied below ted to be recoverybased rather tha prevetative i.e. they mitigate the cosequece of the failure, rather tha stoppig the failure occurrig i the first place. For prevetative barriers for traspoder failures or dysfuctio, appropriate desig, maiteace ad iteroperability are required. Firstly, provided below is a graphical represetatio of the Barrier Model, followed by a table explaiig each elemet i more detail. ATC Collisio Avoidace Crew Collisio Avoidace Providece ACCIDENT The scope of this barrier has bee wideed from purely operatioal airspace desig, ad ow icludes other desig aspects (such as the system), sice may barriers are oly effective if desiged ad calibrated appropriately. Desig ad plaig does ot directly use ay iput from traspoders. Desig ad strategic plaig Demad ad capacity balacig Nevertheless, the ability of the ANSP to desig ad pla to cope with potetial failures is cosidered, sice the barrier is importat i prevetig evetual operatioal risk impacts. This may iclude cotroller traiig for uusual circumstaces ad emergecies, with practice i sythetic eviromets (e.g. simulators) to remai curret for evets that rarely occur i the live eviromet. Also icluded i this elemet is the desig of techical systems ad procedures; this may iclude stadardisatio efforts for airbore or groud tools. Demad ad capacity balacig, icludig multi-sector plaig, is based upo schedules ad flight pla data as opposed to track data. Therefore, the impact of a icorrectly operatig traspoder o flow cotrol ad sector loadig is classified as egligible. Agai, the effectiveess of DCB barriers may assist i mitigatig the cosequeces of the traspoder failure or dysfuctio. Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

16 Traffic plaig ad sychroisatio Traffic plaig ad sychroisig uses traspoder-based iformatio to update predictive tools ad form tracks, so would be egatively impacted by a traspoder that is ot operatig correctly. However, as traffic plaig ad sychroisatio is a predictio tool, a error at this stage is ulikely to lead directly to a loss of separatio. Nevertheless, it may impact trusted predictive tools such as MTCD ad AMAN, causig kock-o cosequeces. It may also impact the plaig cotroller s task of detectig future coflicts usig plaed trajectories, leadig to icorrect or o actio take to resolve the potetial coflict at a early (strategic) stage. The traffic plaig ad sychroisatio barriers will have a role i mitigatig the cosequeces of a traspoder failure, particularly due to the use of (static or dyamic) flight pla data. New techological developmets (makig more use of predicted trajectories) are likely to icrease the criticality of this barrier i the overall system. Tactical coflict maagemet ATC collisio avoidace Tactical coflict maagemet is the first phase of this barrier model where executive cotrollers are usig, ad basig decisios o, traspoder data i real time for separatio assurace (coflict maagemet). This may be doe i additio to decoflictio by flight strips, with icorrect traspoder data leadig to cofusio ad iappropriate istructios. Traspoder fuctioality may impact the ability of cotroller tools to war the cotroller regardig the coflict. At this phase ay iaccuracies or loss i the traspoder data could lead directly to a loss of separatio, sice the cotroller s ability to detect ad resolve the coflict may be degraded. Sice the tactical coflict maagemet barriers will i some form use traspoder-based data, the effectiveess of these barriers i mitigatig the cosequeces of a traspoder failure may ot be great. ATC collisio avoidace refers to the groud-based (executive cotroller ad tools) techiques to esure immiet potetial collisios are avoided. It may iclude alerts from safety ets such as Short Term Coflict Alert, ad the executive cotroller s treatmet of the alert. It also icludes situatios where o alert exists, but the cotroller still provides urget istructios (e.g. tur left, climb, desced) to avoid a collisio. Ay iaccuracies or problems with traspoder data at this phase could have serious cosequeces o the effectiveess of the barriers. The ability of the barriers to mitigate ay cosequeces of a traspoder failure would be miimal. 16

17 Crew collisio avoidace icludes maual ad tool-based support. Collisio Avoidace Systems 1 are the prime barrier at this stage. It is a safety et, requirig immediate actio by the flight crew i respose to a Resolutio Advisory to avoid a potetial collisio, such that a miimum of 500ft separatio is assured if the guidace is followed. Crew collisio avoidace If the traspoder data is lost or dysfuctioal, this will have a immediate impact upo e.g. ACAS, which utilises this data i various forms to form the Traffic Advisories ad Resolutio Advisories. This could especially be the case for corrupt data, sice ACAS actios are prioritised over ATC, so icorrect advisories are particularly cocerig. If the traspoder data is lost, Collisio Avoidace Systems (CAS) will ot fuctio. Likewise, if the data emaatig from a threat aircraft is itermittet or corrupt, there is the possibility that the CAS will filter out the threat aircraft ad o advisory will be made. The pilot may still be able to resort to see-ad-avoid (i.e. out the widow situatioal awareess). Providece Providece refers to the o-desiged factors which prevet a collisio (i.e. it just happeed that the aircraft were ot i the same place at exactly the same time). 3.5 Sceario derivatio The Sceario derivatio sectio for each failure mode provides a assessmet of how each failure mode would affect existig barriers. It provides a explaatio of how the barrier is reduced or ullified. It the uses this iformatio to derive scearios (short geeric descriptios of chais of evets) based o each failure mode. I most cases, the severity of the potetial scearios is aliged to their positio i the barrier model: o their ow, traffic plaig failures will geerally lead to mior losses of separatio, due to the presece of other barriers. If some of the later barriers fail, major losses of separatio or potetial collisios may result the sceario is the characterised operatioally as a iability to provide collisio avoidace.. 1 Collisio Avoidace Systems iclude TCAS I, ACAS II ad other systems used by e.g. Geeral Aviatio. Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

18 CHAPTER 4 - SPECIFIC METHODOLOGY ASPECTS The figure below provides a overview of the geeric steps i the Operatioal Safety Study BARRIERS SCENARIOS ANALYSIS CONCLUSIONS OPERATIONAL CONTEXT 18

19 4.1 Assessig the barriers impacted Barriers Repairable barriers The barriers icluded i this risk aalysis have bee idetified as possible ways that the cosequeces arisig from various failure types of the traspoder could be mitigated. This icludes mitigatios o first cotact, such as validatio of Mode A ad Mode C iformatio. As oted above, the prevetio of traspoder failure or dysfuctio is outside the scope of this operatioal safety study, sice it looks at detailed techical equipmet issues. The iclusio of the barriers does ot imply that they are relevat to all situatios ad either does it imply that their adoptio by aircraft operators or ANSPs as a group would ecessarily be appropriate. The barriers are arraged by failure mode to show the causal liks, the summarised at the ed of the sectio. The providece ad ed result i the barrier model are ot show, as they are ot relevat. The cocept of repairable barriers is itroduced below. This is where the failure mode of a traspoder has reduced the effectiveess of a barrier i the system, but that certai actios may be able to repair the effectiveess of this barrier. For example, re-programmig the Medium Term Coflict Detectio fuctio such that if Mode C iformatio is lost, it does ot assume the aircraft is at all heights ad subsequetly provide uisace alerts. 4.2 Operatioal cotext I may cases across Europe, the operatioal cotext for a busy sector is similar. This study assumes that the level of traffic ad complexity of sector does ot act as a differetiator for the effectiveess of the barriers idetified. Likewise, the weather coditios may impact the ability to see-ad-avoid, but oly i terms of the geeral effectiveess of that barrier. Operatioal cotext The followig cotextual elemets may act as a variable o the effectiveess of the mitigatig barriers idetified above. Type of sector: Approach sectors may make more use of surveillace iformatio, whilst e-route sectors may rely more o flight pla data to de-coflict aircraft. Availability of Primary Surveillace Radar: PSR may ot be available i all sectors, particularly i e-route operatios. I geeral, cotrolled airspace is assumed for this study. Nevertheless, the proximity of ucotrolled airspace ad potetial impact from otraspodig aircraft may chage the effectiveess of certai barriers. Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

20 4.3 Methodology for barrier effectiveess The effectiveess of each of the idetified barriers is assessed for each sceario. Where the effectiveess is depedet o operatioal cotext, this is oted. If the barrier is ot applicable for the sceario (e.g. it is oly specific to a uique failure mode), the box is left blak (white). Assessig barrier effectiveess Gree deotes a high barrier effectiveess (i.e. prevets the loss of separatio almost every time). Yellow deotes a depedet barrier effectiveess (i.e. oly effective some of the time). Red deotes a low barrier effectiveess (i.e. ot effective for a particular sceario). White deotes a o-applicable barrier (i.e. caot judge effectiveess, as it is i o way relevat for the failure mode). 20

21 Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

22 CHAPTER 5 - FAILURE MODE T1: TOTAL LOSS 5.1 Sceario derivatio (failure mode T1: total loss of traspoder) This set of scearios assumes a total loss of the traspoder, with o iformatio regardig Mode A, C or S data reachig the cotroller or groud tools. This icludes uderlyig techical failures withi the avioics, the traspoder beig iadvertetly switched off, or the traspoder failig to deliver a reply (for whatever reaso). Deliberate switchig off of the traspoder is cosidered to be out of scope, as it does ot ivolve safety failure but is a illegal act. Desig ad strategic plaig Demad ad capacity balacig Traffic plaig ad sychroisatio Tactical coflict maagemet ATC collisio avoidace Crew collisio avoidace Providece ACCIDENT 22

23 Barrier Model Barriers Affected Possible scearios Desig ad strategic plaig Noe Noe Demad ad capacity balacig Noe Noe Traffic plaig ad sychroisatio Tactical coflict maagemet ATC collisio avoidace Crew collisio avoidace Cotroller tools - A complete loss of track would severely impact cotroller tools. This would affect tools such as MTCD ad AMAN, particularly where the tools require the updatig of flight pla based iformatio with track iformatio. The mai impact is that the iformatio i the tools is out-of-date ad less reliable. I some high complexity eviromets, the tools may be uusable. The risk may be that a iappropriate pla is geerated, leadig to higher workload durig the executio phase, ad potetial loss of separatio as a result. ATCO - Loss of the surveillace track at the CWP level ca cause loss of real time situatioal awareess of the plaig cotroller. This results i a reliace o flight pla data ad voice reportig to build a situatio picture. Cotroller tools - tools that rely o secodary surveillace iformatio would ot operate; for example, all coformace/adherece moitorig tools (to the flight pla data), coverig route ad height. ATCO - The ability of the ATCO to provide tactical clearaces ad istructios would be severely impacted by the loss of real-time traspoderbased surveillace iformatio at the CWP, icludig the track, altitude ad idetity. This will usually lead to sigificat additioal workload, sice oe aircraft will be cotrolled procedurally. The detectability of the aircraft may also be compromised, particularly if sector hadover procedures are ot effective. Groud-based safety ets - The safety ets would ot operate without real-time track iformatio derived from the traspoder. No alerts would be issued. ATCO - The ability of the ATCO to provide istructios for collisio avoidace would be compromised by the loss of track ad label surveillace data. The barrier would be almost ieffective usig the CWP. Some effectiveess remais from voice reportig ad procedural clearaces (e.g. stop descet, climb ot above ) Airbore tools - ACAS ad other CAS would ot operate. No RA (or TA) would be give if the traspoder was ot operatioal o the aircraft ivolved. T1-S1 - Loss of separatio due loss of all track iformatio o oe aircraft causig iappropriate plaig. T1-S2 - Loss of separatio due loss of all track iformatio o oe aircraft impactig tactical cotrol. T1-S2 - Loss of separatio due loss of all track iformatio o oe aircraft impactig tactical cotrol. Providece /a Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

24 5.2 List of resultat scearios (failure mode T1) Scearios arisig from traspoder failure or dysfuctio (XX-YY deotes failure mode ad sceario ID) ID T1-S1 T1-S2 Sceario descriptio Loss of separatio due loss of all track iformatio o oe aircraft causig iappropriate plaig Loss of separatio due loss of all track iformatio o oe aircraft impactig tactical cotrol Followig further aalysis of the operatioal evets, it is recommeded that these scearios are re-visited to uderstad the oes highlightig the greatest risk to operatios. 5.3 Barriers to mitigate total loss (failure mode T1) Barrier Model Repairable barriers Existig or ew barriers Desig ad strategic plaig Demad ad capacity balacig Traffic plaig ad sychroisatio MB04: Applicatio of traspoder validatio procedures o first cotact - O first radar cotact with a aircraft, the ATCO should validate the traspoder fuctio, icludig e.g. operatio, Mode A code ad Mode C operatio. This could iclude o start-up or departure. The thoroughess of completio of this procedure could be improved for certai sectors or eviromets. Noe MB09: More effective flight pla data - This is the improvemet of cotroller predictio tools to give more accurate performace whe usig oly flight pla data (eve if desiged for dyamic updates usig track data), for example whe maually updated by the ATCO. The ATCO also requires clear procedures ad traiig for maually iputtig ad updatig flight pla data for the most effective use durig a loss of track sceario. This also reflects the geeral mitigatio of appropriate use of flight pla data i the evet of a loss of track for both ATCO tools ad the cotroller. MB01: Airspace desig gives positive separatio - This icludes the systematic separatio of aircraft usig de-coflicted RNAV/RNP based routes. Free-route airspace may reduce the effectiveess of this barrier. MB02: Procedure desig for traspoder malfuctio - Procedures ca be defied ad implemeted for traspoder loss. If primary radar is available, flight pla correlatio should be maitaied. If ot (e.g. i the subsequet sector), procedures may vary, ad may iclude military escort or i extremis refusig the aircraft etry or returig the aircraft to a airfield. Procedures may also iclude assistace of the supervisor or plaer. The aircraft should also be cleared out of RVSM airspace. MB03: Appropriate ATC system desig ad calibratio - I the case of total loss of a traspoder, desig ad calibratio of a effective tool for alertig ATCOs i the evet of: a dropped track (across oe or more sectors); or a o-correlated track (i.e. without flight pla data); or a track without secodary surveillace iformatio (i.e. primary oly, but still correlated). MB08: Sector capacity plaig - Esurig that the umber of aircraft the cotroller ca hadle if a track is lost is appropriate i.e. esurig that sector capacity limits are appropriate by sesitivity aalysis of track drop scearios. MB10: Use of voice reportig - Use of voice reportig is particularly relevat as a barrier durig sector hadover, whe defied procedures may be followed. If silet hadover is used, this barrier may ot be applicable. If the ATCO has detected the track drop/loss, it may also be used withi a sector for improved situatioal awareess. 24

25 Tactical coflict maagemet ATC collisio avoidace Crew collisio avoidace MB12: Regular scaig by ATCO - The cotroller should maitai a effective regular sca (e.g. to be able to detect o-alerted dropped tracks), rather tha solely rely o first cotact procedures. This also applies to detectio of icorrect aircraft beig give a clearace (due ivalid correlatio). There is some debate as to the effectiveess of this barrier, sice i e-route cotrolled airspace, strip maagemet is traditioally the primary meas of decoflictio. MB13: Use of primary radar data If available, this ca be used to maitai a correlated track to support tactical coflict maagemet i the evet of a loss of secodary surveillace iformatio. Note that this may be assisted by cooperatio with the military, allowig the sharig of primary radar data. MB15: Crew detectio of traspoder failure Existig alerts are icorporated o most commercial aircraft, but may ot be immediately oticeable i flight (e.g. Embraer Legacy- B737 accidet i Brazil). Fail-safe idicatios of traspoder failures or malfuctios, if detected, should be give to the flight crew. Noe Noe MB14: Alert for chage i track status - Ay chage of track status should be alerted to the cotroller. This icludes the loss of traspoder iformatio (i.e. primary oly, or flight pla track), or the total loss of a track. Alertig improves the detectability. This is also applicable for multiple sectors, i.e. also alertig the ext sector the aircraft is due to eter, ad may be used at the plaig stage. MB10: Use of voice reportig remais importat to resolve coflicts ad separate traffic, as log as the ATCO is aware of the two aircraft. MB16: Collisio avoidace via procedural cotrol - Use of altitude iformatio acquired through voice reportig to achieve vertical separatio. MB19: See ad avoid practiced by aircraft - This could iclude the executive cotroller actively ecouragig the aircraft to see-ad-avoid through iformig them of the track loss situatio (if detected) ad otifyig them of proximate aircraft s approximate or last kow positio. The effectiveess of see-ad-avoid for Commercial Air Trasport is ot thought to be high, particularly where there is o idicatio of the other aircraft through other meas (e.g. via TCAS display or through party-lie situatioal awareess). 5.4 Matrix of scearios ad barrier effectiveess (failure mode T1) Gree deotes a high barrier effectiveess (i.e. prevets the loss of separatio almost every time). Yellow deotes a depedet barrier effectiveess (i.e. oly effective some of the time). Red deotes a low barrier effectiveess (i.e. ot effective for a particular sceario). White deotes a o-applicable barrier (i.e. caot judge effectiveess, as it is i o way relevat for the failure mode). MITIGATION BARRIERS OPERATIONAL SCENARIOS: MB01: Airspace desig gives positive separatio MB02: Procedure desig for traspoder malfuctio MB03: Appropriate ATC system desig ad calibratio MB04: Applicatio of traspoder validatio procedures o first cotact MB05: Weighted use of all aircraft ID sources i ATC system T1-S1 - Loss of separatio due loss of all track iformatio o oe aircraft causig iappropriate plaig Assumig desig is utilised (e.g. ot free-route) Aids ATCO detectio /a /a T1-S2 - Loss of separatio due loss of all track iformatio o oe aircraft impactig tactical cotrol Assumig desig is utilised (e.g. ot free-route) If traspoder failure detected by ATCO Aids ATCO detectio If traspoder failure is pre-flight or at first cotact /a Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

26 MITIGATION BARRIERS OPERATIONAL SCENARIOS: MB06: Aomaly reportig ad effective respose MB07: Maiteace procedures for traspoder MB08: Sector capacity plaig MB09: More effective flight pla data MB10: Use of voice reportig T1-S1 - Loss of separatio due loss of all track iformatio o oe aircraft causig iappropriate plaig /a /a Mitigates loss of separatio due workload More effective trajectory predictio tools Improves detectability T1-S2 - Loss of separatio due loss of all track iformatio o oe aircraft impactig tactical cotrol /a /a Mitigates loss of separatio due workload Ulikely to be effective tactically Improves detectability MITIGATION BARRIERS OPERATIONAL SCENARIOS: MB11: Sector-sector coordiatio MB12: Regular scaig by ATCO MB13: Use of primary radar data MB14: Alert for chage i track status MB15: Crew detectio of traspoder failure T1-S1 - Loss of separatio due loss of all track iformatio o oe aircraft causig iappropriate plaig No impact No impact Effective whe primary preset No impact No impact o plaig T1-S2 - Loss of separatio due loss of all track iformatio o oe aircraft impactig tactical cotrol No impact Improves detectio possibility Effective whe primary preset Earlier awareess of dropped track, aidig detectio ad respose Possible earlier detectio tha by ATCO OPERATIONAL SCENARIOS: MB16: Collisio avoidace via procedural cotrol MB17: Cotroller advisory to other aircraft MITIGATION BARRIERS MB18: Recalibratio of groudbased safety ets MB19: See-adavoid practiced by aircraft MB20: Collisio avoidace system MB21: Improvemet of collisio avoidace system behaviours T1-S1 - Loss of separatio due loss of all track iformatio o oe aircraft causig iappropriate plaig No impact o plaig /a /a Limited effectiveess for CAT If loss due to traspoder failure, CAS do ot operate /a T1-S2 - Loss of separatio due loss of all track iformatio o oe aircraft impactig tactical cotrol If detected by ATCO /a /a Limited effectiveess for CAT If loss due to traspoder failure, CAS do ot operate /a 26

27 5.5 Summary of mitigatig barriers (failure mode T1) MB01 MB02 MB03 MB04 MB05 MB06 MB07 MB08 MB09 MB10 MB11 MB12 MB13 MB14 MB15 MB16 MB17 MB18 MB19 MB20 MB21 T1-S1 T1-S2 Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

28 CHAPTER 6 - FAILURE MODES A, S & C 6.1 Summary of mitigatig barriers (failure mode T1) Traffic forecast Failure mode A3 assumes that the Mode A code has bee corrupted due to errors i the traspoder or data registers. Pilot iput of icorrect Mode A is icluded i aother failure mode (ot aalysed). The Mode A code could be corrupt durig the etire duratio of the flight (e.g. a software error i the traspoder, udetected o first cotact) or could become corrupted durig flight. It is importat to ote that a corrupted Mode A may icrease the likelihood of a duplicate Mode A sceario occurrig at the same time. The impact of a corrupt Mode A code will be highly depedet o the ATM system i use. For systems which use codecallsig correlatio, there may be a reliace o the code to esure correct correlatio with the flight pla, thus leadig to more serious cosequeces if the code is corrupt. Other systems use a weightig factor, particularly whe the 24-bit aircraft address is preset i these cases, the Mode A code corruptio may ot have a discerable impact as the system would correlate ad track usig the 24-bit aircraft address primarily. Barrier Model Barriers Affected Possible scearios Desig ad strategic plaig Noe Noe Demad ad capacity balacig Noe Noe Traffic plaig ad sychroisatio Tactical coflict maagemet ATC collisio avoidace Crew collisio avoidace Cotroller tools - corrupt Mode A code may impact cotroller tools used for plaig ad sychroisatio such as MTCD or AMAN/DMAN. A severe impact is ulikely sice the tools primarily use flight pla data, but cofusio i the system arisig from duplicated Mode A codes may lead to track swaps ad geerate iaccurate predictios. ATCO - Cotroller cofusio could result from o-valid idetity beig show (or o idetity iformatio, depedig o the system), ad durig a sequecig (sychroisatio) task, this could lead to overloadig or the ATCO calculatig a iappropriate solutio. Cotroller tools - Cotroller tools reliat o effective aircraft idetity ad flight pla correlatio could be impacted by a corrupt Mode A code. This icludes tools which check adherece (coformace) with a cleared route. ATCO - A corrupt Mode A code could icrease a cotroller s workload, sice it may lead to a missig aircraft ID or a icorrect aircraft ID o the CWP. I extremis, this could lead to the icorrect aircraft receivig a istructio or clearace, potetially leadig to a loss of separatio. ATCO - i commo with the tactical coflict maagemet barriers, a loss or corruptio of aircraft ID may lead to reduced effectiveess of the ATCO providig collisio avoidace istructios or clearaces. It is ot thought that safety ets would be impacted, except i the case where the Mode A code is corrupted to become a code which is excluded by the safety ets (e.g. VFR or military codes). No impact ACAS ad other CAS are ot reliat o the Mode A code. A3-S1 - Loss of separatio due loss of all track iformatio o oe aircraft due corrupted Mode A code causig iappropriate plaig. A3-S2 - Loss of separatio due track swap betwee two aircraft due corrupted Mode A code causig iappropriate plaig. A3-S3 - Loss of separatio due o-valid idetity displayed due corrupted Mode A code causig iappropriate plaig. A3-S4 - Loss of separatio due loss of all track iformatio o oe aircraft due corrupted Mode A code impactig tactical cotrol. A3-S5 - Loss of separatio due track swap betwee two aircraft due corrupted Mode A code leadig to wrog aircraft receivig istructio. A3-S6 - Loss of separatio due o-valid idetity displayed due corrupted Mode A code leadig to additioal workload. 28

29 6.1.2 Scearios for failure mode C2: Itermittet Mode C Failure mode C2 assumes that the Mode C sigal is itermittet. This factors situatios icludig techical failures withi the avioics ad radar detectio failures. A itermittet mode C could lead to the followig problems at the Cotrollers Workig Positio, depedet o the exact ATM system processig: Complete loss of track (track dropped as system cosiders it ivalid, or whe the aircraft is over a aerodrome ad the system assumes the track has bee termiated as if the aircraft has laded); Normal display of track, but with o altitude iformatio i the label; Aircraft assumed to be at all heights i the system, creatig blocked cylider of airspace at all flight levels (ad thus uisace alerts). The table below outlies the barriers impacted by the failure mode C2, ad defies potetial operatioal scearios which may result. Barrier Model Barriers Affected Possible scearios Desig ad strategic plaig Demad ad capacity balacig Traffic plaig ad sychroisatio Tactical coflict maagemet ATC collisio avoidace Crew collisio avoidace Noe Noe Cotroller tools - Tools such as Medium Term Coflict Detectio (MTCD) may be affected by a itermittet Mode C failure. Some MTCD desigs use a mixture of plaed ad track data to carry out periodical updates of the plaed trajectory thus altitude data beig out of date may have a impact o the accuracy of the coflict detectio fuctios, leadig to iappropriate plaig ad potetial extra workload durig the executio phase. I limited cases, it has bee see that the MTCD tool assumes the aircraft is at all altitudes if it loses altitude iformatio - this leads to may uisace alerts. ATCO - Exact impact is depedet o the local ATM system (see above). If altitude is dropped from the label whe itermittet, cotroller is likely to otice before issuig ay istructios or clearaces to the aircraft i questio. The Mode A would be retaied as a idetifier, potetially squawkig 0000 to idicate traspoder malfuctio. Havig detected the issue, flight progress strips (electroic or paper) or voice reportig of altitude may help the cotroller to udertake the tactical coflict maagemet task. If the altitude is latet (i.e. show as out-of-date, e.g. coasted), this may lead to iappropriate istructios or clearaces beig give. Primary Radar Track may be show o the scree with o SSR track (if the system validates the secodary surveillace based track as ivalid due to the itermittet Mode C iformatio); this would alert the cotroller to a lost track. This is depedet o the system. Cotroller tools - Adherece or coformace moitorig tools may be able to moitor agaist a) cleared level ad b) height of restricted areas, to esure a flight is proceedig accordig to clearaces ad agreed flight plas. These barriers effectiveess may be impacted by itermittet Mode C. Groud-based safety ets usig itermittet Mode C will lead to either too may false alerts, or missed alerts. Also, if a alert is geerated correctly, ad Mode C is lost, the alert may termiate too early, leadig to icorrect actio o behalf of the cotroller. ATCO - the cotroller s ability to provide accurate collisio avoidace istructios i the vertical dimesio would be hidered by itermittet altitude data, particularly if it is show as icorrect o the CWP. Airbore safety ets ACAS II will be able to form a TA without Mode C, but ot a RA. If the Mode C is itermittet, RAs may ed prematurely or be geerated with a delay. Other collisio avoidace system performace may vary. C2-S1 - Loss of separatio due itermittet Mode C causig icorrect plaed trajectory leadig to additioal workload. C2-S1 - Loss of separatio due itermittet Mode C leadig to icorrect altitude data C2-S1 - Loss of separatio due itermittet Mode C causig uisace or false alerts leadig to additioal workload Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

30 6.1.3 Scearios for failure mode S4: Duplicated Mode S 24-bit address Failure mode S4 assumes that duplicated Mode S 24-bit addresses are set. Whilst this may seem ulikely, the block allocatio of addresses to aircraft withi a State meas that occasioally this does occur whe two of these aircraft are withi the same airspace, particularly with ewly delivered or registered aircraft. Aother cause might be the trasfer of a traspoder from oe aircraft to aother, without re-settig addresses (where these are itegrated with the traspoder box). This also icludes techical failures withi the avioics. The impact of the duplicated Mode S 24-bit address would deped o the local ATM system. A track may be dropped (as it assumed to be a ghost track eve if two valid flight plas exist), ever iitiated, or swapped. The ATM system may also have validatio fuctios that will alert the cotroller to the issue, for example otig that the track of oe of the aircraft does ot coform to the flight pla route, or that o correlatio has take place. If the track is ever iitiated, for example whe eterig ito coverage of a ew system, the track may still appear o the adjacet system s sector. Barrier Model Barriers Affected Possible scearios Desig ad strategic plaig Noe Demad ad capacity balacig Traffic plaig ad sychroisatio Tactical coflict maagemet ATC collisio avoidace Crew collisio avoidace Noe Cotroller tools - If a track is dropped or ot iitiated, the cotroller tools could be less effective, havig to rely o remaiig flight pla data (ad/ or maual iputs). The correlatio of tracks to flight pla data may be impacted. ATCO - A duplicated 24-bit address could lead to ATCO s performig iappropriate plaig ad sequecig tasks, particularly i the case of a swapped track situatio. If the iformatio used to pla or sequece is icorrect the solutio is likely to be wrog. Cotroller tools - Ieffectiveess of existig tools due to either oe track beig filtered, ever iitiated, or track swap. This icludes o-correlatio with flight pla data. This would affect tools such as coformace/adherece moitorig. ATCO - All potetial outcomes will reduce the effectiveess of the cotroller s tactical coflict maagemet. The impact of lost tracks may deped o the detectability (system moitorig/validatio ad alertig), whilst the track swap may lead to icorrect clearaces ad istructios beig give. Safety ets - Groud-based safety ets will be impacted by a duplicated 24-bit address. A track swap would still allow warigs ad alerts to be give, but potetially cause cofusio over the correct course of actio. A dropped (lost) track at system level (prior to iput to the safety et) could reder the safety ets ieffective for that aircraft ad others i the viciity. ATCO - the cotroller s ability to provide istructios regardig collisio avoidace would be reduced if the track was dropped or swapped. I may cases, the barrier would be redered ieffective. Airbore tools - Collisio Avoidace Systems, e.g. ACAS, are likely to be compromised where idetical 24-bit addresses are preset. If aother aircraft has the same 24-bit address as owship, the track will be filtered. Where two other aircraft i the airspace have the same 24-bit address, the aircraft furthest from owship would be suppressed (i.e. o TAs or RAs). S4-S1 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, causig iappropriate plaig. S4-S2 - Loss of separatio due duplicated Mode S 24-bit address causig detected dropped track, leadig to additioal workload. S4-S2 - Loss of separatio due duplicated Mode S 24-bit address causig dropped track. S4-S3 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, leadig to wrog aircraft beig give istructio. S4-S2 - Loss of separatio due duplicated Mode S 24-bit address causig dropped track. S4-S3 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, leadig to wrog aircraft beig give istructio. 30

31 6.2 List of resultat scearios (failure modes A, S ad C) The full list of operatioal scearios defied is show below. I each case, it is recogised that a loss of separatio may lead to a more severe outcome (i.e. accidet). Nevertheless, for the purposes of this report, idetifyig the loss of separatio is adequate sice the resultat barrier effectiveess is still applicable. I certai circumstaces, the dysfuctioal traspoder could impact the probability of a differet ed risk; that of Cotrolled Flight Ito Terrai (CFIT). This would occur if the cotroller gave the wrog aircraft a clearace, takig it below the MSA (Miimum Safe Altitude) ad towards terrai. Moder commercial aircraft systems should reder the likelihood of this egligible, sice all aircraft with Flight Maagemet Systems would cotai mitigatios i case of vectorig below MSA. As a last resort, the Groud Proximity Warig Systems (airbore) ad Miimum Safe Altitude Warig cotroller safety ets should prevet a accidet. The umber ad detail of scearios may seem excessive for this operatioal safety study. However, as the traspoder errors ad dysfuctios lead to very specific operatioal impacts at the CWP level, it was cosidered useful to highlight the specific chai of evets as the effective mitigatios may differ i each case. For some scearios, specific operatioal evets (icidets or occurrece reports) are available to highlight the validity of the sceario. These are described i detail i Appedix A. This is ot true for all scearios i some cases, expert judgemet has bee used to derive the feasible sceario. ID A3-S1 A3-S2 A3-S3 A3-S4 A3-S5 A3-S6 C2-S1 C2-S2 C2-S3 S4-S1 S4-S2 S4-S3 Sceario descriptio Loss of separatio due loss of all track iformatio o oe aircraft due corrupted Mode A code causig iappropriate plaig Loss of separatio due track swap betwee two aircraft due corrupted Mode A code causig iappropriate plaig Loss of separatio due ivalid idetity displayed due corrupt Mode A code causig iappropriate plaig Loss of separatio due loss of all track iformatio for oe aircraft due corrupt Mode A code impactig tactical cotrol Loss of separatio due track swap betwee two aircraft due corrupt Mode A code leadig to wrog aircraft receivig istructio Loss of separatio due ivalid idetity displayed due corrupt Mode A code leadig to additioal workload Loss of separatio due itermittet Mode C causig icorrect plaed trajectory leadig to additioal workload Loss of separatio due itermittet Mode C leadig to icorrect altitude data used Loss of separatio due itermittet Mode C causig uisace or false alerts leadig to additioal workload Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, causig iappropriate plaig Loss of separatio due duplicated Mode S 24-bit address causig dropped track Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, leadig to wrog aircraft beig give istructio Followig further aalysis of the operatioal evets, it is recommeded that these scearios are re-visited to uderstad the oes highlightig the greatest risk to operatios. Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

32 6.3 Barriers to mitigate corrupt Mode A code (failure mode A3) Barrier Model Repairable barriers Existig or ew barriers Desig ad strategic plaig Demad ad capacity balacig Traffic plaig ad sychroisatio Tactical coflict maagemet ATC collisio avoidace Crew collisio avoidace MB04: Applicatio of traspoder validatio procedures o first cotact - O first radar cotact with a aircraft, the ATCO should validate the traspoder fuctio, icludig e.g. operatio, Mode A code ad Mode C operatio. This could iclude o start-up or departure. The thoroughess of completio of this procedure could be improved for certai sectors or eviromets. MB05: Weighted use of all Aircraft ID sources i ATC system - Moder ATC systems use a combiatio of aircraft IDs, primarily Mode A code ad Mode S 24-bit address (but also aircraft callsig) to correlate a track. Weightigs ca be applied per idetificatio elemet. Implemetig this would reduce the likelihood of a corrupt (or duplicated) Mode A code causig a track loss, drop or swap. Noe Noe MB12: Regular scaig by ATCO - The cotroller should maitai a effective regular sca (e.g. to be able to detect o-alerted dropped tracks), rather tha solely rely o first cotact procedures. This also applies to detectio of icorrect aircraft beig give a clearace (due ivalid correlatio). There is some debate as to the effectiveess of this barrier sice, i e-route cotrolled airspace, strip maagemet is traditioally the primary meas of decoflictio. MB13: Use of primary radar data - If available, this ca be used to maitai a correlated track to support tactical coflict maagemet i the evet of a loss of secodary surveillace iformatio due corrupt Mode A code. Note that this may be assisted by cooperatio with the military, allowig the sharig of primary radar data. Noe Noe MB01: Airspace desig gives positive separatio - This icludes the systematic separatio of aircraft usig de-coflicted RNAV/RNP based routes. Free-route airspace may reduce the effectiveess of this barrier. MB03: Appropriate ATC system desig ad calibratio - For a corrupted Mode A code, desig ad calibratio of effective tools for alertig ATCOs i the evet of: a dropped track (across oe or more sectors); or a o-correlated track (i.e. without flight pla data); or a duplicated (split) track. Further effective alerts for whe a Mode A code is detected as beig chaged or duplicated. MB08: Sector capacity plaig - Esurig that the umber of aircraft the cotroller ca hadle if a track is lost is appropriate i.e. esurig that sector capacity limits are appropriate by sesitivity aalysis of track drop scearios. MB11: Sector-sector coordiatio - The upstream sector may ot have duplicated Mode A, ad therefore may have correlated tracks, ad be able to assist with plaig. MB14: Alert for chage i track status - Ay chage of track status should be alerted to the cotroller. This icludes the loss of traspoder iformatio (i.e. primary oly, or flight pla track), or the total loss of a track. Alertig improves the detectability. This is also applicable for multiple sectors, i.e. also alertig the ext sector the aircraft is due to eter. MB15: Collisio avoidace via procedural cotrol - Use of altitude iformatio acquired through voice reportig to achieve vertical separatio. MB18: See ad avoid practiced by aircraft - This could iclude the executive cotroller actively ecouragig the aircraft to see-ad-avoid through iformig them of the track loss situatio (if detected) ad otifyig them of proximate aircraft s approximate or last kow positio. The effectiveess of see-ad-avoid for Commercial Air Trasport is ot thought to be high, particularly where there is o idicatio of the other aircraft through other meas (e.g. via TCAS display or through party-lie situatioal awareess). MB19: Collisio avoidace system - The airbore Collisio Avoidace System (e.g. TCAS) should cotiue to alert o aircraft with corrupt Mode A codes. 32

33 6.4 Barriers to mitigate itermittet Mode C (failure mode C2) This sectio presets a umber of barriers, ether previously idetified barriers that are repairable, or etirely ew oes that ca be used to mitigate the effect of a aircraft with itermittet Mode C. Barrier Model Repairable barriers Existig/Possible ew barriers Desig ad strategic plaig Demad ad capacity balacig Traffic plaig ad sychroisatio Tactical coflict maagemet MB04: Applicatio of traspoder validatio procedures o first cotact - O first radar cotact with a aircraft, the ATCO should validate the traspoder fuctio, icludig e.g. operatio, Mode A code ad Mode C operatio. This could iclude o start-up or departure. The thoroughess of completio of this procedure could be improved for certai sectors or eviromets. MB06: Aomaly reportig ad effective respose - Esurig that curret procedures o aomaly reportig are effectively followed ad actioed. Noe MB09: More effective flight pla data - This icludes cotiued appreciatio of the importace of flight pla (strip) based decoflictio, ad the use of cleared levels. As the use of trajectory predictio tools becomes more critical, the effectiveess of these tools i case of o-omial scearios should be esured. For example, the MTCD could be recalibrated i case of itermittet Mode C so that tracks that are ot show at every altitude i the case of periodical updates. Istead, the update should potetially rely o the flight pla altitude. Cotroller updates (via level chages ito e.g. electroic flight strips) could also be iput. MB12: Regular scaig by ATCO - The cotroller should maitai a effective regular sca (e.g. to be able to detect o-alerted dropped tracks), rather tha solely rely o first cotact procedures. This also applies to detectio of icorrect aircraft beig give a clearace (due ivalid correlatio). There is some debate as to the effectiveess of this barrier sice, i e-route cotrolled airspace, strip maagemet is traditioally the primary meas of decoflictio. MB13: Use of primary radar data - If available, this ca be used to maitai a correlated track to support tactical coflict maagemet i the evet of a loss of secodary surveillace iformatio. Note that this may be assisted by cooperatio with the military, allowig the sharig of primary radar data. MB15: Crew detectio of traspoder failure - Existig alerts are icorporated o most commercial aircraft, but may ot be immediately oticeable i flight (e.g. Embraer Legacy- B737 accidet i Brazil). Fail-safe idicatios of traspoder failures or malfuctios, if detected, should be give to the flight crew. MB01: Airspace desig gives positive separatio -This icludes the systematic separatio of aircraft usig de-coflicted RNAV/RNP based routes. Free-route airspace may reduce the effectiveess of this barrier. MB02: Procedure desig for traspoder malfuctio - Specific procedures should be desiged ad traied o i the evet of itermittet Mode C beig detected, for example squawkig 0000 for malfuctioig traspoder, ad the ATCO usig cleared flight level iputs to show curret level. If Mode C is ot available, the aircraft should also be cleared out of RVSM airspace. MB03: Appropriate ATC system desig ad calibratio - For itermittet Mode C, this refers to stadards, local specificatio ad calibratio esurig the effectiveess of groud-based safety ets (ad MTCD) to hadle itermittet mode C. The track should ot be judged ivalid i the evet of itermittet Mode C. MB08: Sector capacity plaig - Esurig that the umber of aircraft the cotroller ca hadle if a track is lost is appropriate i.e. esurig that sector capacity limits are appropriate by sesitivity aalysis of track drop scearios. Noe MB14: Alert for chage i track status - Ay chage of track status should be alerted to the cotroller. This icludes the loss of traspoder iformatio (i.e. primary oly, or flight pla track), or the total loss of a track. Alertig improves the detectability. This is also applicable for multiple sectors, i.e. also alertig the ext sector the aircraft is due to eter. Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

34 ATC collisio avoidace Crew collisio avoidace MB18: Recalibratio of groud-based safety ets - There are two optios where the safety et assumes the aircraft is at all altitudes where Mode C is lost. Some may prefer to limit the umber of uisace alerts by ihibitig the fuctioality whe a aircraft is ot reportig Mode C, whilst others would prefer ot to ihibit, ad thus to deal with uisace alerts give the potetial beefit from receptio of the valid alert. Noe MB16: Collisio avoidace via procedural cotrol - Use of altitude iformatio acquired through voice reportig to achieve vertical separatio. MB17: Cotroller advisory to other aircraft - If detected, the ATCO could provide a advisory to all other aircraft o frequecy of the o-operatioal Mode C aircraft, so that they uderstad that TCAS RAs will ot be iitiated. MB19: See ad avoid practiced by aircraft - This could iclude the executive cotroller actively ecouragig the aircraft to see-ad-avoid through iformig them of the track loss situatio (if detected) ad otifyig them of proximate aircraft s approximate or last kow positio. The effectiveess of see-ad-avoid for Commercial Air Trasport is ot thought to be high, particularly where there is o idicatio of the other aircraft through other meas (e.g. via TCAS display or through party-lie situatioal awareess). MB20: Collisio avoidace system - The airbore Collisio Avoidace System (e.g. TCAS) will provide Traffic Advisories oly o aircraft ot sedig Mode C reports. The flight crew s awareess will be improved with solely TAs, but they must be aware of the lost Mode C iformatio to react o the TA appropriately (without waitig for a RA). 6.5 Barriers to mitigate duplicated Mode S 24-bit address (failure mode S4) This sectio presets a umber of barriers, ether previously idetified barriers that are repairable, or etirely ew oes that ca be used to mitigate the effect of a aircraft with itermittet Mode C. Barrier Model Repairable barriers Existig/Possible ew barriers Desig ad strategic plaig Demad ad capacity balacig MB05: Weighted use of all Aircraft ID sources i ATC system - Moder ATC systems use a combiatio of aircraft IDs, primarily Mode A code ad Mode S 24-bit address (but also aircraft callsig) to correlate a track. Weightigs ca be applied per idetificatio elemet. Implemetig this would reduce the likelihood of a duplicated Mode S 24-bit address causig a udetected track drop or split. MB06: Aomaly reportig ad effective respose - Esurig that curret procedures o aomaly reportig are effectively followed ad actioed. Noe MB03: Appropriate ATC system desig ad calibratio - I the case of duplicated Mode S 24-bit address, this icludes effective stadards, specificatios ad calibratio for STCA to hadle duplicated addresses without loss of fuctio. It also icludes the effective alertig of dropped tracks (e.g. due to duplicatio), ad alertig if the aircraft is ot coformig to its flight pla route (e.g. if correlated with a icorrect track). MB07: Maiteace procedures for traspoder - Appropriate oversight of maiteace (particularly for leased aircraft betwee States). Swappig traspoders betwee aircraft should iclude specific quality checks o 24-bit address. MB08: Sector capacity plaig - Esurig that the umber of aircraft the cotroller ca hadle if a track is lost is appropriate i.e. esurig that sector capacity limits are appropriate by sesitivity aalysis of track drop scearios. 34

35 Traffic plaig ad sychroisatio Tactical coflict maagemet ATC collisio avoidace Crew collisio avoidace Noe MB12: Regular scaig by ATCO - The cotroller should maitai a effective regular sca (e.g. to be able to detect o-alerted dropped tracks), rather tha solely rely o first cotact procedures. This also applies to detectio of icorrect aircraft beig give a clearace (due ivalid correlatio). There is some debate as to the effectiveess of this barrier sice, i e-route cotrolled airspace, strip maagemet is traditioally the primary meas of decoflictio. Noe MB21: Improvemet of collisio avoidace system behaviours - Two situatios are defied: Coflict betwee owship ad aother aircraft with duplicated Mode S address ACAS curretly igores ay duplicated Mode S. All other aircraft (with o-duplicated Mode S) are alerted upo as ormal. A workaroud for this is ot available but could be ivestigated. Coflict betwee owship, ad two or more other aircraft with duplicated Mode S addresses Aother issue is that, if ACAS sees two or more surveillace tracks with the same Mode S 24- bit address, oly the track closest i rage shall be retaied. This may mea that a potetial RA is suppressed agaist the furthest aircraft with the same Mode S 24-bit address. MB10: Use of voice reportig - Use of voice reportig is particularly relevat as a barrier durig sector hadover, whe defied procedures may be followed. If silet hadover is used, this barrier may ot be applicable. If the ATCO has detected the track drop/loss, it may also be used withi a sector for improved situatioal awareess. MB11: Sector-sector coordiatio - The upstream sector may ot see duplicated Mode S 24-bit addresses, ad therefore may have correctly correlated tracks, ad may be able to assist with plaig. MB14: Alert for chage i track status - Ay chage of track status should be alerted to the cotroller. This icludes the loss of traspoder iformatio (i.e. primary oly, or flight pla track), or the total loss of a track. Alertig improves the detectability. This is also applicable for multiple sectors, i.e. also alertig the ext sector the aircraft is due to eter. MB16: Collisio avoidace via procedural cotrol - Use of altitude iformatio acquired through voice reportig to achieve vertical separatio, if track swap or drop detected by ATCO. MB19: See ad avoid practiced by aircraft - This could iclude the executive cotroller actively ecouragig the aircraft to see-ad-avoid through iformig them of the track loss situatio (if detected) ad otifyig them of proximate aircraft s approximate or last kow positio. The effectiveess of see-ad-avoid for Commercial Air Trasport is ot thought to be high, particularly where there is o idicatio of the other aircraft through other meas (e.g. via TCAS display or through party-lie situatioal awareess). Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

36 6.6 Matrix of scearios ad barrier effectiveess (failure modes A, S ad C) Gree deotes a high barrier effectiveess (i.e. prevets the loss of separatio almost every time). Yellow deotes a depedet barrier effectiveess (i.e. oly effective some of the time). Red deotes a low barrier effectiveess (i.e. ot effective for a particular sceario). White deotes a o-applicable barrier (i.e. caot judge effectiveess, as it is i o way relevat for the failure mode). MITIGATION BARRIERS OPERATIONAL SCENARIOS: MB01: Airspace desig gives positive separatio MB02: Procedure desig for traspoder malfuctio MB03: Appropriate ATC system desig ad calibratio MB04: Applicatio of traspoder validatio procedures o first cotact MB05: Weighted use of all aircraft ID sources i ATC system A3-S1 - Loss of separatio due loss of all track iformatio o oe aircraft due corrupted Mode A code causig iappropriate plaig Assumig desig is utilised (e.g. ot free-route) Aids ATCO detectio If traspoder failure is pre-flight or at first cotact Avoids issues due to code-callsig correlatio A3-S2 - Loss of separatio due track swap betwee two aircraft due corrupted Mode A code causig iappropriate plaig Wrog a/c may be cleared - ot always effective /a Aids ATCO detectio through alert Aids ATCO detectio i some cases May mitigate likelihood of track swap A3-S3 - Loss of separatio due ivalid idetity displayed due corrupt Mode A code causig iappropriate plaig Wrog a/c may be cleared - ot always effective /a Not effective if ivalid idetity displayed Aids ATCO detectio i some cases Ca prevet ivalid idetity A3-S4 - Loss of separatio due loss of all track iformatio for oe aircraft due corrupt Mode A code impactig tactical cotrol Assumig desig is utilised (e.g. ot free-route) If detected by ATCO Aids ATCO detectio through alert Aids ATCO detectio i some cases Ca prevet track drop (by establishig valid idetity) A3-S5 - Loss of separatio due track swap betwee two aircraft due corrupt Mode A code leadig to wrog aircraft receivig istructio Wrog a/c may be cleared - ot always effective /a Aids ATCO detectio Aids ATCO detectio i some cases May mitigate likelihood of track swap A3-S6 - Loss of separatio due ivalid idetity displayed due corrupt Mode A code leadig to additioal workload Wrog a/c may be cleared - ot always effective /a Not effective if ivalid idetity displayed Aids ATCO detectio i some cases Ca prevet ivalid idetity C2-S1 - Loss of separatio due itermittet Mode C causig icorrect plaed trajectory leadig to additioal workload If detected by ATCO Effective desig ad reversio to flight pla data /a C2-S2 - Loss of separatio due itermittet Mode C leadig to icorrect altitude data used Depedet o geometry ad airspace If detected by ATCO /a C2-S3 - Loss of separatio due itermittet Mode C causig uisace or false alerts leadig to additioal workload Depedet o geometry ad airspace If detected by ATCO Icreases effectiveess of detectio /a S4-S1 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, causig iappropriate plaig Wrog a/c may be cleared - ot always effective /a May alert if a/c does ot coform to flight pla Aids ATCO detectio Depedet o weightig (assumig 24-bit takes priority) S4-S2 - Loss of separatio due duplicated Mode S 24-bit address causig dropped track Assumig desig is utilised (e.g. ot freeroute), ad depedet o geometry of airspace If detected by ATCO Alerts dropped track if detected Aids ATCO detectio Depedet o weightig (assumig 24-bit takes priority) S4-S3 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, leadig to wrog aircraft beig give istructio Wrog a/c give istructio /a May alert if a/c does ot coform to flight pla Aids ATCO detectio Depedet o weightig (assumig 24-bit takes priority) 36

37 MITIGATION BARRIERS OPERATIONAL SCENARIOS: MB06: Aomaly reportig ad effective respose MB07: Maiteace procedures for traspoder MB08: Appropriate ATC system desig ad calibratio MB09: More effective flight pla data MB10: Use of voice reportig A3-S1 - Loss of separatio due loss of all track iformatio o oe aircraft due corrupted Mode A code causig iappropriate plaig /a /a Mitigates loss of separatio due workload More effective use of flight pla based plaig Improves detectability A3-S2 - Loss of separatio due track swap betwee two aircraft due corrupted Mode A code causig iappropriate plaig /a /a Mitigates loss of separatio due workload No impact Improves detectability A3-S3 - Loss of separatio due ivalid idetity displayed due corrupt Mode A code causig iappropriate plaig /a /a Mitigates loss of separatio due workload Possible improved detectio of ivalid idetity Improves detectability A3-S4 - Loss of separatio due loss of all track iformatio for oe aircraft due corrupt Mode A code impactig tactical cotrol /a /a If detected, ca mitigate workload impacts No impact for plaig tools Improves detectability A3-S5 - Loss of separatio due track swap betwee two aircraft due corrupt Mode A code leadig to wrog aircraft receivig istructio /a /a May assist detectig wrog istructio (ATCO ot too busy) No impact Improves detectability A3-S6 - Loss of separatio due ivalid idetity displayed due corrupt Mode A code leadig to additioal workload /a /a May assist detectig wrog istructio (ATCO ot too busy) No impact Improves detectability C2-S1 - Loss of separatio due itermittet Mode C causig icorrect plaed trajectory leadig to additioal workload If o-goig /a Mitigates loss of separatio due workload Effective updates i tool reduce workload No impact C2-S2 - Loss of separatio due itermittet Mode C leadig to icorrect altitude data used If o-goig /a No impact May assist detectio Potetial updates o altimeter readigs if detected C2-S3 - Loss of separatio due itermittet Mode C causig uisace or false alerts leadig to additioal workload If o-goig /a Mitigates loss of separatio due workload Could override Mode C iformatio usig cleared flight levels No impact S4-S1 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, causig iappropriate plaig If o-goig Prevetative, but also o-goig Prevetative, but also o-goig Mitigates loss of separatio due workload No impact Improves detectability S4-S2 - Loss of separatio due duplicated Mode S 24-bit address causig dropped track If o-goig Prevetative, but also o-goig Prevetative, but also o-goig Mitigates loss of separatio due workload (if detected) No impact Improves detectability S4-S3 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, leadig to wrog aircraft beig give istructio If o-goig Prevetative, but also o-goig Prevetative, but also o-goig May assist detectig wrog istructio (ATCO ot too busy) No impact Improves detectability Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

38 MITIGATION BARRIERS OPERATIONAL SCENARIOS: MB11: Sector-sector coordiatio MB12: Regular scaig by ATCO MB13: Use of primary radar data MB14: Alert for chage i track status MB15: Crew detectio of traspoder failure A3-S1 - Loss of separatio due loss of all track iformatio o oe aircraft due corrupted Mode A code causig iappropriate plaig Improved situatioal awareess from adjacet sector No impact Effective whe primary preset Earlier awareess of dropped track /a A3-S2 - Loss of separatio due track swap betwee two aircraft due corrupted Mode A code causig iappropriate plaig Improved detectio of swap from adjacet sector No impact Not likely to be effective i mitigatig track swap Depedet o timig of track swap /a A3-S3 - Loss of separatio due ivalid idetity displayed due corrupt Mode A code causig iappropriate plaig Improved situatioal awareess from adjacet sector No impact Effective whe primary preset Depedet o timig of chage i Mode A code /a A3-S4 - Loss of separatio due loss of all track iformatio for oe aircraft due corrupt Mode A code impactig tactical cotrol Improved detectio ad situatioal awareess from adjacet sector Limited effectiveess If primary radar preset Earlier awareess of dropped track (detectio) /a A3-S5 - Loss of separatio due track swap betwee two aircraft due corrupt Mode A code leadig to wrog aircraft receivig istructio Improved detectio of swap from adjacet sector Limited effectiveess Not likely to be effective i mitigatig track swap Depedet o timig of track swap /a A3-S6 - Loss of separatio due ivalid idetity displayed due corrupt Mode A code leadig to additioal workload Improved situatioal awareess from adjacet sector Limited effectiveess Effective whe primary preset Depedet o timig of chage i Mode A code /a C2-S1 - Loss of separatio due itermittet Mode C causig icorrect plaed trajectory leadig to additioal workload C2-S2 - Loss of separatio due itermittet Mode C leadig to icorrect altitude data used No impact No impact No impact No impact If detected i time by flight crew No impact Limited effectiveess No impact No impact If detected i time by flight crew C2-S3 - Loss of separatio due itermittet Mode C causig uisace or false alerts leadig to additioal workload No impact Limited effectiveess No impact No impact If detected i time by flight crew S4-S1 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, causig iappropriate plaig Improved detectio of swap from adjacet sector Limited effectiveess Not likely to be effective i mitigatig track swap Depedet o timig of track swap /a S4-S2 - Loss of separatio due duplicated Mode S 24-bit address causig dropped track Improved situatioal awareess from adjacet sector Limited effectiveess i detectig failure Effective whe primary preset Earlier awareess of dropped track /a S4-S3 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, leadig to wrog aircraft beig give istructio Improved detectio of swap from adjacet sector Limited effectiveess Not likely to be effective i mitigatig track swapt Depedet o timig of track swap /a 38

39 MITIGATION BARRIERS OPERATIONAL SCENARIOS: MB16: Aomaly reportig ad effective respose MB17: Maiteace procedures for traspoder MB18: Appropriate ATC system desig ad calibratio MB19: More effective flight pla data MB20: Use of voice reportig MB21: Improvemet of collisio avoidace system behaviours A3-S1 - Loss of separatio due loss of all track iformatio o oe aircraft due corrupted Mode A code causig iappropriate plaig No impact o plaig /a /a Limited effectiveess for CAT CAS do ot use Mode A code still effective /a A3-S2 - Loss of separatio due track swap betwee two aircraft due corrupted Mode A code causig iappropriate plaig No impact o plaig /a /a Limited effectiveess for CAT CAS do ot use Mode A code still effective /a A3-S3 - Loss of separatio due ivalid idetity displayed due corrupt Mode A code causig iappropriate plaig No impact o plaig /a /a Limited effectiveess for CAT CAS do ot use Mode A code still effective /a A3-S4 - Loss of separatio due loss of all track iformatio for oe aircraft due corrupt Mode A code impactig tactical cotrol If detected by ATCO /a /a Limited effectiveess for CAT CAS do ot use Mode A code still effective /a A3-S5 - Loss of separatio due track swap betwee two aircraft due corrupt Mode A code leadig to wrog aircraft receivig istructio Depedet o ATCO detectio of icorrect istructio /a /a Limited effectiveess for CAT CAS do ot use Mode A code still effective /a A3-S6 - Loss of separatio due ivalid idetity displayed due corrupt Mode A code leadig to additioal workload Depedet o ATCO detectio of icorrect istructio /a /a Limited effectiveess for CAT CAS do ot use Mode A code still effective /a C2-S1 - Loss of separatio due itermittet Mode C causig icorrect plaed trajectory leadig to additioal workload C2-S2 - Loss of separatio due itermittet Mode C leadig to icorrect altitude data used C2-S3 - Loss of separatio due itermittet Mode C causig uisace or false alerts leadig to additioal workload S4-S1 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, causig iappropriate plaig S4-S2 - Loss of separatio due duplicated Mode S 24-bit address causig dropped track S4-S3 - Loss of separatio due duplicated Mode S 24-bit address causig swapped tracks, leadig to wrog aircraft beig give istructio No impact o plaig No impact o plaig Effective if detected by ATCO Depedet o ATCO detectio of icorrect istructio Icreased effectiveess i dealig with itermittet Mode C No impact Reductio i uisace / false alerts Limited effectiveess for CAT Limited effectiveess for CAT Limited effectiveess for CAT /a /a Limited effectiveess for CAT /a /a Limited effectiveess for CAT /a /a Limited effectiveess for CAT No Resolutio Advisories o a/c ot sedig Mode C Traffic Advisories give some awareess No Resolutio Advisories o a/c ot sedig Mode C Traffic Advisories give some awareess No Resolutio Advisories o a/c ot sedig Mode C Traffic Advisories give some awareess Reductio i capability due filterig of duplicated 24-bit address track Reductio i capability due filterig of duplicated 24-bit address track Reductio i capability due filterig of duplicated 24-bit address track /a /a /a Mitigates issue of duplicated 24-bit address tracks Mitigates issue of duplicated 24-bit address tracks Mitigates issue of duplicated 24-bit address tracks Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

40 6.7 Summary of mitigatig barriers (failure modes A, S ad C) A3-S1 A3-S2 A3-S3 A3-S4 A3-S5 A3-S6 C2-S1 C2-S2 C2-S3 S4-S1 S4-S2 S4-S3 MB01 MB02 MB03 MB04 MB05 MB06 MB07 MB08 MB09 MB10 MB11 MB12 MB13 MB14 MB15 MB16 MB17 MB18 MB19 MB20 MB21 40

41 CHAPTER 7 - CONCLUSIONS AND RECOMMENDATIONS 7.1 Coclusios This study has looked at the impact of traspoder failure or dysfuctio o the operatio of ATC. It looks primarily at the boudary betwee techical iputs ad operatioal impact. Pre-operatioal prevetative barriers are cosidered to be out of scope, sice they refer to traspoder desig ad fuctioality. However, operatioal resposes to traspoder failures (e.g. aomaly reportig, ad o-goig maiteace) are icluded as they help mitigate future occurreces. The scearios were developed to help assess the combiatios of mitigatios ad their effectiveess for specific operatioal chais of evets. I all cases, a loss of separatio was assumed as the ed effect, without judgig the severity of this effect. It is oted that other risks may exist from a surveillace data chai failure, i particular udetected corruptio. It is possible that the cotroller could clear the aircraft ito terrai (e.g. by issues a iappropriate direct to clearace) or ito weather, causig CFIT or a loss of cotrol i flight. However, this was cosidered ulikely, sice the flight crew would have to igore their o-board systems ad situatioal awareess. The scearios were split ito two mai sectios: the total loss of a traspoder, ad the dysfuctio of a elemet of the traspoder (amely Mode A, Mode C, ad 24-bit Mode S address). The mitigatig barriers (MBs) arisig from the study were take from a combiatio of operatioal evet aalysis (through icidet/occurrece reports ad ivestigatios) ad expert judgemet. The barriers which remaied (partially) effective i the most scearios were: MB01: Airspace desig gives positive separatio. MB10: Use of voice reportig. MB19: See-ad-avoid practiced by aircraft. This is usurprisig, sice all the barriers above are idepedet of the surveillace data chai, ad therefore remai somewhat effective i spite of traspoder failure or dysfuctio. However, it is recogised that MB19 (see ad avoid) is oly slightly effective for Commercial Air Trasport; i recet studies (e.g. UK Airprox Board), it has bee show to assist i ucotrolled airspace, but has ot preveted recet mid-air collisios i cotrolled airspace for example Embraer Legacy B737 i Brazil. Strategic decoflictio of the airspace (MB01) remais oe of the most powerful barriers, sice if routes ever cross, a loss of surveillace should ot lead to ay icreased risk. However, this must be cosidered i the light of a pressure to allow aircraft to fly poit-to-poit at optimum climb ad descet profiles, givig icreased flexibility ad efficiecy, but also icreasig ATC system complexity. This tred may mea that strategic decoflictio of the airspace remais a dream i practical applicatio, eve with true 3D or 4D trajectory maagemet. Therefore, recogitio of the importace of these barriers alogside the traditioal surveillace-based safety ets is ecouraged, particularly where the safety ets are impacted by the failure of the traspoder. I particular, the evolutio of voice reportig, either o first cotact or as a procedural back-up, should be uderstood. For example, the use of silet hadover procedures may impact the effectiveess of sector hadover procedures at mitigatig traspoder failure or dysfuctio. Flight crew detectio of traspoder failure or malfuctio (Mode C) through a automated flight deck auciatio also appears to give a effective meas of detectig ad reactig to the failure. The desig of this auciatio has bee a issue i the past; it must be immediately detectable by the pilots as a critical fuctio of the aircraft. Recet desigs ad modificatios are takig this ito accout. Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

42 The barriers which remai most effective for the scearios associated with total loss of the traspoder were: MB03: Appropriate ATC system desig ad calibratio a effective tool for alertig ATCOs i the evet of: a dropped track (across oe or more sectors); or a o-correlated track (i.e. without flight pla data); or a track without secodary surveillace iformatio (i.e. primary oly, but still correlated) MB10: Use of voice reportig. The barriers which remai most effective for the scearios associated with corrupted Mode A were: MB05: Weighted use of all Aircraft ID sources i ATC system. MB10: Use of voice reportig. MB20: Collisio avoidace system. The barriers which remai most effective for the scearios associated with itermittet Mode C were: MB04: Applicatio of traspoder validatio procedures o first cotact. MB09: More effective flight pla data Particularly, the MTCD could be recalibrated i case of itermittet Mode C so that tracks that are ot show at every altitude i the case of periodical updates. Istead, the update should potetially rely o the flight pla altitude. MB17: Cotroller advisory to other aircraft. The barriers which remai most effective for the scearios associated with duplicated Mode S 24-bit address were: MB07: Maiteace procedures for traspoder. MB10: Use of voice reportig. MB21: Improvemet of collisio avoidace system behaviours. For may other barriers, the iterestig aspect is how specific they are to each failure mode. For example MB07: Maiteace procedures for traspoder ad MB21: Improvemets of Collisio Avoidace System behaviours are oly applicable to the duplicated 24-bit address failures. This suggests that a detailed aalysis of the failure modes ad operatioal impacts may be ecessary to ascertai the true effectiveess of the barriers icluded i the surveillace data chai. This is cosistet with the Europea legislatio requirig a safety assessmet o the ed-to-ed surveillace data chai. Also, for total loss of traspoder, the adequacy of existig barriers must be examied. Historically, a effective barrier has bee the presece of primary surveillace radar. This ow must be questioed, with may primary radars beig take out of service i the e-route eviromet. It is oted i the barrier descriptio that a improvemet i effectiveess could be sought through appropriate sharig of data with the military i.e. icreased cooperatio. Of more iterest for ANSPs may be the operatioal elemets which ca mitigate techical failures. May of these are cotaied i the plaig ad tactical barriers MB09-MB17. Some re-arragemet of the iformatio is ecessary to idetify clear recommedatios. The study shows that there is o silver bullet to mitigate all traspoder failures or dysfuctios. Rather, a robust strategy must be put i place, takig accout of all aspects of the ATC system (airbore ad groud), with multiple mitigatios idetified to give a reasoable likelihood of detectig ad reactig to the failure i sufficiet time. 42

43 APPENDIX A - EXAMPLES OF INDUCED RISK FROM TRANSPONDER FAILURES Itroductio This sectio provides specific examples of icidets of traspoder failure or dysfuctio, leadig to a loss of effectiveess of oe or more barriers. The examples below have bee provided by a umber of sources at varyig levels of detail. As much detail as possible has bee provided, but care has bee take to keep the examples aoymous where appropriate. If a report has bee published ito a icidet, ad is available publically, the source is attributed below. Example A (source: NTSB ivestigatio report) This example provides a overview of a icidet above Atlata (USA); a full NTSB ivestigatio ito the icidet is available. This provides evidece of the severity of icidets that ca occur due to a total loss of traspoder. A Delta Airlies Boeig , registratio N693DL was takig off from Atlata to New York. It departed ruway 27R o a RNAV departure route. It was istructed to take switch from Tower to Departure frequecy. The crew ackowledged, with a correct read back, but did ot chage the frequecy. After approximately 8 miutes the crew reported agai, o hearig this Tower istructed the flight to switch immediately to Departure. Commuicatio was established with departure at this time. The aircraft was already at 10,000ft ad 20NM east of Atlata. After establishig cotact with departures the traspoder was tured o withi 6 secods. Durig this time while ot o radar display the Delta flight was ivolved i three losses of horizotal separatio with other aircraft. There is o vertical iformatio as the oly track available is from the primary track. The miimum separatio distaces with other aircraft were 1.44NM, 0.81NM ad 2.36NM. The NTSB released its fial report o 8th of August It stated: The air traffic cotrollers failure to adhere to required radar idetificatio procedures, which resulted i loss of separatio betwee the departig Boeig 757 ad three other airplaes. Cotributig to the icidet was the pilots iadequate preflight checks, which resulted i the airplae departig with a ioperative traspoder. Example B (source: ANSP cofidetial occurrece report) A orgaisatio has provided several examples of icidets where problems occurred due to a Mode A/C traspoder replyig to a Mode S iterrogatio. I each case differet military aircraft, equipped with oly a Mode A/C traspoder, were replyig more tha oce to a Mode S all-call. The aircraft was replyig more tha oce to iterrogatios from a Mode S radar statio resultig i several ghost tracks beig plotted o the cotrollers display. I some istaces this could be up to 6 ghost tracks. Some aalysis of the evets was coducted ad it cocluded that the root cause of the icidets was a traspoder malfuctio. The traspoder was iterpretig the Mode S iterrogatio as a Mode A sigal. Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

44 Example C (source: ANSP cofidetial occurrece report) A orgaisatio has provided a umber of short summaries of occurreces. These were gathered by ATCOs submittig them to a iteral reportig system. The examples provided have bee tabulated below. I all cases, it appears that the traspoder malfuctio was detected by the ATCO. Traspoder failure type Total loss Total loss (recycled traspoder) Total loss (recycled traspoder) Itermittet total loss (recycled traspoder) Total loss (recycled traspoder) Corruptio of mode A Itermittet total loss (recycled traspoder) Corruptio of mode C Evet The aircraft traspoder was lost durig flight. The aircraft retured to the departure airport as it was ot cleared to eter the eighbourig FIR. A aircraft was e-route at FL miute before eterig a sector, radar idetificatio was lost The radar cotact was re-established 3 miutes ad 16 secods later. A aircraft was e-route at FL 370. The radar cotact was lost withi the sector ad was ot established agai while the aircraft was withi this sector. A aircraft was e-route at F 360. Radar cotact was ot established followig radio commuicatio. Radar cotact was established subsequetly, after 1 miute 53 secods. After a further 36 secods radar cotact was lost, ad ot re-established withi the sector. A aircraft was e-route at FL 310. The radar cotact was lost withi the sector ad was ot established agai while the aircraft was withi this sector. A aircraft was e-route. The wrog squawk code was appearig o the ATCOs display. This happeed o two occasios, for 28 secods ad subsequetly for 56 secods. A aircraft was o route ad climbig from FL360 to FL380. Radar cotact was established whe the aircraft etered the sector. After 1 miute ad three secods radar cotact was lost. It was re-established after 46 secods, lost agai for 56 secods. 3 miutes 44 secods after this the radar cotact was agai lost, but was ot re-established withi the sector. A aircraft was e-route at FL140. However was displayig the wrog altitude o the cotrollers display. Actio take by the ATCO Aircraft ot cleared to proceed by ATCO i adjacet FIR, forcig aircraft to retur to the departure airport. The ATCO detected the loss, ad istructed the pilot to chage the traspoder set (to back-up). The ATCO commuicated with the adjacet sector, ad otified them that the radar idetity had bee lost. The aircraft was accepted ito the adjacet FIR. ATCOs i adjacet FIRs commuicated regardig the problem, at the time it was assumed that the fault was withi the traspoder. The aircraft was accepted ito the adjacet FIR. The ATCO commuicated with the adjacet sector, ad otified them that the radar idetity had bee lost. The aircraft was accepted ito the adjacet FIR. The ATCO istructed the pilot to chage the traspoder settig. ATCO asked for a traspoder check ad otified the adjacet FIR of the problem. They coordiated with the adjacet FIR ad the aircraft was accepted ito it. The ATCO asked for the traspoder to chage settig. They otified the adjacet FIR of the problem. Followig coordiatio, the aircraft was accepted ito the adjacet FIR. 44

45 Example D (source: ANSP cofidetial occurrece report ad subsequet presetatios to SISG) A Europea ANSP reported a aircraft as havig suffered a failure of the Mode S traspoder. It had bee positively idetified o first cotact with the sector, but was ot trasferred via R/T to the subsequet sector. The traspoder failed a few miutes before the sector boudary. I the ext sector, solely a primary retur was visible to the cotrollers. Some iitial cofusio was reported due to the previous presece of ghost returs i the area of airspace through which the aircraft with the failed traspoder was flyig. It was therefore uclear to the cotrollers whether they were lookig at a reflectio. The cotrollers tried to raise the aircraft o R/T, icludig via the emergecy chael. Evetually the aircraft reported o frequecy, ad the traspoder was switched to the back-up by the flight crew (icludig squawk idet to verify operatio). Example E (source: ANSP cofidetial occurrece report) Two aircraft flyig i the airspace of a Europea ANSP were foud to have duplicated Mode S 24-bit addresses. The issue was oticed as oe of the aircraft was filtered out by the ATC system, o the basis of ati-reflectio. It was oted at the time that two differet ATC systems were trackig the two aircraft with the same 24-bit address. O oe system, the ati-reflectio algorithms led to a filterig of the track. O the other system, both aircraft were see at all times. Example F (source: ANSP cofidetial occurrece report) A cotroller i a Europea ANSP filed a occurrece report otig the presece of two flights with the same Mode S 24-bit address i the airspace at the same time. The flight pla was coupled to the wrog flight (i.e. swapped). This was detected, ad o loss of separatio resulted. Example G (public ewspaper sites: Reuters, Times of Idia) Several istaces were reported publically of traspoders failig. These icidets have ot bee followed up directly with the ANSPs ivolved. The traspoders suffered a uexpected total failure durig flight i the followig reported cases: A Air Idia Boeig 787-8, registratio VT-ANE performig flight AI-116 from Lodo Heathrow, EN (UK) to Delhi (Idia), was eroute at FL370 about 30m west of Berli (Germay) whe the mai traspoder ad all other traspoders failed, the aircraft became completely ivisible to secodary (ATC) radar. The aircraft was able to evetually retur to Lodo, where it laded safely just before the ight curfew at Heathrow. The same aircraft, roughly five weeks later, suffered aother total loss of traspoder fuctioality whe flyig from Delhi to Frakfurt, whilst overhead Afghaista. It was quickly detected, ad the aircraft was tured back to Delhi, where it laded safely. Note i each istace that the traspoder failure appears to have bee detected rapidly. Full details should be gathered o these icidets to uderstad the effectiveess of each barrier i.e. was a track chage alertig tool fuctioig, or was the detectio purely o the basis of the cotroller s visual sca? Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

46 APPENDIX B - SUMMARY OF MITIGATING BARRIERS Barriers mitigatig the effects of traspoder failure modes MB01 Airspace desig gives positive separatio MB02 Procedure desig for traspoder malfuctio MB03 Appropriate ATC system desig ad calibratio MB04 Applicatio of traspoder validatio procedures o first cotact MB05 Weighted use of all aircraft ID sources i ATC system MB06 Aomaly reportig ad effective respose MB07 Maiteace procedures for traspoder MB08 Sector capacity plaig MB09 More effective flight pla data MB10 Use of voice reportig MB11 Sector-sector coordiatio MB12 Regular scaig by ATCO MB13 Use of primary radar data MB14 Alert for chage i track status MB15 Crew detectio of traspoder failure MB16 Collisio avoidace via procedural cotrol MB17 Cotroller advisory to other aircraft MB18 Recalibratio of groud-based safety ets MB19 See ad avoid practiced by aircraft MB20 Collisio avoidace system MB21 Improvemet of collisio avoidace system behaviours There are several other detailed operatioal barriers available i the ATC cotrol room, maily impactig the detectability of errors o the Cotroller Workig Positio. These detailed operatioal barriers (e.g. proactive colleague, data block clarity) are dealt with i other Top 5 operatioal studies, for example Blid Spots. 46

47 APPENDIX C - GLOSSARY AND ABBREVIATIONS Glossary Term Approach Path Moitor Area Proximity Warig False Alert Miimum Safe Altitude Warig Nuisace Alert Safety Net Defiitio Approach Path Moitor (APM) wars the cotroller about icreased risk of cotrolled flight ito terrai accidets by geeratig, i a timely maer, a alert of aircraft proximity to terrai or obstacles durig fial approach. Area Proximity Warig (APW) wars the cotroller about uauthorised peetratio of a airspace volume by geeratig, i a timely maer, a alert of a potetial or actual ifrigemet of the required spacig to that airspace volume. Alert which does ot correspod to a situatio requirig particular attetio or actio (e.g. caused by split tracks ad radar reflectios). Miimum Safe Altitude Warig (MSAW) wars the cotroller about icreased risk of cotrolled flight ito terrai accidets by geeratig, i a timely maer, a alert of aircraft proximity to terrai or obstacles. Alert which is correctly geerated accordig to the rule set but is cosidered operatioally iappropriate. Safety ets help prevet immiet or actual hazardous situatios from developig ito major icidets or eve accidets. A groud-based safety et is fuctioality withi the ATM system that is assiged by the ANSP with the sole purpose of moitorig the eviromet of operatios i order to provide timely alerts of a icreased risk to flight safety which may iclude resolutio advice. Groud-based safety ets are a itegral part of the ATM system. Usig primarily ATS surveillace data, they provide warig times of up to two miutes. Upo receivig a alert, air traffic cotrollers are expected to immediately assess the situatio ad take appropriate actio. Airbore safety ets provide alerts ad resolutio advisories directly to the pilots. Warig times are geerally shorter, up to 40 secods. Pilots are expected to immediately take appropriate avoidig actio. Short Term Coflict Alert Short Term Coflict Alert (STCA) assists the cotroller i prevetig collisio betwee aircraft by geeratig, i a timely maer, a alert of a potetial or actual ifrigemet of separatio miima. Operatioal Safety Study Risk of operatio without a traspoder or with a dysfuctioal oe Editio

48 Acroyms ad Abbreviatios Acroym ACAS AMAN ANSP ATC ATCO ATM CAS CAT CWP DCB DMAN ICAO ID MTCD PSR RA RNAV RNP RVSM SAFMAP SISG SSR STCA TA TCAS VFR Defiitio Airbore Collisio Avoidace System Arrival Maager Air Navigatio Service Provider Air Traffic Cotrol Air Traffic Cotrol Officer Air Traffic Maagemet Collisio Avoidace Systems Commercial Air Trasport Cotroller Workig Positio Demad Capacity Balacig Departure Maager Iteratioal Civil Aviatio Orgaisatio Idetificatio Medium Term Coflict Detectio Primary Surveillace Radar Resolutio Advisory (withi Collisio Avoidace Systems) Area Navigatio Required Navigatio Performace Reduced Vertical Separatio Miima Safety Fuctios Maps Safety Improvemet Sub Group Secodary Surveillace Radar Short Term Coflict Alert Traffic Advisory (withi Collisio Avoidace Systems) Traffic Collisio Avoidace System Visual Flight Rules 48

49

50