ICAO Airborne Separation Assurance System (ASAS) Circular · ICAO Airborne Separation Assurance...

DRAFT ASAS Circular Version 1.0 dated 6 July 2000

DRAFT ASAS Circular Version 1.0 dated 6 July 2000 /28

CONTENTS

1. Introduction2. ASAS Concept

Scope of ASASASAS ApplicationsASAS Applications TemplateTransfer of Responsibility for Separation AssuranceAirborne Separation Assurance Process

3. Criticality and Safety IssuesElements of Operational Safety AssessmentComments on the ASAS Safety ObjectivesSpecific ASAS Safety Issues

4. ASAS Functional CharacteristicsOutline of ASAS FunctionsAirborne Surveillance and Separation Assurance ProcessingCockpit Display of Traffic InformationASAS Control PanelASAS Design and Integration Issues

5. ASAS Data Sources6. Interaction with ACAS

The Purpose of ACAS and ACAS IndependenceASAS Conflict Detection and Resolution and ASASInhibition of ACAS during ASAS OperationsShared use of CDTI by ASAS and ACASACAS Hybrid Surveillance

7. ASAS Performance RequirementsRequired Surveillance Performance for ASAS tracksQuality of Data Sources

8. ASAS Operational ConsiderationsResponsibilities during ASAS OperationsASAS Procedural and Human Factors IssuesASAS Transitional Issues

9. Trials10. Terminology and Definitions11. References



ICAO Airborne Separation Assurance System (ASAS) Circular

1. INTRODUCTION1.1 This Circular provides a high level overview and concept of the Airborne SeparationAssurance System (ASAS), and identifies the main ASAS issues.

1.2 The acronym ‘ASAS’ was coined in 1995, in reaction to pressures and desires to use theACAS traffic display for purposes other than collision avoidance. [1] These pressures wereevidence of the potential value of a flight deck system designed to give air crew a comprehensiveand accurate picture of the surrounding air traffic. The SICAS Panel continued to develop theidea of ASAS until its next full meeting, SICASP/6 in 1997. At that time, the main concern ofSICASP was that ACAS was not intended for the ASAS function, and that the use of the ACAStraffic display for anything other than collision avoidance could be counterproductive to ACAS.

1.3 At SICASP/6, ASAS was defined as:

‘The equipment, protocols, airborne surveillance and other aircraft state data, flight crewand ATC procedures which enable the pilot to exercise responsibility, in agreed andappropriate circumstances, for separation of his aircraft from one or more aircraft’. [2]

1.4 Following SICASP/6, SICASP was tasked to develop and review proposals for operationaland technical procedures for the use of ASAS; and to address ASAS criticality issues and theirrelationship with ACAS integrity. This Circular is the first step in the development of a Manualfor ASAS, which would cover these issues, and is in part fulfilment of the task laid on SICASP.

1.5 Following ADSP/4 in 1996, the ADS Panel had been tasked to develop an operationalconcept and operational requirements for the use of a system to increase aircraft situationalawareness and provide airborne separation assurance. Subsequently, the ADSP monitored theactivities in several States developing the potential operational use of ASAS. At ADSP/5 in1999, the Panel received and reported ‘information relevant to the use of a system to increasetraffic situational awareness and provide airborne situational awareness.’ [3]

1.6 Trials and projects related to ASAS and its applications are in progress in various States andinternational organisations. A brief resumé of these is provided in section 9.

1.7 An ATM operational concept, defined within ICAO, should address internationalimplementations of airborne separation assurance applications. In particular, this would identifythe agreed and appropriate circumstances in which specific ASAS applications could be used.Given the differences between airspace regions, and also the different concerns of aircraftoperators, the same ASAS applications will not necessarily be adopted in all regions.Nevertheless, an international consensus through ICAO standards is required to provide thepotential for ASAS applications to be implemented on a world-wide basis. Internationalapplicability of ASAS procedures, airborne separation minima, and any amendment to flightrules will require agreement through ICAO.

1.8 Many aspects of ASAS are expected to require standardisation at the international level.The ICAO Documentation that is expected to be required is listed at Appendix A.



2. ASAS CONCEPT2.1 Scope of ASAS

2.1.1 ASAS encompasses applications seeking to increase flightcrews’ situational awarenessrelated to traffic, and applications providing airborne separation assurance. It is expected thatASAS applications could provide some significant operational advantages to both ATSproviders and airspace users alike. In addition, there could be some additional safety benefitsdue to improved situational awareness for the flight crew.

2.1.2 However, ASAS does not address the flightcrews’ complete situational awareness, whichalso includes weather, proximity to the ground, structure of the airspace (i.e. classes, restrictedareas), aircraft state/control and many other aspects. Nor does it address surface movementguidance and control systems.

2.1.3 ASAS is often mentioned in the same context as Automatic Dependent SurveillanceBroadcast (ADS-B), but ASAS and ADS-B should not be confused. It is true that ASASapplications will require a surveillance capability, probably based on ADS-B but not exclusively.ASAS applications will also require separation assurance capabilities.

2.1.4 ASAS cannot fulfil the ACAS function, which is to provide a collision avoidance safetynet independent of the means of separation assurance. The relationship between ASAS andACAS is discussed in section 6.

2.2 ASAS Applications

2.2.1 Two broad classes of ASAS applications have been identified:

a. Traffic Situational Awareness Applications

b. Cooperative Separation Applications

2.2.2 Traffic Situational Awareness Applications.

2.2.2.1 Traffic situational awareness applications provide information to the flight crew toconvey the position and other information such as the identity, status, and the intentions of theother aircraft with respect to their own trajectory. They can be defined within the scope ofexisting ATC practices. These applications are considered to be the first stage in thedevelopment of more complex ASAS applications.

2.2.2.2 The provision of traffic situational awareness does not constitute separation assurance initself. No transfer of separation responsibility from the ground to the airborne side is envisagedfor Traffic Situational Awareness applications.

2.2.2.3 Potential Traffic Situational Awareness Applications include:

a. Improved aircrew mental picture with respect to the surrounding traffic. In the currentATC system, this could ease the aircrew understanding of the ATC instructions. In thefuture ATC system, where digital data-links are expected to be implemented, TrafficSituational Awareness applications could compensate, for example, for the loss of ‘partyline’ information;



b. Improved ‘see and avoid’ procedures, in particular in the aspects of compatibilitybetween IFR and VFR flights. Indeed, the limits of ‘see and avoid’ procedures have beenreached, due to increased speed of aircraft, poor external visibility of modern cockpits, andhigh pilot workload in some phases of flight;

c. Improved current visual procedures, for example, for a visual approach where a pilot isinstructed to maintain visual separation from preceding aircraft;

d. Enhanced ‘Traffic Information Broadcast by Aircraft’ procedure, where pilotsbroadcast and monitor periodic radio telephony (RTF) position reports. In addition to themonitoring of such RTF reports, the pilot could potentially identify the surrounding trafficwith an ASAS system and speak directly to other aircraft that might conflict with ownaircraft’s planned trajectory.

2.2.3 Cooperative Separation Applications.

2.2.3.1 Cooperative separation applications comprise a set of actions, automatic or manual, eachof which have a clearly defined operational goal, and begin and end with an operational event.During this period, the pilot uses ASAS equipment to comply with an ATC clearance to preserveASAS separation between his aircraft and certain other aircraft, and monitors that ASASseparation is maintained.

2.2.3.2 Air traffic controllers are responsible for the prevention of collisions and for themaintenance of an orderly and expeditious flow of traffic. Provision of separation is a means toachieve safe and efficient aircraft operations. ([4], section 2.2) Currently, pilots are not normallyresponsible for the provision of separation between aircraft, other than to avoid collision andwake turbulence. By taking advantage of capabilities of sharing information between the groundand the airborne side, together with the provision of airborne separation capabilities, cooperativeseparation applications envisage the transfer of some separation assurance tasks to the aircrewwithin new ATC procedures. This is the innovative part of the ASAS concept.

2.2.3.3 When provided with the adequate tools and procedures, and under specifiedcircumstances, the delegation of separation assurance from the ground to the airborne side couldpotentially improve flexibility and capacity of the ATC system, while preserving or enhancingsafety.

2.2.3.4 Increased ATC capacity might be achieved both through streamlining the controllers’task and through the introduction of airborne separation standards, whose minima mightpotentially be less than the separation minima applied by ATC. Furthermore, there could beimproved ability of the aircraft to conform to the assigned separation.

2.2.3.5 Possible Cooperative Separation applications include those listed below.

a. Applications where the following aircraft is cleared to maintain a specified airborneseparation from another aircraft, for example specific offset or longitudinal spacing. Thiscould be applied on oceanic routes, in en-route airspace or in approach airspace;

b. Applications where, after a conflict has been detected by the controller, the pilot isinstructed to provide airborne separation from the other aircraft. These applications couldinclude crossing or passing manoeuvres;

c. Own separation applications where the pilot is cleared to maintain airborne separationfrom all other aircraft in a defined volume of airspace.



2.3 ASAS Applications Template

2.3.1 To permit identification and assessment of the requirements for a proposed ASASapplication, proposals need to utilise a standard template format to address pre-determined areas.By this mechanism, the equipment functional and performance requirements, the operationalprocedures including appropriate contingency measures, may be determined. This enablesoperational and regulatory implications of a proposed application to be exposed and addressed.Such a template is attached at Appendix B. RTCA has developed this template to include otherareas such as economic considerations and some certification aspects. [5]

2.4 Transfer of Responsibility for Separation Assurance

2.4.1 Responsibility for providing separation between aircraft derives from the role of ATCdefined in Annex 11 and Doc 4444. [4] [6] However, the ASAS concept would require, incertain circumstances, changes to the allocation of responsibility for separation between theground and the air. This needs to be clearly defined and addressed, since aspects of ATC legalaccountability are based upon the allocation of responsibility for separation.

2.4.2 Three categories of allocation of responsibility for separation between the ground and theair can be envisaged:

a. Execution of new clearances without any transfer of responsibility for the provision ofseparation. The pilot is required to execute new clearances designed to achieve aseparation specified by ATC. The controller remains responsible for monitoringseparation and taking corrective action, should it be necessary. This is not different inprinciple from the current situation, but the objective is to improve the efficiency of thecontrolling task.

b. Tactical Transfer of Responsibility. Separation responsibility remains with thecontroller, except under specific circumstances, for example, separation from anominated aircraft. In such circumstance, the flight crew would take responsibility formaintaining an airborne separation from nominated aircraft only; the controller wouldretain responsibility for separation from all other aircraft. Tactical transfer ofresponsibility might lead to more ATC capacity, through streamlining the controllers’ taskassociated with managing the specific situation, and possibly through a reduction in theapplicable separation minima.

c. Strategic Transfer of Responsibility. Separation responsibility is allocated to the flightcrew. In this case, the controller might retain responsibility for managing the overallvolume of traffic, or expected traffic flows such that they are compatible with thecapabilities of an ASAS. Nonetheless, strategic transfer of responsibility might increaseairspace capacity and improve flight efficiency.

2.5 Airborne Separation Assurance Process

2.5.1 The separation assurance process requires communications; airborne separation will oftenrequire direct communication between aircraft, particularly where coordination is required.Coordination will include ATC, but an air-air data-link (crosslink, as opposed to broadcast) isexpected to support, in many cases, the necessary air-air coordination for manoeuvresundertaken to ensure separation.



2.5.2 The separation assurance process does not solely depend upon the allocated responsibilityfor separation. It includes many elements, such as the principles of collision avoidancecontained in the ‘Rules of the Air’, the measures associated with the flight rules, flightprocedures, the provision of ATS and procedures, and the establishment of the separationminimum standards. ASAS applications, which require transfer of responsibility for separationin any of the categories described in para 2.4.2, will require the development of specificprocedures and standards for airborne separation minima. Specific flight rules may also berequired for applications involving strategic transfer of separation responsibility.

2.5.3. The prerequisites for Cooperative Separation application implementations include:

a. Procedures. The procedures are required to define, clearly, the allocation of separationassurance tasks and the role of both controllers and pilots, depending on the type ofairspace and rules of flight. In particular, the procedures must define the responsibility forinitiating any manoeuvres necessary to correct a loss of separation. Also, in the event thatthe procedure is compromised by technical failure or operational error, contingencyprocedures must be developed to enable the safe re-establishment of ATC separation bythe controller.

b. Airborne Separation Minima. The determination of airborne separation minima to beapplied for airborne separation assurance needs to take into account various criteria,including operational procedures and communication, navigation and surveillancecapabilities. Aircrew executing Cooperative Separation procedures must comply with theairborne separation minima which have been established. There is no necessary relationshipbetween ATC separation minima and airborne separation minima. However, in procedureswhere a controller retains a responsibility for the provision of separation, the airborneseparation must be greater than the ATC separation minima, so that the controller is ableto monitor the procedure and, if necessary, take corrective action to maintain separation

c. Flight Rules. In the case of strategic transfer of responsibility, flight rules shouldaddress the aircraft priority for right of way during ASAS operations.

3. CRITICALITY and SAFETY ISSUES3.1 Although ASAS operates between aircraft, it is also part of ATM. Thus, safety objectivesneed to be specified and allocated among the components of ATM, including its supporting CNSsystems. As for any new equipment or procedures, the introduction of ASAS will requireassurance that it meets the safety objectives which have been allocated.

3.2 The operational use of ASAS interacts with its technical aspects, with consequences forsafety and criticality. Therefore, the safety of each individual ASAS application must beassessed.

3.3 The development, certification, and regulation of aircraft systems are conducted separatelyfrom those of ground systems. However, the air-to-air and air-to-ground interactions transcendany single institution and necessitate a coordinated process. Therefore, it is desirable that thesafety assessment of the airborne components of ASAS, and its applications, are considered as aconsistent whole with the appropriate ground ATM components.



3.4 Elements of Operational Safety Assessment

3.4.1 The assessment of the safety of an ASAS Application should include, at least, each of thefollowing sequential, distinct, and iterative steps:

a. Operational Environment Definition (OED). The OED describes how and in whatcontext an application of ASAS is expected to operate. It includes the anticipatedresponsibilities of the flight crew and ATC, when and how the application begins andends, the basic information required to support the conduct of the application, resultingdisplays and alerts (if necessary), and communications and operational decisions thatwould be routinely part of the application. The OED also describes the type and characterof the airspace for which the application is intended, including the degree to which theaircraft population is expected to be equipped with ASAS and any other pertinentequipment, the nature of ATC service provided, any requirement for ground surveillance,and any other special characteristics of the airspace (e.g., track system, air routes). Anunderstanding of the environment is necessary for assessing the likelihood and severity ofhazard effects.

b. Operational Hazard Analysis (OHA). The OHA enumerates operational hazard eventsthat could pertain to the application described in the OED. These events need to includeboth probable occurrences and failure events. The OHA describes the worst-case effectand assigns a level of criticality to this effect. This analysis also lists mitigating factorswhich support safety even in the presence of the hazard event.

(i) Hazard Identification. Hazards can include those associated with equipment,communication, software, procedures, or human error. For ASAS applications,operational hazards are not limited to aircraft hazards, for which there is anestablished hazard classification system.

(ii) Criticality Assignment. The criticality assigned to each hazard depends on itsoperational effects in the context of its environment and use. For example, loss ofseparation is unlikely to be catastrophic, but its criticality will depend upon thenature of the procedure, and the separation which was intended to be provided.

The criticality should be determined based on the effects that the hazard could causeand upon the presence or absence of mitigating factors. The probability of eventoccurrence does not affect this determination. As an example, consider the event“flight crew initiates premature descent, before the ASAS crossing is complete.” Ifthe ASAS application provides a warning against this manoeuvre in advance, thewarning constitutes an avoidance measure that reduces its likelihood, but does notaffect its criticality. If, instead, the application provides a warning only after such amanoeuvre has occurred, it is a mitigation that could reduce its criticality.

To illustrate lesser criticality hazards, some traffic situational awareness ASASapplications would not invoke any change in separation responsibilities orprocedures. For these applications, any hazard events may be shown to be of lowcriticality if the protections offered by conventional separation remain in force.

In contrast, for cooperative ASAS applications, in which it is anticipated that theflight crew would use ASAS as the primary means of separation, the hazardsresulting from the use of erroneous data might be shown to be of high criticality. Ofcourse, such an event should be made improbable, but if it were to occur, it could be



mitigated in various ways. These might include either procedural measures ortechnical measures such as comparison of alternate, independent surveillance data.

(iii) Probability of Occurrence. The criticality level of each hazard determines themaximum probability of occurrence permitted for that hazard. The fundamental ruleis the more critical the hazard, the less frequently it is tolerated. This maximumprobability is related to the safety objective for the ATM service which is beingprovided in the airspace. At present, quantitative aircraft-specific hazard probabilityvalues have been assigned, but this is not the case for all ATM system-wide hazards.

Analyses of each hazard must be performed to determine whether the probabilityconforms to the allowed maximum level. If it does not, steps must be taken either tomitigate its criticality or to reduce its probability, or both.

c. Allocation of ASAS Safety Objectives and Requirements. The level of operationalsafety that is required with respect to aircraft separation needs to be established.Specifically, safety objectives for ASAS operations need to be agreed at a policy level.They should be compatible with the Target Level of Safety (TLS) normally expected to berequired for air traffic control, for example 1×10-9 mid-air collision per flight hour,depending upon the ATM service which is provided in the airspace.

From examination of the hazards and their mitigations, a list of functions needs to bedeveloped which will be performed by equipment, communication links, flight crews, andATC to achieve safe ASAS operations. Specific safety requirements then need to beallocated to these functions, ensuring that, when all of these are met, all known hazards areconsidered acceptable. These requirements include development assurance levels,operational procedures, and validation of assumptions (e.g. that a specific failure event isextremely remote).

Performance requirements for system elements can then be developed, includingsurveillance data quality and availability, software quality, communications performance(if applicable), and requirements to enable contingencies to be managed safely.

Further measures may be required to mitigate some identified hazards. These couldinclude procedural limitations to the ASAS application; additional informationrequirements for the flight crew; communications to confirm data or actions; informationon technical limitations. Also, additional requirements may emerge to enablecontingencies to be managed safely.

d. Design and Development. To satisfy the allocated safety requirements, the ASASequipment design and operational procedure development must be consistent with theprocedural assumptions described in the OED and employed in the OHA. Test, validationand operational evaluation activities are then able to provide assurance that these safetyrequirements are met and that the OHA has not overlooked key elements bearing uponsafety.

e. Equipment Certification and Entry into Operational Service. Approval authoritiesascertain that safety and performance requirements are met. Equipment and operationalapprovals must include any limitations of use necessary to ensure that these safety andperformance requirements are met.

f. Operational Performance Monitoring. Continued operational monitoring is essential toassure that the application is performing as was anticipated during earlier test and



validation activities. Lessons learnt should be fed back in order to refine the OHA and, ifnecessary, to rectify or improve the equipment and operational procedures.

3.5 Comments on the ASAS Safety Objectives.

3.5.1 Aircraft operations should be based on the use of ASAS only when ASAS and theprocedures agreed for its use provide the level of safety normally required for the operations inquestion. This involves a judgement that is the responsibility of State regulatory authorities, butthe normal requirement is that the risk of catastrophic failure (e.g. a mid-air collision involvingfare paying passengers) of individual systems or procedures should be less than 1 × 10-9 perflight hour.

3.5.2 It would not be sufficient merely to show that an ASAS application is safer than currentpractices, in lieu of addressing the safety objective, for in most respects these applications arenew and there is nothing to compare on a detailed basis.

3.5.3 The role of ACAS as a safety net is discussed in section 6. The question arises whetherthe presence of ACAS can be invoked in order to meet the required TLS. This is neither atechnical nor an operational judgement, but a policy judgement. The following points need to betaken into account:

a. The mandate for ACAS was based on the premise that it provided a level of protectionin addition to that provided by the primary means of separation assurance, without regardto the absolute levels of safety with or without ACAS.

b. If ASAS is designed in a way that removes the independence of ACAS, then ACASbecomes less effective in reducing collision risk and the policy objective in mandatingACAS is subverted.

c. The reduction in the risk of collision achieved by ACAS depends on context andtherefore is not known for ASAS applications. It would need to be derived anew forASAS applications. The calculations that have been made were for existing ATMpractices and traffic patterns.

3.6 Specific ASAS Safety Issues

3.6.1 Some safety issues which are specific to ASAS, and which have already been identified,are discussed in this section. This list is not exclusive, rather it is intended to be illustrative.

3.6.2 During an anticipated transition, when there might be partial ADS-B equippage, the ASAScockpit display of traffic information (CDTI) might not receive surveillance data for all aircraft.In this circumstance, the ASAS could provide flight crew with a false sense of security since itwould not necessarily display proximate traffic. Flight crew training must specifically addressthis point.

3.6.3 If the ASAS utilises surveillance data from different sources, the plan position accuracy ofthe displayed targets might not be mutually consistent. Therefore, flight crew interpretation ofthe data might not be appropriate. This situation could be avoided, potentially, by requiring aminimum level of data accuracy for any aircraft that is displayed, or by using different targetsymbology.



3.6.4 At this stage, it is an open question whether ADS-B data will have sufficient integrity tosupport all ASAS applications. Data from other sources, such as TIS-B, might be used toincrease the integrity of the ASAS surveillance data, but in this case it will need to bedemonstrated that common failure modes are not introduced, with ground-based ATC if TIS-Bis used. In particular, any plans to base ATC surveillance on ADS-B alone, while ASAS is alsobased on ADS-B, would require proof that the simultaneous use of ADS-B for both functionswould not degrade the safety of the ATM system. As ADS-B navigation sources and ADS-Bcommunications are central to both airborne and ground based surveillance, a failure in ADS-Bmight lead to an increased risk of loss of separation through simultaneous loss of bothsurveillance systems.

3.6.5 Similarly, it is an open question whether the use of a single communications link for ADS-B will have sufficient integrity to support all ASAS applications. The use of TIS-B to increasethe integrity of the ASAS surveillance data could exacerbate this problem. It is possible that theuse of two different communication link mediums will be required for ADS-B.

3.6.6 The use of data from more than one source creates the risk that a single aircraft could berepresented by more than one target symbol. This could present problems for correctinterpretation of the ASAS display. This aspect is discussed at paragraph 4.2.

3.6.7 Under present ATC system, instructions for separation and sequencing are centrallymanaged on a ‘first-come first served basis’. These instructions are obligatory, unless validreasons are provided for deviation. Therefore, co-operation between aircraft for separation andtraffic sequencing priority is naturally ensured. In order to avoid a potential reduction of thesafety levels of the ATM system, even if all technical aspects are solved, the application ofprocedures should be monitored in ASAS applications that involve strategic transfer ofresponsibility. This is to ensure appropriate adherence to flight rules and the applicableseparation minima, for example in instances where commercial interest or other reasons couldlead to situations where the application of the safety margins is not respected.

3.6.8 In an ASAS application that involves a tactical transfer of responsibility for separation, itis necessary to ensure that there is a procedure, which clearly defines the role of both ATC andthe flight crew, in order to avoid unsafe situations which could arise from misunderstanding orincorrect implementation of separation assurance tasks.

3.6.9 ASAS applications will involve new skills and tasks for the flight crew. Specific flightcrew training must be provided to ensure correct interpretation and use of ASAS equipment. Inaddition, the ATC ASAS training requirements must be addressed.

3.6.10 An ASAS alerting system might be required to support airborne separation monitoringtasks performed by the flight crew. The efficacy of the ASAS alerts, and the priority withrespect to alerts generated by other aircraft systems, would need to be addressed.

4. ASAS FUNCTIONAL CHARACTERISTICS4.1 Outline of ASAS Functions

4.1.1 An ASAS will interact with a specific on-board Surveillance Data Tx/Rx function, acommunication system, and Flight Data System. A typical ASAS for commercial transport



aircraft will include a surveillance data and separation assurance processing system, a cockpitdisplay and alerting system, and a control panel.

4.1.2 Flight Data System. Provides flight and navigation data for the surveillance data Tx/Rxfunction (e.g. for ADS-B) and the ASAS.

4.1.3 Surveillance Data Tx/Rx Function. Receives surveillance data from all sources ofsurveillance, mainly broadcast data sources, and transmits own ship data. This function couldcomprise of several units, e.g. for more than one ADS-B medium, or for data communicationsother than ADS-B. In the case of ADS-B, this function receives own ship data, generates thentransmits ADS-B messages, receives ADS-B messages from other aircraft and assembles theADS-B reports from other aircraft.1

4.1.4 Communication System. An RTF or datalink communication will be required betweenthe flight crew and the controller, and possibly between the flight crew of participating aircraft.

4.2 Airborne Surveillance and Separation Assurance Processing

4.2.1 There is a requirement for an Airborne Surveillance and Separation Assurance Processing(ASSAP) function. ASSAP processes the data received, forms tracks for other aircraft, presentsthe tracks to a cockpit display and makes any calculations required for particular applications, inparticular to support airborne separation assurance.

4.2.2 ASSAP performs several individual functions:

a. Combination and Processing of Surveillance Data. This function processes surveillancereports from one or more sources, develops current estimates of position and velocity foreach target aircraft, and makes these available to the CDTI function. This functionincludes several elements:

(i) Correlation. Correlation is the determination of the aircraft to which asurveillance report is to be assigned. In addition, when data from any of the sourcesdo not uniquely identify the target, this function must perform a further correlationalgorithm (e.g., by position match) in order to assign a new report to an existingtrack, or to start a new track. This function would also drop an established trackwhen data has not been received over an appropriate interval.

1 The various ADS-B reports are specified an RTCA MASPS [7], and do not necessarily correspond to the messagesactually transmitted and received.



(ii) Data Fusion. When multiple sources provide data for a target, a Data Fusionfunction must gather the reports, select or combine data from the various sources,possibly provide smoothing, and determine the appropriate quality measure toaccompany the estimate. The estimated position, velocity, intent or other data (ifany), quality measure, and the corresponding time are considered to form a ‘track’for the target aircraft. It is still an open issue whether there may be some rareconditions when data fusion may be suspended, allowing the capability to display orprocess a track from one source alone.

The consequence for ACAS functionality of using ACAS data in ASAS is discussedin Section 6.1. The use of the ASAS CDTI to display ACAS alerts and tracks isdiscussed in Section 6.4.

Own aircraft’s navigation and intent data, while not strictly surveillance data, areused to develop information on targets relative to own aircraft.

b. Separation Assurance Processing. This function performs processing of target datausing criteria unique to the operational application, normally for supporting special displayfeatures or alerts pertaining to a target. It may not apply to Traffic Situational Awarenessapplications of ASAS, for which the display of the target’s track information on the CDTImay suffice.

The function needs an input to determine the application to be performed, and theapplicable separation minima. It may include conflict detection and resolution (CD&R),and monitoring of the conflict resolution manoeuvre. In some applications it may benecessary to designate the target of interest.

Figure 1-1. Functional Diagram of ASAS and relation with other systems

CDTI &Alerting

ATC &other

aircraft

ASSAP :

FlightData/Management

System

SurveillanceData Tx/Rx

(ADS-B, TIS-B)

Comms.

ASASControlPanel

ACASSurveillance data processingSeparation assurance processingInterfacing

ASAS



c. External Communication of Conditions. This function enables own ADS-B broadcasts,or if appropriate, crosslinks between aircraft, to announce any special conditionsdetermined by on-board processing. Examples of such conditions could include ownaircraft’s participation in an application; a coordination message between ASAS CD&R ofthe participating aircraft; or an alert condition declared by own ASSAP.

d. Internal Communication of Conditions. This function notifies other onboard functionsof the status of an ASAS application. One example could be to indicate ASAS isconducting an application based on intentional close proximity to a target, and to identifythat target. The possibility of suppressing ACAS alerts against specific targets duringparticular ASAS applications is discussed in section 6.3.

4.3 Cockpit Display of Traffic Information (CDTI)

4.3.1 The display is the interface between the data processing and the pilot. The display couldbe substituted, or complemented, by an aural, textual, or graphical means of communicatinginformation to the pilot. Required display elements and their quality depend on the intendedoperational use of the data.

4.3.2 The capabilities of the CDTI need to be consistent with those of ASSAP and the needs ofthe applications. Individual tracks will have to be selectable for some applications, so thatadditional information can be provided for those tracks.

4.4 ASAS Control Panel

4.4.1 The ASAS control panel is the interface between the pilot, the display and the dataprocessing. The ASAS control panel will provide the ability to select a set of features based onthe desired category of ASAS applications.

4.5 ASAS design and integration issues

4.5.1 The integration of ASAS in current cockpits could be complex. For example, dependingupon the nature of the application existing FMS or auto-pilot functions might need to bemodified.

4.5.2 Algorithms for conflict detection, conflict resolution, separation assurance manoeuvresmust meet various performance requirements. These include effectiveness, nuisance alert rate,and compatible resolution manoeuvres between aircraft. Manoeuvres recommended by ASASCD&R need to be compatible between the two aircraft; the safest way to ensure compatibilitybetween two aircraft is through explicit coordination, which would be best implemented througha two way data-link. (Compatibility with ACAS RAs is discussed in 6.2.2.) Dedicatedalgorithms might be necessary for some ASAS applications (e.g. merging of traffic orlongitudinal station keeping).

4.5.3 ASAS and ACAS might share some components provided the loss of the ASAS functionsis not detrimental to the ACAS function. The ACAS must remain the safety net in the event ofnavigation failure and separation assurance failure.



5. ASAS DATA SOURCES5.1 ASAS could utilise surveillance and navigation data from several sources. Other data, forexample aircraft trajectory intent data, could also be used. It is therefore necessary to define therequirement, identify if the data is available and convey the information to the users.

5.2 ASAS will probably rely on ADS-B surveillance data. Many of the airborne applicationsenvisaged for ASAS are also applications of ADS-B. ADS-B is a function on an aircraft thatperiodically broadcasts its state vector (horizontal and vertical position, horizontal and verticalvelocity) and other information. The position data is based on the aircraft’s own navigationsystem.

5.3 The ADS-B navigation data does not have to be based on GNSS. Options could includeinertial or DME, but the requirements will be application dependent. Nevertheless, it is acceptedthat the majority of ADS-B units might well broadcast GNSS derived data, and that there is awidespread expectation that many ASAS applications will be based on the use of GNSS data.

5.4 It is recognised that the potential benefits brought by ASAS could be enhanced by the use ofair-ground data-link ( for example the proposed TIS-B service) and air-air datalink (crosslink) toprovide information on non-ADS-B equipped aircraft. The delay involved in obtaininginformation via the ground and the consequential problems of data correlation andsynchronisation will require investigation.

5.5 Depending on the ASAS applications, there may also be a requirement for exchange offlight information (e.g. ASAS capabilities, selected parameters or trajectory change points)between aircraft or the ground.

5.6 ACAS can provide surveillance information for traffic equipped with SSR Mode A/C orMode S transponders. This could be useful for ADS-B surveillance data validation, or if thetraffic was not equipped with ADS-B capability. Issues related to the use of ACAS surveillancedata are addressed at Section 6.

5.7 The surveillance data requirements will also be ASAS application dependent, but it isrecognised that ASAS will benefit from the positive identification of other aircraft, specificallyflight i/d (call sign used in flight). In addition, aircraft trajectory intent information could berequired for many co-operative ASAS applications. The availability and integrity requirementsfor intent data need to be assessed.

5.8 The potential need to coordinate resolution manoeuvres is discussed in paragraph 4.5.2.This coordination could be provided by ATC, or by RTF transmissions between aircraft, but inmany cases crosslink (air-air data-link) could be expected to support the necessary coordinationfor separation assurance manoeuvres. The level of reliability required for the crosslinkcoordination protocol needs to be assessed, but it is possible that ADS-B will prove inadequatefor such purposes.



6. INTERACTION WITH ACAS6.1 The Purpose of ACAS and ACAS Independence

6.1.1 ACAS is an airborne system based on Secondary Surveillance Radar (SSR) technology,which provides a last resort safety net function. Its purpose is to prevent collision when theprimary means of separation assurance has failed.

6.1.2 The reduction in the risk of collision that was predicted for ACAS was based on anassumption that it would operate independently of the primary means of separation assurance.(The shared reliance on the aircraft pressure altitude measurement was taken into account whenestimating the reduction in the risk of collision achieved by ACAS for current ATM practices.)Therefore it is essential to preserve the independence of ACAS, because the loss of thisindependence would undermine the reduction in collision risk achieved by ACAS. Further, it iscontended that there is a general policy perception that ACAS operates independently of thecurrent, ground-based, primary means of separation assurance, and that this is why it adds valueto the ATM system.

6.1.3 The most important elements contributing to the independence of ACAS are:

a. the range measurements made by ACAS: that it does not use the estimates of horizontalseparation used by ground ATC;

b. that it alerts automatically, not relying on the humans responsible for maintainingseparation.

Secondary features are the ACAS collision avoidance algorithms, and the software thatimplements them; these have to be competent for the system to work, but the separateness oftheir existence contributes little numerically to the reduction in collision risk achieved by ACAS.

6.1.4 ACAS uses the same SSR system as that which is used for primary separation. Thisundermines independence only marginally, since the ACAS and the ground surveillance systemdetermine position by independent measurements.

6.1.5 The following are examples of the ways in which the independence of ACAS might belost.

a. The use of ACAS data by aircraft surveillance and separation assurance systems, forexample the use of range data to modify ADS-B position data. The independence wouldbe lost because a common mode of failure would be introduced: separation could be lostand a collision threat created because the data being used are in error.

b. The use by ACAS of data that are used for separation assurance, e.g. the ADS-Bposition data expected to form the basis of ASAS applications. The argument is the sameas in (a) above, and the distinction lies in the original primary purpose in obtaining thedata.

c. The use of ACAS in operational procedures to maintain separation. There are twoconsiderations here: that already given, which is that some fault in ACAS would lead to aloss of separation and a collision threat that, by construction, cannot be resolved by ACAS;and that such use of ACAS would presumably be intended to enable some reduction inseparation between the aircraft concerned, thus increasing the risk of collision.



d. The invoking of ACAS in the approval process. The independence is lost because thereduction in collision risk achieved by ACAS could no longer be considered to increasethe safety of the procedure or system approved.

6.2 ASAS Conflict Detection and Resolution, and ACAS

6.2.1 It is assumed that part of ASAS will be an airborne Conflict Detection and Resolution(CD&R) function that will alert the pilot to a loss or potential loss of separation, and enable himto take corrective action. Idealistically, but somewhat unrealistically, ASAS CD&R wouldoperate so effectively that ACAS alerts only when airborne separation assurance has failed. It islikely that an interaction between ASAS CD&R and ACAS would be unavoidable.

6.2.2 It is necessary that the manoeuvres recommended by ASAS CD&R be compatible withACAS RAs on the other aircraft. This could be achieved by:

a. making the ASAS manoeuvre precede the potential RA, which then does not occur;

b. making the ASAS manoeuvre complementary to the ACAS RA through design, forexample a horizontal ASAS manoeuvre would be complementary to the vertical RAsissued by ACAS II;

c. explicitly coordinating the ASAS manoeuvre with the ACAS on the other aircraft – butACAS is not designed to coordinate with ASAS CD&R;2

d. ensuring that ASAS CD&R gives way to any ACAS RAs generated on own aircraft.

6.2.3 ACAS does not assure separation; ACAS resolution advisories can be generated inencounters whether or not there is a loss of current ATC separation. This should be expected tooccur in ASAS applications; there could be occasions where there is a (nuisance) ACAS alert,but no alert from the ASAS CD&R. When designing ASAS application procedures, andestablishing the airborne separation minima, the ACAS interaction should be borne in mind.

6.2.4 However, this does not indicate that ASAS CD&R could substitute, effectively, for thecurrent ACAS. In addition to the practical problems which would be raised by introduction ofan ASAS-based collision avoidance, which must be compatible and coordinate with the currentACAS, such a system would not be capable of providing independence from the primaryseparation assurance system, e.g. the active surveillance capability provided by the currentACAS.

6.2.5 An alternative solution to reduce the problem of ACAS nuisance alerts is to redesign theACAS collision avoidance logic to utilise extended squitter data or ACAS crosslink dataprovided provisions are made to protect the independence of ACAS.

2 ACAS coordinates the RAs generated on two ACAS equipped aircraft by transmitting the RA sense, encoded as aResolution Advisory Complement, on 1030MHz. Additionally, an ‘RA report’, which includes the nature of the RAand (if known) the address of the threat, is made available for replies (on 1090MHz) to specific Mode Sinterrogations. This RA report is also broadcast every 8s on 1030MHz. [8]



6.3 Inhibition of ACAS during ASAS Operations

6.3.1 It is anticipated that the level of nuisance ACAS alerts in some ASAS applications couldbe such that it will be necessary to disable some RAs, with the equivalent protection beingprovided in some other way. For example, the potential use of ASAS to enable simultaneousapproaches to closely spaced parallel runways in IMC will certainly cause such nuisance alerts,but should not be prohibited due to that consideration alone if the procedure is demonstrated tobe safe. If RAs are disabled in any particular application, ASAS will have to include a functionto produce its own alert in the event of loss of the separation required during the application.However, these alerts would not be independent of ASAS and thus, alone, would not substitutefor ACAS. However, if the state vector data used by ASAS are validated by comparison withthe ACAS range measurements (and the bearing measurements, should they be of value), thisvalidation against the independent range measurements could support substitution for ACAS.

6.3.2 ACAS range data might be used by ASAS to validate ADS-B position data for reasons inaddition to those discussed in 6.3.1, such as to improve the integrity of the ASAS tracks in otherdemanding applications. Before a collision threat could result, a double failure would berequired (the ADS-B data are wrong, and wrong ACAS range data validate the ADS-B data).However, it would be essential that action be taken should the ADS-B data not be validated.This would be likely to take the form of an abort of the ASAS procedure. No advantage can beclaimed in terms of integrity added to the ADS-B data by the validation if such action is nottaken.

6.4 Shared use of CDTI by ASAS and ACAS

6.4.1 The ACAS safety analyses on which basis the ACAS SARPs were adopted by ICAO donot invoke the traffic display that is usually fitted with ACAS II equipments. The purpose of theACAS traffic display is to aid visual acquisition of traffic on which a TA (and subsequently anRA) has been issued. Therefore, the ACAS traffic display can be shared with other functions.Conversely, a ‘general-purpose’ CDTI could be used for this purpose.

6.4.2 Where a CDTI is used as the ACAS traffic display, it must give priority to the display ofACAS alerts. The CDTI should not display two tracks for the same aircraft, for example theASAS track and the ACAS track. It is acceptable for the ACAS alerts to be displayed on theASAS track, for example by change of target symbology shape and colour. The association ofan ACAS and ASAS track is a matter of design, and should be included as an ASSAP function.

6.4.3 A displayed track based solely on ACAS must be clearly identifiable as such, and must notbe used for separation assurance.

6.5 ACAS Hybrid Surveillance

6.5.1 ACAS SARPs describe techniques that use the Mode S extended squitter and the ACAScrosslink to improve the ACAS surveillance system. The purpose of this hybrid surveillancetechnique is to use ADS-B data to reduce the frequency of active interrogations by ACAS; it is afeature of ACAS and it is not provided for the support of ASAS. The hybrid surveillancetechnique maintains the independence of the ACAS collision avoidance function, as is explainedbelow.



6.5.2 Using the hybrid surveillance technique, extended squitter, which is one implementationof ADS-B, would be used to provide surveillance of most intruders, but ACAS will accept suchsurveillance only after it has used an active interrogation to validate the extended squitter data.This validation will be repeated at regular intervals if the aircraft nears threat status.Furthermore, any intruder that is diagnosed by ACAS as potentially becoming a collision threatwill be tracked using active interrogations and all ACAS advisories will be based on activeinterrogation data only. Thus the collision protection provided by ACAS would still be based onactive interrogation.

7. PERFORMANCE REQUIREMENTS7.1 Required Surveillance Performance for ASAS Tracks

7.1.1 The various ASAS applications will be based on the CDTI, which will display tracks forother aircraft formed by the Airborne Surveillance and Separation Assurance Processingfunction (ASSAP, see section 4.2), and, in some case, on alerting or other support tools providedby ASSAP, again based on tracks formed by ASSAP. The Required Surveillance Performance(RSP) thus relates to ASSAP, and the tracks formed by ASSAP, and different levels of RSP arelikely to be required for different ASAS applications.

7.1.2 The qualities of an ASSAP track that require specification include the following:

a. data elements, e.g. position, velocity, flight i/d;

b. accuracy, e.g. of position, velocity, vertical rate;

c. integrity (of the track);

d. update period of the track;

e. latency;

f. availability; and

g. continuity (of availability of the track).

7.1.3 One of the chief functions of ASSAP will be to assure that the RSP is met, by monitoringthe quality of the data it uses to form its tracks (e.g. by monitoring the integrity of position datain ADS-B reports), and by carrying out its own checks.

7.1.4 Some ASAS applications might require a higher level of integrity than that reported by thesource for ADS-B data; this would create a need to validate ADS-B data before they are used byASAS. The fact that the position data conveyed by ADS-B are navigation data creates acommon point of failure for navigation, or ATC based separation, and separation assuranceprovided by ASAS. Fortunately, these position data are relatively easy to validate, either beforethey are transmitted (which would increase their integrity), or after receipt using the rangebetween the two aircraft. Use of ACAS range data in this manner is discussed in paragraph6.3.2.



7.2. Quality of Data Sources

7.2.1 For some applications, the ASSAP tracks displayed on the CDTI will need to be current,i.e. have low latency. This will constrain the update rates of the input data sources, in particularADS-B and TIS-B, which, in turn, implies that ground based surveillance systems will need tomatch the requirements of those ASAS applications that depend on the support of TIS-B.

7.2.2 The performance of ASAS is likely to be determined by the performance of ADS-B.ADS-B must be capable of delivering: the volume of data required, i.e. all the data elements forrealistic aircraft numbers; at the update rate discussed in 7.2.1; for aircraft within the maximumrange for the various ASAS applications; with the required integrity. The availability of theADS-B data could be improved by receiving ADS-B on more than one frequency. The integrityof ADS-B data could be improved by using ADS-B designs that enable independent ranging.

8. OPERATIONAL CONSIDERATIONS8.1 Responsibilities during ASAS Operations

8.1.1 New, or modified, legal, operational responsibilities will affect air traffic controllers andpilots, and must be clearly defined. However, ATS providers and airspace authorities, andaircraft operators will also have responsibilities to modify existing legal requirements,regulations and procedures; this will include contingency procedure provisions. States shouldmake their ATS providers aware of the possibility of ASAS equipped aircraft flying in theirairspace, even if ASAS applications are not implemented in their service area. Therefore, thereis a need for an internationally approved operational concept on the subject of transfer ofseparation responsibility from the controller to the flight crew.

8.1.2 Nonetheless, the category of tactical transfer of responsibility (para 2.4.2.b) to theflightcrew could be introduced within the framework of the current ATC system, which alreadyinvolves co-operation between the ground and the airborne sides.

8.1.3 However, strategic transfer of responsibility (para 2.4.2.c) has more extensiveimplications. Even here, the role of ATC would still be essential, but more work is required toenable this to be defined. It is envisaged that ATC would:

a. provide flight information services (e.g. meteorological data), and alerting service;

b. provide ATC elements such as flight plan de-confliction, traffic density and complexitymanagement;

c. provide ATC separation service in transition zones between airspace with extendedtransfer of responsibility and airspace with limited, or no, transfer of responsibility;

d. provide ATC separation under contingency procedures if the transfer of separationresponsibility to the flight crew could not be sustained. The ATC requirement forinformation and surveillance data would need to be established; and

e. provide other normal ATC functions which would not be provided by ASAS, forexample terrain warnings.



8.1.4 In the event of any strategic transfer of responsibility to the airborne side, the appropriateregulatory authorities must have the means to verify the correct implementation of the applicablerules.

8.2 ASAS Procedural and Human Factors Issues

8.2.1 The ASAS procedures must precisely define the roles of pilots and controllers and, clearlyimplement any required transfer of responsibility.

8.2.2 The combination of correctly designed procedures and displays should minimisedisruptive effects such as inappropriate and unexpected manoeuvres, or superfluous questioningof the controller.

8.2.3 For each ASAS application, contingency procedures need to be defined. They must not bebased on the fact that aircraft are fitted with ACAS; this is discussed in paragraph 3.5.3.

8.2.4 ASAS procedures should not be contradictory to ACAS procedures.

8.2.5 The controller should be provided with means to identify ASAS-capable aircraft and withtools to identify situations where delegation of separation assurance tasks can take place.

8.2.6 To enable the controller to maintain traffic situational awareness, and to provide acontingency service, the controllers surveillance data may need to be supplemented by ASASdata.

8.2.7 ASAS applications will require implementation of new procedures and new rules to beapplied both by pilots and controllers. In order to maintain safety, it will be necessary to ensurethat such new tasks are feasible and safe, taking into consideration the workloads of both thecontrollers and pilots in the environment (phase of flight, traffic density and complexity) inwhich the application would be used.

8.3 Training Considerations

8.3.1 Pilots’ and controllers’ training is essential for proper use of the ASAS procedures anddisplays. Appropriate training requirements need to be defined, and course syllabusesdeveloped, approved, and implemented.

8.3.2 Training aspects are critical and will have to be closely considered when:

implementing a new application;

extending a well-known application to a new operational environment; or

modifying the operational environment.

8.3.3 Training aspects will focus on new relations and responsibilities between flight crews ofdifferent aeroplanes performing ASAS applications, and between flight crews and controllers.

8.4 ASAS Transitional Issues

8.4.1 ASAS applications would require operational evaluation to validate technical performance,application viability and procedures. Results could encourage further equipage, bydemonstrating potential benefits to ATS providers and airspace users.



8.4.2 During the transition phase - when there is a mixed population of non-equipped andsuitably equipped aircraft - it will be necessary to consider which ASAS applications are feasibleto implement. It could be possible to provide position information to equipped aircraft aboutnon-equipped aircraft through implementation of ground functions such as TIS or TIS-B.

8.4.3 Some improved traffic situation awareness may occur even when the percentage of ASASequipped aircraft is small, particularly in situations where two aircraft benefit from being able totrack each other (e.g., possibly, paired approaches). It is probable that benefits to ASASequipped aircraft would increase as other aircraft equip. Other factors, such as surveillancecoverage, would also be significant.

9. TRIALS9.1 The following activities and trials are briefly introduced to highlight the emergence ofpotential operational uses for ASAS applications.

a. In-Trail Climb (ITC) operational trials have been conducted in US oceanic airspacesince 1994. The trial involves a limited number of aircraft operators. Safety analysis wasperformed, procedures were developed, and flight crew and controllers were trained toapply the ITC. Lack of international consensus, particularly regarding the use of ACAS asthe surveillance data source, has prevented this procedure from achieving full operationalstatus.

b. The North European CNS/ATM Applications Project (NEAP), conducted some trialsof ASAS station keeping applications in 1998. Two aircraft operators and three ATSproviders were involved. [9] [10]

c. The SafeFlight 21 programme certified and demonstrated, in 1999, an airbornesurveillance equipment to be used as an aid to ‘see and avoid’; other ASAS applicationswere also demonstrated. The demonstration involved a cross-section of the aircraftoperator community. Further demonstration of additional applications is planned duringthe years 2000 and 2001.

d. The Capstone Program is a joint industry and FAA effort to improve aviation safetyand efficiency in the Alaska region. The trial will commence in 2000, and will eventuallyinvolve about 150 commercial aircraft. These aircraft will be fitted, amongst otherfeatures, with a multi-function display to provide traffic and terrain advisories.

e. ASAS applications to increase airport capacity, by improving the utilisation of closelyspaced parallel runways, are being studied by research establishments and some aircraftoperators. One candidate ASAS application is for independent approach to closely spacedparallel runways, the other is for paired aircraft approaches, again, to closely spacedparallels.

f. R&D centres in several States are conducting studies related to ASAS from variousperspectives: concepts, operational and technical considerations, algorithms for conflictdetection and resolution.



10. TERMINOLOGY & DEFINITIONSACAS Crosslink. The ACAS crosslink is a technique for providing ACAS access to theComm-B registers contained in a Mode S transponder. These registers can contain informationon aircraft state or aircraft intent that may be useful to ACAS.

ACAS. An airborne collision avoidance system based on SSR transponder technology andcomplying with the ICAO SARPs for airborne collision avoidance systems.

Airborne Collision Avoidance. An aircraft function that operates independently of groundbased equipment to alert pilots to the risk of potential airborne collision with other aircraft and togenerate avoidance advice.

ADS-B. A function on an aircraft or surface vehicle that broadcasts position, altitude, vector andother information for use by other aircraft, vehicles and by ground facilities.

Airborne Separation Assurance System (ASAS). The equipment, communications, protocols,airborne surveillance and other aircraft state data, flight crew and air traffic control procedureswhich enable the pilot to exercise responsibility, in agreed and appropriate circumstances, forseparation of his aircraft from one or more other aircraft.

ASAS Separation. An airborne separation, to prescribed minima, either generic or specific toan ASAS application, which is applied by the pilot between own aircraft and other aircraft,through reference to ASAS.

Conflict. A loss or potential loss of separation.

Conflict Detection. The process of detecting or predicting a potential loss of separation. Unlessthe context indicates otherwise, this process is normally assumed to be automatic.

Separation. Separation exists between two or more aircraft when their positions and velocitiesare in accordance with standards or procedures that have been determined to be appropriate forthe operations in which the aircraft are engaged.

Separation Assurance. The process by which assurance is provided that separation ismaintained.

11. REFERENCES[1] ‘Airborne Separation Assurance System: the ASAS Concept’, SICASP/WG2/489, Sydney,

March 1995

[2] ‘The ASAS Concept’, SICASP/6-WP/44, Appendix A, Montreal, February 1997

[3] ‘Information relevant to the use of a system to increase traffic situational awareness andprovide airborne separation assurance’, ADSP/5-WP/61, Appendix B, Montreal, October1999



[4] ‘Procedures for Air Navigation Services, Rules of the Air and Air Traffic Services’, Doc.4444-RAC/501, ICAO, 13th edition, July 1996

[5] ‘Development and Implementation Planning Guide for Automatic DependentSurveillance-Broadcast (ADS-B) Applications’, RTCA/DO-249, RTCA, October 6 1999

[6] ‘International Standards and Recommended Practices, Air Traffic Services’, Annex 11 tothe Convention on International Civil Aviation, ICAO, 10th edition July 1994

[7] ‘Minimum Aviation System Performance Standards for Automatic DependentSurveillance Broadcast (ADS-B)’, RTCA/DO-242, RTCA, February 19 1998.

[8] ‘International Standards and Recommended Practices, Aeronautical Telecommunications’,Annex 10 to the Convention on International Civil Aviation, Volume IV ‘SurveillanceRadar and Collision Avoidance Systems’, ICAO, second edition July 1998

[9] ‘NEAP Project Documentation CD - Final Report’, the Swedish CAA

[10] ‘North European ADS-B Network (NEAN): Final Project Summary and ConclusionReport’, NEAN Project Group, February 1999



Appendix A

DOCUMENTS REQUIRED TO STANDARDISE ASASThe following new ICAO documents, or amendments to existing documents, are expected to berequired for the standardisation of ASAS and ADS-B.

DOCUMENT PURPOSE

ASAS Manual ASAS applications descriptions,role of the component systems, CDTI, ADS-B,Crosslink, ASAS Processor (ASSAP),applications specific software (in particularCD&R),

PANS-OPS (amendments),PANS-RAC Annexes

Procedures for ASAS applications. Concept,and values, of Airborne Separation minima

SARPs, GM for Airborne Surveillance andSeparation Assurance Processing (ASSAP)

Standardisation and guidance

Mode S SARPs, GM, and Manual(amendments)

SARPs and GM for Mode S extended squitter

SARPs for ADS, or Manual Standardisation of ADS-B

SARPs VDL Mode4 and other links, as required Standardisation and guidance

SARPs for Conflict Detection and Resolution Standardisation and guidance



Appendix B

TEMPLATE FOR ASSESSING OF ASAS APPLICATIONSTo permit identification and assessment of the implications of each proposed ASAS application,the proposal should address the following generic areas:

1. Definition of the ASAS application

a. Operational Purpose. The proposal should contain a clear, accurately expressed,statement, which sets out its operational purpose.

b. Type of Airspace. The airspace for which it is proposed, for example, for en-route,terminal, or oceanic airspace, and whether it is proposed for high or low density airspace.

c. IFR/VFR Applicability. The applicability to instrument flight rules (IFR) and visualflight rules (VFR).

d. Development of Special Flight Rules. The potential need for special flight rules (e.g.electronic flight rules (EFR).

e. The Applicability to a Radar, or to a Non-radar, Environment.

Note: It would be advantageous to include an operational scenario illustrating the use of theproposed application.

2. Benefits and Constraints

The benefits, and the level of those benefits, that are expected to be achieved from the ASASprocedure should be listed for the ATM user and the ATM provider. Similarly, the anticipatedconstraints should be exposed. For example, the application might be expected to increase ATMcapacity and provide improved economic returns for an operator, but a constraining factor mightbe that all aircraft in the sector would require to be transmitting ADS-B data, or be capable ofexecuting the application, before the application could be applied.

a. Benefits:

(i) safety;

(ii) capacity, for example, airspace throughput;

(iii) operational Efficiency, and Flexibility.

b. Constraints:

(i) the compatibility of the proposed application with aircraft not capable ofexecuting the application;

(ii) need for ‘exclusive-use airspace’.

3. Operational Procedures

The proposal should provide information on the proposed operational procedures.

a. Pilot and Controller Actions. A description of the operational procedure:

(i) the pilot and controller actions when initiating, authorising, and terminating theprocedure;



(ii) the criteria for pilot acceptance of the procedure - for example, can the pilotrefuse the initiation of the procedure?

(iii) an assessment of the need to delegate the responsibility for separation from thecontroller to the pilot, and indication of the procedure point at which the separationshould be delegated, and the point at which it returns to the controller;

(iv) the proposed procedure to be applied when transferring separationresponsibility from the controller to the pilot;

(v) the proposed procedure to be applied when returning separation responsibilityfrom the pilot to the controller.

b. Proposed Separation Minimum. The proposed ASAS separation between aircraftwhich is to be applied by the pilot during the execution of the procedure.

c. ASAS Advisories and Alerts. The need for advisories or alerts to advise the pilot of apotential loss of separation. The proposed pilot response to those advisories/alerts.

d. Proposed Phraseology. Proposed new, or new usage of current, radiotelephony (RTF)phraseology.

e. The controller's responsibility to monitor. If appropriate, the controller's responsibilityfor monitoring an application and re-establishing standard ATC separation in the eventthat the ASAS procedure is compromised.

f. Contingency Procedures. In the event of an inability to maintain the ASAS procedure,for example due to received corrupted data provided by other aircraft, ASAS failure,contingency measures must permit the effective and safe reapplication of standardseparation by the controller, (including use of redundant systems and capabilities).

g. Emergency Procedures. The procedures to be followed in the event of an aircraftemergency.

4. Safety Rationale

An initial safety assessment, together with assessment of availability, continuity, and integrityrequirements should be provided. At this stage, this need only be done at a high level, but itshould demonstrate an acceptable intrinsic safety level of the application without the need forACAS or any of its sub-systems. A comprehensive safety analysis of the application would beundertaken at a later stage in the standardisation process. This would include:

a. Failure Mode Analysis;

b. Safety Budget and Allocation;

c. Collision Risk Modelling.

5. Requirements for Surveillance and Aircraft State, or any other, Data

The proposal should contain an assessment of the minimum surveillance and aircraft state, or anyother, data requirements necessary for the proposed application. This would include:

a. Data Required;

b. Update Rate;

c. Accuracy;



d. Latency;

e. Availability;

f. Continuity;

g. Integrity.

6. Requirements for Datalink

The proposal should include assessment of all the air-to-air, air-to-ground, ground-to-air, orbroadcast datalink requirements.

7. Pilot Interface Requirements

The proposal should identify the pilot interface requirements needed for the application, togetherwith its interaction with the pilot interface of other systems. This should include an assessmentof the following related areas:

a. Human Factor Aspects;

b. Display Requirements, for example, the minimum acceptable size and resolution of thecockpit display;

c. Aural Indications, for example, enunciation and aural ‘attention-getter’;

d. Alert Priorities, an assessment of aural or visual indications priority; and

e. Failure and Mode Selection Indicators, for example, mode or failure visual indicator‘flags’ and aural ‘attention-getter’.

8. ASAS Algorithm Requirements



Appendix C

ACRONYMSACAS Airborne Collision Avoidance SystemADS-B Automatic Dependent Surveillance – BroadcastADSP Automatic Dependent Surveillance Panel – now called the OPLINK PanelASAS Airborne Separation Assurance SystemASSAP Airborne Surveillance and Separation Assurance ProcessingATC Air Traffic ControlATM Air Traffic ManagementATS Air Traffic ServicesCD&R Conflict Detection and ResolutionCDTI Cockpit Display of Traffic InformationCNS Communications, Navigation and SurveillanceDME Distance Measuring EquipmentFAA Federal Aviation Administration (of the USA)FMS Flight Management SystemGNSS Global Navigation Satellite SystemICAO International Civil Aviation OrganisationIFR Instrument Flight RulesIMC Instrument Meteorological ConditionsITC In Trail ClimbMASPS Minimum Aviation System Performance StandardsMOPS Minimum Operational Performance Specifications (or Standards)NEAP North European CNS/ATM Applications ProjectOED Operational Environment DefinitionOHA Operational Hazard AnalysisRA Resolution AdvisoryR&D Research and DevelopmentRSP Required Surveillance PerformanceRTCA RTCA Inc.RTF Radio TelephonySARPs Standards and Recommended PracticesSICASP SSR Improvements and Collision Avoidance Systems PanelSSR Secondary Surveillance RadarTIS Traffic Information ServiceTIS-B Traffic Information Service - BroadcastTLS Target Level of SafetyTx/Rx Transmission and ReceptionVFR Visual Flight Rules

ICAO Airborne Separation Assurance System (ASAS) Circular · ICAO Airborne Separation Assurance...

Documents

Transcript of ICAO Airborne Separation Assurance System (ASAS) Circular · ICAO Airborne Separation Assurance...