2.3.3 The following IFATCA Policies directly address Flight ID.

From IFATCA Technical and Professional Manual page 3216:

From IFATCA Technical and Professional Manual page 3217:

From IFATCA Technical and Professional Manual page 32214:

From IFATCA Technical and Professional Manual page 3275:

2.3.4 These policies provide safeguards from identification issues with Flight ID. But there are many issues coming to light with this technology. It is the intent of this paper to document and evaluate them thoroughly and determine if additional policy is needed.

2.4 Literature Survey

2.4.1  The following is a chronological review of papers that have discussed potential Flight ID issues.

2.4.2  IFATCA Toulouse 1998

2.4.2.1 Airborne Separation Assistance Systems (ASAS) were first discussed at the IFATCA Conference in 1998 at Toulouse, when they were known as Airborne Separation Assurance Systems.

2.4.2.2 The subject “Transfer of Control Functions to Pilots” became part of SC4’s working programme at the Toulouse conference.

2.4.3  IFATCA Santiago 1999, WP 166:

“IFATCA considers the following to be the minimum attributes of any CDTI system used in Airborne Separation Assurance applications: Positive unambiguous identification of all relevant aircraft to the standards currently required of ATC systems and controllers.”

2.4.4  PO-ASAS 2001

2.4.4.1  In 2001, the US FAA and Eurocontrol worked together to produce the PO-ASAS, Principles of Operation for the Use of ASAS. This document mentioned the Flight ID issue as follows.

2.4.4.2  Page 19:

“Positive identification by the flight crew of aircraft designated by the controller in an instruction or clearance is essential for the safe and efficient execution of ASAS applications. Prior to implementing the flight identification procedure, sufficient simulations and field tests should be conducted to ensure the procedure does not cause additional confusion for flight crews and controllers.”

2.4.4.3  Page 21:

“It is anticipated that airborne surveillance will rely on ADS-B, but not exclusively. In case of partial ADS-B equipage, ground-based traffic services like Traffic Information Service – Broadcast (TIS-B) could be used as a complementary, or even the primary, source of data for airborne surveillance. [In the US, where the four-digit beacon code is used by ground systems to identify an aircraft, the flight ID in the ADS-B transponder could be different from that in the TIS-B transmission.]”

At this early stage it was already realized that a discrepancy could exist between CDTI- displayed Flight ID and ATC-displayed Flight ID.

2.4.4.4  Page 33:

“The [ASAS] procedures must be designed to eliminate ambiguity in the delegation and end of separation responsibility for both flight crews and controllers. Controllers especially cannot tolerate ambiguity because it adversely impacts their workload. Even occasional repeat communications to clarify the clearance could negate any benefits of delegating separation responsibility.”

2.4.4.5  Acknowledgment that ambiguity is intolerable to controllers is essential. Real-time ATC decision making relies heavily on complete confidence in the data presentation. PO- ASAS was a good starting point for handling the Flight ID issue.

2.4.5 Transition to Elementary Mode S Surveillance – Functional Requirements for Mode A Assignment and Correlation, November 20, 2001; Eurocontrol.

2.4.5.1  This paper aimed to accomplish two things: Provide some ground rules for a transition to ADS-B but also alleviate code allocation issues.

2.4.5.2  Section 1.2:

“The steady increase in traffic is causing code saturation problems in some areas, a problem which may be alleviated by the use of Mode S elementary surveillance.”

2.4.5.3  Section 1.4:

“[CONOPS] paragraph 4.2.2 (ii) states that a flight that is not contained wholly within the mode S area should be assigned a discrete code. However this constraint severely reduces the scope for the optimisation of transit code use. This document allows for the relaxation of this constraint provided that the service providers concerned are satisfied.”

2.4.5.4  The method prescribed in this paper requires Mode S-equipped aircraft to broadcast 1000 on Mode A, and this triggers the ground system to correlate the track based on the Mode S flight ID. This method is known as the “conspicuity code”.

2.4.5.5  Eurocontrol attempted to address the incorrect Flight ID issue. The following is from the document cited above:

2.4.5.6 In 2008, Eurocontrol phased in Centralised Code Assignment and Management System (CCAMS) to help manage code allocation issues.

2.4.6 Eurocontrol Specimen Aeronautical Information Circular (AIC), June 26, 2003.

2.4.6.1  This document identified an even deeper potential problem, the case when the airframe 24 bit address is incorrect:

“Instances occur of incorrect 24-bit aircraft addresses being installed/hard-wired on individual aircraft. This has happened not only on first installation of a Mode S transponder but also when a major modification has been made to the Mode S equipment, and following a change of State of Registration. Incorrect installation, such as setting the address to all zeros, or, inadvertent duplication of an address can pose a severe risk to flight safety.”

2.4.6.2  This document specifies the ground rules for the 24 bit address:

“The world-wide addressing scheme has been designed so that, at any one time, no address is assigned to more than one aircraft. Only one address can be assigned to an aircraft and it cannot be changed except under exceptional circumstances authorised by the State regulatory authority concerned.”

2.4.6.3 It also specifies what the pilot is to enter into the Mode S Flight ID:

“In accordance with ICAO Doc 8168 [PANS-OPS] Vol. I, Part VIII, 1.3, flight crew of aircraft equipped with Mode S having an aircraft identification feature shall set the aircraft identification in the transponder… to the aircraft identification specified in item 7 of the ICAO flight plan, or, if no flight plan has been filed, the aircraft registration. Note 1 – No zeros, dashes or spaces are to be added when the Aircraft Identification consists of less than 7 characters.”

2.4.7 IFATCA Buenos Aires 2003

2.4.7.1  At this meeting, provisional IFATCA policy on ASAS and CDTI was accepted.

The policy stated:

This was a first and valuable statement because of its simplicity and broad scope.

2.4.7.2  IFATCA policy also urged the publication of Minimum Operational Performance Specifications (MOPS) for CDTIs by ICAO. This was partly to insure consistent display of Flight ID information between CDTIs of different manufacturers.

2.4.7.3  WP-93 stated:

“It is assumed that these surveillance data requirements provide positive unambiguous identification and intent information. More attention is required to the ‘positive identification’ of other aircraft. Flight ID and R/T call-sign are very often not the same and could introduce error on the flight-deck if not handled correctly in design and implementation (e.g. is every pilot aware that EIN is called ‘Shamrock’ and vice versa?).”

2.4.8 ICAO SASP, Honolulu, Hawaii, November 2003. Draft Amendments to PANS ATM

2.4.8.1 This document seemed to suggest that the Flight ID issue could be resolved within the ATC systems:

2.4.8.2  Correlating the 24 bit address of the airframe with a Flight ID would involve including the 24 bit address in the flight plan. It would require an accurate update whenever an aircraft is out of service for maintenance.

2.4.8.3  Flight ID ambiguities arising from erroneous pilot inputs could be resolved within the ATC systems if the software identifies the mismatch immediately and unmistakably to the controller and if the airborne units allow Flight ID update in flight. This would mirror today’s Mode A environment, where wrong beacon codes are swiftly corrected. But such software is not a requirement today.

2.4.9 IFATCA Istanbul 2007 B.5.11, Surveillance Applications Policy – ASAS

2.4.9.1  IFATCA stated its commitment to ASAS in Agenda Item B.5.11:

“…as our Federation is fully taking part in the ASAS-implementation process it is necessary that the delegates and Member Associations (MAs) have a full understanding of the problems and issues at hand.”

2.4.9.2  B.5.11 also reviewed the timetable for ASAS as identified in PO-ASAS. Package 1 was to deploy in the 2008-2012 time frame, and was to include six ASAS ground applications and seven ASAS airborne applications, including in-trail procedure (ITP), enhanced crossing and passing (C&P), and enhanced sequencing and merging (S&M). These methods could be compromised by incorrect Flight ID.

2.4.9.3  B.5.11 also hit the Flight ID issue:

The CDTI must also utilise a much more sophisticated target labelling, including Flight Identification (ID; using Mode S or ADS-B). In this respect the TCAS-displays just depict the surrounding targets by showing a “blip symbol”…without any target labelling or positive identification shown to the crew. As mentioned above the certification of CDTIs is not yet standardized and regulated by ICAO, or any other international agency. This is a problem that needs to be solved as quickly as possible.

2.4.9.4  It went on to say:

Before surveillance systems can be used operationally it has to be ascertained that…the aircraft (or aircraft pairs) on the CDTI are properly identified. ATC will transmit the identification (or call-signs) of the conflicting traffic to the air crews for conflict resolution or simply to operate their flight “reference to” a given traffic. There must be a high degree of certainty that the risk of misidentification is tolerably low.

2.4.9.5  A final selection from this document examines one of the core issues in perfect detail:

2.4.9.6 Because the ground display is using a different source for Flight ID than the airborne display, the door is open to ambiguity and errors if call signs are referenced by controllers, as ASAS applications will require. Situations can be envisioned in which this discrepancy results in safety lapses and even tragedy. It is likely that other situations will exist in the new ATC environment that cannot yet be envisioned but in which safety would be compromised by the lack of integrity in Flight ID.

2.4.10 IFATCA Istanbul 2007 B.5.12, Surveillance Applications Policy – Operational Applications of ADS-B

2.4.10.1 Paper B.5.12 speaks directly to the emerging issue:

“In the ADS-B environment the flight ID transmitted by the ADS-B unit is responsible (primarily) as the means to correlate a Flight Data Record (FDR) to an ADS-B track. The process involved in entering this data (and indeed changing it) is a much more complex procedure and one that is proving an issue.”

2.4.10.2 The issue of changing the Flight ID starts to become apparent when operators attempt to use ADS-B in “real life”. While the FAA Capstone project had been using ADS-B for many years, FAA systems ignore the Flight ID transmitted by Mode S. Instead, they rely solely on traditional four digit beacon code to correlate a flight plan with a target. But systems in Europe and elsewhere – and obviously CDTIs that read Mode S transmissions – are working from the Flight ID in these transmissions.

2.4.10.3 B.5.12 goes on to say:

2.4.10.4 B.5.12 notes one of the Flight ID issues that pilots may attempt to enter IATA two-letter carrier codes into their Mode S units instead of ICAO three-letter carrier codes:

2.4.10.5  It is not sound design to add another burden on pilots, where none existed before, that requires absolute precision in a mundane task.

2.4.11  IFATCA Istanbul 2007 B.5.13, Surveillance Applications Policy – Review Policy on ADS-B

2.4.11.1  The issue rose to the level of action in Australia, where a regulatory change was proposed as a result.

2.4.11.2  Paper B.5.13 discusses this proposal:

“Again…TOC discusses the issues of capability to ‘switch off’ incorrect ADS-B data. This is an essential part of the protection required when using this technology. In trials conducted in Australia, incorrect Flight ID input is relatively common and with some avionics, the ability to change it ‘airborne’ is limited. This issue…has been recognised in Australia with the proposed changes to ‘Civil Aviation Regulations’ mandating this function.”

2.4.12  Cristal ITP, ISAVIA Simulation, April 30, 2008

2.4.12.1  This test of in-trail procedures used professional controllers, pilots and live aircraft to demonstrate reduced in-trail separation using CDTI displays and cockpit-based separation.

2.4.12.2  To prevent pilots from responding when their call sign was referenced to another aircraft, the reference aircraft call signs were spoken using the ICAO alphabet, i.e. alpha-alpha-lima for “American” (AAL):

“In the simulator it became obvious that switching from the traditional radio call-signs to the ICAO alphabet for airline traffic was not natural for the controllers. It is therefore safe to assume that the same applies to radio operators at a radio station. Using radio call signs is so interwoven in the radio procedures that the controllers found it hard to remember to use the ICAO alphabet for the ITP clearances.”

2.4.12.3  The controller group involved with the test strongly recommended that the procedure only be allowed via datalink because of the use of reference call signs in an open frequency.

2.4.13  ICAO ASP, Louisville, KY. April 20-24, 2009. Guidance Material on Aircraft Identification

2.4.13.1  ICAO has focused on the issue and described in detail numerous reasons the pilot- entered Flight ID would be incorrect, including the use of leading zeroes, use of non- ICAO operator designators, missing characters (SWR97 instead of SWR097), flight IDs from previous legs, characters unrelated to the call sign (hyphens, etc.), no Flight ID, IATA operator designator, and others.

2.4.13.2  Human factor issues included:

• inadequate flight crew knowledge on setting the Flight ID,
• the “embedding” of Flight ID in an integrated FMS such that the crew is not aware of what is being transmitted and is completely dependent on whatever was originally entered at the beginning of the flight, and
• restrictions placed by some operators on altering Flight ID during flight. 2.4.13.3 Equipment issues included:

• input devices that automatically insert zeroes,
• failure of the FMS/Mode S link,
• absence of Flight ID input device on aircraft not equipped with FMS,
• inability to modify hardwired company designator when the aircraft is operated by a different airline, and others.

2.4.14 ICAO ASP, Louisville, KY, April 20-24, 2009. Eurocontrol Maastricht – UAC Statistics on Aircraft Identification

2.4.14.1 Eurocontrol delivered this definitive live study on error rates in Mode S Flight ID. Figure 1 shows the results. A significant error rate remained over the long term.

Figure 1: Incorrect Flight ID data from Maastricht Study

2.4.15 MITRE Corporation, ICAS 2008, Say Who? Homing in on Conventions for Traffic Identification in Communications Centered Around a Cockpit Traffic Display

2.4.15.1 This study expressed the core issue concisely:

“..a procedural requirement for controller/pilot communications establishing a shared traffic referent is implicit in the design of multiple [ASAS] applications.”

2.4.15.2 The implication of this statement is that without a “shared traffic referent” (a common source of call sign data) between pilot and controller, ASAS applications are unsafe. If the pilot referent for call sign is the Flight ID transmitted by an ADS-B transponder and the controller referent is the aircraft identification stored in the ATC system, there is no shared referent.

2.4.15.3 The study mentions, ominously, what can result when there is no shared traffic referent or when the traffic referents are not fully synchronized. In the mid-air collision in July 2002 near Uberlingen, Germany, the data available to the controller was not updated as frequently as that available to the aircraft’s TCAS.

2.4.15.4 The study also pointed out yet another issue with call signs. There has always been an issue with reading call signs properly, but this issue has been confined to the controller side. With pilots having their own display of text call signs on the CDTI, it will become possible for pilots to confuse call signs visually, not just by audio, especially since pilots will be reading from a relatively small screen at an angle.

2.4.15.5 The call sign study that was conducted included the following assumption:

“…a core premise of the ASAS/CDTI design is that the pilot will initialize the system, typically before departure, by setting the aircraft call sign in the transponder broadcast. For purposes of this appraisal, we assume that a process is in place to ensure the integrity of the broadcast call sign identifier and displayed call signs are correctly associated with aircraft addresses on pilot and controller systems.”

2.5 ICAO

2.5.1  The following sections from ICAO Document 4444 (PANS-ATM) are applicable to the flight ID issue.

2.5.2  8.5.3 Operation of SSR transponders:

2.5.4  8.2 Situation Display:

“8.2.9 Labels shall be associated with their position indications in a manner precluding erroneous identification by or confusion on the part of the controller. All label information shall be presented in a clear and concise manner.”

2.5.5  The PANS-ATM seems to only address system requirements as stated in 8.2.9. The question is: Does this requirement mean that the display system must allow the controller to over-ride the flight ID presented on screen? The next question is: As a practical reality do ANSPs adhere to such a requirement?

2.5.6  8.6.2.3 SSR Identification Procedures:

2.5.7  The goal of eliminating the recourse to Mode A discrete codes can only be realized if pilots have full control to edit the flight ID in their Mode S transponders, just as they currently have in Mode A transponders.

2.5.8  8.6.2.2 ADS-B Identification Procedures:

“Where ADS-B is used for identification, aircraft may be identified by one or more of the following procedures:

a) direct recognition of the aircraft identification in an ADS-B label;

b) transfer of ADS-B identification (see 8.6.3);

c) observation of compliance with an instruction to TRANSMIT ADS-B IDENT.”

2.6 Existing ICAO Proposed Changes

2.6.1  Bjarni K. Stefansson is Representative to the ICAO Separation and Airspace Safety Panel (SASP). In his report from their meeting in Montreal in June 2009, Bjarni reports that In Trail Procedure (ITP) is a proposed change to the PANS-ATM.

The proposed language includes the following:

“A controller may separate an ITP aircraft from a reference aircraft provided the following conditions are satisfied…b) the Aircraft Identification of each reference aircraft in the ITP request exactly matches Item 7-Aircraft Identification of the corresponding aircraft’s filed flight plan;

Note — In ITP communications, the Reference Aircraft Identification should be spoken in accordance with the ICAO radiotelephony alphabet, eg. ALPHA BRAVO CHARLIE.”

2.6.2  The proposed language prevents the Flight ID issue from causing a problem. Controllers are not to issue an ITP clearance when a discrepancy exists between the reference aircraft identification (Mode S Flight ID) and the filed aircraft identification (ATC-displayed Flight ID). The method relies on controllers and pilots to pay close attention to the spoken Reference Aircraft Identification.

2.7 Surface Vehicles

2.7.1  Surface vehicles are or will be broadcasting a “Flight ID” as well. Products such as the Sensis Veelo vehicle locator are portable transponders designed to integrate directly into the ATC system, including the 24-bit physical address. They allow the user to enter a text string into what is normally the Flight ID field.

2.7.2  Perhaps contrary to popular belief, the lack of a “flight plan” for vehicles can be good. There can be no confusion because of the existence of a separate “traffic referent”, as we have with Mode S Flight ID and filed aircraft identification. The vehicle has only one identity at a time – whatever it is broadcasting.

2.7.3  All parties, from ATC to other vehicles and aircraft with ADS-B in, will see the identical identification on their displays. If the ID is incorrect, then it seems likely the controller will not provide a clearance and the vehicle will remain in a safe area until the error is corrected. The exception would be when two vehicles are broadcasting the same Flight ID. In that case, the ATC software must identify the error.

2.7.4 Some of these systems do not display the Flight ID being transmitted to the operator of the vehicle. This is a safety risk since units may be moved between vehicles and the label on the unit showing the Flight ID being broadcast will invariably fall off.

2.8 IFALPA

2.8.1 In the joint IFATCA / IFALPA meeting in Las Vegas in October 2009, this subject was discussed and IFALPA generally agreed with the IFATCA position.

2.9 Educational Issues

2.9.1  NAVCANADA has been a pioneer in educating Hudson Bay pilots in the importance of entering Flight ID properly.

2.9.2  While NAVCANADA has had success in this effort, the community flying over the Hudson Bay is only a small portion of the world’s active pilots. Obtaining compliance from a small and select group of pilots is not the same challenge as it would be to get compliance from pilots on a worldwide scale. This is not to be critical of pilots in any way, but simply to recognize the practical aspects of dealing with very large numbers of people. Pilots already have a great number of performance “traps” they can fall into during every flight and do not need another.

2.10 Intrinsic Solution

2.10.1  TOC considers best a technological solution that mitigates or resolves the issue dynamically and automatically. Such a self-correcting, intrinsic solution would either eliminate Flight ID discrepancies or provide automatic detection and an easy, quick and routine resolution.

2.10.2  Karol Kerns of Mitre Corp (McLean, Virginia, USA) wrote the following in an ad hoc paper regarding this issue:

2.10.3 Ms. Kerns has been studying the Flight ID issue for many years and TOC feels her opinion on this represents a well-reasoned and justifiable position. TOC believes it can serve as a starting point for IFATCA’s position on the issue. TOC believes IFATCA should lobby for an intrinsic solution, and that any alternative would be a “band-aid” solution that would represent a burden to the system.

2.11 Other Issues of Note

2.11.1  Mode A beacon code is not always broadcast by Mode S transponders because at one point it was not required by ICAO. It is now under DO-260A but many aircraft still do not transmit Mode A code via Mode S transponder.

2.11.2  Flight ID in CPDLC can be a third manually entered identification in some cases where the airborne CPDLC is not integrated with the FMS or Mode S. Having a third traffic referent further degrades the integrity of the system.