65TH ANNUAL CONFERENCE, Abu Dhabi, 28 April – 2 May 2025WP No. 104Deactivation of Safety NetsPresented by PLC and TOC |
Summary
| This paper discusses the need for amendments to the IFATCA TPM policies related to safety net alerts in the ATC system. It emphasizes the findings from the FAA’s study on nuisance alerts, highlighting the importance of eliminating unnecessary alerts and tailoring safety nets to each facility’s specific needs. It stresses the importance of involving ATCOs in defining nuisance alerts, exploring visual alerts to minimize distractions, and ensuring effective configuration of automation systems. The proposed policy additions and changes aim to improve safety net effectiveness, reduce nuisance alerts, and prevent the deactivation of safety nets, ensuring they remain reliable and purposeful. |
Introduction
1.1. Controller Tools and Safety Nets are necessary functions that are imperative to the safety of the Air Traffic Control (ATC) system. The ATC environment can have different layers of defence. These can include ATC procedures, flow control regulations, and conflict detection tools such as Medium Term Conflict Detection (MTCD) systems and Short Term Conflict Alert (STCA) systems (Toulouse 1998). When alarms and alerts from safety nets are deactivated, a layer of protection against incidents is removed, and thus controller vulnerability is increased.
1.2. Contained in the IFATCA Technical and Professional Manual (TPM) definitions section, there are definitions for the following terms relating to alerts: controller tools, conflict detection tools, short term conflict alert, and safety nets.
1.3. It is easy to say that all these things including their specific alerts and warnings are used as controller tools; however, the term “safety tools” as discussed at conference in Montego Bay, Jamaica (IFATCA 2023) is not a term defined in the TPM. The term safety nets as defined in the TPM more accurately represents the topic of discussion.
1.4. The discussion on WP 158 Information Overload in ATC (Jamaica 2023), focused on ATCOs having to process too much information at one time which can lead to an ATCO ignoring or disabling an alarm or alert. When these alarms or alerts become false alerts or nuisance alerts, they could perhaps be deactivated or ignored by the ATCO without assessing the risk. As indicated in the TPM, associated with ATS 3.16 The Use of Safety Nets in ATM, safety net tools are being employed for separation protection in addition to collision avoidance. The distinction in the system and the alert provided to the ATCO is not present and as such, “the use of the safety net is being compromised by its use as a conflict detection tool.” (TPM 2024a)
1.5. Safety nets are designed to create a warning when immediate recognition and corrective or compensatory action is required. The purpose of this working paper is to better define the terms associated with controller tools and safety nets and assess the need for a more defined policy regarding any deactivation of safety nets.
Discussion
Preface
2.1. The following definitions, as written in the TPM Version 67.0, 2024, are important to understand and consider throughout the discussion of this paper:
2.1.1. Controller Tools – Functions of an ATM system that enhance a controller’s ability to meet the objectives of Air Traffic Services. They provide information that assists controllers in the planning and execution of their duties, rather than dictating a course of action.
2.1.2. Safety Net – An Integral part of the ATM system that is imperative to air traffic safety. Airborne or ground-based function, the sole purpose of which is to alert the pilot or controller of an imminent situation such as the collision of aircraft or aircraft to terrain. Safety Nets, using primarily surveillance data, shall provide sufficient warning times to allow appropriate action to be taken to prevent the collision of aircraft or aircraft to terrain. For airborne systems, this includes, but is not limited to the Airborne Collision Avoidance System (ACAS). For ground-based systems, this includes, but is not limited to Short Term Conflict Alert (STCA), Minimum Safe Altitude Warning (MSAW), Airspace Proximity Warning (APW), Approach Path Monitor (APM), and Runway Incursion Monitoring.
2.2. What must be clearly understood is that while all safety nets serve as controller tools, not all controller tools qualify as safety nets.
Background
2.3. Study on nuisance alerts – Nuisance alerts can cause many problems in operational settings and have caused some ANSPs to deactivate their safety systems completely. In an effort to provide a guide for air traffic system designers and controller user teams, the United States Federal Aviation Administration (FAA) and the Engility Corporation conducted a study (Friedman-Berg, Allendoerfer & Pai, 2008) on nuisance alerts. In the study, the authors found that nuisance alerts are distracting and can lead to desensitisation and poorer overall performance. Just like with information overload, there has been much anecdotal evidence regarding the high rate of nuisance alerts in facilities, but there have not been many studies to evaluate the problem.
2.3.1. Alerts are intended to cause people to stop what they are doing and attend to a potential hazard. However, some alerts fail to provide useful information and can create their own human factors problems. When an alert is identified as false, or does not result in action, it can cause an interruption unnecessarily reducing performance. These are known as nuisance alerts. When a controller encounters too many nuisance alerts, they may start to ignore the alert and become desensitised to it. They may also develop decreased trust in the automation system.
2.3.2. Desensitisation can lead to slower responses to real high urgency alerts. When there is a high incidence of nuisance alerts, people may suppress the alert before determining its actual status or may no longer treat the alert as a mandatory action.
2.3.3. Audible alerts can be effective at drawing attention; however, they have been the source of many complaints from ATCOs. Frequent and irrelevant auditory interruptions can disrupt visual task performance, which could be a problem in a profession like Air Traffic Control.
2.3.4. In the study, two main alerts were examined: Conflict Alert (CA) which projects that two aircraft will be closer than separation minima allow, and Minimum Safe Altitude Warning (MSAW) which projects that one aircraft soon will be closer to a physical obstruction (terrain, buildings) than is considered safe. The presentation methods for CAs and MSAWs vary among ATC systems and incorporate combinations of flashing, colour, text, and sound.
2.3.5. It was determined that at least twenty seconds are necessary for a controller to recognise an alert, formulate a response, communicate it to the pilot, and for the pilot and aircraft to respond. Also, alerts lasting less than 20 seconds that did not result in an error were deemed nuisances, because they were deactivated before a controller response could have taken effect.
2.3.6. When analysing controller actions after a particular alert was activated, it was found that responses took longer than a minute. It was also observed that in 67% of situations, controllers took action before activation of the alert. Taking action before the alert is strong evidence that most CAs and MSAWs notify controllers about situations for which they are already aware. For control instructions, where a controller asks a pilot to change altitude, heading, etc., the median response time was approximately 88 seconds. For traffic advisories, where controllers warn aircraft that they may violate separation standards, the median response time was 78 seconds. These long gaps suggest that controllers wait to see how a situation develops before taking action. This does not mean that the alerts are unnecessary, because they do lead to action. MSAW alerts tend to take less time for action (38 seconds on average) before beginning to issue control instructions. This suggests that controllers regard most MSAW situations to be more urgent than most CAs.
2.3.7. If a controller does not respond to an alert and the event does not develop into a loss of separation, it can be concluded that the situation resolved itself and that the alert may have been some form of nuisance alert. The number of nuisance alerts is the most serious human factors issue facing ATC alerting systems. Nuisance alerts create workload and distractions can lead to poor performance. Determining whether an alert is truly a nuisance alert is a difficult task with limited data. When a situation occurs, to know if an alert was truly a nuisance, we would need to know what the controller knew, what they didn’t know, and what they were thinking at the time of the alert. Additionally, individual performance may differ between controllers. Therefore, an alert that might be a nuisance for one controller might be a necessary warning to another.
2.4. Reasons why safety nets might get deactivated.
2.4.1. In some cases, safety nets may be getting used as controller tools. When the parameters are not set correctly, false alarms or alerts can cause them to become nuisance alerts causing the tool to be discontinued.
2.4.2. Unexpected/Unplanned outage- ANSPs should have contingency plans in effect in case of a system failure wherein safety nets are unavailable, disengaged, or deactivated.
2.4.3. Planned outages- Controller tools and safety nets can be disabled for reasons such as system maintenance, software updates, or testing. It is vital in this case that the ATCO’s are aware of such an outage and are briefed on the impact the outage will have on the system. Using a visual aid or a checklist can be useful.
2.4.4. In some ANSPs, at an ATCOs request with supervisor approval, an engineer can disable safety nets that are considered nuisance alerts for one particular aircraft (i.e. paradrop, military, or photo missions) to
prevent continuous activation during that particular flight. This action should not disable the entire system.
2.5. Examples of safety net deactivation by ANSPs, 2023 observations.
2.5.1. Several European member states have different operating parameters for their safety net systems. Below are examples given from their representatives:
2.5.1.1. In one European example, the Air Traffic Control Officers (ATCOs) cannot switch off any safety nets, but they can suppress the medium-term conflict alert, which does not turn off the entire system. The engineers can switch the system off when needed. If they turn off the STCA, ATCOs slow down the rate of flights to reduce risk.
2.5.1.2. In another, the parameters set on STCA activate 2 minutes before the projected loss of separation would occur and the alert cannot be suppressed.
2.5.1.3. In a third example, ATCOs cannot turn off any alerts that are safety nets; however, they are able to suppress the MSAW in some areas as long as the aircraft is on final approach or on a Standard Instrument Departure (SID) or Standard Terminal Arrival (STAR) to prevent false alerts. Only technical staff or system developers can turn the system off.
2.5.1.4. In an approach control facility, all controller tools and safety nets are switched off. At the Area Control Centre (ACC), there is STCA available, but the approach control unit turns it off because it has been a nuisance alert since technicians cannot adjust the system to allow for different separation minima.
2.5.1.5. In a fifth example, the Supervisor can, at the request of the ATCO, turn off all alerts for a particular callsign, as in a photo mission or paradrop. This does mitigate the nuisance alert; however, all alerts are then turned off for that particular callsign. 2.5.1.6. In another example, several safety nets are in use like a runway incursion and alerting system, and a go-around detections system, as well as safety nets in the electronic flightstrip system. These tools can only be turned off by engineers after approval of the supervisor. For the approach control, there is no STCA, but another tool they consider a safety net is Pilot Selected Level (PSL) warning. This is available based on the input from the pilot. ATCOs then get an alert if they assign an altitude/flight level (FL) and the pilot enters a different altitude/FL.
2.5.1.7. While in another, access to the functions of safety nets are limited to managers and technicians only. ATCOs can suppress some alerts; however, they cannot suppress STCA. ATCOs can only acknowledge and disable the audible portion. They can only suppress conflict alerts for specific flights operating in a flight or a group such as military aircraft in designated training areas.
2.5.2. In two member states in the Americas Region, ATCOs have Medium Term Conflict Alert which gives an initial advisory about the conflict, then will alert again as Short Term Conflict Alert (STCA) when a separation loss is imminent. ATCOs are able to suppress the first advisory acknowledging the alert and confirming that action is being taken to correct the situation. If that corrective action is not sufficient when separation loss is imminent, the alert will activate again and cannot be suppressed until separation is achieved. MSAW alerts are also in use which can be suppressed for a specific flight on approach to its destination.
2.5.3. An ANSP in South America has a generic alarm which is generated by any safety alert such as Secondary Surveillance Radar (SSR), duplicity, route deviation, etc. It was the sound of a telephone ring. It was deactivated because it was considered a nuisance alarm. Safety alerts are on all the time, but the audible alarm had to be turned off because it would alarm all day long. Some safety alerts do change colours, though. For instance, red for an emergency.
2.5.4. In the Middle East, ATCOs cannot turn off any alerts in approach and tower environments. The only way to turn off a low altitude alert is to define the label as a VFR aircraft. All other alerts will have an audible alert until the conflict is resolved.
2.5.5. In the Asia Pacific Region, ATCOs at one ANSP can turn off the alarms for individual aircraft after recording it in the aircraft label on the display.
2.6. The above-mentioned ANSP examples show where safety nets are being utilised for separation assurance. The tool is being used to predict a potential loss of separation and not an imminent collision. In this capacity, as per the definition, the system would not be considered a Safety Net but instead just a Controller Tool. These examples show that adaptation/configuration of the tool is not appropriate, which leads to the desire to disable the alerts as they are determined to be nuisance alerts. While there is no issue with the system/functionality having a dual purpose, clear distinction between the two needs to be ensured.
2.7. Existing IFATCA policy does not truly differentiate between Controller Tool and Safety Net, as not all Controller Tools are Safety Nets. Current policy regarding controller tools and safety nets are as follows,
2.7.1. ATS 3.16 The Use of Safety Nets in ATM policy (TPM 2024a) is very limited and does not address the concerns of the Member Associations when the topic came up in discussion in Committee C during conference in Montego Bay, Jamaica (IFATCA 2023). We will propose an amendment to provide overarching guidance and address the concerns. The policy currently states:
|
When implementing ground-based safety nets, common phraseology and procedures shall be used in their operation. |
2.7.2. ATS 3.17 Conflict Detection Tools policy (TPM 2024b) is relative and effective. This policy states:
|
Responsibility and legal implications should be fully addressed before implementation of CDTs. During degraded modes, clearly defined operational procedures shall exist. Nuisance and false alerts shall be kept to an absolute minimum. |
2.7.3. ATS 3.18 Short Term Conflict Alert policy (TPM 2024c) is relative and effective but does contain an overarching statement. We will propose one small change. This policy states:
|
STCA, as a safety net, shall be provided to each ATM-system with ATS Surveillance. STCA parameters shall be adjustable and nuisance filters for each individual ATC unit with ATS Surveillance, are developed, and tested for the area involved and adjusted to the procedures, airspace layout, separation standards, surveillance source, traffic mix, etc. A STCA function shall not be considered when developing a safety case, unless it can be demonstrated that the functionality is used in a separation assurance mode of operation. |
2.7.4. ATS 3.19 Minimum Safe Altitude Warning Systems policy (TPM 2024c) is effective, and we will propose a slight amendment based on the study provided. This policy states:
|
MSAW shall be fully implemented with appropriate operational requirements, procedures, and training in order to significantly reduce the number of CFIT. |
2.7.5. WC 10.2.5 Automation/Human Factors policy (TPM 2024e) was amended during the conference in Montego Bay, Jamaica (IFATCA 2023). During this discussion in Committee C, the members discussed the possible need for additional policy regarding deactivation of safety tools. We will propose an amendment to address the additional policy requirement and for wording consistency. The policy states:
|
Automation shall improve and enhance the data exchange for controllers. Automated systems shall be fail-safe and provide accurate and incorruptible data. These systems shall be built with an integrity factor to review and crosscheck the information being received. |
2.7.6. WC 10.2.10 Short Term Conflict Alert (STCA): Human Factors/Legal Aspects policy (TPM 2024f) is one of two policies in the TPM about STCA. This policy contains overarching statements that would apply to all safety net systems and would be better addressed in another policy.
We will propose removal in its entirety. This policy states:
|
The Short Term Conflict Alert (STCA) system should only alert the controllers at the specific radar sector concerned, and not at positions where controllers are not involved in the alert. The methods and procedures for the use of STCA should be clearly defined before the introduction of the equipment. Unless STCA provides a definitive course of action for the controller to follow, it cannot be accepted that the fitting of an STCA device will necessarily increase the controller’s legal liability should an incident occur. |
Way Forward
2.8. The first step in the clarification between Controller Tools and Safety Nets is to clearly define a Safety Net Alert. Although there are four “alert” definitions in the TPM, none of them outline what a Safety Net Alert should be. A definition such as this would clearly define a Safety Net Alert,
A unique and distinguishable audible and/or visual annunciation, provided by an ATM system to a controller, indicating the activation of a Safety Net.
This supports the existing Safety Net definition and then both together provide a foundation for policies throughout the TPM.
2.9. When the Safety Net definition is considered in concert with the suggested Safety Net Alert definition, the last sentence of the last section of policy WC 10.2.5 Automation/Human Factors should be changed to reflect the importance of a Safety Net and its associated alert. Existing wording does not clearly state “Safety Net”, rather it states, “Safety tool”, and includes “should”, thus leaving room for interpretation. To bring clarity and emphasise the relative importance and intent of the component of the policy; it is suggested to amend the wording from “Safety tool” to “Safety Net” and change “should” to “shall”.
Safety Nets shall not be deactivated.
2.10. As there will be occasions where a Safety Net must be deactivated for maintenance, upgrades, etc., policy WC 10.2.5 must provide for the ability to deactivate a Safety Net. As such, guidance needs to be provided in another policy or a new policy to prevent Safety Net deactivation without due consideration. In reviewing existing policy, it was felt that ATS 3.16 The Use of Safety Nets in ATM would be an appropriate location. This conclusion was based on the intent of that policy as a whole. The addition of the following wording to the above suggestion for policy WC 10.2.5 will provide necessary direction.
…in any manner unless required for the implementation of, change to, or degradation of adaptation/configuration of the functionality and/or system, as per the policy The Use of Safety Nets in ATM
2.11. WC 10.2.10 Short Term Conflict Alert (STCA): Human Factors/Legal contains sound wording regarding alerts and where they are observed but it is related to a specific function. With the establishment of a Safety Net Alert definition and overarching WC policy relating to Safety Net Alert human factors is obvious. With such a policy, any system or function identified as a safety net would have guidance to follow in relation to the respective alerts. A safety net alert policy would also support WC 10.2.5 Automation/Human Factors policy with the suggested amendment. A new WC policy labelled “Safety Net Alert/Human Factors” with the following wording is suggested,
Safety Net Alerts should only alert the controllers at the specific working position(s) concerned, and not at working positions where controllers are not concerned in the alert.
Safety Net Alert suppression shall be restricted to only the audible annunciation. The audible annunciation should reactivate following a brief period if the event creating the alert persists. The visual annunciation shall remain active until the event creating the alert is fully resolved.
This wording captures where and how safety net alerts should be presented and encompasses the human factors impacts of alerts. This is accomplished by the restriction of the alert to the specific working position. Additionally, guidance to the audible and visual alerts for the purpose of ensuring they are not continually intrusive to the ATCO yet will provide a reminder to the ATCO if the issue does not resolve in a timely manner.
2.12. ATS 3.16 The Use of Safety Nets in ATM is an overarching policy that provides simplified guidance to common phraseology and procedures relating to its operation. The policy however falls short on considerations to development of procedures and protocols relating to system failures, degradations, deactivation, etc. To address this shortfall, the following addition to the policy is suggested,
ATCOs must be involved in the development of procedures and protocols for implementation, changes to, degradations of, and safety net failures. ATCOs, managers, or technical personnel must not have the ability to change, degrade or deactivate the safety net on an impromptu basis.
This wording not only covers off the involvement of ATCOs in the development of procedures and protocols but also provides guidance to restrict spontaneous deactivation of safety nets.
2.13. As nuisance alerts are a significant issue, and examples mentioned above outline the importance of appropriate adaptation/configuration, it is suggested that the overarching policy ATS 3.16 also provides guidance on the integrity of safety nets. The following addition to the policy is suggested,
To ensure the integrity of the safety net is maintained, all safety net system configurations, adaptations, and customisations must be set in such a manner to eliminate, avoid or minimise spurious and nuisance alerts from being presented. In addition, these settings must be reviewed on a regular basis, and amended as required.
This wording provides the guidance to ensure safety nets are adapted/configured appropriately to prevent nuisance alerts for the airspace they are being utilised. Additionally, wording includes guidance to regularly review adaptations/configurations to ensure they are still consistent with separation standards and procedures employed in the airspace for which the safety net is being used.
2.14. As safety nets are being leveraged as a separation assurance tool or “Controller Tool”, the occurrence of nuisance alerts increases and effectively diminishes the impact of safety nets. To ensure that safety nets remain effective as the “last line of defence”, it was felt that ATS 3.16 should have wording to clarify that safety nets should not be considered in a safety case. The following addition to the policy is suggested,
A Safety Net function shall not be considered when developing a safety case.
This wording is currently contained in policy ATS 3.18 Short-Term Conflict Alert, is well-founded, and should apply universally to all safety nets. By incorporating it into the overarching safety net policy ATS 3.16, it would then apply to any systems identified as a safety net.
2.15. By incorporating the wording from ATS 3.18 concerning safety cases and the separation assurance mode of operation into ATS 3.16, the current wording in ATS 3.18 can be removed from the policy. As such, it recommended that it be removed and ATS 3.18 policy simply read as,
STCA, as a safety net, shall be provided to each ATM-system with ATS Surveillance.
STCA parameters shall be adjustable and nuisance filters for each individual ATC unit with ATS surveillance, are developed, and tested for the area involved and adjusted to the procedures, airspace layout, separation standards, surveillance source, traffic mix, etc…
To preserve the intent and integrity of safety nets, exception conditions should not be included in a Safety Net policy. Since ATS 3.18 defines the associated system as a ‘safety net’ within the policy, exception wording in ATS 3.18 will be removed.
2.16. Currently there are two policies relating to short term conflict alert (STCA), one being a WC policy and the other an ATS policy. With the development of a Safety Net Alert definition and the creation of a Safety Net/Human Factors policy, the content within WC 10.2.10 is either duplicated or is covered. One component not addressed by the new definition and policy relates to the ATCO liability. This remaining part of the statement is somewhat of an overarching statement indicating that having the function available does not increase the ATCO legal liability. This type of statement could be added to any policy relating to a controller tool or safety net potentially creating a lot of duplication in the TPM. As such, it is suggested that it be added to the overarching policy WC 10.2.5, with the following wording,
A controller’s liability for incidents shall not increase with the fitting of any Controller Tool or Safety Net.
This wording follows similar structure to other statements within the policy. Its inclusion in policy WC 10.2.5 would mean that it would apply throughout the policies relating to automation.
2.17. WC 10.2.10 also contains a statement relating to methods and procedures being clearly defined before implementation of STCA capabilities. This statement, while important for STCA, is appropriate for any safety net utilised in ATM. With this in mind, it is more appropriate for it to be in an overarching policy to impact all safety nets removing the need to state it in individual policies. Therefore, it is suggested that the following be added to the first paragraph of the overarching policy ATS 3.16 The Use of Safety Nets in ATM,
Procedures for the use of safety nets must be clearly defined prior to the introduction of the functionality.
To locate this wording in policy ATS 3.16, it will appropriately apply to any safety net system policy within TPM as well as any potentially new safety net that may yet have a policy in TPM.
2.18. By addressing the statement indicated in item 2.10 of this paper, all components of the existing WC 10.2.10 are addressed in either the new policies or incorporated into other appropriate existing policies. As such, the policy has been rendered redundant and should be removed from TPM.
2.19. Minimum Safe Altitude Warning (MSAW) is a safety net (EUROCONTROL 2017). Current policy ATS 3.19 Minimum Safe Altitude Warning Systems does not contain a clear indication of that understanding. To ensure that the safety net aspect of the system is not lost if it were leveraged to be a Controller tool, an addition of wording is necessary. The suggested wording is “as a safety net”, inserted following “MSAW” at the beginning of the policy. Furthermore, to ensure policy consistency across safety nets using surveillance, the following wording would be included: “shall be provided to each ATM system with ATS Surveillance and”. The entire policy would read as,
MSAW, as a safety net, shall be provided to each ATM-system with ATS Surveillance and shall be fully implemented with appropriate operational requirements, procedures, and training in order to significantly reduce the number of CFIT.
The inclusion of this wording would then ensure that the system is subject to the overarching Safety Net and Safety Net Alert definitions and policies.
2.20. To maintain consistency within the TPM in having policies for safety net systems, policies need to be added for both Area Proximity Warning (APW) and Approach Path Monitor (APM) as both are considered safety nets (EUROCONTROL 2017).
2.20.1. The following are suggested policies for APW and APM respectively,
2.20.1.1. APW, as a safety net, shall be provided to each ATM-system with ATS Surveillance and shall be fully implemented with appropriate operational requirements, procedures, and training in order to significantly reduce incursion of a flight into “specialuse” airspace. 2.20.1.2. APM, as a safety net, shall be provided to each ATM-system with ATS Surveillance and shall be fully implemented with appropriate operational requirements, procedures, and training in order to significantly reduce the number of CFIT of aircraft during final approach.
Conclusions
3.1. In evaluating the current definitions dealing with alerts in the ATC system contained in the IFATCA TPM, version 67.0, 2024 and understanding the discussion and reasoning for policy change in WP 158, Information Overload in ATC (Jamaica 2023), it can be deduced that policies affected within the TPM need to be amended appropriately. A wording change to the policy WC 10.2.5 Automation/Human Factors is needed to comply with current terminology.
3.2. The FAA’s study on nuisance alerts highlights the importance of eliminating those alerts that qualify as nuisance alerts and ensuring safety nets are tailored to be effective for each particular sector within every facility. An interesting point was made in the conclusion of this study when the authors noted that they could not tell what the controller was thinking at the time of an alert or what effect such a large number of nuisance alerts may have on controller performance without doing a “human in the loop” study or stopping the simulation and asking those particular questions.
3.3. Reviewing the 2023 examples provided by Member Associations shows that systems’ use, and effectiveness vary. One constant seems to be that most ANSPs that have the ability to turn off the safety net system completely only do so in the event of an outage or when it has been identified as a nuisance alert. Otherwise, most ATCOs may only suppress the system for a single aircraft during that particular flight, or one conflict as an acknowledgement that sufficient action is being taken. Based on these findings, it can be agreed that efforts should be made to eliminate nuisance alerts and that safety nets shall not be disengaged. In cases such as a system outage or system maintenance, contingency plans should be in place and ATCOs and supervisors should be advised of the impact on the operation.
3.4. It is vitally important that ATCOs be involved in the process of determining what qualifies as a nuisance alert and what alerts are important to an ATCO in the operation. It also may be important to explore visual alerts over audible alarms to ensure distractions to other controllers are kept to a minimum. Automation systems should also reactivate when a CA or MSAW lasts longer or becomes more urgent than a set of predetermined criteria. With ATCOs involvement, MAs and ANSPs should collaboratively conduct further analysis so as to build and improve suppression zones, MSAW grids, and determine controller response times to alerts to develop more precise parameters for use in safety alert algorithms.
3.5. In reviewing the current policies regarding ATC System alerts and warnings, it can be determined that concerns of the Member Associations could be addressed by amending some of these policies. It is necessary to include the ATCOs in the process of developing policies and procedures and ensuring nuisance alerts are omitted. The most important controller tools are effective safety nets that are properly developed and do not get deactivated.
3.6. As safety nets are increasingly being used as separation assurance or controller tools, their distinct purpose is becoming blurred. This shift diminishes their effectiveness, as separation assurance tools do not always signal an imminent collision or require an immediate controller response. The fundamental role of a safety net is to prevent collisions, not to manage separation. Safety nets are designed to prevent a catastrophic event. When the urgency is lower, safety nets should not be triggered.
3.7. All of the suggested changes to policy are intended to establish criteria around a Safety Net and the corresponding Safety Net Alert. The adoption of the suggested changes to policy will ensure that Safety Nets remain effective for the intended purpose, reduce, or eliminate nuisance alerts, and ultimately remove the need to consider deactivating a Safety Net.
Recommendations
4.1 As the definitions adopted at conference in Singapore (IFATCA 2024) affect existing policies and the desire to provide more guidance to Safety Nets and Safety Net Alerts, we propose that the following definitions and new policies be added as well as amend identified existing policies in the current TPM (TPM 2024g).
4.1.1. New Definition – Safety Net Alert
It is proposed to create a new definition in TPM for Safety Net Alert
| IFATCA TPM (NEW), Definitions – Safety Net Alert |
|
A unique and distinguishable audible and/or visual annunciation, provided by an ATM system to a controller, indicating that a safety net is triggered. |
4.1.2. New Policy – Human Factors / Safety Net Alerts
It is proposed to create new WC policy in TPM for Human Factors/Safety Nets Alerts
| IFATCA TPM (20xx), WC X.X.X – Human Factors / Safety Net Alerts |
|
Proposal: Safety Net Alerts shall only alert the controllers at the specific working positions concerned, and not at working positions where controllers are not concerned in the alert. Safety Net Alert Suppression shall be restricted to the audible annunciation and the suppression be position specific. The audible annunciation should reactivate following a brief period if the event creating the alert persists. The visual annunciation shall remain active until the event creating the alert is fully resolved. |
4.1.3. IFATCA TPM (2024), WC 10.2.5 – Automation/Human Factors
It is proposed to add a component about Safety Nets to not be deactivated and add a statement regarding controller liability
| IFATCA TPM (2024), WC 10.2.5 – Automation/Human Factors |
|
Proposal: The human factors aspects of Automation shall be fully considered when developing automated systems.  Automation shall assist and support ATCOs in the execution of their duties.  Total workload should not be increased without proof that the combined automated/human systems can operate safely at the levels of workload predicted, and to be able to satisfactorily manage normal and abnormal occurrences. Automated tools or systems that support the control function shall enable the controller to retain complete control of the control task in such a way so as to enable the controller to support timely interventions when situations occur that are outside the normal compass of the system design, or when abnormal situations occur which require noncompliance or variation to normal procedures. Automation should be designed to enhance controller job satisfaction.  A Controller shall not be held liable for incidents that may occur due to the use of inaccurate data if he is unable to check the integrity of the information received.  A Controller shall not be held liable for incidents in which a loss of separation occurs due to a resolution advisory issued by an automated system.  Guidelines and procedures shall be established in order to prevent incidents occurring from the use of false or misleading information provided to the controller.  The number of items displayed on one label and the number of items/information displayed on the current screen should be set after a dedicated study. Safety A controller’s liability for incidents shall not increase with the fitting of any Controller Tool or Safety Net.. |
4.1.4. IFATCA TPM (2024) WC 10.2.10 – Short Term Conflict Alert
It is proposed to remove this policy in its entirety.
| IFATCA TPM (2024), Short Term Conflict Alert |
|
Proposal: |
4.1.5. IFATCA TPM (2024) ATS 3.16 – The Use of Safety Nets in ATM
It is proposed to add highlighted to existing policy
| IFATCA TPM (2024), ATS 3.16 – The Use of Safety Nets in ATM |
|
Proposal: To ensure the integrity of the safety net is maintained, all safety net system configurations, adaptations, and customisations must be set in such a manner to eliminate, avoid or minimise spurious and nuisance alerts from being presented. In addition, these settings must be reviewed on a regular basis, and amended as required. A Safety Net function shall not be considered when delveloping a safety case. |
4.1.6. IFATCA TPM (2024) ATS 3.18 – Short Term Conflict Alert
It is proposed to remove the last paragraph from the existing policy.
| IFATCA TPM (2024), ATS 3.18 – Short Term conflict Alert |
| Proposal: STCA, as a safety net, shall be provided to each ATM-system with ATS Surveillance. STCA parameters shall be adjustable and nuisance filters for each individual ATC unit with ATS surveillance, are developed, and tested for the area involved and adjusted to the procedures, airspace layout, separation standards, surveillance source, traffic mix, etc. |
4.1.7. IFATCA TPM (2024) ATS 3.19 – Minimum Safe Altitude Warning Systems
It is proposed to add the highlighted to existing policy.
| IFATCA TPM (2024), ATS 3.19 – Minimum Safe Altitude Warning Systems |
|
Proposal: |
4.1.8. NEW Policy – Area Proximity Warning (APW) It is proposed to create new ATS policy in TPM for APW
| IFATCA TPM (20xx), ATS X.X.X – Area Proximity Warning (APW) |
| Proposal:
APW, as a safety net, shall be provided to each ATM system with ATS Surveillance and shall be fully implemented with appropriate operational requirements, procedures, and training in order to significantly reduce incursion of a flight into “special-use” airspace. |
4.1.9. NEW Policy – Approach Path Monitor (APM) It is proposed to create new ATS policy in TPM for APM
| IFATCA TPM (20XX), ATS X.X – Approach Path Monitor (APM) |
|
Proposal: APM, as a safety net, shall be provided to each ATM-system with ATS Surveillance and shall be fully implemented with appropriate operational requirements, procedures, and training in order to significantly reduce the number of CFIT of aircraft during final approach. |
References
5.1. Toulouse 1998. IFATCA 37th Annual Conference, WP No. 98, Short Term
Conflict Alert
5.2. IFATCA 2023, IFATCA 62nd Annual Conference, Montego Bay, Jamaica, 8-12 May 2023
5.3. Jamaica 2023. IFATCA 62nd Annual Conference, WP No. 158, Information Overload in ATC
5.4. TPM 2024a. IFATCA Technical and Professional Manual, Version 67.0, December 2024. ATS PROVISION OF AIR TRAFFIC SERVICES, ATS 3.16
5.5. Friedman-Berg, F. & Allendoerfer, K. & Pai, S. (2008). Nuisance Alerts in Operational ATC Environments: Classification and Frequencies. Proceedings of the Human Factors and Ergonomics Society Annual Meeting. 52. 10.1177/154193120805200123
5.6. TPM 2024b. IFATCA Technical and Professional Manual, Version 67.0, December 2024. ATS PROVISION OF AIR TRAFFIC SERVICES, ATS 3.17
5.7. TPM 2024c. IFATCA Technical and Professional Manual, Version 67.0, December 2024. ATS PROVISION OF AIR TRAFFIC SERVICES, ATS 3.18
5.8. TPM 2024d. IFATCA Technical and Professional Manual, Version 67.0, December 2024. ATS PROVISION OF AIR TRAFFIC SERVICES, ATS 3.19
5.9. TPM 2024e. IFATCA Technical and Professional Manual, Version 67.0, December 2024. WC 10.2 SOCIAL AND LABOUR ASPECTS, WC 10.2.5
5.10. TPM 2024f. IFATCA Technical and Professional Manual, Version 67.0, December 2024. WC 10.2 SOCIAL AND LABOUR ASPECTS, WC 10.2.10
5.11. TPM 2024g. IFATCA Technical and Professional Manual, Version 67.0, December 2024.
5.12. EUROCONTROL 2017. Ground-based safety nets (STCA, MSAW, APW, APM). EUROCONTROL. https://www.eurocontrol.int/project/ground–basedsafety–nets
5.13. IFATCA 2024, IFATCA 63rd Annual Conference, Singapore, 15-19 April 2024
| REF |
