38TH ANNUAL CONFERENCE, Santiago, Chile, 15-19 March 1999WP No. 83Safety Components in a Separation Minima |
Until the early days of CNS/ATM implementation, controllers accepted the separation standards as defined by ICAO and considered them not subject for discussion or argument. They were the operating minima which applied globally. However it became apparent that the implementation of CNS/ATM was to be achieved through regional development which suggested that the rate of progress would vary according to regional requirements and user demands. Also, this process was driven by user demands to increase system capacity which in turn would bring an early cost benefit. An obvious capacity increase was identified in the reduction of separation for the long oceanic sectors. ISPACG was established to create an informal forum to explore solutions to ATS problems within the South Pacific. It became the focus for reducing the existing procedural separations to lower minima utilising the benefits of satellite communications.
IFATCA became involved with ISPACG at an early stage and by doing so, became involved in the reduction of separation discussions. It became apparent that there was a divergence of views between the operators (controllers and pilots) and the other parties (ATS providers and users) which was based on the safety of the reduced separation minim. The early debates lead to a lack of confidence in the methods which were being applied to evaluate and validate the separation minima. This scepticism has lead to an increased involvement and interest in separation standards because IFATCA acknowledged that it was the controller who applied the separation and if there was any doubt about the safety of the standard then this would be detrimental to the integrity of the ATC system.
The regional development of CNS/ATM has delegated responsibility to States, under ICAO guidance, for the establishment of separation standards which creates potential difficulties for the harmonization within a particular region. For the concerned MAs, this delegation requires an understanding of the basic elements of the separation minima and what is required to establish a minimum.
The aim of this paper is to consider the various safety components of a separation minima and their impact on reducing minima from their current levels. It is anticipated that this paper will provide information material for MAs who are directly involved with the introduction of CNS/ATM systems and the consequent demands for reduced separation.
Discussion
This section will consider the various components of the separation and relate to the safety aspects as appropriate. Before discussing, it should be noted that separation is a generic term which applies to a number of different situations varying from the use of radar to that of a procedural environment. Many of these different separations have derived from operational use and experience over a long period of time consequently it is not clear how they were established in the first place – but they appeared to work! In the 1960’s, the problem of capacity for long range oceanic flights became acute and more formal methods of mathematical modelling were introduced to establish oceanic procedural separations. The most notable work was done by P G Reich whose model is still used as a benchmark today. Although these models formulated a logical picture, it presents the average controller who wishes to have an understanding of the background to separation with a major problem, that is an appreciation of mathematics which is not for everybody therefore this paper will try to avoid subject and present each element in a general context. Also, it should be noted that the main thrust for the reduction of separation minima still remains in those areas of the world where procedural (non-radar) ATC is provided which includes the development of separations when using ADS.
Relationship between airspace and separation minima
Although airspace is classified by ICAO in terms of the level of air traffic services that are being provided within a specified area, this only gives part of the picture. When considering separation minima, the nature of the airspace has to be considered in terms of such factors as geography, demography, and traffic density. This has been defined in the groupings of continental and oceanic airspace and further refined using general measurements of traffic density – high and low. Although airspace can be classified as Class A (IFR only with positive separation) for example, the type and level of Air Traffic Service will vary considerably depending on the its characteristics and the operation that it is supporting. The separation minima and the provision of air traffic control will be significantly different in high density TMA airspace to that of low density oceanic airspace.
Factors affecting separation minima
There are a number of factors influencing separation minima and these include:
Airspace Structure:
a) route structure, i.e. the use of parallel or non-parallel ATS routes and whether they are bi-directional or uni-directional;
b) existing separation minima and how often values close to the separation minima are used in practice;
c) complexity of airspace, including, inter alia:
a) traffic demand pattern :
a) numbers and locations of crossing tracks;
b) amount of traffic operating opposite direction tracks;
c) amount of traffic which is climbing or descending;
d) nature of aircraft population i.e. the diversity of traffic with respect to aircraft performance and equipage (e.g. mix of various speeds, climb performance, desired optimal flight levels);
e) peak and average traffic demands versus system capacity;
b) runway capacities and limitations of associated ground services;
c) any adjoining special use airspace, airspace usage, and types of activities including the civil/military mix; and
d) regional meteorological conditions (e.g. the prevalence of convective storms etc); and
d) designated airspace classification.
Communications capability:
a) direct controller/pilot voice communication (VHF/HF/SATCOM);
b) indirect controller/pilot voice communication (HF);
c) controller/pilot datalink communication (CPDLC);
d) controller/controller voice and automated datalink communication, both inter and intra ATS unit(s);
e) datalink between ground ATC automation systems and aircraft flight management computers; and
f) system availability, reliability and capacity.
Surveillance capability:
a) procedural dependent surveillance:
a) content of pilot position reports; and
b) reporting interval.
b) automatic dependent surveillance (ADS):
a) basic update rate;
b) display accuracy;
c) ADS contracts (e.g. increased reporting by triggering events);
d) sensor accuracy;
e) system reliability; and
f) end-to end communications time capabilities.
c) independent surveillance (radar):
a) type of sensor (primary or secondary);
b) coverage area;
c) processing and associated delays;
d) accuracy of measured position after processing;
e) update rate;
f) display accuracy;
g) system reliability.
Aircraft Navigation Performance:
a) required navigation performance;
b) typical and non-typical performance (e.g. MASPS/MOPS); (RTCA SC181 documents refer; and
c) time-keeping accuracy.
Flow management capability (ability to control traffic input to ATC):
a) strategic air traffic flow management;
b) tactical air traffic flow management;
c) ad hoc ATC “in trail” restrictions or enhancements; and
d) procedural restrictions (e.g. by local operating restrictions).
Air traffic management tools to reduce controller workload or improve controller intervention capability:
a) automated controller planning tools including conflict prediction;
b) resolution;
c) controller displays; and
d) out of conformance alerts (3D) (i.e. automatic systems which alert ATC to any deviation of an aircraft from its nominal flight path).
Aircraft equipped with airborne collision avoidance systems (ACAS).
Methods of safety assessment
The relationship between a separation minima and the airspace system is interdependent therefore when assessing the safety of a separation minima, it must be achieved within the context of the airspace structure in which it is applied. There are two methods of assessing system safety, namely:
a) Comparison with a reference system, and
b) Evaluation of system risk against a threshold.
The comparison with a reference system considers the relevant characteristics of the proposed system against the corresponding characteristics of the reference system which are known to be safe. Providing the proposed system meets the same or better the safety related aspects of the reference system then it is reasonable to assume that it is safe. A good example of this sort of process is the replacement of a radar with one of a similar or higher performance in that it is a relatively simple process to compare the safety aspects including separation minima which may well be able to be reduced in the appropriate circumstances.
The evaluation of system risk against a threshold requires a construction of a mathematical model taking into account all significant factors to produce an assessment of collision risk which is then used to estimate system safety. This figure is then measured against a pre-determined acceptable level of risk – e.g. a target level of safety. For en-route, the TLS has been expressed as a the number of fatal accidents per flight hour which could result from collisions of aircraft (where a collision between two aircraft represents two fatal accidents). ICAO have recognised that the concept of a global TLS is valid but that the metric of fatal accidents per flight hour as applied to the NAT region may not be applicable to other regions. ICAO have agreed to the development and use of different metrics provided it can be demonstrated that any change in separation minima is subject to the over-riding consideration that the risk of collision as a consequence of a loss of separation, from any cause, should be less than the agreed level of system safety.
RGCSP has recommended that the value of 5 x 10-9 fatal accidents per flight hour per dimension arising from collisions should be chosen as an assessment TLS for systems planned for implementation after the year 2000 in regions where the use of this metric is appropriate. Where this is not appropriate then justifiable alternative values and methods of assessment should be established.
ATC determinants in the establishment of separation minima
Although the factors affecting separation have been listed, it is necessary to consider the role of the controller in the application of separation and the prevention of collision. It is generally agreed that the key elements of a separation minima are:
a) navigation performance including the use of RNP values appropriate to the airspace and the separation to be applied;
b) surveillance performance including the future application of ADS;
c) controller intervention capability including communications; and
d) traffic conditions – volume, complexity, collision pairs, etc.
Controller Intervention Capability Model
Controller Intervention Capability (CIC)
Although navigation and surveillance play a significant role in the separation minima, they can be assumed to be stable elements which therefore places a critical emphasis on the controller intervention capability. This emphasis also takes account that these stable navigation and surveillance elements are still prone to technical and/or human error. The final element of traffic conditions will have a significant impact on the ability of the controller to intervene to prevent the risk of collision. Central to the controller intervention capability is communications which becomes the vital linkage; dependent on the type of communications and the time it takes to effect a control instruction will determine the separation minima.
From this elements, it is possible to construct a collision risk model using controller intervention capability as the main criteria which could form the basis of a more sophisticated evaluation. The proposed model is detailed in Fig 1. Also, this model demonstrates the human factors element in a tightly coupled system by highlighting the areas where the possibility of human error or incorrect assessment can affect the satisfactory resolution of a conflict situation. It is necessary to assess the probability of such errors and the means of mitigating them when calculating separation minima. The model can be expanded to demonstrate the potential of automated tools to reduce controller workload and consequently introduce the possibility of reduction of separation.
The critical area in this model is between the point of controller decision to resolve the conflict and the time it takes to relay this information to the pilot plus the time taken for the pilot to respond. Fig 2 highlights the critical path and the time/distance factors. This clearly demonstrates the crucial role of the communications link and the time taken to achieve satisfactory two way pilot/controller contact. It is obvious that the controller intervention capability will be enhanced if good direct VHF pilot/controller voice communication is established as compared to third party HF voice. CPDLC probably lies in between these extremes.
Core elements of the Controller Intervention Buffer
C – E represents the minimum time/distance for tactical controller intervention in which D is the critical factor whereas the combination of A – C and E – F represent the time/distance buffer. The combination A – F in terms of time or distance would represent the separation minima taking into account the factors detailed in Fig 1.
Where:
A- is the data inputted to the controller indicating that an event or gross error has occurred which has the potential to create a loss of separation
B- is the controller reaction and identification of the hazard and assessment of risk
C- is the controller decision and action to resolve the confliction
D- is the means of communication to relay the action required to the pilot
E- is the pilot reaction to the ATC instruction
F- is the resolution of the conflict
Whilst this CIC remains the core element in the prevention of a collision or loss of separation, there is a peripheral area which must be taken into account before the separation minima can be established. This is the “buffer” which allows for the controller to identify and decide the course of action and for the pilot to respond to the control instruction and to execute the required action. Depending on the operating environment and the source of data to the controller, the separation minima can either be measured by time or distance. However, it has been already noted that navigation and surveillance performance are regarded as stable elements consequently the majority of separations are being measured as distances.
Operational experience and Judgement
The construction of a collision risk model requires a number of assumptions to be made because it is not possible to factor in every eventuality and random possibility so a reasonable assumption has to be made. In making such assumptions, it is important that operational experience and judgement is utilised to the maximum effect. In a simple model as described above, the views and judgements of operational controllers are particularly valid in assessing the various elements. Equally, it should be noted that operational input from pilots is essential to achieve the correct balance.
Performance monitoring and data evaluation
By definition, a separation minima must be safe so that any reduction of separation or separation introduced for new equipment (e.g. ADS) or airspace structure must be submitted to rigorous analysis. This would include comparison between collision risk estimation and the target level of safety with the over-riding consideration that the risk of collision is less than the agreed level of safety. Also, it may require the collection and evaluation of operational data. Before the implementation of a separation minima, satisfactory and convincing evidence must be produced to corroborate the minima proposal which can be supported by the expert judgement of experienced controllers. Such evidence can be collated from the monitoring of verification and operational trials.
This monitoring can be achieved by:
a) specific data collection
b) mandatory occurrence reports
c) special incident reports
d) tactical monitoring by air traffic authorities and routine flight crew and maintenance procedures, and
e) regional monitoring programmes which can be designed to target specific parameters such as in MNPS airspace the annual proportion of large errors and the standard deviation of core performance.
If monitoring demonstrates that performance is out with the established limits, remedial action needs to be implemented to restore the safety margins.
Conclusion
Separation minima and airspace structure are interdependent therefore discussion about the safety elements of a separation minima is not possible in isolation. The safety components are numerous and cannot be covered in a short working paper therefore much of the information contained in this paper has been taken from the draft ICAO Manual on Airspace Planning methodology for the Determination of Separation Minima (ICAO Version 3.0). MAs who have a particular interest in this subject are recommended to obtain a copy.
The early separation minima have their origins clouded in history except that by custom and practice and, probably judicious adjustment, they appeared to work. Although mid air collisions did occur, they were very rare however the increase of traffic, particularly over the North Atlantic where ATC was non existent, indicated that such hit and miss methods were no longer acceptable. To meet these concerns, mathematicians applied their skills to the complexities of collision risk modelling and introduced logical reasoning into the process of establishing safe separation minima. This early work still passes the test of time.
Until the advent of CNS/ATM technology, controllers were generally not involved in the process of developing separation minima. The change in approach has been caused by the improved standards of navigation and surveillance performance. The potential for increased capacity and reduced costs by reducing separation minima has introduced a level of commercial pressure into the equation.
It is in controller interest to participate in establishing separation minima and understanding the safety elements of the process. Any new separation minima must be safe and this will involve a tests, analysis, data collection, and evaluation. The experienced controller has a vital role to play by providing essential operational information and judgement throughout the whole process from initial collision risk modelling to the evaluation and monitoring of the operational trials.
References
Manual on Airspace Planning Methodology for the Determination of Separation Minima ICAO Doc 9689.
A Theory of Safe Separation Standards for Air Traffic Control, P G Reich, November 1964.
A Mathematical derivation of ATC Separation Standards, R N Lord and D A Saunders, December 1964.
Rationale of Radar Separation Standards, A G Sharpe, December 1988.
General Model for Separati on Standards, MITRE.
A Preliminary Mathematical Model for the Radar Separation Minima, Mark J Rockman, MITRE May 1995.
Air Traffic Services Planning Manual, ICAO 1984.
Collision Risk Assessment of ADS based Operations and Lateral Separation in North Atlantic Airspace, S Owens, NATS.
Last Update: September 28, 2020