39TH ANNUAL CONFERENCE, Marrakech, Morocco, 6-10 March 2000WP No. 156Air Traffic Control Separation Monitoring Tool (ASMT) |
Introduction
At the 38th IFATCA Conference in Santiago De Chile, EGATS expressed concern over the impending introduction of what it knew as an ATC Separation Monitoring Tool (ASMT). EGATS asked Committee SC4 to look at the possible effect and ramifications of such an introduction.
ASMT is a device that continuously and automatically monitors the separation between transponding aircraft, and will detect any infringement of pre-defined separation criteria that takes place within the parameters of a radar system. Separation Monitoring Facility (SMF) is a specific form of an ASMT that is used within the UK.
The working paper is based on the experiences of a limited exposure to SMF, as few MA’s have the availability of this post-incident tool other than in the form of radar recordings. A number of countries were approached for assistance, but with the exception of some input from Canada and Australia, little help has been forthcoming.
This paper has been prepared jointly by SC4 and SC7, and considers the implications from the operational standpoint, as well as the legal aspects.
Discussion
Availability
The USA and the UK are seemingly the only countries to have introduced a system such as that envisaged by Eurocontrol. USA have named their facility the “Operational Error Detection Patch” – but it is usually known by their staff as the “snitch” programme.
The origin of the UK (SMF) equipment lies within the original software purchased by the UK CAA from IBM and the 9020D hardware that was in use in the USA back in the 1970’s. It has been extensively modified for use within UK airspace.
It is understood that apart from Eurocontrol, both the Canadian and Austrian ATC providers are currently attempting to introduce a similar system. It is also apparently available in Singapore although not utilised. In Australia it is available in a different form at the ATC Units where the STCA system provides the relevant manager with notification that it has been triggered. Investigative action can then be taken if thought appropriate. This is not a true ASMT/SMF facility – and warnings of this nature are not available in the UK’s SMF, or to the relevant supervisors or manager, although such notification can be seen at any radar position.
There is no evidence, as yet, that such a system is, or will be, a mandatory requirement for any provider as part of the units approval by its regulator – for example within the ECAC States under EATMP.
Hardware
Although this is not necessarily the only methodology in use, the SMF system is based on PC architecture and extracts radar data for processing in a similar way to that used in Short Term Conflict Alert – STCA. It is displayed in two locations:
- As an initial warning for supervisory staff in the ATC Operations Room
- The replay of data associated with any incident (undertaken in a room away from the operational environment)
Software Parameters
In Australia the notification is only from the STCA facility.
In the USA the system parameters are 1000ft and/or 5nm below FL290, 2000ft and 5nm above.
The UK uses different parameters for the Area/Approach Control functions where National Air Traffic Services Ltd (NATS) staff are employed. The algorithms are significantly superior to those of the USA system, and are suitable for use in TMA airspace.
Where radar separation minima is 5nm (En-route Area Control) the system parameters below FL290 are 3 1⁄2 nm and 600ft, whilst above FL290 they are 3 1⁄2 nm and 1600ft. In the Transition Area for Reduced Vertical Separation Minima (RVSM) between FL290 and FL660, the rules for airspace below those levels are applied (although the current version of TCAS software produces an RA/TA for aircrews as though 2000ft separation is needed).
Where minimum radar separation is 3 nm (Area Control – TMA, and Approach Control) the parameters are 2 nm and 600ft.
To trigger an alert, both vertical and lateral parameters have to be breached at the same time.
Procedures for use
Following an alert, supervisory staff (usually in current radar practice) undertake an initial assessment of the ‘loss of separation’, at a display away from the operational environment so as to prevent unwanted intrusiveness by staff not involved in the occurrence.
The equipment only displays the radar tracks of the aircraft involved, and does not have the availability of RTF/telephones so no guide as to traffic levels is initially accessible.
If the incident is determined as a possible error by either ATC or Aircrew, further action is then taken. However, because the system does cause a number of false alerts, it is possible that the situation was an acceptable ATC practice and no action need be taken. Such cases include SSR garble, and climb/descents after an opposite direction pass observed by radar has taken place (although the vertical/lateral requirements are breached).
There are also nuisance alerts that should ideally be filtered out, such as VFR transit in Class D Airspace where VFR/IFR separation is not a prerequisite, and incidents in areas not under the responsibility of the relevant manager.
There is no subjectivity, despite the difference between what is shown by the system and what was seen by the controller, as radar replays and RTF recordings are then used to determine the cause. Under normal circumstances (where only the SMF alarm has been triggered and no other indications of a loss of separation has occurred) the controller is left at his/her radar sector until initial investigation shows that a more comprehensive assessment involving the ATC staff member is required. Individual operational controllers are not normally advised of any alarm unless an error is suspected, and no record is made of the person involved until this is confirmed.
Operational Aspects – UK Staff Perceptions
Initial concern was expressed by staff that “big brother” was watching, and when the system was first introduced it soon became obvious that incidents that had perhaps previously gone unnoticed, would now be investigated.
A number of ‘standard operating practices’ then came into question, and many staff had to amend their techniques to avoid occurrences with the result that sector capacity was reduced. For example, with 2 1⁄2 nm spacing being permitted on final approach this would be difficult to achieve without availability on the intermediate approach as well. The track to be flown between two consecutive aircraft may be an acceptable 3nm in longitudinal distance but the actual distance between the centres of the targets might be less. For example, when one aircraft has turned base from the downwind leg and the following aircraft is still downwind (formula for the length of the hypotenuse of a triangle, in comparison to the length of the other two sides).
Management then realised that as staff were actually increasing separation above the minima to prevent triggering the system, the landing rate at Heathrow (for example) was being reduced when compared to the pre-SMF regime. A management decision was made to perpetuate the long-standing techniques, and class such a loss of separation as “normal operating practice”. It would appear that expediency resulting from commercial pressures has lead to this decision.
The UK does not replace normal requirements for reporting procedures because SMF is available. The system is only available at National Air Traffic Services Ltd (NATS) Units so Airprox and Mandatory Occurrence Reporting (MOR) in accordance with UK Legislation is still required. However, the introduction of SMF has probably increased the likelihood of an individual submitting a report. Irrespective of the legislative requirements, it is not unusual for staff and/or supervisors to continually check for an alarm, when a STCA has been observed, to see if a report is required.
Confidentiality is never assured in incident reporting, as invariably someone other than those involved in an incident is aware of the situation. The actual details are normally protected from unwanted intrusion by means of having the viewing display in a separate (and locked) room accessible only by the managers/supervisors concerned. However, despite these precautions, a recent incident appeared in the media without the prior knowledge of the staff involved.
There are still potentially dangerous errors that will not be picked up by the system or may not be reported by those involved. This will continue to occur unless the parameters are set at those of separation minima. Each ATC provider has to objectively consider the options to cover this situation. If the UK experience is anything to go by, to follow this latter line would dramatically increase the number of reported incidents.
STCA/ASMT Interaction
Regardless of their operational use, both STCA and ASMT are devices that monitor separation minima from data derived from a radar source.
STCA provides a collision risk assessment and is programmed to alert the controller before a loss of separation occurs.
ASMT only alerts at the point that specified parameters are breached and is effectively a post- incident analysis tool, not a controller aid.
ASMT should not be used in isolation to STCA. Combined together, STCA and ASMT could be seen to be effective devices, assisting in the maintenance of safe controlled airspace.
In general, an ASMT device might be used for:
- acquiring relevant data;
- detecting infringements of specified parameters;
- providing alerts;
- storing safety infringement detection data and alerting acknowledgment, including archiving capabilities;
- processing safety infringement data including both automatic and manual processing;
- providing visibility of safety infringement data by a reviewing and reporting mechanism.
ICAO does not appear to have a clear policy on the implementation of ASMT. In regard to ICAO requirement for monitoring, this is more a question of an implied rather than explicit requirement (i.e. Annex11 and PANS-RAC are not specific about this, Annex 11 attachment B section 3 – implies it.)
It would seem, however, that the principal is whenever a safety assessment has been used to develop a separation minimum, the implementation requires that the safety assessment be verified prior to implementation or an ongoing basis periodically thereafter. Generally, it is left to the individual states as to how they monitor airspace and the provision of ATS.
Legal Aspects
With regard to the operation of ASMT, it is most important to consider the legal liability and implications of the ATCO. It is essential to regulate the system and to promote specific settlement procedures of an incident/accident arising from its use consistent with the due and faithful discharge by an ATCO of the duties for which he is privilege to perform. Therefore, it follows, that the question must be – if liability claim is to be justifiable – whether the incident/accident complained of is such as to show that the ATCO disregarded the essential requirements of maintaining standard separation. This must be separate and apart from systems failure which can also give rise to liability.
The investigation should focus on identifying the causal factors. It should be limited to the “technical investigation” and not to judicial inquiry. This “technical investigation” should be carried out in accordance with the investigation objective stated in ICAO Annex 13, Aircraft Accident Investigation which states:
The fundamental objective of the investigation of an accident / incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability.
The primary objective of any safety management program is accident prevention. Safety management is a pro-active and re-active discipline aimed at minimizing the Air Navigation Services contribution to the risk of an aircraft accident as far as reasonably practicable.
From a regulatory view point, it is important, to incorporate legislation aimed at setting targets which represents a level of safety performance the ATCO finds acceptable, and to measure, in an accurate way, progress towards them. In order to measure the safety level, emphasis on a management system as a means of underpinning safety related behaviour becomes evident. Such systems must demand and reflect good management practices, proper documentation, and functional management of related accidents/incidents.
The functions and responsibilities of the Air Traffic Control Officer (ATCO), in a rapidly growing ATS environment are becoming increasingly more complex. Pressures from airspace users, government and (in some case) ATS providers, to increase capacity, is likely to result in ATC personnel being obliged to use the minimum separation possible. Where separation is lost they therefore open themselves to what might be perceived as punitive action stemming directly or indirectly from the introduction of any ASMT facility.
Where there is a likelihood of an investigation of an incident/accident arising, the system should be such that an electronic or hardcopy recording should be available. All relevant data should be used for any investigation.
IFATCA has policy on the use of recorded data page 44A4 of IFATCA manual that states:
| Audio visual and recordings, together with transcripts of air traffic control communications, are intended to provide a record of such communications for use in the monitoring of investigation of incidents and accidents. Such recordings are confidential, are not permitted to be released to the public, and are not to be used to provide direct evidence in disciplinary cases, or be used to determine controller incompetence (Taipei 97.c.11). |
With technology rapidly increasing in complexity, and mosaic radar displays or synthetic video becoming commonplace, it is pertinent to question the accuracy and integrity of future systems such as ASMT where they may not replicate exactly the same data that the controller is provided with.
Conclusions
When considering the implementation of an ASMT device, it must be noted that there are increased demands to maximise the efficiency of airspace utilisation. This in turn reduces the margins of error that a controller must work with. The ASMT device is, therefore, something that should be used for investigation into the circumstances of any perceived loss of separation, rather than a punitive tool that can be used directly by Management for disciplinary action.
It also has to be noted that ASMT, is a ‘post incident’ tool rather than a safety system that will warn operational ATCO’s of an impending loss of separation. To be effective as a device that assists and supports the maintenance of prescribed separation minima, ASMT must include STCA.
The criteria used to set up the separation monitoring parameters of an ASMT device must be carefully planned and monitored. To be effective, sufficient consideration must be given to restrict false or nuisance alerts, while at the same time ensuring that clear losses of prescribed separation minima are accurately identified.
To be effective, an ASMT device must be proven as being reliable and accurate in its recording and representation of alerts. The integrity of any data stored and retrieved should be taken into consideration before any investigation of any alert takes place.
During any investigative process, following an ASMT alert, confidentiality must be assured and only recognised staff members are afforded the availability to review the recorded data.
When any investigation results from an ASMT alert, the processes described within existing IFATCA for incident investigation should be adhered to.
It has to be acknowledged that false alarms may occur. Although these waste the time of supervisory staff, ASMT is a useful tool in support of Local Competency schemes and an overall guide to the safety management of a unit.
Initially, staff can be expected to be very wary of the implementation of such a system, but in the longer term the use and acceptance of ASMT can be seen to be a valuable tool that supports the integrity of an Air Traffic System. However, this partially depends on the ethos of the relevant managers of the Service Provider and their attitude towards an open and blameless operating culture with regards reporting incidents.
Recommendations
Amend the IFATCA Manual at page 4 1 2 6 to insert new heading and paragraphs as Provisional Policy, as follows:
2.11. Air Traffic Control Separation Monitoring Tool
2.11.1. IFATCA considers that the ASMT device is something that should be used for the analysis of the circumstances of any perceived loss of separation, rather than as a punitive tool that can be used directly by Management for disciplinary action.
2.11.2. The introduction of ASMT should be preceded by the introduction of STCA.
2.11.3. The criteria used to set up the separation parameters of an ASMT device must be carefully planned and monitored. To be effective, sufficient consideration must be given to restrict false or nuisance alerts.
2.11.4. If STCA is not part of the system, or is inoperable, then the legal liability of the ATCO needs to be clearly defined and established.
2.11.5. If ASMT is to be used it must be part of a Safety Management programme.
Last Update: September 28, 2020