WAM Generic Approval Process Volume 2 Guidance Notes

Transcription

1 WAM Generic Approval Process Volume 2 SUR Reference No.: SUR-WAM-GEN-PRO V2 CDMS Reference No.: Edition Number: Edition Date: 08/01/2009 Status: Issued Classification: Public Author: Andrew Desmond Kennedy Intended For: General Public Edition Page 1 of 76

2

3 A Table of Contents OPERATIONAL APPROVAL WITHIN THE SES...8 A.1 PURPOSE...8 A.2 THE INTEROPERABILITY REGULATION...8 A.3 IMPLEMENTING RULES...9 A.4 COMMUNITY SPECIFICATIONS...10 A.5 CONFORMITY ASSESSMENT...11 A.5.1 Introduction...11 A.5.2 EC Declaration of Verification...12 A.5.3 EC Declaration of Suitability for Use...12 A.6 THE 2 ND PACKAGE OF SES LEGISLATION...13 B HOW TO DECIDE WHICH TECHNOLOGY TO PROCURE...14 C B.1 PURPOSE...14 B.2 OVERVIEW...14 B.3 OPERATIONAL SERVICE ENVIRONMENT...14 B.4 OTHER COST DRIVERS...18 B.5 CONCLUSION...20 PROCUREMENT OPTIONS FOR ANSPS...21 C.1 PURPOSE...21 C.2 POTENTIAL OPTIONS...21 C.3 LIFECYCLE CONSIDERATIONS...23 D OPERATIONAL CONSIDERATIONS WHEN DEPLOYING WAM...26 E D.1 PURPOSE...26 D.2 IS WAM DIFFERENT?...26 D.3 INITIATION PHASE (STEPS 1 TO 4)...27 D.3.1 Team building...27 D.3.2 Operational requirements...27 D.3.3 Planning, procedures and documentation...28 D.4 TRANSITION / TEST PHASE (STEP 5)...29 D.5 OPERATIONAL PHASE (STEP 6)...29 D.6 REQUIREMENTS FOR A CONTROLLER HANDBOOK...30 PERFORMANCE AND INTEROPERABILITY REQUIREMENTS...31 E.1 PURPOSE...31 E.2 WHY IS WAM DIFFERENT?...31 E.3 PROCESS...31 E.4 INTEROPERABILITY OF THE WAM SYSTEM...32 E.5 IMPLEMENTING WAM IN A NON-RADAR ENVIRONMENT...33 E.6 IMPLEMENTING WAM IN A RADAR ENVIRONMENT...33 E.7 SERVICE (AND COVERAGE) VOLUME DEFINITION...33 F COVERAGE AND RECEIVER SITE PLANNING...35 F.1 PURPOSE...35 F.2 WHY IS WAM DIFFERENT?...35 F.3 DEFINING THE OPERATIONAL SERVICE AND ENVIRONMENT...35 F.4 SERVICE VOLUME DESCRIPTION...38 F.4.1 Sources of information and assistance...38 F.5 COVERAGE VOLUME PLANNING...39 F.5.1 Software tools...39 F.5.2 Siting of interrogators and reference transponders...41 Edition Page 3 of 76

4 F.5.3 Site feasibility study G HOW TO PLAN FOR FUTURE SYSTEM EXPANSION G.1 PURPOSE G.2 OVERVIEW G.3 AIRSPACE PLANNING ASSESSMENT G.4 WAM IMPACT ANALYSIS H ASSESSING THE WAM COMMUNICATIONS LINKS H.1 PURPOSE H.2 CONSIDERATIONS AT THE DESIGN STAGE H.2.1 Function and requirements H.2.2 Common vs. Distributed clock H.3 INTRODUCTION TO TECHNICAL OPTIONS H.3.1 VSAT H.3.2 Telecommunication line H.3.3 Microwave H.3.4 Optical fibre H.4 MAKING THE CHOICE H.5 THE USE OF A THIRD PARTY I GUIDANCE ON THE RE-USE OF THE EUROCONTROL GENERIC WAM SAFETY ASSESSMENT I.1 PURPOSE I.2 CONTEXT I.3 WAM SAFETY MATERIAL I.3.1 Overall content I.3.2 Safety Argument I.3.3 Operational Service and Environment Description (OSED) I.3.4 Functional Hazard Assessment (FHA) I.3.5 Preliminary System Safety Analysis (PSSA) I.3.6 System Safety Analysis (SSA) I.4 CAVEATS J FAILURE MODE SCENARIOS; POTENTIAL MITIGATIONS AND PRACTICES J.1 PURPOSE J.2 WHY IS WAM DIFFERENT? J.3 FAILURE IN WAM SYSTEMS J.4 MITIGATIONS IN SYSTEM DESIGN J.5 OPERATIONAL MITIGATIONS DURING FAILURE SCENARIOS J.5.1 Scenario 1: N J.5.2 Scenario 2: (N-x) failure modes J.5.3 Scenario 3: Major degradation of WAM service J.5.4 Scenario 4: No WAM service K HOW TO CONDUCT A PERFORMANCE ASSESSMENT OF WAM SYSTEMS K.1 PURPOSE K.2 OVERVIEW K.3 SIMULATION K.4 ACCEPTANCE TESTING K.5 TEST FLIGHTS K.5.1 Elements to consider K.5.2 Alternative means of data collection K.5.3 Assessing n-1 scenarios K.5.4 Summary K.6 ONGOING VALIDATION AND MONITORING Edition Page 4 of 76

5 L K.7 FINAL...69 INTEGRATION OF WAM SYSTEMS THE EFFECT ON THE ATC SYSTEM...71 L.1 PURPOSE...71 L.2 A PROCESS-ORIENTED VIEW...71 L.3 WAM IMPLEMENTATION...71 L.4 REMINDER OF OPERATIONAL EFFECTS...72 L.5 TECHNICAL EFFECTS...73 L.5.1 Aircraft...74 L.5.2 Interrogation...74 L.5.3 Test or reference transponder...74 L.5.4 Tracker...74 L.5.5 RMCS (Remote Monitoring and Control Station)...75 L.5.6 Alarming...75 L.5.7 Data recording (TOA data)...75 L.5.8 Timing...75 L.5.9 Future WAMs...75 L.5.10 Synchronisation timing...75 List of Figures Figure 1: IR development process...9 Figure 2: CS development process...10 Figure 3: Role of core standards in CS development...11 Figure 4: High level representation of the surveillance loop...21 Figure 5: Levels of WAM implementation...26 Figure 6: Factors to consider in the environment definition Figure 7: Surrounding terrain and instrument approach procedure used at Innsbruck Airport...37 Figure 8: Example of ANSP tool to simulate WAM performance...41 Figure 9: WAM surveillance volume coverage analysis (manufacturer tool)...41 Figure 10: Factors affecting a site feasibility study...43 Figure 11: Schematic representation of a potential WAM system expansion...47 Figure 12: Overall WAM Safety Argument...55 Figure 13: Representation of the impact of coverage degradation upon traffic flow...61 Figure 14: Differences between radar and WAM in assumed performance in coverage area...64 Figure 15: WAM implementation levels...72 Figure 16: WAM interfaces with other systems...73 List of Tables Table 1: Technology procurement considerations...17 Table 2: System requirements and cost drivers...19 Table 3: Procurement model overview...22 Table 4: Advantages and disadvantages of various WAM communication links...52 Edition Page 5 of 76

6 THIS PAGE INTENTIONALLY LEFT BLANK Edition Page 6 of 76

7 EXECUTIVE SUMMARY The process for achieving the operational approval of a WAM system needs to reflect the strengths and weaknesses of WAM as a surveillance technique. It therefore differs substantially from that used for traditional surveillance methods such as PSR and SSR. In response to this EUROCONTROL issued a contract to develop best practice guidelines for operational approval of WAM systems. The first formal release of the document was written by Helios under contract TRS T07/11131CG. The Eurocontrol Agency will, on behalf of MLTF members, update the document within the context of MLTF activities to reflect lessons learnt refinements to guidance notes etc. Latest versions will be posted on and also on the MLTF One Sky team site. Any feedback on the document is encouraged, and should be sent to the contact points at As such, this document is designed to support Air Navigation Service Providers in achieving operational approval for a Wide Area Multilateration (WAM) system. The document is presented in two volumes. Volume 1 contains an introduction to the approvals process, followed by a six step outline of the tasks ANSPs will need to undertake to achieve operational approval for WAM. WAM specific elements are highlighted throughout, with particular attention paid to differences from traditional radar surveillance. This volume contains the following guidance notes, intended to highlight best practice in each area: A. Operational approvals within the SES B. How to decide which technology to procure C. Procurement options for ANSPs D. Operational considerations when deploying WAM E. Performance and interoperability requirements F. Coverage and receiver site planning G. How to plan for future system expansion H. Assessing the WAM communications links I. Guidance on the re-use of the EUROCONTROL example WAM safety assessment J. Failure mode scenarios: potential mitigations and practices K. How to conduct a performance assessment of WAM systems L. Integration of WAM systems the effect on the ATC system References and abbreviations are listed in Volume 1. Edition Page 7 of 76

8 A Operational Approval within the SES A.1 Purpose This guidance note provides an introduction to the institutional and legal framework that underpins the operational approval and conformity assessment process within Europe, on the basis of the Single European Sky legislation. The Single European Sky (SES) is an initiative of the European Commission to reform the architecture of European air traffic control to meet future capacity and safety needs. SES currently consists of 4 regulations that were passed on the 10 March 2004: Framework Regulation [ref 18] Service Provision Regulation [ref 19] Airspace Regulation [ref 20] Interoperability Regulation [ref 21] The key regulation when considering operation approval is the Interoperability Regulation (See Section A.2) which has introduced Implementing Rules (See Section A.3) Community Specifications (See Section A.4) and Conformity Assessment (See Section A.5) to ATM. In June 2008, the Commission proposed amendments to the SES legislation, the potential impact of these amendments are discussed in Section A.6. A.2 The Interoperability regulation The two basic objectives of the Interoperability Regulation, as stated in Article 1(3), are: to achieve interoperability between EATMN systems, constituents and procedures 1 ; to ensure coordinated and rapid introduction of new and validated concepts of operations or technology in ATM. This is achieved through: Essential Requirements: The IOP Regulation provides the framework for the SES interoperability rules and specifications. Very high level requirements, known as Essential Requirements (ER), are defined for each of the 8 domains identified in Annex II of the Regulation (including surveillance systems and procedures). These requirements are mandatory and must be taken into account by all ATM stakeholders. Implementing Rules: Implementing Rules (IRs) define the more detailed technical and procedural rules, which build on the essential requirements; they basically define WHAT should be done (See A.3 below). Community Specifications: A Community Specification (CS) provides a means of compliance against the Essential Requirements and applicable Implementing Rules for a specific system. (see A.4 below) The Essential Requirements of the IOP regulation have applied to the integration of new services since October 2005 and by April 2011 shall apply to all operational systems (of the 8 domains). 1 Constituents: tangible items, such as equipment, and intangible items, such as the software on which the interoperability of the European air traffic management network depends. System: ground and airborne constituents and the space equipment to support air navigation services during all phases of flight. (see European Union website for more - Edition Page 8 of 76

9 A.3 Implementing Rules IRs are normally developed by EUROCONTROL under mandate from the Commission and adopted by the Single Sky Committee (see Figure 1). Figure 1: IR development process Each IR specifies a means of compliance either by referencing CSs or other existing industry standards (such as those produced by EUROCAE). It is possible for an ANSP to pursue an alternative means of compliance but this is not recommended as it may require more effort on the part of the ANSP and NSA. EUROCONTROL is currently developing a draft IR on surveillance performance and interoperability (SPI) which will define the level of service required by surveillance systems. Edition Page 9 of 76

10 A.4 Community Specifications Community Specifications are a possible means of compliance with implementing rules indeed, compliance with published Community Specifications creates a presumption of conformity with the Essential Requirements and the relevant IRs for interoperability. This is one of the major features of the EC s New Approach to standardisation: CS remain voluntary and provide flexibility for industry as other solutions may be available. CSs are developed either by the European Standardisation Organisations (ESO) or EUROCONTROL under mandate from the Commission (as illustrated in Figure 2). A CS requires formal adoption by publication in the European Journal. Figure 2: CS development process The CS is therefore essentially a new standard, introduced by the SES legislation, to provide a formal means of conformity assessment to the requirements of the Interoperability Regulation. The ICB interoperability sub-group notes that the Interoperability CS is similar to the EASA Acceptable Means of Compliance (AMC). As shown in Figure 3, a CS should draw on aviation standards developed by the traditional processes (e.g. EUROCAE). A CS will, as a minimum, add material on how requirements of the CS comply with the essential requirements. Edition Page 10 of 76

11 CS specific Material and Compliance Annex Community Specification Reference to Core Technical Material ICAO Documents EUROCAE Documents RTCA Document Reference to Means of Compliance EASA CS/AMC Certification Specification Eurocontrol Document SES Essential Requirements Implementing Rules Interop Regulation Safety EASA Rulemaking and Regulatory Requirements 1 A.5 Conformity Assessment Figure 3: Role of core standards in CS development A.5.1 Introduction Conformity Assessment (CA) is the collective term used for a number of techniques (testing, inspection and certification) which are used to determine if a product, system or design meets a defined specification. It helps companies demonstrate that they have met their customers' requirements. It is used in a wide variety of industries across Europe, to avoid potential barriers to trade. CA is the process used for demonstrating that EATMN components are compliant with the Essential Requirements and/or IRs. CA provides the purchaser with evidence that the manufacturer has understood and met the underlying requirements. Although for many directives (e.g. R&TTE, EMC) there is a requirement to display CE-marking to show compliance, it is not a requirement of the IOP Regulation. The key factor is conformity with the given specification which may be a standard issued by a recognized standards body, or a legislative requirement or specification developed within an industrial sector. CA has arisen from the need of manufacturers, users and regulators to be sure that products, services and systems meet a specified requirement or standard. The prime stimulus for the development of CA has been the market to promote customer confidence and so develop trade. The EC Declaration of Verification (DoV), as defined in the Interoperability Regulation, is used by an ANSP (in accordance with the relevant implementing rules for interoperability) in order to demonstrate that it meets the essential requirements of the Regulation and the IRs, when integrated into the EATMN. Before a system is put into service, the relevant ANSP will need to conduct a CA in order to establish a DoV, confirming compliance, and will submit it to the relevant national supervisory authority (NSA) together with a Technical File (TF). The TF accompanying the DoV must contain all the necessary documents relating to the characteristics of the system, including its Edition Page 11 of 76

12 conditions and limits of use, as well as the documents certifying conformity of constituents where appropriate. The EC Declaration of Suitability for Use (DSU) is prepared by a manufacturer to show that the constituents which are produced have compliance with the essential requirements and relevant implementing rules for interoperability. This shows that they can be implemented as part of an ATM system in accordance with the ANSP s DoV. EUROCONTROL have established a Conformity Assessment Task Force 2 (CATF) to produce guidelines for CA. The CATF have produced Initial Guidelines for Conformity Assessment of EATMN systems [ref 22] which should be referred to for further details on the process. The next two sections provide a brief overview of DoV and DSU which are the main elements of CA. A.5.2 EC Declaration of Verification The ANSP is responsible for the verification of an EATMN system using CA. CA is required when either: A new system is deployed An existing system is upgraded The result of CA is an EC Declaration of Verification which is accompanied by a Technical File (TF). In accordance with the Interoperability Regulation: The technical file accompanying the EC declaration of verification must contain all the necessary documents relating to the characteristics of the system, including conditions and limits of use, as well as the documents certifying conformity of constituents where appropriate. A draft schema for the DOV and TF are provided on the CATF website. A.5.3 EC Declaration of Suitability for Use When a manufacturer wishes to market an EATMN component (including WAM system components), they must ensure and declare that the provisions laid down in the Essential Requirements and in the relevant implementing rules for interoperability have been taken in to account. This is done by means of the EC Declaration of Conformity or Suitability for use, The goal of an EC declaration is to give assurance that a constituent complies with applicable Single European Sky (SES) interoperability regulatory provisions and to make clear who is responsible for the declaration. The manufacturer, or his authorised representative established in the Community, shall undertake the following activities in order to carry out the verification of compliance of a particular constituent: select the set of regulatory provisions applicable to the EATMN constituent; ascertain compliance of the EATMN constituent with the applicable regulatory provisions; provide data to substantiate compliance of the EATMN constituent with the applicable regulatory provisions; declare compliance of the EATMN constituent with the specified regulatory provisions by issuing an EC declaration of conformity or suitability for use. A draft schema for the EC Declaration of Use is provided in at the CATF website. 2 See Edition Page 12 of 76

13 A.6 The 2 nd Package of SES Legislation In June 2008, the Commission launched a 2 nd Package of SES legislation 3 which contains four main pillars: Modification of the existing SES legislation to provide a performance management framework. Extension of EASA framework to cover safety regulation of ATM and aerodromes. Adoption of the SESAR ATM Master Plan Strengthening gate-to-gate capacity. The extension of EASA competence will change the approvals process, as EASA will become responsible for certification of ATM systems although the actual process will be delegated to the local NSA. Modification to the interoperability regulation has been included so that a Declaration of Conformity issued under the proposed extension to EASA covers the requirements of the Interoperability Regulation. ANSPs and Manufacturers will not therefore need to repeat the exercise for both the EASA and SES frameworks, but will need to consider new Essential Requirements introduced by EASA. 3 Edition Page 13 of 76

14 B How to decide which technology to procure B.1 Purpose This guidance note outlines the different attributes, functionalities and issues offered by various candidate surveillance technologies (PSR, SSR, WAM and ADS-B). This guidance is broken down into two sections, the first outlining the operational service environment and the second considering the infrastructure requirements of the system itself and the associated cost drivers. It represents a high level capability overview and is suitable material for creating a background of understanding in those people unfamiliar with the various technology options on offer but who may be involved in system procurement. B.2 Overview When considering how to respond to traffic growth, an ANSP has a choice of which surveillance technology it decides to install to monitor its airspace. The principal techniques on offer are PSR, SSR, WAM and ADS-B; various combinations of which will provide surveillance services with varying degrees of service level, redundancy, coverage and cost. The choice will be driven by a consideration of the local environment, including geography and service requirements. Note: the advice given below does not specify the contractual arrangements under which the surveillance information is provided to the controller, only the technical means by which it is done. In addition, it might also be possible for the ANSP to buy in data from other surveillance services e.g. through a cross-border Service Level Agreement (SLA) or by establishing an SLA with a third party (registered as a CNS provider under the SES if in Europe). In this situation an ANSP will only have a platform-independent contractual relationship with the data it is using. B.3 Operational service environment The table below highlights the main factors an ANSP should consider when deciding which technology to procure. It also helps to identify any trade-offs that might need to be made between various architectures; particularly with respect to the local environment. Note: Consideration of current aircraft equipage concludes that it is not yet possible to rely on ADS-B for sole-means surveillance in Europe. The suitability of this technique of surveillance, in other regions, equally depends upon the aircraft equipage and certification in the local environment. Nevertheless, it is worth highlighting that a WAM system will be future-proofed against an increase up-take of ADS-B if it is equipped with receivers capable of decoding 1090 Extended Squitter ADS-B messages. The nature of the local implementation environment will dictate many of the system requirements and therefore the cost drivers. It therefore follows that a generic CBA for WAM will not add-value to the decision making process as many costs will stem from site specific issues it is for this reason that EUROCONTROL has not produced one. Instead, this analysis should be undertaken at a local level. Edition Page 14 of 76

15 SUR-WAM-GEN-PRO V2 WAM Generic Approval Process Volume 2 Consideration Type PSR SSR WAM ADS-B Geography Mountainous Coverage from a single site is poor due to screening of signal by mountains - a situation that may be exacerbated by presence of any wind farms (PSR particularly). Thus, radar surveillance in mountainous terrain will require the installation of multiple radar systems at a high cost. The distributed nature of WAM makes it well suited to environments where line-ofsight surveillance from a single point over the entire coverage volume is difficult. An ADS-B system requires fewer ground stations than Multilateration to provide coverage across an equivalent volume of airspace (assuming line-of-sight can still be maintained). Coastline/sea Sea - Continental shelf Conventional PSR or SSR radar will require only a single site to detect the signal of an aircraft's transponder over sea, with ranges up to 200NM possible. The availability of these sites may well dictate the surveillance method employed. Off-shore wind farms will reduce the effectiveness of primary radars. Generally unfeasible to construct the large infrastructure required to support the operation of a SSR or PSR. WAM s triangulation technique accuracy is reduced when the ground stations geometry is all in one direction to the signal (i.e. on the coast), as the percentage of error versus time difference of arrival becomes much larger. This can be solved by placing stations offshore (e.g. oilrigs). Compact design of the receivers makes their installation feasible in inaccessible environments - such as those on oil rigs. Nevertheless there still need to be enough sites (minimum 4) to be able to derive a WAM solution. An ADS-B system requires fewer ground stations then Multilateration to provide coverage across an equivalent volume of airspace. Its suitability will hinge upon the nature of the traffic mixture in the airspace. ADS-B will have similar ranges to SSR (i.e NM), as both are line-of-sight. ADS-B system requires fewer ground stations to cover an equivalent airspace volume. If the availability of sites is limited (as is very likely), this is a significant advantage. Edition Page 15 of 76

16 SUR-WAM-GEN-PRO V2 WAM Generic Approval Process Volume 2 RF environment 1090MHz spectrum issues PSR does not operate in the 1090MHz band (nevertheless, it has spectrum issues in the L-band with other technologies based on ultra-wide-band) SSR may fail to successfully decode the Mode A and Mode C messages broadcast by aircraft transponders in a high traffic density environment, as FRUIT and garbling affect the reply. WAM has a similar issue to SSRs, and the interrogation strategy of active WAM should be carefully managed. In high density airspace it is anticipated that frequency congestion will be a major driver in setting the requirement for number of receivers/sensors and their location. Frequency congestion may become an issue in future years (particularly for ADS-B and WAM combined systems) where mixed equipped aircraft mean that both ADS-B squitters and a high level of interrogations are seen in the airspace. Consideration Type PSR SSR WAM ADS-B RF environment (cont) Mitigations Not needed A carefully tailored interrogation strategy should be designed, particularly where multiple surveillance sources exist. Once the interrogation strategy is set, any further FRUIT or multipathing could be mitigated (in the case of WAM) by the presence of additional ground sensors. In fact the dispersed nature of WAM sites means that they will not all experience the same FRUIT and garbling, giving greater resistance to these effects. Furthermore constant monitoring of surveillance performance (through the use of reference Traffic environment Avionics equipage in the operational service environment Independent of aircraft transponder failure, transponder pollution, pilot code entry error, incorrect message decode, multipath effects, closely spaced Mode A replies and duplicated 24-bit addresses. However, this provides no ID capability. transponders) will alert the service provider to potential problems. Only requires a functioning Mode A / C transponder on board the aircraft, although many SSRs in Europe are now Mode S based. WAM can use the Mode S Downlinked Aircraft Parameters, where they are interrogated for. ADS-B compatible transponder must be fitted and certified. Currently in Europe, Mode S transponders tend to be fitted with ADS-B, but not certified to squitter the data (therefore, there are no guarantees on the data quality). An EASA Acceptable Means of Compliance (AMC20-24 published mid -2008) should mean the data is certified. Edition Page 16 of 76

17 SUR-WAM-GEN-PRO V2 WAM Generic Approval Process Volume 2 Shape of surveillance volume Receiver site environment Coverage over a specific area Availability of existing infrastructure and installation/ access feasibility. Will provide coverage across a volume defined by a 360 degree sweep (assuming no sectorisation) out to a radius of up to 250 NM in an environment that is obstacle free in the line-of-sight between radar and target aircraft. Differences in performance on the range boundary may exist, due to terrain. It may be possible to incorporate military primary radar feeds into that used for civil applications by the ANSP, however service availability would have to be formally established. If an SSR system is being procured, it is likely that it can be co-located with an existing PSR system. Otherwise, new land requirements will be very difficult to meet (environmental, power, comms, local residents etc) The distributed WAM architecture is well suited to providing surveillance coverage within a specific and well defined service volume and can in fact be tailored to the precise coverage requirements. Site feasibility study should be performed in accordance with the guidance note F. It requires careful analysis (to ensure performance of WAM in the environment) using such software tools as EUROCONTROL CAPT 2 (Coverage Analysis and Planning Tool) to plan the location of the receiver sites.. ADS-B operates as a line of sight surveillance tool (as SSR), but can be more distributed than SSR at the same cost (lower cost ground stations, easier to maintain). Tools are already available for the coverage planning and analysis (particularly in relation where to place the ground stations through such tools as CAPT). For more on CAPT, see F.5.1. Consideration Type PSR SSR WAM ADS-B Service environment Functionality of surveillance system Suitable for providing a basic separation service, including lateral enroute separations. May also be used with procedural control. Both techniques can support the most stringent service requirements (for example, dual SSR supporting 3NM), although they may require PSR in some high traffic density environments. As WAM is generally more accurate than SSR, it may in the future support more critical service applications (for example, precision runway monitoring). ADS-B (with appropriate equipage requirements) should support the same services as SSR and WAM. In common with SSR and WAM, additional data may support advanced ground functionality. Benefits from surveillance Functional benefits, assuming coverage The only surveillance source independent of any on-board aircraft systems, it gives enhanced safety and security in the environment. SSR and WAM provide very similar benefits (particularly when comparing Mode S SSR and a WAM system able to process Downlinked Aircraft Parameters). These benefits include accurate positional surveillance, with identity and other data known. Safety is the prime benefit, together with capacity and efficiency. WAM also gives higher performances, including accuracy of 2D position and update rate. ADS-B gives similar benefits to WAM in terms of update rate, accuracy of position (based on GPS data) and data available. ADS-B also does not require as extensive ground infrastructure as WAM, and therefore has a cost benefit. Table 1: Technology procurement considerations Edition Page 17 of 76

18 SUR-WAM-GEN-PRO V2 WAM Generic Approval Process Volume 2 B.4 Other cost drivers The information contained in the following table will assist an ANSP in capturing the type of requirements and cost drivers associated with the implementation of a WAM system. Consideration PSR SSR WAM ADS-B Redundancy Redundancy of PSR coverage is WAM may provide redundancy for generally not required. SSR or ADS-B. However, it is important to maintain PSR coverage in volumes of airspace where a significant proportion of the traffic may not be transponder equipped (or where surveillance resources are shared with the military and an independent means of surveillance is required). Given the deployment of a single SSR in a given environment, the only means of redundancy of SSRs is to procure an entire second SSR. This is costly to implement, necessitating multiple radar sites possibly being relatively densely distributed across the ground, leading to multiply redundant SSRs for enroute (depending on the need for low altitude coverage in the airspace). Within WAM, redundancy may be provided by adding ground sensors (and possibly coverage cells incorporating central processors). This is less expensive than procuring an entire new SSR system, and may provide the same level of redundancy. Common points of failure should be carefully checked however, to ensure this solution is redundant. The positioning data source of ADS- B (the aircraft in this case) is single failure mode (i.e. if that one element fails, ADS-B is not available for that aircraft). Therefore, redundancy generally will need to be provided by other surveillance means, most obviously SSR or WAM. Relying on ADS-B sole means entails relying on the aircraft transponder, something that may not meet a safety case in high density TMA operations. Siting of surveillance The large size of the radars, and amount of infrastructure supporting the operation of PSR and SSR, make single site installation of these surveillance sensors costly for the ANSP. They may be co-located, reducing the overall cost. The high number of receiver sites and communication facilities necessitated by the dispersed nature of the WAM infrastructure, the size of the coverage volume and the nature of the local environment (mountains, buildings etc.) may present a challenge to the ANSP in both securing the land and providing the receiver station with the required power/ services. Fewer receivers than WAM are needed to support ADS-B based surveillance methods. Consequently the costs involved in establishing the ground station network are less then those for WAM systems. Edition Page 18 of 76

19 SUR-WAM-GEN-PRO V2 WAM Generic Approval Process Volume 2 Consideration PSR SSR WAM ADS-B Other ground infrastructure Maintenance With a centralised system, and standard communications links, both PSR and SSR have well-known and costed ground infrastructure. As a percentage of the cost of the radar and land, the other elements do not constitute a large part of the investment. These surveillance techniques intrinsically require the receiver station to incorporate moving parts into its design making them costly to maintain in terms of both servicing and on-going power supply. WAM is distributed, and relies upon high integrity (and availability) communications links and Uninterruptible Power Supply at each site. This adds significant expense. The lack of moving parts and of a WAM receiver site lowers the through-life cost of the surveillance service relative to either PSR or SSR. ADS-B ground stations are not likely to be as numerous as WAM, and do not require as high integrity comms links. ADS-B offers similar cost savings to those of WAM. In addition the reduced number of receiver sites needed to support ADS-B based surveillance will reduce costs still further. Decommissioning It may be possible to sell the large area of land left by a decommissioned SSR or PSR site; however, income generated by this sale may not re-coup the outlay of dismantling equipment and making the site safe. If WAM receivers are capable of de-coding ADS-B messages, their potential lifespan before decommissioning will be greatly extended by enabling their forward compatibility with future traffic mixes (particularly if they are able to support extension of ADS-B-out message sets). It is anticipated that the costs of WAM decommissioning will be lower than that of either PSR or SSR due to the less complex infrastructure of the WAM receiver sites. Table 2: System requirements and cost drivers Note: The feasibility of ADS-B as either a primary or fall-back method of surveillance depends on the level of avionics equipage and appropriate certification. It is anticipated that ADS-B will develop into a viable surveillance technique with an increased uptake of supporting avionic equipment. It should be noted that current (2008) implementations of ADS-B 1090ES on aircraft are generally installed on a non-interference basis (i.e. they are not certified for operational use), and therefore the data cannot be trusted. As EASA has now released an Acceptable Means of Compliance for the carriage of ADS-B transponders (for non-radar airspace), this situation will likely improve. The ADS-B in Non-Radar Airspace AMC was released in mid-2008 (AMC 20-24). EUROCONTROL is contributing towards establishing ADS-B as a viable surveillance technique through its central coordination role. In particular, the Pioneer Airlines project of CASCADE has the objective to obtain airworthiness approval for the use of ADS-B for enhanced Air Traffic Services in a non-radar environment (ADS-B-NRA), and in turn to support the ground validation work ongoing in many European sites enabling them to move to a pre-operational phase. Edition Page 19 of 76

20 SUR-WAM-GEN-PRO V2 WAM Generic Approval Process Volume 2 For Wide Area Multilateration close to existing airport-based systems, it may be possible to show compliance to the EUROCAE Minimum Operational Performance Standards (MOPS) for Mode S Multilateration Systems for use in A-SMGCS - ED-117 [ref 25], and extend the groundbased systems out into the approach/departure routes (or terminal environment). This will depend on the extent of the service volume required, and the performance therein. For monitoring approach paths (for example, Precision Runway Monitoring), it is thought to be unlikely that ED-117 will provide a suitable test specification. Real-life examples of the above criteria include: Innsbruck, where mountainous terrain led to the decision to deploy WAM; detailed coverage planning (particularly the base of the coverage) led to a cost-effective solution that minimised the number of receivers needed for the service volume; North Sea Oil Rigs, where installing radar is extremely cost-inefficient compared to the installation of a WAM receiver; Cape Town, where the use of WAM on the surrounding mountains ensures continuous coverage through the TMA and CTA, gap-filling the existing radars; also, low capital expenditure (Capex) was a consideration, even at the expense of slightly higher operational expenditure (Opex) through power, communications and support costs for WAM. B.5 Conclusion In conclusion, when choosing a technical solution to provide the appropriate surveillance performance for the operational services and environment of interest, the ANSP should take into account the factors mentioned above. Primary Surveillance Radar is a complementary technology, required for safety and security. It is particularly of interest in ensuring an acceptably safe service in high density terminal areas, or areas where there is a significant risk of transponder failure or lack of equipage. Secondary surveillance can be provided by Mode S Secondary Surveillance Radar, or Wide Area Multilateration. The decision between these technologies depends on many factors, in particular the coverage required, the choice of power and communications links, and any change in performance requirements (e.g. higher accuracy or update rate). ADS-B is primarily a future candidate for surveillance; 1090ES transponder equipage is not yet widespread, and is not certified. Installing WAM may be a useful upgrade path to ADS-B, particularly when considering redundancy requirements. Edition Page 20 of 76

21 C Procurement options for ANSPs C.1 Purpose An ANSP should consider the different procurement options for the deployment of a WAM system. This guidance note supports the selection of the most appropriate procurement option and highlights how the choice of procurement option links back to the overall procurement and approvals processes. C.2 Potential Options When setting out to procure a WAM system the ANSP has several valid options to pursue, including: System infrastructure procurement Sub-system procurement Managed/outsourced These options are illustrated in Figure 4 which provides a high level representation of a surveillance loop with the different options represented at the different levels of granularity in the functional boxes shown. Thus: if the entire surveillance system was outsourced to another provider the ANSP would treat the green box (labelled Surveillance ) as a black box the contractor would be responsible for the performance of the surveillance reports emanating from it. whereas an ANSP following a sub-system procurement model is likely to investigate the different market options available for various receiver designs (and so would investigate the constituents of the surveillance system and/or WAM system). Figure 4: High level representation of the surveillance loop Table 3 explains the differences between these models. The progression of the model from sub-system procurement through to full outsourcing essentially describes the placing of progressively more responsibility for the gathering of safety evidence on the manufacturer rather than the ANSP. Edition Page 21 of 76

22 Model Description Implications Examples Sub-system procurement Procuring elements of the WAM system from a manufacturer ANSP provides system integration in addition to day to day management. It also assumes additional responsibility for the design of the overall system such that the required surveillance performance is achieved (for example the number of stations, the level of redundancy required and the level of spares holding). Bespoke surveillance systems System infrastructure procurement Managed/ outsourced Procuring a WAM system from a manufacturer as either a replacement or enhancement to the existing surveillance system Procuring a surveillance capability from a third party service provider ANSP will be responsible for day to day operations including maintenance. Some tasks involved in sub-system procurement are delegated from ANSP to manufacturer (depending on the freedoms agreed in the contract). Irrespective of the contracts' terms this model requires the ANSP to present information to its NSA; this will necessitate that it performs some delegated tasks at a high level (e.g. receiver site location). The ANSP will need to ensure that its certification as a CNS service provider covers the outsourced service and third party (under the SES II legislation). Typical ATC system procurement SITA's surveillance services to Air Services Australia, ADS-B service to FAA Table 3: Procurement model overview Potential procurement options should be analysed, including the associated risks in terms of impact on the cost, capability and lifetime of the proposed WAM system. Any options that are unlikely to deliver a viable solution should be identified, and a clear rationale for not pursuing these options documented (i.e. the case should be made both against the rejected models and for the ones chosen). This ANSP should identify the most cost-effective procurement option including provision of decision points, which provide flexibility in contracting post-implementation support and plans for incremental acquisition (i.e. extension of the WAM system s coverage beyond that initially proposed). In this respect the procurement strategy should consider how well the models meet the ANSPs requirements for the: Design and manufacture (evidence of compliance with standards); Operational life management (e.g. responsibilities for system wide component maintenance [including costs]), The arrangements to create a full operating capability; and disposal issues. In particular the ANSPs should consider performing a Cost Benefit Analysis (CBA) of the various models in order to determine which type best meets the: budgetary constraints over the long and short term (analysis metrics will include break-even point and the net present value); Edition Page 22 of 76

23 size and capability of the ANSP s CNS (Communication-Navigation-Surveillance) implementation/maintenance department; These considerations should include the nature of first, second and third line engineering support capabilities within the ANSP (in respect to the maintenance of both sub-systems and their calibration). When this is compared to the other procurement options, the trade-offs involved in recruiting, training and retaining staff to perform these duties must be considered. C.3 Lifecycle considerations When selecting which procurement option to follow the ANSP should consider what issues will affect the WAM system throughout its operational lifetime. This through-life support planning (Steps 2 to 6 in Volume 1) will enable the ANSP to assess how well it can support these needs. The cost to the ANSP should be investigated at each stage so that overall costs can be fed into the cost-benefit comparison. It is possible that the ANSP will decide that the best procurement model to follow will differ depending on the WAM sub-systems. For example the ANSP may decide to outsource the management of the communications between the receivers and the central processor within the framework of a system infrastructure procurement model through the signing of a Service Level Agreement (SLA) with the service provider (e.g. telecommunications company). The principal steps in the lifecycle were captured in Volume 1. Elements of these steps have been re-grouped to provide a natural series of considerations that should be made when selecting the procurement option. Step 2 Analyse design options and system requirements, and Step 3 Define local environment considerations In this stage the exact architecture of the system is defined (including redundancy requirements and site locations). An inventory of the equipment needed to support the WAM system should be compiled (and updated in the subsequent steps), including: No of Rx; No of Tx; No of RMTR (Reference and Monitoring Transponder); No of RCMS terminals (Remote Control Monitoring Station); Central Processing Systems/Servers (CPS) Uninterruptible Power Supply (UPS); Displays - monitoring system health and its overall performance. Note that if WAM is being added to a non-radar environment, there may be a need for new processing and display to the controller also; Datalink communications installation; Towers (to mount Rx and Tx if necessary); Track recorders and playback functionality; Spares; Supporting technical documents (manuals, spares inventories); New test equipment required (BITE); Training courses for ATCOs (in the operational use of the new WAM derived data) and for Engineers (tailored to their specialism in WAM system maintenance); Edition Page 23 of 76

24 Ancillary equipment associated with equipping and protecting remote receiver sites; Cost of communication links between Rx sites (including taking into account instances where existing links can be re-used). This list can be completed with the help of potential WAM system manufacturers (who will be familiar with what components are required to support a WAM system), or by engaging expert WAM surveillance engineers directly. When this list is sufficiently mature, and a separate intelligence gathering exercise has determined the cost of procuring the components, a first estimate for the initial cost of system implementation can be produced. In doing this, a basic assessment of the validation process cost should also be made, in particular the likely requirement for flight trials. Step 4 covers this below; however, the costs incurred in these later steps should be included in any investment plan pre-procurement. It is at this point that it should be decided whether the ANSP will be providing the communications link themselves. If this is the case then an external authority should be appointed to provide support and independent verification that the options under consideration will meet WAM system performance criteria. It is suggested that the NSA would be ideally suited to this role; particularly if the suitable technical capability can be tapped within this organisation (alternatively an outside contractor may need to be engaged). Step 4 Delivery integration and validation This stage will assess the cost to the ANSP of placing the equipment in the environment and ensuring that it is fully operational. In addition the costs of validation and monitoring will also be assessed including: Cost of flight test, calibration and validation activities (these services could typically be provided by the system manufacturer if identified within the scope of the contract) The cost of ensuring that the Built In Test Equipment (BITE) is operational in the system s operating environment. In most cases the cost associated with compiling the approvals documentation will be a cost incurred by the procuring ANSP, however assistance may be sought from the manufacturer (e.g. in Rx site planning, provision of a list of components and their costing). Step 5 Establish operational service To deduce the training costs incurred by the ANSP, the duration of the training courses themselves will need to be determined and the impact on the roster assessed (i.e. ensure there is adequate cover while other ATCOs are in training) Transition planning considerations should include the: Cost of change proposals and downtime; Warranty agreements (including start point of warranty e.g. at delivery, at SAT or when the total system goes operational) Off-line/degraded mode time periods when systems are taken down for maintenance or upgrades; Further elements of establishing the operational service are noted in Guidance Note D. Edition Page 24 of 76

25 Step 6 Deliver operational service The SLAs with the supplier should be defined, where possible, to cover the lifetime of the components or systems (i.e. before, during and after warranty). It is anticipated that such an agreement would include provision for: User manuals (in both electronic and hard copy format) Guaranteed maintenance turn-around times (including penalty clauses if these were not met); Help desk provision; Regression testing (to ensure no unforeseen issues produce levels of service degradation). Edition Page 25 of 76

26 D Operational considerations when deploying WAM D.1 Purpose This guidance note outlines the operational considerations an ANSP should be aware of when deploying WAM in its local environment. It outlines the key elements of operational deployment, including the operational personnel s involvement throughout the procurement and approvals process. In particular, it lays out strategies to successfully build acceptance of the WAM technology with operational personnel. The following drawing depicts a WAM implementation in an existing operational environment indicating the different levels of implementation. Figure 5: Levels of WAM implementation The design of a WAM system for implementation and deployment has to be planned, carried out and verified at the operational and technical level. In this guidance note the focus is put on the operational level when deploying WAM. The technical level is considered in Guidance Note L on integrating WAM. D.2 Is WAM different? The operational considerations for deploying WAM depend upon the proposed role, for example a WAM system could be deployed: To enhance redundancy within an existing SSR system As a gap-filler in an existing SSR system To replace an existing SSR system Edition Page 26 of 76

27 As the sole surveillance system in Non Radar Airspace Operational considerations arise from changes in the operational tool-set or available procedures. From an operational perspective, it is assumed that WAM can be considered as a radar-like surveillance sensor that performs as good as (or indeed better than) SSR - both technologies share some basics like independency from aircraft derived data and cooperative functionality. Whichever way the internal functionality of a radar sensor is designed, the external high level function interaction with aircraft transponders and the surveillance data output is comparable. The consideration for the operational use of WAM is therefore identical to the consideration for the operational use of SSR albeit with some issues concerning failure modes and associated degradation (see Guidance Note J). D.3 Initiation phase (steps 1 to 4) Three types of changes to the ATC system may affect the controllers work when implementing WAM in an existing surveillance environment: Changes in the coverage volume Changes in performance if the WAM data is fused with other existing sources by the tracker Change from SSR failure strategy to a WAM failure strategy D.3.1 Team building An important issue, if sometimes underestimated, is the human factor that is ubiquitous in each change in operations. The correct design of equipment, and its acceptance after implementation, relies on the assignment of the necessary people to a project. Therefore, a team (task force) with widespread expertise should be established to work together on the project s success. It is essential that people from different departments, different knowledge and levels in the hierarchy and even from internal organisations (such as a union) participate in that team. On the one hand, all involved persons are involved such that it helps to avoid late input and complaints; on the other hand, the project needs the input from many different viewpoints in order not to miss corrective input and get the best quality outcome. Working in such a well-defined team, with the involvement of all future system users, builds trust. This might constitute the key issue for the success of the WAM deployment. D.3.2 Operational requirements Based on the information of the initial change, the knowledge of the local environment and the input of expert s experience (even from the past) the implementation team could start to work in order to develop the operational requirements together in workshops. Requirements should not only be defined according to standards or guidance, as an excellent source of expertise comes from the controllers experience and thus estimation and feeling. EXAMPLE: the HMI update rate for a WAM application was determined to be 2 seconds based on a decision not to change habits too much instead of using technical possibilities to an extent (HMI update for a radar had been 4 seconds and a potential WAM update rate could have been smaller than 1 second, but controllers have been used to the 4 seconds). Edition Page 27 of 76

28 Additional to the well known requirements such as Probability of Detection, accuracy, availability and so on there are others that should be taken into account as well: Is (n-1) sufficient or should (n-2) be more adequate (e.g. in case of replacing SSR, implementation of WAM as a second layer,...) Should the overall service volume be divided into operational sub-volumes, and how are the requirements impacted Will the coverage volume be limited or increased later on (and thus the WAM system) How is the involvement of local ANSP personnel defined in order to assist or support manufacturers Who takes responsibility Clear requirements and criteria when the service is off or degraded (for the whole volume or even for sub-volumes) A guideline for finding correct and adequate requirements for a local implementation could be given by clarifying the balance between: the operational benefit; the environmental needs; the systems quality; the costs. By adjusting these four criteria in a reasonable way, a WAM implementation should be achievable for each location interested in surveillance improvement. An upcoming challenge will be to enable the market to produce COTS products in such a way to serve all different levels. D.3.3 Planning, procedures and documentation Whenever operational benefits arise from a WAM implementation, there will be an impact from any degradation in the WAM system. It is therefore meaningful to specify the benefits, the impact, the mitigation and the consequences (reduction in throughput or movements, procedural control, separation issues etc). In particular, the failure case has to be defined in a very precise way since WAM is a new surveillance technology with less field experience. The risk of facing unexpected situations and behaviour is material, and therefore a well designed mitigation strategy has to be defined and to be in place. A large number of failure scenarios should be included in this strategy guidance note J considers this in more detail. A helpful strategy could be to choose a conservative approach to safety aspects in order to increase the safety margin. Additionally to the national and site specific documentation such as project planning, handbooks and so on there are others that should be taken into account as well: Procedure for maintenance in order not to degrade the system Procedure for upgrade in order not to degrade the system or minimise the downtime and to keep costs low (upgrade during day / night, test-phase design) Procedure for the WAM systems failure case (degradation case) and notification of effects to the ATC (that failure case could be seen as a service off or service downgrade ) Edition Page 28 of 76

29 Procedure and responsibilities for the failure case reporting (accurate, timely, according to ESARRs, special procedure for failures that were not detected before) Early defined transition plan highlighting roles, mitigations during the transition Fall back scenarios and procedures Controllers technical training to ensure familiarisation and understanding of the (local) WAM system D.4 Transition / test phase (step 5) The transition phase from procedural based service (in the case of introducing WAM to a previous non-radar environment) to surveillance based service has to be planned carefully according to local operations, existing environment and resource situation. The best case scenario is to run a test period on a test ATM system followed by a shadow mode operational period at the operational system before the new WAM sensor is switched on as an active part of the operational system. If such a procedure cannot be achieved due to the lack of a test system environment, a specific time period for testing the WAM sensor parallel to the operational system has to be planned and designed in such a way that mitigation means can be applied instantly in case of problems. Appropriate fall-back scenarios for all identified risks have to be in place and available during such a test phase or transition phase to enable a safe and quick change to the original environment at any time. A date for changing the system status from operational validation to operational should be announced in order not to keep that test-status for a long term period. The different distribution of controller s workload has to be taken into account during that time period. It might be helpful to declare the controller s role as a mitigation means during that test phase. People should be aware of possible failures (controllers and technicians) and be prepared. Unknown and unexpected behaviour may occur. Training will be a key step in ensuring that controllers are made aware of the potential behaviours of the new surveillance system. During the test phase an improved monitoring is a key issue. If problems occur, they have to be analysed and solved, but should not be considered as a show-stopper. D.5 Operational phase (step 6) After the introduction of the new WAM system and a consolidation phase, controllers get increasingly used to the benefits gained from WAM. As experienced, and reported from different WAM implementation teams, a well designed WAM (MLAT) system doesn t tend to fail very often. Balancing this positive fact for controllers is the risk, to decrease the ability of failure mode handling. Thus a cyclic contingency training regarding failure modes should be specified and carried out (procedural control, situational awareness etc). As a lesson learnt, it is more important, in case of WAM failures, to train those extremely familiar with the legacy environment than those who are not, as the perception of the failures may not be as high in the former case. Edition Page 29 of 76

30 D.6 Requirements for a controller handbook The Controller Handbook will need to be updated when introducing WAM. This update should take account of the following issues: Overall concept Separation minima Application Operational issues Expected benefits, anticipated constraints, associated Human Factors Procedure description, fallback procedures and ATC procedures and methodology Proficiency and training An example controller handbook can be found in [ref 23]. Edition Page 30 of 76

31 E Performance and interoperability requirements E.1 Purpose This guidance note provides additional information to ANSPs on how to define the operational and system performance of the WAM system, in the context of the overall ATC system, whilst ensuring interoperability with existing systems. It does not repeat work already done by EUROCONTROL (in section 4 of the generic WAM surveillance safety assessment [ref 1]) or ICAO SASP [ref 16]. Instead, it builds on these references, showing lessons learnt by ANSPs in defining performance and interoperability requirements. E.2 Why is WAM different? The performance design of the WAM system, from both an operational and technical standpoint, can cause confusion amongst those procuring WAM systems. Performance should be considered as an answer to the question: How good does the system need to be to be useful, and work as intended? Interoperability requirements also ensure that the new WAM system infrastructure works with existing ATM system elements, including avionics. If the intention is to use WAM data in the same manner as radar data, the operational performance should be at least as good (i.e. the same service volume, data elements, data quality etc). Thus, in many documents to date, the concept of proving that WAM is as good as or better than radar data is described (for example, ICAO SASP [ref 16] and the EUROCONTROL generic WAM safety case [ref 1, 2 and 3]). However, WAM technology has the potential to provide far more specific performance data, either through new service volumes or increased data quality (e.g. accuracy, update rate). Thus, there may be a more complex performance analysis, driven by operational demand. This is expanded below and also in guidance notes F and K. Regardless of the similarity or otherwise of required operational performance from the new WAM system, the translation into detailed technical/system performance requirements will certainly be different than for the radar case, owing to the different method of deriving aircraft 2D position. As WAM data has different properties to radar data, interoperability of the system should be carefully considered to ensure it is future-proof whilst being in line with current implementations. E.3 Process In line with ED-78A [ref 9], the ANSP should be following a top-down process to define operational and system performance requirements as follows: Operational service and environment definition (OSED) Operational performance definition System (technical) performance definition Interoperability requirements definition It is nevertheless recognised that in certain cases, bottom-up technical requirements may impact the achievable performance of the WAM system, and therefore act as a constraining factor. Defining the requirements requires significant effort, and must be understood by the responsible operational and technical personnel. The interpretation of these requirements must be clear and unambiguous. For example, controllers recognise a probability of detection Edition Page 31 of 76

32 to a low threshold (i.e. not very precise), whereas technicians are able to measure PoD and compare it against the specifications. For the ANSP, translating the operational performance figures into technical WAM performance will depend on the exact architecture. For example, tracker functionality will impact the eventual requirements on the WAM system itself, as it impacts the latency of the data and the potential accuracy (if the tracker contains extrapolation functions, the ANSP may be able to require a slightly lower continuity). The type of Functional and Technical Specification being written will also determine the level of performance requirements to be defined. The ANSP may decide to purely place requirements on the data output of the WAM system, leading to a Service Level Agreement on data performance. Alternatively they may decide that, in order to have greater control of the system, maintenance and spares policy etc, a greater level of detail is required including (for example) individual component properties. Other guidance notes describe this decision in more depth, in particular Procurement Options for ANSPs in Annex C. E.4 Interoperability of the WAM system The following elements should be considered in the interoperability of the new WAM system (further details are found in Guidance Note L): WAM data formats: two main options exist for the ANSP they may either use ASTERIX Cat 019 and Cat 020 dealing with WAM monitoring messages and WAM data transmission respectively, or ASTERIX Cat 048 where WAM data format (not content) is altered to imitate radar data. The latter option may be used if the ANSP does not want to upgrade their tracker for cost reasons; this may mean some integrity information is lost as the tracker processes the data, since it will not know that the data has been received from WAM (instead, it will assign radar properties to the data, such as elements of the error distributions). However, as multi-sensor tracker solutions are state of the art at present, it is recommended for the ANSP to make full use of the WAM data that Cat 019 and Cat 020 are using. WAM data update rate (data stream loading at the input to the tracker, or other interface point): the tracker (or other interface) and communications link must be able to deal with the increased data update rate, or the data should be filtered if this is not feasible. There are also differences in the way WAM systems transmit information, with some transmitting positions at the moment they are derived (sometimes more than once per second) and others operating on a cyclical basis. Some trackers can only handle a certain amount of inputs per second; this will act as a limitation to any data requirements. Note that it will depend on the traffic loading in the environment; any solution should be designed to be robust to any future increase in traffic levels forecast for the coverage volume (note here it is the coverage volume that is important, rather than the service volume, unless a requirement is put upon suppliers to suppress any derived data outside the service volume). WAM data elements (if any new data elements arise from the introduction of WAM): if the ANSP has only a legacy Mode A/C radar, it is likely that the WAM system will be able to provide increased data to that currently available, for example, Mode S Downlinked Aircraft Parameters. It is an operational and cost-driven decision for the ANSP whether investment in the ATC system will be made to process and use this additional data. Adjustment of any radar data to align with WGS-84 (x,y) coordinates, such that WAM is compatible: this refers to slightly older systems, where the radar range is displayed as a slant range as opposed to true ground distance. In order to correlate with the Edition Page 32 of 76

33 WAM 2D position (which is calculated as a true ground plot), the slant range must be translated into WGS-84 coordinates. Transponder occupancy levels and interrogation planning. Dependent on the WAM implementation, active interrogations may be required. The interrogation strategy should be carefully considered, to avoid under or over interrogating aircraft in the coverage volume. Any single interrogation generated by the WAM system affects the existing surveillance system directly by adding an additional usually omni-directional interrogation signal to the existing ones (frequency occupancy) or indirectly by forcing a transponder to answer. E.5 Implementing WAM in a non-radar environment The goal of implementing WAM where no surveillance currently exists is to provide surveillance data that enables an Air Traffic Control surveillance-based service (separation, monitoring and/or vectoring). The move from a procedural service to a surveillance-based service must be planned carefully according to the local operations and environment. Performance requirements may be initially designed according to the premise that a radar-like service will be provided. In this case, the WAM data must be shown to be as good as or better than a reference SSR at an operational performance level. The key is to define the reference SSR appropriately for the local situation. The ANSP may use one of their own SSRs as a reference, or may refer to the EUROCONTROL Radar Standard [ref 6]. Note that any operational performance value specified should be independent of the surveillance source (i.e. it should apply to both SSR and WAM). Even when showing that WAM data performance is the same as (or better than) radar data performance, the service and coverage volumes must be adequately defined as further described below. E.6 Implementing WAM in a radar environment The goal of implementing WAM in a current SSR environment is to either provide redundancy at a lower cost than SSR, or improve performance in some manner. The former objective can be considered in the same way as the non-radar case, with performance as good as radar being sufficient. The second case requires more thought. If the goal is to improve operational performance, the critical points are to capture what benefits are being sought, and how they will be provided. This should be carried out through detailed operational workshops, involving the key parties (ATCOs, managers, potentially unions) in the discussions, particularly where it changes the controllers role. For example, an ANSP with independent parallel runways may wish to apply higher surveillance requirements to monitor the approaches (in particular, vectoring onto the final approaches, or the use of curved approaches). This may be specified as a higher update rate, a higher accuracy and/or a higher availability. It is likely that the update rate will be required to more quickly show turn dynamics of aircraft, whilst greater accuracy may give the controllers more comfort in monitoring the aircraft on the approach. The availability figures may result from a safety assessment, where acceptable failure rates of the data with aircraft on parallel approaches are found to be higher than for a nominal TMA or en-route scenario. E.7 Service (and coverage) volume definition There is a need to define the service volume, balancing the operationally-desired service volume, the achievable coverage volume and the cost. The intended service volume should first be defined. As mentioned throughout this document, there is the possibility to divide the service volume dependent on required performances for Edition Page 33 of 76

34 different operational environments. The feasibility of providing this service volume should then be assessed. If the intended service volume cannot be met by the simulated coverage volume, a trade-off between additional cost and higher technical resource (e.g. new sensor, more optimisation, or a new system) should be made. Note that this is only likely to be the case for low-level service volumes affected by terrain and/or obstacles. En-route volumes should be straightforward. As an example, one ANSP had the situation where performance in the defined service volume was not achieved according to the provided system; several holes in performance were detected, contrary to simulation results (equally, a new element e.g. multipath may be identified in reality compared to the simulations). The decision then to be taken was whether to equip with additional sensors, or to reduce the service volume to fit within the achievable coverage volume. The latter option was taken, as it had minimal impact on operations (note this was only detected by the use of extensive flight trials, something discussed further in the paper on assessing WAM performance in Guidance Note K. The areas with reduced WAM performance (i.e. the holes in the service volume) should be stated in the local handbook. Due to future scenarios, as the service volume for WAM systems is increased, it may be difficult to envisage a single coverage volume to cover the entire airspace, as the typical n-1 scenario will no longer be meaningful (e.g. if one sensor fails, and another fails 200NM away, it makes no sense for the entire WAM system to move to a degraded mode across the entire region). This situation is solved by the introduction of logical sub-volumes of airspace. These can be arranged with respect to: a) the siting of WAM infrastructure (sensors, interrogators or reference transponders), such that technical failures are appropriately responded to, and b) to assist operational procedures in case of degradation (e.g. responsibility for procedural mitigations can lie with a single supervisor or ACC, so that if a sub-volume loses performance, the operational response is appropriate to the technical issue). The WAM application software should assist this concept, by enabling the concept in the supplier CPS and data handling. Although it is the decision of the individual National Supervisory Authority as to whether additional operational approvals are necessary for the extended coverage volume (and assumedly extended service volume), it is expected that this supervisory activity will fall within existing review tasks, as long as the operational service being provided does not materially change. If a new operational service is being provided through the extension of the service volume, the NSA may wish to conduct a new operational approval. More detail on the coverage volume planning (to meet the desired service volume) is given Guidance Note F on coverage and receiver site planning. Edition Page 34 of 76

35 F Coverage and receiver site planning F.1 Purpose This guidance note outlines a methodology for receiver site planning that should ensure the system is built around a performance based concept i.e. one that meets the requirements of the operational service environment. It also considers the siting of interrogators and reference transponders. The note has been broken down into sections describing how the operational service environment and coverage will influence the locations of receivers (a top down approach), methods and tools for planning the locations of receiver sites and additional sources of information. This paper should be read in conjunction with Guidance Note E on defining operational performance requirements, including the service volume. F.2 Why is WAM different? WAM, as a distributed technology, requires a far greater level of detail in the coverage planning of components than radar. The coverage must support an adequate reception of signals to ensure the TDOA calculation (through the siting of receivers and the geometry between them), whilst providing interrogators and reference transponders in the local environment as necessary to ensure adequate signal levels and monitoring. In practical terms, every point in the coverage volume must be visible to at least 4 sensors for track initiation (3 sensors for ongoing position calculations), and more if n-x solutions are required. Coverage planning is one of the key differences with the implementation of WAM; ANSPs should anticipate that it will take significant additional effort to solve the issues involved. F.3 Defining the operational service and environment The functional requirements of the surveillance system will primarily be influenced by the operational and service environment into which the WAM system is being introduced. It is expected that these attributes will flow from the local environment description and, therefore, capturing the nature of this operational service and environment will be the first step in planning the placement of receiver sites. An operational service and local environment description will include a consideration of the: Needs of both the airspace users and those of the controllers (in terms of the surveillance information) to support a particular airspace application, such as that of; - Separation through vectoring in the TMA and/or precision runway monitoring (vectoring aircraft to within 2.5 or 3 NM of each other); - Any traffic advisory service; - New routes in the airspace, enabled by the introduction of increased surveillance coverage. Nature of geographical environment both within and surrounding the airspace under consideration (e.g. landscape [mountains, lakes etc.] and, for urban environments, the location of tall buildings likely to cause shadowing in signal reception and transmission); Density and complexity of traffic flow (including airspace routing and structure in the local area, and any changes envisaged as a result of the move to WAM based surveillance). Edition Page 35 of 76

36 Figure 6: Factors to consider in the environment definition. An example of the type of information that would form part of such a description is provided by Figure 7 which outlines the location of mountainous terrain in relation to AustroControl s WAM surveillance system in Innsbruck and the procedure that the system is intended to support. Case study Innsbruck AustroControl, in line with many early implementers of the WAM system, initially deployed the WAM system in a trial capacity. A high level requirement of WAM covering the approach to INN was described, including the Missed Approach Procedure. Equally, there was a costbenefit consideration, with the ANSP ensuring that 6 sensors (as an assumption) met the greatest amount of operational service volume, whilst planning for increased coverage in the future. These 6 sensors did not fully meet the operational need, and were subsequently increased to 9. More difficult were the discussions on low-level coverage in the INN valley, with stepped/ramped coverage being carefully defined according to operational need and technical pragmatism (cost), agreed with the manufacturer. Edition Page 36 of 76

37 Figure 7: Surrounding terrain and instrument approach procedure used at Innsbruck Airport Edition Page 37 of 76

38 F.4 Service volume description As a second step, the following requirements for the surveillance service volume must be defined, based on the operational service and environment definition. The service volume must be defined in 3 dimensions, with particular care taken on the lower boundary of the volume. This is because the lower the coverage required, the greater number of sensors will be needed to give the visibility to ensure adequate performance. The performance definition (described in Guidance Note D) should show what level of performance each service volume requires; note that different service volumes can be defined for different levels of performance (unlike for example a single radar system, where performance is solely a function of distance from the radar). Whatever the borderline will be - a straight line, a ramp or a step pattern it has to be defined in such a way to support a convincing test flight at the end. A borderline defined as equal to a mountain slope leads to unresolvable difficulties. A potential mitigation could be introduced by specifying the borderline or 500ft above AGL depending on the environment. Since WAM is a very new technology in the field of aviation surveillance such knowledge and anticipatory appraisals are essential. F.4.1 Sources of information and assistance When determining the size and shape of the service volume the following sources could be consulted: Judgement of local experts, e.g.; - the ANSP s surveillance manager; (identify any existing surveillance coverage, including those volumes of known blank spots ); - the operations manager (to capture the various procedures used throughout the airspace volume proposed for MLAT coverage). Documented operational requirements for the service area (e.g. TMA) Recorded radar tracks for the proposed area (giving information about direction and density of the traffic flow); Aeronautical charts for the local area; High accuracy terrain maps from the local mapping authority (e.g. Ordnance Survey in the UK) Required benefits from the implementation of the new WAM system; for example, improved Missed Approach Path coverage, or low-level gap filling for existing radars. In addition the ANSP may wish to compile an inventory of the major aeronautical operations taking place within the coverage volume (including major TMAs/airports, location of GA airfields, helicopter operations [routes and heliports] etc). It could also be expected that the WAM system manufacturer could provide some type of assistance to the ANSP when planning the siting of ground station receivers, such that any service volume defined was pragmatic in terms of being met technically and financially. Most WAM manufacturers have their own planning tools. The level of support provided by the manufacturer in this respect will depend on the procurement model pursued. Nevertheless the ANSP can help to secure this assistance (at least at a high level) by including it as part of a pre-contract pre-qualification requirement when issuing the initial tender documentation, or being releasing a formal Request for Information. Alternatively the ANSP may wish to develop the coverage planning tools in house (or have direct access and working knowledge of the EUROCONTROL CAPT 2 WAM planning tool). It Edition Page 38 of 76

39 is recommended that more than one tool is used (e.g. manufacturer and CAPT2), to compare the results and improve the integrity of the eventual findings. F.5 Coverage volume planning Once the level and coverage of surveillance required (i.e. the service volume) has been established, the issue of locating ground WAM constituents and deriving a coverage volume can be addressed. This performance-driven top down approach to establishing the WAM systems infrastructure is thought to be the best approach in order to ensure that the technical performance of the surveillance system meets its operational performance requirements. The coverage volume planning relies upon a similar environment definition to the service volume, but includes the location of the receiver (Rx) sensors, the interrogator/s, and the reference transponder/s. It also takes account of any redundancy required in the system, drawing on the early investment decisions made and the outcome of the PSSA. Site feasibility is the other aspect that must be ensured prior to the coverage plan being finalised. F.5.1 Software tools The visibility of the sensors to the traffic and the redundancy requirements in the system can be addressed initially through surveillance coverage planning tools. The conclusions reached through the use of these tools will require validation through flight trials. It should be noted that software tools are particularly valuable when exploring redundancy within the system, principally by providing an answer to the question what would happen to the coverage volume and integrity if sensor x failed? Note that in addition to the variants of receiver positioning (geometry), terrain and traffic density, consideration may also need to be given to features such as wind farms, which may have an adverse effect on the probability of reception for the WAM sensor. Software packages can determine the coverage provided by the system as a function of the location and number of functioning sensor sites within the system. Examples include: CAPT (Coverage and Analysis Planning Tool) 2: This EUROCONTROL software tool for the planning of WAM receiver site locations is currently under development, with completion due by March It is anticipated that this tool will enable ANSPs to explore the relationship between the location of receivers and coverage volume, along with the impacts of failure scenarios. it will use a terrain model to determine positions of coverage unavailability due to the screening of the WAM signal by physical obstacles. SASS-C: Surveillance Analysis Support System for ATC-Centre: is an ATC-centre based Surveillance Analysis workbench for ATC Radar Plot Analysis and Tracker Performance Measurements. It provides a software toolbox (developed by EUROCONTROL) that gives standardised methods and tools for assessing the performance of Surveillance infrastructures. SASS-C is typically used for: - Monitoring the compliance of operational radar and trackers to nominal performance, and in particular those defined in the EUROCONTROL Surveillance Standard for En-Route and Major TMA. - Supporting the periodical (daily/weekly/monthly) monitoring of the ATC Centre surveillance systems efficiency. - Supporting air incident investigation. - Supporting the development of radar and tracking systems. Edition Page 39 of 76

40 At present, SASS-C is designed to handle surveillance data from Radar sensors (PSR, SSR, Mode S elementary surveillance) in both a Mono- and Multi-radar environment, and Trackers. In the future, extensions for handling ADS-B and multilateration data in addition to Radar data are foreseen (SMART V7 will model WAM error characteristics). SMART (Simulator for Multi-radar Analysis for Realistic Traffic): This EUROCONTROL surveillance tool has three distinct primary functions. - The Traffic component generates realistic aircraft trajectories in an air traffic network using Aeronautical Information Services data (routes etc), aircraft models, interactive traffic load models, traffic characteristics and weather data. - The Radar component produces plot data using radar and transponder error models, generation models for false plot and non-aircraft related primary plots. SMART v7 will also model WAM error characteristics. - The Output component sends out required data in real time via the Local Area Network The use of SMART should form part of the process performed by the ANSP when determining: - performance of a given sensor/configuration of sensors in terms of errors, latency screening and coverage volume (comparing WAM derived data to that from other sources, e.g. SSR, ADS-B); and; - tool to simulate future traffic levels to ensure the built system can cope with the growth in air traffic and associated RF pollution. RMCDE (Radar Message Conversion and Distribution Equipment): surveillance data front end processor and distribution system (interfaces various ASTERIX sensor data, as fed to it directly by the sensors). SCAS (Surveillance Coverage Analysis Suite) produces coverage diagrams and interface diagrams for different surveillance sources and explores future traffic scenarios; and therefore is used as an evaluation tool. It is expected that the above suite of tools will be used to support sensor configuration planning and sensor performance analysis. Alternatively the ANSP may wish to utilise its own set of surveillance planning tools. An example of one of these tools is shown in the figure below, taken from AustroControl s analysis of the Innsbruck WAM environment. The tool takes into account line of sight calculations to receiver units, and subsequent Dilution of Precision. Each point represents different numbers of receivers that can be seen (with purple being 5 or more). Note that the simulation may not reflect reality fully, an aspect discussed further in guidance note K. Edition Page 40 of 76

41 Figure 8: Example of ANSP tool to simulate WAM performance Manufacturers also use similar tools. An example coverage map from a manufacturer (again, covering Innsbruck) is shown below. Figure 9: WAM surveillance volume coverage analysis (manufacturer tool) F.5.2 Siting of interrogators and reference transponders Interrogators (transmitters) must be sited in the surveillance environment to ensure that: the entire WAM service volume is fully interrogated (e.g. to produce Mode A/C/S transponder transmissions for all non ADS-B squittering aircraft); and Edition Page 41 of 76

42 where interrogators are being used for ranging (multi-ranging), they are appropriately sited to ensure performance of the WAM system. The interrogation strategy will also determine the location of WAM interrogators if the interrogators can be designed to work in conjunction with existing interrogators (e.g. SSR), there may be less WAM interrogations needed to give the required replies. Also, the position of the reference transponder must be accurately known in absolute terms so that any deviation of its position (as deduced by the WAM system) from it can be measured and monitored (e.g. due to geometric dilution of precision, terrain shielding or equipment failures). If the WAM system is a distributed clock system, there is the need to either: a) find a site where the reference transponder can see all receiver sensors or b) include a reference transponder that can see a subset of receiver sensors, but share at least one receiver with a second reference transponder (such that timings can be compared and errors monitored). F.5.3 Site feasibility study Once the above considerations have been addressed, the ANSP will know the approximate locations in the environment where WAM receivers will need to be installed. These locations at which the sensors could physically be placed should then be collated together in a master inventory. A feasibility study for each of the proposed receiver sites should then be conducted. This should be performed in a consistent manner that will enable the ANSP to make an informed and unbiased decision about which site will: offer the greatest benefit to the coverage volume of the WAM s surveillance system (initially explored through software simulations and later validated by real world trials); and; minimise the impact of the receiver sites upon the local environment. The availability of planning permission for the establishment of a WAM receiver site will be a particularly pertinent consideration in this respect. The Frequently Asked Questions below contain more information on this aspect. Edition Page 42 of 76

43 Figure 10: Factors affecting a site feasibility study After an initial site survey has established an inventory of potential receiver sites that are capable of providing coverage throughout the planned volume, the suitability of each site may be determined by scoring it against a set of criteria. In particular, the ANSP should identify where critical sites (that cannot be moved) exist, and secure them. This may be the case if the presence and location of one ground sensor/receiver is critical to the performance of the WAM system in the service volume. Ideally, this should not be the case, as redundancy can be provided by additional sensors where necessary. However, the cost-benefit case may suggest that certain locations will be non-redundant (e.g. for deployments on-board oil-rigs). This analysis will include a consideration of the following issues: Ownership: Who owns the site? Is it the ANSP, the government (military?), a commercial organisation or a private individual? What contractual arrangements, if any, will need to be put in place to ensure the ongoing usage of the site? Planning permission: What is the probability of acceptance? Note: it may be decided to attempt a planning application even if this is thought unlikely to be accepted initially particularly if the site is deemed eminently suitable on all other counts. Existing installations on site: is it used for existing ATM-CNS, telecommunications or power networks infrastructure? Power availability: Feasibility/costs of connection to existing power network or, alternatively, is there a need to generate the receiver s power on site and what implications does this have on cost, security, maintenance etc. (e.g. solar panels). Security: e.g the costs of barriers - if determined to be necessary to keep the site secure (although a security or vulnerability assessment should also be conducted to ensure that all system aspects are considered) Edition Page 43 of 76

44 Accessibility: of location and its contribution towards installation, maintenance and decommissioning costs? Neighbourhood and environmental considerations: Is the ANSP under pressure from local lobbying groups? Receiver design: are there any special requirements for the supporting infrastructure (e.g. on-site power generation, re-use of existing radio mast, etc.)? Communications link: Will the communications between the different receivers and the central processor be provided via cables, shot-wave line-of-sight microwave links or Satellites (VSAT). Are there any legal, regulatory or safety issues associated with using any of these types of links? Antenna type (omni-directional vs sectorised): producing antenna diagram is essential to ensure the appropriate model is captured (both for horizontal and vertical domain) The above points outline the type of factors that could potentially constrain the size and location of the WAM system s service volume. Ultimately, a balance will have to be struck between the level of coverage needed and the availability of suitable sites. A useful exercise as part of this process is to assess the contribution that a receiver or transmitter at a particular site makes to the overall system performance. Considerations should include whether a) is it vitally important that a receiver is located at that particular site, b) what are the alternatives to this site (if any) and c) what the cost implications are if another site has to be chosen. F FAQs for site feasibility 1. What is the contractual liability in the case of site selection for the ANSP or manufacturers? The contractual liability for the site selection, as it impacts the performance of the WAM system in the service volume, is a key issue for all actors. Several conditions exist, depending on which actor is responsible for selecting specific sites to meet the ANSP s defined service volume. Note that liability would only exist if a very clear requirement of service volume (and performance within the volume) was laid out by the ANSP. If this is the case, it is recommended that the ANSP require the manufacturer to show how it will meet this requirement through the placement of its constituent components (receivers, interrogators etc). The ANSP may provide a site map (showing possible locations across the area under the service volume), but the manufacturer should then guarantee the performance if it defines exact placement. Thus, any contractual liability in the case of non-performance of the WAM system then lies with the manufacturer. 2. Is an appropriate existing site available? The site for a receiver would ideally already be under the ownership of the ANSP it is anticipated that this will be the case for some potential sites, but not all. For instance it is supposed that the ANSP, when establishing dual layer SSR and WAM coverage, will colocate a WAM receiver with the SSR. However in a situation where WAM is replacing an SSR it may be decided that it is in the ANSP s best interest to sell the site on which the SSR was located for development as its replacement WAM receiver will have a much smaller footprint upon the land. An excellent alternative to siting receivers on land already owned by the ANSP would potentially be their situation on a site currently used as ground stations for other communication networks. In the commercial sector these sites are most likely to be mobile telephone network towers or radio communication masts. The level of objection presented by local authorities to the augmentation of these sites with an additional receiver for the WAM Edition Page 44 of 76

45 system is likely to be lower than that for a new site. However although these ground station sites are likely to have a good availability of such resources as power, security, etc a possible barrier to the installation of a WAM receiver upon them would be the possible interference between different radio signals. N.B. it is always important to remember that a top down approach to receiver siting should be taken by the ANSP. Indeed the required coverage volume should not be reverse engineered according to what sites are available on the ground as this may well result in an inappropriate coverage volume being established. 3. What is the feasibility of establishing a new site? In situations where the required coverage volume dictates that a new site, previously unused for a communications or surveillance activity, is established as the location for the receiver site, its suitability to perform the task must be established. A basic requirement for the site must be availability of reliable power, and the choice of communications link to be used. Uninterruptible Power Supplies may be cost-inefficient for each remote site; therefore, redundancy may need to be built in (for example, through the use of solar panels). The key issue for most new sites is the Environmental Impact Assessment, which may add significant cost and effort to the project, depending on the exact location. The WAM antennae themselves are reasonably small, and therefore easy to install. Security may be an issue in the local environment, as it can be difficult to establish security for remote sites. The sites must also be reasonably accessible. Although requiring less maintenance than a typical SSR, WAM sensors do need checking regularly (6 or 12 months) for cabling, wind damage, etc. The number of man hours required to install, service and decommission a receiver at a particular location should be investigated prior to its installation. 4. What argument and supporting evidence will the ANSP need to provide to the local planning authority for permission to erect a WAM receiver? The ANSP will need to justify to the local authorities the need for the receiver site. It is anticipated that such a case will need to outline the benefits of the WAM system as a whole including the enhancement to public safety and the local economy. It is expected that this information will be contained within the planning application submitted to the local authorities. F Trade off analysis for site feasibility It is expected that the final set of sites selected for the installation of WAM receivers will be determined through a trade off analysis that aggregates the potential costs, benefits and risks of all the sites identified as possible locations for receiver installation. This task will need to be performed at a system-wide WAM level. It is anticipated that this study will serve to identify the two sites that are best suited to hosting each receiver required in the WAM system (i.e. this ensures that both a primary site and a back up one are captured). Edition Page 45 of 76

46 G How to plan for future system expansion G.1 Purpose This guidance note considers how to develop a WAM system such that its geographic scope (service volume) can be extended. The development of such an extension will still need to be planned for in terms of the impact it will have upon the ability of controllers to manage the airspace and the costs involved in the additional infrastructure and data processing facilities. G.2 Overview Multilateration is a highly adaptable surveillance technique it can be designed to the needs of the surveillance application it supports (be it on the airport surface, in the TMA or for the en-route environment). It is particularly flexible in its expandability; the scope for coverage provided by any given system can be extended with the addition of receivers (and central processing facilities, if necessary). This feature of the dispersed WAM surveillance system potentially offers scope to combine discrete areas of surveillance coverage into a single contiguous volume. For example surface surveillance, precision runway monitoring and terminal airspace surveillance could be covered by a single WAM network that fills the coverage gaps between these various locations and is built to ensure redundancy. Equally, a service volume could be lowered to include low-level coverage down to regional airports. G.3 Airspace planning assessment As a first step in considering the options for expanding a WAM system, all the various types of ANS offered both within the WAM coverage volume and in the local airspace surrounding it should be captured (e.g. a vectoring and radar advisory service in the TMA, separation service in en-route airspace etc.). This information should include details about the type of surveillance technique that is currently used to support those applications (if any). This should also assess the likely routes in the coverage volume, including any missed approach procedures and medium-term changes. Secondly any existing multilateration installations in and around the proposed WAM coverage volume should be investigated (Note: these are most likely to be used for monitoring airport surface movements). In particular this survey should capture the accuracy of the systems performance. From this information it should be possible to geographically map out the existing multilateration coverage volumes, possibly by using colour coded contours to describe the level of surveillance accuracy and redundancy they provide. Notes detailing the type of platform that supports the surveillance coverage (WAM, PSR, SSR) should be added to this geographic inventory. Examples of this planning include (for WAM) the Innsbruck Eastern approaches, not covered by the initial installation, and (for A-SMGCS) the Heathrow Terminal 5 project. These considerations are shown pictorially in Figure 11. The grey text boxes show existing infrastructure and surveillance, the yellow text boxes show the planned future WAM extensions to cover a terrain-shadowed route in the top left of the diagram, and a WAM coverage volume expansion for the regional airport routes in the bottom right. Edition Page 46 of 76

47 WAM mountain surveillance region. WAM extension to cover surveillance of ex-procedural regional airport routes with a new coverage volume (and WAM central processor) International airport (associated SIDs and STARs marked in red) Existing MLAT (A- SMGCS) coverage volume (yellow) Existing WAM coverage volume SSR coverage volume (blue) Regional airport (associated SIDs and STARs marked in blue) WAM extension of existing coverage volume to cover surveillance of regional airport routes Full integration with existing WAM coverage volume Figure 11: Schematic representation of a potential WAM system expansion. G.4 WAM impact analysis An assessment of how the proposed new WAM application will impact on the existing surveillance environment including where gaps in surveillance coverage either currently exist or will be created should be made following the planning assessment. This process will need to take into account the impact of decommissioning those surveillance feeds that will be replaced by the installation of a WAM system. This analysis should then be developed to identify the location of the areas into which the WAM system s initial deployment could be extended to provide gap filling surveillance. For each area identified as a location for the implementation of an extended multilateration network, an initial feasibility study should be performed. This will need to take into account the degree of the potential need for the surveillance service and the capability of the environment to support the necessary infrastructure. The following aspects should be taken into consideration at an early stage; What applications will the extended multilateration surveillance volume support? In particular what are the redundancy requirements following from this; and; Is such redundancy provided by operational SSRs or PSRs and, if so, when will they be decommissioned? How could the extended WAM system be decomposed into sub-volumes of service coverage such that if it suffers a receiver failure, coverage will only be degraded in a particular sub-volume rather than across the entire WAM network? Such a design consideration is particularly important when contemplating WAM network expansion as the probability of complete system outage will increase with the size of the system s network (e.g. is risk of a total system loss increased by placing more receivers into it should a separate FPDS tracker system be used?). Edition Page 47 of 76

48 By ensuring that the system s design will localise the effects of a single failure within it, the ANSP, following a failure in the WAM network, is able to keep unaffected areas of airspace open and fully functional. As such this modular design structure represents a safety barrier to WAM surveillance degradation. These fallback areas should be designed so that the ATCO can safely transition to them following a sudden and continuous loss of coverage. A summary study of the procedures and training needed to support the safe operation/transition to these fallback modes will need to be performed. The system design to offer this provision for fallback services should be assessed through computational simulations exploring impact of component failure within the newly extended WAM system. Alongside system design considerations, the procedures for the ATCO to adopt during coverage degradation will also have to be planned, defined and validated. An exploration of these issues should form the basis of an initial scoping study for each of the potential locations for WAM system expansion. These studies may be used to feed into such prioritisation work as cost-benefit analyses and other trade-off assessments for receiver siting and coverage planning for future system expansion. This work may also contribute towards the business case for the initial implementation of WAM. This background work will also contribute to the development of a functional and technical specification (FTS) for the extended WAM system that could be released as part of the ITT issued by the ANSP to extend its WAM system. In particular, this will detail the location and level of surveillance coverage that the extended WAM system will provide. This stage will precede supplier interviews at which point the details surrounding the potential agreements to be put in place between the supplier and the ANSP should be discussed. It is particularly important that when considering a WAM network expansion, the design of the surveillance system in question is tailored so that it does not introduce additional risk into the system. For instance, the mere extension by the addition of receivers to the architecture without careful system design will heighten the overall risk of receiver failure leading to coverage outage. Therefore, the design of the system s expansion will have to be node based; i.e. that a given set of receivers will be served by a bespoke central processor and that its surveillance feed will be routed directly into the tracker. These considerations may raise issues surrounding the interoperability requirements for the sensors in order to ensure that the surveillance performance is contiguous. This will be especially relevant if a different equipment supplier is chosen from that one that supplied the original system. ASTERIX categories 019 and 020 [ref 10] and [ref 12] may ensure some level of interoperability, but work is still ongoing on a category to ensure interoperability of data between two ground sensor units from different manufacturers (Cat 024). Edition Page 48 of 76

49 H Assessing the WAM communications links H.1 Purpose WAM depends upon reliable communication links between the receivers and the central processor. The selection of the correct communications media is crucial and has proven to be a significant cost driver over the lifetime of the WAM system. This guidance note addresses the most important issues to an ANSP when selecting and procuring the communications system: the type of information that should constitute the pre-tender documentation; whether a third party service provider should be used and what the important considerations are in this respect; and where the responsibilities and liabilities reside. H.2 Considerations at the design stage The pre-tender documentation should provide a functional outline of the proposed system, (including options for distributed or common clock systems) and what requirements this places upon the types of communication link used. In particular it should specify quantitatively parameters defined in H.2.1 below. An introduction to the types of requirements and types of communication media likely to be proposed is presented here. H.2.1 Function and requirements The accuracy of the WAM system hinges on the ability of its communication links to reliably provide the central processor with airborne transmissions. These may be time stamped digital signals (in a distributed clock system) or analogue transmissions of the detected broadcast. Although this is the principal function of the WAM communication network an ancillary requirement is for it to carry messages from the central unit back out to the nodes. These latter communications will primarily be concerned with performance testing (e.g. through the use of a reference transponder) and sensor health monitoring. Therefore requirements for the communications link include: high availability; provide two-way communications; has a given bandwidth of x (which ultimately depends upon the traffic density in the coverage zone i.e. the number of messages it will have to carry); with y delay characterises (typically between 2 and 4 seconds so that the overall age of the data items at the screen is below that set by surveillance performance standards); z rate of packet loss (such that it offers a safety critical level of assurance that the messages it carries will be of a given integrity). These requirements will need to be fully verifiable, requiring testing using a test signal generator, flight trials and appropriate analysis at the time of system installation (i.e. before commencing operations). H.2.2 Common vs. Distributed clock Common clock: time delay must be largely deterministic. In a distributed clock system the local time stamping at the receiver sites means that variance in transmission delay is acceptable. Edition Page 49 of 76

50 The need for communication delays to be accurately known in a common clock system places stringent requirements on the type of communication link that can be used. To avoid introducing random delays at the receiver site the transmission received at the sensor is communicated to the central processor in analogue format. Typically a single-hop microwave link is used, or a dedicated optical fibre is laid between sites. The route the message took to be relayed from the sensor to the central processor (this may depend upon level of traffic congestion across the network); and; A knowledge of the duration of delay associated with the various routes through the network (established through rigorous calibration). Distributed clock: systems offer greater flexibility in the type of communications link that can be used because knowledge of the latency inherent in the link is not as critical as with common clock systems. Nevertheless the surveillance message (along with its time of arrival at the receiver) still needs to be communicated to the central processor within a set amount of delay. Furthermore because the signal can now be digitised any digital or analogue communications link can be used. Examples of digital links used include VSAT and a PSTN (Public Switch Telephone Network). However in this type of system the distributed clocks require synchronisation various mechanisms could be used to achieve this including: An operator can typically assess the costs it will incur in establishing a WAM communications network by using mathematical tools to explore options for receiver siting. For example, these could examine ways of providing surveillance within a given volume while maintaining a line of sight between the receivers (thereby facilitating the use of microwave links). H.3 Introduction to technical options It is necessary for WAM communication links to be broadcast on a frequency that will not cause interference with transmissions that either interrogate or emanate from airborne transponders. This requirement mitigates the potential of WAM systems to pollute airspace already congested by R/F transmissions. Although the magnitude of this problem is specific to the local environment, such considerations as these restrict the technical options available to procurers for establishing WAM communication links. The following set of descriptions provides an outline to the different types of communications links that have been used to network WAM system receivers. H.3.1 VSAT This is a digital link where the signal travels from a very small aperture terminal (VSAT) at the remote WAM receiver site via a geostationary satellite either to a ground station (and then via a telecommunications line to the central hub) or to a second VSAT terminal at the hub. H.3.2 Telecommunication line A telecommunications link can act as a medium for WAM communications by carrying either an analogue or digital signal. Public networks may consist of: A PSTN (Public Switched Telephone Network) carrying analogue signals A PSDN (Public Switch Digital Network) carry digital signals (packetized data) However, normal practice is for all analogue traffic to be digitised and transferred the only true analogue lines are copper pairs linking sites directly, which are rare and not normally offered by telecommunications companies. Thus PSTN lines are not thought to be valid for WAM. A PSDN network packet switches data using copper wires. Redundancy in this system is secured by using dual switch nodes. Edition Page 50 of 76

51 A variable amount of delay is associated with the complex process of packet switching in a PSDN line. However as the type of digital messages being communicated across a PSDN line from the remote receivers would be carrying the time-stamped messaged of a distributed clock system a knowledge of the precise duration of this delay is not critical. If the public telecommunications network is used a safety of life service level agreement between the ANSP and the telecommunication provider must be established. Typically these type of agreements support dual (i.e. redundant) lines being leased from the telecommunication company so that it is possible for two lines to both to be committed to relaying WAM system messages at any time. This SLA must be clear and unambiguous, particularly relating to whether it is the responsibility of the telecommunications provider or the ANSP to lay the line. In particular if the ANSP is not content that the agreement negotiated with the third party communications provider meets its requirements (particularly in relation to safety considerations) then it must examine other technology options. H.3.3 Microwave Single hop link line of sight microwave links have been used to relay analogue messages between WAM receiver sites and the central processor and as such have been used to support common clock WAM systems. H.3.4 Optical fibre Optical fibres have been used to establish dedicated links between WAM receivers. The signals they transmit are analogue in nature and so are used to support common clock WAM systems. H.4 Making the choice The table below details the advantages and disadvantages of the various types of communication link described above. Note that for the costs involved, there may be a trade-off necessary between initial Capital Expenditure and ongoing Operational Expenditure. For example microwave links have high CapEx and relatively low OpEx. VSAT entails much lower CapEx, but high OpEx. Link Disadvantages Advantages Relative cost VSAT Potentially suffers from a relatively long delay period (the signal has to travel the great distance from the receiver to the satellite and then from the satellite back down to the central processor). Highly reliable link, does not require ground infrastructure or a line of sight Very high (ongoing high Opex Operational Expenditure) Signal often suffers from timing jitter. Introduces an ongoing cost in the rental of the data line. It has excellent level of integrity, accuracy and availability. Edition Page 51 of 76

52 Telecommunication line Requires an appropriate service level agreement to be established between the ANSP and the telecommunications company to ensure sufficient bandwidth and redundancy is built into the link to provide high integrity and availability. This agreement will need to convince the regulator (NSA) that it is of sufficiently quality and clarity to ensure the required level of service support. Relatively fast link (delay of order of milliseconds) Medium The laying of the line can prove to be a high Capex, with ongoing Opex Requires the route of the redundant link to be physically separated from the principle communication channel. Introduces an ongoing cost in the rental of the data line. Suffers from delay inherent in gates in the telecommunications network which can confuse central processor (by causing an echoing of signal). Hard cable laying is costly (and vulnerable) over large distances. Microwave Requires line of sight between emitter and receiver sites and so careful siting of receivers. A high Capex (Capital Expenditure) is associated with establishing the link Relatively fast link. Reliable link High Optical fibre R/F transmissions (used to synchronise the clocks of distributed WAM systems) Requires the redundant link to be physically separated from the principal communication channel. Hard cable laying is costly (and vulnerable) over large distances. Optical fibres cannot have large kinks in them. A high Capex is associated with establishing the link A line of sight is needed between the transponder and the receiver aerials. This requirement means the receivers in such architecture are often mounted on high towers. It is possible to use multiple synchronisation transponders as long as these can all be linked together with a common timing system. A major challenge faced by these communication systems is their potential to pollute airspace already congested by R/F transmissions. The magnitude of this problem is specific to the local environment and it may preclude the use of R/F as a communications link. Relatively fast link. Reliable link This architecture has been found to work well in systems that have their receivers monitoring relatively flat regions (e.g. oceanic areas) where the sensors are distributed over relatively small distances (such as along a coastline). Table 4: Advantages and disadvantages of various WAM communication links Medium (primary cost is installation of cabling) Low (relatively inexpensive equipment and ongoing maintenance costs) Edition Page 52 of 76

53 H.5 The use of a third party The use of a third party communications service provider has been mentioned as part of the technical options listed above. This is because some technical options lend themselves more readily to operation by a third party particularly in instances where they own and run the network over which the communication will be transmitted (e.g. telecommunications companies). When an ANSP decides to use a third party to provide a service WAM system it must assure itself that: The appropriate Service Level Agreements can be established to support a safety of life service The responsibilities and liabilities reside in the correct place and are traceable Both of these points will be captured in the system safety case for the WAM system ideally in a section dedicated to the safety management organisational structure and accountabilities. This should name individuals in the ANSP, the NSA and the third party who are directly responsible for the provision of a SLA, in particular who is responsible for: Monitoring the performance of the communication system Reporting a fault and to whom (i.e. what are the contact details of the third party providing the link) and; Issuing a response to a reported fault (i.e. dispatching and overseeing the efforts of a maintenance team). Evidence supporting the competence of the members of staff to whom the responsibilities have been accorded should also be compiled. For example this section could list the dates of training courses attended by all parties in which responses to failures have been rehearsed. The third party should be required to document communication link failures reported to them and as part of the pre-qualification to tender and to be able to produce this information within a given number of working days. Edition Page 53 of 76

54 I Guidance on the re-use of the EUROCONTROL Generic WAM Safety Assessment I.1 Purpose This note has been written to provide guidance on how, to best suit their own needs, local implementers should approach the re-use of the WAM safety material produced by EUROCONTROL. In particular it is aimed at those individuals within ANSPs who will hold overall responsibility for the production of their own WAM system safety cases. It describes the WAM safety material and how it is organised, and suggests how each section may contribute to preparation of a specific safety case for a local implementation. I.2 Context Aim of a Safety Case. A safety case enables system implementers to assure themselves and their regulators that the system being assessed will deliver an acceptable level of safety throughout its lifetime. EUROCONTROL has developed a Safety Case Development Manual (SCDM) [ref 24] which provides guidance on the overall structure and content of a Safety Case. WAM Safety Case EUROCONTROL has also developed a document Generic Safety Assessment for ATC Surveillance using Wide Area Multilateration. [Ref 1, 2, 3] The objectives of that document are to: show that WAM can in principle be a safe source of data for the provision of an ATC (vectoring, monitoring and separation) service in terminal and en-route airspace, provide guidance to ANSPs to help them complete their own safety case; help ensure a consistent approach to the content of WAM safety cases across Europe. The latter two objectives are the subject of this Guidance Note. Guidance is provided through development of example material in the WAM Safety document, which is structured in 2 volumes. Volume 1 summarises the overall assessment with emphasis on the success case ; volume 2 provides a detailed example of the development of a failure case. The document as a whole follows the approach described in SCDM and the EUROCONTROL Safety Assessment Methodology [ref 7]. I.3 WAM Safety Material I.3.1 Overall content The WAM Safety document provides: A high-level safety argument that ANSPs can re-use in their own safety cases. The remainder of the document is structured according to this safety argument, with each new section addressing a new sub-argument; A generic Operational Services and Environment Description (OSED) which ANSPs can tailor to their local conditions; A functional model of an example minimal WAM sub-system; A justification that the WAM concept is safe in principle, which is itself based on two arguments: Edition Page 54 of 76

55 o Evidence that when operating according to specification (the success case ) WAM performance can meet or exceed the performance of conventional Monopulse Secondary Surveillance Radar (MSSR), known as the reference sub-system. (See also Guidance Note E) o An analysis to ensure that the safety risks in the example WAM sub-system operating in the generic OSED are understood and acceptable (the failure case ). This includes a generic Functional Hazard Analysis (FHA) and an example Preliminary System Safety Assessment (PSSA) of the example WAM sub-system. Both FHA and PSSA can be re-used as the basis for the specific FHA or PSSA that may be developed by ANSPs implementing their own WAM sub-systems. The emphasis of this Guidance Note is on this element of the Safety Case. Guidance on how to satisfy the rest of the safety argument. A summary of the assumptions used and example Safety Requirements developed from applying the SCDM and SAM guidance. I.3.2 Safety Argument This is a framework to which other elements of the safety assessment relate. It provides a logical argument that the system considered and its operation in the defined environment will be safe if certain assumptions are met and evidence is documented. The SCDM elaborates how a Safety Argument should be developed and used as well as the various types of evidence that are required to support it. The overall WAM safety argument is decomposed into Argument 1, that considers whether WAM is acceptable safe in principle (truly a generic argument, expanded below), and other Arguments that look at aspects of the local implementation. Figure 12 below shows the overall argument diagram. Figure 12: Overall WAM Safety Argument Edition Page 55 of 76

56 Arguments 2, 3, 4 and 5 are specific to the local implementation and not covered by the WAM Generic Safety document, other than in a limited section of guidance to implementers. The other cover many of the aspects of local implementation, in particular Notes D (operational impact), J (failure modes) and L (technical impact). I.3.3 Operational Service and Environment Description (OSED). An example OSED is provided that describes an ATC service incorporating vectoring, monitoring and separation together with a generic environment. Both the operational application description and the environment description are drawn from ICAO documentation such as PANS-ATM [ref 15] and PANS-OPS [ref 14]. The ANSP specific environment will in general differ in detail from the generic description. These differences must be accurately described because they affect the details of the subsequent analysis. For example, the traffic scenario may differ and there may be various local procedures to take account of local operating conditions and which may be mitigations to operational situations that can arise. In particular, all assumptions must be clearly stated. Examples are given in the WAM Generic document. I.3.4 Functional Hazard Assessment (FHA). An example FHA is provided for the ATC service in the generic environment. The FHA is the starting point of the failure analysis. It describes hazardous situations that can occur at the Controller Working Position (CWP) which may lead to an unsafe situation typically loss or corruption of the basic surveillance information needed to provide the air traffic services. The assessed severity of such hazards is an operational judgement, taken in the context of the local environment, procedures, mitigations and traffic levels. The EUROCONTROL Safety Assessment Methodology [ref 7] provides guidance on how the hazards should be classified. Quantified safety objectives must then be developed. A fully worked numeric example is included in the WAM Generic Safety document. The FHA is the principal top down element of the failure analysis. Failure mode scenarios and mitigations are treated in more detail in a Guidance Note J. I.3.5 Preliminary System Safety Analysis (PSSA). An example PSSA is provided for the assessed minimal 4 WAM sub-system. The PSSA depends on the particular WAM system architecture used. For the purposes of the example, a particular architecture is assumed and described. The example PSSA then shows how quantitative Safety Requirements (SRs) for each element of the WAM sub-system may be derived. However, these SRs cannot be taken into any other specific assessment, because they are specific to the example. The PSSA process in full requires the development of fault trees and their analysis (for which many automated software tools are available) as well the inclusion of detailed bottom up sub-system or component level performance characteristics. Manufacturer expertise and knowledge is essential for WAM elements performance figures; ANSP knowledge must provide the equivalent data for the non-wam elements. 4 The example WAM sub-system analysed is minimal in particular this refers to non-redundancy of receivers, so that if one receiver fails, there is not enough information to form a position estimate. It is important to note that no operational system would be designed and installed in such a minimal manner. The minimal approach was taken specifically to highlight the importance of multiple coverage of the entire volume of airspace for which the specified performance is required to support the operational service. This aspect is examined further in Guidance Note F on coverage planning. Edition Page 56 of 76

57 Further, in any actual implementation, allocation of requirements to individual components may be different by different manufacturers as well as being constrained by the non-wam elements of the ATC system, within the framework of which the WAM system must operate. The PSSA therefore forms the principal bottom up element of the failure analysis. Specific integration considerations are developed further in Guidance Note L. I.3.6 System Safety Analysis (SSA). A SSA is not provided in the WAM Generic Safety document, because it is both very implementation specific and would require the understanding and consideration of too many assumptions to be a useful example. I.4 Caveats It should be stressed that the assumptions, objectives, requirements and mitigations mentioned above will have to be cross-checked individually to the proposed operating environment for each local implementation to which they are applied. This will initially involve a top-down assessment of the safety objectives themselves to assess if their stringency is set at the required level. From a bottom up perspective the functional architecture differences between the WAM surveillance system and radar will again require careful consideration and re-work when proposed mitigation options are being explored. The conclusions drawn from a safety case hinge on the correctness of the assumptions and calculations made. Thus safety requirements and fault trees re-working to reflect the availability of WAM system components (i.e. the potential basic causes of WAM system failure). If this step is not taken (or the assumptions themselves are not sufficiently maintained to reflect the current status/environment of the system) the safety case as a mechanism for proving the safety of the system is null and void. Furthermore it should be noted that the EUROCONTROL generic safety assessment does not include a System Safety Assessment (SSA) which may only be performed once the system is in operation. The SSA principally seeks to validate the assumptions made in the PSSA using additional information about the system implementation and surrounding environment. It is for these reasons recommended that the generic safety assessment is used only as a contributory reference document in support of the completion of a local safety case. This is the case even when the generic safety case is used as a template to structure the layout of the local safety case. Throughout the generic safety assessment the reader is prompted for points at which differences between the generic and specific case should be considered. Edition Page 57 of 76

58 J Failure mode scenarios; potential mitigations and practices J.1 Purpose This guidance note describes the potential failure modes of a WAM system, and the mitigations that could be implemented to reduce their impact. Although the probability of their occurrence is largely dependent on the local implementation, the underlying failures are common to all WAM systems. It should be noted that the failure modes outside the ground WAM system (e.g. aircraft transponder failure) are not discussed here; for the aircraft transponder and data sources, the situation can be considered to be similar to the SSR scenario. J.2 Why is WAM different? Although WAM is an independent cooperative surveillance source, like SSR, the failure modes arising from its use are unique to this technology; the mitigations applied to these failures need to take account of the specific failure modes. WAM is a geographically dispersed surveillance system; it has multiple locations at which failure can occur, in particular with the sensors, interrogators or reference transponders and inter-site communications. Traditional radar (SSR and PSR) surveillance has, in comparison, a more centralised functional architecture. These differences mean that the surveillance service provided by WAM will degrade differently to radar following a failure. Patches in the coverage may appear and the service quality, under the failure mode, may not remain uniform across the volume. It is important for implementers to realise that contingency planning for WAM system unavailability should be embarked upon at an early stage in the design process to ensure partial system degradation can be safety managed. The guidance in section J.3 outlines why WAM surveillance is different from traditional radar feeds and what causes failures in such systems. Sections J.4 and J.5 go on to explain the types of mitigation that can be used at the operational and technical levels to reduce the impact of various failure scenarios. J.3 Failure in WAM systems The WAM service (at the input to the tracker, or other defined interface) can be degraded due to system failures or through planned maintenance activities (for example, a software upgrade in the central processor). This paper focuses on the unexpected system failures. The following levels of failure and their impact upon overall system surveillance performance can been defined. The surveillance system performance is defined in terms of availability i.e. what level of availability is required from the WAM system, and from the surveillance system overall? These figures will then determine the impact of the failure modes. The first two scenarios refer to failures in the ground sensors. Scenario 1 N-1: A redundant WAM system can suffer the failure of a single sensor without impacting upon the service it provides. It is therefore said to be built with a N- 1 architecture; i.e. that N, the number of sensors, can be reduced by one and the system can still provide the required availability. Scenario 2 N-x: This failure mode is defined as that which occurs after a WAM system of N receivers (sensors) experiences x failures, where x is typically >1. The functionality of the WAM service is degraded in a manner specific to the exact location of the failed sensors. It is assumed that the x failed receivers are close enough together to have a combined operational impact (i.e. they are within the same coverage volume). This scenario may encompass planned receiver outages, alongside other failed sensors. Such a failure could cause, for instance, an uneven degradation in the accuracy of the position information provided by the WAM system Edition Page 58 of 76

59 across a given coverage volume. This will impact WAM system availability, but in a mixed surveillance mode environment, may not have a material impact on surveillance system availability. Scenario 3 Major degradation of WAM service: A failure mode impacting several components in the WAM system, for example (and depending on the exact local implementation) the interrogation functionality or multiple sensors. This type of failure covers those cases where the level of surveillance coverage remaining is unknown subsequent to the failure. It therefore includes instances where receiver outage is not planned for and the consequence of that outage (e.g. on the position reports) is unknown. This failure is considered separately from the N-x case because it represents a significant cross-service volume failure that may prompt different mitigations than the N-x scenario. Scenario 4 No WAM service: This type of failure describes a case where no surveillance service is provided by the WAM system across the entirety of the WAM system s service volume. It should be noted that the performance characteristics of the redundant surveillance sensors in the service volume following the partial or complete failure of the WAM system will dictate the precise procedures used to control traffic in that volume. For example, it may be possible to maintain a full surveillance service if the performance of the WAM system degrades in a volume also monitored by SSR. In this case, the ANSP may decide to procure a WAM system with a lower availability (e.g. N receivers), and treat it as a single MSSR in a mixed surveillance mode environment. In a situation where PSR is the only surveillance feed providing information to the controller following the failure of a WAM system, data items will be lost from the Controller Working Position. Consequently, it is likely that significant mitigations will need to be imposed (as PSR will only provide degraded 2D positional information without identity). J.4 Mitigations in system design Known failure modes can largely be mitigated against at the system design stage through the inclusion of redundant components or sub-systems to increase the availability of the WAM system. This is particularly important when installing WAM in an airspace where frequent WAM service degradation is not tolerable from a risk point of view (e.g. a busy TMA). For example, the communication network between the dispersed elements of the WAM system could be provided by a single link or a redundant dual link. Such considerations are of particular importance to the dispersed nature of the WAM system as opposed to traditional single site surveillance techniques (e.g. SSR). The implementation chosen may well depend upon the requirements of the local environment; for example in the past it has not been possible to co-locate redundant receiver systems on oil rigs due to space constraints at the proposed site. The NSA may require redundant WAM receivers to be designed into the architecture if operational mitigations would add too much risk in the service volume (i.e. therefore technical mitigations must be used). J.5 Operational mitigations during failure scenarios The following guidance is concerned with the mitigations that could be put in place after the system has entered operation. Failures are principally considered as either loss or corruption of those data items presented at the CWP provided by the WAM surveillance feed. When architectures other than WAM sole means are in use, the failures may not actually manifest themselves at the CWP, but instead be detected through monitoring of the WAM surveillance s feed. When a failure mode Edition Page 59 of 76

60 is detected at the CWP itself, the controller will have to accommodate the loss of surveillance functionality through the use of revised procedures. Such procedures are designed to ensure that levels of safety are maintained during a degraded mode. The procedures employed during a WAM system failure will depend in part upon the nature of the local environment in the surveillance volume. The safety of such procedures will be dependent on the visibility and meteorological conditions, pilot certification and the navigation capability of the aircraft (e.g. its P-RNAV and VNAV equipage). These considerations would have to be assessed by the local ANSP and regulator on a case-by-case basis. It should be noted that the accurate completion of an FHA is required to identify the highest risks present in the system, thereby allowing the targeting of areas to which mitigations could be applied. Case study: Fall back modes of operation for AustroControl AustroControl have implemented a WAM system at Innsbruck. A further system is being deployed in the Vienna TMA. The potential fallback modes of operation in each case are quite different. In Innsbruck, a basic fallback plan of moving to procedural control is employed in the event of nearly all failure modes (the architecture is n-1). This entails a slightly reduced capacity, and removal of the surveillance picture for the controllers. In Vienna, although no final decision has been taken on the fallback modes to be used, it is likely that a single fallback mode of full procedural control will not be accepted. Vienna has other surveillance sources; nevertheless, if WAM were sole means, the traffic density is such that procedural control would bring too much risk and disbenefit in the form of reduced capacity. J.5.1 Scenario 1: N-1 An N-1 redundant WAM system will not have reduced availability after it suffers a single sensor failure (this is designed into the system). J.5.2 Scenario 2: (N-x) failure modes This type of failure mode could arise from the: x WAM sensors failing (where one of these failures could be due to a planned maintenance, but x>1) Receiver Central Processor datalinks failing; or distributed WAM clock providing an incorrect time-stamp (e.g. through incorrect timing synchronisation in a very local environment); Impact: Reduction in surveillance service provided by the WAM system covering certain sections of the coverage volume. This may be a loss of information, or in certain cases, an undetectable corruption of aircraft information (for example, position or track). Notes: The surveillance coverage volume may remain intact following the failure of x WAM receivers; however, the accuracy or integrity of the position reports may be degraded. This results in a lower availability of the WAM system. The particular impact will be dependent upon the nature of the local service environment (captured in the OSED). For instance the potential risks involved will be very different if the WAM network provides surveillance for high density TMA environment compared to if it was used for the provision of a traffic advisory service. Edition Page 60 of 76

61 In the situation where failures produce a WAM system operating with N-x receivers, it is expected that the ANSP will initiate recovery plans to re-establish a fully functional N or N-1 system immediately. It may be possible to maintain some form of operational service in this case. Mitigations: The operational mitigations can be split into strategic planning and tactical control. Strategic planning: Decompose WAM service volume into several sub-volumes, such that individual sub-volumes can be closed if WAM performance degrades within that sub-volume Physical dimensions and locations of provisional sub-volumes to be invoked in the event of receiver unavailability are dictated by location of receivers and communication links on the ground; In order for these to be established, the impact of a particular receivers unavailability must have been explored through mathematical simulations and the operability of proposed fall-back sectors validated using flight trials flown under the failure mode. The likelihood of an outage should be consistent across the geographic areas as such their definition will also necessitate analysis of the system s architecture (e.g. the placing of dual communication channels [and their physical separation] within the system); Implement procedures for creating de-conflicting routes within a degraded WAM service volume, such as adopting procedural control and imposing flow restrictions. A pictorial representation of this is provided in Figure 13. The procedures to be used must have been planned in advance by the Air Traffic Managers/Controllers responsible for section of airspace under WAM surveillance. Figure 13: Representation of the impact of coverage degradation upon traffic flow Edition Page 61 of 76