Transponders in aviation - Eurocontrol

May 2014 l N°19

NETALERT - the Safety Nets newsletter

WELCOME Transponders in aviation

For the past two years EUROCONTROL’s
Safety Improvement Sub-Group
(SISG) has been working on its Top 5
ATM Operational Safety Priorities.
One of these is the risk of operations
without a transponder or with a
dysfunctional one.

This was the chosen focus for this Transponders play an important role in tracking an aircraft.They provide a vital link between aircraft
edition of NETALERT at our editorial and the ATC systems on the ground, as well as ACAS/TCAS in the air. Conversely, an inoperative
planning meeting early this year. Our transponder,or one providing erroneous information,poses a potential safety risk.You can read more
intention was to explain how despite about faulty or non-functioning transponders elsewhere in this issue. Here we go back to basics to
advances in technology and safety, provide a brief recap of transponders and their role in aviation.
the dependence of the ATM system
on an aircraft’s transponder means a Transponders are... Transponders are not just carried by
failure has the potential to make it A transponder is an avionic system commercial aircraft they are also used
blind to both ATC and safety nets, located on board the aircraft that provides by helicopters, military aircraft, General
including TCAS. Events have overtaken information about the aircraft identification Aviation, gliders and UAS. Some airside
us. In the intervening weeks the and barometric altitude to the ATC system ground vehicles are also equipped with
transponder on Malaysian Airlines on the ground and to TCAS on other transponders.
flight MH370 stopped working for the aircraft. The reply from the transponder
reasons yet to be explained, is also used by radar on the ground to Uses in aviation
emphasising the importance of this determine the position of the aircraft. The Information from the aircraft transponder
topic both to those working in information to the ground is provided in is used to provide the controller with
aviation and to the general public. response to an interrogation by systems a more complete surveillance picture
such as secondary surveillance radar (SSR) or compared to primary radar. The displayed
In this edition we recap the role of multilateration systems. ADS-B (Automatic barometric altitude is taken directly from
transponders in aviation and Dependent Surveillance – Broadcast) the information provided by the aircraft’s
summarise the impacts, methods of capable transponders also allow the aircraft transponder whereas the identification
detection, actions and mitigations for to ‘broadcast’ information to ground stations information provided by the transponder
a total loss of transponder and other and other aircraft without interrogation. is used to correlate the aircraft track to its
transponder failure modes. We also
present findings from a real-life
incident.

CONTENTS
1/2/3 Transponders in aviation
3/4 No transponder what now?
5 Flying without a transponder - 10 minutes is all it can take
6/7 Transponder failure is not always total
8/9 SESAR update
9 Also in SESAR - SESAR airport SNET trials at Milan Malpensa

Transponders in aviation

continued

flight plan. The latter can also be used to How do transponders work?
feed controller tools such as AMAN, MTCD Transponder operations are standardised in ICAO Annex 10 Volume IV. First the ground
and various conformance monitoring tools. interrogator (or in the case of TCAS the airborne interrogator) transmits an interrogation
With the evolution of Mode S transponders, sequence on 1030MHz (either continuously to all aircraft in the vicinity for Mode A/C or
the ATC system can now downlink other selectively to a single aircraft for Mode S). Upon receipt, the transponder on-board the aircraft
aircraft parameters (known as Downlink immediately responds on 1090MHz. Once the return signal is received by the ground station,
Airborne Parameters, DAPs). For example, the data is processed and relayed on to the controller’s display/used by tools and safety nets.
the selected altitude set by the crew can
be used both to alert ATC if there has been Interrogation (1030MHz)
any misinterpretation of the altitude/level
clearance and to improve STCA alerting Equipped with
performance. a transponder

TCAS also relies on transponder signals to Reply (1090MHz)
detect potential conflicts and provide Traffic Containing Mode A/C
Advisories (TAs) and Resolutions Advisories
(RAs) to the pilot. Where both aircraft are or Mode S data
equipped with Mode S transponders (see
‘different modes’ below) TCAS is capable of Ground ATCO screen
co-ordinating RAs between both aircraft to interrogator ■ Aircraft ID
ensure safe conflict avoidance manoeuvres. ■ Altitude
If not coordinated there is a significant risk of ■ Select flight level
selecting incompatible RAs that increase the ■ Etc
risk of collision.
Select) interrogations of each specific aircraft. designated airspace. These local mandates
Different modes ‘All call’ interrogations are also made to have been supplemented by a European
In civil aviation there are two main identify new aircraft to be interrogated. Mode wide regulation. The current regulation
interrogation-reply modes, Mode A/C and S also has the ability to transmit DAPs. Mode S stipulates that all aircraft operating IFR/GAT
Mode S. There are also modes operated by transponders are backward compatible with in Europe are to be compliant with Mode S
the military. the older Mode A/C radars. Typically Mode Elementary Surveillance by January 2015 and
S radars will be backward compatible with December 2017 for new and retrofit aircraft
In response to Mode A interrogations the Mode A/C transponders, but this depends respectively. Within the same timescales,
transponder transmits an identity code for on local implementation. aircraft with a minimum take-off mass greater
the aircraft in the octal range 0000-7777, than 5,700 kg and/or with a maximum
with some codes allocated to transmit Deployment and carriage requirements cruising true air speed greater than 250
specific emergency situations. Mode C Mode A/C transponders and secondary knots are required to be compliant with
provides the aircraft’s barometric altitude surveillances radars were a mainstay of air Mode S Enhanced Surveillance (EHS) and,
in 100 feet increments. Mode A/C operation traffic control for many decades. However, through the carriage and operation of an
has a number of technical limitations such with these systems reaching the limit of their extended squitter transponder, with “ADS-B
as its inefficient use of the radio spectrum operational capability there has been a shift Out” requirements in support of ground
and the limited number of Mode A codes to Mode S. and airborne surveillance applications. Early
available. discussions are now taking place with regards
On the ground, many SSR Mode S systems to extending the applicability of EHS so as to
Mode S was developed to overcome the are deployed and operational across the increase the opportunities for rationalisation
limitations of Mode A/C. In particular, core European area and beyond. In Europe of the surveillance infrastructure on the
Mode S has over 17 million unique 24-bit they are a mix of Elementary and Enhanced ground.
aircraft addresses, altitude reports in 25 feet Surveillance. In the air Mode S transponder
increments and “selective interrogation”. equipage is now mandatory for flights The future
Unlike traditional Secondary Surveillance conducted as IFR/GAT in many European Several initiatives are underway which will
Radar (SSR) stations which elicit multiple States and also for VFR flights in some see continued reliance on transponders in
replies containing the same information from
all aircraft within their range, Mode S makes
selective (Mode S is abbreviated from Mode

NETALERT Newsletter May 2014 2

Transponders in aviation

continued

the future. This includes the increased use receivers. There is also an impetus to increase Transponder failure
of ADS-B for surveillance in low density the number of transponder-equipped aircraft, Now the obvious question. With so much
and remote regions, as well as oceanic for example by using low power, low cost reliance on aircraft transponders, what happens
surveillance - potentially by transponders transponders e.g. for gliders. when one fails, is switched off or provides
broadcasting data to satellite-based ADS-B erroneous data? To find out, read on…

Further reading
• PANS-ATM Doc 4444, Chapter 8.5 - SSR Code Management
• PANS-OPS Doc 8168, Flight Procedures Part VIII - Secondary Surveillance Radar (SSR) Transponder Operating Procedures
• Surveillance Activities within EUROCONTROL: http://www.eurocontrol.int/articles/surveillance

No transponder

- what now?

The total failure, of an aircraft’s transponder on this subject. In recent months there system on the Embraer did not detect the
has the potential to make it effectively invisible have been two known examples of aircraft B737, and the B737’s TCAS could not detect
to ATC. It also renders safety nets, including returning to major European hubs due to the Embraer. Consequently the aircraft
those in the cockpit, ineffectual. Below complete transponder failure. So while not tragically collided.
EUROCONTROL’s Stanislaw Drozdowski answers everyday occurrences, it’s not unheard of in
questions on possible impacts, methods of Europe. What are the impacts of a total loss of
detection and potential mitigations. transponder on the controller?
Isn’t there a back-up transponder on the As I said at the start, all altitude and
What happens when a transponder fails? aircraft and a warning given to the crew identification information is lost, and the
The total loss of a transponder for an aircraft in the event of a failure? track as well, if no primary radar is present
in flight results in no transponder based data The number of transponders depends – effectively making the aircraft invisible
for an aircraft (identification and altitude) on the size of the aircraft, but modern to the controller. This results in an increase
being presented on the controller working passenger aircraft will typically carry two. in workload due to loss of situational
position (CWP). This means that altitude One is operating and the other is a back-up. awareness, reliance on procedural control/
information is lost. If primary radar is present Both are fed by separate altimeters, with the voice reporting and a severely reduced
the track may remain correlated with a active transponder typically being fed by the ability to provide tactical instructions –
flight plan, or the controller can manually altimeter used by the pilot flying the aircraft. including issuing instructions for collision
perform the correlation. If no primary radar avoidance. Even if primary radar is available,
is present, the track (position) is lost as well. There may be a warning to crew in the altitude and, possibly, identification will be
This affects controller tools and safety nets case of a transponder failure, but it won’t lost so there will also be workload impacts
used by both pilots and controllers which necessarily be prominent and may go in this situation as well.
rely upon transponder data. unnoticed, or there may even be no warning
at all. For example, in 2006 an Embraer Is the controller given a warning that
How common is complete transponder business jet was cruising towards a B737 all information relating to an aircraft
failure? at the same flight level over Brazil. The has disappeared? If not, how is the loss
Thankfully, complete failure is rare. However, transponder of the Embraer had for some detected?
a number of ANSPs were able to contribute reason stopped working and the crew was It’s not possible to generalise. Some
real-life examples of transponder failure to not aware of this. As TCAS does not function ATC systems include a loss of track alert
a EUROCONTROL Operational Safety Study if the transponder does not work, the TCAS functionality, but it depends on the system

3 NETALERT Newsletter May 2014

No transponder - what now?

continued

and local implementation. In the absence to the controller. The colour of the track or be invisible to these and other safety nets (as
of this, it’s down to the controller to identify the track symbol changes to indicate that in the earlier example involving the Embraer
a failure through situational awareness, there is no radar data behind the track. This business jet and the B737).
regularly scanning the screen, or during serves as a warning to the controller that
handover between sectors when the the radar data has been lost. However, the Given the potentially hazardous
aircraft contacts ATC but the controller can’t accuracy of the position information will consequences of the total loss of a
identify it on the screen. Total failures can decrease over time and has to be manually transponder, are there failsafe
quickly become apparent if there is only one adjusted using reports from the pilot. mitigations?
aircraft in the sector, but may be much more Despite all the advances in systems and
difficult to detect when multiple aircraft are Will controller tools or STCA and TCAS safety, there is no system-wide back-up
in the sector (see next article). This means be affected? for information derived from the aircraft
total failures may sometimes go unnoticed Controller tools using transponder based transponder, and therefore there are no
for a period of time and their potential information will either not operate (i.e. fail-safe mitigations. Given this, it is not
consequences can be critical, hence their those using real-time information such as surprising that our studies show the most
inclusion in the Top 5 ATM Operational conformance or adherence monitoring effective mitigations to be an ability to
Safety Priorities. The irony is that in previous tools) or will become less reliable. quickly detect a total transponder failure
decades transponder failures were more and effective procedures for dealing with
frequent and controllers were regularly Safety nets such as STCA and TCAS rely on it. There are technical mitigations, such as
expecting them. With failures less frequent transponder replies. Therefore, without an using flight plan data, but these are system
today, it’s not something that tends to be active transponder, an aircraft will effectively and implementation specific.
expected.
ICAO Doc 4444, PANS-ATM, section 8.8.3.3, aircraft transponder failure in areas
What does a controller do on detection? where the carriage of a functioning transponder is mandatory
Are there standard procedures?
PANS-ATM provides some guidance but no When an aircraft experiencing transponder in certain traffic situations, either in terminal
specific procedures, these tend to be ANSP failure after departure is operating or areas or en-route, continuation of the flight
-specific. If primary radar is available, flight expected to operate in an area where the may not be possible, particularly when
plan correlation should be maintained, carriage of a functioning transponder with failure is detected shortly after take-off.
however the availability of primary radar specified capabilities is mandatory, the The aircraft may then be required to return
varies between States. In the absence of ATC units concerned should endeavour to the departure aerodrome or to land
primary radar, steps taken can range from to provide for continuation of the flight to at the nearest suitable aerodrome that is
voice reporting by the pilot to enable the aerodrome of first intended landing in acceptable to the operator concerned and
procedural control by the ATCO, to military accordance with the flight plan. However, to ATC.
escort, or in extremis refusing the aircraft
entry to the next sector/FIR or returning the EUROCONTROL Top 5 ATM Operational Safety Priorities
aircraft to the airfield of departure/nearest
suitable airfield. The aircraft should also be The Top 5 were identified through workshops with ANSPs and the use of data from
cleared out of RVSM airspace and be kept high severity (classified as ‘A’ and ‘B’) incidents. This work focussed on two high priority
well clear of other aircraft. risk areas - runway incursions and loss of separation en-route. The priorities identified
(in no particular order) were:

Can flight plan data be used as an ■ Risk of operations without transponder or with a dysfunctional one
alternative? ■ Landing without clearance
Flight plan data is not as precise as radar- ■ Detection of occupied runway
derived tracks. It may be out of date, and ■ ‘Blind spot’ – inefficient conflict detection with the closest aircraft
requires updating automatically or manually ■ Conflict detection with adjacent sectors
to be of real value. However, if a track
associated with a flight plan is lost before the Each priority has undergone a dedicated Operational Safety Study to provide additional
end point of the flight plan, some systems insight on causal/contributory factors and identify mitigations, best practices and
continue to coast the track along the flight lessons learnt. They will also inform the development of SKYbrary materials.
plan route to give some increased awareness

Further reading
More information can be found at:http://publish.eurocontrol.int/sites/default/files/article/files/top5_factsheet_web.pdf

NETALERT Newsletter May 2014 4

Flying without a transponder

– 10 minutes is all it can take

What follows is a real-life example of the potential consequences of flying without an operational transponder. In March 2011, a Delta Airlines B757 took
off from Atlanta without its transponder being activated. A succession of mistakes by both the crew and ATC resulted in the aircraft flying undetected
for several minutes after departure. During this time it flew in a close horizontal proximity to three other aircraft. This article details the incident and
highlights the difficulty of identifying an aircraft without an operating transponder in busy airspace.

13:19 Summary of incident departures controller. However, due to the
large number of primary targets in the vicinity
Tower clears aircraft for take-off on RWY27R the departures controller could not positively
Aircraft departs without its transponder activated identify the aircraft. The departures controller
and his supervisor then conducted a search
13:20 Following take-off, tower instructs the crew to turn left to waypoint FUTBL in the general area of the aircraft’s departure
and contact the departures controller route but could not identify a potential target.
Crew reads back instruction correctly but does not contact the departures controller The aircraft was only identified when it called
Tower controller is distracted and does not verify the departing aircraft has a valid the tower controller. It was subsequently
radar label transferred to the departures controller who
asked the pilot to verify the transponder was
13:24 Departures controller realises there is an unaccounted flight strip for the aircraft turned on.
but cannot positively identify the flight on his display
Departures controller contacts tower and queries the situation Subsequent investigations identified that
Subsequent searches do not positively identify the aircraft during the time the aircraft was operating
without a transponder, and not under the
13:26 Aircraft contacts tower to request an update direct control of ATC, it was involved in three
Tower tells crew they should be in contact with departure separate losses of horizontal separation. The
minimum separation distances with other
13:27 Aircraft contacts departure aircraft were 1.44 miles, 0.81 miles and 2.36
Departures controller requests crew to state their position miles. This was concluded from the position
Departures controller requests crew to verify transponder is turned on of the primary radar track, hence it is not
After 6 seconds, crew replies that transponder is on possible to establish what vertical separation
existed at the time.
13:29 Radar contact is established and aircraft radar label appears on departure display
The incident, due to its seriousness, has
The departing aircraft was transferred from somewhere else and he did not notice been investigated by the US National
the tower controller to the departures this. Transportation Safety Board (NTSB). In its
controller without his knowledge and 3 Despite reading back the tower final report, the NTSB concluded that the
without an operational transponder. This controller’s instructions to contact the probable causes of the incident were: “The
happened for three reasons: departures controller, the pilot did not air traffic controllers’ failure to adhere to
do so. required radar identification procedures,
1 Prior to departure the crew did not which resulted in loss of separation between
activate the aircraft’s transponder. Five minutes after take-off the departures the departing Boeing 757 and three other
2 Before transferring to the departures controller realised he had a flight strip that airplanes. Contributing to the incident was
controller, the tower controller should was unaccounted for and called the tower. the pilots’ inadequate preflight checks,
have verified that the departing aircraft The tower controller and his coordinator which resulted in the airplane departing
displayed a valid radar label. However, both searched for the missing target on with an inoperative transponder.”
the tower controller’s attention their traffic situation display and reported
was temporarily drawn to a situation a possible primary radar target to the

Further reading
The full NTSB incident report (OPS11IA410) can be found at (http://www.ntsb.gov/aviationquery/brief.aspx?ev_id=20110324X53002)

5 NETALERT Newsletter May 2014

Transponder failure

is not always total

In addition to the total loss of a transponder, the EUROCONTROL Operational Safety Study also investigated a subset of other possible transponder failure
modes.The findings of this work are summarised in this article.

Failure modes investigated Possible impacts – display of the aircraft track to the controller
The failure modes investigated were
intermittent Mode C pressure altitudes, Intermittent Mode C Duplicated Mode S Corrupted Mode A
duplicated Mode S 24-bit addresses and 24-bit address
corrupted Mode A identification codes. ■ Complete loss of track ■ No discernable impact
For each, the investigations focussed upon (track dropped as system ■ Displayed correctly (e.g. correlation with the
transponder-based errors or detection considers it invalid) ■ Never initiated fight plan is made using
failures as opposed to ground system ■ Normal display of ■ Dropped (assumed to the 24-bit Mode S address)
processing failures: track, but with no altitude be a “ghost track”even if ■ No correlation with the
information in the label two valid flight plans exist) flight plan (e.g. where only
Intermittent Mode C: Transponder-based ■ Aircraft assumed to be ■ Swapped Mode A is used)
altitude information is lost from the at all heights in the system ■ Track swaps
controller working position (CWP) for short ■ Split tracks
periods of time.
Duplicated Mode S 24-bit address: Two Possible impacts – TCAS II
aircraft are operating with the same Mode
S 24-bit address in proximity to one another Intermittent Mode C Duplicated Mode S Corrupted Mode A
(e.g. within the same sector or adjoining 24-bit address
sectors). ■ Delayed, incorrect or ■ No impact (no reliance
Corrupted Mode A: Information received prematurely terminated ■ Missed alerts (intruders on Mode A)
at the CWP is incorrect, primarily due to an alert with the same Mode S
erroneous input into the transponder, or the address(es) as own are
processing and transmission of the Mode A ignored by TCAS II)
code by the transponder.

Possible impacts - display of the aircraft Possible impacts – ground-based safety nets
track to the controller
For each of the failure modes, how the Intermittent Mode C Duplicated Mode S Corrupted Mode A
associated aircraft track is displayed (or not) 24-bit address
to the controller will depend upon the local ■ Delayed or prematurely ■ False alerts due to split
configuration of the ATM system. Some terminated alert ■ Missed alerts due to the tracks or, for example, if the
examples are given in the table to the right. ■ Nuisance alerts due to track never being initiated corrupt code is one not
the ATM system thinking or dropped permitted in a certain
In turn, local system configuration will the aircraft is at all altitudes airspace volume
influence detection by the controller and ■ Missed alerts, for
the possible impacts. Some ATM systems example, if the corrupt
may have functions to warn the controller code is on a list of codes
of possible failures. For example, validation that do not alert against
functions highlighting: a loss of barometric each other or a protected
altitude, the track of one of the aircraft not volume of airspace
conforming to the flight plan route or that
no correlation has taken place. Additionally,
some modern ATC systems may address

NETALERT Newsletter May 2014 6

Transponder failure is not always total

continued

Filtering of duplicated Mode S addresses by TCAS II or false/nuisance alerts.Again,which impacts
occur will depend upon the local
Example 1: 'Own' and 'target' aircraft have Example 2:Two 'target' aircraft have the configuration of the ATM system.
the same 24-bit Mode S address same 24-bit Mode S address
Of interest are the mitigation choices faced
'Target' 'Target' 'Target' by the ANSP for dealing with intermittent
aircraft aircraft aircraft Mode C (e.g. due to the track not being
initiated or dropped). If the ground-based
'Own' 'Own' safety nets assume the aircraft to be at all
aircraft aircraft altitudes (see table on previous page) there
is the potential for nuisance alerts,particularly
TCAS on-board the 'own' aircraft TCAS on-board the 'own' aircraft filters in the case of MSAW. However, if the track is
filters out the 'target' aircraft out the further 'target' aircraft dropped or maintained without altitude
information, an alert may missed, generated
corrupted Mode A by using a weighted Also, TCAS II does not produce Resolution late or terminated early.
combination of aircraft identifications Advisories (RAs) against an aircraft that is
(primarily using Mode A code and Mode S equipped with a Mode A/C transponder but Solutions
24-bit address but also aircraft callsign) to does not provide altitude information (Mode As Helios Director Ben Stanley explains,
correlate a track. C). This aircraft will be tracked as a non- dealing with different transponder failure
altitude reporting target using range and modes requires several steps:“There is no single
Possible impacts – TCAS II bearing information, and will be shown on mitigation to deal with the different forms of
Duplicated Mode S 24-bit addresses and the TCAS traffic display without a data tag or transponder failure. Solutions start with the
intermittent Mode C will also have potential trend arrow associated with the traffic effective reporting of transponder anomalies,
impacts on TCAS II. Corrupted Mode A symbol. Traffic Advisories (TAs) can be including ensuring they are addressed.
codes will have no impact as TCAS II has no generated against non-altitude reporting
reliance on this information. aircraft when the range test for TA generation At the sharp end it’s about providing the
is satisfied (non-altitude reporting aircraft are controller with the necessary alerts and
Two TCAS II equipped aircraft will coordinate deemed to be at the same altitude as the procedures to quickly identify the malfunction
their RAs through the Mode S data link. So ‘own’ aircraft), but RAs are suppressed. and undertake any necessary action. This
that it does not alert against itself, an aircraft Therefore,if the altitude information from the could include alerts for any change in track
will ignore any duplicate Mode S addresses. threat aircraft is intermittent, it is possible status (e.g. loss of information, dropped track,
As per the diagram above, this has two that an RA could be generated late, not at all, change of identity etc.),transponder validation
possible impacts. Firstly, where the ‘own’ be of incorrect sense or terminated procedures on first contact, procedures in
and 'target' aircraft have the same Mode prematurely. the case of malfunctions (e.g. potentially
S address, TCAS II will not alert. Secondly, squawking 0000) and even co-ordination with
where two 'target' aircraft have the same Possible impacts – ground-based safety nets neighbouring sectors who may be able to see
Mode S address, the TCAS II on the ‘own’ For ground-based safety nets the impacts the aircraft correctly.
aircraft will only alert against the nearest relate to the potential for either missed alerts,
threat aircraft and filter the furthest. prematurely terminated, late initiating alerts At the system design stage there is also a need
to consider both how the system deals with
Duplicate Mode S addresses in the same airspace – is it possible? malfunctions on detection and how it can
Given that one of the benefits of Mode S is the unambiguous identification of aircraft by means support the controller in any subsequent
of a 24-bit address,can two aircraft have the same address? It is feasible;sometimes an incorrect action – be it still providing useable
address can be assigned to an aircraft, for example, due to the block allocation of addresses to information or warning about erroneous data
a State, when a transponder is transferred from one aircraft to another without re-setting the or information loss”.
address or a fault in the aircraft wiring.
In previous NETALERTS…
However, for any significant safety impact both aircraft would need to be in the same airspace. Ground based safety nets and transponder data have been
While this is unlikely, it has happened. For example, two aircraft flying in the airspace of a covered in a number of previous issues:
European ANSP were found to have duplicated Mode S addresses. Two different ATC systems
were tracking the aircraft – in one the anti-reflection algorithms filtered one of the tracks,in the ■ Issue 10: Safety nets and DAPs/loss of transponder data
other both aircraft were seen at all times.
■ Issue 11: Safety nets in Malta

■ Issue 14: Operating STCA at airports outside of major TMAs

■ Issue 17: Split Tracks

7 NETALERT Newsletter May 2014

SESAR update

Our regular review of SESAR safety nets related projects follows…

Evolution of Ground-Based Safety Nets interoperability of TCAS II-ACAS XA operations. A joint meeting has taken place between P9.47,
and Airborne Safety Nets (P4.8.1-3) RTCA SC147 and EUROCAE WG75 to start
Early results from three of these exercises (led the development of the ACAS-X Minimum
Enhanced ground-based safety nets by DSNA) show a significant reduction of Operational Performance Standards (MOPS).
Work Area 1 (enhanced ground-based the risk of mid-air collisions and a significant
safety nets using existing down-link aircraft reduction in operationally undesired Resolution The definition of operational requirements,
parameters (DAPs) in TMA and en-route Advisories (RAs). However, operational and assumptions and scenarios for General
environments) completed an operational safety issues have also been identified, Aviation (GA) collision avoidance capability
validation in the Milan ACC, in October for including greater deviations resulting from in a European environment is nearing
nominal situations,and in April for non-nominal remaining RAs (which might impact ACAS XA completion.Similar work is nearing completion
situations.The V3 validation activity assessed an compatibility with ATC practices), too many for surveillance in an ACAS-XA environment.
enhanced STCA industrial prototype developed complex RA sequences (which might impact Additionally, a number of activities including
by P10.4.3 using existing down-linked aircraft safety and pilot acceptability) and some TCAS the assessment of issues and mitigation means
parameters (DAP). The associated validation II / ACAS XA interoperability issues (with more for TCAS-equipped and GA aircraft encounters,
report has been produced.Based on the results, Crossing & Reverse RAs on TCAS II aircraft as well as the development and V&V planning
the maturity of the concept will be checked by when encountering ACAS XA aircraft). for the Surveillance Tracking Module (STM), are
the SJU in June. to start early this year.
ACAS RA downlink Partners:Honeywell (leader),AIRBUS,DSNA,
Fast time simulations and workshops were Work continues on the display of downlinked EUROCONTROL
undertaken for the V2 validation in Work Area 2 ACAS RAs to the controller. The preliminary
(enhanced ground-based safety nets adapted operational concept,validation and evaluation ACAS monitoring (15.4.3)
to future TMA and en-route environments with of the concept are to be completed in the first The integration study for the ACAS monitoring
enhanced 3/4D trajectory management) in the half of 2014. system prototype is being updated by
last quarter of 2013.The exercise evaluated the Partners:DSNA (leader),NATS,EUROCONTROL EUROCONTROL. The evaluation report is being
use of system-wide information management revised, with a planned handover to the SJU
(SWIM) and new surveillance means (e.g. Safety Nets Adaptation to New Modes of during the summer.
Automatic Dependent Surveillance-Broadcast Operation (P10.4.3) Partners:THALES (leader),INDRA,EUROCONTROL,
(ADS-B)) to enhance ground-based safety P10.4.3 supported the V3 validation on DFS
nets, particularly STCA and APW, in a future enhanced STCA using DAPs conducted by
trajectory-based environment. An associated P4.8.1. Airport Safety Support Tools for Pilots,
validation report is being produced. However, The project is now working towards its next Vehicle Drivers and Controllers (6.7.1)
the partners considered that the concept was validation exercise, enhanced safety nets and In Work Area 2 (runway safety lights (RWSL)),
not mature enough to be able to conduct the Resolution Advisory data processing (RADP), a new prototype RWSL system is under
planned V3 validation, which may then occur planned for November 2014. The exercise will development.Once integrated,the operational
only in the follow-up to SESAR,SESAR 2020. assess Indra's prototype safety nets server validation will take place at Paris Charles de
(SNS) and controller working position (CWP). Gaulle.
The merge of P4.8.1, P4.8.2 and P4.8.3 into The SNS computes the short term conflicts
a single (P4.8.1) project is effective as of based on the aircraft tracks (among others) Work Area 3 (conflicting ATC clearances) has
01/01/2014 but still needs to be formalized. and has an integrated RA data processor been merged into Work Area 4 (conformance
(RADP) prototype. In the planned exercise the monitoring). The associated operational
ACAS XA CWP will display both RAs and STCA alerts. A services and environment descriptions (OSEDs)
The estimation of potential generated risks, number of related deliverables have either for the controller element of these the two
safety benefits, operational performance and been submitted to the SJU or are in progress. concepts have been delivered to the SJU and
interoperability of TCAS II-ACAS XA are all to Partners:INDRA (leader),ENAV,EUROCONTROL, the safety and performance requirements
be completed in summer 2014. In parallel, the SELEX (SPRs) are being updated. Work on the OSEDs
preparations for the V2 validation exercises and SPRs for the corresponding pilot elements
assessing the evaluation of ACAS XA in Europe TCAS Evolution (P9.47) of these concepts is in progress.
are still on-going. These exercises aim at The prototype to assess implementing an
assessing the potential safety and operational extended hybrid surveillance capability into In Work Area 5 (alerts for vehicle drivers), a
benefits, and dis-benefits, of ACAS XA for TCAS II is now ready for its technical validation. second V2 validation exercise has taken place in
Europe (compared to TCAS II), as well as the Malmö.The exercise demonstrated how drivers

NETALERT Newsletter May 2014 8

SESAR update Snippets

continued Trending SNETs news...
DSNA and DFS join forces over CoSNET
could be alerted to safety-critical issues on the prototypes to support validation activities DSNA and DFS have jointly developed,
airport manoeuvring area (e.g. risk of collision (both simulations and live trials) for enhanced validated and deployed the CoSNET
or infringement of closed areas) using an on- surface safety nets is progressing according (Cooperative Safety Nets) safety net system
board system and/or uplinked alerts. to plan. A number of deliverables related to leading to significantly reduced procurement
the NATMIG and Indra prototypes have been costs for both ANSPs. CoSNET is based on
In Work Area 6 (traffic alerts for pilots),the OSED submitted to the SJU.The development of the DSNA’s experience with its own safety net
and interoperability deliverables are being Thales and DFS systems is on-going. Support system which has been in operation since
updated,and the SPRs are being finalised. to operational validation tasks is on-going 1996. DFS introduced CoSNET at its largest
Partners:DSNA (leader),AIRBUS,ALENIA,DFS, while technical specifications and support to control centre in Langen in December 2013,
NORACON, THALES, SEAC, EUROCONTROL standardisation activities are expected to be with the Munich and Bremen centres due to
launched later this year. receive CoSNET later this year. DSNA plans to
Enhanced Surface Safety Nets (12.3.2) Partners:THALES (lead),DFS,DSNA,INDRA, replace its existing safety net servers with
The development and verification of industrial NATMIG, SELEX, EUROCONTROL CoSNET servers, beginning in autumn 2014
at the Strasbourg approach control unit.
Also in SESAR - CoSNET can provide the safety nets MSAW,
STCA, APW and APM.
SESAR airport SNET trials at For more on this: http://www.
Milan Malpensa airtrafficmanagement.net/2014/03/watm-
dsna-dfs-launch-cosnet/
In November 2013, ENAV and its SESAR partners non-conformance to ATC procedures/
conducted the V3 validation of new airport instructions, conflicting ATC clearances, 2014 Safety Forum: Airborne Conflict
safety nets under the umbrella of P6.3.2 “Airport surface conflict prediction & detection, The 2014 Safety Forum, organised by the
ATM Performance - Execution Phase”. runway incursion detection & area intrusion) Flight Safety Foundation, EUROCONTROL and
and their display to controllers. A shadow the European Regional Airlines Association
The exercise focused on the early detection mode exercise also took place, investigating will take place at EUROCONTROL on 10-11
of conflicting vehicle trajectories on the the accuracy and reliability of Automatic June. The forum will focus on Airborne
airport surface/runways and the provision of Dependent Surveillance-Broadcast (ADS-B). Conflict Risk, covering a wide range of
related alerts to controllers. The first part of subjects such as: pilot-controller interaction,
the validation was a real-time simulation of The results of these trials will be analysed and ATC system functionality,airspace design and
innovative alarms for controllers (for example, published as part of SESAR Release 3 package. aircraft performance. The riskfrom operations
without a functioning transponder study will
also be presented.To register or see the latest
agenda go to http://www.skybrary.aero/
index. php/Portal:Airborne_Conflict

For more information
http://www.sesarju.eu/newsroom/all-news/airport-safety-net-concept-successfully-validated-milan-malpensa-airport.

Contact

ENSURING THE EFFECTIVENESS © May 2014 - European Organisation for the Safety of Air Navigation (EUROCONTROL) Contact us by phone:
OF SAFETY NETS Ben Bakker (+32 2 729 3146),
This document is published by EUROCONTROL for information purposes. Stan Drozdowski (+32 2 729 3760) or by
It may be copied in whole or in part, provided that EUROCONTROL is mentioned as the source and email: [email protected]
to the extent justified by the non-commercial use (not for sale).The information in this document may
not be modified without prior written permission from EUROCONTROL.

9 NETALERT Newsletter May 2014