Safety Net

The Dutch air navigation service provider (ANSP) LVNL has introduced successfully a go-around detection system as safety net in the control towers at Amsterdam Airport Schiphol. This article explains the characteristics of this safety net and shares lessons learned about the operational introduction.

Schiphol is the Netherlands’ primary airport and one of the busiest in Europe with more than 1,500 movements per day. Schiphol has six converging runways, most of them used in two directions, for takeoff and landing. During daytime operations, three runways typically are in use simultaneously — either two for landing and one for takeoff, or vice versa.

The large number of aircraft movements, combined with strict environmental (noise) regulations and often fluctuating wind and weather conditions, result in a variety of runway combinations being used. Many of these runway combinations are considered to be dependent, meaning flight operations on one runway can affect flight operations on another. Dependent runway use is key to Schiphol’s operational concept and is important to achieve high airport capacity and sustainability under various circumstances. Extensive safety assessments have been performed to ensure this high capacity can be achieved while maintaining a high level of operational safety.

LVNL has implemented various mitigating measures to ensure safe use of dependent runways. For example, controllers in the airport air traffic control tower are trained on this specific type of operation and are made aware of potential consequences of a go-around. Procedures restrict the use of dependent runways (such as limitations on the use of some runway combinations under low visibility conditions), and takeoff clearances for departing aircraft are timed in relation to the positions of approaching aircraft.

However, even with mitigations in place, procedural guidelines often cannot be precisely applied in actual operations. The Aeronautical Information Publication for Schiphol instructs pilots flying approaches to “in case of missed approach inform ATC [air traffic control] immediately.” But during a go-around, with a potential high workload in the cockpit, the top priority of the flight crew is not communicating with ATC. The axiom “aviate, navigate, communicate” teaches pilots to fly the airplane first. Communication is a task to be performed when the situation is under control. ATC, therefore, is not always immediately informed of a go-around maneuver initiated by the pilot.

ATC procedures instruct the runway controller to monitor the landing to ensure a go-around is detected in a timely manner. But the controller has to perform multiple tasks and monitor multiple runways and may shift attention to another task when convinced an aircraft has landed.

A go-around is a normal phase of flight in which the pilot aborts the (final) approach. The go-around can be initiated by the air traffic controller or by the flight crew. Reasons for a go-around range from technical problems in the aircraft, to an unstabilized approach, to a blocked runway, to a cabin not being ready for landing. At Schiphol, approximately 350 to 400 go-arounds are performed annually.

In an operation such as Schiphol, with dependent runway use, timely detection of a go-around is crucial because a (late) go-around can lead to a major incident, such as occurred on May 10, 2015 at Schiphol.¹ LVNL, therefore, investigated improving the probability of detecting a go-around, in addition to enhancing training and procedural measures. The solution is provided from the machine perspective (that is, through implementation of a system-based technical improvement): the introduction of a Go-Around Detection System (GARDS) at the Schiphol control towers as an additional safety net. Safety nets are defined by Eurocontrol as ground-based or airborne system functions that alert controllers or pilots to an increased risk to flight safety. With GARDS, it is the controller who is being alerted.

Fine Tuning

Before the decision was made to implement GARDS, years of work were completed on how to design a system that would have the anticipated benefit of timely go-around detection, but would avoid common safety net pitfalls, some of which are described below. A preliminary study by the Netherlands Aerospace Centre (NLR) investigated the technical feasibility of go-around detection. The demonstration of technical possibilities was followed by a study of operational feasibility, laying the foundation for the GARDS operational concept. The final project started in 2013 and led to implementation about two years later.

By that time, the technical approach had evolved into a design based on an algorithm that determines whether there is a deviation from the anticipated, nominal situation. “Tunnels” define the nominal approach paths and an aircraft moving out of these tunnels is detected. Although these tunnels are not physically presented to the air traffic controllers, it is an intuitive and easy to explain technical design that is well understood by non-technical experts. This helps to understand when the system generates an alert. The detection range of the tunnels is limited to 4.5 nm (8.3 km) before runway threshold because this area covers the most critical go-around situations.

In addition to the position of the aircraft, the speed of the aircraft is analyzed at the runway during touchdown and roll-out. The reason for this is that, for late go-arounds (i.e. after runway threshold), the speed of the aircraft is an earlier indication of a possible go-around than the position of the aircraft. Usually aircraft going around do not slow down in a timely manner and may even increase speed before they start to increase altitude. Including speed in the detection algorithm therefore reduces detection times.

The input data for the algorithm consists of ground radar tracks and multi-lateration data, with a one second update frequency. For GARDS, the update frequency and coverage of the surveillance data are crucial for a high system performance. A timely detection would not be feasible with a four-second update frequency, because subsequent inputs to the system take too long. The required surveillance infrastructure was available at Schiphol, enabling the reliance of GARDS on this source of information.

Overcoming Safety Net Pitfalls

While a solid technical approach is crucial for system functioning, the full operational concept, including working practices, human factors aspects and a framework for operational use, determines whether the go-around detection system can be implemented successfully. A lot of attention was paid to the design of the operational concept in GARDS development. In June 2016, Flight Safety Foundation, Eurocontrol and the European Regions Airline Association dedicated their annual Safety Forum to the subject of safety nets. The key features of GARDS are linked below to some of the Safety Forum’s findings in order to explain how the design of GARDS mitigates common safety net pitfalls.

• • GARDS is designed as safety net that cannot be switched off by the air traffic controller.
    A major risk of a safety net, recognized by the Safety Forum, is that the safety net becomes the primary means of task achievement, instead of being a means of mitigation. This can eventually lead to skill degradation, when relying on a system becomes more important than the task of the person involved.
    • This risk is limited for GARDS. Go-arounds are fairly rare at Schiphol, compared to the overall number of movements, so in the majority of landings there is no warning. But foremost, the air traffic controller is often faster than GARDS at detecting the go-around. The system has to rely on surveillance data, whereas the air traffic controller has much more information available to detect a go-around. For example, in many situations, the flight crew informs ATC about the go-around in an early stage. The air traffic controller can also use cues such as the aircraft pitch to identify an aircraft that has commenced a go-around. This indicates that GARDS really is a safety net that does not replace the normal way of working.
  • GARDS does not require a change in working method.
    A key finding of the Safety Forum was that safety nets should be complementary to normal operational procedures. They are not intended to alter the way of working but rather to provide support in potentially hazardous situations.
    • This was the starting point when designing GARDS: The system was designed to allow the existing way of working to continue. Pilots still report a go-around, and air traffic controllers monitor approaching and landing aircraft. The system acts like an additional crewmember, reminding you and pointing out when the primarily responsible crewmember — the runway controller — has missed something. No controller inputs to GARDS are required for the system to function, and all data used are based on existing system inputs.
  • GARDS presents both visual and auditory warnings to the air traffic controller.
    When well designed, alerting by a safety net can help to optimize conflict resolution. The approach taken for GARDS is to support the runway controller in two ways: by means of a visual alert (on-the-ground situation and air surveillance display) and an auditory alert (generated at the working position of the runway controller involved). In good visibility conditions, the air traffic controller looks outside. The auditory alert, a message presented twice that includes the name of the runway involved, provides information on a go-around situation without the controller having to work with his or her head down. Air traffic controllers use ground radar in poor visibility and directly see the GARDS warning on the same display. The ground surveillance display can also be used for further reference because it indicates which specific aircraft is making a go-around, by indicating an orange square around the aircraft involved. The design philosophy of GARDS is consistent with the design of a runway incursion alerting system that was already in use at the Schiphol towers.
  • GARDS is easy to understand and unambiguous in use.
    The effectiveness of runway safety nets may be reduced when they are not intuitive and easy to use. There should be no question on how to interpret a warning generated by a safety net.
    • In the design of GARDS, unambiguous use was taken as key design principle. The system is designed to work for all runways and runway combinations and all visibility conditions. The GARDS algorithm is based on parameters that are logical for the air traffic controller, making the system properly explainable. An intuitive system not only increases effectiveness of the safety net but also reduces the need for extensive familiarization training. Air traffic controllers were involved throughout the design to make sure operational feedback was provided.

To investigate various design alternatives for GARDS and to validate the design concept, real time simulations were performed during the development of the system. These simulations supported design iterations that eventually led the system to be ready for implementation. For example, simulations helped to develop the human-machine interface. They also demonstrated the GARDS system in practice, by modelling historical go-arounds and replaying these on the simulator. Air traffic controllers were involved in these simulations and could verify system performance, which resulted in fine tuning of functional requirements of the system.

Implementation

Experience has shown that innovative tools and systems are often appreciated during research and development, but that when it comes to actual implementation, operational acceptance can be a bottleneck. Underlying factors for resistance to implementation are, for example, when it becomes clear that a lot of training is needed when the existing way of working changes, or when the system is not reliable enough.

The GARDS project demonstrates that successful implementation of an innovative system is possible within a relatively short timeframe. Three major lessons can be learned from this project that are relevant more generally for the introduction of safety nets:

• • • Continuous involvement of the stakeholders (in this case: the air traffic controllers) increases acceptance. Throughout the project, from initial research to actual realization, air traffic controllers were involved. Real time simulations were completed to demonstrate the system under development, which allowed the air traffic controllers to see how the operational requirements were translated into system design. Controllers also were involved in decisions on how the implementation should be designed, such as whether a phased or an “all-at-once” introduction would be best. The involvement of the operational department was shown to be crucial in the rapid development.
    • Off-line tuning of the safety net ensures successful go-live. The Safety Forum concluded that safety nets must be properly tuned in order to produce meaningful alerts. As far as safety nets are concerned, a sub-optimal tuning can easily lead to many nuisance (false) alerts. Creating an optimal balance between timing of the alert and the number of false alerts that are generated received attention during the GARDS design. An off-line tuning was performed on the algorithm, based on more than five years of radar data. This data set includes more than 1 million arrivals and 2,000 go-arounds. This allowed the algorithm to be tuned on a large variety of operational situations and flown trajectories. Local circumstances, for example, characteristic flight patterns and speed behavior for the various landing runways, were taken into account and were used for optimizing the algorithm and the layout of the “tunnels.” This extensive off-line tuning made sure the system was properly tuned at the moment of go-live.
    • Evaluation and performance monitoring after go-live creates a lifecycle approach. A systems engineering lifecycle approach was advocated during the Safety Forum. The introduction of GARDS was succeeded by an operational evaluation to monitor performance of GARDS in practice. This resulted in minor updates, such as adjustments of the auditory warning volume to suit the noise levels at the control tower. In addition, the performance of GARDS is monitored by investigating monthly system reports and following occurrence reporting.

The implementation of GARDS highlights that innovation in air traffic management can progress from theoretical concepts to operational use within a short timeframe and with support of the air traffic controllers. While innovation is not easy in a safety-critical environment and sometimes requires a lot of effort, this project shows that an occurrence can be the starting point for the implementation of innovative systems.

Mariska Roerdink is the project manager for the Go-Around Detection System and a senior performance expert with Air Traffic Control the Netherlands (LVNL). She made a presentation on GARDS at the Flight Safety Foundation Safety Forum at Eurocontrol headquarters in Brussels in June 2016.

Note

• 1. LVNL. 10 May 2015 — Indicident during go-around at Amsterdam Airport Schipol.

Featured image: @ alexsl | iStockphoto

Editor’s Note: This article has been updated since it was originally published to include a link to Amsterdam Airport Schiphol.