What email address or phone number would you like to use to sign in to Docs.com?
If you already have an account that you use with Office or other Microsoft services, enter it here.
Or sign in with:
Signing in allows you to download and like content, and it provides the authors analytical data about your interactions with their content.
Embed code for: RVSM ICAO doc 9574
Select a size
Reduced Vertical Separation Minima RVSM
ICAO doc 9574 Manual on Implementation of 300 m (1,000 ft) Vertical Separation Minima between FL 290 and FL 410 Inclusive
Manual on Implementation of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive Second Edition — 2001 Doc 9574 AN/934 International Civil Aviation Organization Approved by the Secretary General and published under his authority AMENDMENTS The issue of amendments is announced regularly in the ICAO Journal and in the monthly Supplement to the Catalogue of ICAO Publications and Audio-visual Training Aids, which holders of this publication should consult. The space below is provided to keep a record of such amendments. RECORD OF AMENDMENTS AND CORRIGENDA AMENDMENTS CORRIGENDA No. Date applicable Date entered Entered by No. Date of issue Date entered Entered by 1 1/11/01 — ICAO (ii) (iii) TABLE OF CONTENTS Page Page Chapter 1. Introduction . . . . . . . . . . . . . . . . . . . . 1-1 1.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 1.2 Purpose of manual. . . . . . . . . . . . . . . . . . . . 1-2 1.3 Content and presentation. . . . . . . . . . . . . . . 1-2 1.4 List of acronyms . . . . . . . . . . . . . . . . . . . . . 1-3 1.5 List of definitions . . . . . . . . . . . . . . . . . . . . 1-3 Chapter 2. General requirements . . . . . . . . . . . . 2-1 2.1 Safety objectives . . . . . . . . . . . . . . . . . . . . . 2-1 2.2 Global system performance specification. . 2-2 2.3 Global height-keeping performance specification. . . . . . . . . . . . . . . . . . . . . . . . . 2-3 Chapter 3. Implementation planning . . . . . . . . . 3-1 3.1 Implementation considerations . . . . . . . . . . 3-1 3.2 Operating conditions . . . . . . . . . . . . . . . . . . 3-1 3.3 Implementation strategy . . . . . . . . . . . . . . . 3-2 Chapter 4. Aircraft requirements and approval 4-1 4.1 RVSM height-keeping performance . . . . . . 4-1 4.2 Airworthiness approval . . . . . . . . . . . . . . . . 4-1 4.3 State RVSM approval . . . . . . . . . . . . . . . . . 4-2 Chapter 5. Procedures. . . . . . . . . . . . . . . . . . . . . . 5-1 5.1 Flight crew operating procedures . . . . . . . . 5-1 5.2 ATC procedures. . . . . . . . . . . . . . . . . . . . . . 5-2 Chapter 6. System performance monitoring . . . 6-1 6.1 Requirement for monitoring . . . . . . . . . . . . 6-1 6.2 Monitoring the technical performance . . . . 6-1 6.3 Assessment and evaluation of operational errors and in-flight contingencies. . . . . . . . 6-4 6.4 Responsibilities of the authorities. . . . . . . . 6-5 Appendix A. Quantitative aspects of system performance monitoring . . . . . . . . . . . . . . . . . . . . . A-1 Appendix B. Reference documentation. . . . . . . . B-1 1-1 Chapter 1 INTRODUCTION 1.1 BACKGROUND 1.1.1 In the late 1950s it was recognized that, as a result of the reduction in pressure-sensing accuracy of barometric altimeters with increasing altitude, there was a need above a certain flight level (FL) to increase the prescribed vertical separation minimum (VSM) of 300 m (1 000 ft). In 1960, an increased VSM of 600 m (2 000 ft) was established for use between aircraft operating above FL 290 except where, on the basis of regional air navigation agreement, a lower flight level was prescribed for the increase. The selection of FL 290 as the vertical limit for the 300 m (1 000 ft) VSM was not so much an empirically- based decision but rather a function of the operational ceiling of the aircraft at that time. In 1966, this changeover level was established at FL 290 on a global basis. At the same time, it was considered that the application of a reduced VSM above FL 290, on a regional basis and in carefully prescribed circumstances, was a distinct possibility in the not too distant future. Accordingly, ICAO provisions stated that such a reduced VSM could be applied under specified conditions within designated portions of airspace on the basis of regional air navigation agreement. 1.1.2 It has long been recognized that any decision concerning the feasibility of reducing the VSM above FL 290 could not be based upon operational judgement alone, but would need to be supported by a rigorous assessment of the risk associated with such a reduction of separation. The lack of a clear-cut method of achieving such an assessment was the primary cause of the failure of various attempts to determine the feasibility of a reduced VSM. 1.1.3 In the mid-1970s, the series of world fuel shortages and the resultant rapid escalation of fuel costs, allied to the growing demand for a more efficient utilization of the available airspace, emphasized the necessity for a detailed appraisal of the proposal to reduce the VSM above FL 290. Thus, at its fourth meeting (in 1980), the ICAO Review of the General Concept of Separation Panel (RGCSP) concluded that, despite the cost and time involved, the potential benefits of reducing the VSM above FL 290 to 300 m (1 000 ft) were so great that States should be encouraged to conduct the major evaluations necessary. 1.1.4 In 1982, coordinated by the RGCSP, States initiated programmes to study comprehensively the question of reducing the VSM above FL 290. Studies were carried out by Canada, Japan, Member States of EUROCONTROL (France, Federal Republic of Germany, Kingdom of the Netherlands and United Kingdom), Union of Soviet Socialist Republics and United States, and in December 1988 the results were considered by the RGCSP at its sixth meeting (RGCSP/6). 1.1.5 These studies employed quantitative methods of risk assessment to support operational decisions concerning the feasibility of reducing the VSM. The risk assessment consisted of two elements: first, risk estimation, which concerns the development and use of methods and techniques with which the actual level of risk of an activity can be estimated; and second, risk evaluation, which concerns the level of risk considered to be the maximum tolerable value for a safe system. The level of risk that is deemed acceptable was termed the target level of safety (TLS). 1.1.6 The process for the estimation of risk in the vertical plane using the collision risk model (CRM) assumed that collisions result solely from vertical navigation errors of aircraft to which procedural separation had been correctly applied. The TLS was derived to apply to this contribution of collision risk alone; it does not address risk from other sources, such as height deviations due to turbulence, responses to airborne collision avoidance system alerts, emergency descents and operational errors in the issuance of, or compliance with, air traffic control (ATC) instructions. 1.1.7 The recognition of several sources of risk in addition to vertical navigation errors played a role in the choice of TLS values by various States during their studies. Several approaches were followed in order to establish an appropriate range of values, including all en-route mid-air collisions and the implicit period between collisions, and Manual on Implementation of a 300 m (1 000 ft) Vertical 1-2 Separation Minimum Between FL 290 and FL 410 Inclusive adjusting the TLS until the period of time became acceptable. Nevertheless, the primary approach, and the traditional manner, was to use historical data from global sources, predicted forward to approximately the year 2000 to provide a safety improvement and to apportion resultant risk budgets to derive the vertical collision risk element. 1.1.8 The derived values for the TLS ranged between 1 × 10-8 and 1 × 10-9 fatal accidents per aircraft flight hour. On the basis of these figures, it was agreed that an assessment TLS of 2.5 × 10-9 fatal accidents per aircraft flight hour would be used to assess the technical feasibility of a 300 m (1 000 ft) VSM above FL 290 and also to develop aircraft height-keeping capability requirements for operating in a 300 m (1 000 ft) VSM. 1.1.9 Using the assessment TLS of 2.5 × 10-9 fatal accidents per aircraft flight hour, RGCSP/6 concluded that a 300 m (1 000 ft) VSM above FL 290 was technically feasible. This technical feasibility refers to the fundamental capability of aircraft height-keeping systems, which could be built, maintained and operated in such a manner that the expected, or typical, performance is consistent with safe implementation and use of a 300 m (1 000 ft) VSM above FL 290. In reaching this conclusion on technical feasibility, the panel found it necessary to establish: a) airworthiness performance requirements embodied in a comprehensive minimum aircraft system perform- ance specification (MASPS) for all aircraft utilizing the reduced separation; b) new operational procedures; and c) a comprehensive means of monitoring the safe operation of the system. 1.1.10 It is important to emphasize that the assess- ment TLS did not address all causes of risk of collision in the vertical plane. In the first edition of this guidance material, regional planning authorities were advised of the necessity to institute measures to ensure that the risks associated with operational errors and emergency actions did not increase in the 300 m (1 000 ft) VSM environment. In the North Atlantic (NAT) Region, which on 27 March 1997 became the first ICAO region to implement the reduced vertical separation minimum (RVSM), it was agreed that a more formal approach was necessary to assessing all causes of risk in the vertical plane. On the basis of the experience gained in the monitoring and analysis of the causes of operational errors in NAT minimum navigation performance specification (MNPS) airspace, the NAT Systems Planning Group (NAT SPG) agreed that limiting the risk of collision due to the loss of planned vertical separation as a consequence of such events should receive attention at least equal to that devoted to limiting the effects of technical errors (errors of aircraft height-keeping systems). Therefore, in addition to the TLS for technical errors, i.e. 2.5 × 10-9 fatal accidents per aircraft flight hour, an overall TLS of 5 × 10-9 fatal accidents per aircraft flight hour resulting from a loss of vertical separation due to any cause was adopted. 1.2 PURPOSE OF MANUAL 1.2.1 The basic purpose of this manual is to provide regional planning groups (RPGs) with a basis for the development of documents, procedures and programmes to enable the introduction of a 300 m (1 000 ft) VSM above FL 290 within their particular regions in accordance with the criteria and requirements developed by ICAO. More detailed justification and explanation of the various criteria, requirements and methodology outlined in this manual are provided in the report of the RGCSP/6 Meeting (Doc 9536). 1.2.2 This manual also provides: a) guidance to State aviation authorities on those measures necessary to ensure that the criteria and requirements are met within their area of responsi- bility; and b) background information for operators to assist them in the development of operating manuals and flight crew procedures. 1.3 CONTENT AND PRESENTATION 1.3.1 The sequence of the material in the first edition of this manual reflected the stages of implementation that emerged from the deliberations of the RGCSP/6 Meeting, which, as a result of the vertical studies programme, determined the feasibility of a global application of the reduced vertical separation minimum. This second edition of the manual has been restructured to improve its presentation and to take into account new material resulting from relevant RVSM-related developments since the first edition was published in 1992. Chapter 2 describes the general RVSM requirements in terms of, inter alia, safety, required aircraft height-keeping performance, and operating aspects. Chapter 3 gives guidance on the steps to follow for regional implementation of RVSM, and Chapter 4 describes specific aircraft RVSM requirements and approval aspects. Chapter 1. Introduction 1-3 Chapter 5 gives general guidance on procedures, for both ATC and flight crew, and Chapter 6 provides information on system monitoring, including the responsibilities and tasks of authorities in RVSM performance monitoring. Appendix A contains guidance on the quantitative aspects of system performance monitoring, and Appendix B provides a list of reference documentation, such as regional documentation developed in the context of regional RVSM implementation programmes. 1.3.2 In this manual, RVSM refers to a vertical separation minimum of 300 m (1 000 ft) between FL 290 and FL 410 inclusive. 1.4 LIST OF ACRONYMS AAD Assigned altitude deviation ACAS Airborne collision avoidance system ACC Area control centre ASE Altimetry system error ATC Air traffic control ATS Air traffic services CFL Cleared flight level CMA Central monitoring agency CRM Collision risk model FAA Federal Aviation Administration FL Flight level FTE Flight technical error GAT General air traffic GMS GPS-based monitoring system GMU GPS-based monitoring unit GPS Global positioning system HF High frequency HMU Height-monitoring unit JAA Joint Aviation Authority MASPS Minimum aircraft system performance specification MNPS Minimum navigation performance specification NAT North Atlantic NAT SPG North Atlantic Systems Planning Group NOTAM Notice to airmen OAT Operational air traffic RGCSP Review of the General Concept of Separation Panel RMA Regional monitoring agency RNAV Area navigation RPG Regional planning group RVSM Reduced vertical separation minimum of 300 m (1 000 ft) between FL 290 and FL 410 inclusive SD Standard deviation SSE Static source error SSR Secondary surveillance radar TLS Target level of safety TVE Total vertical error VSM Vertical separation minimum 1.5 LIST OF DEFINITIONS The following definitions are intended to clarify certain specialized terms used in this manual. Aberrant aircraft. Those aircraft which exhibit measured height-keeping performance that is significantly different from the core height-keeping performance measured for the whole population of aircraft operating in RVSM airspace. Aircraft type groupings. Aircraft are considered to belong to the same group if they are designed and assembled by one manufacturer and are of nominally identical design and build with respect to all details which could influence the accuracy of height-keeping performance. Airworthiness approval. The process of assuring the State authority that aircraft meet RVSM MASPS. Typically, this would involve an operator meeting the require- ments of the aircraft manufacturer service bulletin for that aircraft and having the State authority verify the successful completion of that work. Altimetry system error (ASE). The difference between the altitude indicated by the altimeter display, assuming a correct altimeter barometric setting, and the pressure altitude corresponding to the undisturbed ambient pressure. Altimetry system error stability. Altimetry system error for an individual aircraft is considered to be stable if the statistical distribution of altimetry system error is within agreed limits over an agreed period of time. Altitude-keeping device. Any equipment which is designed to automatically control the aircraft to a referenced pressure altitude. Assigned altitude deviation (AAD). The difference between the transponded Mode C altitude and the assigned altitude/flight level. Automatic altitude-keeping device. Any equipment which is designed to automatically control the aircraft to a referenced pressure-altitude. Manual on Implementation of a 300 m (1 000 ft) Vertical 1-4 Separation Minimum Between FL 290 and FL 410 Inclusive Collision risk. The expected number of mid-air aircraft accidents in a prescribed volume of airspace for a specific number of flight hours due to loss of planned separation. Note.— One collision is considered to produce two accidents. Flight technical error (FTE). The difference between the altitude indicated by the altimeter display being used to control the aircraft and the assigned altitude/flight level. Height-keeping capability. The aircraft height-keeping performance that can be expected under nominal environmental operating conditions with proper aircraft operating practices and maintenance. Height-keeping performance. The observed performance of an aircraft with respect to adherence to cleared flight level. Non-compliant aircraft. An aircraft configured to comply with the requirements of RVSM MASPS which, through height monitoring, is found to have a total vertical error (TVE) or an assigned altitude deviation (AAD) of 90 m (300 ft) or greater or an altimetry system error (ASE) of 75 m (245 ft) or more. NOTAM. A notice distributed by means of tele- communication containing information concerning the establishment, condition or change in any aeronautical facility, service, procedure or hazard, the timely knowledge of which is essential to personnel concerned with flight operations. Occupancy. A parameter of the collision risk model which is twice the count of aircraft proximate pairs in a single dimension divided by the total number of aircraft flying the candidate paths in the same time interval. Operational error. Any vertical deviation of an aircraft from the correct flight level as a result of incorrect action by ATC or the aircraft crew. Overall risk. The risk of collision due to all causes, which includes the technical risk (see definition) and all risk due to operational errors and in-flight contingencies. Passing frequency. The frequency of events in which two aircraft are in longitudinal overlap when travelling in the opposite or same direction on the same route at adjacent flight levels and at the planned vertical separation. RVSM approval. The term used to describe the successful completion of airworthiness approval and operational approval (if required). Target level of safety (TLS). A generic term representing the level of risk which is considered acceptable in particular circumstances. Technical risk. The risk of collision associated with aircraft height-keeping performance. Total vertical error (TVE). The vertical geometric difference between the actual pressure altitude flown by an aircraft and its assigned pressure altitude (flight level). Track. The projection on the earth’s surface of the path of an aircraft, the direction of which path at any point is usually expressed in degrees from North (true, magnetic or grid). Vertical separation. The spacing provided between aircraft in the vertical plane to avoid collision. Vertical separation minimum (VSM). VSM is documented in the Procedures for Air Navigation Services — Air Traffic Management (PANS-ATM, Doc 4444) as being a nominal 300 m (1 000 ft) below FL 290 and 600 m (2 000 ft) above FL 290 except where, on the basis of regional agreement, a value of less than 600 m (2 000 ft) but not less than 300 m (1 000 ft) is prescribed for use by aircraft operating above FL 290 within designated portions of the airspace. 2-1 Chapter 2 GENERAL REQUIREMENTS 2.1 SAFETY OBJECTIVES 2.1.1 Implementation of RVSM should be based on a safety assessment, demonstrating that RVSM safety objectives have been satisfied. The safety assessment should include using a CRM for the airspace in accordance with the guidance provided in this manual (more detailed information on CRM methodologies are contained in the documents referenced in Appendix B). 2.1.2 RVSM safety objectives have been set for both technical risk and overall risk and are as follows. Safety objective for technical risk 2.1.3 Technical risk is the risk of collision associated with aircraft height-keeping performance. Risk associated with operational errors (e.g. controller/pilot errors) and in-flight contingencies is not included. 2.1.4 The RVSM safety objective for technical risk is a TLS of 2.5 x 10-9 fatal accidents per aircraft flight hour. This value for technical risk was used to derive the global system performance specification and the global height- keeping performance specification, which are detailed in 2.2 and 2.3, respectively. Safety objective for overall risk 2.1.5 Overall risk is the risk of collision due to all causes, which includes the technical risk (see above) and all risk due to operational errors and in-flight contingencies, such as pilot/controller errors, height deviations due to emergency procedures, and turbulence. 2.1.6 The RVSM safety objective for overall risk should be set by regional agreement. Due account should be taken of existing ICAO guidance on safety objectives and of safety objectives applied in other regions. To this end, attention is drawn to: a) the guidance provided in Annex 11, Attachment B, Section 3, which, with regard to spacing between parallel tracks or between parallel RNAV route centre lines based on RNP type, recommends that for implementation of en-route systems after the year 2000, a target level of safety of 5 × 10-9 fatal accidents per flying hour per dimension should be applied. However, other appropriate metrics and methods of assessment providing an acceptable level of safety may be established by States and, as appropriate, implemented by regional agreement; b) the overall safety objective applied for RVSM in the NAT Region, i.e. a TLS of 5 × 10-9 fatal accidents per aircraft flight hour resulting from a loss of vertical separation due to any cause (see 1.1.10); and c) the reference list in Appendix B to this manual. 2.1.7 Guidance on the methodologies to estimate risk associated with RVSM is contained in Chapter 6, System Performance Monitoring. 2.1.8 Regional authorities should take into account all possible means of quantifying and reducing the level of risk of collision resulting from operational errors and in-flight contingencies in RVSM airspace. Whilst the frequency of occurrence of these events is not considered to be a function of the separation minimum applied, it will be essential for RPGs to institute measures to ensure that the risk due to operational errors and in-flight contingencies does not increase following the reduction of vertical separation from 600 m to 300 m (2 000 ft to 1 000 ft). Guidance on the type of measures to be taken by RPGs, ATC and flight crews is outlined in Chapters 5 and 6. 2.1.9 In comparing estimated risk with a target risk value, such as a TLS, regional authorities should take into account the estimation method applied, its accuracy, its assumptions and the intended scope of applicability of the target risk value when making the final operational judgement as to whether implementation of RVSM will adversely affect overall airspace safety. Manual on Implementation of a 300 m (1 000 ft) Vertical 2-2 Separation Minimum Between FL 290 and FL 410 Inclusive 2.2 GLOBAL SYSTEM PERFORMANCE SPECIFICATION 2.2.1 The global system performance specification is a statement of the parameters that form the basis for defining the integrated set of requirements for aircraft height-keeping, aircraft systems, aircraft operating proce- dures, ATC procedures and monitoring practices presented in this manual. The global system performance specification defines the height-keeping performance necessary to meet the safety goal for RVSM technical risk (see 2.1). This level of height-keeping performance depends on specific values of important airspace parameters affecting the risk of collision should vertical separation be lost. The height-keeping performance requirement of the system performance specification is expressed as the maximum value for the probability that aircraft will lose vertical separation equal to the RVSM value, Pz(1 000). The important airspace parameters concern the frequency with which aircraft pass while having procedural vertical separa- tion equal to RVSM and actual horizontal separation less than the horizontal size of an aircraft. These important airspace parameters may be expressed in different ways, depending on the route structure of the airspace. 2.2.2 The global system performance specification was originally derived for opposite-direction traffic. In that case, the important airspace parameters are the frequency with which aircraft pass while having procedural vertical separation equal to RVSM and no nominal horizontal separation, and the standard deviation of the error with which aircraft maintain assigned track in the lateral dimension. The quantitative statements of the global system performance specification are: a) a passing frequency equal to 2.5 opposite-direction passings per aircraft flight hour; b) a standard deviation of lateral path-keeping error equal to 550 m (0.3 NM); and c) a probability that two aircraft will lose procedural vertical separation of RVSM value, Pz(1 000), equal to 1.7 × 10-8. The values for passing frequency and the standard deviation of lateral path-keeping were chosen to forecast future global airspace conditions. These choices reflect the intention to ensure that the TLS will continue to be met with the anticipated increase in global traffic volume and expected technological improvements in navigation. 2.2.3 The global system performance specification in 2.2.2 is based on factoring the frequency with which aircraft pass, with an actual horizontal separation of less than the horizontal size of an aircraft, into a longitudinal and a lateral component. A standard deviation of lateral path-keeping error of 550 m (0.3 NM) produces a probability of lateral overlap of 0.058 for aircraft on the same track. The combined effect of the requirements of 2.2.2 a) and b) on vertical collision risk is equal to 2.5 × 0.058 = 0.145. Therefore, an equivalent but more generally applicable quantitative statement of the global system performance specification is: a) a frequency of opposite-direction passing events involving lateral overlap equal to 0.145 passings per aircraft flight hour; and b) a probability that two aircraft will lose procedural vertical separation of RVSM value, Pz (1 000), equal to 1.7 × 10-8. 2.2.4 Although the global system performance speci- fication was derived and formulated in terms of opposite- direction traffic, it also applies to other route structures, e.g. same-direction traffic, crossing traffic and combinations thereof. For each type of route structure, an equivalent form of the global system performance specification exists (for further details see 6.2.5 and Appendix A). Trade-off between global system performance specification parameters 2.2.5 The parameters of the global system per- formance specification consist of the height-keeping performance on the one hand and the specified airspace parameters on the other. This allows for two types of trade-offs between these parameters, depending on the value of the probability of vertical overlap, Pz(1 000), i.e. whether Pz(1 000) is equal to or well below the value of 1.7 × 10-8, as defined in the global system performance specification. However, Pz(1 000) may never be allowed to exceed the value of 1.7 × 10-8. 2.2.6 The first type of trade-off that may be used is between the airspace parameters of passing frequency and the standard deviation of lateral path-keeping error, provided that the probability of vertical overlap is not greater than 1.7 × 10-8. These two airspace parameters may be traded off against one another provided that their joint effect on vertical collision risk is not greater than that due to an opposite-direction passing frequency of 2.5 passings per aircraft flight hour and a lateral path-keeping error Chapter 2. General Requirements 2-3 standard deviation of 550 m (0.3 NM). The numerical bound for this joint effect is 0.145 (see also 2.2.3). Thus, either a higher passing frequency in combination with less accurate lateral path-keeping or a lower passing frequency in combination with more accurate lateral path-keeping would be allowed as long as the bound of 0.145 was not exceeded. Note that this trade-off for opposite-direction traffic is implicit in the more general form of the global system performance specification in 2.2.3. 2.2.7 The second type of trade-off is between the probability of vertical overlap, Pz(1 000), and the airspace parameters, provided that the probability of vertical overlap is well below the value of 1.7 × 10-8. The margin provided by Pz(1 000) may then be used to increase the upper bound of 0.145 for the combined effect of passing frequency and lateral path-keeping error standard deviation. Within this larger upper bound, the two airspace parameters may be varied as set out in 2.2.6. This second type of trade-off should be performed with great care since the height- keeping performance of the aircraft population may change over time, e.g. aircraft new to the airspace under consideration are only required to meet the global Pz(1 000) value of 1.7 × 10-8 and not a lower value. 2.2.8 It should be noted that conducting the trade-off process is more complex than carrying out a straight- forward check against a fixed upper bound. The benefit, however, is more flexibility with regard to the allowable parameter values. 2.3 GLOBAL HEIGHT-KEEPING PERFORMANCE SPECIFICATION 2.3.1 In order to ensure safe transition between regions, a global height-keeping performance specification was developed so that, if met, the required Pz(1 000) value of the global system performance specification would be met. The global height-keeping performance specification applies to the aggregate of height-keeping errors of individual aircraft and simultaneously satisfies the following four requirements: a) the proportion of height-keeping errors beyond 90 m (300 ft) in magnitude is less than 2.0 × 10-3; b) the proportion of height-keeping errors beyond 150 m (500 ft) in magnitude is less than 3.5 × 10-6; c) the proportion of height-keeping errors beyond 200 m (650 ft) in magnitude is less than 1.6 × 10-7; and d) the proportion of height-keeping errors between 290 m and 320 m (950 ft and 1050 ft) in magnitude is less than 1.7 × 10-8. 2.3.2 The above requirements have been the basis for the development of the RVSM minimum aircraft system performance specification (MASPS) (see Chapter 4, 4.1). The global height-keeping performance specification is also applied in the process to monitor Pz(1 000) (see Chapter 6, 6.2). 3-1 Chapter 3 IMPLEMENTATION PLANNING 3.1 IMPLEMENTATION CONSIDERATIONS 3.1.1 The introduction of RVSM should be based on a regional air navigation agreement. This may require that States or regions establish specially designated airspace wherein aircraft are required to comply with additional ATC procedures and equipment carriage specifications. Application of these requirements and specifications must be included in Doc 7030 — Regional Supplementary Procedures and/or national aeronautical information publications where applicable. When this action is taken, all aircraft operating within the designated airspace must meet the height-keeping performance as defined in this manual. The following factors, where applicable, should be considered in the process of reaching a decision to implement RVSM: a) the costs that operators will incur in order to meet the RVSM MASPS; b) system users: types/mix of aircraft (military and civil); origin and destination of flights; primary routes and flight levels; aircraft passing frequency; c) due account should be taken of: 1) the proportion of the aircraft population that have been equipped to meet existing require- ments for RVSM operations in other regions; and 2) the requirements imposed by the future RVSM implementation plans of adjacent regions; d) airspace organization and ATC system: route structure (bi/unidirectional and crossing); desig- nated military airspace; flow control procedures; radar/procedural control; availability of secondary surveillance radar (SSR) or other means of altitude reporting capability; other airspace constraints. Additional consideration should also be given to the ability of the ATS infrastructure to fully support RVSM, including examination of the equipment and procedures necessary to achieve the goal of the elimination of operational errors; e) in the case of densely populated airspace or where the introduction of navigation systems that signifi- cantly improve the lateral track-keeping accuracy may cause violation of the technical TLS, States/regions may need to consider other options to reduce the collision risk, e.g. the application of systematic track offsets; f) the possible effects of regional meteorological conditions (e.g. severe turbulence, standing waves); and g) procedures to assist States in fulfilling their responsibilities for ensuring that aircraft on their registry, or for which they have a responsibility because they are the State of the Operator, do not operate in RVSM airspace unless approved to do so. 3.1.2 The lateral and vertical dimensions of the airspace in which RVSM is to be applied must be defined and promulgated in appropriate national and regional documentation. 3.1.3 The table of cruising levels specified in Appendix 3 of Annex 2 to the Convention on International Civil Aviation, for use in RVSM airspace, should be used. 3.2 OPERATING CONDITIONS A single statement of operating conditions and require- ments cannot encompass the many and varied airspace structures, meteorological environments, air traffic control systems, and air traffic mixes that exist in different States and regions. The following provides a basic framework which should be met as conditions of operation where RVSM airspace has been established: Manual on Implementation of a 300 m (1 000 ft) Vertical 3-2 Separation Minimum Between FL 290 and FL 410 Inclusive a) procedures must be developed to provide a transi- tion between RVSM airspace and areas maintaining a 600 m (2 000 ft) VSM; b) all operations must be conducted in accordance with instrument flight rules; c) additional plans and procedures must be developed to ensure separation is maintained in areas where meteorological conditions develop that adversely affect height-keeping performance (see 5.2.6 to 5.2.8). This should include the provision to forecast such conditions and to implement contingency plans when the conditions occur (see 5.2.7). d) strategic ATC procedures must be developed and implemented to provide adjustments when system performance monitoring indicates that established tolerances are exceeded. This action may require the introduction of flow control measures, one-way routes, systematic offset flying, or other methods; and e) contingency plans must be developed for in-flight failures (see 5.1.1g) and 5.2.4). 3.3 IMPLEMENTATION STRATEGY It is the responsibility of the appropriate RPG to determine whether or not RVSM should be introduced in the airspace of a particular region. The following steps, which together constitute an outline implementation strategy, were defined initially by the RGCSP and further refined as a result of the practical experience gained from the work in the NAT and EUR Regions. This strategy employs a formal collision risk assessment methodology as a decision-making tool in support of operational judgement. a) Step 1 — Identify the need for RVSM. This step should be conducted in consultation with provider States and user organizations and should include an assessment of: 1) the potential for an increase in the airspace system capacity; 2) the ability to provide improved vertical flight profiles to aircraft; 3) the consequences for ATS in terms of: — workload; — required facilities; — resectorization; and — transition procedures; 4) the costs to non-RVSM approved operators of having to operate outside RVSM airspace; 5) the overall cost/benefit of the implementation of RVSM; and 6) the state of RVSM implementation in adjacent regions. b) Step 2 — Preliminary assessment of system safety. This step should be undertaken to determine whether RVSM can be implemented in the defined airspace in conformance with the agreed safety objectives. This step should address conditions expected after RVSM implementation, and include: 1) an estimate of the maximum aircraft passing frequency within the region; 2) an assessment of the typical lateral track keeping accuracy of RVSM-approved aircraft of the region; 3) an evaluation of whether a TLS budget of 2.5 × 10-9 fatal accidents per flight hour, as a consequence of technical height-keeping devia- tions, can be satisfied; 4) an analysis of height deviations as a conse- quence of operational errors and emergency actions. This should assess the frequency of occurrence of such deviations together with an assessment of the level of risk of collision in the existing environment and in the planned RVSM airspace, the causes of the errors, and recom- mended measures to reduce the risk in RVSM airspace. Possible sources of information include: — incident and/or occurrence reports of inadvertent departures from assigned flight levels; — transponder height data; — routine position reports that may identify operations at an incorrect flight level; and — specific data collection; Chapter 3. Implementation Planning 3-3 5) an evaluation of whether the overall risk objectives (see 2.1) can be satisfied; and 6) consideration of any other operational problems which may affect safety, e.g. wake turbulence (see also 6.3). c) Step 3 — Planning and preparation. This step should include: 1) the continued consultation, cooperation and commitment of regulatory authorities, ATS providers and airspace users; 2) the development of a detailed work programme and identification of those issues which lie on the critical path. The programme should incorporate: — implementation considerations and require- ments (Section 3.1); — airworthiness issues (Section 4.2); — procedures for the State approval of aircraft (Section 4.3); — flight crew operating procedures (Section 5.1) and training; — ATC system requirements, simulations, procedures and training (Section 5.2); — system performance monitoring consider- ations (Chapter 6); — if applicable, an agreed means of handling non-RVSM approved aircraft; — completion of any remedial measures necessary; and — possible requirements for phased implement- ation; 3) regional agreement on implementation time- scales. d) Step 4 — Verification phase. Before commencing this phase, it is essential that a high proportion of the anticipated RVSM aircraft population meet RVSM requirements. Further, an appropriate means of monitoring aircraft height-keeping should be in place if sufficient height-keeping data are not already available. The verification process will take place over an agreed period of time during which the total system operation will be evaluated in the existing 600 m (2 000 ft) VSM environment. This phase should continue until: 1) it has been demonstrated that RVSM approval requirements and related guidance material are adequate, in the sense that compliance with such requirements leads to an observed height- keeping performance consistent with the global height-keeping performance specification of 2.3; and 2) the causes of observed errors inconsistent with the global height-keeping performance speci- fication have been remedied; and 3) the technical TLS of 2.5 × 10-9 fatal accidents per aircraft flight hour has been met with a predetermined level of statistical confidence; 4) the system integrity has been verified; this should include confirmation, with a predeter- mined level of statistical confidence, that the introduction of RVSM does not increase the risk due to operational errors and in-flight contingencies. This may require the implementation of additional effective safety measures to reduce the risk as a result of these events; and 5) if quantification of the level of overall risk indicates, with a predetermined level of confidence, that the overall safety objectives (see 2.1) will be violated in an RVSM environment, additional effective safety measures need to be determined and implemented in order to meet the overall safety objectives. e) Step 5 — Operational use of RVSM. The commencement of the 300 m (1 000 ft) RVSM operations will be conditional upon the satisfactory completion of the 600 m (2 000 ft) verification phase. At the beginning of the operational application of RVSM, a comprehensive evaluation of all elements of RVSM operations should be carried out. After this evaluation, it will be necessary to ensure continued system safety. Particular attention will be required to ensure that: 1) all aircraft operating in RVSM airspace are RVSM approved; Manual on Implementation of a 300 m (1 000 ft) Vertical 3-4 Separation Minimum Between FL 290 and FL 410 Inclusive 2) the RVSM approval process remains effective; 3) the TLS of 2.5 × 10-9 fatal accidents per aircraft flight hour (in respect of monitored technical height-keeping performance of a representative sample of the aircraft population) continues to be met with a predetermined level of statistical confidence; 4) with a predetermined level of statistical con- fidence, the introduction of RVSM does not increase the level of risk due to operational errors and in-flight contingencies; 5) additional safety measures, introduced to reduce the risk as a result of operational errors and in-flight contingencies and to meet the overall safety objectives (see 2.1), are effective; 6) evidence of altimetry system error (ASE) stability exists (see Chapter 6); and 7) ATC procedures remain effective. 4-1 Chapter 4 AIRCRAFT REQUIREMENTS AND APPROVAL 4.1 RVSM HEIGHT-KEEPING PERFORMANCE 4.1.1 In accordance with the conclusions of the RGCSP/6 Meeting (Doc 9536), altimetry system and altitude-keeping characteristics were developed to satisfy the global height-keeping performance specification as described in 2.3. They describe the performance level that aircraft need to be capable of achieving in service, exclusive of Human Factors and extreme environmental influences, if the airspace system TVE requirements are to be satisfied. 4.1.2 The aforementioned characteristics were trans- lated by technical bodies into airworthiness standards through the assessment of the characteristics of ASE and automatic altitude control. These standards comprise the in-service aircraft height-keeping requirements for RVSM operations and form part of the RVSM MASPS. The RVSM MASPS include specifications and procedures for the separate aspects of type approval, release from production, and continued airworthiness and is included in the following documents for global application: a) Joint Aviation Authority (JAA) Temporary Guidance Leaflet (TGL) No. 6 — Guidance Material on the Approval of Aircraft and Operators for Flight in Airspace above Flight Level 290 where a 300 m (1 000 ft) Vertical Separation Minimum is Applied — or any subsequent version thereof; or b) Federal Aviation Administration (FAA) Document 91-RVSM, Interim Guidance Material on the Approval of Operators/Aircraft for RVSM Operations. These documents are an acceptable means for RVSM approval and were developed in compliance with the guidance material in this manual. 4.2 AIRWORTHINESS APPROVAL Introduction 4.2.1 Airworthiness approval must in all cases be in accordance with the requirements of the RVSM MASPS. As stated in 4.1.2, the RVSM MASPS, in addition to characterizing the ASE and automatic height-keeping capability requirements, also contains specifications and procedures for type approval and continued airworthiness. 4.2.2 All approvals will be applicable to an individual aircraft or to a group of aircraft, as defined in 4.2.3, that are nominally identical in aerodynamic design and items of equipment contributing to height-keeping accuracy. Definition of aircraft type groupings 4.2.3 For aircraft to be considered as part of a group for the purposes of airworthiness approval, the following conditions should be satisfied: a) the aircraft should have been constructed to a nominally identical design and should be approved on the same Type Certificate (TC), TC amendment, or Supplemental TC, as applicable; Note.— For derivative aircraft, it may be possible to use the data from the parent configuration to minimize the amount of additional data required to show compliance. The extent of additional data required will depend on the nature of the differences between the parent aircraft and the derivative aircraft. b) the static system of each aircraft should be nominally identical. The static source error (SSE) corrections should be the same for all aircraft of the group; and Manual on Implementation of a 300 m (1 000 ft) Vertical 4-2 Separation Minimum Between FL 290 and FL 410 Inclusive c) the avionics units installed on each aircraft to meet the minimum RVSM equipment criteria should comply with the manufacturer’s same specification and have the same part number. Note.— Aircraft that have avionics units which are of a different manufacturer or part number may be considered part of the group if it can be demonstrated that this standard of avionics equipment provides equivalent system performance. 4.2.4 If an airframe does not meet the conditions of 4.2.3 a) to c) to qualify as a part of a group, and is presented as an individual airframe for approval, then it will be considered to be a non-group aircraft. The significance of this is that the certification processes for group and non-group aircraft are different. Continued airworthiness 4.2.5 It is imperative that all aircraft continue, during their service life, to satisfy the requirements of the RVSM MASPS. While height-monitoring data from independent sources, as recommended by ICAO, should help to detect any long-term deterioration in altimetry system perform- ance, it is nevertheless essential that certifying authorities ensure that, as part of the approval process, operator maintenance and inspection practices are reviewed and updated to reflect the specific airworthiness requirements applicable to RVSM operations. 4.3 STATE RVSM APPROVAL Approval process 4.3.1 Where RVSM is applied, the specific aircraft type or types that the operator intends to use will need to be approved by the State of Registry of the aircraft or of the aircraft operator. RVSM approval will encompass the following elements: a) Airworthiness approval (including continued airworthiness). The aircraft will be approved as meeting the requirements of the appropriate State airworthiness document derived from the height- keeping capability requirements as defined by the RVSM MASPS. Furthermore, the aircraft altimetry and height-keeping equipment must be maintained in accordance with approved procedures and servicing schedules. b) Operational approval. As defined by ICAO regional air navigation agreements, it may be necessary for an operator to hold a separate RVSM-specific operational approval in addition to an RVSM airworthiness approval to operate in RVSM airspace. Section 5.1 contains guidance on operational procedures that an operator may need to adopt for such airspace where RVSM is applied, including advice on the material that may need to be submitted for review by the authority responsible. Validity of approval 4.3.2 RVSM approval issued for one region will always be valid for RVSM operations in another region provided that specific operational approval as in 4.3.1 b) is not required. Confirmation of approval status 4.3.3 Implementation of RVSM is dependent on the establishment of an aircraft approval confirmation process, which is intended to exclude unqualified aircraft and operators from operating in RVSM airspace unless the appropriate separation is applied. The process may have regional variations, but the primary responsibility for confirmation of the approval status of an aircraft/operator must rest with the State of the Operator/State of Registry. The confirmation process will be facilitated by the application of the following measures: a) maintaining a comprehensive record of all approvals granted for operations in RVSM airspace; b) providing the approvals records in 4.3.3 a) to the regional monitoring agency (RMA) for inclusion in its regional RVSM-approvals database; and c) including a check of the approval status of aircraft/operators in the schedule of routine in-flight inspections. 4.3.4 At the appropriate level, a secondary responsi- bility should rest with the ATS provider States to institute routine checks of the approval status of aircraft operating within their area of authority and intending to operate in RVSM airspace. This responsibility could be met by: a) scrutinizing ATS flight plans; b) conducting cross-checks against the regional RVSM-approvals database, taking into account the currency of its contents; and Chapter 4. Aircraft Requirements and Approval 4-3 c) querying operators that are suspected of not being in compliance with the airspace requirements. 4.3.5 Dependent on State regulations, clearances may be withheld for operations that are not in compliance with the airspace requirements. 4.3.6 In conjunction with the ATS provider States, a further level of confirmation of approval can be effected by the RMA of a region in which RVSM applies. This can be achieved by the RMA taking action, following a query by a controlling authority, to obtain confirmation of approval status from the State of the Operator/State of Registry of aircraft which are not listed in a regional RVSM-approvals database. Note.— The role of the RMA is covered in detail in 6.4.4. 4.3.7 The State of the Operator/State of Registry should formulate policies and courses of action with respect to aircraft/operators that are found to be operating in RVSM airspace without approval, which could jeopardize the safety of other users of the airspace. 5-1 Chapter 5 PROCEDURES 5.1 FLIGHT CREW OPERATING PROCEDURES In-flight procedures 5.1.1 Generally, flight crew operating procedures in RVSM airspace are no different than those in any other airspace; however, the implementation of RVSM may necessitate changes to some procedures specific to a region, e.g. contingency procedures, and should be reflected in regional documentation. Given the safety requirements and the effect large height deviations could have on the risk levels, crews should be reminded to exercise vigilance to minimize the occurrence of deviations from the cleared flight level. To this end, during routine training, flight crews should be reminded of the importance of adhering to the following in-flight procedures: a) in level cruise it is essential that the aircraft be flown at the cleared flight level (CFL). This requires that particular care be taken to ensure that ATC clearances are fully understood and complied with. Except in the event of an emergency, the aircraft should not intentionally depart from CFL without a clearance from ATC; b) during cleared transition between levels, the aircraft should not be allowed to overshoot or undershoot the new flight level by more than 45 m (150 ft); Note.—The transition should be accomplished using the altitude capture feature of the automatic altitude-keeping device, if installed. c) an automatic altitude-keeping device should be operative and engaged during level cruise, except when circumstances such as turbulence or the need to retrim the aircraft require its disengagement. In any event, adherence to cruise altitude should be done by reference to one of the two altimeters required by the RVSM MASPS; d) the altitude-alerting device should be operating and engaged; e) regular (hourly) cross-checks between the altimeters should be made, and a minimum of two RVSM MASPS-compliant systems must agree within 60 m (200 ft). Failure to meet this condition will require that the system be reported as defective and notified to ATC; f) the operating altitude-reporting transponder should be connected to the RVSM MASPS-compliant altimetry system being used to control the aircraft; g) before entering RVSM airspace, the pilot should review the status of equipment required. The following equipment should be operating normally: 1) two altitude measurement systems, as defined by the RVSM MASPS; 2) automatic altitude-keeping device(s); Note.—Redundancy requirements for altitude- keeping devices should be established by regional agreement after an evaluation of such criteria as mean time between failures, length of flight segments and availability of direct pilot-controller communications and radar surveillance. 3) at least one altitude-reporting transponder (if required for operation in that specific RVSM airspace) capable of being switched to operate from either of the two altimetry systems required by the RVSM MASPS; and 4) one altitude-alerting device; Should any of this equipment fail prior to the aircraft entering RVSM airspace, the pilot should request a new clearance so as to avoid flight in this airspace. Manual on Implementation of a 300 m (1 000 ft) Vertical 5-2 Separation Minimum Between FL 290 and FL 410 Inclusive h) the following contingency procedures should be adhered to after entering RVSM airspace: 1) the pilot should notify ATC of contingencies (equipment failures, weather conditions) in which the ability to maintain CFL is affected and coordinate a plan of action (see 5.2.4); 2) equipment failures should be notified to ATC. Some examples are: — failure of all automatic altitude-keeping devices on board the aircraft; — loss of redundancy of altimetry systems, or any part of these, on board the aircraft; — failure of all altitude-reporting transponders; — loss of thrust on an engine necessitating descent; and — any other equipment failure affecting the ability to maintain CFL; 3) the pilot should notify ATC when encountering severe turbulence; and 4) if unable to notify ATC and obtain an ATC clearance prior to deviating from the assigned CFL, the pilot should follow established contingency procedures as defined by the region of operation and obtain ATC clearance as soon as possible. Operations manual 5.1.2 Where applicable, aircraft operators should revise their operations manuals to reflect any differences in standard operating procedures that result from operation in RVSM airspace. 5.2 ATC PROCEDURES General 5.2.1 RVSM implementation requires that ATC procedures be developed and appropriate training provided. As a basis for the development of regional procedures, consideration should be given to the following: a) increased vigilance in light of the additional flight levels and changes in traffic flow direction by flight level relative to the 600 m (2 000 ft) VSM above FL 290; b) appropriate action to be taken by controllers in the following situations: 1) aircraft known not to be suitably equipped are flight planned into RVSM airspace; 2) an aircraft informs ATC that the capability to maintain a CFL appropriate to RVSM require- ments has been lost; 3) the pilot advises that the automatic altitude- keeping device has been turned off; and 4) the displayed altitude differs from the CFL by 90 m (300 ft) or more. Note 1.— While not necessary to support RVSM implementation, the availability of altitude display is beneficial. Note 2.— Consideration should be given to the need to modify ATC systems to support RVSM implementation. Transition procedures 5.2.2 The implementation of RVSM airspace will progress region by region until a total global application is achieved. During this period, the transitional interfaces between RVSM airspace and surrounding airspace (in which a 600 m (2 000 ft) VSM is still applied) will require careful consideration. Attention should be given, but not confined, to the following issues: a) the necessary measures to ensure that adjacent airspace and ATC can accept the increased traffic density which RVSM may cause; b) procedures for permitting non-approved aircraft to operate in transition airspace; c) procedures for separating non-approved aircraft operating in transition airspace; d) procedures for separating non-approved aircraft from approved aircraft operating in transition airspace; and Chapter 5. Procedures 5-3 e) procedures for accomplishing the transition. This requires detailed planning, which shall determine, for example, the specific points where traffic will be directed to diverging routes and the specific points at which lateral separation will be achieved so that the altitude change may be initiated to meet the 600 m (2 000 ft) VSM. 5.2.3 Following the development of the afore- mentioned ATC transition procedures, the following should be accomplished: a) testing the plan through simulation; and b) coordinating responsibilities among all ATC facilities concerned. ATC contingency procedures 5.2.4 In addition to emergency conditions that require immediate descent, such as loss of thrust or pressurization, ATC shall be made aware of any conditions that may make it impossible for an aircraft to maintain its CFL. Controllers should be trained regarding the appropriate action to take in the event that they are notified by the pilot of any such condition, as described in 5.1.1 h). Suggested actions in the event of such an occurrence are: a) obtain the pilot’s intentions; b) assess the traffic situation to determine if the aircraft can be accommodated through the provision of lateral, longitudinal or increased vertical separation and, if so, apply the appropriate minimum; c) when the aircraft cannot be accommodated in accordance with b), ascertain if the aircraft can maintain altitude in accordance with the requirements applicable below RVSM airspace. If so, and if the pilot confirms it to be operationally feasible, the controller should issue a revised clearance to a level outside RVSM airspace when traffic permits; and d) handle aircraft that cannot be accommodated in accordance with either b) or c) as an emergency and take whatever action is necessary to provide the appropriate separation. Military operations 5.2.5 States are reminded of the recognized responsibility in regard to military traffic as specified in the Procedures for Air Navigation Services — Air Traffic Management (PANS-ATM, Doc 4444), Part II, Section 6. In this regard, procedures must be developed to accommodate military flight operations that do not meet the equipment requirements of RVSM MASPS (see 4.1 to 4.2). These procedures must specify how military flight operations in RVSM airspace are to be accommodated, but segregated from air traffic being provided with a 300 m (1 000 ft) VSM above FL 290. Suggested methods of accomplishing this are: a) the provision of temporary airspace reservations; b) the provision of block altitudes; c) the provision of special routes applicable only to military aircraft; and d) the provision of special routes applicable to air traffic requiring a 600 m (2 000 ft) VSM above FL 290. Meteorological conditions 5.2.6 Meteorological conditions that can cause turbulence which can be detrimental to accurate height-keeping include: a) gravity shear waves; b) thunderstorms; c) orographic flow. 5.2.7 Orographic flow, more commonly known as mountain wave activity, has been identified as being particularly detrimental to accurate height-keeping. Prior to implementation of RVSM, States known to have airspace susceptible to orographic flow should: a) assign responsibility for forecasting such conditions; and b) detail the action required by ATC on receipt of such forecasts. 5.2.8 When reports of severe turbulence are received, ATC must ascertain the capability of the aircraft to maintain CFL. Upon confirmation that meteorological conditions are affecting, or are likely to affect, height-keeping accuracy, Manual on Implementation of a 300 m (1 000 ft) Vertical 5-4 Separation Minimum Between FL 290 and FL 410 Inclusive ATC should be required to provide alternative separation as soon as possible. Additionally, when any of the meteorological conditions listed in 5.2.6 are expected to prevail over an area for an extended time period, the appropriate ATC authority should consider: a) issuing a NOTAM specifying the routes or area affected; and b) temporarily suspending the use of 300 m (1 000 ft) VSM in the affected area. 6-1 Chapter 6 SYSTEM PERFORMANCE MONITORING 6.1 REQUIREMENT FOR MONITORING 6.1.1 System performance monitoring is necessary to ensure that the implementation and continued operation of RVSM meet the safety objectives (see 2.1). For practical purposes, a distinction can be made about the monitoring process in the context of: a) the risk associated with the aircraft technical height- keeping performance (technical risk), and b) the overall risk, i.e. due to all causes. 6.1.2 For 6.1.1 a), the monitoring process should aim to achieve the following: a) provide confidence that the technical TLS of 2.5 × 10-9 fatal accidents per aircraft flight hour will be met when RVSM is implemented and will continue to be met thereafter; b) provide guidance on the efficacy of the RVSM MASPS and on the effectiveness of altimetry system modifications; and c) provide evidence of ASE stability. The monitoring objective of 6.1.2 a) can be achieved by an accepted method of assessing the collision risk due to the loss of vertical separation, based on the use of the Reich CRM. Further guidance on the process and methods of achieving the monitoring objectives of 6.1.2 a), b) and c) is provided in 6.2. 6.1.3 For 6.1.1 b), the monitoring process should take into account the additional risk associated with operational errors and in-flight contingencies. This part of the monitoring process is aimed particularly at providing confidence that the regionally agreed overall safety objectives will be met after RVSM is implemented. Guidance on monitoring system performance in terms of the risk due to operational errors and in-flight contingencies is provided in 6.3. 6.2 MONITORING THE TECHNICAL PERFORMANCE Parameters of the collision risk model 6.2.1 In order to provide confidence that the technical TLS is being met (objective 6.1.2. a)), it is necessary to assess, through monitoring on a continual basis, the values of particular parameters of the CRM. 6.2.2 The CRM parameters fall into two groups from the standpoint of monitoring requirements and have been depicted in Figure 6-1. The first group consists of two parameters that are critical to safety assessment. The first parameter of this group (Item a) in Figure 6-1)) is a measure of the height-keeping performance of the overall aircraft population, termed the “vertical overlap probability” and denoted as Pz(1 000). The second (Item b) in Figure 6-1)) is an airspace parameter characterizing the exposure to vertical collision risk, i.e. a measure of the number of aircraft passing events involving horizontal overlap per aircraft per hour. For the cases of same- and opposite-direction traffic, this parameter may be factored into two parts. One part is a measure of the number of aircraft passing events (involving longitudinal overlap) per aircraft flying hour, termed the “passing frequency”; and the other part is a measure of the lateral path-keeping performance, termed the “lateral overlap probability” and denoted as Py(0). 6.2.3 The second group of CRM parameters, which includes such things as aircraft speed and length, is less demanding in terms of the resources required to collect the requisite data. This is because the CRM is relatively insensitive to these parameter values and also because these values are not expected to change substantially over the planning horizon of this manual. They should be reassessed periodically to ensure that their values reflect the current RVSM airspace system. 6.2.4 Many different combinations of the parameter values of the first group may lead to compliance with the Manual on Implementation of a 300 m (1 000 ft) Vertical 6-2 Separation Minimum Between FL 290 and FL 410 Inclusive technical TLS. One particular combination of such values is that used in the initial assessment which led to the first implementation of RVSM, i.e. the criteria laid down in the global system performance specification (see 2.2). Thus, a convenient way of providing confidence that the technical TLS will be met is by monitoring compliance with the criteria of the global system performance specification (GSPS). If, however, all of the individual GSPS criteria cannot be met, it may then be necessary to consider a trade-off between the parameters as set out in 2.2.5 to 2.2.8. The process is outlined below, and additional technical details are given in Appendix A. Assessment and evaluation of technical height-keeping errors 6.2.5 Monitoring of the first group of parameters identified in 6.2.2 comprises the essential part of system performance monitoring. Since the calculation of risk changes proportionally with these parameters, monitoring procedures must be established to ensure that the following criteria for these parameters are not simultaneously exceeded: a) the combination of all passing frequency com- ponents has no more of an adverse effect on risk than does a frequency of 0.145 opposite-direction passing events involving horizontal overlap per aircraft flight hour; and b) the vertical overlap probability, Pz(1 000), does not exceed 1.7 × 10-8. If either of these criteria is not satisfied, the collision risk should be reassessed to ensure that the technical TLS is not being exceeded. If criterion b) is not satisfied, remedial action should be taken since this indicates that the RVSM MASPS are not sufficiently effective. If only criterion a) is not satisfied, then a trade-off between vertical overlap probability and the combined frequency of all passing events involving horizontal overlap may be possible as outlined in 2.2.7, provided that the technical TLS is not exceeded. If such a trade-off is not possible, then remedial action should be taken on the frequency of passing events involving horizontal overlap. 6.2.6 In those cases where it is possible to factor the frequency of passing events involving horizontal overlap into a longitudinal and a lateral part, monitoring of the first group of parameters can be performed by ensuring that the following criteria are not simultaneously exceeded: a) the vertical overlap probability, Pz(1 000), does not exceed 1.7 × 10-8; b) the combination of all passing frequency com- ponents has no more of an adverse effect on risk than does an opposite-direction passing frequency of 2.5 per aircraft flying hour; and Figure 6-1. Subdivision of CRM parameters from the standpoint of monitoring requirements CRM parameters for monitoring First group Second group a) vertical overlap probability, Pz (1 000) b) airspace parameter (exposure to vertical collision risk): For opposite and same direction: 1) passing frequency 2) lateral overlap probability, Py(0). For crossing and direct routings: “Frequency of passing events involving horizontal overlap” c) aircraft relative speeds d) aircraft dimensions Chapter 6. System Performance Monitoring 6-3 c) the lateral overlap probability, Py(0), is not greater than 0.058 (this is based on a lateral path-keeping accuracy standard deviation of 550 m (0.3 NM)). If any one of these criteria is exceeded, the collision risk probability should be reassessed to ensure that the technical TLS is not being exceeded, and remedial action should be taken. 6.2.7 The assessment of these criteria is considered below, and quantitative details of the trade-off process are provided in Appendix A. Monitoring of Pz(1 000) 6.2.8 The assessment of Pz(1 000) is a difficult mathematical process. To continually assess whether the value of 1.7 × 10-8 is being exceeded or not, a global height-keeping performance specification (below) has been established. The specification, which must be met for the aggregate of TVE performance in the airspace, is the simultaneous satisfaction of the following four require- ments: a) the proportion of TVE beyond 90 m (300 ft) in magnitude is less than 2.0 x 10-3; b) the proportion of TVE beyond 150 m (500 ft) in magnitude is less than 3.5 x 10-6; c) the proportion of TVE beyond 200 m (650 ft) in magnitude is less than 1.6 x 10-7; and d) the proportion of TVE between 290 m and 320 m (950 ft and 1 050 ft) in magnitude is less than 1.7 × 10-8. 6.2.9 From the above, it can be seen that an assessment of TVE is critical to an assessment of Pz(1 000). As a result, the accuracy with which TVE can be measured is an important concern. The best overall method of measuring TVE is by comparing the geometric height of an aircraft, as measured by precision radar, to the geometric height of its assigned flight level. This accuracy should be such that the mean measurement error is 0 m (0 ft) and the standard deviation of measurement error does not exceed 15 m (50 ft). 6.2.10 Large amounts of TVE data are needed to draw inference from the monitoring process with a high level of confidence, but practically such large amounts of data are difficult to obtain. The estimation of TVE through joint assessment of assigned altitude deviation and altimetry system error data may assist in this process. The methodology for the collection and/or calculation of TVE (from component errors) is set out in Appendix A. 6.2.11 Additionally, Appendix A describes a four- element approach for the collection and assessment of height-keeping performance data in the verification phase. This approach would allow the RPG to gain a growing statistical confidence in meeting the safety and monitoring objectives throughout the verification phase. Monitoring the frequency of aircraft passing events involving horizontal overlap 6.2.12 The generalized form of the global system performance specification in 2.2.3 requires that the combination of the frequency of all aircraft passing events involving horizontal overlap does not have any more of an adverse effect on risk than does a frequency of 0.145 opposite-direction passing events involving horizontal overlap per aircraft flying hour. This value is the equivalent of the product of the criteria for opposite-direction passing frequency and the lateral overlap probability specified by the original global system performance specification. The background of the latter two criteria is outlined in 6.2.6; however, the generalized form is better suited to crossing traffic and direct routings. Monitoring aircraft passing frequency 6.2.13 The global system performance specification given in 2.2 requires that the aircraft passing frequency in RVSM airspace does not have any more of an adverse effect on the risk of mid-air collision than does an opposite-direction passing frequency of 2.5 aircraft passings per aircraft flying hour. This passing frequency value was agreed to by the RGCSP, based on an assessment of the annual average passing frequency over the whole airspace of three adjacent area control centres (ACCs) covering the region’s busiest traffic flows or highest passing frequency. The use of these adjacent ACCs covering the highest passing frequency was to address the problem of high traffic flows where higher-than-average collision risk may pertain. 6.2.14 ATC authorities must conduct an annual review of either the frequency of aircraft passings involving horizontal overlap or those involving longitudinal overlap, based on traffic movement data from the airspace. Appendix A provides methods of estimating the frequency of these aircraft passings. Manual on Implementation of a 300 m (1 000 ft) Vertical 6-4 Separation Minimum Between FL 290 and FL 410 Inclusive Monitoring lateral overlap probability 6.2.15 As part of the process to assess the lateral overlap probability, the RMA should periodically assess lateral path-keeping performance in the airspace concerned. This is due to the fact that, other factors remaining constant, better lateral path-keeping accuracy increases the risk of collision in the event of a loss of a 300 m (1 000 ft) vertical separation. It is also important that planning authorities recognize that the CRM is directly affected by changes in aircraft lateral path-keeping accuracy, and they should appreciate the potential change to risk levels resulting from any mandatory changes, or otherwise, in aircraft navigation equipage. Appendix A provides suggested methods for carrying out this function. Monitoring other CRM parameters 6.2.16 The remaining CRM parameters are average aircraft speed, relative speed between aircraft, and average aircraft length, width and height within RVSM airspace. As stated previously, either the risk of a mid-air collision is relatively insensitive to these parameter values, or the values are not expected to change substantially over the planning horizon of this manual. Intensive monitoring of the values of these parameters should not be necessary. The RMA should be aware of their relative importance in the overall process of ensuring that system safety is maintained and should assess their likely values on a periodic basis using whatever means are deemed appropriate. The values of these parameters, as well as all others upon which the global system performance specification is based, are listed in Appendix A. Other aspects of monitoring the technical performance 6.2.17 It can be seen from the above discussion that the risk due solely to aircraft technical height-keeping performance may be estimated by collecting appropriate data in order to produce values for a number of parameters for use in a collision risk model. This allows for assessments of risk against the TLS to be carried out pre- and post-RVSM implementation, thus satisfying the objective of 6.1.2 a). Furthermore, the process, as illustrated, requires that altimetry system error data be collected, and this data can be used to assess the efficacy of the RVSM MASPS and to provide evidence of ASE stability, thus satisfying the objectives at 6.1.2 b) and c). To satisfy the objective of 6.1.3, an assessment and evaluation of operational errors are also required and these are covered in section 6.3. 6.2.18 It should be noted that the monitoring requirements, in particular the measurement of TVE, have been established at a stringent level appropriate to an initial application in the first region to implement RVSM. As a result of this initial work, the data collected and operational experience gained, some relaxation in the monitoring requirements may be possible, both in this first region and in other regions where RVSM is introduced as a part of the global implementation process. For example, if it could be shown that there is no significant correlation between an operator and the technical height-keeping capability of its aircraft, then consideration may be given to the use of TVE data of a specific aircraft type collected in one regional RVSM implementation programme to make an estimate of Pz(1 000) in another region, thereby removing the necessity to collect TVE data on all aircraft of that type prior to the introduction of RVSM. Therefore, regional planning groups will meet to obtain monitoring data from RMAs in regions where implementation has already taken place to determine the extent of their monitoring programmes. Ultimately, a regional implementation may not require any TVE data to be collected in order to assess the risk against the technical TLS. However, the requirement to collect data on operational errors and in-flight contingencies to assess the overall risk will still be a requirement because these sorts of errors will be region-specific. For information on regional implementation programmes, refer to the documentation list in Appendix B. 6.3 ASSESSMENT AND EVALUATION OF OPERATIONAL ERRORS AND IN-FLIGHT CONTINGENCIES 6.3.1 In order to meet the monitoring objective as outlined in 6.1.1 b), it will be necessary for the RPG to assess and evaluate the impact of RVSM on the risk due to operational errors and in-flight contingencies. The frequency of occurrence of these errors is not considered to be a function of the separation minima applied. The RPG should institute such measures as necessary to ensure that the level of collision risk from these causes is no greater in RVSM airspace than that experienced with a VSM of 600 m (2 000 ft). These measures are detailed in 6.4.4 as part of the tasks of the RMA. 6.3.2 The monitoring process will involve the collection of operational data, and appropriate method- ologies will need to be available to process this data to enable comparison with regionally agreed overall safety objectives. The operational data may come from sources such as mandatory occurrence reports, airmiss data or near mid-air collision reports. RPGs and others concerned with Chapter 6. System Performance Monitoring 6-5 reviewing and acting on these reports should be prepared to take action as necessary. Follow-up activity, in the case of an unacceptable risk increase, should be based on a thorough assessment of the cause of the risk increase, with increased monitoring vigilance to ascertain that the follow-up actions have the required risk-compensation and/or risk-reducing effect. 6.3.3 Details of the assessment of the risk associated with operational errors and in-flight contingencies are provided in Appendix A. 6.4 RESPONSIBILITIES OF THE AUTHORITIES Introduction 6.4.1 The methodology used to progress the evalua- tion of system performance is described in relation to the specific tasks of the various bodies and units which form a typical regional organization: a) regional planning group; b) regional monitoring agency; and c) air traffic control. Responsibilities of the regional planning group (RPG) 6.4.2 The overall responsibility for deciding that RVSM should be implemented and continued rests with the RPG (see also 3.1). 6.4.3 The organization and overall control of the system and height-keeping performance monitoring mechanisms rests with the RPG. The following points are of particular importance: a) determining the system and height-keeping perform- ance monitoring mechanisms for which requirements have been presented in this section and expanded upon in Appendix A; b) recommending measures for the recovery of costs associated with a height-keeping performance monitoring mechanism; c) establishing an RMA (see 6.4.4). This should include detailed operating procedures and standard letter and report formats; and d) requiring the RPG to conduct an annual review of all aspects of the system’s operation. Any review should include: 1) an assessment of the system safety; 2) the verification or amendment of the parameters employed in the CRM; 3) the scrutiny of data and reports from the RMA; 4) the recommendation of measures to reduce system risk and to improve height-keeping performance; and 5) the recommendation of improvements to the monitoring process. Responsibilities of a regional monitoring agency (RMA) 6.4.4 The experience gained through the monitoring of NAT MNPS RVSM operations indicates that the concept of having an RMA for each region in which RVSM is introduced is essential to safety. The RMA will have a significant role to play in all aspects of the monitoring process, but one of its priorities will be to establish a database of aircraft approved by the respective State authorities for operations at RVSM levels in that region. This is an essential part of the monitoring process because this information is of vital importance if the height-keeping performance data collected by the monitoring systems is to be of use in the risk assessment. RMAs in regions that have previously established such databases share approvals and height-monitoring data among each other, which should facilitate the transfer of this data to regions where new RVSM implementation programmes are being established. 6.4.5 Further to 6.4.4, typical duties of an RMA are as follows: a) to receive reports of those height deviations of non-compliant aircraft which are of a magnitude equal to or greater than the following criteria: 1) TVE — 90 m (300 ft); 2) ASE — 75 m (245 ft); and 3) AAD — 90 m (300 ft). Note.— The above figures are absolute values and do not include any measurement error in the height- Manual on Implementation of a 300 m (1 000 ft) Vertical 6-6 Separation Minimum Between FL 290 and FL 410 Inclusive monitoring system employed. The threshold at which follow-up action is initiated should take account of the inherent inaccuracy of the monitoring system. b) to take necessary action with the relevant State and operator to: 1) determine the likely cause of the height deviation; and 2) verify the approval status of the relevant operator; c) to recommend, wherever possible, remedial action; d) to analyse data to detect height deviation trends and, hence, to take action as in c); e) to undertake such data collections as required by the RPG to: 1) investigate height-keeping performance of the aircraft in the core of the distribution; 2) establish or add to a database on the height- keeping performance of: — the aircraft population; — aircraft types or categories; and — individual airframes; f) to monitor the level of risk of collision as a consequence of operational errors and in-flight contingencies as follows: 1) establish a mechanism for collation and analysis of all reports of height deviations of 90 m (300 ft) or more resulting from the above errors/actions; 2) determine, wherever possible, the root cause of each deviation together with its size and duration; 3) calculate the frequency of occurrence; 4) assess the overall risk (technical combined with operational and in-flight contingencies) in the system against the overall safety objectives (see 2.1); and 5) initiate remedial action as required. It is important to bear in mind that height deviations, as a consequence of operational errors and in-flight contingencies, occur in all airspace irrespective of the separation minimum. The purpose of this monitoring activity is to ensure that operations in RVSM airspace do not induce an increase in the risk of collision from these causes and that the total vertical risk does not exceed the agreed overall safety objectives (see 2.1). The actions/measures proposed to reduce risk should not be exclusive to RVSM airspace; g) to initiate checks on the “approval status” of aircraft operating in the relevant RVSM airspace (see 4.3.3 to 4.3.6), identify non-approved operators and aircraft using RVSM airspace and notify the appropriate State of Registry/State of the Operator accordingly; h) to circulate regular reports on all height-keeping deviations, together with such graphs and tables necessary to relate the estimated system risk to the TLS, employing the criteria detailed in 6.2.8, for which formats are suggested in Appendix A; and i) to submit annual reports to the RPG. Responsibilities of State regulatory authorities in the monitoring process 6.4.6 As part of the process to monitor compliance with the global system performance and global height- keeping performance, independent monitoring of aircraft height-keeping performance in a given region may be instigated. The RMA will be responsible for collating and analysing the height-keeping data and in the event that an RVSM-approved aircraft is monitored with an estimated ASE or TVE in excess of the limits, corrected for system measurement inaccuracy, set out at 6.4.5, will take action to inform both the appropriate State authority and the operator. The State authority will be requested to take action to help the RMA determine the cause of the error. In the event that the investigation reaches an unsatisfactory conclusion, the State authority may consider suspending or revoking the operator’s RVSM approval. Following any rectification work, the operator would again be expected to demonstrate compliance with the RVSM MASPS by ensuring that the subject aircraft has been monitored by an independent height-monitoring system at the earliest opportunity. Chapter 6. System Performance Monitoring 6-7 Role of the appropriate ATC authority in monitoring height-keeping performance 6.4.7 The ATC authority has a vital role to play in the monitoring process in that there is a need to gather information on and report any deviation equal to or greater than 90 m (300 ft), for any reason, from cleared levels whether the deviation causes an incident or not. This information will contribute to the assessment of the level of overall risk in the system. The information required by the RMA to conduct the risk assessment might, depending on the region of implementation, include the following data: a) reporting agency; b) date and time of deviation; c) location of deviation; d) airspace/operating conditions, e.g. operational air traffic (OAT)/general air traffic (GAT)/random/ organized track system (OTS) (if applicable); e) flight identification and type; f) flight level assigned; g) observed/reported final flight level Mode “C”/pilot report; h) duration not at the cleared flight level; — cause of deviation; i) other traffic; j) crew comments, if any, when notified and control- ling authority remarks. A-1 Appendix A QUANTITATIVE ASPECTS OF SYSTEM PERFORMANCE MONITORING 1. INTRODUCTION 1.1 This appendix provides guidance concerning the quantitative aspects of independent system performance monitoring associated with implementation and continued use of a reduced vertical separation minimum in an airspace. It includes the assembly, treatment and use of data necessary to demonstrate that compliance with the global system performance specification in Chapter 2, 2.2 is satisfactory. Extensive information is presented on the vertical overlap probability, Pz(1 000). This appendix also presents a height-keeping performance verification process for the implementation of RVSM and contains an example that illustrates calculations of sample-size requirements associated with the verification phase of the implement- ation strategy in a hypothetical region. 1.2 More details on the material in this appendix can be found in regional guidance material, such as the Supplement to NAT Doc 002 on risk assessment and monitoring aspects in the context of NAT RVSM. 1.3 It is important to note that the guidance in this appendix focuses primarily on the assessment of risk due to technical height-keeping deviations. When assessing the suitability of a region for RVSM implementation, con- sideration should also be given to the risk due to operational errors and in-flight contingencies. Some information on this aspect is given in Section 5 of this appendix. 2. COLLISION RISK ASSESSMENT Introduction 2.1 The use of analytical methods to guide decision- makers on the safety of an activity is generally referred to as risk assessment. Such an assessment consists of two elements: risk estimation and risk evaluation. Risk estimation refers to the process of determining the expected level of risk that will result from the activity or proposal under consideration. Risk evaluation refers to the process of deciding whether such a level of risk is acceptable. 2.2 The term risk is used to represent a numerical index of safety. When applied to any particular problem, a formal definition of risk requires specification of the units in which it will be measured. For the purpose of collision risk assessment, the units adopted here are fatal accidents per aircraft flight hour. 2.3 The risk estimation method consists of using a CRM, which expresses the risk of a mid-air collision in an airspace in terms of a number of quantifiable parameters. The risk evaluation method consists of determining that level of risk which is deemed acceptable, termed the target level of safety (TLS). It is against the TLS that the estimated risk can be compared, providing a quantitative basis for judging the safety of operations in an airspace. The collision risk model 2.4 The risk of collision to be modelled is that due to the loss of procedural vertical separation between aircraft flying above FL 290 in a given portion of an airspace. One collision between two aircraft is counted as the occurrence of two accidents. The risk of collision depends both on the total number and types of aircraft flying in the system and the system characteristics. 2.5 The CRM provides an estimate of the number of accidents within an airspace system that might occur per aircraft flight hour due to aircraft collisions resulting from the loss of procedural vertical separation in an RVSM environment. 2.6 The basic model, which can be applied equiv- alently to vertical, lateral and longitudinal separation Manual on Implementation of a 300 m (1 000 ft) Vertical A-2 Separation Minimum Between FL 290 and FL 410 Inclusive analysis, is expressed in terms of quantifiable parameters. In the vertical dimension the CRM can be broken down in order to separately model a single route on which aircraft are flying in the same or opposite directions at adjacent flight levels, pairs of crossing routes and combinations of individual and intersecting routes. A full description of the CRM can be found in the Report of the Sixth Meeting (RGCSP/6, Doc 9536) of the Review of the General Concept of Separation Panel, and its associated appendices. 2.7 Three parameters used within the basic model: the vertical overlap probability, denoted as Pz(1 000); the lateral overlap probability, denoted as Py(0); and the aircraft passing frequency, are the most important quantities in determining the vertical collision risk. Of these, the vertical overlap probability is the most difficult to estimate. 2.8 The global system performance specification stated in Chapter 2, 2.2 limits the maximum values associated with each of these parameters to ensure an acceptable level of collision risk due to the loss of procedural vertical separation throughout worldwide airspace. The global height-keeping performance speci- fication stated in Chapter 2, 2.3 presents requirements for the height-keeping performance necessary to satisfy the Pz(1 000) of the global system performance specification. 2.9 For crossing traffic and “direct-to” clearances, the generalized form of the global system performance specification stated in 2.2.3 is more appropriate. This form limits the maximum values for the vertical overlap probability and the frequency of aircraft passings involving horizontal overlap to ensure an acceptable level of collision risk due to the loss of procedural vertical separation throughout worldwide airspace. 2.10 Section 3 of this appendix discusses the monitoring of the lateral overlap probability and the aircraft passing frequency. Section 4 outlines possible methods for monitoring the vertical overlap probability and assessing whether the associated height-keeping performance specification is being met. 2.11 The remaining CRM parameters are not expected to change substantially over time. Nevertheless, RMAs should be aware, as noted in 6.2.16, of their relative importance in the overall risk assessment process and should assess their likely values on a periodic basis. The collision risk parameter values used to derive the value of Pz(1 000) of 1.7 × 10-8 necessary to meet the safety goal for RVSM technical risk (see Chapter 2, 2.1) are presented in Table A-1. The target level of safety 2.12 The TLS represents the acceptable level of risk appropriate to the decision under consideration. In aviation TLS is expressed in units of fatal accidents per aircraft flight hour, since the number rather than the individual severity of fatal accidents is what decision-makers can hope to control through the choice of separation standard values. 2.13 The RGCSP chose a TLS value of 2.5 × 10-9 fatal accidents per aircraft flight hour as the upper limit “attributable to the loss of procedural vertical separation” to guide the development of the global system performance specification. Table A-1. Parameter values used to define the global height-keeping performance specification Description Value/unit Lateral path-keeping standard deviation (sy) 550 m (0.3 NM) Lateral overlap probability (Py(0)) 0.058 Opposite-direction passing frequency (Nx(opp)) 2.5 aircraft passings/hour Same-direction passing frequency Nx(same) 0 aircraft passings/hour Crossing passing frequency Nxy(cross) 0 aircraft passings/hour Average aircraft length (Mx) 45 m (148 ft) Average aircraft width (My) 45 m (148 ft) Average aircraft height (Mz) 15 m (50 ft) Average relative same-direction aircraft speed (|ÙV|) 37 km/h (20 kt) Average aircraft speed (|V|) 870 km/h (470 kt) Average relative cross-track aircraft speed (|y|) 7 km/h (4 kt) Average relative vertical aircraft speed during loss of vertical separation (|z|) 19 km/h (10 kt) Appendix A. Quantitative Aspects of System Performance Monitoring A-3 Note.— The TLS of 2.5 × 10-9 fatal accidents per aircraft flight hour applies only to technical height-keeping errors. 3. MONITORING AIRCRAFT PASSING FREQUENCY AND LATERAL NAVIGATION PERFORMANCE 3.1 Ensuring that the aircraft passing frequency and lateral navigational performance in an airspace are consistent with the global system performance specification is a requirement for introducing RVSM into an airspace. After its introduction, monitoring of these parameters is necessary in accordance with Chapter 6 of this manual. The following presents procedures for estimating and testing the parameters in accordance with these requirements. Monitoring passing frequency Introduction 3.2 The proportion of time during which aircraft at adjacent flight levels are exposed to the risk of collision due to the loss of procedural vertical separation is accounted for in the global system performance specification by defining a maximum frequency of opposite-direction passings of aircraft on the same route. This value, 2.5 passings per aircraft flight hour, was chosen to accommodate growth in global traffic over the planning horizon set in this manual. In practice, exposure may occur due to aircraft passings in the same or opposite directions on the same route at adjacent flight levels or due to passings of aircraft at adjacent flight levels on separate routes at a crossing point. (A closely related parameter often used in oceanic track systems is “occupancy”, which is a measure of the number of aircraft at adjacent flight levels within a specified distance of a typical aircraft). Independent system performance monitoring requires that the combined effect of the frequency of these various types of passings be estimated using traffic movement data from RVSM airspace, or simulated data prior to RVSM implementation, and be compared to 2.5 opposite-direction aircraft passings per flight hour. These estimates should be determined over the whole airspace of three adjacent ACCs covering the region’s busiest traffic flows or highest passing frequency, in order to address the problem of high traffic flows where higher-than-average collision risk may pertain. 3.3 The overall approach to estimating the frequency of the various types of aircraft passings is presented in 3.4 to 3.13 below. Procedures for comparing the combined effect of the estimated frequency to that used in developing the global height-keeping performance specification are presented in 3.14 to 3.19 below. Estimating aircraft passing frequency Data required 3.4 Aircraft flight data in the form of flight progress strips, or the equivalent, are necessary to estimate the passing frequency (or occupancy, where appropriate). The data should reflect the range of traffic flows in RVSM airspace consistent with the requirements of Chapter 2, 2.2, occasioned by daily, weekly and seasonal fluctuations in demand. Such sampling has been accomplished in practice by choosing a specific date or week of the month and gathering traffic movement data (actual or simulated) at that time for a year. 3.5 Originally, studies of aircraft passing frequency used flight strip data as the primary source of information. Alternative methods may be used in order to monitor aircraft passings on a continuous basis by automatic systems using radar tracking data. Such methods require an aircraft passing to be defined in terms of a volume of airspace within which the two aircraft must be contained. Use of radar data 3.6 Because of the many crossing routes and an increasing number of “direct-to” clearances in the EUR Region, the feasibility of using radar data for estimating the frequency of passing events involving horizontal overlap has been established. The basic principle remains the same as with the use of flight progress strips, i.e. calculating the total number of passing events, multiplying by 2 and dividing by the total number of flight hours above FL 290 in straight and level flight. 3.7 The following time- and flow-related data should be obtained from the radar tracks for each ACC sector: a) the time during which radar tracks were recorded; b) the total number of aircraft within the sector; c) the flow rate (per hour at each flight level) across the sector boundary; d) the total number of flight hours in level flight, classified by nearest flight level; and e) the total number of flight hours in climb/descent, classified by adjacent flight levels. Manual on Implementation of a 300 m (1 000 ft) Vertical A-4 Separation Minimum Between FL 290 and FL 410 Inclusive Estimating the passing frequency of aircraft on same- and opposite-direction routes 3.8 All routes within the three adjacent ACCs should be examined on an individual basis when estimating aircraft passing frequency or occupancy. If this is not practical, care should be taken that the routes analysed provide representative estimates. Each route should be divided into segments, for example, by reporting points or navigation aid locations. The traffic movement data, organized by flight level on each segment, must then be examined either manually or automatically to determine the number of pairs of aircraft at adjacent flight levels that pass each other in the same or in opposite directions. The number of same- and opposite-direction aircraft passings should then be combined with similar counts from all other route segments analysed. The sum of the overall same- and opposite-direction aircraft passings should then be multiplied by 2 and divided by the total number of flight hours above FL 290 in straight and level flight on the segments during the periods analysed, giving the same- and opposite-direction aircraft passing frequency estimates. If occupancy analysis is deemed appropriate, vertical occupancy can be estimated in a manner analogous to that for estimating lateral occupancy shown in the Air Traffic Services Planning Manual (Doc 9426), Part II, Section 2, Chapter 4, Appendix C. Estimating aircraft passing frequency on crossing routes 3.9 After identifying crossing routes within the three adjacent ACCs, the aircraft passing frequency at all the crossing points should be estimated. If this is not practical, care should be taken that the crossings analysed provide representative estimates. The number of aircraft pairs involving horizontal overlap at crossing points should be counted, multiplied by 2 and divided by the total flight time in the sampled RVSM airspace to produce an estimate of the crossing passing frequency. 3.10 Aircraft passings involving horizontal overlap at route crossing points are rare events and their frequency is difficult to measure. Nonetheless, it is possible to estimate this frequency; traffic flows representative of crossing routes may be used in a model similar to that which is presented in Doc 9426. 3.11 In busy continental airspace, flights are generally under radar surveillance and subject to tactical control by ATC. This leads to highly complex and, frequently, very variable traffic patterns with the actual tracks flown often deviating from the published ATS routes and crossing at a variety of angles. As a result, it is not possible to accurately estimate a frequency of passing events just based on the information on traffic flows on the ATS routes. 3.12 A realistic picture of the actual traffic patterns can be obtained from radar data. From the radar data it can be determined first of all whether a pair of aircraft pass within a specified volume of airspace. If this is the case, it contributes to the frequency of such passing events in the airspace considered. The actual relative velocity can also be estimated from the radar data. This information can then be processed in a way similar to that for an airspace with crossing routes. 3.13 Like aircraft passing events involving horizontal overlap at crossing points, passing events for direct routings involving horizontal overlap are rare events and difficult to estimate. The problem can be addressed by suitably defining vertical proximate events. Checking aircraft passing frequency 3.14 An airspace consisting of a route structure without crossing routes may be checked by plotting the estimated values for same- and opposite-direction aircraft passing frequency (Nx(same) and Nx(opp)) in Figure A-1. If these values are within the shaded area, then the airspace under consideration contains a frequency that affects risks no more than that used in developing the global height-keeping performance specification defined in Chapter 2, 2.3 of this manual. If the values are outside the shaded area, then a trade-off between the parameters of the global system performance specification may be possible as introduced in 2.2.5 to 2.2.8 and further explained in the next paragraphs. If the trade-off is not feasible, then the aircraft passing frequency in the airspace is too high to meet the technical safety objectives, and the RPG may need to consider employing either some form of air traffic management or airspace restructuring. 3.15 Assuming that the probability of vertical overlap, Pz(1 000), is equal to 1.7 × 10-8, the first type of trade-off to be considered is that between the passing frequency and the lateral navigation performance (see Figure A-2). This requires an estimate of the probability of lateral overlap, Py(0), to be known and to be less than a value of 0.058 corresponding with a standard deviation of lateral path-keeping error of 550 m (0.3 NM). If the estimate of the probability of lateral overlap is larger than the value of 0.058, then this type of trade-off is not possible. If the estimate of the probability of lateral overlap is less than the value of 0.058, then the check on the combined effect of same- and opposite-direction passing frequency is given by the following inequality: Appendix A. Quantitative Aspects of System Performance Monitoring A-5 Figure A-1. Region of acceptable aircraft passing frequency for same- and opposite-direction traffic Figure A-2. Flow diagram of the trade-off between global system performance specification parameters for same- and opposite-direction traffic when Py(0) < 0.058 and on the assumption that Pz z z z(1 000) < 1.7 × 10-8 0 0.2 0.4 0.6 0.8 1 1.2 0 0.5 1 1.5 2 2.5 3 N( x same) N( x opp) N (opp) within shaded area of Figure A-1 xx (same) and N Yes No Py(0) <0.058 Trade-off equation (1) Trade-off equation (2) OKOK Risk exposure too largeNo No NoYes Yes Yes OK Manual on Implementation of a 300 m (1 000 ft) Vertical A-6 Separation Minimum Between FL 290 and FL 410 Inclusive (1) where Py(0) represents the estimate of the probability of lateral overlap. Figure A-3 shows the region of acceptable same- and opposite-direction passing frequency for two values of Py(0), namely Py(0) = 0.058 and Py(0) = 0.029. The former value just meets the pertinent requirement of the global system performance specification of 2.2.2 b) of this manual and reproduces the result of Figure A-1. The other value is half of the former and represents a twice as large standard deviation of lateral path-keeping error. Figure A-2 shows that combinations of larger passing frequency values are allowed then. Note.— The product of the numbers in the right-hand side of the inequality (1) represents 0.145 opposite- direction passing events involving horizontal overlap (see 2.2.3 of this manual). 3.16 If the estimated values for same- and opposite-direction passing frequency are within the larger area of Figure A-3, then the trade-off has been successful. If the estimated values are outside the enlarged area, then a different trade-off may be possible, i.e. between the parameters in the horizontal domain and the vertical domain as set out in 2.2.7 of this manual. The check on the combined effect of same- and opposite-direction passing frequency is then given by the inequality: (2) 3.17 For airspace regions that contain crossing routes, a conservative check was developed by considering crossing angles and aircraft velocities. It involves determining if the combined frequency of all passing events within the region meets the following equation: (3) 3.18 A somewhat less conservative check is applicable when the minimum crossing angle is not smaller than 10 degrees, namely: (4) 3.19 If the left-hand side of equation (3) or (4) is less than or equal to 2.5, the check has been successful and the region’s aircraft passing frequency is at or below the equivalent value used to develop the global height-keeping performance specification. If the left side of equation (3) or (4) is greater than 2.5, the check has been unsuccessful. This latter condition implies that either the region’s aircraft passing frequency is too high to meet the specification or its Nx opp ()2.5 0.96 ---------- Nx same()0.058 Py 0() -------------- 2.5≤+ Nx opp()2.5 0.96 ---------- Nx same()0.058 Py 0() -------------- 1.7 10 8–× Pz 1000 () ------------------------- 2.5≤+ 2.5 0.96 ---------- Nx same () Nx opp ()37.5Nxy cross() 2.5≤++ 2.5 0.96 ---------- Nx same () Nx opp ()21.4Nxy cross() 2.5≤++ Figure A-3. Region of acceptable aircraft passing frequency for same- and opposite-direction traffic based on a trade-off with a probability of lateral overlap, Py(0), for two different values of Py(0) Note.— Outline only, not to scale. P (0)=0.029 y P (0)=0.058 y Appendix A. Quantitative Aspects of System Performance Monitoring A-7 combination of crossing angles and aircraft velocities are outside the ranges considered in developing the check for inequality. If this situation applies, aircraft passing frequency may be calculated using model parameters from the respective regions. The above inequality may also be used in place of Figure A-1 when there are no crossing routes by setting Nxy(cross) to zero. Monitoring lateral navigational performance 3.20 As lateral navigational performance in an airspace improves, the risk of collision due to the loss of procedural vertical separation increases. This paradoxical effect requires that actual lateral path-keeping performance in RVSM airspace be examined to ensure that assumptions made in developing the global height-keeping performance specification are not violated. 3.21 Lateral navigational performance influenced determination of the global height-keeping performance specification through the standard deviation of lateral path-keeping. Assuming a first Laplace distribution of lateral path-keeping, the lateral overlap probability, Py(0), may be represented symbolically as: (5) where My is the average aircraft width and λy is the standard deviation of lateral path-keeping. As shown in Table A-1, a standard deviation of 550 m (0.3 NM) representing a population of aircraft all equipped with a similar precision area navigation (RNAV) system has been assumed. 3.22 When different types of navigation systems are present, an estimate of the overall variance is obtained by weighting the individual variances with the proportions of aircraft equipped with each type of navigation system. To check a lateral navigation performance is straightforward: the estimated standard deviation value should be greater than that used to develop the global height-keeping performance specification (i.e. 550 m (0.3 NM)). 3.23 If the check on the standard deviation is neg- ative, then it may be possible to trade off the better lateral navigation performance against a passing frequency which is lower than that assumed in the development of the global system performance specification (see Figure A-4)). On the assumption that the probability of vertical overlap, Pz(1 000), is equal to 1.7 × 10-8, the trade-off as set out in 2.2.6 of this manual is obtained by inverting equation (1), i.e.: (6) Py 0( ) λ y σy 2 ()⁄= Py 0() 0.058 -------------- 2.5 Nx opp ()2.73 1.04 ---------- Nx same ()+ ---------------------------------------------------------------≤ Figure A-4. Flow diagram of the trade-off between global system performance specification parameters for same- and opposite-direction traffic when the combination of same- and opposite-direction passing frequency is within the shaded area of Figure A-1 and on the assumption that Pz(1 000) < 1.7 × 10-8 OKP (0) <0.058 y N (same) and N xx (opp) within shaded area of Figure A-1 Trade-off equation (6) OK Trade-off equation (7) OK No No Yes Yes Yes No Risk exposure too large Yes No Yes Manual on Implementation of a 300 m (1 000 ft) Vertical A-8 Separation Minimum Between FL 290 and FL 410 Inclusive The denominator in the right-hand side of equation (6) will be smaller than the value of 2.5 if the combined passing frequency of all aircraft passing events is within the acceptable area of Figure A-1. The right-hand side will then be greater than one (1), which defines the margin by which Py(0) may exceed its original bound of 0.058, without being inconsistent with the horizontal part of the global system performance specification. The margin on Py(0) can be directly translated into a margin on the standard deviation σy of the lateral path-keeping error distribution by means of equation (5). 3.24 If the trade-off in 2.2.6 of this manual is not possible, it may finally be examined whether a trade-off between the vertical and horizontal domains as set out in 2.2.7 is feasible. Thus, on the assumption that the probability of vertical overlap, Pz(1 000), is well below the value of 1.7 × 10-8, the trade-off is obtained by inverting equation (2), i.e.: (7) 3.25 The first ratio in the right-hand side of equation (7) provides the margin due to Pz(1 000) being well below the bound of 1.7 × 10-8, for example 1.7 × 10-9. This ratio then results in a factor of 10. The resulting margin for Py(0) is dependent on the value of the passing frequency as shown by the second ratio in the right-hand side of equation (7). If the estimated values of the two passing frequency components were within the allowable area of Figure A-1, then this provides some additional margin (which in itself was insufficient to cover the higher lateral navigation performance as described for the first type of trade-off in 3.21). If the estimated values of the two passing frequency components were outside the allowable area of Figure A-1, then the second ratio is less than one and takes up part (or all) of the margin provided by the vertical dimension (this will already have been found independently in the check on passing frequency, cf. 3.13 to 3.15). Thus, the ultimate margin for Py(0) is given by the full right-hand side of equation (7). 3.26 The trade-offs illustrated in the Figures A-3 and A-4 can be combined into a single diagram as shown in Figure A-5. Note that an additional branch is present for the Py 0() 0.058 -------------- 1.7 10 8–× Pz 1000 () ------------------------- 2.5 Nx opp ()2.5 1.96 ----------Nx same()+ ---------------------------------------------------------------≤ Figure A-5. Flow diagram of the trade-off between global system performance specification parameters for same- and opposite-direction traffic on the assumption that Pz(1 000) < 1.7 × 10-8 OKP (0) <0.058 y N (same) and N xx (opp) within shaded area of Figure A-1 Trade-off equation (6) OK Trade-off equation (7) OK No No Yes Yes Yes No No No No Risk exposure too large P (0) <0.058 y Trade-off equation (1) Trade-off equation (2) Trade-off equation (8) Yes OK OK OK Yes Yes No Yes Yes No Appendix A. Quantitative Aspects of System Performance Monitoring A-9 case where Nx(same) and Nx(opp) are not within the shaded area of Figure A-1 and Py(0) is not less than or equal to 0.058. In that case, the trade-off in 2.2.7 of this manual between the probability of vertical overlap and the airspace parameters may still be possible. The corresponding trade- off equation is given by: (8) Application of the checking process to airspace studied by the RGCSP 3.27 Airspace studied by the RGCSP was examined to provide examples of the application of the checking process. The standard deviations of lateral path-keeping and values for the aircraft passing frequency are taken from the report of the RGCSP/6 Meeting (Doc 9536, 5.5.2 and Table 5-3). 3.28 As an example of an airspace dominated by parallel routes, the values for the aircraft passing frequency estimated for NAT airspace are plotted in Figure A-6 and are seen to be well within the acceptable area. Values for same- and opposite-direction aircraft passing frequency for European, Japanese and United States airspace are also plotted in the figure. 3.29 The application of the checking process to airspace with crossing routes is based on equation (3). As an example, European airspace values are used. Substituting these passing frequency values, the left-hand side of equation (3) is 0.575. Because this value is less than 2.5, the inequality is maintained and the combination of the frequency of en-route and crossing-route aircraft passings is within the bounds anticipated when developing the global height-keeping performance specification. 4. MONITORING HEIGHT-KEEPING PERFORMANCE Introduction 4.1 This section first outlines methods for measuring TVE through a comparison of the geometric height of an aircraft tracked by height monitoring units (HMUs), or by GPS-based monitoring unit (GMU) height monitoring systems (GMS), against the geometric height of the assigned flight level, and secondly for estimating TVE through estimation of its altimetry system error (ASE) and assigned altitude deviation (AAD) components, where AAD is a surrogate for flight technical error (FTE). Because the rate of collection of measured TVE data is likely to be relatively low, estimated TVE will be of value in increasing the size of the data sample and affording Py 0() Nx opp()2.5 0.96 ----------Nx same()+ ≤ 1.7 10 8–× Pz 1000 () ------------------------- 0.058 () 2.5 () Figure A-6. Corresponding points in the region of acceptable aircraft passing frequency for same- and opposite-direction traffic 0 0.2 0.4 0.6 0.8 1 1.20 0.5 1 1.5 2 2.5 3 N (same) x P (opp) x Unacceptable Acceptable Europe Japan North Atlantic United States Manual on Implementation of a 300 m (1 000 ft) Vertical A-10 Separation Minimum Between FL 290 and FL 410 Inclusive greater statistical confidence that the global height-keeping performance specification has been met. It is important to note, however, that the component error methodology for estimating TVE is dependent upon the availability of measured TVE from which to derive a value for ASE. General approach 4.2 A four-element approach for the collection and assessment of height-keeping performance data in the verification phase is proposed in the following four paragraphs. This approach may allow the regional planning group to gain a growing statistical confidence in meeting the safety and monitoring objectives throughout the verification phase. The four elements will be conducted simultaneously with each stage building one upon the other. In the first step, examining typical performance will include estimating ASE values. Those aircraft with marginally acceptable ASEs (aberrant aircraft) or those that develop large values (non-compliant aircraft) are of major concern since the presence of a small number of such aircraft would degrade system safety. The second element of the process consists of conducting an ASE census in order to examine and eliminate, with a high degree of confidence, any excessive ASE. The third element counts the number of large errors that directly affect risk and provides the associated confidence level for the target levels of safety. Finally, the process involves determining if the global height-keeping performance specification has been met. 4.3 The first element of the data evaluation consists of examining the typical height-keeping performance of aircraft, with a given level of confidence, by identifying the number of TVE, ASE and AAD values beyond the tolerance limits given in 6.4.5 and counting the number of occurrences of each value. In addition, height-keeping performance should be examined in order to detect adverse trends that could ultimately result in unacceptable performance. This examination will focus on performance exhibited by individual aircraft types and operators, with analysis of mean TVE, ASE, and AAD performance and variability about the means. This examination should be repeated periodically throughout the four-element process. 4.4 The second element of the four-element process consists of conducting the ASE census. It will, of course, take a longer time to complete than the first element since its primary goal is to obtain estimates of the ASE of every aircraft and to identify those that exceed the ASE tolerance limit of 6.4.5 a) so that follow-up corrective action can be taken. When such a census cannot be conducted, it is necessary to obtain a representative sample which, at a minimum, contains a census of the RVSM MASPS- approved aircraft types and data on every combination of aircraft/operator pairing. For example, in the NAT RVSM programme, somewhere in the order of 80 per cent of the predicted population were monitored as part of the verification phase. On the basis of the quality of the collected data, it was adjudged to be representative of the population. A suggested approach to dealing with the collected ASE data is described in this appendix. 4.5 The third element of the quantitative evaluation consists of providing an indication of the currently achieved level of safety and the level of confidence that is being attained within the system as early as possible. Risk estimation based on probability distribution fitting and/or control charts for critically large ASEs, TVEs and AADs, similar to those described for typical height-keeping performance, will be applied. This element should also include an evaluation of the level of risk caused by operational errors and emergency actions. 4.6 The objective of the fourth element is to demonstrate compliance with the global height-keeping performance specification. This objective will continue to be pursued after the introduction of RVSM. TVE component errors Introduction 4.7 The TVE of an aircraft is taken to be the result of the statistically independent and additive contributions of contemporaneous errors in the aircraft’s altimetry and altitude-keeping systems. These two component errors of TVE are considered to have different characteristics. 4.8 Estimation of the ASE and AAD of an aircraft is possible during independent system performance monitoring operations. These component error estimates are necessary in order to support the risk-reduction goal of monitoring so that any observed instances of large TVE can be classified in regard to the height-keeping subsystem which is likely to be at fault. Estimation of ASE 4.9 The ASE of an aircraft is expected to vary within some limits about some mean value which is characteristic for each individual aircraft for a given set of operating conditions. This characteristic mean is expected to be largely invariant over many flights, unless there is some intervention, such as damage or repair, which changes the error characteristics. The interval over which ASE remains Appendix A. Quantitative Aspects of System Performance Monitoring A-11 relatively constant, in the absence of intervention, is not precisely known, but data and experience do indicate some moderate increase in the magnitude of ASE as an altimetry system ages. Data and experience also indicate that the errors of the independent altimetry systems of the pilot and co-pilot are not necessarily equal. 4.10 An aircraft’s actual ASE at any time is the difference between its actual TVE and contemporaneous actual FTE. Given a measure of TVE and a contemporaneous AAD for the aircraft, the difference between TVE and AAD provides an estimate of ASE. The accuracy of this estimate is affected by the granularity of the 30-m (100-ft) quantization inherent in Mode C and any correspondence error between the Mode C return and the altitude display. When averaged over a number of repeated samples, however, this approach should enable a representative value of ASE to be established. Estimation of AAD 4.11 Errors in altitude-keeping can vary during a single aircraft flight. Data on altitude-keeping errors from such sources as flight data recorders and SSR systems indicate that magnitudes of less than 15 m (50 ft) predominate but that, on relatively infrequent occasions, error magnitudes of 90 m (300 ft) or more occur. These latter error magnitudes typically persist for short periods, in the order of 30 to 180 seconds. There are two approaches to estimating the performance of altitude-keeping systems. If either direct altimeter readings or flight data recorder information on pressure altitude as measured by the altimetry system are used, the difference between this altitude and the aircraft’s cleared flight level is termed FTE. If SSR returns are used, the difference between a transponded Mode C reading and a cleared flight level is AAD. 4.12 Where available and practicable within RVSM airspace, SSR Mode C data should be gathered. Typically, a Mode C altitude return will be available every 4 to 12 seconds if a single SSR is tracking an aircraft. Each such return provides an estimate of AAD for the aircraft when CFL is subtracted. These AAD estimates will not be statistically independent but will provide the opportunity to observe larger altitude-keeping system errors that may occur. Consideration should also be given to the inclusion of large FTEs (e.g. due to turbulence, autopilot failures, etc.) that might be documented in occurrence reports. Procedures for monitoring height-keeping performance Introduction 4.13 Independent system performance monitoring requires the measurement of aircraft height-keeping errors. Direct measurement of TVE for an aircraft can, at present, be carried out only by measuring the aircraft’s geometric height at a given time and estimating the contemporaneous and collocated geometric height of the flight level to which it is assigned. The difference between these two heights yields the TVE measurement. 4.14 Given the nature of the TVE component errors, independent system performance monitoring should consist of an integrated set of procedures for: a) monitoring TVE, with a system having error characteristics identified in 4.21 below, in the airspace so as to obtain as broadly based a sample of aircraft types and users as is practicable; b) monitoring AAD through Mode C coverage; and c) producing a companion ASE estimate for each TVE measure. 4.15 Paragraph 6.2.18 indicates that future regional implementations of RVSM may not necessarily require TVE data to be collected as part of the airspace safety verification process, on the grounds that statistically representative data may be available from other regions with established monitoring programmes. However, it may still be necessary to collect representative AAD data which, combined with the aforementioned TVE data, would be used in the estimation of Pz (1 000). Measurement accuracy for TVE 4.16 States contributing TVE estimates to RGCSP deliberations independently determined that the combined standard deviation of measurement error for both the aircraft and the flight level geometric heights should not be greater than 15 m (50 ft). The individual mean measurement error for the aircraft and the flight level geometric heights should be 0 m (0 ft). These measurement error criteria should also be taken as applicable to any system performance monitoring programme. Characteristics of a height-monitoring system are described in 4.21. Manual on Implementation of a 300 m (1 000 ft) Vertical A-12 Separation Minimum Between FL 290 and FL 410 Inclusive Aberrant and non-compliant aircraft 4.17 The criteria for non-compliant aircraft to be applied by an RMA are: a) TVE — 90 m (300 ft); b) ASE — 75 m (245 ft); and c) AAD — 90 m (300 ft). In deciding whether or not an aircraft meets these criteria, the inherent inaccuracy (measurement error) of the monitoring system, as well as normal variation in an airframe’s ASE or TVE, needs to be taken into account. The decision process is affected by two types of statistical error: type I error and type II error. To avoid unjustified action being initiated on the basis of a large measured deviation (type I error), the trigger levels for action are to be set at slightly larger values than the criteria above. An airframe is deemed to be non-compliant if any of its monitored deviations exceed these trigger levels. However, the situation also needs to be avoided where an aircraft that does not meet the above criteria is labelled as meeting the criteria (type II error). To ensure this, the trigger levels for action are to be set at slightly lower values than the above set of trigger levels. An aircraft whose measured height- keeping deviations exceed any of the lower trigger levels is called aberrant. Aberrant aircraft, thus, are those aircraft which exhibit measured height-keeping performance that is significantly different from the core height-keeping performance measured for the whole population. 4.18 As an example, the sets of trigger levels currently in use in the NAT Region are shown below. a) trigger levels for aberrant aircraft: |ASE| > 49 m (160 ft) or |TVE| > 52 m (170 ft); and b) trigger levels for non-compliant aircraft: |ASE| > 90 m (300 ft) or |TVE| > 107 m (350 ft) or |AAD| > 90 m (300 ft). Since determination of these trigger values is dependent on an evaluation of the measurement accuracy of the monitoring system and also the height-keeping performance of the whole NAT population, the trigger levels will be subject to change. Monitoring strategy for TVE/ASE 4.19 Because of the specialized systems required, TVE can be monitored in only limited portions of an airspace. Thus, TVE monitoring should be planned and conducted so that as broad a cross-section as possible of the user population and aircraft types can be observed. TVE monitoring can be used to uncover instances of larger ASE not detectable by in-flight drills. Monitoring strategy for AAD 4.20 Because of the generally short duration of large AADs, this component error should be monitored, to the extent practicable, wherever there is SSR coverage in RVSM airspace. The actual monitoring process, however, should record only instances of AAD magnitudes of 90 m (300 ft) or more for both risk reduction, by means of error follow-up, and risk assessment. To conduct risk assessment, it will also be necessary to estimate the total amount of level-flight flying time in the SSR coverage area at and above FL 290. With the count of larger AAD errors and the total flying time, an estimate of the proportion of time during which larger AAD errors occur can be made. Characteristics of a height-monitoring system 4.21 The basic purpose of a height-monitoring system is to collect data on the technical height-keeping performance of aircraft in straight and level flight at FL 290 or above. The following features form the basis of the operational requirement for such a system: a) it should be capable of automatic operation where practicable; b) it should be capable of measuring the geometric height of aircraft in straight and level flight at and above FL 290 over a period of 30 seconds or more; c) it should be capable of accepting input data on the estimated geometric height of the usable flight levels between FL 290 and FL 450; d) it should record the geometric height of the aircraft and the flight level; e) it should be able to access aircraft identification and Mode C SSR readings during the TVE tracking period; f) it should be capable of deriving TVE, AAD and ASE; g) it should be capable of flagging “alerts” when a pre- determined TVE, ASE or AAD has been exceeded, Appendix A. Quantitative Aspects of System Performance Monitoring A-13 and this information should be in such a format so as to be readily identifiable during the initial scrutiny of the data; and h) it should record all data in a format that facilitates subsequent analysis. Risk reduction using observed height-keeping performance data 4.22 In addition to taking investigative action on aircraft with observations of height-keeping performance not considered to be in compliance with the RVSM MASPS, each observed instance of aberrant TVE, AAD or ASE should also be the object of follow-up investigation. Errors of large magnitudes should be rare events in the light of requirements on the component systems stipulated in Chapter 4. It is important that records of these larger errors be analysed as a group to look for systematic causes of deviations and for adverse trends in the component errors. When such causes are identified, they should be the object of appropriate remedial actions (affecting, for example, the maintenance practices of all users with a particular type of altimetry system if existing practices are implicated in the causes of a systematically occurring large altimetry system error). If the cause of a specific larger error can be judged to have been removed, it may be reasonable to conduct subsequent risk assessment with observed instances of the error type removed from the monitoring results. Note.— The values of aberrant TVEs, AADs or ASEs should be determined based on typical performance of the population as a whole and should also allow for measurement error of the height-monitoring system employed. Composition of TVE samples 4.23 The composition of the TVE sample used for risk assessment is important. Because the ASE component of TVE for an aircraft is considered to be a rather long- duration error, which will be different for each aircraft type and may be different for each airframe within an aircraft type, the TVE sample should reflect a census of the ASE of altimetry systems used, or likely to be used, in RVSM airspace because undetected large ASE adversely influences risk. Such a census may be a practical impossibility. Thus, it will be important during risk assessment to consider what the ASE of airframes that are not included in the TVE sample may be in view of the ASE of identical aircraft types observed in the sample. The AAD component has been observed to reflect ATC operational conditions, such as areas where flights transition between flight levels, and meteorological environments as well as variations due to aircraft types and airspace users. Thus, the TVE sample should reflect these conditions and environments to the extent possible but, ideally, in the proportions in which they occur in RVSM airspace. As with the considerations that apply to observations of the ASE component of TVE, risk assessment should take into account the proportions in which all conditions relevant to adequate representation of AAD are present in any TVE sample. Estimation of the probability of vertical overlap, Pz (1 000) 4.24 There were two methods adopted in the RGCSP analysis to model the observed height-keeping errors. In the first method, an analytical probability density function (PDF) is fitted directly to the TVE data and is then self- convoluted to assess the vertical overlap probability. For the second method, individual PDFs are fitted to the ASE results, broken down per aircraft group, and then re- combined in the proportions that these aircraft groups cross the RVSM airspace under consideration. The aggregate ASE distribution is then numerically convoluted with the PDF for the AAD data to produce a TVE distribution, termed TVEsyn. A self-convolution of this TVEsyn distribution is performed to obtain the vertical overlap probability. 4.25 The second method is more complicated to perform but is likely to be more accurate since it takes account of how well the monitoring sample matches the overall situation in the airspace under consideration. For small monitoring samples, this is particularly important, although it is then difficult to obtain enough data to fit distributions to the ASE data for individual aircraft groups. For large monitoring samples, it may be that the monitoring sample is sufficiently close (in terms of aircraft type proportions) to the overall situation in the airspace, thus making it possible to fit a PDF directly to the TVE data. ASSESSMENT AND EVALUATION OF OPERATIONAL ERRORS AND IN-FLIGHT CONTINGENCIES 5.1 As set out in 1.1.10 and 6.3.1 to 6.3.3 of the main text of this manual, the level of collision risk resulting from errors in ATC instructions and emergency procedures in RVSM airspace needs to be assessed in addition to that resulting from technical height-keeping deviations. The Manual on Implementation of a 300 m (1 000 ft) Vertical A-14 Separation Minimum Between FL 290 and FL 410 Inclusive types of errors and their possible consequences may vary from region to region. The following briefly summarizes two approaches to their assessment that have been developed in the context of the NAT and the EUR Regions, respectively. For more information, see the regional documentation. NAT Region 5.2 The NAT approach comprises the following elements: a) definition of types of errors on the basis of their cause; b) classification of errors for risk assessment purposes; c) determination of appropriate parameter values for each error; d) estimation of probability of vertical overlap; and e) estimation of vertical collision risk. 5.3 The assessment begins with identifying what types of operational errors could exist in the airspace under consideration. In the NAT, large height deviations collected by the CMA are divided into the following four main types: a) ATC-pilot loop errors and incorrect clearances; b) aircraft contingency events; c) deviations due to meteorological effects; and d) deviations due to ACAS. Within each type, one or more error classes, characterized by different CMA codes, are defined as shown below. (There is an additional error class O, Other) See the Supplement to NAT Doc 002 for a more detailed description of the various error classes. ATC-pilot loop errors and incorrect clearances D: Failure to climb/descend as cleared; E: Climb/descent without ATC clearance; F: Entry to MNPS airspace at an incorrect level; and G: ATC FL re-clearance resulting in loss of lateral or longitudinal separation. Aircraft contingency events A: Contingency action due to engine fault; B: Contingency action due to pressurization failure; C: Contingency action due to other cause. Deviations due to meteorological effects I(W): Aircraft unable to maintain level due to weather conditions. Deviations due to ACAS H: Deviation resulting from ACAS resolution advisories. 5.4 The next step is to classify each large height deviation for risk assessment purposes as either risk bearing or non-risk bearing. In the NAT, a large height deviation is classified as non-risk bearing when it occurs wholly outside MNPS airspace or when it is explicitly stated that correct contingency procedures were followed and the aircraft turned off track prior to any change of level. 5.5 Risk-bearing height deviations are further broken down into those involving whole numbers of flight levels and those not involving whole numbers of flight levels. 5.6 During the development of a large height deviation involving whole numbers of flight levels, one or more intermediate flight levels may have been crossed. This is taken into account in the NAT approach through the following parameters of the incident: a) the time spent around levels crossed, if any; 1) the number of flight levels crossed, if any; 2) the rate of climb/descent; and b) the time spent in level flight at uncleared flight levels, if any. Item b) is mainly related to ATC-pilot loop errors and incorrect clearances (error classes D, E, F, G); item a) is mainly related to aircraft contingency events (error classes A, B, C) but may also play a part in ATC-pilot loop errors and incorrect clearances. 5.7 It has been observed that the rate of climb/descent and the time spent in level flight at uncleared levels are rarely included in the incident reports. For those cases, Appendix A. Quantitative Aspects of System Performance Monitoring A-15 cautious estimates have been developed for the NAT based on information from operators and other sources. 5.8 Large height deviations of a few hundred feet, but not involving whole numbers of flight levels, may occur as a result of turbulence or nuisance-ACAS resolution advisories. The parameters of this type of incident are the maximum deviation and the total duration from the start of the deviation until the cleared flight level is re-established. Again, cautious estimates of the latter have been developed for the NAT because information about the duration has been found to rarely be documented in the incident report. 5.9 Estimates of the probability of vertical overlap associated with the different types of risk-bearing large height deviations can be made using the individual parameters. The probability of vertical overlap for aircraft in level flight at uncleared levels is computed as the product of the proportion of total flying time spent at incorrect levels and the probability that two aircraft nominally flying at the same level are in vertical overlap. For aircraft slowly crossing an uncleared flight level, the probability of vertical overlap can be estimated as the ratio of the average height of an aircraft and the vertical separation minimum. (A more complicated relation is required for crossing an uncleared flight level at higher speeds.) 5.10 The probability of vertical overlap for large height deviations not involving whole numbers of flight levels is not estimated separately. Rather, the relative frequency for each deviation magnitude is estimated (by dividing its duration by the total MNPS system flight hours) and added to the distribution of assigned altitude deviation (AAD) (cf. 4.6 and 4.18 of this appendix). In this way, this type of large height deviation is included in the distribution of technical height-keeping errors and in the estimate of the technical risk. 5.11 The vertical collision risk associated with each large height deviation involving either flying at an uncleared level or crossing an uncleared level is calculated with the Reich collision risk model, where the probability of vertical overlap and the relative vertical velocity are dependent on the specific error. The individual vertical risk estimates are then combined into an overall estimate of the total vertical collision risk due to such large height deviations. EUR Region 5.12 In addition to the NAT approach, an approach based on hazard analysis has been developed for the EUR Region. A hazard identification process has resulted in two broad categories of hazards: a) loss of vertical separation following altitude deviations, the main type of scenario being failure to level at the assigned altitude (level “bust”) and the main causes being pilot errors and pilot-ATC miscommunication; and b) loss of vertical separation due to ATC misjudgements, the main scenario being ATC placing two aircraft in close proximity during a climb or descent and the main causes appearing to be controller aberrations, problems in coordination between military and civil controllers and coordination difficulties between controllers in different sectors. 5.13 An altitude deviation generally leads to one or more of the following: a) crossing one or more uncleared flight levels; b) joining an uncleared flight level; and c) levelling off between flight levels. The approach then consists of determining the frequency of altitude deviations and calculating the associated probability of vertical overlap. The latter depends on the specific effects and the probability of ATC failing to intervene successfully. 5.14 An ATC misjudgement has been defined as a loss of vertical separation where both aircraft follow the instructed flight profiles. A key difference from altitude deviations is that misjudgements always occur in the context of another aircraft being in the near vicinity. The process developed involves first of all deriving the frequency of ATC misjudgements leading to the loss of vertical separation and dividing this frequency into components involving joining and crossing levels and involving different traffic directions. This is followed by determining ATC intervention probabilities for each component and combining collision risks in the absence of ATC with probabilities of failed ATC intervention. B-1 Appendix B REFERENCE DOCUMENTATION Reference list of existing documentation on SRVSM operations and requirements 1. NAT Doc 001, T13.5N (Eighth edition); Consolidated guidance material — North Atlantic Region 2. Supplement to NAT Doc 002, Risk assessment and system monitoring for the verification and operation of a 300 m (1 000 ft) VSM in the MNPS airspace of the North Atlantic Region 3. North Atlantic MNPS Airspace Operations Manual (Eighth edition) 4. Joint Airworthiness Authorities Temporary Guidance Leaflet No 6, Revision 1, Guidance material on the approval of aircraft operators for flight in airspace above flight level 290 where a 300 m (1 000 ft) vertical separation minimum is applied 5. EUR Doc 009, Guidance material on the implementation of a 300 m (1 000 ft) Vertical Separation Minimum in the European RVSM Airspace 6. EATMP, ATC Manual for a Reduced Vertical Separation Minimum (RVSM) in Europe 7. Pacific Region, Guidance Material on the Implementation of a 300 m (1 000 ft) Vertical Separation Minimum for application in the airspace of the Pacific Region (ICAO) — END — flight level at higher speeds.) 5.10 The probability of vertical overlap for large height deviations not involving whole numbers of flight levels is not estimated separately. Rather, the relative frequency for each deviation magnitude is estimated (by dividing its duration by the total MNPS system flight hours) and added to the distribution of assigned altitude deviation (AAD) (cf. 4.6 and 4.18 of this appendix). In this way, this type of large height deviation is included in the distribution of technical height-keeping errors and in the estimate of the technical risk. 5.11 The vertical collision risk associated with each large height deviation involving either flying at an uncleared level or crossing an uncleared level is calculated with the Reich collision risk model, where the probability of vertical overlap and the relative vertical velocity are dependent on the specific error. The individual vertical risk estimates are then combined into an overall estimate of the total vertical collision risk due to such large height deviations. EUR Region 5.12 In addition to the NAT approach, an approach based on hazard analysis has been developed for the EUR Region. A hazard identification process has resulted in two broad categories of hazards: a) loss of vertical separation following altitude deviations, the m