Harmonisation of Category-III Precision Approach Navigation System Performance Requirements

Wolfgang Schuster; Washington Ochieng

doi:10.1017/S0373463310000287

Harmonisation of Category-III Precision Approach Navigation System Performance Requirements

Published online by Cambridge University Press: 13 September 2010

Wolfgang Schuster and

Washington Ochieng

Show author details

Wolfgang Schuster*: Affiliation:
(Centre for Transport Studies, Imperial CollegeLondon)
Washington Ochieng: Affiliation:
(Centre for Transport Studies, Imperial CollegeLondon)
*: (Email: w.schuster@imperial.ac.uk)

Article contents

Abstract
INTRODUCTION
ILS LOOK-ALIKE METHOD
AUTOLAND METHODOLOGY
COMPARISON OF ILS-LA AND AUTOLAND METHODS
CONCLUSION
References

Rights & Permissions

Abstract

Two distinct methods have been proposed and used to derive the required performance for CAT-II and III precision approaches: the “ILS (Instrument Landing System) Look-Alike Method” and the “Autoland Method”. The former is based on the concept of matching the performance of the ILS at the Navigation System Error (NSE) level through linearization of current specifications at a given height. The latter is based on the need to protect the safety of a landing operation using the current specification for the probability to land in a given landing box. Fundamentally, both methods assume the same safety targets and type of distribution, and are independent of specific navigation architectures. Therefore, they should deliver the same performance requirements. However, the requirements from the two methods for CAT-III approach are different. This paper reviews the two methods in detail, highlighting the key differences, and proposes ways to reconcile the methods and the requirements.

Keywords

CAT III ILS Look-alike Autoland

Information

Type: Research Article
Information: The Journal of Navigation , Volume 63 , Issue 4 , October 2010 , pp. 569 - 589

DOI: https://doi.org/10.1017/S0373463310000287 [Opens in a new window]
Copyright: Copyright © The Royal Institute of Navigation 2010

1. INTRODUCTION

A key element of aircraft operational safety is the definition and specification of the operational system performance requirements for each phase of flight. This operational system performance (also referred to as the total system performance) comprises two elements: the navigation system performance, which determines how well an aircraft “knows” its position, and the flight technical performance, which measures how well an aircraft is able to follow the path defined by the navigation system. The actual performance of a given navigation system is measured against the requirements to determine if it is suitable to carry out the intended operation. It is anticipated that Global Navigation Satellite Systems (GNSS) will be at the core of future air navigation systems. GPS (as the current mature GNSS) is already widely used for phases of flight up to non-precision approach. Furthermore, studies have shown that for precision approaches, stand-alone GNSS (e.g. GPS or GALILEO) require enhancing with Ground Based Augmentation Systems (GBAS) to meet the required performance.

Early attempts by the US Federal Aviation Administration (FAA) and the International Civil Aviation Organisation (ICAO) All Weather Operations Panel (AWOP) to develop requirements for GNSS to support CAT-III operations were based on the state-of-the-art technology for landing operations. The idea was to match system operational performance at the Navigation System Error (NSE) level through linearization of the performance specifications (errors) at a given height of the Instrument Landing System (ILS). This resulted in the so-called ILS Look-Alike approach used originally to define the performance requirements for CAT-I approach. The method was subsequently adopted by the European Organization for Civil Aviation Equipment (EUROCAE) to derive the NSE and Alert Limits (AL) requirements for CAT-III approach. However, the US Radio Technical Commission for Aeronautics (RTCA) adopted a different approach (the Autoland method) that derives the navigation system performance requirements from the touchdown requirements laid out in FAA (1999) and EASA (2003), and observed flight-technical errors of current aircraft. The Signal-In-Space (SIS) performance requirements for CAT-III approaches derived from the two methods are given in Table 1.

Table 1.

SIS Performance Requirements for the various phases of aircraft operation (Schuster, Reference Schuster2006).

The potentially significant differences (e.g. in accuracy and alert limit requirements) have resulted in considerable debate over the years, including by the RTCA and EUROCAE. This paper reviews both methods in detail and identifies the key differences, with a particular focus on the vertical component (i.e. the most stringent requirements that will ultimately determine the GNSS-based architecture for CAT-III operations). It concludes by proposing ways to reconcile the two approaches.

2. ILS LOOK-ALIKE METHOD

The ILS Look-Alike method is based on translating current ILS performance into GBAS performance requirements. The rationale for using the ILS performance specifications is its validation through many years of operational service. The ILS is currently in use to guide aircraft under reduced visibility conditions from the initial intercept point until it reaches a given height, which in the case of CAT IIIb approaches is zero. It consists of two separate systems on the ground: the localiser and the glide-slope. Each emits electromagnetic waves consisting of a carrier amplitude-modulated by two tones. The Depth of Modulation (DM) of these two tones is a function of the angle of displacement from the centreline. The ILS aircraft receiver measures the Difference in DM (DDM) between the two tones for both the localiser and glide-slope signals to compute the angular position, both horizontally and vertically respectively.

2.1. Accuracy – Navigation System Error

Any change in the transmission of the ILS signal that causes a change in the DDM at a given angle with respect to the nominal (expected) DDM (either due to transmitter or receiver error/failure) contributes to the Navigation System Error (NSE). The various sources of error include course misalignment, beam bends, angular displacement sensitivity, receiver mis-centring and others including polarisation of the carrier, receiver displacement sensitivity and linearity, and noise due to RF and power supply interference (ICAO, 2002; 2004).

The performance specifications in ICAO (2002; 2004) are expressed in terms of angles. In order to translate the angular performance into the runway lateral, along-track and vertical performances as required by GBAS, various assumptions are made about the geometry of the runway and location of the localizer and glide-slope transmitters. A nominal runway of 2900 m is assumed (Figure 1). The Glide-Path Intercept Point (GPIP) is located at 286·2 m from the runway-threshold (TH), which corresponds to the 50 ft Decision Height (DH) for a 3-degree glide-slope, typically used for CAT-III landings. The 100 ft decision-height point C is located at 572·4 m from the GPIP. The point at which the vertical performance requirements are most stringent corresponds to that where aircraft equipment makes the transition from using the glide-slope to the radar-altimeter as the main instrument in the flare manoeuvre. The point at which this occurs is variable, although most Airbus aircraft do not make use of the glide-slope below 60 ft (Guillet, Reference Guillet2007). For lateral guidance, the most stringent requirements correspond to the point D located at 900 m from the TH. Figure 1 illustrates these considerations.

Figure 1.

ILS Operational Environment for Precision Landings (Eurocae, 2007).

Table 2 summarises the main sources of error and allocated performance specifications in ICAO (2002, 2004) of the localiser system of the ILS. A detailed explanation of these errors can be found in Eurocae (2007). Assuming the error sources in Table 2 are independent and Gaussian, the overall errors at the 95^th percentile can be determined by taking the root of the sum-squared of the individual errors (Table 3).

Table 2.

ILS Performance Specifications ICAO (2002, 2004) and Eurocae (2007).

Table 3.

ILS Performance.

2.2. Integrity – Alert Limits

To guarantee the integrity of the information output at the aircraft ILS receiver under both nominal and fault conditions, monitors are used to ensure that errors exceeding a certain threshold (the Alert Limit – AL) are detected and annunciated within a given Time-To-Alert (TTA) from the onset of the failure. The probability that the monitors do not detect errors exceeding the AL within the TTA corresponds to the Integrity Risk (IR), shown in Table 1. For each of the errors described above, the AL requirements in Eurocae (2007) were derived based on the ILS monitor limits specified in ICAO (2002, 2004), assumed to be given at the 5σ level. The same ILS geometrical considerations as above were used. The monitor limits were assumed to correspond to the maximum permissible errors. The overall AL (Table 4) was derived as the sum of the individual alert limits (Eurocae, 2007).

Table 4.

Alert Limits (lateral – LAL and vertical – VAL) derived from ILS Monitor Limits (Eurocae, 2007).

2.3. Choice of Linearization Height

In order to determine the linearization height to derive the vertical performance (Eurocae, 2007), requirements to land within a given ‘landing box’ (LB) (set out in EASA (2003) and shown in Figure 2), were used in addition to the ILS specifications. By using a half-length of the touchdown-box as the Nominal Touch-Down Point (NTDP) at 1450 ft, the maximum allowable Total System Error (TSE) along the runway (TSE-RWY_ILS) is computed as 1250 ft. Under the assumption that the FTE along the glide-path (FTE-GP_ILS) and the NSE-GP_ILS are independent and that the statistical distribution of errors along the glide-path can be converted to that of the errors along the runway through the flare manoeuvre, Eurocae (2007) relates the TSE-RWY_ILS to the FTE along the glide-path (FTE-GP_ILS) by (Figure 3):

(1)

$TSE_{RWY\comma ILS} \equals {{FTE_{GP\comma ILS} } \over {\sin \lpar \alpha \minus \varepsilon _{NSE} \rpar }}$

where ε_NSE corresponds to the angular error derived from the ILS performance specifications. By subtracting the FTE-GP_ILS from the total TSE-GP_ILS at TH+200ft, the NSE-GP_ILS as is extracted as (Eurocae, 2007):

(2)

$NSE_{GP\comma ILS} \equals TSE_{RWY\comma ILS} \times \left( {\sin \alpha \minus \sin \left( {\alpha \minus \varepsilon _{NSE} } \right)} \right)$

Using a nominal GPA=3 deg and ε_NSE=0·1337, the NSE-GP _ILS is derived as 0·89 m. This value lies in between those obtained from the 50 ft and 100 ft linearization heights. As this NSE is consistent with a typical height at which most aircraft cease to use the glide-path, it was selected in Eurocae (2007) as the minimum requirement.

Figure 2.

Landing Box Requirements (EASA, 2003).

Figure 3.

Alternative Derivation of GBAS NSE (Eurocae, 2007).

2.4. Validation – Accuracy and Alert Limits

The accuracy and integrity values derived were validated using the synthetic model in the ILS Collision Risk Model (CRM), as described in detail in Eurocae (2007). The difference with the simple RSS addition of the individual errors is that in this model, the total error is based upon a convolution of the individual errors. Table 5 shows a comparison of the RSS and CRM derivation of the NSE-GBAS errors and the VAL. EUROCAE used automatic landing simulations with conservative assumptions on the FTE to further validate these requirements. The results suggest that a NSE-GBAS of 1 m and a VAL of 2·6 m provides equivalent operational performance to ILS (Eurocae, 2007).

Table 5.

CRM Validation of Errors and VAL (Eurocae, 2007).

3. AUTOLAND METHODOLOGY

The Autoland method was developed jointly by Boeing and the FAA (Murphy et al, Reference Murphy2005), and adopted by the RTCA. It aims to establish requirements such that GBAS provides operational safety equivalent to the ILS, underpinned by the current airworthiness certification criteria (EASA, 2003; FAA, 1999).

3.1. Airworthiness Requirements

Current airworthiness certification mandates that aircraft touch down inside the landing box (Figure 2). The risks (probabilities) associated with the relevant TSE being exceeded (i.e. landing outside the box) are specified for three conditions (Murphy et al., Reference Murphy2005): fault-free (Figure 2), a single or combination of malfunctions (without monitors), and the limit case representing the worst case error assuming that biases are limited by monitors.

Assuming that the TSE components are Gaussian and uncorrelated, the variance of the TSE along the runway (RWY) is expressed as:

(3)

$\sigma _{TSE \minus RWY}^{\setnum{2}} \equals \sigma _{FTE \minus RWY}^{\setnum{2}} \plus \sigma _{NSE \minus RWY}^{\setnum{2}}$

where the variances of the FTE and NSE are also both measured along the runway. All three cases are analysed in detail in Murphy et al (Reference Murphy2005) and Shively (Reference Shively2004). An overview of the analysis is given below. For each case and a given NSE, the maximum allowed FTE is computed as a function of the aircraft NTDP, and compared to the performance of current Boeing aircraft.

3.1.1. Fault-Free Case

As shown in Figure 4 under the assumption of a normal distribution, the probability of landing short PLS or of landing long PLL can be related to the TSE by:

(4)

$P_{LS}^{FF} \equals {1 \over {\sqrt {2\pi } \sigma _{TSE \minus RWY} }}\int\nolimits_{ \minus \infty }^{TH \plus \setnum{200}} {e^\displaystyle{ \minus {{\left( {x \minus NTDP} \right)^{\setnum{2}} } \over {\setnum{2}\sigma _{{TSE \minus RWY}}^{\setnum{2}} }}} \hskip2ptdx}$

(5)

$P_{LL}^{FF} \equals {1 \over {\sqrt {2\pi } \sigma _{TSE \minus RWY} }}\int\nolimits_{TH \plus \setnum{2700}}^{ \plus \infty } {e^{ \minus \displaystyle{{\left( {x \minus NTDP} \right)^{\setnum{2}} } \over {\setnum{2}\sigma _{{TSE \minus RWY}}^{\setnum{2}} }}} dx}$

Assuming that σ_FTE and σ_NSE are uncorrelated, the following relations are obtained:

(6)

$\sigma _{FTE \minus RWY\comma LS}^{FF} \les \left\{ {\left[ {{{NTDP \minus 200 \minus TH} \over {\sqrt 2 \times erfc^{ \minus \setnum{1}} \left( {2 \times 10^{ \minus \setnum{6}} } \right)}}} \right]^{\setnum{2}} \minus \sigma _{NSE \minus RWY\comma LS}^{\setnum{2}} } \right\}^{\setnum{1}\sol \setnum{2}}$

(7)

$\sigma _{FTE \minus RWY\comma LL}^{FF} \les \left\{ {\left[ {{{2700 \minus NTDP \plus TH} \over {\sqrt 2 \times erfc^{ \minus \setnum{1}} \left( {2 \times 10^{ \minus \setnum{6}} } \right)}}} \right]^{\setnum{2}} \minus \sigma _{NSE \minus RWY\comma LL}^{\setnum{2}} } \right\}^{\setnum{1}\sol \setnum{2}}$

where

(8)

$erfc\lpar x\rpar \equals {2 \over {\sqrt \pi }}\int\nolimits_{x}^{ \plus \infty } {e^{ \minus t^{\setnum{2}} }\, dt}.$

The σ_NSE-RWY is related to the VAL by (Murphy et al., Reference Murphy2005):

(9)

$\sigma _{NSE \minus RWY} \equals {{3{\cdot}28 \times VAL} \over {K_{md\comma H\setnum{0}} \times \tan \lpar GPA\rpar }}$

where K _md,H0 is the fault-free missed detection multiplier, equal to 6·9 (vertically) and GPA is the glide-path angle of the approach.

Figure 4.

Probability of landing outside box – Fault-free case.

3.1.2. Malfunction Case

In the case of a malfunction, airworthiness certification states that “the probability of any single or combination of malfunctions that prevents a safe landing must be extremely improbable […]”. This applies to any malfunction with a probability larger than 1E-9. Furthermore, the “longitudinal touchdown should be no earlier than a point on the runway 200 ft from the threshold and the longitudinal touch-down should be no further than 3000 ft from the threshold”. Finally, it is stated that “malfunction cases may be considered under nominal environmental conditions”. In Murphy et al (Reference Murphy2005), nominal environmental conditions are interpreted as meaning all variations resulting in the middle 95% of the touchdown dispersion. Using a similar approach to the fault-free case, the maximum tolerable FTE is derived as:

(10)

$\sigma _{FTE \minus RWY\comma LS}^{MF} \les \left( {\left[ {{{NTDP \minus 200 \minus TH \minus E\lowast 3{\cdot}28\sol \tan \alpha } \over 2}} \right]^{\setnum{2}} \minus \sigma _{NSE \minus RWY}^{\setnum{2}} } \right)^{\setnum{1}\sol \setnum{2}}$

(11)

$\sigma _{FTE \minus RWY\comma LL}^{MF} \les \left( {\left[ {{{3000 \minus NTDP \plus TH \minus E\lowast 3{\cdot}28\sol \tan \alpha } \over 2}} \right]^{\setnum{2}} \minus \sigma _{NSE \minus RWY}^{\setnum{2}} } \right)^{\setnum{1}\sol \setnum{2}}$

where E is the additional bias-like error [in metres] in the vertical and is transformed during the flare manoeuvre into E∗3·28/tanα along the RWY [in feet].

3.1.3. Limit Case

EASA (2003) specifies limit risk, with respect to landing within the ‘box’, as the probability of occurrence if one variable is held at its most adverse value, while the other variables vary according to their probability distributions. The probabilities of landing short or long are given as 1E-5. The most adverse value of the error is assumed to depend on the probability of occurrence of a bias-like error E_B, P(E_B), equal to 1 given the hypothesis of a fault; the probability of this error not being detected (by a monitor), P_MD(E_B), and the conditional probability that, given such error, the aircraft makes an Unsafe Landing (UL), i.e. lands outside the landing box, P(UL|E_B). The total probability of an UL with a given E_B is then:

(12)

$P_{UL} \left( {E_{B} } \right) \equals P\left( {E_{B} } \right) \times P_{MD} \left( {E_{B} } \right) \times P_{UL\vert E_{B} } \left( {E_{B} } \right).$

Therefore, the overall probability of UL is assumed to be a trade-off between the probability of missed-detection (P_MD) given an error E_B, which decreases with increasing E_B (due to the existence of monitors) and the probability of landing outside the box given an error of size E_B, which increases with increasing error. Analogous to the malfunction case, the probability of UL given a worst bias error of value E_B on the short-side can be expressed as:

(13)

$P_{LS\vert E_{B} }^{Lim} \lpar E_{B} \rpar \equals {1 \over {\sqrt {2\pi } \sigma _{TSE \minus RWY} }}\int\nolimits_{ \minus \infty }^{TH \plus \setnum{200}} {e^\displaystyle{ \minus {{\left( {x \minus NTDP \plus E_{B} \lowast {3{\cdot}28}\sol \tan \alpha } \right)^{\setnum{2}} } \over {\setnum{2}\sigma _{{TSE \minus RWY}}^{\setnum{2}} }}} \; dx}$

where E _B is a function of the monitor used. The P _MD depends on the error size and the monitors used. In Shively (Reference Shively2004), three different error sources for GBAS are addressed: Reference Receiver (RR) – VPL_H1 test and B-value test; ephemeris and signal deformation faults. Each of these errors is monitored, thereby limiting the biases transmitted to the aircraft to a value determined by the monitor threshold, with a probability that depends on the monitor performance (affected e.g. by noise). As an example, for the B-value test (which produces the worst-case E _B in Shively, Reference Shively2004), the protection level under the hypothesis of a single faulted RR is (RTCA, 2004):

(14)

$VPL_{H\setnum{1}\comma j} \equals MAX\left\{\! {\left\vert {B_{vert\comma j} } \right\vert \plus K_{md\comma H\setnum{1}} \sigma _{vert\comma H\setnum{1}} } \right\}$

for each of the j RRs. In order to satisfy the integrity risk allocated to the H1 hypothesis, Murphy et al (Reference Murphy2005) requires that:

(15)

$\left\vert {B_{vert\comma \max } } \right\vert \plus K_{md\comma H\setnum{1}} \sigma _{vert\comma H\setnum{1}} \equals VAL.$

This is rewritten as:

(16)

$\eqalign{\left\vert {B_{vert\comma \max } } \right\vert \equals \tab VAL \times \left( {1 \minus {{K_{md\comma H\setnum{1}} \sigma _{vert\comma NSE\comma H\setnum{1}} } \over {K_{md\comma H\setnum{0}} \sigma _{vert\comma NSE\comma H\setnum{0}} }}} \right) \cr \equals \tab 0{\cdot}344 \times VAL \cr}$

under some general assumptions about the residual errors (see Shively, Reference Shively2004) and the assumption that VPL_H0 and VPL_H1 are both equal to VAL at the worst geometry. A threshold is thus set at B_vert,max and the risk of an unsafe landing as a function of E_B is computed using the derivation presented in Shively (Reference Shively2004). The value of E_B corresponding to the maximum probability of an unsafe landing is then used to compute the FTE versus NTDP bound as in Equations 6 and 7:

(17)

$\sigma _{FTE \minus RWY\comma LS}^{Lim} \les \left( {\left[ {{{NTDP \minus 200 \minus TH \minus E_{B \minus RWY}^{\max } \lowast 3{\cdot}28\sol \tan \alpha } \over {\sqrt 2 \times erfc^{ \minus \setnum{1}} \left( \displaystyle{{{2 \times 10^{ \minus \setnum{5}} } \over {P_{md} \left( {E_{B \minus RWY}^{\max } } \right)}}} \right)}}} \right]^{\setnum{2}} \minus \sigma _{NSE \minus RWY}^{\setnum{2}} } \right)^{\setnum{1}\sol \setnum{2}}$

(18)

$\sigma _{FTE \minus RWY\comma LL}^{Lim} \les \left( {\left[ {{{3000 \minus NTDP \plus TH \minus E_{B \minus RWY}^{\max } {\lowast} 3{\cdot}28\sol \tan \alpha } \over {\sqrt 2 \times erfc^{ \minus \setnum{1}} \left( {{{2 \times 10^{ \minus \setnum{5}} } \over {P_{md} \left( {E_{B \minus RWY}^{\max } } \right)}}} \right)}}} \right]^{\setnum{2}} \minus \sigma _{NSE \minus RWY}^{\setnum{2}} } \right)^{\setnum{1}\sol \setnum{2}}$

The denominator takes into account the fact that the total probability of landing outside the box is the combined probability of the ‘limit case error’ not being detected and the TSE exceeding this box.

3.2. Results of Autoland Method

In the Autoland method in Murphy et al (Reference Murphy2005), the approach is taken to compute the maximum allowed FTE for a select maximum allowed NSE and compare the maximum allowed FTE to the FTE currently achieved by (Boeing) aircraft. The fault-free condition is shown to constrain the maximum tolerable NSE for the land-long case whilst the malfunction and limit-case conditions are shown to limit the maximum tolerable NSE for the land-short case. For all three cases, the conclusion is reached that a VAL of 10 m results in FTE requirements that can be met by current Boeing Aircraft for a landing under CAT-III weather conditions.

4. COMPARISON OF ILS-LA AND AUTOLAND METHODS

The ILS-LA and the Autoland methods both make the same assumptions about the safety requirements, defined by the probability to land within the landing box. Furthermore, both methods assume the same type of probability distribution, i.e. Gaussian. In theory therefore, both methods should deliver the same navigation system error specifications under the key assumption that all other factors contributing to the total system error are the same. However, as shown in Table 1 the results are significantly different: for example, the VAL requirement derived by EUROCAE using the ILS Look-Alike method is 2·6 m and by the RTCA using the Autoland method is 10 m.

From Sections 2 and 3, a number of key issues and differences can be identified:

• The ILS-LA method uses the tolerances for the ILS error sources described in Table 2 to compute the overall tolerance. A number of error sources described in ICAO (2002) were not taken into consideration. The effect of neglecting these additional error sources is to potentially over-estimate current ILS performance, leading to effectively more stringent navigation system performance requirements.
• The error specifications of the ILS provided in ICAO (2002, 2004) are not always clear (Capretti, Reference Capretti2006). Noticeably, the levels at which the individual errors in Table 2 and Table 4 are provided are ambiguous. For example, Section 4.1.5 of ICAO (2002) refers to errors at 2σ whilst Section 4.2.55 refers to 3σ. Moreover, there are inconsistencies between the error tolerances and monitor limits, which are specified at the 5σ level. This led to the assumption in the ILS-LA approach that the actual error tolerance corresponds to the minimum between the error and monitor specifications at the 2σ level. The justification for this approach is unclear and its sensitivity to the interpretation of the σ-level has not been investigated.
• The ILS-LA method is based on many years of operational experience with ILS, during which no aircraft has landed outside the landing box as a direct result of using the ILS for the landing operation. Therefore, the safety requirements of landing inside the box have always been met. However, safety requirements have potentially been exceeded, making current ILS navigation system specifications potentially too stringent to meet the landing safety requirements. On the other hand, the Autoland method assumes the actual allocated probability of landing inside the landing box under different error configurations.
• The Autoland method considers three types of error conditions and safety considerations for landing inside the box and deduces the limiting condition for the specification of the NSE. A number of hypotheses in determining the limiting conditions are questionable.
• The Autoland method assumes that, in addition to satellite navigation equipment, conventional aircraft equipment such as radar altimeter and autopilot are used in the transition to the flare and touchdown manoeuvre, which affect the measured FTE of the aircraft used in the derivation of the NSE.
• Whilst the ILS-LA method attempts to provide generic, architecture-independent NSE requirements, the Autoland method in Murphy et al (Reference Murphy2005) considers a specific monitor-enabled architecture for GBAS CAT-III, based on the proposed architecture for GBAS CAT-I.

Sections 4.1 and 4.2 investigate each of these issues and major differences. Section 4.3 provides a detailed comparison and options for reconciling the two approaches.

4.1. ILS-LA Method Analysis

4.1.1. Additional Error Sources

As a first step, a detailed review of all the major ILS error sources as well as the performance specifications thereof were carried out in this paper, using the same approach as in Eurocae (2007). In addition to the error sources summarised in Eurocae (2007), various other error sources were identified from ICAO (2002, 2004) in this paper for the glide-slope:

• Radio-frequency interference leading to course-line fluctuations.
• Depth of modulation due to the carrier at power supply frequencies or harmonics and noise.
• Fluctuations in the difference in DDM as a result of the receiver displacement sensitivity tolerance.
• Displacement linearity of the receiver: difference between input and output.

Table 6 compares the results obtained for the vertical accuracy of ILS with and without including these additional errors (all added in quadrature). The values are close, showing that the impact of accounting for the additional error sources is not significant.

Table 6.

Revised glide-slope error sources.

4.1.2. Error Tolerance versus Monitor Limits

One of the assumptions in the derivation of the errors given in Table 6 is that the monitor limits in ICAO (2002, 2004) correspond to the 5σ limit and that Adjust-Maintain (AM) limits can be interpreted as NSE errors and are given at the 3σ level. The more stringent of these two values when converted to 1σ is interpreted as the ILS-NSE requirement. However, no specification of the σ-levels is provided for some of the variables and it is not clear that adjust-maintain limits were in fact specified at the 3σ rather than the 2σ limit (Capretti, Reference Capretti2006). Typically, when interpreted at the 3σ level the error specifications at 95% are more stringent than those derived from the monitor specifications at 5σ. In order to investigate the sensitivity of the σ-level on the performance specification of ILS, a comparison of AM limits interpreted at the 2σ and 3σ limits was carried out in this paper. The effect of using 2σ instead of 3σ is to relax the ILS performance requirements. The results are shown in Table 7. The difference in the results is at the level of 10% and can clearly not explain the large discrepancy between the RTCA and EUROCAE approaches in deriving these error specifications.

Table 7.

Different Interpretations of ICAO (2002, 2004) Performance Specifications.

The alert limits were derived separately, although not independently from the NSE, by adding the monitor limits specified for the various error sources. For those error sources where no monitor was specified, a 5σ value of the NSE was assumed. However, as shown in Eurocae (2007), there are inconsistencies between the error specifications obtained when interpreting the monitor-limit at 5σ and the AM limits at 3σ. Since both specifications refer to the same error sources with the same distribution, the actual ratio between the monitor-limit and AM specifications should simply correspond to the ratio of the σ-levels, i.e. 5/3 in the above case. Yet they do not and probabilities are not preserved. In order to preserve the probabilities, this paper derives the VAL on the basis of the NSE derived in this paper (see Table 6, column 3), requiring the total integrity risk to be less than or equal to the required integrity risk 0·5E-9 (see Table 1). Table 8 compares the results of the vertical alert limits derived using this method and those derived in Eurocae (2007). The results are in very good agreement. If the same ratio between the VAL and σ_NSE as in Murphy et al (Reference Murphy2005) is considered (shown in the last column of Table 8), the difference is approximately 11%.

Table 8.

GBAS VAL – Different Derivation Methods.

4.1.3. ILS Operational Experience – Translation of ILS into GBAS errors

One of the differences between the ILS and the GBAS is the angular nature of the errors in the former and the bias-like nature in the latter. As a validation of the derived performance requirements, Eurocae (2007) derives the GBAS NSE using the Autoland landing box requirements by projecting the landing box requirements onto the approach path using a model based on the Collision Risk Model (CRM). A key assumption is that the actual total system error of the combined aircraft plus ILS navigation system corresponds to the total system error derived based on the landing box specifications. In order for this assumption to be valid, an implicit assumption on the FTE is made. This is a key assumption and, as is shown in Section 4.3, is one of the key factors contributing to the discrepancies between the results of the ILS-LA and the Autoland methods.

Under these assumptions, Eurocae (2007) obtains a so-called “beta-to-bias” NSE for GBAS and extracts a so-called linearization height. Two flawed assumptions in this process are notable. In translating the ILS errors into GBAS errors firstly, the derivation implicitly assumes a correlation between NSE-GP_GBAS and FTE-GP_GBAS (Equation 2) and secondly, the NSE is computed perpendicular to the GP rather than vertically. These issues are addressed here by developing a slightly modified picture of Figure 3, shown in Figure 5a and Figure 5b.

Figure 5a.

Revised Beta-to-Bias method (ILS).

Figure 5b.

Revised Beta-to-Bias Method (GBAS).

In the approach shown in Figure 5, no correlation between the FTE and NSE is assumed. Moreover, the computations are carried out in the vertical direction rather than perpendicular to the glide-path. In deriving the NSE requirements, it should be noted that the GPIP does not coincide with the NTDP of the ‘landing box’. In order to compare the box requirements with the ILS specifications, the GPIP needs to be shifted to the NTDP. As a result, given the angular nature of the ILS error, the NSE error at TH+200 is effectively computed at a distance of 1250 ft from the GPIP, corresponding to a linearization height of 65·5 ft.

Let T be the parameter along the runway, a function of F (the vertical parameter at TH+200) and α (the GPA), simple differential calculus yields:

(19)

$dT \times \tan \alpha \equals dF \minus {T \over {\cos ^{\setnum{2}} \lpar \alpha \rpar }}\,d\alpha$

If F and α are uncorrelated, making the appropriate associations, we can rewrite the above equation as:

(20)

$\sigma_{TSE\comma RWY\comma ILS}^{\setnum{2}} \times \tan ^{\setnum{2}} \alpha \equals \sigma _{FTE\comma Vert\comma ILS}^{\setnum{2}} \plus {{T^{\setnum{2}} } \over {\cos ^{\setnum{4}} \alpha }}\sigma _{\alpha }^{\setnum{2}}.$

The second term on the right-hand-side corresponds to σ_NSE,Vert,ILS, yielding:

(21)

$\eqalign{\sigma _{NSE\comma Vert\comma ILS} \equals \tab {{1250} \over {\cos ^{\setnum{2}} \lpar 3\rpar }} \times 0{\cdot}1391 \times {\pi \over {180}} \cr \equals \tab 0{\cdot}928\,m\,\lpar 2\sigma \rpar \cr}$

For equivalent performance to ILS, this value corresponds to the required σ_{NSE,Vert,GBAS}. In order to satisfy the total integrity risk of 0·5E-9 per 15 seconds (vertically), the VAL can be derived as:

(22)

$\eqalign{ VAL \equals \tab \sigma _{NSE \minus vert\comma GBAS} \times \sqrt 2 \times erfc^{ \minus \setnum{1}} \lpar 0{\cdot}5E \minus 9\rpar \cr \equals \tab 2{\cdot}89\;m \cr}$

The results of a similar computation assuming that the original ILS Adjust-Maintain (AM) limits are given at 2σ, are presented in Table 9.

Table 9.

VAL – Different interpretations of ILS ICAO specifications and VAL.

Using the interpretation of the ILS-errors at 3σ (in Eurocae, 2007) produces a VAL=2·89 m (using the interpretation of VAL in this paper) or a VAL=3·20 m (using the interpretation of VAL in Murphy et al, Reference Murphy2005). Both values are of the same order of magnitude and clearly different from the 10 m VAL obtained from the Autoland analysis. Table 10 summarises the results obtained from the ILS-LA method in this paper. Since the NSE is assumed to be a bias for GBAS and the FTE is assumed to be constant over the approach, the vertical values are assumed to be independent of height and distance from the threshold. The similarity between the values of the σ_FTE and σ_TSE shows that for the ILS, nearly all of the tolerable error is allocated to the FTE. This result is crucial since it means that even small differences in the assumption on the FTE potentially lead to significant differences in the NSE requirements. As discussed in Section 4.3, the assumption on the FTE is the key difference between the assumptions made between the two methods and responsible for the large discrepancies in the final specifications obtained.

Table 10.

Results from ILS-LA (this paper).

4.2. Autoland Method Analysis

4.2.1. Limiting Condition for the Specification of the NSE

In Murphy et al (Reference Murphy2005), a distinction is made between fault-free, malfunction (FAA, 1999) and ‘limit’ (EASA, 2003) conditions. For the malfunction condition, nominal environmental conditions are interpreted as variations resulting in the middle 95% of the touchdown dispersion. The ‘limit’ case condition is interpreted as an NSE with the largest probability of landing outside the box. This is the convolution of the conditional probability of having an error of a given size, of not detecting this error (by a monitor) and that given such error, of the aircraft landing outside the landing box. FAA (1999) makes a distinction between fault-free and malfunction conditions only, where specifications for the malfunction conditions do not mention any allowed probability of landing outside the revised landing box. EASA (2003) on the other hand, distinguishes between ‘average’ and ‘limit’ cases. To reconcile the two ‘Airworthiness Requirements’ sources, this paper interprets the requirements as follows:

• Fault-Free: Corresponding to the ‘average’ case, with a landing box between TH+200 ft and TH+2700 ft and a probability of not landing either before or after the box of <1E-6 (as in Murphy et al, Reference Murphy2005).
• Malfunction: with a landing box between TH+200 ft and TH+3000 ft and a probability of not landing either before or after the box of <1E-5. The malfunction was initially interpreted as a bias-error corresponding to the VAL and ‘nominal environmental conditions’ are interpreted as conditions of the fault-free scenario.
• Limit Case: with a landing box between TH+200 ft and TH+3000 ft and a probability of not landing either before or after those limits less than 1E-5. As specified in EASA (2003), “the ‘limit’ column is the probability of occurrence if one variable is held at its most adverse value, while the other variables vary according to their probability distributions”.

If the approach is taken to keep the performance requirements generic, and no specific architecture is assumed, the limit and malfunction cases are identical. This was one of the potential approaches taken in this paper. As in the malfunction case, the ‘most adverse value’ was therefore initially interpreted as a bias-error of magnitude VAL. Using a similar derivation (as shown in Figure 6) to that in Murphy et al (Reference Murphy2005), the probability of landing short or long under malfunction conditions was derived as:

(23)

$P_{LS}^{MF} \equals {1 \over {\sqrt {2\pi } \sigma _{TSE \minus RWY} }}\int\nolimits_{ \minus \infty }^{TH \plus \setnum{200}} {e^\displaystyle{ \minus {{\left( {x \minus NTDP \plus E\lowast {3{\cdot}28}\sol \tan \alpha } \right)^{\setnum{2}} } \over {\setnum{2}\sigma _{{TSE \minus RWY}}^{\setnum{2}} }}}\,dx}$

and

(24)

$P_{LL}^{MF} \equals {1 \over {\sqrt {2\pi } \sigma _{TSE \minus RWY} }}\int\nolimits_{TH \plus \setnum{3000}}^{ \plus \infty } {e^\displaystyle{ \minus {{\left( {x \minus NTDP \minus E\lowast {3{\cdot}28}\sol \tan \alpha } \right)^{\setnum{2}} } \over {\setnum{2}\sigma _{{TSE \minus RWY}}^{\setnum{2}} }}}\,dx}$

where E is the additional bias-like error [in metres] in the vertical and is transformed during the flare manoeuvre into E-RWY [in feet] scaled by the glide-slope angle α.

Figure 6.

Probability of landing short or long – Malfunction case.

The σ_FTE in this paper were derived as:

(25)

$\sigma _{FTE \minus RWY\comma LS}^{MF} \les \left( {\left[ {{{NTDP \minus 200 \minus TH \minus E\lowast 3{\cdot}28\sol \tan \alpha } \over {\sqrt 2 \times erfc^{ \minus \setnum{1}} \left( {2 \times 10^{ \minus \setnum{5}} } \right)}}} \right]^{\setnum{2}} \minus \sigma _{NSE \minus RWY}^{\setnum{2}} } \right)^{\setnum{1}\sol \setnum{2}}$

(26)

$\sigma _{FTE \minus RWY\comma LL}^{MF} \les \left( {\left[ {{{3000 \minus NTDP \plus TH \minus E\lowast 3{\cdot}28\sol \tan \alpha } \over {\sqrt 2 \times erfc^{ \minus \setnum{1}} \left( {2 \times 10^{ \minus \setnum{5}} } \right)}}} \right]^{\setnum{2}} \minus \sigma _{NSE \minus RWY}^{\setnum{2}} } \right)^{\setnum{1}\sol \setnum{2}}$

where the σ_NSE-RWY in this paper was originally assumed to correspond to the maximum NSE error along the runway allowed by the VAL in the fault-free case. Note the difference in the denominator for the malfunction case developed in Murphy et al, Reference Murphy2005 (see Section 3.1.2.) and in this paper. However, for reasons explained later in this section, the σ_NSE-RWY may have to be interpreted differently to be in line with integrity requirements.

Under the initial assumptions on the σ_NSE-RWY, the difference of this paper with Murphy et al (Reference Murphy2005) is in the interpretation of nominal environmental conditions, interpreted here as referring to conditions identical to the fault-free case except for the addition of a bias-error to the nominal NSE. The reason for this approach is that it preserves the allowed probability of landing short or long. The choice of 95% in Murphy et al (Reference Murphy2005) effectively limits the probability of landing within the ‘box’ to 95% rather than the required 99·999% (1–1E-5). Additionally, the approach in this paper allows the requirements in EASA (2003) and FAA (1999) to be reconciled.

Figure 7 shows the FTE as a function of NTDP derived for the nominal and malfunction conditions using the interpretation in Murphy et al (Reference Murphy2005) and the malfunction conditions using the initial interpretations in this paper. The fault-free case with a VAL=10 m is also shown. In order to satisfy the touchdown requirements, the FTE of the aircraft with the worst-case performance (i.e. of the aircraft with the largest FTE for a given NTDP) must lie below the respective curve for all conditions. Current Boeing aircraft performance corresponds to the grey area (extracted from Murphy et al, Reference Murphy2005). Whilst under fault-free and malfunction conditions as interpreted in Murphy et al (Reference Murphy2005) a VAL of 10 m can satisfy current Boeing aircraft performance, the initial interpretation of malfunction conditions in this paper suggested a VAL=5·2 m was required to satisfy the malfunction condition. However, further research identified that the assumption of a bias at the alert limit essentially imposes an actual limit on the maximum tolerable NSE that is larger than the VAL and is therefore inconsistent with the integrity requirements. The malfunction condition must thus be interpreted differently. An option is to interpret the malfunction requirement as a landing inside the box with a probability of 1–1E-5 in the presence of a NSE at the alert limit, rather than a bias-error at the alert limit. Such interpretation would be consistent with the integrity definition.

Figure 7.

Comparison of nominal malfunction cases.

However, irrespective of the interpretation of the malfunction condition, it should be noted that whilst perhaps counter-intuitive at first, it is actually the landing operation under nominal conditions that requires the most stringent navigation system performance and not the malfunction or limit-case conditions. This is because the geometry of the landing requirements (i.e. the landing box), together with the probability of landing inside the box, determines the allowed NSE (for a given FTE), irrespective of whether the NSE is composed of a bias and noise or only of noise. The integrity requirements of the landing operation then determine the required VAL. In other words, the VAL is determined by the operation only (under the assumption of a given FTE). Moreover, given that the TSE requirements for the malfunction case are less stringent than for the nominal conditions, the VAL in the malfunction case is expected to be larger than the VAL derived from the nominal conditions (assuming that the NSE malfunction does not affect the FTE). Therefore, nominal conditions impose the limiting constraint.

4.2.2. Aircraft Architecture Assumptions

The derivation in the above section makes no assumptions about the architecture of the ground subsystem. However, it implicitly assumes a specific architecture onboard the aircraft, namely radar altimeters, in determining the FTE during the landing operation. This leads to the performance of Boeing aircraft shown in Figure 7, with FTE values of ~211 ft at the NTDP=1450 ft – significantly different from the approach used in the ILS-LA method.

4.2.3. Navigation Architecture-specific Derivation

One of the questions to be addressed is if it is acceptable to derive performance requirements based on the use of ground-monitors and how this may affect the navigation system performance requirements for CAT-III landing. As discussed earlier, the total performance requirements should depend only on the operation and not a specific architecture. However, a possible approach is to assume a specific ground architecture to derive the NSE that can be achieved with given monitors, and adopt this as the NSE requirement. This would then impose a limit on the FTE requirements that aircraft would have to meet to satisfy the operational TSE. A specific architecture would thus allow to trade the required NSE for the required FTE, without affecting the total performance requirements of the landing operation. Therefore, an architecture-independent derivation using the FTE requirements from the architecture-dependent approach should result in identical maximum NSE requirements. A comparison of monitor versus no-monitor cases in Murphy et al (Reference Murphy2005) seems to show that the existence of monitors relaxes the NSE performance requirements for a given FTE. This result would imply that the TSE is architecture dependent. However, as discussed above, the TSE should not depend upon any architecture. To explain this result, it should be noted that the total residual NSE is essentially composed of a bias-term and a noise factor, and the maximum allowed residual NSE can be expressed as:

(27)

$\sigma_{NSE}^{\max } \equals VAL \equals Bias\plus \sigma _{noise}^{\max }$

where the σ_noise includes noise both at ground level and aircraft level. By imposing monitor thresholds, the bias-error is limited. This allows the system to perform better than in the absence of monitors, i.e. it is possible to satisfy lower VAL requirements. Alternatively, one may be tempted to say that the maximum ‘noise’ is allowed to be larger than if there was no threshold (because the overall GBAS system performance is better than without monitors), up to a limit imposed by the monitor:

(28)

$\sigma _{noise}^{\max } \equals VAL\, \minus Bias$

This appears to be the approach taken in Murphy et al (Reference Murphy2005), with the exception that the larger noise-allowance appears to have been interpreted as a larger NSE allowance. This would explain why Murphy et al (Reference Murphy2005) obtained more relaxed VAL (rather than more relaxed ‘maximum noise’) in the presence of monitors. However, relaxing noise-requirements is not necessarily an option as the noise under malfunction conditions and nominal conditions may be linked and may result in the integrity requirements of the nominal conditions not being met.

4.3. Key issues of ILS-LA and Autoland Results

Given that the basic assumptions on safety requirements and error distributions are the same for both methods, unless ILS NSE performance specifications are too stringent with respect to the Airworthiness Certification requirements, both methods should give similar performance requirements for GBAS. However, as shown in Table 11 there are a number of differences.

Table 11.

Key differences between ILS Look-Alike and Autoland methods.

From the review carried out three key issues can be identified with the methods used to derive the NSE performance requirements: the existence, or not, of monitors, interpretation of ‘most adverse error’ and the assumptions on the maximum tolerable aircraft FTE.

The Autoland method assumes the existence of monitors in the derivation of the performance requirements whilst the Autoland method in this paper and the ILS-LA method do not. It should be noted that this should not be confused with the use of monitors as a means of achieving the performance requirements, which GBAS will need, irrespective of which method is used in the derivation of the performance requirements. The use of a specific architecture with monitors imposes a limit on the bias, and will allow GBAS to perform better (i.e. with more stringent values of VAL) than in the absence of monitors. Therefore, aircraft with lower FTE performance may be able to perform landings under CAT-III weather conditions. In Murphy et al (Reference Murphy2005), monitors are employed to relax the VAL requirements, rather than allowing them to be tightened for reasons explained earlier.

The interpretation of ‘most adverse error’ as a bias with a magnitude of VAL result in VAL requirements that were apparently more stringent than the VAL under nominal conditions. However, given that the operational requirements in the malfunction case or the limit case are more relaxed than those under nominal conditions, the NSE and VAL are expected to be larger than under nominal conditions. The reason why a smaller VAL was obtained is an incorrect interpretation of the bias as an error with magnitude VAL, since this interpretation does not allow the integrity requirements to be met. An alternative interpretation of ‘most adverse error’ as a NSE at the alert limit (rather than a bias-error at the alert limit) was proposed in this paper and results in a VAL under malfunction conditions that is larger than the VAL under nominal conditions.

The key difference between the ILS-LA method and Autoland methods is the assumption made with respect to the maximum FTE. As shown in Table 11 the former implicitly assumes that the σ_FTE,RWY,GBAS may take any value up to 261·36 ft (with a NTDP=1450 ft). In comparison, the Autoland method assumes a maximum σ_FTE,RWY,GBAS determined by the current Boeing aircraft performance (including the use of radar altimeters) up to ~211 ft. Figure 8 shows the maximum VAL that can be supported as a function of the FTE at the NTDP=1450 ft.

Figure 8.

VAL versus FTE at NTDP=1450 ft.

The smaller FTE assumed on Boeing aircraft allows for a larger VAL. If the Boeing FTE is assumed in the ILS-LA method, a VAL=17·2 m is derived. This is very similar to the VAL=16·4 m derived in this paper for the Autoland method under nominal conditions. However it is significantly different from the VAL=2·9 m derived in this paper from the ILS-LA method, which assumed a larger implicit FTE. The essential difference between the ILS-LA method and Autoland method without monitors is thus the assumption made on the maximum allowed FTE. This may suggest that the NSE requirements of ILS, whilst appropriate for the FTE performance of aircraft at the time when these performance requirements were derived, may be too stringent for the performance of modern aircraft.

5. CONCLUSION

In order to harmonise the NSE performance requirements for CAT-III landing, two approaches may be taken:

• the development of a specific GBAS architecture with specific monitor thresholds in the allocation of the performance requirements or,
• the definition of aircraft FTE requirements.

If a specific GBAS architecture is used in the derivation of the performance requirements, monitors determine the NSE performance that can be achieved. This NSE requirement hence implicitly imposes specific FTE requirements upon the aircraft. If on the other hand the assumption is made that FTE of current aircraft must be supported, this would impose a limit on the performance requirements that monitors must be able to support. If more stringent performance requirements than this limit can be met by the specific architecture, it would allow the FTE requirements to be relaxed.

Based on the landing box requirements, this paper has shown that nominal conditions impose the limiting constraint on aircraft landing under CAT-III weather conditions. If the current FTE implicitly assumed in the ILS performance specifications is used, a VAL=2·9 m is required. If instead the Boeing aircraft FTE performance is considered, a VAL ~17 m would provide the required safety for a Cat-III landing. The difference in FTE assumptions thus results in significantly different NSE requirements. The establishment and validation of FTE requirements is thus another possible approach towards the harmonisation of the NSE performance requirements. If this approach is taken, both the ILS-LA and the Autoland method would essentially agree on the NSE performance requirements that should be applied, irrespective of whether monitors are used or not.

In addition to the above, various other issues should be addressed including the validity of the assumption that the vertical NSE and FTE normal distributions translate into normal distributions along the runway during the flare manoeuvre, the impact of using individual monitors for specific failures in the presence of simultaneous multiple failures, the impact of a decorrelation of the NSE residual errors between the ground station and the aircraft, and optimal design and dimensioning of ground monitors.

ACKNOWLEDGMENT

This work was undertaken within the ANASTASIA project, funded under the EC Sixth Framework Program. The authors acknowledge the contributions of ANASTASIA partners and the EC.

References

REFERENCES

Capretti, A., (2006). Communication with A. Capretti, ICAO.Google Scholar

EASA, (2003). Certification Specifications for All Weather Operations, CS-AWO Book 2, AMC-AWO-131.Google Scholar

Eurocae, (2007). High-Level Performance Requirements For a Global Navigation Satellite System/Ground Based Augmentation System to Support Precision Approach Operations, ED-144, EUROCAE (2007).Google Scholar

FAA, (1999). Criteria for Approval of Category III Weather Minima for Takeoff, Landing and Rollout, FAA Advisory Circular 120-28D (July 1999).Google Scholar

Guillet, A., (2007). Communication with A. Guillet – Airbus-France.Google Scholar

ICAO, (2002). Manual on Testing of Radio Navigation Aids – Volume I: Testing of Ground-Based Radio Navigation Systems, DOC 8071.Google Scholar

ICAO, (2004). Aeronautical Telecommunications – Annex 10, Volume 1.Google Scholar

Indiens, R., (2005). Alert Limit Requirements Harmonization, RTCA.Google Scholar

Murphy, T et al. , (2005). Determining the Vertical Alert Requirements for a Level of GBAS Service that is Appropriate to Support Cat II/III Operations, Boeing Report Vol. IV.Google Scholar

Murphy, T. (2006). Work currently ongoing at Boeing, Communication with T. Murphy.Google Scholar

RTCA (2004). Minimum Aviation System Performance Standards for the Local Area Augmentation System (LAAS), RTCA-DO245A.Google Scholar

Schuster, W. and Ochieng, W., (2006). Presentation to EUROCAE WG28-SG4 (27-29 March).Google Scholar

Schuster, W., (2006). Navigation Performance Requirements Tables, ANASTASIA (July).Google Scholar

Schuster, W. et al. , (2008). High Accuracy Navigation Study Report, ANASTASIA EC Deliverable D3232.Google Scholar

Schuster, W. et al. (2009). Key technology operational performance analysis final report, ANASTASIA EC Deliverable D3.4.Google Scholar

Shively, C. (2004) Derivation of Vertical Alert Limit for LAAS Cat III Autoland Considering Limit Risk Requirement, 60^th Annual Meeting of the ION.Google Scholar