Doc 9937

Operating Procedures and Practices for Regional

Monitoring Agencies in Relation to the Use
of a 300 m (1 000 ft) Vertical Separation Minimum
Between FL 290 and FL 410 Inclusive
Second Edition, 2019

Approved by and published under the authority of the Secretary General

INTERNATIONAL CIVIL AVIATION ORGANIZATION

Doc 9937
Operating Procedures and Practices for Regional
Monitoring Agencies in Relation to the Use
of a 300 m (1 000 ft) Vertical Separation Minimum
Between FL 290 and FL 410 Inclusive
Second Edition, 2019

Approved by and published under the authority of the Secretary General

INTERNATIONAL CIVIL AVIATION ORGANIZATION

Published in separate English, Arabic, Chinese, French, Russian
and Spanish editions by the
INTERNATIONAL CIVIL AVIATION ORGANIZATION
999 Robert-Bourassa Boulevard, Montréal, Quebec, Canada H3C 5H7

For ordering information and for a complete listing of sales agents

and booksellers, please go to the ICAO website at www.icao.int

Second Edition, 2019

Doc 9937, Operating Procedures and Practices for Regional

Monitoring Agencies in Relation to the Use of a 300 m (1 000 ft)
Vertical Separation Minimum Between FL 290 and FL 410 Inclusive
Order Number: 9937
ISBN 978-92-9258-644-7

© ICAO 2019

All rights reserved. No part of this publication may be reproduced, stored in a

retrieval system or transmitted in any form or by any means, without prior
permission in writing from the International Civil Aviation Organization.
 AMENDMENTS

Amendments are announced in the supplements to the Products and Services

Catalogue; the Catalogue and its supplements are available on the ICAO website at
www.icao.int. The space below is provided to keep a record of such amendments.

RECORD OF AMENDMENTS AND CORRIGENDA

AMENDMENTS CORRIGENDA

No. Date Entered by No. Date Entered by

(iii)
 FOREWORD

The requirements and procedures for the introduction of a 300 m (1 000 ft) vertical separation between FL 290 and
FL 410, generally referred to as the reduced vertical separation minimum (RVSM), were developed by the Review of the
General Concept of Separation Panel (RGCSP), which has since been renamed the Separation and Airspace Safety
Panel (SASP). The provisions necessary for the application of RVSM have been incorporated into Annex 2 — Rules of
the Air, Annex 6 — Operation of Aircraft, Annex 11 — Air Traffic Services and the Procedures for Air Navigation
Services — Air Traffic Management (PANS-ATM, Doc 4444). More detailed guidance material is provided in the Manual
on Implementation of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive (Doc 9574).

In order to ensure that the overall safety objectives of the air traffic services (ATS) system can be met, all aircraft
operating in airspace where RVSM is implemented are required to hold an approval, issued by the State of the Operator
or State of Registry as appropriate, indicating that they meet all the technical and operational requirements for such
operations. This requirement, and the responsibility of States with regard to the issuance of these approvals, are
specified in 7.2.4 b) of Annex 6, Parts I and II.

Doc 9574 states that there is a need for system performance monitoring for the operational use of RVSM. The
requirement for and technical performance criteria of monitoring are described in Chapter 5 of Doc 9574. Regional
monitoring agencies (RMAs) have been established by the appropriate planning and implementation regional groups
(PIRGs) to undertake these functions. The objectives of the RVSM monitoring programme include, inter alia:

a) verification that the RVSM approval process remains effective;

b) verification that the target level of safety will be met upon implementation of RVSM and will continue to
be met thereafter;

c) monitoring of the effectiveness of the altimetry system modifications which have been implemented to
enable aircraft to meet the required height-keeping performance criteria; and

d) evaluation of the stability of altimetry system error (ASE).

_____________________

(v)
 TABLE OF CONTENTS

Page

Glossary ....................................................................................................................................................... (ix)

Definitions ................................................................................................................................................. (ix)

Abbreviations and acronyms ..................................................................................................................... (xi)

Publications ..................................................................................................................................................... (xiii)

Chapter 1. Introduction ................................................................................................................................ 1-1

1.1 Purpose of the manual ................................................................................................................... 1-1

1.2 General description of RMA functions ............................................................................................ 1-1
1.3 Requirements for the establishment and operation of an RMA ...................................................... 1-2

Chapter 2. Working principles common to all regional monitoring agencies ......................................... 2-1

2.1 Establishment and maintenance of an RVSM approvals database ................................................ 2-1

2.2 Monitoring and reporting aircraft height-keeping performance and
the occurrence of large height deviations ....................................................................................... 2-2
2.3 Conducting safety assessments .................................................................................................... 2-7
2.4 Safety reporting and monitoring operator compliance with State
approval requirements after RVMS implementation ....................................................................... 2-12
2.5 Remedial actions ............................................................................................................................ 2-12

Appendix A. Duties and responsibilities of a regional monitoring agency ............................................. App A-1

Appendix B. RMA forms for use in obtaining records of RVSM approvals from a
State authority ........................................................................................................................................ App B-1

Appendix C. Content and format of an RVSM approvals database and procedures

for exchanging data ............................................................................................................................... App C-1

Appendix D. Merits and requirements of height-monitoring systems ..................................................... App D-1

Appendix E. Guidance on reducing minimum monitoring requirements ................................................ App E-1

Appendix F. Action to be taken when an individual airframe is assessed as being non-compliant

with altimetry system error performance requirements ..................................................................... App F-1

Appendix G. Recommended height-keeping performance monitoring data to be maintained

in electronic form by an RMA for each monitored aircraft ................................................................. App G-1

(vii)
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
(viii) of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

Appendix H. Action to be taken when a monitoring group is assessed as being non-compliant

with altimetry system error performance requirements ..................................................................... App H-1

Appendix I. Large height deviation reporting form ................................................................................... App I-1

Appendix J. Scrutiny group composition, objectives and methodology ................................................ App J-1

Appendix K. Suggested form for ATC unit monthly reporting of large height deviations ..................... App K-1

Appendix L. Sample content and format for collection of sample traffic movements ........................... App L-1

_____________________
 GLOSSARY

DEFINITIONS

The following definitions are intended to clarify specialized terms used in this document.

Aberrant aircraft. Aircraft which exhibit measured height-keeping performance that is significantly different from the
core height-keeping performance measured for the whole population of aircraft operating in RVSM airspace.

Aircraft-type group. Aircraft are considered to be members of the same group if they are designed and assembled by
one manufacturer and are of nominally identical design and build with respect to all details that could influence the
accuracy of height-keeping performance.

Altimetry system error (ASE). The difference between the altitude indicated by the altimeter display, assuming a
correct altimeter barometric setting, and the pressure altitude corresponding to the undisturbed ambient pressure.

Altimetry system error stability. Altimetry system error for an individual aircraft is considered to be stable if the
statistical distribution of altimetry system error is within agreed limits over an agreed period of time.

Altitude. The vertical distance of a level, point or an object considered as a point, measured from mean sea level (MSL).

Altitude-keeping device. Any equipment which is designed to automatically control the aircraft to a referenced pressure
altitude.

Assigned altitude deviation (AAD). The difference between the transponded Mode C altitude and the assigned
altitude/flight level.

Collision risk. The expected number of mid-air aircraft accidents in a prescribed volume of airspace for a specific
number of flight hours due to loss of planned separation.

Note.— One collision is considered to result in two accidents.

Exclusionary RVSM airspace. Airspace in which flight cannot be planned by civil aircraft which do not hold a valid
RVSM approval from the appropriate State authority.

Flight technical error (FTE). The difference between the altitude indicated by the altimeter display being used to control
the aircraft and the assigned altitude/flight level.

Height. The vertical distance of a level, a point or an object considered as a point, measured from a specified datum.

Height-keeping capability. Aircraft height-keeping performance that can be expected under nominal environmental
operating conditions with proper aircraft operating practices and maintenance.

Height-keeping performance. The observed performance of an aircraft with respect to adherence to flight crew
prescribed flight level. This includes both technical and operational errors.

Large height deviation (LHD). A vertical deviation of 300 ft or more from an altitude assigned or coordinated by ATC.
The deviation may be the result of human error, equipment malfunction or environmental factors such as turbulence,
and should be reported in accordance with the LHD codes in Attachment B to Appendix J.

(ix)
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
(x) of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

Non-compliant aircraft. An aircraft configured to comply with the requirements of the RVSM MASPS which, through
height monitoring, is found to have a total vertical error (TVE) or an assigned altitude deviation (AAD) of 90 m
(300 ft) or greater, or an altimetry system error (ASE) of 75 m (245 ft) or more.

Non-exclusionary RVSM airspace. Airspace where a vertical separation of 300 m (1 000 ft) is applied between RVSM-
approved aircraft, but in which flight may be planned by civil aircraft that do not hold a valid RVSM approval from the
appropriate State authority. In such airspace, a vertical separation of 600 m (2 000 ft) must be applied between any
non-RVSM approved aircraft and all other aircraft.

Occupancy. A parameter of the collision risk model which is twice the number of aircraft proximate pairs in a single
dimension divided by the total number of aircraft flying the candidate paths in the same time interval.

Operational error. Any vertical deviation of an aircraft from the correct flight level as a result of incorrect action by ATC
or the flight crew.

Overall risk. The risk of collision due to all causes, which includes the technical risk (see definition) and the risk due to
operational errors and in-flight emergencies.

Passing frequency. The frequency of events in which two aircraft are in longitudinal overlap when travelling in the same
or opposite direction on the same route at adjacent flight levels and at the planned vertical separation.

RVSM airworthiness approval. The process by which the State authority ensures that aircraft meet the RVSM
minimum aviation system performance specification (MASPS). Typically, this would involve an operator meeting the
requirements of the aircraft manufacturer’s service bulletin for the aircraft and having the State authority verify the
successful completion of this work.

RVSM approval. The term is used synonymously with RVSM operational approval.

RVSM operational approval. The process by which the State authority ensures that an operator meets all the
requirements for operating aircraft in RVSM airspace. RVSM airworthiness approval is a prerequisite for operational
approval.

Target level of safety (TLS). A generic term representing the level of risk which is considered acceptable in particular
circumstances.

Technical risk. The risk of collision associated with aircraft technical height-keeping performance, which specifically
refers to the performance affected by the avionics of the aircraft, not the flight crew.

Total vertical error (TVE). The vertical geometric difference between the actual pressure altitude flown by an aircraft
and its assigned pressure altitude (flight level).

Track. The projection on the earth’s surface of the path of an aircraft, the direction of which path at any point is usually
expressed in degrees from North (true, magnetic, or grid).

Vertical separation. The spacing provided between aircraft in the vertical plane.

Vertical separation minimum (VSM). VSM is documented in the Procedures for Air Navigation Services — Air Traffic
Management (PANS-ATM, Doc 4444) as being a nominal 300 m (1 000 ft) below FL 290 and 600 m (2 000 ft)
above FL 290 except where, on the basis of regional agreement, a value of less than 600 m (2 000 ft) but not less
than 300 m (1 000 ft) is prescribed for use by aircraft operating above FL 290 within designated portions of the
airspace.
Glossary (xi)

ABBREVIATIONS AND ACRONYMS

AAD Assigned altitude deviation

ACAS Airborne collision avoidance system
ADS-B Automatic dependent surveillance — broadcast
ADS-C Automatic dependent surveillance — contract
AGHME Aircraft geometric height measurement element
AHMS ADS-B height monitoring system
ARD Altitude recording device
ASE Altimetry system error
ATC Air traffic control
ATS Air traffic services
CRM Collision risk model
FAA Federal Aviation Administration
FIR Flight information region
GMS GPS-based monitoring system
GMU GPS-based monitoring unit
GPS Global positioning system
HME Height-monitoring equipment
HMU Height-monitoring unit
JAA Joint Aviation Authorities
KSN Knowledge sharing network
LHD Large height deviation
MASPS Minimum aircraft system performance specification
MLAT Multilateration
MMR Minimum monitoring requirements
NAT North Atlantic
NOAA National Oceanic and Atmospheric Administration
PIRGs Planning and implementation regional groups
RA Resolution advisory
RGCSP Review of the General Concept of Separation Panel
RMA Regional monitoring agency
RVSM Reduced vertical separation minimum
SASP Separation and Airspace Safety Panel
SD Standard deviation
SSR Secondary surveillance radar
STC Supplementary type certificate
TCAS Traffic alert and collision avoidance system
TGL Temporary guidance leaflet
TLS Target level of safety
TMU Total vertical error monitoring unit
TVE Total vertical error
VSM Vertical separation minimum

_____________________
 PUBLICATIONS
(referred to in this manual)

Annexes to the Convention on International Civil Aviation

Annex 2 — Rules of the Air

Annex 6 — Operation of Aircraft

Part I — International Commercial Air Transport — Aeroplanes
Part II — International General Aviation — Aeroplanes
Part III — International Operations — Helicopters

Annex 10 — Aeronautical Telecommunications

Volume II — Communication Procedures including those with PANS status

Annex 11 — Air Traffic Services

Procedures for Air Navigation Services

ATM — Air Traffic Management (Doc 4444)

Manuals

Aircraft Type Designators (Doc 8643)

Designators for Aircraft Operating Agencies, Aeronautical Authorities and Services (Doc 8585)

Location Indicators (Doc 7910)

Manual on a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive (Doc 9574)

Reports of Meetings

Report of the Sixth Meeting of the Review of the General Concept of Separation Panel (RGCSP/6) (Doc 9536) 1

_____________________

1. This document is permanently out of print.

(xiii)
 Chapter 1

INTRODUCTION

1.1 PURPOSE OF THE MANUAL

The intent of this manual is to provide guidance on RMA operating procedures, in order to achieve a standardized
approach to the way in which RMAs carry out these functions and the associated detailed duties and responsibilities of
Doc 9574. It is not intended to provide exhaustive guidance on how to operate an RMA. Information on what is required
of an RMA will be found in the Manual on a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410
Inclusive (Doc 9574).

1.2 GENERAL DESCRIPTION OF RMA FUNCTIONS

1.2.1 An RMA supports the continued safe use of RVSM within a designated airspace. In the context of RVSM,
“safe” has a quantitative meaning: satisfaction of the agreed safety goal, or target level of safety (TLS). Section 2.1 of
Doc 9574 describes the safety objectives associated with RVSM implementation and use.

1.2.2 RMA duties and responsibilities are described in Doc 9574, 5.4.4 and 5.4.5, as well as in Appendix A to
this manual. For the purposes of this overview, the functions of an RMA can be summarized as:

a) establish and maintain a database of RVSM approvals;

b) monitor aircraft height-keeping performance and the occurrence of LHDs and report the results
appropriately;

c) conduct safety assessments and report the results appropriately;

d) monitor operator compliance with State approval requirements and report non-approved aircraft to the
appropriate authority or RMA; and

e) initiate necessary remedial actions if RVSM requirements are not met.

1.2.3 A list of the RMAs responsible for the provision of monitoring and safety assessment activities related to
RVSM in each FIR and a list of the States and respective designated RMAs for RVSM approvals are available on the
ICAO portal and the websites of individual RMAs.

1-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
1-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

1.3 REQUIREMENTS FOR THE ESTABLISHMENT AND OPERATION OF AN RMA

1.3.1 An RMA must have both the authority and technical competence to carry out its functions. In establishing
an RMA, it is therefore necessary to ensure that:

a) the organization receives authority from a PIRG to act as an RMA as the result of a decision by a
State, a group of States or a PIRG; and

b) the organization acting as an RMA has adequate personnel with the technical skills and experience to
carry out the functions listed in 1.2.2.

1.3.2 It is the responsibility of the body authorizing the establishment of an RMA to ensure that these
requirements are met. An example of a process satisfying this requirement would be for the organization intending to be
an RMA to participate in a training programme under the guidance of an established RMA. For an organization with no
prior experience in RVSM monitoring, such a programme could take as long as one year and should include both formal
and on-the-job training.

_____________________
 Chapter 2

WORKING PRINCIPLES COMMON

TO ALL REGIONAL MONITORING AGENCIES

This chapter presents the working principles common to all RMAs and describes the activities associated with the five main
RMA functions listed in Chapter 1, Section 1.2. More detailed information, including agreed data formats, required
communication links and appropriate references to ICAO documents and regional materials, is provided in the Appendices.

2.1 ESTABLISHMENT AND MAINTENANCE OF AN

RVSM APPROVALS DATABASE

2.1.1 One of the functions of an RMA is to establish a database of aircraft approved by its State authority for
operations in RVSM airspace in the region for which the RMA has responsibility. This information is necessary for two
reasons:

a) the RMA is responsible for verifying the approval status of all aircraft operating within its region; and

b) height-keeping performance data must be correlated to an approved airframe.

This information is of vital importance if the height-keeping performance data collected by the height-monitoring systems
are to be effectively utilized in the risk assessment.

2.1.2 Aviation is a global industry and many aircraft operating in a region where RVSM has not previously been
implemented may nevertheless be approved for RVSM operations and have their approvals registered with another
RMA. While each RMA will need to establish an RVSM approvals database, there is considerable scope for database
sharing. So while a region will need its own RMA to act as a focal point for the collection and collation of RVSM
approvals for aircraft operating under its jurisdiction, it may not need to maintain a complete database of all aircraft in the
world that are RVSM-approved. It will, however, need to establish links with other RMAs in order to determine the RVSM
status of aircraft it has monitored, or intends to monitor, so that a valid assessment of the technical height-keeping risk
can be made.

2.1.3 To avoid duplication by States in registering approvals with RMAs, the concept of a designated RMA for
the processing of approval data has been established in this guidance material. Under the designated RMA concept, all
States are associated with a particular RMA for the processing of RVSM approvals. A list of States and their respective
designated RMAs should be endorsed by PIRGs and/or bilateral agreements detailing the respective responsibilities,
and should be maintained on ICAO’s portal and the websites of individual RMAs. RMAs may contact any State to
address safety matters without regard to the list of designated RMAs. The correspondence between the RMA and each
particular State should be coordinated with the respective designated RMA.

2.1.4 Appendix B provides the pertinent forms, together with a brief description of their use, that an RMA should
supply to a State authority to obtain information on aircrafts’ RVSM approval status.

2-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
2-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

2.1.5 To facilitate data sharing, each RMA should maintain its approvals database in a common format and in
electronic form.

2.1.6 Appendix C suggests the minimum database content and the format in which it should be maintained by an
RMA. Appendix C also describes the data to be shared by RMAs and procedures for sharing such data.

2.2 MONITORING AND REPORTING AIRCRAFT HEIGHT-KEEPING PERFORMANCE

AND THE OCCURRENCE OF LARGE HEIGHT DEVIATIONS

2.2.1 An RMA must be prepared to collect the information necessary to assess the in-service technical height-
keeping performance of the aircraft operating in the airspace for which it has monitoring responsibility. In addition, it
must establish procedures for the collection of information concerning large deviations from the cleared flight level and
operational errors caused by non-compliance with ATC instructions or loop errors within the ATC system.

2.2.2 Experience has shown that monitoring aircraft technical height-keeping performance is a challenging task
requiring specialized systems. Experience has also shown that organizing and overseeing the collection of LHD
information necessitates special procedures. These two topics will be treated separately in this section.

Monitoring of aircraft height-keeping performance

2.2.3 Monitoring of aircraft height-keeping performance is a demanding enterprise, particularly as regards the
estimation of ASE. The following discussion of height-keeping performance monitoring first considers the technical
requirements for a monitoring system and then examines the application of monitoring in an airspace. Guidance on
monitoring requirements for RVSM-approved aircraft is also provided along with suggested formats for storing
monitoring data to facilitate data exchange with other RMAs.

Establishment of a technical height-monitoring function

2.2.4 The principal objectives of an RVSM monitoring programme are to provide:

a) evidence of the effectiveness of the RVSM MASPS, and altimetry system modifications made in order
to comply with the MASPS, in achieving the desired height-keeping performance;

b) confidence that the technical TLS will continue to be met thereafter; and

c) evidence of ASE stability.

2.2.5 To achieve these objectives, a technical height-monitoring function must be established. To date, regions
have used either ground-based HMUs, AHMSs, or air portable GMUs. Whatever system(s) a region decides to use, the
quality and reliability of the monitoring infrastructure and its output data must be ensured through correct specification of
the systems and thorough verification of performance.

2.2.6 It is particularly important for RMAs to verify whether height-monitoring data from whatever sources they
use can be combined for the purposes of the data analysis. The combination of data for collision risk evaluation should
be avoided unless the error characteristics of the two monitoring systems have been determined to be identical. This is
especially important in any work to establish ASE stability because the different measurement errors in individual
systems can distort the results and indicate ASE instability when none exists, or vice versa.
Chapter 2. Working principles common to all regional monitoring agencies 2-3

2.2.7 As a means of ensuring both adequate accuracy in estimating TVE and transferability of monitoring results,
an RMA must establish that any TVE estimation system which it administers has a mean measurement error close to
zero and a standard deviation of measurement error not greater than 15 m (50 ft). Estimates of measurement errors
associated with the HMU, AHMS and the GMS, which employs GMUs, should indicate that each system satisfies these
requirements.

2.2.8 An RMA should coordinate with its region’s PIRG to ensure that a suitable monitoring infrastructure is
available to meet the region’s requirements. A suitable monitoring infrastructure can be established through an
arrangement to share GMU facilities with an existing RMA, through the establishment of fixed ground-based monitoring
facilities or an AHMS within the region, or by engaging a suitable contractor to operate the monitoring programme. If the
latter option is selected, the choice of support contractors should take into account their prior experience and the
suitability of the monitoring procedures and facilities which they propose using.

2.2.9 For further information on the merits and requirements of height-monitoring systems, see Appendix D. If a
new method of monitoring is proposed, the new system should, in addition to meeting the requirements of 2.2.7, be
evaluated against existing systems to ensure that the results are comparable.

2.2.10 For regions that have a limited monitoring capability, data from other regions may be acceptable for the
evaluation of technical risk. This should be considered before determining the minimum technical height-monitoring
facilities necessary to meet the requirements of Annex 11.

Technical height-monitoring requirements

2.2.11 The three objectives of aircraft height-keeping performance monitoring are stated in Doc 9574 and noted in
2.2.4 above.

2.2.12 The majority of current aircraft types are eligible for RVSM airworthiness approval under group approval
provisions. These provisions make it possible to define aircraft-type groups consisting of aircraft types that are designed
and assembled by one manufacturer and are of nominally identical design and build with respect to all details that could
influence the accuracy of height-keeping performance. It is not normally necessary to monitor all airframes within a
monitoring group providing an adequate sample is available and the performance of the group is within the parameters
specified below.

2.2.13 The minimum monitoring requirements (MMR) document serves as guidance for RMAs in evaluating
airworthiness issues within their RVSM airspace of responsibility. It is also required to check the long-term stability of
ASE on an ongoing basis. It lists the aircraft types that are eligible for RVSM approval under group provisions and the
groups to which they belong, and suggests the level of monitoring that should be expected for each operator. As data
are collected over time, the monitoring requirements for specific aircraft types may change and, as a result, the MMR
should be updated periodically. The MMR table is available on RMAs’ websites and guidance on how to reduce MMR is
provided in Appendix E.

2.2.14 The analysis of aircraft technical height-keeping performance should demonstrate that:

a) the technical TLS of 2.5 x 10–9 fatal accidents per flight hour has been met;

b) the number of aircraft monitored for each operator/aircraft-type combination meets a predetermined
level;
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
2-4 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

c) aircraft-type groups demonstrate performance such that the absolute value of the group mean ASE is
not in excess of 25 m (80 ft) and that the sum of the absolute value of the mean ASE and 3 SD of ASE
is not in excess of 75 m (245 ft). No individual measurement should exceed 245 ft in magnitude,
excluding monitoring system measurement error; and

d) no individual measurement of ASE for each aircraft approved on a non-group basis for RVSM
operations exceeds 49 m (160 ft) in magnitude, excluding monitoring system measurement error.

Note 1.— Data from other regions may be used to meet the above objectives providing they are
contemporary with the assessment period.

Note 2.— With reference to 2.2.14 b), the minimum number of aircraft in a particular group to be monitored
is normally expressed as a percentage of the operator’s fleet of that group, with a further provision that the number of
aircraft must not be less than two unless the operator has only a single airframe in the group.

Note 3.— With reference to 2.2.14 a), the technical TLS is normally evaluated on an annual basis, as
determined by the PIRG, or on a more frequent basis as determined by an individual RMA. The other activities may be
continuous.

2.2.15 Guidance on the conduct of a safety assessment leading to an estimate of risk for comparison with the
TLS referred to in 2.2.14 a) is provided in Section 2.3.

2.2.16 With regard to 2.2.14 b), the MMR should be reviewed at regular intervals and coordinated with all RMAs.
The reviewed version should be available on the RMA’s website. An RMA in conjunction with its PIRG may require a
higher level of monitoring than defined in the MMR. The MMR itself should be subject to periodic review, either in
collaboration with other RMAs or through ICAO. This review should be based on the quality and quantity of available
data.

2.2.17 It is especially important that an RMA take appropriate action if the height-keeping performance monitoring
system detects an individual aircraft whose ASE, after accounting for measurement error, is in excess of the 75 m (245 ft)
limit noted in 2.2.14 c). Similarly, appropriate action should be taken if either an aircraft’s observed TVE after accounting
for measurement error, or its AAD, is 90 m (300 ft) or more. In all cases, the action should include notifying the aircraft
operator and the State authority which granted the aircraft’s RVSM approval. Appendix F contains an example of such a
letter of notification.

2.2.18 It is also necessary to establish procedures whereby the PIRG is provided with timely notification of all
actions taken under the provisions of 2.2.17.

2.2.19 In order to facilitate the exchange of aircraft height-keeping performance monitoring data between RMAs,
an RMA should maintain the minimum information identified in the exchange of height measurement data table in
Appendix G for each observation of aircraft height-keeping performance obtained from the airspace within which it
exercises its functions.

Reporting of aircraft height-keeping performance statistics

2.2.20 If an RMA is employing a height-keeping performance monitoring system that produces substantial
estimates of aircraft ASE, then tabulations of ASE by aircraft-type groups, as identified in the MMR, should be kept. For
each group, the magnitude of mean ASE and the magnitude of mean ASE + 3 SD of ASE should be calculated and
compared to the group performance limits, which are 25 m (80 ft) and 75 m (245 ft), as noted above. Groups exceeding
Chapter 2. Working principles common to all regional monitoring agencies 2-5

the performance requirements must be investigated and reported annually, or more frequently as required, to the body
which authorized the establishment of the RMA. Note that a minimum data set of results is required before the group
results can be considered valid.

2.2.21 In order to provide for situations where one or both of these limits is exceeded for an aircraft-type group, an
RMA should have a process in place to examine the findings, e.g. through consultation with airworthiness and
operations specialists. This could be achieved, where necessary, by establishing a group within the region consisting of
specialists in these fields. Alternatively, and in particular in cases where the observed performance deficiency is
affecting more than one region, it may be possible to achieve this through cooperation with other regions which have
established airworthiness and operations groups.

2.2.22 It is the RMA’s responsibility to bring performance issues that have an impact on safety to the attention of
State authorities, aircraft manufacturers and PIRGs. Should the examination of monitoring results indicate a potential
systematic problem in group performance, the RMA, or other appropriate body, should notify both the State authority
that issued the airworthiness approval for the aircraft-type group in question and the aircraft manufacturer. Where
applicable, the RMA may also propose remedial measures. An RMA does not have the regulatory authority to require
that improvements to performance be made; only the State that approved the RVSM airworthiness documents for the
aircraft-type group has such authority. However, the State is required, under the provisions of Annex 6, Parts I and II, to
take immediate corrective action with regard to aircraft that are reported by an RMA as not complying with the height-
keeping requirements.

2.2.23 RVSM airworthiness approval documents in the form of an approved service bulletin, supplementary type
certificate (STC) or similar State-approved material provide directions to operators regarding the steps needed to bring
an aircraft type into compliance with RVSM requirements. If there is a flaw in the ASE performance of an aircraft type,
the ultimate goal of the RMA is to influence appropriate corrections to the compliance method, which would then be
incorporated into the applicable RVSM airworthiness approval documents. An RMA’s actions to achieve this goal should
be the following:

a) assemble all ASE monitoring data for the aircraft type from the airspace for which the RMA is
responsible in accordance with the approach shown in Appendix H;

b) assemble the measurement error characteristics of the monitoring system or systems used to produce
the results in a);

c) as deemed relevant by the RMA, assemble all summary monitoring data (consisting of mean ASE,
ASE SD, minimum ASE, maximum ASE, and details of any flights found to be non-compliant with ASE
requirements) from other regions or airspace where the aircraft type has been monitored; and

d) by means of an official RMA letter, similar in form to that shown in Appendix H, inform the State
authority that approved the airworthiness documents for the aircraft-type group, and the manufacturer,
of the observation of allegedly inadequate ASE performance, citing:

1) the requirement that the absolute value of an aircraft-type group’s mean ASE be no greater than
25 m (80 ft), and that the sum of the absolute value of the group’s mean ASE and 3 SD of ASE be
no greater than 75 m (245 ft);

2) the data described in a) and b) and, as necessary, c), which will be provided on request;

3) the need for compliance with these requirements in order to support safe RVSM operations; and
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
2-6 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

4) a request to be informed of consequent action taken by the State and/or manufacturer to remedy the
cause or causes of the observed performance, including any changes to the State airworthiness
approval documents.

Monitoring the occurrence of large height deviations

2.2.24 Experience has shown that LHDs — deviations of 90 m (300 ft) or more in magnitude — have significantly
influenced the outcome of safety assessments of RVSM. RMAs play a key role in the collection and processing of
reports of such occurrences.

2.2.25 The causes of such deviations have been found to be:

a) an error in the altimetry or automatic altitude control system of an aircraft;

b) turbulence and other weather-related phenomena;

c) the crew not following established contingency procedures during an emergency descent by an aircraft;

d) the response to airborne collision avoidance system (ACAS) resolution advisories;

e) not following an ATC clearance, resulting in flight at an incorrect flight level;

f) an error in issuing an ATC clearance, resulting in flight at an incorrect flight level; and

g) coordination errors between adjacent ATC units in the transfer of control responsibility for an aircraft,
resulting in flight at an incorrect flight level.

2.2.26 The aircraft technical height-keeping performance monitoring programme administered by an RMA addresses
the first of these causes. There is, however, a need to establish, at a regional level, the means to detect and report the
occurrence of LHDs due to the remaining causes. A sample LHD reporting form is included in Appendix I. While the RMA
will be the recipient and archivist for reports of LHDs, it is important to note that the RMA alone cannot be expected to
conduct all activities associated with a comprehensive programme to detect and report LHDs. This needs to be addressed
through the appropriate PIRG and its subsidiary bodies as part of an overall regional safety management programme.

2.2.27 Typically, a programme to assess LHDs will usually include a regional or State-based Scrutiny Group to
support the RMA monitoring function. A Scrutiny Group is comprised of operational and technical subject-matter experts
who support the evaluation and classification of LHDs. The RMA should coordinate with the PIRG to establish a
Regional Scrutiny Group, or with relevant State organizations to establish a State-based Scrutiny Group that will
examine reports of LHDs. Scrutiny Group guidance is contained in Appendix J.

2.2.28 Experience has shown that the primary sources of reports of LHDs are the ATC units providing air traffic
control services in the airspace where RVSM is or will be applied. The information available to these units, in the form of
voice reports and ADS-C reports, and through the use of ATS surveillance systems such as radar, ADS-B or MLAT,
provides the basis for identifying LHDs. A programme for identifying LHDs should be established and ATC units should
report such events monthly. A recommended monthly report form is provided in Appendix K. It is the responsibility of the
RMA to collect this information and provide periodic reports of observed height deviations to the appropriate PIRG
and/or its subsidiary bodies, in accordance with procedures prescribed by the PIRG.
Chapter 2. Working principles common to all regional monitoring agencies 2-7

2.2.29 For all involved aircraft, the individual LHD reports from ATC units to the RMA should contain, as a minimum,
the following information:

a) reporting unit;

b) location of deviation, either as latitude/longitude or a bearing and distance from a significant point;

c) date and time of the LHD;

d) sub-portion of airspace, such as established route system, if applicable;

e) flight identification and aircraft type;

f) assigned flight level;

g) final reported flight level or altitude and basis for establishment (e.g. pilot report or Mode C);

h) duration at incorrect level or altitude;

i) cause of deviation;

j) any other traffic in potential conflict during deviation;

k) crew comments when notified of deviation; and

l) remarks from the ATC unit making the report.

2.2.30 Other sources of LHD reports should also be explored. For example, an RMA should investigate, in
conjunction with the responsible PIRG, whether operators within the airspace for which it is responsible would be
prepared to share pertinent summary information from internal safety occurrence databases. Arrangements should also
be made for access to information which may be pertinent to the RVSM airspace from State databases of air safety
incident reports and voluntary reporting safety databases, such as the Aviation Safety Reporting System administered
by the United States National Aeronautics and Space Administration (NASA), all of which could be possible sources of
information concerning LHD incidents in the airspace for which the RMA is responsible.

2.3 CONDUCTING SAFETY ASSESSMENTS

Safety assessment

2.3.1 A safety assessment consists of estimating the risk of collision associated with RVSM and comparing this
risk to the agreed RVSM safety goal, the TLS. An RMA must acquire in-depth knowledge on the use of RVSM within a
particular airspace. Experience has shown that such knowledge can be gained, in part, by reviewing charts and other
materials describing the airspace and by periodically collecting samples of traffic movements within the airspace. It is
also important that RMA personnel sufficiently understand the way in which an ATC system operates in order for them to
correctly interpret the information from these sources.

2.3.2 It should also be noted that currently, there is no standard CRM applicable to all airspace. The
development and application of a CRM is a complicated activity and should be conducted only by trained and
experienced personnel. Emerging RMAs that do not have the requisite skills should seek assistance from external
sources or established RMAs before adapting a CRM or attempting to conduct risk calculations. Additional guidance can
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
2-8 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

be obtained from previous RGCSP and SASP documentation. It will be necessary to adapt existing CRM parameters to
take account of regional variations.

2.3.3 An RMA is responsible for conducting safety assessments on a continual basis. The PIRG will specify the
RMA’s safety reporting requirements.

Establishing the competence necessary to conduct a safety assessment

2.3.4 Conducting a safety assessment is a complex task requiring specialized skills that are not widely available.
As a result, an RMA will need to pay special attention to ensuring that it has the necessary competence to undertake
safety assessments on a continual basis.

2.3.5 Ideally, an RMA should have the internal competence to conduct a safety assessment. However,
recognizing that personnel with the required skills may not be available internally, it may be necessary for the RMA to
augment its internal staff capabilities through arrangements with another RMA or some other organization possessing
the necessary competence.

2.3.6 If an external organization must be used to conduct a safety assessment, the RMA must nevertheless
have the internal competence to judge whether the assessment is carried out properly. This competence should be
acquired through an arrangement with an RMA that has experience in conducting safety assessments.

Conducting a safety assessment

2.3.7 As part of its ongoing duties, an RMA must ensure that a safety assessment takes into account all the
factors that influence collision risk within the airspace where RVSM will be applied. RMAs must therefore establish the
means for collecting and organizing pertinent data and other information needed to adequately assess all the relevant
airspace factors. As noted below, some data sources from other airspace may assist an RMA in conducting a safety
assessment. However, the overall results of a safety assessment from another portion of worldwide airspace may not be
used as the sole justification for concluding that the TLS has been met in the airspace where the RMA has safety
assessment responsibility.

Assembling samples of traffic movements for the airspace

2.3.8 Samples of traffic movements should be collected for the entire airspace being assessed. ATC providers
within the airspace may therefore need to cooperate in the collection of samples. In this case, the RMA will have to
coordinate the collection of traffic movement samples either directly with States or through the PIRG.

2.3.9 An RMA must be fully cognizant of the particular type of RVSM airspace that has been implemented in
particular airspaces. For example, RVSM may be implemented as exclusionary airspace, in which an aircraft must have
RVSM approval to flight plan through the airspace, or as non-exclusionary airspace, in which flight by non-RVSM
approved aircraft is permitted. In the latter case, a minimum of 600 m (2 000 ft) vertical separation must be provided
between the non-approved aircraft and all other aircraft. The RMA also needs to be aware of any changes to the ATS
route structure, including changes to the permitted directions of flight on existing routes. Operational factors such as
these must be taken into account in the safety assessment.
Chapter 2. Working principles common to all regional monitoring agencies 2-9

2.3.10 When planning the time and duration of a traffic sample, the RMA should consider the importance of
capturing any periods of heavy traffic flow which might result from seasonal or other factors. The duration of any traffic
sample should be at least 30 days, or any other statistically significant period, with a longer sample period left to the
judgement of the RMA.

2.3.11 The following information should be collected for each flight in the sample:

a) date of flight (mm/dd/yyyy) or (dd/mm/yyyy);

b) flight identification or aircraft call sign, in standard ICAO format;

c) aircraft type designator, as listed in Doc 8643;

d) aircraft registration mark, if available;

e) an indication that the operator and aircraft are RVSM-approved (i.e. Does a "W" appear in Item 10 of
the flight plan?);

f) location indicator for the origin aerodrome, as listed in Doc 7910;

g) location indictor for the destination aerodrome, as listed in Doc 7910;

h) entry point into RVSM airspace (as a significant point or latitude/longitude);

i) time at entry point;

j) flight level at entry point;

k) exit point from RVSM airspace (as a significant point or latitude/longitude);

l) time at exit point;

m) flight level at exit point; and

n) as many additional position/time/flight-level combinations as the RMA judges necessary to capture the
traffic movement characteristics of the airspace.

2.3.12 When coordinating the collection of the sample, the RMA should, where possible, specify that information
must be provided in electronic form, for example in a spreadsheet. Appendix L contains a sample format for the
collection of traffic movement data in electronic form, where the entries in the first column may be used as column
headings on a spreadsheet template.

2.3.13 Acceptable sources of the information required in a traffic movement sample are one or more of the following:
special ATC observations, ATC automation systems, automated air traffic management systems, and ATS surveillance
system data.

Review of operational procedures and airspace organization

2.3.14 Experience has shown that operational procedures and airspace organization can substantially affect the
collision risk in RVSM airspace. An example of this, in addition to the one given in 2.2.24, would be the decision to apply
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
2-10 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

the table of cruising levels in Appendix 3 of Annex 2 while using routes in a unidirectional manner. This decision would
make it possible to provide an effective 600 m (2 000 ft) vertical separation between aircraft at adjacent usable flight
levels on these routes.

2.3.15 In light of such possibilities, the RMA should carefully review operational procedures and airspace
organization to identify any features that might influence risk. Any aspects that could adversely affect risk should be
reported to the body responsible for the planning and oversight of the airspace.

Agreed safety assessment process for determining whether the TLS is met

2.3.16 “Technical risk” is the term used to describe the risk of collision associated with aircraft height-keeping
performance. Some factors which contribute to technical risk are:

a) errors in aircraft altimetry and automatic altitude control systems;

b) aircraft equipment failures resulting in unmitigated deviation from the cleared flight level, including
situations in which not following the required procedures further increases the risk; and

c) responses to false ACAS resolution advisories.

Intuitively, such factors affect risk to a greater extent if the planned vertical separation between a pair of aircraft is 300 m
(1 000 ft), compared to if a 600 m (2 000 ft) standard is in use.

2.3.17 The term “operational error” is used to describe any vertical deviation of an aircraft from the correct flight
level as a result of incorrect action by ATC or the flight crew. Examples of such actions are:

a) a flight crew misunderstanding an ATC clearance, resulting in the aircraft operating at a flight level
other than that issued in the clearance;

b) ATC issuing a clearance which places an aircraft at a flight level where the required separation from
other aircraft cannot be maintained;

c) a coordination failure between ATC units in the transfer of control responsibility for an aircraft,
resulting in either no notification of the transfer or the transfer at an unexpected flight level;

d) inappropriate response to a valid ACAS resolution advisory; and

e) incorrect pressure setting on the altimeters, e.g. QNH remains set.

2.3.18 On initial consideration, the relationship between the required vertical separation and risk due to
operational errors may be less clear than is the case with technical risk. However, as will be pointed out in the
subsequent discussion of risk modelling, the application of RVSM does increase the risk associated with such errors if
all other factors remain unchanged when transitioning from a 600 m (2 000 ft) to 300 m (1 000 ft) vertical separation
minimum. When carrying out a risk assessment, care should be taken to avoid including a single event in both the
assessment of technical risk and assessment of operational risk.
Chapter 2. Working principles common to all regional monitoring agencies 2-11

2.3.19 The overall RVSM safety goal which must be satisfied is the one agreed upon at the regional level and
expressed as the number of fatal accidents per flight hour due to all causes of risk associated with RVSM. However, as
noted in 1.2.1, there is also an upper limit to the permissible technical risk. Therefore, in order to declare that the safety
goal has been met, the RMA must show that the following two conditions are satisfied simultaneously:

–9
a) the technical risk does not exceed 2.5 x 10 fatal accidents per flight hour; and

b) the sum of the technical risk and risk resulting from operational errors does not exceed the agreed
regional number of fatal accidents per flight hour.

–9
2.3.20 While there is a firm bound on technical risk of 2.5 x 10 fatal accidents per flight hour, there is no similar
maximum tolerable value for risk due to operational errors. Thus, it is possible that risk modelling can result in an
–9
estimate of technical risk less than 2.5 x 10 fatal accidents per flight hour and an estimate of operational risk in excess
of this value, with the sum of the two still satisfying the overall TLS. On the other hand, if the estimate of technical risk
–9
exceeds 2.5 x 10 fatal accidents per flight hour, it is not possible to satisfy the overall safety goal, even if the sum of
the estimated technical and operational risks does not exceed the agreed regional number of fatal accidents per flight
hour.

The collision risk model used in safety assessment

2.3.21 This guidance will not present derivation or details of the CRM to be used in conducting a safety
assessment. An RMA should acquire that background knowledge by reviewing the following publications:

a) Report of the Sixth Meeting of the Review of the General Concept of Separation Panel (RGCSP/6)
1
(Doc 9536), Montreal, 28 November to 15 December 1988, Volume 1 (History and Report) and
Volume 2 (Annexes A to E);

2
b) Risk Assessment and System Monitoring, August 1996 (available from the ICAO European and North
Atlantic Office);

c) EUR RVSM Mathematical Supplement, Document RVSM 830, European Organisation for the Safety
of Air Navigation (Eurocontrol), August 2001; and

d) Manual on a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive
(Doc 9574), Appendix A, Third Edition, 2012.

2.3.22 The report of RGCSP/6 contains the derivation of the basic mathematical vertical collision risk model, as
well as a description of the choice of a value for the portion of the TLS applied to technical risk.

2.3.23 The North Atlantic and Eurocontrol documents contain the detailed safety assessment processes and
procedures applied in the two regions in preparation for RVSM implementation.

1. This document is permanently out of print.

2. This material is contained in NAT Doc 002 which is no longer in print; however, the Supplement is still available.
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
2-12 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

2.4 SAFETY REPORTING AND MONITORING OPERATOR COMPLIANCE

WITH STATE APPROVAL REQUIREMENTS AFTER RVSM IMPLEMENTATION

2.4.1 The overall purpose of RMA activities is to support the continued safe use of RVSM.

2.4.2 The RMA should conduct periodic safety assessments in order to determine whether the TLS continues to
be met. The frequency of these reports is as required by the responsible PIRG. The minimum requirement should be
annual reports.

2.4.3 One important activity of the RMA is to conduct periodic checks of the approval status of operators and
aircraft using airspace where RVSM is applied. This activity is especially important in FIRs or other areas of
responsibility where RVSM is applied on an exclusionary basis. This activity is termed monitoring operator compliance
with State approval requirements.

2.4.4 An RMA will require two sources of information to monitor operator compliance with State approval
requirements:

a) a listing of the operators and the type and registration marks of aircraft operating in the airspace; and

b) the database of State RVSM approvals.

2.4.5 Ideally, this compliance monitoring should be implemented for the entire airspace on a daily basis.
However, difficulties in accessing traffic movement information may make such daily monitoring impossible. As a
minimum, the responsible RMA should conduct compliance monitoring of the complete airspace for at least a 30-day
period annually. When conducting compliance monitoring, the filed RVSM approval status shown on the flight plan of
each traffic movement should be compared to the database of State RVSM approvals. When a flight plan shows an
aircraft as RVSM-approved, but the approval is not recorded in the database, the appropriate State authority should be
contacted for clarification of the discrepancy.

2.4.6 RMAs should keep in mind that it is the responsibility of the State authority to take appropriate action
should an operator be found to have filed a false declaration of RVSM approval status.

2.5 REMEDIAL ACTIONS

2.5.1 Remedial actions are measures taken to eliminate causes of systematic problems associated with factors
that affect the safe use of RVSM. RMAs must be proactive in the identification, reporting and resolution of all causes of
risk. Remedial actions may be necessary to eliminate the following causes of problems:

a) failure of an aircraft-type group to comply with group ASE requirements;

b) failure of individual airframes to meet ASE compliance requirements;

c) aircraft operating practices resulting in LHDs; or

d) operational errors.

2.5.2 All RMAs should periodically review monitoring results to determine if there is evidence of any recurring
problems.

2.5.3 An RMA should design its height-keeping performance monitoring programme to provide ongoing
summary information of ASE performance by aircraft-type group so that adverse trends can be identified quickly. When
Chapter 2. Working principles common to all regional monitoring agencies 2-13

non-compliant ASE performance is confirmed for an aircraft-type group or individual airframe, the RMA should follow the
guidance material described in this manual.

2.5.4 The RMA should report to the PIRG any issue that has an impact on the safe operation of RVSM, in
accordance with agreed procedures. It is especially important that RMAs conduct an annual review of reports of LHDs
with a view to uncovering systematic problems. If such problems are discovered, these reports should be submitted
according to the requirements specified by the body that authorized the establishment of the RMA. The reports should
include details of LHDs suggesting the existence of a systematic problem.

_____________________
 Appendix A

DUTIES AND RESPONSIBILITIES OF A

REGIONAL MONITORING AGENCY
(Based on 5.4.4 and 5.4.5 of Doc 9574)

The duties and responsibilities of an RMA are to:

1. establish and maintain a database of aircraft approved by the respective State authorities for operations within
RVSM airspace in that region;

2. receive reports of height deviations of aircraft observed to be non-compliant, based on the following criteria:

a) TVE ≥ 90 m (300 ft);

b) ASE ≥ 75 m (245 ft);

c) AAD ≥ 90 m (300 ft);

3. take the necessary action with the relevant State and operator to:

a) determine the likely cause of the height deviation; and

b) verify the approval status of the relevant operator;

4. recommend, wherever possible, remedial action;

5. analyse data to detect height deviation trends and, hence, take action as in 4;

6. undertake the data collections required by the PIRG to:

a) investigate height-keeping performance of the aircraft in the core of the distribution;

b) establish or add to a database on the height-keeping performance of:

— the aircraft population;

— aircraft types or categories; and

— individual airframes;

App A-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App A-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

7. monitor the level of risk as a consequence of operational errors and in-flight contingencies as follows:

a) establish a mechanism for collation and analysis of all reports of height deviations of 90 m (300 ft) or more
resulting from the above errors/actions;

b) determine, wherever possible, the root cause of each deviation together with its size and duration;

c) calculate the frequency of occurrence;

d) assess the overall risk (technical combined with operational and in-flight contingencies) in the system against
the overall safety objectives (see Doc 9574); and

e) initiate remedial action as required;

8. initiate checks of the approval status of aircraft operating in the relevant RVSM airspace, identify non-approved
operators and aircraft using RVSM airspace and notify the appropriate State of Registry/State of the Operator
accordingly;

9. circulate regular reports on all height-keeping deviations, together with the graphs and tables necessary for relating
the estimated system risk to the TLS, employing the criteria detailed in Doc 9574, for which formats are suggested
in Appendix A to Doc 9574; and

10. submit annual reports to the PIRG.

_________________
 Appendix B

RMA FORMS FOR USE IN OBTAINING RECORDS OF RVSM

APPROVALS FROM A STATE AUTHORITY
(APPROVAL NOTIFICATION BY AN OPERATOR MUST BE VALIDATED
BY THE APPROPRIATE AUTHORITY)

1. It is important for RMAs to have an accurate record of a point of contact for any queries that might arise
about an ongoing height-monitoring investigation or approval status. Originators are therefore requested to provide a
completed Form RMA F1 upon their first communication with the RMA and subsequently whenever there are changes
the point of contact’s details.

2. Ideally, originators should submit information to the RMA in electronic form or, alternatively, by fax or post.
A separate Form RMA F2 must be completed for each aircraft granted RVSM approval.

3. Form RMA F3 must be completed and immediately forwarded to the RMA when the State of Registry has
cause to withdraw the approval of an operator/aircraft for operations in RVSM airspace.

4. Sample Forms RMA F1, F2 and F3 and instructions for completing them follow.

App B-1
Appendix B App B-3

RMA F1
CONTACT DETAILS FOR MATTERS RELATING TO RVSM APPROVALS

This form should be completed and returned to the address below upon the first communication with the RMA or when
there is a change to any of the details requested on the form. (PLEASE USE BLOCK LETTERS)

STATE:

ICAO ONE- OR TWO-LETTER

1
IDENTIFIER FOR STATE

ADDRESS:

CONTACT PERSON FOR MATTERS CONCERNING RVSM APPROVALS:

Name:
First name Surname

Title: Initials:

Post/Position:

Telephone No.: Fax No.:

E-mail:

Initial reply*/Change of details* (*Delete as appropriate)

When completed, please return to the following address:

(RMA address)

Telephone: Fax: E-mail:

1. Enter the one- or two-letter ICAO identifier as contained in the most current version of Doc 7910. If more than one identifier is
designated for the State, use the letter identifier that appears first.
Appendix B App B-5

RMA F2
RECORD OF APPROVAL TO OPERATE IN RVSM AIRSPACE

APPROVAL NOTIFICATION BY AN OPERATOR MUST BE VALIDATED

BY THE APPROPRIATE STATE AUTHORITY
(Please refer to the instructions overleaf)

This form must be completed and returned to the address below, without delay, when the State of Registry or State of
the Operator approves or amends the approval of an operator/aircraft for RVSM operations. (PLEASE USE BLOCK
LETTERS)

1
State of Registry:

2
Name of the Operator:

3
State of the Operator:

4
Aircraft type:

5
Aircraft series:

6
Manufacturer’s serial number:

7
Registration mark:

8
Mode S aircraft address:

9
Airworthiness approval:

10
Date issued:

11
RVSM approval:

12
Date issued:

13
Date of expiry (if applicable):

Method of compliance reference (service bulletin

14
number, STC number, etc.):

15
Remarks:

When completed, please return to the following address:

(RMA address)

Telephone: Fax: E-mail:

 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App B-6 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

INSTRUCTIONS FOR COMPLETING FORM RMA F2

1. Enter the one- or two-letter ICAO identifier as contained in the most current version of Doc 7910. If more than one
identifier is designated for the State, use the letter identifier that appears first.

2. Enter the operator’s three-letter ICAO identifier as contained in the most current version of Doc 8585. For general
aviation aircraft, enter “IGA”. For military aircraft, enter “MIL”. If none, place an X in this field and write the name of
the operator/owner in the remarks row.

3. Enter the one- or two- letter ICAO identifier as contained in the most current version of Doc 7910. If more than one
identifier is designated for the State, use the letter identifier that appears first.

4. Enter the ICAO designator as contained in the most current version of Doc 8643, e.g. for Airbus A320-211, enter
A320; for Boeing B747-438, enter B744.

5. Enter the aircraft series or manufacturer’s customer designation, e.g. for Airbus A320-211, enter 211; for Boeing
B747-438, enter 400 or 438.

6. Enter the manufacturer’s serial number.

7. Enter the registration mark of the aircraft, e.g. for AA-XYZ, write AAXYZ.

8. Enter the ICAO-allocated Mode S aircraft address code (6 characters, hexadecimal).

9. Enter Yes or No.

10. Enter the date the airworthiness approval was issued (MM/DD/YY), e.g. for October 26, 1998, write 10/26/98.

11. Enter Yes or No.

12. Enter the date the RVSM approval was issued (MM/DD/YY), e.g. for October 26, 1998, write 10/26/98.

13. Enter the date of expiry of the RVSM approval (MM/DD/YY), e.g. for October 26, 1998, write 10/26/98.

14. Provide information on the method of compliance (service bulletin number, STC number, etc.).

15. Provide any other remarks.

Appendix B App B-7

RMA F3
WITHDRAWAL OF APPROVAL TO OPERATE IN RVSM AIRSPACE

NOTIFICATION BY AN OPERATOR MUST BE VALIDATED

BY THE APPROPRIATE STATE AUTHORITY
(Please refer to the instructions overleaf)

This form must be completed and returned to the address below, by the most appropriate method, when the State of
Registry or State of the Operator has cause to withdraw the approval of an operator/aircraft for operations within the
RMA airspace. (PLEASE USE BLOCK LETTERS)

1
State of Registry:

2
Name of the Operator:

3
State of the Operator:

4
Aircraft type:

5
Aircraft series:

6
Manufacturer’s serial number:

7
Registration mark:

8
Mode S aircraft address:

9
Date of withdrawal of RVSM approval:
10
Reason for withdrawal of RVSM approval:

11
Remarks:

When completed, please return to the following address:

(RMA address)

Telephone: Fax: E-mail:

 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App B-8 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

INSTRUCTIONS FOR COMPLETING FORM RMA F3

1. Enter the one- or two-letter ICAO identifier as contained in the most current version of Doc 7910. If more than one
identifier is designated for the State, use the letter identifier that appears first.

2. Enter the operator’s three-letter ICAO identifier as contained in the most current version of Doc 8585. For general
aviation aircraft, enter “IGA”. For military aircraft, enter “MIL”. If none, place an X in this field and write the name of
the operator/owner in the remarks row.

3. Enter the one- or two- letter ICAO identifier as contained in the most current version of Doc 7910. If more than one
identifier is designated for the State, use the letter identifier that appears first.

4. Enter the ICAO designator as contained in the most current version of Doc 8643, e.g. for Airbus A320-211, enter
A320; for Boeing B747-438, enter B744.

5. Enter the aircraft series or manufacturer’s customer designation, e.g. for Airbus A320-211, enter 211; for Boeing
B747-438, enter 400 or 438.

6. Enter the manufacturer’s serial number.

7. Enter the registration mark of the aircraft, e.g. for AA-XYZ, write AAXYZ.

8. Enter the ICAO-allocated Mode S aircraft address code (6 characters, hexadecimal).

9. Enter the date of withdrawal (MM/DD/YY) of the RVSM approval, e.g. for October 26, 1998, write 10/26/98.

10. Provide the reason for withdrawal of the RVSM approval.

11. Provide any other remarks.

_____________________
 Appendix C

CONTENT AND FORMAT OF AN RVSM APPROVALS DATABASE

AND PROCEDURES FOR EXCHANGING DATA

1. RVSM APPROVALS DATA

To properly maintain and track RVSM approval information, some basic aircraft identification information is required (e.g.
manufacturer, type, serial number, etc.) as well as details specific to an aircraft’s RVSM approval status. Table C-1 lists
the minimum data fields to be collected by an RMA for an individual aircraft. Table C-2 describes the approvals database
record format.

Note.— This Appendix primarily details the different data elements to be stored by and/or exchanged
between RMAs.

2. DATA PROCEDURES

2.1 Data should be posted on a protected website accessible to all RMAs. In the event that data have to be
sent from point to point, the two RMAs should agree on a common file format. Table C-3 provides suggested data
exchange procedures to be used by RMAs.

2.2 In addition to regular data exchanges, responses to one-off queries from other RMAs shall be provided on
request. Queries may include requests for data in addition to the minimum exchanged data set, such as additional height
measurement fields or service bulletin information.

3. EXCHANGE OF AIRCRAFT APPROVALS DATA

An RMA shall exchange RVSM approvals data with another RMA only when an aircraft is, as a minimum, airworthiness-
approved. Table C-4 defines the fields required for sharing a record with another RMA.

4. EXCHANGE OF HEIGHT MEASUREMENT DATA

Height measurement data shall be exchanged only when the data can be positively linked to an aircraft that is RVSM
airworthiness-approved. In addition, this data must be reliable as measured by appropriate quality control checks.
Table C-5 defines the fields required for the exchange of height measurement data.

App C-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App C-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

Table C-1. Aircraft RVSM approvals data

Field Description

State of Registry Nationality identifier as specified in Doc 7910 for the

current State of Registry

ICAO operator designator ICAO designator for the current operator as defined in
Doc 8585

State of the Operator State of the Operator, using the one- or two-letter
nationality indicator specified in Doc 7910

ICAO aircraft type designator Aircraft type designator as specified in Doc 8643

Series Aircraft generic series as described by the aircraft

manufacturer (e.g. 747-100, series = 100)

Serial number Aircraft serial number as given by the manufacturer

Registration mark Aircraft’s current registration mark

Mode S Current Mode S aircraft address (6 hexadecimal digits)

RVSM airworthiness (MASPS) approved Yes or No indication of RVSM airworthiness approval

Date RVSM airworthiness approved Date of RVSM airworthiness approval

RVSM operational approved Yes or No indication of RVSM operational approval

Date RVSM operational approved Date of RVSM operational approval

Date of expiry of RVSM operational approval Date of expiry of RVSM operational approval

Method of compliance (service bulletin number or Reference number/name of compliance method used
STC number) to make the aircraft MASPS-compliant

Remarks Open comments

Region(s) for RVSM approval Name of the region(s) where the RVSM approval is
applicable (required only if RVSM approval is issued for
a specific region(s))

Operator name Name of the current operator

Registration date Date registration was active for the current operator

State issuing the RVSM approval State granting RVSM approval, using the one- or two-
letter nationality indicator specified in Doc 7910

Date of withdrawal of RVSM airworthiness Date of withdrawal of the aircraft’s RVSM airworthiness
(MASPS) approval approval (if applicable)

Date of withdrawal of RVSM operational approval Date of withdrawal of the aircraft’s RVSM operational
approval (if applicable)

Information provided by State authority Yes or No indication of whether or not the information
was provided to the RMA by a State authority
1
Civil or military indication Indication of whether the aircraft is civil or military
1. This is not necessarily a separate field; it can be a field on its own. It is indicated in the ICAO operator designator as
MIL except when the military has an ICAO code designator.
Appendix C App C-3

Table C-2. Approvals database record format

Field Type Size

State of Registry Text 2

ICAO operator designator Text 3

State of the Operator Text 2

ICAO aircraft type designator Text 4

Series Text 40

Serial number Text 20

Registration mark Text 11

Mode S (hexadecimal) Text 6

RVSM airworthiness (MASPS) approved: “Y” or “N” for Yes or No Text 1

Date RVSM airworthiness approved (dd/mm/yyyy) Date 8

RVSM operational approved: “Y” or “N” for Yes or No Text 1

Date RVSM operational approved (dd/mm/yyyy) Date 8

Date of expiry of RVSM operational approval (dd/mm/yyyy) Date 8

Method of compliance reference (service bulletin number or STC number) Text 50

Remarks Text 200

Region(s) for RVSM approval Text 20

Operator name Text 200

Registration date Date 8

State issuing the RVSM approval Text 2

Date of withdrawal of RVSM airworthiness (MASPS) approval Date 8

(dd/mm/yyyy)

Date of withdrawal of RVSM operational approval (dd/mm/yyyy) Date 8

Information provided by the State authority: “Y” or “N” for Yes or No Text 1

Civil or military indication Text 8

 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App C-4 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

Table C-3. Data exchange procedures for RMAs

Data type Data subset Frequency When

RVSM approvals All Monthly First week in month

Height-monitoring data Specified height- As requested

monitoring data (HMU,
GMS, AGHME, etc.) from
the region that generated
the data

Non-compliant aircraft/group All As required As occurs

Table C-4. Exchange of aircraft approvals data

Column Field Example Notes

1 State of Registry CP ICAO State code
2 Operator RYA ICAO operator code
3 State of the Operator WA ICAO State code
4 Aircraft type B744 ICAO type
5 Aircraft monitoring type B744-10 MMR type
6 Series 100 Generic series as described by the aircraft
manufacturer
7 Serial number 525B-0196 Manufacturer’s serial number
8 Registration VHZOO No dashes or spaces
9 Hex Mode S AB420F Six hexadecimal digits 0..9A..F
10 Full RVSM approval Y Y or N (operational approval)
11 Date of full RVSM 22/12/05 dd/mm/yy
approval
12 RVSM approval Y Y or N
expired/withdrawn
13 Date RVSM approval 23/12/05 dd/mm/yy
expired/withdrawn
14 Deregistered N Y or N
15 Date of deregistration dd/mm/yy (blank if not deregistered)
16 Operator name RUDIMENTARY Avoid commas and accented characters where
AIRLINES possible
17 Date of last successful 22/12/05 (Optional). Height-keeping monitoring only
local monitoring within this RMA.
18 Remarks (Optional free text)
Appendix C App C-5

Table C-5. Exchange of height measurement data

Field Need to share Remarks

Date of measurement Mandatory dd/mm/yy
This is the date of measurement of
GMU-based monitoring results and the
last monitoring date during the HMU,
AGHME, and AHMS data collection
period
Time of measurement Mandatory Typically for GMU-based monitoring
results
Measurement instrument Mandatory HMU (or HMU site), AGHME (or
AGHME
site), AHMS, EGMU
Mode S aircraft address Mandatory (if Hexadecimal six-digit fixed format
available)
Aircraft registration mark Mandatory Without hyphen
Aircraft serial number Mandatory
Operator – ICAO designator Optional
ICAO aircraft type designator Mandatory
Aircraft series Optional
Mean Mode C altitude during measurement Optional
(this field may be null for GMS)
Assigned altitude at time of measurement Optional
Estimated TVE Mandatory
Estimated AAD Mandatory
Estimated ASE Mandatory Refer to each RMA’s website for more
information
Current geometric height reference Mandatory (if Applicable to AHMS monitoring results
available)
Operator name Optional
MMR group Mandatory
RMA providing the data Mandatory

5. CONFIRMED NON-COMPLIANT INFORMATION

5.1 As part of its monitoring assessments, an RMA may identify a non-compliant aircraft or discover an aircraft
group that is not meeting the ICAO performance requirements or MASPS. This information should be made available to
other RMAs.

5.2 When identifying a non-compliant aircraft, the RMA should include:

a) the notifying RMA;

b) date sent;

c) registration mark;

d) Mode S aircraft address;

 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App C-6 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

e) serial number;

f) ICAO aircraft type designator;

g) State of Registry;

h) registration date;

i) ICAO designator for the operator;

j) operator name;

k) State of the Operator;

l) date(s) of non-compliant measurement(s);

m) ASE value;

n) action started (Y/N);

o) date aircraft fixed.

5.3 When identifying an aircraft group that is not meeting the MASPS, the RMA should include:

a) the notifying RMA;

b) date sent;

c) aircraft-type group;

d) specific monitoring data analysis information;

e) action started (Y/N);

f) action closed (Y/N);

g) date closed;

h) new service bulletin number (if applicable);

i) date of new service bulletin (if applicable).

Appendix C App C-7

6. FIXED PARAMETERS — REFERENCE DATA SOURCES

Some of the data that are used internally by an RMA and which form some of the standard data formats can be found in
the following documents:

ICAO

— Location Indicators (Doc 7910)

— Designators for Aircraft Operating Agencies, Aeronautical Authorities and Services (Doc 8585)
— Aircraft Type Designators (Doc 8643)

IATA

— Airline Coding Directory

_____________________
 Appendix D

MERITS AND REQUIREMENTS OF

HEIGHT-MONITORING SYSTEMS

1. INTRODUCTION

1.1 The primary function of a height-monitoring system (HMS) is to estimate the ASE of an aircraft by
comparing the actual height of the aircraft to the height of the flight level as indicated by the aircraft’s own altimetry
system. The flight level is a pressure level that changes in height over time and space due to variations in meteorological
conditions. It is therefore important that an HMS is capable of modelling the variations in meteorological conditions
normally by reference to actual or forecast meteorological data.

1.2 An HMS must determine the ASE with very high precision (in the order of tens of feet). HMS systems
typically produce a stream of three-dimensional plot data. This data stream is then combined into a single track which is
smoothed and compared to the height of the pressure level over the course of the track. An HMS therefore consists of
two elements: a detection and plot extraction system to provide the data stream followed by a processing system to
calculate the value of ASE.

1.3 At the present time, there are two generic types of HMSs. These are fixed ground-based systems that
monitor all aircraft that enter the coverage area, and portable on-board monitoring systems that measure the aircraft on
which they are carried. The ground-based systems are used to monitor aircraft height-keeping performance of traffic in
the North Atlantic, North American, Asia Pacific and European Regions. The portable systems are also used in these
and several other regions. There are advantages and disadvantages to both systems, which are discussed below.

2. GROUND-BASED HEIGHT-MONITORING UNITS (HMUS, AGHMEs and AHMSs)

2.1 A HMU is a network of ground-based receiver stations which receive SSR transponder signals from aircraft
replying to interrogations from one (or more) radar stations, together with associated signal processing equipment. A
HMU operates in a passive manner in the sense that the system does not interrogate aircraft in the same way as an
SSR. It receives random replies from aircraft as a result of uncorrelated interrogations. The replies have to be sorted, the
form of reply which has been received (Mode A or C) has to be established, and those from the same aircraft chained to
allow the smoothed value of the geometric height to be compared with the geometric height of the assigned flight levels
and the reported flight level (Mode C). The system elements that are involved in the measurement of an aircraft’s
geometric height together comprise the height-monitoring equipment (HME). Those system elements that perform the
estimation of TVE comprise the total vertical error monitoring unit (TMU).

2.2 The HME determines the geometric height of each aircraft by comparing the time of reception of its SSR
signals at each of the different receiver stations. The HME outputs the three-dimensional position and associated
identification (Mode A, C or S, as appropriate) once per second. To evaluate TVE, the TMU requires meteorological data
provided by MET offices. These data are further refined by evaluating the trends in the performance of the ensemble of
aircraft being monitored during a particular time interval.

App D-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App D-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

2.3 The size of the HMU coverage area and the number of HMUs needed depend on the airspace route
structure and number of aircraft that must be monitored. For example, the NAT environment has gateway locations
ensuring that a large proportion of aircraft will fly over a single HMU during their normal operations. No such gateway
locations allowing such high coverage from a single HMU exist for European operations.

2.4 To ensure coverage of a number of air routes and to avoid the need to inhibit ATC freedom, the HMUs
required for the European RVSM programme must have an operational radius of approximately 45 NM. To maintain the
system accuracy over this area, the HMU requires a five-site system with a distance of approximately 25 NM between
the central station and the remaining four receiver stations arranged in a square around the central site.

2.5 The preferred sites identified for the European HMUs were airfields and other installations owned by the
ATS providers. The use of such sites simplifies procurement procedures and reduces the risk associated with the
application for planning permissions. The second set of sites identified were sites where line-of-sight can be physically
obtained. These are mainly communication towers.

2.6 The aircraft geometric height measurement element (AGHME) is the U.S. version of the HMU, developed
by the Federal Aviation Administration (FAA). It calculates aircraft height similarly to its HMU counterpart, where Mode S
signals are accurately time-stamped within a network of five receiver stations and later processed to determine aircraft
position in the form of latitude, longitude, height and time. Multiple estimates of position are possible within one-second
measurements. Aircraft identification is derived from the Mode S address, and Mode S altitude is directly recorded and
used to determine flight level and assigned altitude deviation (AAD). Meteorological data are gathered from the National
Oceanic and Atmospheric Administration (NOAA) for the calculation of aircraft TVE and ASE.

2.7 AGHME site locations support the monitoring programme of North American operations and are under the
jurisdiction of the North American Approvals Registry and Monitoring Organization (NAARMO). Two AGHME sites are
installed and operational in Lethbridge and Ottawa, Canada. Four additional sites are installed and operational in the
U.S. cities of Atlantic City, NJ; Wichita, KS; Cleveland, OH and Phoenix, AZ. A fifth AGHME site is in the planning stages
for Eugene, OR. Site locations were determined based on North American, Atlantic and Pacific operations. Test flights
are an ongoing measure of system accuracy and development for all North American AGHME sites and thus far have
demonstrated AGHME post-processing accuracies in the neighbourhood of 30 NM.

2.8 An automatic dependent surveillance — broadcast (ADS-B) height monitoring system (AHMS) comprises
the collection and post-processing of large ADS-B data sets obtained from any ADS-B network or single ground station.
The use of ADS-B data for height-keeping monitoring is the outcome of a formal research project between the FAA and
Airservices Australia represented by the Australian Airspace Monitoring Agency (AAMA). ASE is calculated using
programmes developed by the FAA that process data from AGHME and GMS monitoring systems. The use of ADS-B
geometric height for estimating ASE provides a highly efficient wide-area monitoring system at minimal cost and with
little operational impact on aircraft operators or flight crews.

2.9 The main advantage of ground-based systems is their ability to capture a large amount of data which can
be made available for analysis rapidly without copious manual intervention. The main disadvantage is that they require a
flight within range of the system.
Appendix D D-3

3. THE GPS-BASED MONITORING SYSTEM (GMS)

3.1 The GMS consists of one or more portable GMUs and an offline data processing system. Depending on
the supplier, a GMU may consist of one or two GPS receivers, an altitude recording device (ARD), a laptop computer for
the processing and storage of data, an integrated computer with an embedded Windows operating system, and two
separate GPS antennas. Units with the ARD and integrated computer system are an updated version of the original
GMU with one antenna. These units are called enhanced GMUs (EGMU). The ability to collect Mode C data in real time
with the ARD portion of the unit in conjunction with the GPS receiver and integrated operating system make this unit
preferable over older monitoring technology. The antennas are attached to aircraft windows using suction pads. The
GMU may either be battery-powered or have a power input to allow connection to the aircraft’s power supply. After
completion of the flight, the recorded GPS data are transferred to a central site where, using differential GPS post-
processing, the aircraft geometric height is determined. The height data are then compared to the geometric height of
the assigned flight levels as estimated from data provided by the MET offices. It is important to note that the MET data
cannot be refined in the manner described for HMU operation. SSR Mode C data, as recorded by the GMU or obtained
from ATC providers as radar data output, are then combined with the height data and flight level heights to determine
the aircraft altimetry system errors.

3.2 The analysis of the GMU data can be made available within a few days, but this can extend up to a few
weeks, depending on the logistics of the GMU’s use and the retrieval of the data.

3.3 To monitor a specific airframe, the GMU may be installed on the aircraft flight deck or in the cabin. It may
require a power input, and the antennas must be temporarily attached to the aircraft windows. This process may require
appropriate certification of the GMU for the aircraft types in which it must be installed. It also requires appropriate
expertise for installation and operation, and active support from operators and pilots.

3.4 The main advantage of a portable system is the ability to target an individual aircraft for monitoring during
normal operations without requiring that the aircraft fly in a particular portion of airspace. The main disadvantages of
GMSs are the requirements for cooperation from the target aircraft and significant labour costs in operation and data
extraction and post-processing.

4. ADVANTAGES AND DISADVANTAGES

When developing a monitoring system, RMAs are advised to carefully consider the monitoring programme’s goals, the
flows of traffic in the airspace where the RVSM exists and the availability of applicable monitoring data from other
regions. With this information, RMAs can then examine the merits of the height-monitoring systems discussed above,
which can be summarized as follows:
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App D-4 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

HMU/AGHME AHMS GMU

Measures all aircraft in the Measures all ADS-B-equipped Aircraft are individually targetable
coverage area aircraft in the coverage area that
include geometric height in ADS-B
transmitted messages
Refinement of FL geometric height Refinement of FL geometric height Refinement not possible
possible possible
Large data set captured per day Very large data set captured per Small data set captured per day
day, but size can be easily
modified
Expensive to buy and deploy Inexpensive to buy and deploy Inexpensive to buy
Inexpensive to operate Inexpensive to operate Expensive to operate
Operation is transparent to aircraft Operation is transparent to aircraft Possible difficulties in installing on
flight deck
Trend detection of height-keeping Trend detection of height-keeping Uncertain trend detection
performance of aircraft-type groups performance of aircraft-type groups
Can monitor all operations of an
airframe
Height reference used in the ADS-
B-provided aircraft geometric
height estimate not known for
some ADS-B avionics systems
(can be mean sea level (MSL) or
height above ellipsoid (HAE)) –
additional processing required to
determine the correct height
reference.

_____________________
 Appendix E

GUIDANCE ON REDUCING MINIMUM

MONITORING REQUIREMENTS

The following material describes the process used by Eurocontrol, in its role as operator of the European RMA, to
determine whether minimum monitoring requirements for particular aircraft-type groups may be reduced. It is provided
as an example which may be used by other RMAs to assist in the development of criteria for reducing minimum
monitoring requirements in their own areas of responsibility. Importantly, it is assumed that all data used in this process
have been quality-inspected and deemed valid measurements.

The six criteria used to determine initial monitoring requirements or targets are:

1. The ASE value for an aircraft-type group should satisfy |mean ASE| + 3 SD of ASE < 60 m (200 ft).

EASA CS-ACNS, Book 2, and FAA advisory circular Authorization of Aircraft and Operators for Flight in Reduced
Vertical Separation Minimum (RVSM) Airspace state that the ASE for an aircraft-type group, when the aircraft are
operating in the basic flight envelope, should meet the criterion of |mean ASE| + 3 SD of ASE ≤ 60 m (200 ft). This
performance standard is more strict than that for aircraft in the total flight envelope (|mean ASE| + 3 SD of ASE ≤ 75
m (245 ft)). It should be noted that the latter is also the group requirement specified in Annex 6, Part I, Chapter 7,
Appendix 4, and Annex 6, Part II, Chapter 2.5, Appendix 2.2.

It is assumed that all monitoring data are collected while aircraft are flying within the basic flight envelope. It is also
assumed that if the observed ASE monitoring data show that an aircraft-type group is meeting the standard for the
basic flight envelope, then it is likely to satisfy |mean ASE| + 3 SD of ASE ≤ 75 m (245 ft) when operating in the total
flight envelope. Therefore, when deciding whether or not the monitoring requirements for the group can be reduced,
the stricter criterion for the basic flight envelope is applied.

The overall monitoring group performance results must satisfy the requirements specified in ICAO Annex 6;
however, consideration may be given to results that may have been influenced by irregular data samples or aircraft
that have been identified as exhibiting non-typical behaviour owing to problems not considered as generic or
consistent with the overall group performance characteristics.

2. For each aircraft-type group, the percentage of the operator population with at least one measurement should meet
a predetermined target.

In addition to the first criterion, RMAs must ensure that a representative number of operators are included in the
monitoring sample in order for monitoring data to be representative of the total operator population. Ideally, a
minimum of 75 per cent of the total operators of aircraft within a group should have at least one of their aircraft
monitored in order for RMAs to obtain a representative sample of the entire operator population and conclude that
operators’ performance is consistent. Individual operators not exhibiting similar performance may require a separate
investigation so that the causes of non-typical performance can be identified. It may be valid to adjust this threshold
depending on the total number of operator fleets in service compared to the number monitored and the quality and
quantity of available height-keeping performance results.

App E-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App E-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

3. Individual aircraft performance must be consistent with that of the group.

For each aircraft-type group, the individual aircraft means are compared to the classification mean ±1.96 times the
airframe standard deviation with a correction factor. The correction factor is dependent on the number of repeated
samples and corrects for any bias in the estimation of standard deviation. The individual aircraft means should fall
within these upper and lower bounds in 95 per cent of the cases.

It should not be possible to reduce monitoring targets in situations where individual aircraft ASE trends or
characteristics are repeated among several representative airframes. In such cases, the ASE trends or
characteristics may be generic for the whole group and cause difficulties in meeting current or future group
performance requirements. Examples include instances whereby a large number of airframes are exhibiting
aberrant ASE results or whereby a common ASE trend is deteriorating at a significant rate.

4. Each operator has a fleet that meets individual measurement requirements.

EASA CS-ACNS, Book 2, and FAA advisory circular Authorization of Aircraft and Operators for Flight in Reduced
Vertical Separation Minimum (RVSM) Airspace state that the absolute ASE of any measure for a non-group aircraft
must not exceed 49 m (160 ft) for worst-case avionics. On the assumption that a group aircraft should perform equal
to or better than a non-group aircraft, the absolute maximum ASE value was examined for all operator/aircraft-type
group combinations. To account for any measurement system error, an additional 9 m (30 ft) was considered when
examining the measurements.

It should not be possible to reduce monitoring targets in situations where a representative proportion of operators
have fleets with a high proportion of airframes exhibiting aberrant ASE performance.

5. For each aircraft-type group, ASE measurements recorded by different monitoring systems must be in agreement.

If large amounts of data are available from different monitoring programmes, the results of each programme should
support the results of others. If they do not, additional checks should be conducted to identify the causes. As a
result, it may be possible to justify the group’s separation on the basis of a change in production or a modification
that impacts the ASE characteristics of a subset of the original group.

6. The ASE measurements recorded over time for each aircraft-type group must not demonstrate a degradation in
performance.

Monitoring groups should not exhibit an ASE trend of greater than 10 ft per year. When reviewing compliance with
this criterion, the size and distribution of the available data sample should be taken into consideration.

References
1. European Aviation Safety Agency (EASA). Certification Specifications and Acceptable Means of Compliance for
Airborne Communications, Navigation and Surveillance (CS-ACNS). Book 2 – Acceptable Means of
Compliance and Guidance Material.
2. Federal Aviation Administration (FAA). Authorization of Aircraft and Operators for Flight in Reduced Vertical
Separation Minimum (RVSM) Airspace. Advisory Circular 91-85
3. International Civil Aviation Organization (ICAO). Annex 6 to the Convention on International Civil Aviation,
Operation of Aircraft. Part I — International Commercial Air Transport — Aeroplanes
4. International Civil Aviation Organization (ICAO). Annex 6 to the Convention on International Civil Aviation,
Operation of Aircraft. Part II — International General Aviation — Aeroplanes

______________________
 Appendix F

ACTION TO BE TAKEN WHEN AN INDIVIDUAL AIRFRAME

IS ASSESSED AS BEING NON-COMPLIANT WITH
ALTIMETRY SYSTEM ERROR PERFORMANCE REQUIREMENTS

SAMPLE LETTER TO AN OPERATOR AND STATE AUTHORITY OF AN AIRCRAFT

OBSERVED TO HAVE EXHIBITED AN ALTIMETRY SYSTEM ERROR
IN EXCESS OF 245 FT IN MAGNITUDE

(This sample letter can be modified to adapt to specific RMA operational requirements.)

Large Altimetry System Error (ASE) Report Date:

Control Number:

To: Operator Name Prepared By: RMA Name

Operator Address RMA Address
Subject Aircraft Registration: XX

Cc:

Dear (Operator Name),

Safe operation in reduced vertical separation minimum (RVSM) airspace requires stringent limits on the measurement of
true aircraft altitudes during normal operations. Aircraft use a barometric altimeter to determine altitude and follow
common pressure and flight levels. Differences between the altitude indicated by the altimeter display and the actual
pressure altitude corresponding to the undisturbed ambient pressure, which are known as altimetry system error (ASE),
can occur. Put more simply, ASE is the difference between the altitude observed by the pilot, ground controller and
airborne collision avoidance systems, and the actual altitude. To comply with international standards, an aircraft’s ASE
must be kept at a minimum and must not exceed 245 ft.

ASE is undetectable in the air traffic system; however, it can be detected using specialized instruments and through the
treatment of collected data. Ongoing system performance monitoring and individual aircraft performance monitoring are
therefore necessary to ensure that international safety performance requirements are met.

App F-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App F-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

The (RMA name) has been tasked by a regional planning group of the International Civil Aviation Organization (ICAO)
to provide RVSM monitoring services for the (region). The subject aircraft has been monitored using specialized
monitoring instruments and has been found to exhibit large ASE values of greater than 200 ft in magnitude.

Section I: Subject aircraft and ASE measurement overview

Table title here

Operator:
Registration number/Mode S address:
Aircraft type/series/serial number:
Date of RVSM operations/Date of expiry of
RVSM approval:
Equipment ID field (/W or /Q):
Large measurement(s) recently monitored:
Monitoring instrument:

Section II: Data analysis and performance summary

The following table and figures provide a summary of aircraft ASE performance and comparative data. Table 1 provides
a summary of repeated large ASE measurements recorded during the period of (date range).

Table 1. Repeated large ASE measurements recorded during the period of (dd Month yyyy - dd Month yyyy)

Monitoring Date of Flight

ASE
instrument measurement level
Appendix F F-3

An overview of the aircraft’s ASE performance is shown in Figure 1.

The performance of the monitoring instrument over the period during which the subject aircraft’s large ASE was
observed is shown in Figure 2. Figure 2 includes a plot of all measurements recorded by the measurement device during
the period when the large ASE value(s) were recorded for the airframe specified in this report. The purpose of this figure
is to demonstrate that the performance of the measurement device was stable during the reporting period, and that
factors such as weather or the degradation of a component within the measurement device did not cause anomalous
performance.

A comparison of the average ASE performance of other similar aircraft is shown in Figure 3. The large ASE
measurements can be compared with the ASE performance of the same or similar aircraft types.

Figure 1. Aircraft ASE over time

 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App F-4 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

Figure 2. Monitoring instrument performance during the period of (date range)

Figure 3. Average (aircraft type) ASE observed during the period of (date range)
Appendix F F-5

Section III: Issues from continual maintenance

During routine calibration, aircraft systems are maintained on the ground while at rest; therefore, the dynamic nature of
ASE cannot be seen.

Aircraft altimetry systems use parts that:

- wear over time (such as the pitot-static probe and portions of internal plumbing); and/or
- are subject to damage (such as skin flexing/deformation during operations); and/or
- are affected by airframe modifications (such as the application of paint, decals and branding marks,
mounting of accessories or repairs that disrupt airflow in the vicinity of the static pressure ports).

All these scenarios can produce a significant error in true height. Other factors in normal high-speed flight operations,
such as aerodynamic loading and exposure to temperature ranges, moisture and contaminants, can also produce a
significant variation in the sensed pressure.

Section IV

The monitoring process must be repeated to confirm that the aberrant or non-compliant value is a reasonable estimate
of the aircraft’s ASE. If the value is confirmed, the cause or causes of the altimetry system’s non-compliant performance
will have to be investigated and remedied.

A summary of the cause or causes identified and remedial actions taken should be sent to (INSERT RMA).

NOTE: Prior to repeating the monitoring flight, the operator should carefully inspect the aircraft and review all relevant
factors to identify any possible causes of the observed ASE value.

Respectfully,

(RMA contact details)

_____________________
 Appendix G

RECOMMENDED AIRCRAFT HEIGHT-KEEPING PERFORMANCE

MONITORING DATA TO BE MAINTAINED IN ELECTRONIC FORM
BY AN RMA FOR EACH MONITORED AIRCRAFT

Field Field identifier Field data type Width Range

1 Validity indicator Alphabetic 1 C: Compliant

A: Aberrant
N: Non-compliant

2 Date of measurement (dd/mm/yyyy) Date (UTC) 8 e.g. 01/01/1996

3 Time of measurement (hh:mm:ss) Time (UTC) 8 e.g. 12:00:00

4 Measuring instrument Alphanumeric 4 e.g. “HYQX”, “G123”

1
5 Aircraft Mode A code (octal) Alphanumeric 4

6 Mode S aircraft address (hexadecimal) Alphanumeric 6 This field may be null

(provided only for Mode S-equipped for GMS.
aircraft)

7 Aircraft registration mark Alphanumeric 10 Required for GMS

8 Flight call sign Alphanumeric 7 Required for GMS

9 Operator Alphabetic 3 Required for GMS

10 Aircraft type Alphanumeric 4 Required for GMS

11 Aircraft mark/series Alphanumeric 6 Required for GMS

12 Flight origin Alphabetic 4 Required for GMS

13 Flight destination Alphabetic 4 Required for GMS

14 Mean Mode C altitude during Numeric (ft) 5 0–99999

2
measurement This field may be null
for GMS.
2
15 Assigned altitude at time of measurement Numeric (ft) 5 0–99999

16 Mean estimated geometric height of aircraft Numeric (ft) 5 0–99999

1. Not always provided by the measurement instrument.

2. These fields are in feet, to a resolution of 1 foot (enter feet, not flight level).

App G-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App G-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

Field Field identifier Field data type Width Range

17 SD of estimated geometric height of aircraft Numeric (ft) 5 0–99999

18 Mean geometric height of assigned altitude Numeric (ft) 5 0–99999

19 Estimated TVE Numeric (ft) 4 0–9999

3
20 Minimum estimated TVE Numeric (ft) 4 0–9999
3
21 Maximum estimated TVE Numeric (ft) 4 0–9999
3
22 SD of estimated TVE Numeric (ft) 4 0–9999

23 Estimated AAD Numeric (ft) 4 0–9999

3
24 Minimum estimated AAD Numeric (ft) 4 0–9999
3
25 Maximum estimated AAD Numeric (ft) 4 0–9999
3
26 SD of estimated AAD Numeric (ft) 4 0–9999

27 Estimated ASE Numeric (ft) 4 0–9999

3
28 Minimum estimated ASE Numeric (ft) 4 0–9999
3
29 Maximum estimated ASE Numeric (ft) 4 0–9999
3
30 SD of estimated ASE Numeric (ft) 4 0–9999

31 Indicator of reliability of geometric height Numeric 3 HMU: 0.0–1.0

measurement (0 for maximum reliability) GMU: 0.0–9.9

32 Indicator of reliability of MET data (0 for Numeric 1 0, 1

maximum reliability)

33 Aircraft serial/construction number Alphanumeric 20 e.g. 550–0848

_____________________

3. Standard deviations are undefined when only one data point is available.
 Appendix H

ACTION TO BE TAKEN WHEN A MONITORING GROUP

IS ASSESSED AS BEING NON-COMPLIANT WITH
ALTIMETRY SYSTEM ERROR PERFORMANCE REQUIREMENTS

ALTIMETRY SYSTEM ERROR (ASE) DATA AND ANALYSIS

TO BE PROVIDED TO THE STATE AND MANUFACTURER BY AN RMA

When an RMA judges that monitoring data from the airspace for which it is responsible indicate that an aircraft group
may not be meeting ASE requirements for mean magnitude and standard deviation (SD), the following monitoring
results should be assembled and brought to the attention of the State/manufacturer concerned:

a) the mean magnitude of ASE and ASE SD of all monitored flights;

b) the following information for each monitored flight:

1) the ASE estimate;

2) the date on which monitoring took place;

3) the registration mark of the aircraft conducting the flight;

4) the Mach number flown during monitoring (if available);

5) the altimetry system (captain’s or first officer’s) observed by the monitoring system (if available);

6) the date on which RVSM airworthiness approval was granted to the monitored aircraft;

7) the date on which the aircraft was first put into service by an operator (if available);

8) the monitoring system used to obtain the estimate; and

9) the location where the monitoring took place.

This Appendix contains a sample letter which an RMA may use to notify a State/manufacturer that a monitoring group
has been assessed as being non-compliant with ASE performance requirements (see overleaf).

App H-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App H-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

SAMPLE LETTER

To: (State concerned)

Dear (Name and title),

Re: (Aircraft type) RVSM height-keeping performance

As you are aware, (name of organization), acting as the Regional Monitoring Agency (RMA) for (region or area of
responsibility), is required to perform height-keeping performance assessments, which enable the identification of
performance issues, and to conduct ongoing safety assessments in connection with the application of RVSM in (specify
airspace).

As a basis for the safety of RVSM operations, the International Civil Aviation Organization (ICAO) has set a height-
keeping performance requirement for aircraft-type groups. The requirement stipulates that the mean altimetry system
error (ASE) must not be greater than 25 m (80 ft) and the absolute value of the mean ASE plus three standard
deviations of ASE must not be greater than 75 m (245 ft). RVSM certification requirements have been derived from this
requirement and laid down in (JAA TGL6, FAA 91-RVSM, or other appropriate document) to ensure that this important
safety requirement is not exceeded.

When the monitored altimetry system performance indicates that an aircraft-type group is not meeting the above
requirements and continues to operate as RVSM-approved in RVSM airspace, unacceptable safety implications may
arise. Therefore, in such a situation, immediate action must be taken to ensure the ongoing safety of RVSM operations
and to bring the group’s performance into compliance with group performance requirements. This may be achieved by:
(1) withdrawing the RVSM approval for the aircraft type(s) involved, in order to reconsider the effectiveness of the RVSM
solution for the aircraft type; or (2) removing the approval for those aircraft for which available performance data indicate
that without those aircraft, the group performance requirement would be met, until such time as the cause of the problem
is identified and the performance is brought into compliance.

After adjusting the data set on the latest approval status of (aircraft type) aircraft and the associated measurement
history, the present group performance has been reassessed. The data as of (date) show that the group performance
exceeds the requirements set by ICAO. The current group performance has been determined to be:

ASE (aircraft type)

Mean ASE (insert value)

|Mean ASE| + 3 SD (insert value)

As previously stated, this performance may have safety implications. We therefore request that you take the necessary
action to ensure that the group performance of the RVSM-approved (aircraft type) aircraft operating in RVSM airspace
comply with the ICAO requirement with immediate effect, or that these aircraft no longer operate in RVSM airspace until
group compliance with the ICAO requirement can be achieved.

Please do not hesitate to request our assistance in resolving this issue.

Your urgent response would be appreciated.

Yours sincerely,

cc: (Manufacturer)
_____________________
 Appendix I

LARGE HEIGHT DEVIATION REPORTING FORM

The information contained in this form is confidential and will be

used for statistical safety analysis only.

Please report altitude deviations of 300 ft or more, including those due to TCAS, turbulence and contingency events.
Reports of deviations as a result of TCAS RA should include the contributing causes.

1. Today’s date: 2. Reporting unit:

DEVIATION DETAILS

3. Operator name: 4. Call sign: 5. Aircraft type: 6. Altitude displayed:

4. Aircraft registration number:

7. Date of occurrence: 8. Time UTC: 9. Occurrence position (latitude/longitude or fix):

10. Cleared route of flight:

11. Cleared flight level: 12. Estimated duration at incorrect flight level (seconds): 13. Observed deviation (± ft):

14. Other traffic involved:

15. Cause of deviation (brief description):

15. (Examples: turbulence, equipment failure)

AFTER DEVIATION IS RESTORED

16. Observed/reported final flight level*: Mark the appropriate box: 19. Does this FL comply with the ICAO
Annex 2 tables of cruising levels?
*Please indicate the source of information: 17. The FL is above the cleared level: 
 Yes  No
 Surveillance system  Pilot 18. The FL is below the cleared level: 

App I-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App I-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

NARRATIVE

20. Detailed description of the deviation:

(Please give your assessment of the actual track flown by the aircraft and the cause of the deviation.)

CREW

21. Please provide crew comments (if any):

When completed, please forward the report(s) to:

(Details of Regional Monitoring Agency)

_____________________
 Appendix J

SCRUTINY GROUP COMPOSITION, OBJECTIVES

AND METHODOLOGY

1. COMPOSITION

1.1 The Scrutiny Group requires diverse operational and technical expertise. The Group should be composed of
subject-matter experts in air traffic control, aircraft operation, operational pilot groups, regulation and certification, data
analysis and risk modelling, from the involved regions.

1.2 RMAs establish Scrutiny Subgroups, consisting of subject-matter experts and specialists from member States.
The Subgroup is responsible for executing the preparatory work for a meeting of the Regional Scrutiny Group, including
the analysis and categorization of selected large height deviation events.

1.3 Representatives from the RMA, aviation authorities and pilot associations also participate in the Scrutiny
Subgroup.

2. PURPOSE

2.1 The initial objective of a Scrutiny Group meeting is to examine reports of possible large height deviations from
archives maintained by States to determine which of the archives’ reports influence the risk of collision associated with
application of the RVSM. Once the initial volume of reports has been reduced to those associated with application of
RVSM, the Scrutiny Group produces an estimate of flight time spent at an incorrect flight level. This value is the primary
contributor to the estimation of operational risk in RVSM airspace. An illustration of how this value contributes to
operational risk can be found in Attachment A to this Appendix. The Group examines both technical risk (affected by the
reliability and accuracy of the avionics within the aircraft and by external meteorological events) and operational risk
(affected by the human element) in the development of the safety assessment.

2.2 Once the Scrutiny Group has made its initial determination, the data are reviewed to look for performance
trends. If any adverse trends exist, the Scrutiny Group may make recommendations, to either air traffic service providers
or regulatory authorities, for reducing or mitigating the effect of those trends as a part of ongoing RVSM safety oversight.

3. PROCESS

3.1 The methodology employed is to examine existing reports, databases and other sources and to analyse
events resulting in large height deviations of 300 ft or greater within the band FL 290 to FL 410 in the involved airspaces.
These events are usually the result of ATC loop errors (flight crew errors in executing valid ATC clearances or controller
errors in granting conflict-free clearances), instances wherein a controller fails to capture an inaccurate readback of a
clearance, an altitude overshoot or undershoot, turbulence situations, emergencies, errors in coordination, weather
complications and responses to a TCAS resolution advisory, among others. The largest source of reports useful for
these purposes are existing reporting systems, such as the reporting system established by the RMA. However, in many

App J-1
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App J-2 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

instances these reports are designed for other purposes and so may lack the desired clarity of information. Thus, the
experience of the members of the Scrutiny Group is essential to inferring the effect of the occurrences on the airspace
risk. All data sources undergo an initial review using key RVSM parameters and all reports of interest are extracted.

3.2 The Scrutiny Subgroup should meet regularly to analyse reports of large height deviations so that adverse
trends can be identified quickly and remedial actions can be taken to ensure that risk due to operational errors has not
increased following the implementation of RVSM.

4. ANALYSIS AND METHODOLOGY

4.1 The Subgroup is responsible for analysing the reports of interest and assigning a category and parameter
values to each event. The values consist of cleared flight level, event flight level, levels crossed, levels final, duration at
unplanned flight level, and total vertical deviation. Sample event categories and parameter definitions can be found in
Attachment A to this Appendix.

4.2 Since archived reports are not tailored to the needs of Scrutiny Groups, these values are often not readily
available from the reports in their original form. The Subgroup must rely on its expert judgement and operational
experience to assign these values. Upon completion of its preliminary analysis, the Subgroup will present the results to
the Scrutiny Group for final approval.

4.3 The Scrutiny Group examines the results of its Subgroup’s analysis. Events of interest, typically those consisting
of long-duration errors, are reviewed further.

5. LARGE HEIGHT DEVIATION ANALYSIS

Description of criteria

ATC loop errors. Any incident where there is a misunderstanding between the pilot and the controller, failure to properly
coordinate altitude information or inability to maintain situational awareness.

Cleared flight level. The flight level at which the pilot was cleared or is currently operating (e.g. aircrew accepts a
clearance intended for another aircraft and ATC fails to capture the readback error, or aircrew conforms to a
flawed clearance delivered by ATC).

Code. A category and subcategory assigned to each event (see Attachment B to this Appendix).

Duration. The length of time that an aircraft was level at an altitude that was not cleared by air traffic control, recorded in
one-second increments (see Attachment A to this Appendix).

Event flight level. The flight level of error; the incorrect altitude of operation for an identifiable period of time without
receipt of an ATC clearance.

Hazard zone. The 300-ft buffer zone above and below each flight level (see Attachment A to this Appendix).

Large height deviation. A vertical deviation of 300 ft or more from an altitude assigned or coordinated by ATC. The
deviation may be the result of human error, equipment malfunction or environmental factors such as turbulence,
and should be reported in accordance with the LHD codes in Attachment B to Appendix J.
Appendix J App J-3

Levels crossed. The total number of flight levels between the point at which the aircraft exits the cleared flight level and
is once again under ATC supervision.

Levels final. The cleared flight level after the error/deviation.

Reference flight level. The altitude that would have provided at least the minimum separation (vertical or horizontal)
required.

or

Reference flight level. The flight level from which the height deviation is calculated; this level may be different from the
cleared flight level and often must be determined by the Scrutiny Group’s operational experts from the data in the
large height deviation report.

Total deviation. The total number of feet between the altitude of operation prior to the deviation and the point at which
the aircraft is once again under ATC supervision. A deviation that results in an increase in altitude will be recorded
as a positive number; a deviation that results in a decrease of altitude will be recorded as a negative number.

Rate of descent Rate of climb

Drift 1 000 ft per minute Minimum To be determined

Normal 1 500+ ft per minute Normal To be determined
Rapid 2 500+ ft per minute Expedite To be determined

_____________________
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App J-4 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

Attachment A to Appendix J

RVSM FLIGHT LEVELS

FL 410

FL 400

FL 390

FL 380
Total levels crossed

FL 370

FL 360

FL 350

FL 340
Duration

FL 330

FL 320

FL 310

FL 300

1 000 ft
Hazard zone
FL 290
Hazard zone

_____________________
Appendix J App J-5

Attachment B to Appendix J

CODES FOR LARGE HEIGHT DEVIATIONS

Code Cause of large height deviation

A Flight crew failing to climb/descend the aircraft as cleared

Example: Aircraft A was at FL 300 and assigned FL 360. A cleared level adherence
monitoring alert was seen as the aircraft passed FL 364. The Mode C level reached FL 365
before descending back to FL 360.

B Flight crew climbing/descending without ATC clearance

Example: At 0648, Aircraft A reported leaving cruise level FL 340. The last flight level
clearance was coincident with the STAR issued at 0623, when the flight was instructed to
maintain FL 340. ATC was applying vertical separation between Aircraft A and two other
flights. The timing of the descent was such that Aircraft A had become clear of the first
conflicting aircraft, and there was sufficient time to apply adequate separation with the other.

C Incorrect operation or interpretation of airborne equipment (e.g. incorrect operation of fully

functional FMS, incorrect transcription of ATC clearance or re-clearance, flight plan followed
rather than ATC clearance, original clearance followed instead of re-clearance, etc.)

Example: The aircraft was maintaining a flight level below the assigned altitude. The
altimeters had not been reset at transition. The FL assigned was 350. The aircraft was
maintaining FL 346 for in excess of 4 minutes.

D ATC system loop error (e.g. ATC issues incorrect clearance or flight crew misunderstands
clearance message). Includes situations where ATC’s delivery of operational information is
absent, delayed, incorrect or incomplete, including as a result of hearback and/or readback
errors, and may result in a loss of separation.

Example: All communications between ATC and aircraft were by HF third party voice relay.
Aircraft A was maintaining FL 360 and requested FL 380. A clearance to FL 370 was issued
with the expectation of higher levels at a later point. A clearance was then issued to Aircraft B
to climb to FL 390. This was correctly read back by the HF operator, but was issued to Aircraft
A. The error was detected when Aircraft A reported maintaining FL 390.

E Coordination errors in the ATC-to-ATC transfer of control responsibility as a result of human

factors (e.g. late or absent coordination, incorrect estimated/actual time or non-compliance of
flight level, ATS route, etc. with agreed parameters)

Example 1: Sector A coordinated Aircraft 1 to Sector B at FL 380. The aircraft was actually at
FL 400.

Example 2: The Sector A controller received coordination of Aircraft 1 for Waypoint X at FL

370 from Sector B. At 0504, Aircraft 1 was at Waypoint X at FL 350 requesting FL 370.
 Operating Procedures and Practices for Regional Monitoring Agencies in Relation to the Use
App J-6 of a 300 m (1 000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive

Code Cause of large height deviation

F Coordination errors in the ATC-to-ATC transfer of control responsibility as a result of

equipment outage or technical issues

Example: The controller in FIR A attempted to send an AIDC message to coordinate the
transfer of aircraft at FL 320. Messaging was unsuccessful and attempts to contact the
adjacent FIR by telephone failed. The aircraft contacted the adjacent FIR without the
coordination being completed.

Aircraft contingency event

G Deviation due to aircraft contingency event leading to sudden inability to maintain assigned
flight level (e.g. pressurization failure, engine failure)

Example: Aircraft A descended from FL 400 to FL 300 because of a pressurization issue.

H Deviation due to airborne equipment failure leading to unintentional or undetected change of

flight level

Example: Aircraft A was cruising at FL 380. ATC received an alert indicating that the aircraft
was climbing through FL 383. The flight crew advised that they were attempting to regain the
cleared level with an autopilot and navigation system failure.

Deviation due to meteorological conditions

I Deviation due to turbulence or other weather-related cause

Example: While cruising at FL 400, the aircraft encountered severe turbulence, causing it to
descend 1 000 ft without a clearance.

Deviation due to TCAS RA

J Deviation due to TCAS RA — flight crew correctly following the RA (LHD report should include
details on the cause of the RA)

Example: Aircraft A was cruising at FL 350. The flight crew received a Traffic Alert from TCAS
and almost immediately after, an RA Climb instruction. The flight crew responded and climbed
Aircraft A to approximately FL 353 to comply with the TCAS instruction. The TCAS display
indicated that Aircraft B in the opposite direction descended to approximately FL 345 and
passed below Aircraft A.

K Deviation due to TCAS RA — flight crew incorrectly following the RA (LHD report should
include details on the cause of the RA)

Other

L An aircraft that is not RVSM-approved is being provided with RVSM separation (e.g. flight
plan indicates RVSM approval but aircraft is not approved; ATC misinterpretation of flight
plan)

Example 1: The original flight plan details submitted by FIR A for the outbound leg showed
Aircraft 1 as negative RVSM. The subsequent flight plan submitted by FIR B showed Aircraft 1
Appendix J App J-7

Code Cause of large height deviation

as RVSM-approved. The FIR A controller checked with the aircraft shortly after it entered FIR
A and the pilot confirmed negative RVSM.

Example 2: Aircraft 2, cruising at FL 310, was handed off to the Sector X controller, who
noticed that Aircraft 2’s label indicated RVSM approval. The Sector X controller had controlled
the aircraft the day before, at which point it was a non-RVSM aircraft. The controller queried
the status of Aircraft 2 with the pilot, who advised that the aircraft was negative RVSM.

M Other — this includes situations where:

i. There has been a failure to establish or maintain a separation standard between

aircraft; or
ii. flights are operating (climbing or descending) in airspace where flight crews are
unable to establish normal air-ground communications with the responsible ATS unit.

Example 1: Aircraft A was cruising at FL 350. At xxxx hours, Aircraft A reported “Negative
RVSM” due to equipment failure. At that time, Aircraft B was on converging reciprocal track FL
360, less than 10 minutes prior to the time of passing.

_____________________
 Appendix K

SUGGESTED FORM FOR ATC UNIT MONTHLY REPORTING

OF LARGE HEIGHT DEVIATIONS

NAME OF THE REGIONAL MONITORING AGENCY

Report of Large Height Deviation

Report to the (Regional Monitoring Agency name) of height deviations of 90 m (300 ft) or more, including those due to
ACAS, turbulence and contingency events.

Name of ATC unit: __________________________________________________

Please complete Section I or II as appropriate.

SECTION I

There were no reports of large height deviations for the month of __________.

SECTION II

There was/were _____ report(s) of height deviations of 90 m (300 ft) or more between FL 290 and FL 410. Details of the
height deviations are attached.

(Please use a separate form for each report of height deviation).

SECTION III

When completed, please forward the report(s) to:

(Regional Monitoring Agency name)

(Postal address)

Telephone:
Fax:
E-mail:

_____________________

App K-1
 Appendix L

SAMPLE CONTENT AND FORMAT FOR COLLECTION

OF SAMPLE TRAFFIC MOVEMENTS

The information required for each flight in a sample of traffic movements is listed in Table L-1 with an indication of
whether the information is necessary or optional.

Table L-1. Information required for each flight in a sample of traffic movements

Item Example Necessary or optional

Date (dd/mm/yyyy) or (mm/dd/yyyy) 01/05/2000 for 1 May 2000 Necessary

Flight identification or aircraft call sign MAS704 Necessary
Aircraft type B734 Necessary
Aircraft registration number N500DX Optional
Does Item 10 of the flight plan indicate that the operator “YES”; “NO” Necessary
and aircraft are RVSM-approved? (Does a “W” appear in
Item 10 of the flight plan?)
Origin aerodrome WMKK Necessary
Destination aerodrome RPLL Necessary
Entry fix into RVSM airspace MESOK Necessary
Time at entry fix 0225 Necessary
Flight level at entry fix 330 Necessary
Exit fix from RVSM airspace NISOR Necessary
Time at exit fix 0401 Necessary
Flight level at exit fix 330 Necessary
First fix within RVSM airspace or first airway within RVSM MESOK or G582 Optional
airspace
Time at first fix 0225 Optional
Flight level at first fix 330 Optional
Second fix within RVSM airspace or second airway within MEVAS OR G577 Optional
RVSM airspace
Time at second fix 0250 Optional
Flight level at second fix 330 Optional
(Continue with as many fix/time/flight-level entries as are Optional
required to describe the flight’s movement within RVSM
airspace)

— END —

App L-1