SAFETY REGULATION COMMISSION SAFETY REGULATION COMMISSION Harmonisation of ATM Safety Regulation & ESARRs SAFETY REGULATION COMMISSION SAFETY REGULATION COMMISSION Harmonisation of ATM Safety Regulation & ESARRs Martine Blaize - Deputy of Safety Regulation Unit (SRU)

EUROCONTROL Safety Regulation Commission - Kiev, April 2003 CHANGES in the ATM INDUSTRY CHANGES in the ATM INDUSTRY  ATM service provision becoming increasingly commercialised  National ATM corporations and agencies  Increasing focus on liability  Progressive separation and clarification of safety roles

RULE-MAKINGSAFETYOVERSIGHT SETTING MINIMUM SAFETY LEVELS SAFETY PERFORMANCE MONITORING&IMPROVEMENT ATM SAFETY REGULATION KEY FUNCTIONS

EUROPEAN Harmonisation in ATM safety regulation EUROCONTROL SRC aims at ensuring a harmonised ATM safety regulatory framework across ECAC Context of the EC Single European Sky Context of the EC Single European Sky Transfer to EASA anticipated by ECAC in 1997 Transfer to EASA anticipated by ECAC in 1997 EUROCONTROL

RULEMAKINGSAFETYOVERSIGHT ORGANISATIONALISSUESPARTNERSHIP WITH PROVIDERS PROCESSES RULEMAKINGSAFETYOVERSIGHT ORGANISATIONALISSUESSAFETY PERFORMANCE & IMPROVEMENT PROCESSES ATM SAFETY LEVELS SETTING MINIMUM SAFETY LEVELS ICAO Annex 11… TLS for ATS in national airspace and aerodromes SRC POL DOC 1- ATM Safety Minima n SRC POL DOC 1 provides a minimum to be met n Consideration of Public Interest in area concerned n Link to safety performance monitoring and improvement n Link to the design of ATM system incl. required aircraft equipage Top Down approach

RULEMAKINGSAFETYOVERSIGHT ORGANISATIONALISSUESPARTNERSHIP WITH PROVIDERS PROCESSES RULEMAKINGSAFETYOVERSIGHT SETTING MINIMUM SAFETY LEVELS SAFETY PERFORMANCE & IMPROVEMENT PROCESSES PROCESSES RULEMAKING RULE-MAKING 2001/ The Commission shall.. identify and adopt the ESARRs and subsequent amendment to those requirements within the scope of this Regulation… … that shall be made mandatory under Community Law n ICAO SARPS with any potential deviations n ESARRs demanding- describes the minimum to be enforced n EC ‘Common Requirements’ bearing on ANSPs, + Essential Requirements, Implementing Rules & Community Specifications n Any additional/different safety (regulatory) requirements justified by local environment of operations or national context Inputs to Rule Drafting

GUIDANCE MATERIAL FOR REGULATORS FOR EACH ESARR GUIDANCE MATERIAL FOR REGULATORS ESARR ADVISORY MATERIAL (EAM) ESARR ADVISORY MATERIAL (EAM) AMC FOR ESARR 3 AMC FOR ESARR 4 AMC FOR ESARR 5, 6,... ACCEPTABLE MEANS OF COMPLIANCE AMC FOR ESARR 3 AMC FOR ESARR 4 AMC FOR ESARR 5, 6, 7. ESARR 3 SAFETY MANAGEMENT SYSTEMS ESARR 4 RISK ASSESSMENT AND MITIGATION ESARR 5 ATM PERSONNEL ESARR 6 SYSTEMS SW & HW ESARR 7 ATM PROCEDURES ESARR 2 SAF. OCCURRENCES ESARR 1 ATM SAFETY REGULATORY FRAMEWORK ATM SAFETY REGULATORY FRAMEWORK EUROCONTROL AMC FOR ESARR 2 Acceptable means of compliance EATM Programme Safety Deliverables REQUIREMENTS APPLICATION DOCUMENTS (RAD) RVSMGNSS EGNOS GBAS 8.33 HEP Link ADS Data Link ETC…

ESARR WHAT is required ? = Acceptable Means Of Compliance = Ideas HOW this can be achieved ? ANSPs internal procedures = Customised solutions on HOW ANSPs meet ESARRs on HOW ANSPs meet ESARRs EAM AMC

RULE-MAKINGSAFETYOVERSIGHT SETTING MINIMUM SAFETY LEVELS SAFETY PERFORMANCE MONITORING&IMPROVEMENT ATM SAFETY REGULATION KEY FUNCTIONS

Trust me... Neither blind trust...

SAFETY OVERSIGHT RULEMAKINGSAFETYOVERSIGHT ORGANISATIONALISSUESPARTNERSHIP WITH PROVIDERS PROCESSES RULEMAKINGSAFETYOVERSIGHT SETTING MINIMUM SAFETY LEVELS SAFETY PERFORMANCE & IMPROVEMENT PROCESSESPROCESSES SAFETYOVERSIGHT Safety Oversight n Safety regulatory oversight of procedures implemented by ANSPs & related approval of organisation and SMS n Safety regulatory review of Safety Argument/Case & related approval of ATM systems/changes, procedures and safety staff n EC Conformity assessment processes n Certification/safety regulatory approval processes SES: National Supervisory Authorities, with reliance on third party organisations.... SES: National Supervisory Authorities, with reliance on third party organisations....

This has to be done by the provider... EUROCONTROL Safety Regulation Commission - Workshop on ESARR 3 and Related Material SPECIFICATIONS DETERMINATION DESIGN AND DEVELOPMENT INSTALLATION AND TRANSITION OPERATION PROJECT RISK ASSESSMENT AND MITIGATION DOCUMENTATION Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables RISK ASSESSMENT AND MITIGATION ACTIVITIES ACCEPTANCE REVIEW OF THE RISK ASSESSMENT AND MITIGATION DOCUMENTATION SPECIFICATIONS DETERMINATION DESIGN AND DEVELOPMENT INSTALLATION AND TRANSITION OPERATION PROJECT RISK ASSESSMENT AND MITIGATION DOCUMENTATION Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables RISK ASSESSMENT AND MITIGATION ACTIVITIES ACCEPTANCE REVIEW OF THE RISK ASSESSMENT AND MITIGATION DOCUMENTATION

Role of ATM Safety Regulator ? SPECIFICATIONS DETERMINATION DESIGN AND DEVELOPMENT INSTALLATION AND TRANSITION OPERATION PROJECT RISK ASSESSMENT AND MITIGATION DOCUMENTATION Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables RISK ASSESSMENT AND MITIGATION ACTIVITIES ACCEPTANCE REVIEW OF THE RISK ASSESSMENT AND MITIGATION DOCUMENTATION SPECIFICATIONS DETERMINATION DESIGN AND DEVELOPMENT INSTALLATION AND TRANSITION OPERATION PROJECT RISK ASSESSMENT AND MITIGATION DOCUMENTATION Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables RISK ASSESSMENT AND MITIGATION ACTIVITIES ACCEPTANCE REVIEW OF THE RISK ASSESSMENT AND MITIGATION DOCUMENTATION EUROCONTROL Safety Regulation Commission - Workshop on ESARR 3 and Related Material

EATM programmes (GNSS, RVSM, ACAS..) SRC Co-ordination National ATS providers National Regulator Inputs/co-ordination Final “approval” Submission of safety policy and arguments, with related operational assumptions Request for “approval” in national context of operations Co-ordinated views on acceptability of safety policy and arguments EATM PROGRAMMES related Approval Process EUROCONTROL

ESARR4: Risk Assessment & Mitigation in ATM EUROCONTROL

EUROCONTROL ESARR 4 REQUIREMENTS ESARR 2 deals with the PAST… ESARR 3 is focused on the PRESENT… ESARR 4 is about the FUTURE WHAT CAN GO WRONG ? WHAT CAN BE DONE TO PREVENT IT ? MANAGING THE RISK

DETERMINATION & SPECIFICATION DESIGN AND DEVELOPMENT INSTALLATION AND TRANSITION OPERATION PROJECT RISK ASSESSMENT AND MITIGATION DOCUMENTATION Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables Risk Assessment and Mitigation Deliverables RISK ASSESSMENT AND MITIGATION PROCESS ACCEPTANCE REVIEW OF THE RISK ASSESSMENT AND MITIGATION DOCUMENTATION EUROCONTROL ESARR 4 REQUIREMENTS IN PRACTICAL TERMS...

Hazard identification & risk assessment and mitigation for any change to those parts of the ATM System & supporting services under the provider's managerial control EUROCONTROL ESARR 4 REQUIREMENTS IN ACCORDANCE WITH ESARR 4…. VERIFICATION: THAT ALL IDENTIFIED SAFETY OBJECTIVES SAFETY OBJECTIVES SAFETY REQUIREMENTS SAFETY REQUIREMENTS HAVE BEEN MET  PRIOR TO IMPLEMENTATION OF THE CHANGE  DURING ANY TRANSITION INTO OPERATIONAL SERVICE  DURING OPERATIONAL LIFE  DURING ANY TRANSITION TILL DECOMMISIONING DERIVATION OF RISK MITIGATION STRATEGY: SPECIFY: DEFENCES TO MEET SAFETY OBJECTIVES AND REDUCE OR ELIMINATE THE RISKS INDUCED BY IDENTIFIED HAZARDS SAFETY REQUIREMENTS MAY BEAR ON THE CONSTITUENT PART UNDER CONSIDERATION AND/OR OTHER PARTS OF THE ATM SYSTEM OR OPERATIONAL ENVIRONMENT DETERMINATION OF SAFETY OBJECTIVES: (to be placed on the constituent part) DETERMINE: THEIR TOLERABILITY IN TERMS OF HAZARD'S MAXIMUM MAXIMUM PROBABILITY OF PROBABILITY OF OCCURRENCE OCCURRENCE ASSESS: THE EFFECTS THEY MAY HAVE ON THE SAFETY OF AIRCRAFT & THE SEVERITY OF THOSE EFFECTS IDENTIFY: ATM-RELATED CREDIBLE HAZARDS FAILURE CONDITIONS THEIR COMBINED EFFECTS DETERMINATION OF: SCOPE SCOPE BOUNDARIES BOUNDARIES INTERFACES INTERFACES FUNCTIONS FUNCTIONS OPERATIONAL ENVIRONMENT OPERATIONAL ENVIRONMENT OF THE CONSTITUENT BEING CONSIDERED SAFETY OBJECTIVES (Quantitative) SAFETY REQUIREMENTS (Quantitative and/or Qualitative) (Both qualitative and quantitative methods can be used) SEVERITYCLASSIFICATIONSCHEME as included in ESARR 4 Appendix A (Fig A1) RISKCLASSIFICATIONSCHEME consistent with the one of ESARR 4 Appendix A (Fig A2) (but not the same one !!) SYSTEM DEFINITION SYSTEM DESIGN IMPLEMENTATION OPERATION

EUROCONTROL ESARR 4 REQUIREMENTS IN ACCORDANCE WITH ESARR 4…. FIRST STEP Determination of the constituent part being considered DETERMINATION OF: SCOPE SCOPE BOUNDARIES BOUNDARIES INTERFACES INTERFACES FUNCTIONS FUNCTIONS OPERATIONAL ENVIRONMENT OPERATIONAL ENVIRONMENT OF THE CONSTITUENT BEING CONSIDERED DETERMINATION OF THE CONSTITUENT PART BEING CONSIDERED The "constituent part" under assessment is determined by what the ATM service provider wants to introduce at the time

EUROCONTROL ESARR 4 REQUIREMENTS IN ACCORDANCE WITH ESARR 4…. SECOND STEP Determination of Safety Objectives DETERMINATION OF SAFETY OBJECTIVES: (to be placed on the constituent part) DETERMINE: THEIR TOLERABILITY IN TERMS OF HAZARD'S MAXIMUM MAXIMUM PROBABILITY OF PROBABILITY OF OCCURRENCE OCCURRENCE ASSESS: THE EFFECTS THEY MAY HAVE ON THE SAFETY OF AIRCRAFT & THE SEVERITY OF THOSE EFFECTS IDENTIFY: ATM-RELATED CREDIBLE HAZARDS FAILURE CONDITIONS THEIR COMBINED EFFECTS SAFETY OBJECTIVES (Quantitative) SEVERITYCLASSIFICATIONSCHEME as included in ESARR 4 Appendix A (Fig A1) RISKCLASSIFICATIONSCHEME consistent with the one of ESARR 4 Appendix A (Fig A2) (but not the same one !!) DETERMINATION OF: SCOPE SCOPE BOUNDARIES BOUNDARIES INTERFACES INTERFACES FUNCTIONS FUNCTIONS OPERATIONAL ENVIRONMENT OPERATIONAL ENVIRONMENT OF THE CONSTITUENT BEING CONSIDERED DETERMINATION OF SAFETY OBJECTIVES We identify hazards and determine "Safety Objectives" to express the the maximum tolerability of the hazards identified… … These "Safety Objectives" will become targets to be achieved when designing, developing and operating the system DETERMINATION OF: SCOPE SCOPE BOUNDARIES BOUNDARIES INTERFACES INTERFACES FUNCTIONS FUNCTIONS OPERATIONAL ENVIRONMENT OPERATIONAL ENVIRONMENT OF THE CONSTITUENT BEING CONSIDERED

EUROCONTROL ESARR 4 REQUIREMENTS IN ACCORDANCE WITH ESARR 4…. THIRD STEP Derivation of a Risk Mitigation Strategy SAFETY REQUIREMENTS (Quantitative and/or Qualitative) DERIVATION OF RISK MITIGATION STRATEGY: SPECIFY: DEFENCES TO MEET SAFETY OBJECTIVES AND REDUCE OR ELIMINATE THE RISKS INDUCED BY IDENTIFIED HAZARDS SAFETY REQUIREMENTS MAY BEAR ON THE CONSTITUENT PART UNDER CONSIDERATION AND/OR OTHER PARTS OF THE ATM SYSTEM OR OPERATIONAL ENVIRONMENT DETERMINATION OF SAFETY OBJECTIVES: (to be placed on the constituent part) DETERMINE: THEIR TOLERABILITY IN TERMS OF HAZARD'S MAXIMUM MAXIMUM PROBABILITY OF PROBABILITY OF OCCURRENCE OCCURRENCE ASSESS: THE EFFECTS THEY MAY HAVE ON THE SAFETY OF AIRCRAFT & THE SEVERITY OF THOSE EFFECTS IDENTIFY: ATM-RELATED CREDIBLE HAZARDS FAILURE CONDITIONS THEIR COMBINED EFFECTS SAFETY OBJECTIVES (Quantitative) SEVERITYCLASSIFICATIONSCHEME as included in ESARR 4 Appendix A (Fig A1) RISKCLASSIFICATIONSCHEME consistent with the one of ESARR 4 Appendix A (Fig A2) (but not the same one !!) DETERMINATION OF: SCOPE SCOPE BOUNDARIES BOUNDARIES INTERFACES INTERFACES FUNCTIONS FUNCTIONS OPERATIONAL ENVIRONMENT OPERATIONAL ENVIRONMENT OF THE CONSTITUENT BEING CONSIDERED DERIVATION OF A RISK MITIGATION STRATEGY In order to meet the Safety Objectives, various mitigation measures are identified. They are commonly known as "Safety Requirements" DETERMINATION OF SAFETY OBJECTIVES: (to be placed on the constituent part) DETERMINE: THEIR TOLERABILITY IN TERMS OF HAZARD'S MAXIMUM MAXIMUM PROBABILITY OF PROBABILITY OF OCCURRENCE OCCURRENCE ASSESS: THE EFFECTS THEY MAY HAVE ON THE SAFETY OF AIRCRAFT & THE SEVERITY OF THOSE EFFECTS IDENTIFY: ATM-RELATED CREDIBLE HAZARDS FAILURE CONDITIONS THEIR COMBINED EFFECTS SAFETY OBJECTIVES (Quantitative) SEVERITYCLASSIFICATIONSCHEME as included in ESARR 4 Appendix A (Fig A1) RISKCLASSIFICATIONSCHEME consistent with the one of ESARR 4 Appendix A (Fig A2) (but not the same one !!) DETERMINATION OF: SCOPE SCOPE BOUNDARIES BOUNDARIES INTERFACES INTERFACES FUNCTIONS FUNCTIONS OPERATIONAL ENVIRONMENT OPERATIONAL ENVIRONMENT OF THE CONSTITUENT BEING CONSIDERED

EUROCONTROL ESARR 4 REQUIREMENTS IN ACCORDANCE WITH ESARR 4…. FOURTH STEP VerificationVERIFICATION Verify that all identified Safety Objectives and Safety Requirements have been met VERIFICATION: THAT ALL IDENTIFIED SAFETY OBJECTIVES SAFETY OBJECTIVES SAFETY REQUIREMENTS SAFETY REQUIREMENTS HAVE BEEN MET  PRIOR TO IMPLEMENTATION OF THE CHANGE  DURING ANY TRANSITION INTO OPERATIONAL SERVICE  DURING OPERATIONAL LIFE  DURING ANY TRANSITION TILL DECOMMISIONING (Both qualitative and quantitative methods can be used) SAFETY REQUIREMENTS (Quantitative and/or Qualitative) DERIVATION OF RISK MITIGATION STRATEGY: SPECIFY: DEFENCES TO MEET SAFETY OBJECTIVES AND REDUCE OR ELIMINATE THE RISKS INDUCED BY IDENTIFIED HAZARDS SAFETY REQUIREMENTS MAY BEAR ON THE CONSTITUENT PART UNDER CONSIDERATION AND/OR OTHER PARTS OF THE ATM SYSTEM OR OPERATIONAL ENVIRONMENT SAFETY REQUIREMENTS (Quantitative and/or Qualitative) DERIVATION OF RISK MITIGATION STRATEGY: SPECIFY: DEFENCES TO MEET SAFETY OBJECTIVES AND REDUCE OR ELIMINATE THE RISKS INDUCED BY IDENTIFIED HAZARDS SAFETY REQUIREMENTS MAY BEAR ON THE CONSTITUENT PART UNDER CONSIDERATION AND/OR OTHER PARTS OF THE ATM SYSTEM OR OPERATIONAL ENVIRONMENT DETERMINATION OF SAFETY OBJECTIVES: (to be placed on the constituent part) DETERMINE: THEIR TOLERABILITY IN TERMS OF HAZARD'S MAXIMUM MAXIMUM PROBABILITY OF PROBABILITY OF OCCURRENCE OCCURRENCE ASSESS: THE EFFECTS THEY MAY HAVE ON THE SAFETY OF AIRCRAFT & THE SEVERITY OF THOSE EFFECTS IDENTIFY: ATM-RELATED CREDIBLE HAZARDS FAILURE CONDITIONS THEIR COMBINED EFFECTS SAFETY OBJECTIVES (Quantitative) SEVERITYCLASSIFICATIONSCHEME as included in ESARR 4 Appendix A (Fig A1) RISKCLASSIFICATIONSCHEME consistent with the one of ESARR 4 Appendix A (Fig A2) (but not the same one !!) DETERMINATION OF: SCOPE SCOPE BOUNDARIES BOUNDARIES INTERFACES INTERFACES FUNCTIONS FUNCTIONS OPERATIONAL ENVIRONMENT OPERATIONAL ENVIRONMENT OF THE CONSTITUENT BEING CONSIDERED

FAILUREHAZARD CLASS 1 Accidents CLASS 2 Serious Incidents CLASS 3 Major Incidents CLASS 4 Significant Incidents CLASS 5 No Immediate Effect on Safety PROBABILITY OF THE HAZARD LEADING TO ACCIDENT/INCIDENT INCIDENT OR ACCIDENT MAXIMUM PROBABILITY OF OCCURRENCE OF HAZARD EFFECTS SEVERITY OF EFFECTS ON AIRCRAFT OPERATIONS 1,55x10 -8 TBD LIMITATIONS…. ESARR2 collection Quantification of Safety Objectives SRC POL DOC 1 ECAC ATM Safety Minima PROBABILITY OF OCCURRENCE OF THE HAZARD SAFETY OBJECTIVE MAXIMUM PROBABILITY OF OCCURRENCE OF HAZARD ? ? ? ? SEVERITY OF EFFECTS INDUCED BY THE HAZARD TBD

Operational environment boundary ( TOTAL SYSTEM APPROACH) CNS/ATM system boundary CNS/ATM Procedures ATSU People ATC Procedures Ground Equipment Airspace Aircraft Flight Operations procedures Pilot training Aircraft equipment The ATM system and supporting services

ATM Safety codes Airport Safety codes Airworthiness codes Flight Operations Certification codes ICAO Annex 14 and associated doc ICAO Annex 11 and associated doc ICAO Annex 8 and associated doc ICAO Annex 6 ICAO Annex 6 and associated doc ToTal System Approach ToTal System Approach

AIS: Aeronautical Information Services State Airspace State Aeroplane ManufacturerAeroplane OperatorANSPEquipment Manufacturer National Airworthiness Authority National Airworthiness Authority National Operational Approval Authority ANSP Supervisory Authority Environment Safety Assessment Equipment specifications, limitations,operations and maintenance FlightManual MaintenanceManual Types ofoperations authorised Authorised areasof operations AIS

EUROCONTROL ESARR 4 REQUIREMENTS EUROCONTROL Safety Regulation Commission - Workshop on ESARR 3 and Related Material More Guidance ?  ESARR 4 Guidance Material - EAM4/GUI1 Explanatory Material on ESARR 4 Explanatory Material on ESARR 4 Edition 1.0 Edition 1.0

SAFETY REGULATION COMMISSION SAFETY REGULATION COMMISSION Harmonisation of ATM Safety Regulation & ESARRs SAFETY REGULATION COMMISSION SAFETY REGULATION COMMISSION Harmonisation of ATM Safety Regulation & ESARRs Martine Blaize - Deputy of Safety Regulation Unit (SRU)