ESARR 4

1. ESARR 4 An overview and the important aspects of Risk Mitigation and Assessment in ATM

2. Your presenter • Gary Morton • Expert SRU and Focal Point on ESARR 4 • 10 years in UK CAA in Safety Management and Regulation of ATM systems. Experience in the application of hazard and risk analysis of ATM systems together with ATM system approval mechanisms.

3. Some light relief Watch for randomly located, occasionally relevent cartoons

4. Linkage to other ESARR • SMS, data collection and monitoring • Why change? • Applicability? • Identifying the system • scope, boundary, interfaces, environment, functions • Determining the safety objectives • identify hazards, the severity effect on aircraft safety, determine the tolerability • Implementation

7. Why change? What has altered in the field of ATM that requires a new approach?

8. ESARR 4 Page 8

11. Increased integration • many more groups need to coordinate together • many more regulatory groups need to coordinate together • complexity • dealing with software, human factors!

12. Some light relief

13. Applicability? Who does ESARR 4 effect?

14. ESARR 4 Page 9

16. Applies to the military where they provide ATM services to civil aircraft. • Applies to all civil ATM, whether they are part of government, private, corporatised etc • Applies to airports and en-route centres. • But what are ATM services? • And what is the ATM system and supporting systems?

17. ATM Services

19. Operational environmentboundary The ATM system and supporting services (THE TOTAL SYSTEM APPROACH) CNS/ATM systemboundary ATSU Aircraft People Flight Operations procedures ATC Procedures Pilot training Ground Equipment Aircraft equipment Airspace CNS/ATM Procedures

20. Summary • Any change to the Civil ATM system is covered by ESARR 4

21. Some light releif

22. The overall Risk assessment and mitigation process

23. Operational environmentboundary Effect on occupants Effect on aircraft operations ATM systemboundary Error in ATM ATSU Aircraft People Error in ATSU Flight Operations procedures ATC Procedures Pilot training Ground Equipment Aircraft equipment Airspace ATM Procedures

24. Operational environmentboundary Effect on aircraft operations ATM systemboundary Error in ATM ATSU Aircraft People Error in aircraft Flight Operations procedures ATC Procedures Pilot training Ground Equipment Aircraft equipment Airspace ATM Procedures

25. Operational environmentboundary Effect on aircraft operations ATM systemboundary Error in ATM ATSU Aircraft People Error in aircraft Flight Operations procedures ATC Procedures Pilot training Ground Equipment Aircraft equipment Airspace ATM Procedures

26. Operational environmentboundary Severity 1 Severity 2 ATM systemboundary ATSU Aircraft People Flight Operations procedures ATC Procedures Pilot training Ground Equipment Aircraft equipment Airspace ATM Procedures

27. Some light relief ATC and these steep descents

28. Scope of Risk Assessment and Mitigation When does the ESARR need to be applied?

29. In this session (ESARR4 para 5.1) • we will consider the ESARR 4 requirement to assess safety throughout the life-cycle of a programme • we will consider the ESARR 4 requirement to assess the airborne and ground components of the ATM system • we will consider the ESARR 4 requirement to consider the human, equipment and procedure elements of the system

30. ESARR 4 Page 9

32. Initiation and update of safety arguments must be undertaken according to the stages of life cycle Safety Argument collects evidence that safety is maintained during all stages of life cycle Planning Design Implementation Integration Transfer to Operation Operations and Maintenance Decommissioning

33. Operational environmentboundary Severity 1 Severity 2 ATM systemboundary ATSU Aircraft People Flight Operations procedures ATC Procedures Pilot training Ground Equipment Aircraft equipment Airspace ATM Procedures

36. Review (ESARR4 para 5.1) • ESARR 4 requires a safety assessment of the life-cycle of a programme • ESARR 4 requires an assessment of the airborne and ground components of the ATM system • ESARR 4 requires consideration of the human, equipment and procedure elements of the system

37. Some light relief

38. Identifying the Hazards How do we derive the safety objectives of a system?

39. In this session (ESARR 4 Para 5.2) • we will consider the ESARR 4 requirement to define the scope, boundaries, interfaces and environment of the system • we will consider the ESARR 4 requirement to derive safety objectives by determining hazards, determining the effect of these hazards on aircraft and then determining the tolerable rate of occurence

40. ESARR 4 page 9 and 10

42. Defining the scope, boundaries and interfaces of the system • we are making a change to the system • we need to identify what the system does • so we we need to know how the change effects what the system does

44. So, in order to determine the effect of the change, we must consider what the changed system actually does and how it interacts with other systems. • The boundary of the system is the part we are changing • The interfaces are how this system connects to others • The scope defines the functions of the system

45. To determine the safety objectives of the system • Step 1 determine the ATM related credible hazards and failure conditions • Step 2 relate these to the effect on aircraft considering the environment • Step 3 determine the tolerable rate allowed

47. Step 1 ATM related credible hazards and failure conditions • In the risk assessment and mitigation process, we are worried about things going wrong. • why ATM related? • Why credible? • What is a hazard and a failure condition?

49. A Hazard is defined in ESARR 4 as; • Any condition, event or circumstance which could induce an accident • Similalry, a failure condition is defined as; • A condition having an effect on the aircraft or its occupants, ….. Caused by ...one or more failures, or errors ….

50. A hazard is whenever the system is not delivering its designed function Quieter than a normal friday