Functional Hazard Assessment (FHA) Report for Unmanned Aircraft Systems

Transcription

1 Unmanned Aircraft System (UAS) Safety Case Development Functional Hazard Assessment (FHA) Report for Unmanned Aircraft Systems Reference: Date: 22 November 2009 Issue: v2.0 Prepared by: Hayley Burdett Checked by: Joanne Stoker Authorised by: Alan Simpson Distribution: EUROCONTROL Ebeni Holger Matthiesen Hayley Burdett Chris Machin Joanne Stoker Don Harris Alan Simpson Mike Strong Project File

2 Functional Hazard Assessment (FHA) Copyright The layout, style, logo and contents of this document are copyright of Ebeni Limited No part of this document may be reproduced without the prior written permission of Ebeni Limited. All rights reserved. Configuration Control Issue Date Comments v June 2009 Initial draft for internal review v July 2009 Draft issue following internal review v July 2009 Provisional issue for EUROCONTROL review v Sept 2009 Definitive issue incorporating EUROCONTROL review comments v November 2009 Update incorporating final review comments v November 2009 Proposed definitive issue for internal review v November 2009 Definitive issue Page 2 of 74

3 Functional Hazard Assessment (FHA) Table of Contents 1 Introduction Background UAS Safety Assessment UAS Today Conventions Aim Scope Structure 7 2 Functional Hazard Assessment Overview Introduction FHA Process FHA Objectives UAS Safety Assessment Workshop 10 3 System Definition and Scope of Analysis UAS Operational Scenarios Defining the Scope for the FHA Activity Air Traffic Management Concept Separation Provision Component Collision Avoidance Component Operational Perspectives UAS Characteristics Scoping Statements Assumptions Unmanned Aircraft System Models Flight Profiles Functional Models 20 4 Function Hazard Assessment Results Overview Hazard Identification Approach Hazard Identification Results Consequence Analysis Mitigations for HAZ Mitigations for HAZ Mitigations for HAZ Mitigations for HAZ Mitigations for HAZ Mitigations for HAZ Mitigations for HAZ Mitigations for HAZ Mitigations for HAZ Mitigations for HAZ Analysis Conclusions 32 Page 3 of 74

4 Functional Hazard Assessment (FHA) 4.6 Safety Objectives 33 5 Conclusions 34 6 References 35 Appendix A UAS Safety Assessment Workshop Agenda and Participants 36 A.1 UAS Workshop Agenda 36 A.2 UAS Workshop Participants 37 Appendix B Unmanned Aircraft System Models 38 B.1 Flight Profiles 38 B.2 Functional Models 40 Appendix C Functional Failure Analysis 41 Appendix D UAS Fault Trees 50 D.1 UAS Scenario 1 50 D.2 UAS Scenario 2 58 Appendix E Severity Classification 64 Appendix F Consequence Models 65 F.1 HAZ001 Air Vehicle does not comply with Separation Provision Instruction from ATC65 F.2 HAZ002 Air Vehicle incorrectly responds to Separation Provision Instruction from ATC 66 F.3 HAZ003 Excessive number of intentional deviations from Separation Provision Instruction 67 F.4 HAZ004 Delayed response to Separation Provision Instruction from ATC 68 F.5 HAZ005 Loss of Separation Provision from ATC 69 F.6 HAZ006 ATC Separation Provision Error 70 F.7 HAZ007 Loss of Separation Provision from the Pilot 71 F.8 HAZ008 Pilot Separation Provision Error 72 F.9 HAZ009 Pilot Separation Provision Instruction too late 73 F.10 HAZ010 Separation Provision minima is breached by other aircraft 74 Page 4 of 74

5 Functional Hazard Assessment (FHA) 1 Introduction 1.1 Background The evolution of aerospace technologies in the field of Unmanned Aircraft Systems (UAS), including automatic/autonomous operations, will impact European Air Traffic Management (ATM) as regards new military and civil UAS applications. UAS will represent new challenges as well as new opportunities for ATM design in the future in the context of both SESAR and beyond (vision 2050), for the benefit of both manned and unmanned aviation. The EUROCONTROL Agency, in executing its responsibilities associated with the management of the pan-european ATM network, must ensure that UAS do not negatively impact overall levels of ATM security, safety, capacity and efficiencies. This work will result in the development of an ATM safety assessment for UAS that will identify a set of ATM safety requirements, over and above existing ATM regulatory safety requirements, which, if implemented, will ensure that the introduction of UAS into non-segregated airspace will be acceptably safe. 1.2 UAS Safety Assessment The primary aim of this task is to develop an ATM safety assessment for UAS so as to identify a set of ATM safety requirements, over and above the existing ATM regulatory safety requirements, which, if implemented, will ensure that the introduction of UAS into non-segregated airspace will be acceptably safe. The safety assessment is to consider two defined UAS operating scenarios in order to provide a realistic context into which UAS will be operated. Scenario 1 covers UAS operations in Class A, B or C en-route airspace flying Instrument Flying Rules (IFR) beyond the visual line of sight of the pilot-incommand Scenario 2 covers UAS operations in Class C G airspace operating under Visual Flying Rules (VFR) and the pilot-in-command has direct visual line of sight of the Unmanned Ai Vehicle (UAV) The work currently being undertaken by EUROCAE Working Group 73 on Unmanned Aircraft Systems will also provide input and review effort to the safety assessment work. A UAS Safety Assessment Workshop was carried out to satisfy the process requirements of the EUROCONTROL ANS Safety Assessment Methodology (SAM) [1] which provides a means of compliance with the EUROCONTROL Safety and Regulatory Requirement (ESARR) 4 [2]. 1.3 UAS Today Current UAS operations are largely constrained to designated areas or within temporary restricted areas of airspace, commonly known as segregated airspace, or are flown under special arrangements over the sea or high altitude. On some occasions, UAS operations are permitted in an extremely limited environment outside segregated airspace. To exploit fully the unique potential of UAS there is a desire to be able to access all classes of non-segregated airspace and operate across national Page 5 of 74

6 Functional Hazard Assessment (FHA) borders and airspace boundaries. Such operations must be acceptably safe but regulation should not become so inflexible or burdensome that the benefits are unnecessarily lost. The viability of the civil market for UAS especially, is heavily dependent on unfettered access to the same airspace as manned civil aircraft operations, at least on like for like operations, for example in aerial surveillance applications. Whilst it is essential that UAS demonstrate an equivalent level of safety compared to manned operations the current regulatory framework has evolved around the concept of the pilot-in-the-cockpit. There is a need to develop UAS solutions that assure an equivalent level of safety for UAS operations, which in turn could require some adaption of the current ATM regulatory framework to allow for the concept of the pilotnot-in-the-cockpit without compromising the safety of other airspace users. 1.4 Conventions The UAS community has yet to settle on a single common terminology for UAS. For the purposes of this analysis the following naming conventions are used when referring to UAS operations: Unmanned Aircraft System encompasses the entire system of systems required to support the launch, controlled flight and recovery of Unmanned Air Vehicle. Unmanned Air Vehicle the air vehicle element of the UAS; note the term air vehicle is used in a broad sense to include all forms of air vehicles not otherwise classified as model aircraft. UAV Pilot (UAVp) the pilot in command of the UAV as defined by ICAO Annex 2 [12]. UAV Control System (UCS) the UAV command and control system colocated with the UAV Pilot and providing the necessary Pilot - UAV interface via the UAV Control Link. UAV Control Link the command and control link between the UCS and the UAV. UAV Launch and Recovery System the system or systems used in the launch and or recovery of UAV. Note that UAV Launch and Recovery is outside the scope of the assessment. 1.5 Aim This document comprises the Functional Hazard Assessment (FHA) for Unmanned Aircraft Systems operation in non-segregated airspace and provides an independent assessment of the hazards related to operating UAS in non-segregated airspace. The aim of this FHA is derived from the following top level safety argument claim, which implies a relative safety argument approach: UAS operations in ECAC Airspace are and will be acceptably safe; Page 6 of 74

7 Functional Hazard Assessment (FHA) where ECAC airspace is defined as the airspace of the 44 ECAC Member States, and acceptably safe is defined as risks to other airspace users are: 1.6 Scope o No higher than for equivalent manned operations; and o Reduced to As Far As Reasonably Practicable (AFARP), as required by ESARR 3 [3] and European Air Traffic Management Programme (EATMP) Safety Policy [4]. The initial step in addressing the above claim is to specify safety requirements such that, subject to complete and correct implementation, UAS operations in nonsegregated airspace are acceptably safe. The aim of this FHA is therefore to understand the risk of UAS via the derivation of hazards and an analysis of the consequences of those hazards. The Functional Hazard Assessment work will support the development of a UAS Preliminary System Safety Assessment Report (PSSA) which will document UAS safety requirements and provide traceability to detailed safety requirements. This report covers the safety assurance activities undertaken to assess the safety of UAS operation in non-segregated airspace using two operational scenarios, up to the point where hazards have been identified and the consequence of those hazards assessed. Scenario 1 covers UAS IFR operations in Class A, B or C en-route airspace only. The mode of operation considered for this baseline scenario uses a command and control system architectures known as Radio Line Of Sight (RLOS) or Beyond Radio Line Of Sight (BRLOS). Scenario 2 covers UAS VFR operations based upon Visual Line of Sight (VLOS) command and control systems in classes of airspace where VFR flight is permitted (Class C-G). VLOS operation requires the UAV Pilot to keep the UAV in direct visual observation for the duration of the flight. This safety assessment work is carried out from an Air Traffic Management (ATM) perspective with the aim of requirement setting but is not concerned with the implementation of any such safety requirements. 1.7 Structure The Functional Hazard Assessment Report is structured as follows: Section 1 Section 2 Section 3 Introduction presents the scope and purpose of the report. Functional Hazard Assessment Overview documents the objectives of the Functional Hazard Assessment along with the hazard identification and risk assessment methodology. System Scope and Scope of Analysis provides an overview of the system under consideration and defines the scope of the analysis. Page 7 of 74

8 Functional Hazard Assessment (FHA) Section 4 Functional Hazard Assessment Results documents the results of the Functional Hazard Assessment activity. Section 5 Conclusions presents the conclusions of the Functional Hazard Assessment. Section 6 References provides a list of referenced documents used in the report. Page 8 of 74

9 Functional Hazard Assessment (FHA) 2 Functional Hazard Assessment Overview 2.1 Introduction The EUROCONTROL Air Navigation Services (ANS) Safety Assessment Methodology [1] defines the objectives of a FHA as: 2.2 FHA Process a top-down iterative process, initiated at the beginning of the development or modification of an Air Navigation System. The objective of the FHA process is to determine: how safe does the system need to be? The process identifies potential functional failures modes and hazards. It assesses the consequences of their occurrences on the safety of operations, including aircraft operations, within a specified operational environment. The FHA process specifies overall Safety Objectives of the system, i.e. specifies the safety level to be achieved by the system. This FHA was performed in order to support a relative safety argument. The analysis aims to derive a set of hazards relating to UAS operating in non-segregated airspace. The first step in performing the FHA was to establish the scope and boundary of the system, understanding that the system covers all aspects of the ATM environment including people, procedures and equipment. In the context of the defined scope and system boundary, the analysis has focused specifically on the identification of: A Functional and Logical Safety Model representing UAS operations in each Scenario. Hazards that could arise from inter alia; functional failure, inadequacies, limitations, etc. The potential consequences of those hazards. The FHA process began with the construction of a number of models. Given the requirement to present a relative safety argument, it was important to fully appreciate the current situation with no UAS (referred to as without-uas ) as compared to the proposed situation with UAS flying in non-segregated airspace (referred to as with- UAS ). The models were constructed to aid the identification of potential hazards for which mitigation is required, see section 3.8 for more detail. The models along with the proposed scope, boundary and assumptions for the analysis were presented at a UAS Safety Assessment Workshop for validation and verification by domain experts. A hazard identification verification activity was also carried out as part of the UAS Safety Assessment Workshop. A number of issues, statements and discussion points were raised at the UAS Safety Assessment Workshop which were minuted in [5]. A number of these points have been used to justify or substantiate analysis decisions; these are referred to specifically throughout this document as originating from the workshop participants. Page 9 of 74

10 Functional Hazard Assessment (FHA) The output from the UAS Safety Assessment Workshop has been taken and used to perform a more detailed analysis which has included consideration of consequences and mitigations. These hazard models will subsequently be used as the basis of the UAS Preliminary System Safety Assessment, which will derive the safety requirements for UAS operations in non-segregated airspace. 2.3 FHA Objectives The overall aims for the Functional Hazard Assessment as defined in section 1.4 are further refined to specific task objectives as discussed in the following list. Some of the objectives were addressed as part of the pre-workshop and workshop activities and others as part of the post workshop activities. The results of these activities are captured in this report. The objectives listed below apply to both scenarios. The detailed objectives were: review and agree the overarching UAS Safety Argument Strategy verify the scope and boundaries of the analysis being undertaken validate the UAS Functional and Logical models identify the hazards as applicable to current manned operations (without- UAS) and proposed UAS operations (with-uas) in non-segregated airspace identify, the possible consequences of each hazard, taking into account the available mitigations, using Event Tree Analysis. 2.4 UAS Safety Assessment Workshop A UAS Safety Assessment Workshop was held at EUROCONTROL HQ, Brussels on Wednesday 29th April and Thursday 30th April Minutes from the workshop are recorded in [5]. The Agenda for the UAS Safety Assessment Workshop and a list of participants is provided in Appendix A. With respect to the above objectives, the UAS Safety Assessment Workshop achieved the following: Reviewed and agreed the overarching UAS Safety Argument Strategy. Verified the scope and boundaries of the analysis being undertaken. Validated the Scenario, Functional and Logical models for each UAS scenario. Identified the hazards associated with each scenario and the possible mitigations that are in place. The remaining objectives are all captured as part of the FHA results in section 4. The safety assessment output from the Military UAV as Operational Air Traffic (OAT) outside Segregated Airspace [6] project was also presented at the UAS Workshop as it was agreed as applicable. This is discussed in more detail in section 4.1 Page 10 of 74

11 Functional Hazard Assessment (FHA) 3 System Definition and Scope of Analysis 3.1 UAS Operational Scenarios The concept of operating UAS in non-segregated airspace is expected to be transparent to the ATM environment. There are obvious differences between manned and unmanned aircraft, but in principle the UAS should operate to the same rules of the air and procedures that apply to manned aircraft. The safety of other airspace users depends on the UAS operations achieving at least an equivalent level of safety to manned aircraft. There are a wide variety of possible UAS operations and the safety aspects across the whole flight profile need to be assessed in order to assure those operations are acceptably safe. However, in order to focus this initial safety assessment, two UAS scenarios have been defined as described below. They were identified by the EUROCAE Working Group 73 as two of the most relevant near-term operational scenarios for UAS. The scenarios cover non-segregated operations but not for all flight stages and are subject to the assumptions listed later in section 3.7. Scenario 1 covers UAS IFR operations in Class A, B or C en-route airspace only. The mode of operation considered for this baseline scenario uses a command and control system known as either Radio Line Of Sight (RLOS) or Beyond Radio Line Of Sight (BRLOS). The operations shall take place beyond visual line of sight (BVLOS) of the UAS Pilot. The duration of any UAS operation is dictated by the demands of the task but under Scenario 1 can range from a few hours to a number of days. Figure 1 below represents Scenario 1 Figure 1 Scenario 1 Page 11 of 74

12 Functional Hazard Assessment (FHA) Scenario 2 covers UAS VFR operations based upon VLOS command and control systems in classes of airspace where VFR flight is permitted (Class C- G). Operations in classes C-E airspace could include CTR and/or TMA. Class B CTRs and TMAs, where VFR is also permitted, have been intentionally not considered. VLOS operation requires the UAV Pilot to keep the UAV in direct visual observation for the duration of the flight. The duration of any UAS operation is dictated by the demands of the task but under Scenario 2 range from a few minutes up to the available hours of daylight. Figure 2 below represents Scenario 2. Figure 2 Scenario Defining the Scope for the FHA Activity Prior to the FHA activity it was important to understand the differences between the without-uas and with-uas situations for each of the defined scenarios above in order to structure the analysis and support the relative assessment of risk. The scope of the safety assessment has thus been defined by: understanding the ATM concept and environment in which UAS will operate, see section 3.3. a number of operational perspectives, see section 3.4. understanding the characteristics of UAS, see section 3.5. a series of identified scoping statement and assumptions, see sections 3.6 and 3.7. Page 12 of 74

13 Functional Hazard Assessment (FHA) a number of UAS models, see section Air Traffic Management Concept There are three main components of ATM, defined within the ATM Operational Concept Document [7] endorsed at ANC/11 in September 2003: Strategic Conflict Management Separation Provision and Collision Avoidance. Strategic Conflict Management encapsulates all pre-flight planning activities that take place to ensure demand, capacity and conflicts are managed prior to the real time situation. Figure 3 below shows the principle interactions between the Strategic Conflict Management, Separation Provision, Collision Avoidance components and the Airspace. Note that [7] also states that any Collision Avoidance System should be separate from but compatible with the Separation Provision component. Collision avoidance systems cannot be included in determining the calculated level of safety required for Separation Provision with regards the ESARR4 Target Level of Safety (TLS), however the Collision Avoidance function has been taken into account within this relative safety assessment due to the significant difference between the with- UAS and without-uas situations. Figure 3 High Level Functional Model Page 13 of 74

14 Functional Hazard Assessment (FHA) The use of these terms is important within this analysis and has thus been defined in the following sections in relation to the defined UAS Scenarios Separation Provision Component Separation Provision (SP) is the tactical process of keeping aircraft away from other airspace users, obstacles, restricted airspace, etc. Depending upon the type of airspace and, where applicable the Air Traffic Control (ATC) service being provided, separation provision can be performed either by ATC (as regards separation assurance from other aircraft/airspace by at least an appropriate separation minimum) or by the UAV Pilot, dependent on the class of Airspace, the type of ATC service provided or the flight rules in force. Separation minima are defined for application by ATC in accordance with the airspace classification and the flight rules of each individual aircraft concerned. Manned operations where the UAV Pilot is responsible for SP generally have no specified minima, although the overarching rules of the air apply as the basic requirements. However, the MIL UAV specifications [8] have defined minima for unmanned operations whilst the UAV Pilot is responsible for SP. Scenario 1 - ATC is responsible for providing Separation Provision between the UAS and other airspace users. The SP Monitoring and Instruction functions are provided by an Air Traffic Controller. The pilot is wholly responsible for ensuring the UAV Trajectory Compliance function of SP. The pilot is also responsible for separation from obstacles and terrain. Scenario 2 the UAV Pilot is responsible for Separation Provision. The Separation Provision monitoring and instruction functions are performed by the UAV Pilot, whereas Trajectory Compliance is performed by the UAV Collision Avoidance Component The Collision Avoidance (CA) component is responsible for identifying when a potential collision threat is imminent, then identifying and implementing an avoidance action. The CA objective is to ensure that collision threats are avoided. The CA function acts irrespective of airspace classification, flight rules or who is responsible for SP. Scenario 1 - When Separation Provision is the responsibility of ATC, the CA is intended to act independently from the SP functions. In principle, the CA function should only act when SP has failed (i.e. there is a loss of separation) and then only to take collision avoidance action 1 if the actual distance is assessed as representing a collision risk. Equally, loss of separation assurance by ATC may not represent cause for initiation of a collision avoidance manoeuvre. The CA function is the responsibility of the UAV Pilot; however, the UAV Pilot may be supported by a CA system such as TCAS II 2. Note that ATC may still instigate collision avoidance action from a UAV Pilot but the responsibility remains with the UAV Pilot. Scenario 2 - When the UAV Pilot is responsible for SP then the independence between SP and CA functions is blurred as the pilot is effectively responsible for both. For manned operations the Closest Point of Approach (CPA) and 1 There are scenarios where the time needed to identify, resolve and take avoiding action is such that separation minima may not yet have been breached. 2 As a rule TCAS II Resolution Advisories take precedence over ATC instructions. Page 14 of 74

15 Functional Hazard Assessment (FHA) separation minima are effectively the same, as minima are not usually specified. NOTE: The impact of this on mixed UAS and manned operations needs to be further assessed within the PSSA. If found to be problematic a safety issue will be raised. In relation to Scenario 1 SRC Policy Document [9] states that Collision Avoidance systems (referred to as Safety Nets) are not part of Separation Provision so must not be included in determining the acceptable level of safety required for Separation Provision. The SRC Policy Document statement implies that UAS must provide an equivalent level of interaction with the Separation Provision function as provided by Pilots. Furthermore the UAS Separation Provision System must maintain the level of safety (with respect to the scope of ESARR 4 [2]) without the need for a Safety Net. 3.4 Operational Perspectives Consideration of UAS operations in non-segregated airspace can be understood from a number of operational perspectives. Scenario 1 o Separation Provision ICAO Airspace Classifications are contained in ICAO Annex 11 Air Traffic Services [10]. Table 1 below shows the level of ATC service provided for each airspace classification. Class Type of Flight Separation provided Service provided Radio communication requirements ATC Clearance A IFR only All aircraft Air traffic control service Continuous twoway B IFR All aircraft Air traffic control service Continuous twoway VFR All aircraft Air traffic control service Continuous twoway Yes Yes Yes C IFR IFR from IFR IFR from VFR Air traffic control service Continuous twoway Yes VFR VFR from IFR 1) Air traffic control service for separation from IFR 2) VFR/VFR traffic information Continuous twoway Yes Table 1 Level of ATC Service Provided o Collision Avoidance is the UAV Pilots responsibility regardless of the airspace within which the UAV is operating. o ATS UAS Operational Flight Planning - it is required that a flight plan be filed to ATS for all Scenario 1 operations as they will be IFR in Class A, B or C airspace. Indication to ATC that the flight is unmanned will be through the use of specific UAS aircraft type designators. Page 15 of 74

16 Functional Hazard Assessment (FHA) Scenario 2 o Communications voice communications are required between the UAV Pilot and ATC. o Other airspace users will include manned IFR and VFR aircraft as well as other IFR UAV. o Separation Provision ICAO Airspace Classifications are contained in ICAO Annex 11 Air Traffic Services [10]. Table 2 below shows the level of ATC service provided for each airspace classification. Class Type of Flight Separation provided Service provided Radio communication requirements ATC Clearance C IFR IFR from IFR IFR from VFR Air traffic control service Continuous twoway Yes VFR VFR from IFR 1) Air traffic control service for separation from IFR 2) VFR/VFR traffic information D IFR IFR from IFR Air traffic control service including information about VFR flights (traffic avoidance on request) VFR Nil Traffic information between VFR and IFR (traffic avoidance on request) E IFR IFR from IFR Air traffic control service and traffic information about VFR flights VFR Nil Traffic information as far as practical Continuous twoway Continuous twoway Continuous twoway Continuous twoway No Yes Yes Yes Yes No F IFR IFR from IFR as far as practicable Air traffic advisory service; flight information service Continuous twoway No VFR Nil Flight information service No No G IFR Nil Flight information service Continuous twoway No VFR Nil Flight information service No No Table 2 Level of ATC Service Provided o Collision Avoidance is the UAV Pilots responsibility regardless of the airspace within which the UAV is operating. o ATS UAS Operational Flight Planning it may not be necessary that a flight plan be filed with an ATS unit for VLOS operations o Communications UAs under VLOS operation will communicate to all relevant parties through appropriate means according to the airspace classification. Page 16 of 74

17 Functional Hazard Assessment (FHA) 3.5 UAS Characteristics o Other Airspace Users may include many users, such as hot air balloons, gliders, micro lights or other manned VFR as well as other VLOS UAV. UAS encapsulates the Unmanned Air Vehicle (UAV) itself, the entirety of systems, people and procedures involved in the launch, control and recovery of the AV, including the ground station, the UAS crew, operational processes and flight crew procedures. To establish the potential differences in manned and unmanned operations, it is important to understand the specific characteristics of UAS that are potentially relevant to operations in non-segregated airspace. The UAS characteristics are depicted in Figure 4. A principle characteristic is that the means of UAV Control is functionally separate from the UAV. The UAV Pilot of the UAV will be remote from the UAV in a UAS Ground Control Station (GCS). The UAV Pilot maintains control of the UAV through a UAS Control System (UCS) and a UAS Control Link (UCL). This method of control is the same for Scenario 1 and Scenario 2. Figure 4 UAS Characteristics Model The key characteristics that can effect UAS operations are as follows: Conspicuity - the visibility of the UAV to other airspace users is an important component in the Collision Avoidance component as well as when Separation Provision is the responsibility of the UAV Pilot. This could be an issue for UAs that are smaller than manned aircraft, or UAs that present a poor signature for Primary Surveillance Radar. This may be especially relevant for Scenario 2 as the UAV will be operating under 2000ft and may be small. Automatic Operations One of the key characteristics of a UAS is the ability to operate under various conditions without human interaction. The necessity for human interaction, along with other factors such as safety, mission Page 17 of 74

18 Functional Hazard Assessment (FHA) complexity and environmental difficulty determines the level of automation that the UAS can achieve.. o Fully automatic A mode of operation of a UAS wherein the UAV is expected to accomplish its mission, within a defined scope, without human intervention. o Semi-automatic - A mode of operation of a UAS wherein the human operator and/or the UAS plan(s) and conduct(s) a mission and require various levels of human interaction. o Teleoperation - A mode of operation of a UAS wherein the human operator, using video feedback and/or other sensory feedback, either directly controls the actuators or assigns incremental goals, waypoints in mobility situations, on a continuous basis, from off the UAV and via a tethered or radio linked control device. In this mode, the UAS may take limited initiative in reaching the assigned incremental goals. o Remote control - A mode of operation of a UAS wherein the human operator, without benefit of video or other sensory feedback, directly controls the actuators of the UAS on a continuous basis, from off the vehicle and via a tethered or radio linked control device using visual line-of-sight cues. In this mode, the UAV takes no initiative and relies on continuous or nearly continuous input from the user. Airworthiness the Airworthiness Certification of a UAS is outside scope of this analysis. However, it is assumed within the analysis that UAS will be fitted with certified equipment equivalent to that for manned operation in the intended non-segregated airspace, unless otherwise specifically stated, i.e. the UAV will meet the defined minimum equipment requirements for the airspace and flight rules in force. Flight Performance the manoeuvrability of a UAV is important to understand. Currently, Air Traffic Controllers are required to understand flight performance characteristics of the types of aircraft that come under their control and provide separation provision instructions based on this understanding. This requirement for understanding will also need to apply to unmanned operations to ensure ATC instructions can be implemented. Flight performance is particularly important when understanding if an UAV could comply with an ATC Separation provision instruction or collision avoidance manoeuvre. 3.6 Scoping Statements The following scoping statements have been made to further support the safety assurance activity. Statements S0001 to S0007 were validated during the FHA workshop. Scope S0001 Scope S0002 The aim of the safety assessment is for seamless integration of UAS operations into the current European ATM system. Only single (not in formation) UAs in non-segregated airspace are considered. Page 18 of 74

19 Functional Hazard Assessment (FHA) Scope S0003 Scope S0004 Scope S0005 Payload is considered external to the UAS system from an ATM perspective and is therefore outside scope, except where the payload is used for separation provision/collision avoidance. All other unmanned airspace users intend to be seen; aircraft deliberately operating inconspicuously are outside scope. Only IFR En-Route operations in Classes A, B, or C airspace are considered (Scenario 1). Scope S0006 UAS operations by day and night are considered (Scenario 1) Scope S0007 Only day VFR operations are considered (Scenario 2). Scope S0008 Scope S0009 Scope S0010 Class G airspace above Classes A, B or C airspace are not considered (Scenario 2). Direct Radio and Visual Line of Sight only is the method for command and control (Scenario 2). ATC will not give specific trajectory instructions, but may stipulate airspace limitations, such as to remain below a specified level (Scenario 2). 3.7 Assumptions The following assumptions have also been made to further scope and support the safety assurance activity: Assumption A0001 Assumption A0002 Assumption A0003 Assumption A0004 Assumption A0005 Assumption A0006 Assumption A0007 Assumption A0008 Current equivalent manned operations are tolerably safe. A pilot is only ever in control of one single UAV. Airworthiness approval criteria are available and UAS have been approved by a competent authority. UAS operations comply with applicable ICAO standards, except where explicitly stated. Where an Air Traffic Control (ATC) service is offered to a UAS Pilot, that ATC service is assumed to be approved (designated) (Scenario 1 and Scenario 2). The UAV Pilot and associated Control Station are assumed to be co-located for the duration of UAV operations (Scenario 1). TCAS II Version 7 is not available for a UAV, as stated by ICAO, but may be in operation with other airspace users (Scenario 1). UAV operations are assumed to range in duration from a few hours to a number of days (Scenario 1). Page 19 of 74

20 Functional Hazard Assessment (FHA) Assumption A0009 Assumption A0011 UAV operations are assumed to range in duration from a few minutes up to the hours of available daylight (Scenario 2). UAV Launch and Recovery operations are assumed to take place from locations away from aerodromes/airports (Scenario 2). 3.8 Unmanned Aircraft System Models The following models have been constructed for each scenario based on the defined scope of the FHA for each of the operational perspectives of UAS: Flight Profiles captures all likely ATM environments and situations in which the UAS may be required to operate. Functional Models derived from the components defined within the ICAO Strategic Conflict Model Flight Profiles The flight profile model for each scenario aims to capture all phases of flight within the scope of analysis and likely ATM environments in which the UAS may be required to operate. Scenario 1 - Flight Profile Model is presented in Appendix B.1.1 and encapsulates IFR En-Route operations, crossing FIR boundaries, emergency operations and early descent. Scenario 2 - Flight Profile Model is presented in Appendix B.1.2 and encapsulates pre-flight planning, launch of the UAV, VFR operations, crossing FIR boundaries, approach, recovery and any post landing actions Functional Models The following functional models are presented within the appendices. The aim of these models is to identify the primary functions performed by each system functional element for each of the two scenarios. Scenario 1 Functional Model with ATC Responsible for Separation Provision is shown in Appendix B.2.1. Scenario 2 Functional Model with UAV Pilot Responsible for Separation Provision is shown in Appendix B.2.2. The functional models developed for UAS are based on Figure 3 High Level Functional Model in section 3.2, it should be noted that the primary ATM functions are the same for both the with-uas and without-uas operations. More detailed models identifying logical elements of the with-uas and without- UAS situations will be documented within the Preliminary System Safety Assessment (PSSA) Report. Page 20 of 74

21 Functional Hazard Assessment (FHA) 4 Function Hazard Assessment Results 4.1 Overview In order to establish the relative change in risk as a result of introducing UAS operations in non-segregated airspace, the initial step in the analysis was to identify the hazards at a common boundary point for the without-uas and with UAS for each of the two scenarios. It was then necessary to establish if these hazards were common the both situations and whether there were any news hazards in the with UAS situation. This was analysed for both scenarios. Previous work involving the safety assessment of Military UAV as Operational Air Traffic outside segregated Airspace [6] had identified a list of hazards that were common to both the without-uas and with-uas scenarios. Due to the experience of the UAS workshop facilitators, the similarities in the two projects and the knowledge of the workshop participants, the previous list of hazards was presented as a starting point. It was agreed that these hazards were considered to be applicable to military and civil operations. Therefore the previous list of hazards was reviewed and discussed during the UAS Workshop to identify if the hazards were still valid for the UAS safety assessment work and to identify any gaps. As a result a full functional failure analysis was conducted as part of the post workshop FHA activity as detailed below. 4.2 Hazard Identification Approach Each function depicted in the High Level Function Model (Figure 3 in section 3.2) was reviewed against a set of guidewords to ensure that the list of hazards captured all failure scenarios. Each guideword was applied to each function and considered in more detail, as shown in Appendix C. The functions considered are as listed below: Separation Provision 1. Separation Provision Instruction 2. Separation Provision Monitor 3. Trajectory Compliance Collision Avoidance 4. Observe 5. Resolve/Decide 6. Act Other Aircraft 7. Trajectory Compliance UAV Operator 8. Flight Planning Page 21 of 74

22 Functional Hazard Assessment (FHA) The functional failure guidewords applied to each of the above functions are listed below: Loss complete negation of an intention. No part of the intention is achieved and nothing else happens, i.e. ATC inability to provide separation provision. Error any action that is undesirable regardless of cause, e.g. incorrect response to ATC instruction, partial response to ATC instruction or unintentional actions. Intentional deviation a different action than that intended occurs as a result of an external input i.e. ATC instruction ignored (e.g. due to Traffic Collision Avoidance System (TCAS) Resolution Advisory (RA)). This is included to capture potential hazards associated with scenarios which are counter to the normal intention of the function but necessary, for example in a contingency of emergency situation. Too early an action occurs earlier than expected either relative to UTC, order or sequence. Too late an action occurs later than expected whether relative to UTC, order or sequence. Other (completeness check). The high level functional model presented in Figure 3 represents a closed loop control system, with the airspace as the element under control. By breaking the control loop at the point where the separation provision compliance function interfaces with the airspace it can be observed that: The primary control function is Separation Provision. Collision Avoidance can mitigate Separation Provision failure (although the Trajectory Compliance function is a potential for common cause failure). Collision Avoidance actions can interfere with Separation Provision. Based on this assessment the identification and analysis of hazards has focused on the Separation Provision Function. The Collision Avoidance functional failure scenarios are modelled either as mitigating the consequences of Separation Provision hazards or as potential causes of the Separation Provision hazards. It should also be noted that, for the purpose of the FHA, UAV failures subsequent to link loss are modelled as UAV Pilot hazards on the basis that the UAV Pilot is responsible for defining the contingency action. The following high-level hazards were identified as a direct result of the functional failure analysis of the Separation Provision function as outlined in detail in Appendix C. All identified hazards are common to both the with-uas and without-uas situation: Loss of Separation Provision. Error in Separation Provision. Delayed Separation Provision. Page 22 of 74

23 Functional Hazard Assessment (FHA) Intentional Deviation from Separation Provision Instruction. From the four high-level hazards identified, the Fault Trees in Appendix D show how the functional failure scenarios identified from applying the guidewords relate to the identification of the ten sub-hazards identified in the UAS Safety Assessment workshop. The Fault Trees have thus been drawn for the purpose of showing this linking only; more specific, detailed FTAs have produced to support the causal analysis in the Preliminary System Safety Assessment (PSSA). Each of the hazards identified at the workshop were initially taken and developed within the first issue of the Functional Hazard Assessment (FHA) Report. The hazards have subsequently been re-worked as a result of the initial Preliminary System Safety Assessment (PSSA) activity which has been fed back into the document. Each of the identified hazards has been grouped with one of the high-level hazards outlined above in Table 3 below. UAS Workshop Hazard No. Loss of Separation Provision HAZ001 HAZ005 HAZ007 Separation Provision error HAZ002 HAZ006 HAZ008 HAZ010 Delayed Separation Provision HAZ004 HAZ009 UAS Workshop Hazard Title Air Vehicle does not comply with separation provision instruction from ATC Loss of separation provision from ATC Loss of separation provision from Pilot Air Vehicle incorrectly responds to separation provision instruction from ATC ATC separation provision error Pilot separation provision error Separation Provision Minima is breached by other aircraft Delayed response to separation provision instruction from ATC Pilot separation provision too late Intentional Deviation from Separation Provision Instruction HAZ Hazard Identification Results Excessive number of intentional deviations from separation provision instruction Table 3 Hazard Identification The functional failure analysis confirmed the conclusion of the UAS Safety Assessment workshop that UAS operations for Scenario 1 and Scenario 2 do not introduce any new hazards at the ATM concept level. The assessment also concluded that the resultant hazards are not all applicable to both scenarios hence the workshop agreed the following scenario assignments. Scenario 1 o HAZ001 - Air Vehicle does not comply with separation provision instruction from ATC Page 23 of 74

24 Functional Hazard Assessment (FHA) Scenario 2 This hazard addresses scenarios where the aircraft, for whatever reason, is unable to comply with a separation provision instruction received from air traffic control. o HAZ002 - Air Vehicle incorrectly responds to separation provision instruction from ATC This hazard addresses scenarios where a separation provision instruction received from air traffic control is implemented incorrectly, therefore the aircraft responds in a way not anticipated by air traffic control. o HAZ003 - Excessive number of intentional deviations from separation provision instruction This hazard addresses scenarios where the Pilot is not able to implement separation provision instructions due to overriding conditions and informs air traffic control of the deviation. This hazard covers deviations on a sufficiently frequent basis to significantly impact the air traffic controllers workload. o HAZ004 - Delayed response to separation provision instruction from ATC This hazard addresses scenarios where a response to a separation provision instruction received from air traffic control is delayed in such a manner as to increase air traffic controllers workload. It should be noted that long delays, i.e. in excess of a defined number of seconds, are treated as does not comply under HAZ001. o HAZ005 - Loss of separation provision from ATC This hazard addresses scenarios where separation provision instructions are no longer being provided from air traffic control, specifically to the Pilot. Loss of air traffic control to all air traffic is not addressed within this hazard, as it is assumed that under this situation the Pilot will follow standard procedures in the event of lost communications. o HAZ006 - ATC separation provision error This hazard addresses scenarios where air traffic control provides incorrect separation provision instructions to the Pilot. This hazard is analysed to understand the potential UAS causes as ATC causes are assumed to be common to both the with-uas and without-uas situations. o HAZ001 to HAZ006 These hazards were also considered to be applicable to Scenario 2 only in so far as there are certain circumstances e.g. where an initial ATC clearance is required or a temporary operating area is defined by ATC that require consideration. It should be noted that causes were only Page 24 of 74

25 Functional Hazard Assessment (FHA) 4.4 Consequence Analysis found for HAZ006 on the basis of scoping statement S0008 (see Fault Tree Analysis, Appendix D.2.2.1) o HAZ007 Loss of separation provision from the Pilot This hazard addresses the scenario where the Pilot has not provided or is unable to provide a separation provision instruction to the Air Vehicle. o HAZ008 Pilot separation provision error This hazard addresses the scenario where the Pilot issues a separation provision instruction containing an error to the Air Vehicle. o HAZ009 Pilot separation provision instruction too late This hazard addresses the scenario where the Pilot provides a separation instruction to the Air Vehicle too late. o HAZ010 - Separation Provision Minima is breached by other aircraft This hazard addresses the scenario where separation provision minima are reduced due to the actions of other aircraft. The next step in the analysis is to assess the consequences associated with each hazard for both in without-uas and with UAS situations for both scenarios. The relative impact of the change was then assessed with respect to risk. The FHA considered the consequence of hazards associated with UAS operation in nonsegregated airspace. The consequence analysis was conducted to the point where there is the potential for an accident. The columns in the event tree are defined as follows: First Column Initiating Hazard. Middle Columns potential mitigations that would prevent the hazard resulting in an end consequence. Last Column the end consequence. A number of mitigations within the event trees are generic to all hazards; these are highlighted in the appropriate place. Given the requirement to present a relative qualitative safety argument for UAS operations in non-segregated airspace and the justification for an improved level of risk reduction than the current without-uas situation, the table in Appendix C presents a qualitative severity classification scheme applicable for this safety analysis. The scheme is based on ESARR 4 [2] for ATM and JAR [11] for aircraft related consequences. Page 25 of 74

26 Functional Hazard Assessment (FHA) Mitigations for HAZ001 The event tree for HAZ001 (Air Vehicle does not comply with Separation Provision Instruction from ATC) is shown in Appendix F.1, Figure 5. The mitigations for this hazard are explained in Table 4 below. The descriptions provided within the following tables are based on the output from the UAS Safety Assessment Workshop. The FHA workshop also identified a Pilot mitigation for this hazard and HAZ002 and HAZ004; Pilot notices error. This was removed from the Event Tree as some of the causes identified in the Functional Failure Analysis (FFA) would negate this mitigation. The Pilot mitigation has been remodelled in the FTA as part of the PSSA activity. Note that whilst Air Traffic Control may be involved with UAS operations within Scenario 2, it is unlikely this will be the case as the UAV will be flown under VLOS operation. Event Tree Mitigation Description Scenario 1 ATC notices incorrect response from aircraft ATC amends separation provision instruction for other traffic An Air Traffic Controller may be able to identify an aircraft that has failed to comply with a separation provision instruction. If the Air Traffic Controller is made aware, or notices, the Pilot s inability to comply with a separation provision instruction, it was considered very likely that ATC would provide an amended instruction or attempt to reinforce the instruction. This could be to either that specific aircraft, or dependent upon the circumstances, i.e. an inability to control the aircraft, provide appropriate instructions to surrounding aircraft. The likelihood in the ability of an Air Traffic Controller to identify that an aircraft has failed to comply with a separation provision instruction will remain the same for without-uas and with-uas situations. Although Air Traffic Controllers in the future may be provided with information to enable them to distinguish between manned and unmanned aircraft, this should not change their ability to provide separation provision. There is no change in the likelihood for either without-uas or with-uas situations for this mitigation. Generic Mitigations applicable to all hazards without-uas and with-uas Other aircraft in vicinity takes avoiding action Once all the mitigations listed above have failed, and assuming worst case that there is another aircraft in close vicinity, the immediate mitigation is that the other aircraft takes avoiding action. It should be noted that the use of remote observers was discussed but it was decided that the use of a remote observer was a possible variant in scenario 2 and not considered as a mitigation, therefore is not included in the consequence analysis. It was considered that there will be little or no change in the likelihood of another aircraft taking avoiding action for the without-uas to the with-uas situation. However, this may depend on the conspicuity of the UAV itself in the with- UAS situation and wither the other aircraft is able to move at speed to avoid the UAV. Page 26 of 74

27 Functional Hazard Assessment (FHA) Event Tree Mitigation Description Scenario 1 Collision Avoidance (CA) operates correctly The CA function is not provided (whether with-uas or without-uas when it is required. This mitigation is stated in the negative as it is the top gate of the corresponding Fault Tree. Ideally CA should function in all scenarios, however in reality there are limitations on any CA system in terms of how many CA scenarios can be detected e.g. TCAS when fully working will not resolve all CA correctly and sometimes may indeed create an accident situation which may not have previously existed. As part of the success case argument the conditions under which CA is required to operate must be defined, this will be drawn out further within the Preliminary Safety Case. Collision Avoidance Systems - See Fault Tree analysis in Appendix D Mitigations for HAZ002 Table 4 HAZ001 Event Tree Mitigations The event tree for HAZ002 (Air Vehicle incorrectly responds to Separation Provision Instruction from ATC) is presented in Appendix F.2, Figure 6. The mitigations for this hazard are explained in Table 5. Event Tree Mitigation Description Scenario 1 Pilot recognises and informs ATC of incorrect response ATC notices incorrect response from aircraft The Pilot should notice that the air vehicle has responded incorrectly to a separation provision instruction and inform ATC directly. An Air Traffic Controller may be able to identify an incorrect response from an aircraft to a separation provision instruction. Although Air Traffic Controllers in the future may be provided with information to enable them to distinguish between manned and unmanned aircraft, this should not change their ability to provide separation provision. There is no change in the likelihood for either without-uas or with-uas situations for this mitigation as the pilot of a manned aircraft and UAV Pilot would always monitor closely the aircrafts trajectory. The likelihood in the ability of an Air Traffic Controller to identify that an aircraft has incorrectly complied with a separation provision instruction will remain the same for without-uas and with-uas situations. Page 27 of 74

28 Functional Hazard Assessment (FHA) Event Tree Mitigation Description Scenario 1 ATC verifies situation with Pilot If the Air Traffic Controller is made aware, or notices, the Pilot s incorrect compliance with a separation provision instruction, it is very likely that ATC would query the Pilots response and provide an amended instruction. There is no change in the likelihood for either without-uas or with-uas situations for this mitigation. Other Aircraft and Collision Avoidance mitigations as per HAZ Mitigations for HAZ003 Table 5 HAZ003 Event Tree Mitigations The event tree for HAZ003 (Excessive number of intentional deviations from Separation Provision Instruction) is presented in Appendix F.3, Figure 7. The mitigations for this hazard are explained in Table 6. Event Tree Mitigation Description Scenario 1 Pilot informs ATC of intentional deviation from instruction ATC notices aircraft deviation from separation provision instruction ATC verifies situation with Pilot and resolves other conflicts In either the without-uas or with-uas situation, if a Pilot intentionally deviated from a separation provision instruction it was considered highly likely that he will communicate this to ATC as soon as possible. This mitigation was thought to have a very high likelihood given that procedures state, specifically for collision avoidance manoeuvres that are contradictory to an ATC separation provision instructions, that a Pilot informs ATC as soon as possible. An Air Traffic Controller may query the deviation from an instruction, but may also assume that the instruction will be followed and focus attention elsewhere. If the Air Traffic Controller is made aware, or notices, the intentional deviation from a separation provision instruction, it is very likely that ATC would query the Pilot s response and provide an amended instruction. It was considered potentially more likely that a UAV Pilot would communicate an intentional deviation from an instruction quicker than for a manned aircraft. It is assumed that all intentional deviations are for genuine reasons, e.g. weather avoidance and not due to malicious actions. The likelihood in the ability of an Air Traffic Controller to identify that an aircraft has intentionally deviated from a separation provision instruction will remain the same for the without-uas and with-uas situation. There is no change in the likelihood for either without-uas or with-uas situations for this mitigation. Page 28 of 74

29 Functional Hazard Assessment (FHA) Event Tree Mitigation Description Scenario 1 Other Aircraft and Collision Avoidance mitigations as per HAZ Mitigations for HAZ004 Table 6 HAZ003 Event Tree Mitigations The event tree for HAZ004 (Delayed response to Separation Provision Instruction from ATC) is presented in Appendix F.4, Figure 8. The mitigations for this hazard are explained in Table 7. Event Tree Mitigation Description Scenario 1 Pilot informs ATC of delayed response ATC notices delayed response to instruction ATC verifies situation with Pilot and resolves Pilot will inform ATC if they notice a delayed response to an instruction from the aircraft. It is possible that an Air Traffic Controller may notice a delayed response from an aircraft to a separation provision instruction. If the Air Traffic Controller is made aware, or notices, the Pilot s delayed response and understands the reasons for it, it was considered very likely that ATC would either provide an amended instruction or manoeuvre other aircraft accordingly. There is no change in the likelihood for either without-uas or with-uas situations for this mitigation. The likelihood in the ability of an Air Traffic Controller to identify that an aircraft has a delayed response to a separation provision instruction will remain the same for the without-uas and with-uas situation. An Air Traffic Controller may query that there is no initial response to his instruction. There is no change in the likelihood for either without-uas or with-uas situations for this mitigation Other Aircraft and Collision Avoidance mitigations as per HAZ Mitigations for HAZ005 Table 7 HAZ004 Event Tree Mitigations The event tree for HAZ005 (Loss of Separation Provision from ATC) is presented in Appendix F.5, Figure 9. The mitigations for this hazard are explained in Table 8. Page 29 of 74

30 Functional Hazard Assessment (FHA) Event Tree Mitigation Description Scenario 1 Pilot notices loss of separation provision from ATC Pilot contacts ATC via other means Pilot follows lost communications procedure A Pilot may be able to notice the loss of separation provision from Air Traffic Control and will initially attempt to contact Air Traffic Control and if this is not possible will instigate lost communication procedures. A Pilot may be able to contact ATC via an alternative means i.e. relaying voice communications via other aircraft Once all communication has been lost with ATC pilots are trained in following standard ICAO lost communications procedures The likelihood in the ability of the UAV Pilot to notice the loss of separation provision will remain the same for the without-uas and with-uas situation. The likelihood of a UAS following lost communication procedures is more likely than for manned aircraft. However, loss of communication with Air Traffic Control was considered less significant for the with-uas situation due to the additional communication systems potentially available to a pilot of a UAS. The likelihood in the ability of the UAV Pilot to contact ATC via an alternative means will remain the same for the without-uas and with-uas situation as this forms part of standard lost communications procedures. The likelihood in the ability of the UAV Pilot to follow standard lost communications procedures will remain the same for the without-uas and with-uas situation. Other Aircraft and Collision Avoidance mitigations as per HAZ Mitigations for HAZ006 Table 8 HAZ005 Event Tree Mitigations The event tree for HAZ006 (ATC Separation Provision Error) is presented in Appendix F.6,Figure 10. The mitigations for this hazard are explained in Table 9. Event Tree Mitigation Description Scenario 1 Scenario 2 ATC separation provision instruction error noticed by pilot UAV Pilot may notice an error in a separation provision instruction from ATC The likelihood of a UAV Pilot noticing a separation provision instruction error from ATC was considered to be no different for the without-uas and with- UAS situation. The likelihood of a UAV Pilot noticing a separation provision instruction error from ATC was considered to be no different for the without-uas and with- UAS situation. ATC amends separation provision instruction for other aircraft and executes If the Air Traffic Controller is made aware, or notices, an error with a separation provision instruction, it was considered very likely that ATC would provide an amended instruction. The likelihood in the ability of an Air Traffic Controller to identify an error in the separation provision instruction provided to a UAV Pilot is considered to be no different for the without- UAS to with-uas situation. Air Traffic Control are less likely to be involved, however the likelihood in the ability of an Air Traffic Controller to identify an error in the separation provision instruction provided to a UAV Pilot is considered to be no different for the without- UAS to with-uas situation. Page 30 of 74

31 Functional Hazard Assessment (FHA) Event Tree Mitigation Description Scenario 1 Scenario 2 Other Aircraft and Collision Avoidance mitigations as per HAZ Mitigations for HAZ007 Table 9 HAZ006 Event Tree Mitigations Mitigations for HAZ007 (Loss of Separation Provision from the Pilot) are only applicable to Scenario 2 due to the Pilot being responsible for his own Separation Provision as the Air Vehicle is under VLOS operation. The event tree for HAZ007 is presented in Appendix F.7,Figure 11. The mitigations for this hazard are explained in Table 10. Event Tree Mitigation Description Scenario 2 Pilot recovers loss Pilot amends separation provision instruction and executes Where a Pilot is responsible for providing his own separation provision, he may identify a loss of separation whether a result of Pilot error or Air Vehicle failure. Once the Pilot notices a loss in separation provision, it is was considered very likely that he would revise and execute a new instruction as soon as possible. Where a UAV Pilot is responsible for providing his own separation provision, the likelihood of him realising an action or UAV failure has resulted in a loss of separation was considered to be very low. This is because it may be difficult for a UAV Pilot on the ground to correctly identify the distance and trajectory of a nearby aircraft depending on where the UAV Pilot is located. The likelihood for this mitigation was considered no different for the without- UAS to the with-uas situation. Other Aircraft and Collision Avoidance mitigations as per HAZ001 (Scenario 2) Mitigations for HAZ008 Table 10 HAZ007 Event Tree Mitigations Mitigations for HAZ008 (Pilot Separation Provision Error) are only applicable to Scenario 2 due to the Pilot being responsible for his own Separation Provision as the Air Vehicle is under VLOS operation. The event tree for HAZ008 is presented in Appendix F.8, Figure 12. The mitigations for this hazard are explained in Table 11. Event Tree Mitigation Description Scenario 2 Pilot notices error in separation provision Where a Pilot is responsible for providing his own separation provision, he may identify an error in separation provision. Where a UAV Pilot is responsible for providing his own separation provision, the likelihood of him noticing an error in a separation provision instruction was considered to be very low. Page 31 of 74

32 Functional Hazard Assessment (FHA) Event Tree Mitigation Description Scenario 2 Pilot amends separation provision instruction and executes Once the Pilot notices an error in a separation provision instruction, it was considered very likely that he would rectify this through a revised instruction and execute this as soon as possible. The likelihood for this mitigation was considered no different for the without- UAS to the with-uas situation. Other Aircraft and Collision Avoidance mitigations as per HAZ001 (Scenario 2) Mitigations for HAZ009 Table 11 HAZ008 Event Tree Mitigations Mitigations for HAZ009 (Pilot Separation Provision Instruction too late) are only applicable to Scenario 2 due to the Pilot being responsible for his own Separation Provision as the Air Vehicle is under VLOS operation. The event tree for HAZ009 is presented in Appendix F.9, Figure 13. The mitigations for this hazard are explained in Table 12. Event Tree Mitigation Description Scenario 2 Other Aircraft and Collision Avoidance mitigations as per HAZ001 (Scenario 2) Mitigations for HAZ010 Table 12 HAZ009 Event Tree Mitigations Mitigations for HAZ010 (Separation Provision Minima is breached by Other Aircraft) are only applicable to Scenario 2 due to the Pilot being responsible for his own separation provision as the Air Vehicle is under VLOS operation. The event tree for HAZ010 is presented in Appendix F.10, Figure 14. The mitigations for this hazard are explained in Table 13. Event Tree Mitigation Description Scenario 2 Pilot amends separation provision instruction and executes If the Pilot is made aware, or notices, a loss in separation provision, it was considered very likely that the Pilot would provide an amended instruction to the Air Vehicle. There is no change in the likelihood for either without-uas or with-uas situations fort this mitigation but it should be noted that it may be difficult for a UAV Pilot on the ground to correctly identify the distance and trajectory of a nearby aircraft depending on where the UAV Pilot is located. Other Aircraft and Collision Avoidance mitigations as per HAZ001 (Scenario 2) 4.5 Analysis Conclusions Table 13 HAZ010 Event Tree Mitigations The consequence analysis identified a series of mitigations for each of the hazards assigned to Scenario 1 and Scenario 2. The mitigations are essentially the same for Page 32 of 74

33 Functional Hazard Assessment (FHA) the with-uas and without-uas situations however; there are specific areas where UAS operations have the potential to affect the probability of success of some specific mitigations, such as: The UAV Pilot in Scenario 1 is likely to identify situational awareness issues more easily or quickly based on the additional potential range of information available to them. The UAV Pilot in Scenario 1 may have more communication equipment at hand to verify potential issues with ATC. The capability, performance and integrity of the CA function in Scenario 1 is likely to be greater than in Scenario 2 given the UAV Pilot s relative position to the UAV under VLOS and the potential lack of automated support systems. This will be assessed further as part of the PSSA activity. The analysis also identified that there are some common failure scenarios between the causes of some hazards and the effectiveness of some mitigations, in particular for collision avoidance. For example, aircraft height keeping and navigational equipment is essential to separation provision and collision avoidance and failure of these would be common to both. These common failure scenarios will be addressed as part of the PSSA activity. 4.6 Safety Objectives The purpose of the FHA is to identify a set of high level hazards and derive the associated safety objectives, such that, if satisfied, an acceptable level of safety can be demonstrated. The safety objectives are derived from the safety criteria, which in this case are relative, i.e. not based on an absolute Target Level of Safety (TLS). Given that the analysis has not identified any unique hazards for UAS operations, the safety objective set out below is based on ensuring that the safety criteria (as stated in section 1.4) are achieved, i.e. the risk from UAS operations is: No higher than for equivalent manned operations; and Reduced to As Far As Reasonably Practicable (AFARP), as required by ESARR 3 [3] and European Air Traffic Management Programme (EATMP) Safety Policy [4]. For the criteria to be met the occurrence rate for each hazard must be no greater for UAS operations (in Scenario 1 or Scenario 2) than for manned operations 3. In both cases where practicable the risk from UAS operations should be further reduced. The potential for and feasibility of further risk reduction for each UAS hazard will be considered as part of the PSSA. 3 Since there is no direct equivalent to VLOS operations in manned operations then the occurrence rate must be equivalent to VFR operations in Class G airspace. Page 33 of 74

34 Functional Hazard Assessment (FHA) 5 Conclusions The Functional Hazard Assessment activity has identified ten hazards that fall within the defined scope of the safety analysis. Six hazards apply to Scenario 1 and ten hazards to Scenario 2. The UAS hazards are defined at the boundary of UAS Operations and reflect functional failure scenarios that could potentially lead to hazardous situations. All ten hazards are common to the with-uas and without- UAS situations. The analysis has been performed based on the output of the UAS Safety Assessment Workshop held at EUROCONTROL HQ, Brussels, and is bound by a number of scoping statements and assumptions as detailed in sections 3.6 and 3.7. The results of the Functional Hazard Assessment enable an understanding of the risks associated with the operation of UAS in non-segregated airspace via the derivation of the hazards identified and analysis of the consequences of those hazards. The output of this report and further analysis will enable a separate PSSA Report to be produced that will document the safety requirements and provide traceability to detailed safety requirements. Page 34 of 74

35 Functional Hazard Assessment (FHA) 6 References No Reference Document Title Issue/Date [1] SAF.ETI.ST MAN-01 Air Navigation System Safety Assessment Methodology Edition: October 2006 [2] ESARR4 Risk Assessment and Mitigation in ATM Edition: April 2001 [3] ESARR3 ESARR3: Use of Safety Management Systems by ATM Service Providers Edition: July 2000 [4] SAF.ETI.ST POL EATMP Safety Policy Edition: August 1999 [5] P UAS Safety Assessment Workshop Minutes Edition May 2009 [6] P Functional Hazard Assessment/Preliminary System Safety Assessment (FHA/PSSA) Report for Military UAV as OAT outside Segregated Airspace [7] AN-Conf/11-WP/4 Appendix A to ATM Operational Concept Document Edition August 2003 September 2003 [8] EUROCONTROL- SPEC-0102 EUROCONTROL Specifications For The Use For Military Unmanned Aerial Vehicles As Operational Air Traffic Outside Segregated Airspace Edition July 2007 [9] SRC POL DOC 2 SRC Policy Document 2: Use of Safety Nets in Risk Assessment and Mitigation in ATM Edition April 2002 [10] ICAO Annex 11 Air Traffic Services Edition: 11 [11] JAA JAR Classification of Airborne Equipment Failures - Date: July 1997 [12] ICAO Annex 2 Rules of the Air Amendment 42 Date: July 2009 Table 14 Table of References Page 35 of 74

36 Functional Hazard Assessment (FHA) Appendix A UAS Safety Assessment Workshop Agenda and Participants A.1 UAS Workshop Agenda Agenda: Location: Time: UAS Safety Assessment Workshop EUROCONTROL HQ, Brussels, Pegase (29th April) & Jupiter (30th April) Wednesday 29th April to Thursday 30th April ADENDA 1. Introductions and Logistics a. Ebeni Team b. UAS Safety Assessment Workshop Participants 2. Overview of the UAS Safety Assessment Workshop a. Objectives b. Scope c. Technical Approach Summary 3. Review of UAS Scenarios 4. Review of UAS Functional and Logical Architecture Models 5. Identification of hazards 6. What If Analysis 7. Consequence Analysis 8. Discussion 9. Questions/AOB Page 36 of 74

37 Functional Hazard Assessment (FHA) A.2 UAS Workshop Participants Name Title/Role Organisation Contact Details Michael Strong ATM Expert EUROCONTROL Jean-Michel De Rede (29th only) Safety Expert EUROCONTROL Andrew Jones ATM Expert Thales Aerospace com Hans Brants Project Manager/Flight Instruction National Aerospace Lab (NLR) Mike Wildin ATM Expert EUROCONTROL Andy Edmunds ATM Expert NATS, UK Don Harris ATM Expert EUROCONTROL Michael Haim (29th only) Navigator SHAPE Marc Deboeck Senior ATM Safety Expert EUROCONTROL, DG/SRU Tony Henley Product Manager BAE Systems Alan Simpson Safety Engineer Ebeni Limited Jo Stoker Safety Engineer Ebeni Limited Hayley Burdett Safety Engineer Ebeni Limited Page 37 of 74

38 Appendix B B.1 B.1.1 Functional Hazard Assessment (FHA) Unmanned Aircraft System Models Flight Profiles Flight Profile: Scenario 1 Page 38 of 74

39 B.1.2 Functional Hazard Assessment (FHA) Flight Profile : Scenario 2 Page 39 of 74

40 B.2 Functional Hazard Assessment (FHA) Functional Models B.2.1 Functional Model: Scenario 1 B.2.2 Functional Model: Scenario 2 Page 40 of 74

41 Functional Hazard Assessment (FHA) Appendix C Functional Failure Analysis Ref Function Guideword Scenario 1 Impact Hazard Scenario 2 Impact Hazard 1.1 Separation Provision Instruction Loss Pilot no longer receives ATC Instruction. This is a hazard if the Pilot fails to revert to lost communications procedure and follows agreed contingency plan HAZ005 ATC: In certain circumstances it may be necessary to receive an ATC instruction to proceed. This would be a hazard if the UAV Pilot commences operation without an ATC clearance HAZ008 UAV Pilot: UAV Pilot no longer gives separation instruction to the aircraft, e.g. loss of situational awareness, pilot error etc. This is a hazard if the aircraft has no safe contingency plan in the event of VLOS control failure HAZ007 ATC: Pilot given incorrect instruction regarding clearance. HAZ006 UAV Pilot: UAV Pilot issues a separation provision instruction to the aircraft containing an error HAZ008 UAV makes intentional deviation from separation provision instruction provided by UAV Pilot, e.g. override event (terrain avoidance) or emergency HAZ Error Intentional Deviation Pilot given incorrect instruction regarding separation, e.g. wrong course change, invalid permission to approach, danger area open, etc. HAZ006 UAV Pilot makes intentional deviation from separation provision instruction provided by ATC, e.g. weather avoidance, emergency alerts, etc. This is a potential hazard if the subsequent action is not coordinated with ATC HAZ003 Page 41 of 74

42 Ref Function Guideword Scenario 1 Impact Hazard Scenario 2 Impact Hazard Too Early Pilot is given instruction too early leading to the aircraft being in the wrong position at a particular time, e.g. pilot is told to climb too early and separation is reduced HAZ006 ATC: as 1.2 above HAZ006 UAV Pilot: UAV is given instruction too early from UAV Pilot, leading to the UAV being in the wrong position at a particular time, e.g. UAV is told to climb too early and separation is reduced HAZ008 Pilot is given separation provision instruction from ATC too late leading to the aircraft being in the wrong position at a particular time, e.g. pilot is told to climb too late and separation is reduced HAZ006 ATC: as 1.2 above HAZ006 UAV Pilot: UAV Pilot provides instruction too late leading to the aircraft being in the wrong position at a particular time HAZ009 Separation is not monitored, potentially increasing probability of a loss of or incorrect separation provision instruction from ATC. Also undermines the ability of the ATC to mitigate certain ATC hazards HAZ005 ATC: Assumed that ATC will still be able to provide correct clearance None UAV Pilot: Pilot loses situational awareness and is unable to correctly control the UAV in relation to other aircraft HAZ007 Separation is incorrectly monitored leading to incorrect separation provision instruction from ATC HAZ006 ATC: as 1.2 above HAZ006 UAV Pilot: Pilot has an incorrect situational awareness and may give an incorrect separation provision instruction to the UAV HAZ008 Too Late Separation Provision Monitor Functional Hazard Assessment (FHA) Loss Error 2.3 Intentional Deviation Not applicable None Not applicable None 2.4 Too Early Not valid None Not valid None Page 42 of 74

43 Ref Function Trajectory Compliance Functional Hazard Assessment (FHA) Guideword Scenario 1 Impact Hazard Scenario 2 Impact Hazard Too Late As 2.2, Separation provision is monitored too late, leading to the wrong UAV Pilotture of air traffic and a delayed or incorrect separation instruction from ATC HAZ006 ATC: as 1.2 above HAZ006 UAV Pilot: Pilot not paying attention to situational awareness and may give an incorrect separation provision instruction to the UAV HAZ008 UAV Pilot or UAV is unable to comply with separation provision instruction from ATC, e.g. due to system performance limitations, aircraft equipment failure, etc. this is a hazard if UAV Pilot is unable to coordinate loss with ATC HAZ001 UAV Pilot responds incorrectly to separation provision instruction from ATC, e.g. pilot error, incorrect read back, equipment failure, etc. HAZ002 If the UAV does not respond correctly then is a hazard if the UAV Pilot is unable to coordinate with ATC HAZ001 UAV Pilot makes intentional deviation from separation provision instruction provided by ATC, e.g. weather avoidance, emergency alerts, etc. Is a hazard if UAV Pilot is unable to coordinate loss with ATC HAZ003 Loss Error Intentional Deviation ATC: The scenario is based on ATC not providing specific trajectory instructions (see Scope S008). However, ATC may stipulate airspace limitations (e.g. stay below 2000 ft) UAV Pilot: UAV is unable to comply with separation provision instruction from UAV Pilot, e.g. due to critical equipment failure, etc. HAZ007 ATC: as 3.1 UAV Pilot: UAV responds incorrectly to separation provision instruction from UAV Pilot, e.g. pilot error, equipment failure, etc HAZ008 ATC: as 3.1 UAV Pilot: UAV makes intentional deviation from separation provision instruction provided by UAV Pilot, e.g. terrain avoidance, emergency alerts, etc HAZ008 Page 43 of 74

44 Ref Function Guideword Scenario 1 Impact Hazard Scenario 2 Impact Too Early UAV Pilot carries out separation provision instruction too early leading to an incorrect response HAZ002 ATC: as 3.1 The UAV may perform a manoeuvre out of sequence; this is a hazard if the UAV Pilot is unable to coordinate with ATC HAZ001 UAV Pilot: UAV carries out separation provision instruction too early leading to an incorrect response (depends on how instructions are given to UAV, not credible where instructions are live) UAV Pilot delayed response to a separation provision instruction, e.g. communication link latency, pilot input delayed, etc HAZ004 ATC: as 3.1 Loss No observation of air traffic takes place therefore no collision threats are detected so CA inoperative CA will not act when required Error An error is made when observing other traffic leading to either: Too Late Observe Functional Hazard Assessment (FHA) Intentional Deviation Missing a collision threat, hence CA does not act CA does not act when required False identification of a collision threat hence the CA may activate when not required Cause of HAZ004 if UAV Pilot unaware otherwise HAZ003 CA may not be able to detect certain threats due to limitations of sensors or due to characteristics of threat (e.g. inconspicuous) CA does not act when required Hazard HAZ008 UAV Pilot: UAV delayed response to a separation provision instruction, e.g. communication link latency, pilot input delayed, etc HAZ009 UAV Pilot: UAV Pilot fails to monitor for collision threats so CA not performed CA does not act when required UAV Pilot: UAV Pilot misjudges collision threats so CA not performed correctly CA acts incorrectly Not applicable N/A Page 44 of 74

45 Ref Guideword Scenario 1 Impact Hazard Scenario 2 Impact Hazard 4.4 Too Early Not a hazard but early CA activation may be construed a nuisance. Excessive occurrence of nuisance events may result in ATC workload issues None Not applicable N/A 4.5 Too Late Impact the same as Loss (4.1 above) CA does not act when required Impact the same as Loss (4.1 above) Loss of CA mitigation Loss No decision on collision avoidance is made or no CA resolution is possible CA will not act when required UAV Pilot: UAV Pilot unable to determine collision avoidance action so CA not performed CA does not act when required Error An error is made when deciding what collision avoidance action is necessary, either UAV Pilot: UAV Pilot misjudges collision resolution so CA not performed correctly CA acts incorrectly Function Functional Hazard Assessment (FHA) Resolve/ Decide Wrong avoidance action decided for a collision threat, hence CA does acts incorrectly CA acts incorrectly False identification of a CA action hence the CA may activate when not required Cause of HAZ004 if UAV Pilot unaware otherwise HAZ Intentional Deviation Not applicable N/A Not applicable N/A 5.4 Too Early As 4.4 None Not applicable N/A Page 45 of 74

46 Ref Function Functional Hazard Assessment (FHA) Guideword Scenario 1 Impact Hazard Scenario 2 Impact Hazard Too Late Collision avoidance decision is taken too late CA does not act when required UAV Pilot: Collision avoidance decision is taken too late CA does not act when required Loss UAV Pilot or UAV does not execute collision avoidance manoeuvre CA action ignored UAV Pilot: UAV does not execute collision avoidance manoeuvre from UAV Pilot CA does not act when required 6.2 Error UAV Pilot or UAV makes an error when executing collision avoidance manoeuvre CA acts incorrectly UAV Pilot: UAV does not execute collision avoidance manoeuvre from UAV Pilot correctly CA acts incorrectly 6.3 Intentional Deviation UAV Pilot or UAV does not comply with a collision avoidance action due to override or critical failure None Not applicable N/A 6.4 Too Early As 4.4 None Not Applicable N/A 6.5 Too Late UAV Pilot or UAV executes collision avoidance manoeuvre too late CA does not act when required UAV executes collision avoidance manoeuvre too late CA does not act when required Act Page 46 of 74

47 Ref Function Guideword Scenario 1 Impact Hazard Scenario 2 Impact Hazard 7.1 Other Aircraft Trajectory Compliance Loss Other aircraft does not follow ATC instructions which if unresolved by the ATC would lead to a loss of separation from ATC. HAZ005 UAV Pilot: The other aircraft may breach the separation minima or closest point of approach from the UAV perspective, which the UAV Pilot must still attempt to avoid HAZ010 Alternatively, ATC could issue an incorrect instruction to the UAV for example as a result of workload or misjudging the correct resolution HAZ006 Other aircraft responds incorrectly to separation provision instruction which if unresolved by the ATC would lead to a loss of separation from ATC. HAZ005 UAV Pilot: The other aircraft may breach the separation minima or closest point of approach from the UAV perspective, which the UAV Pilot must still attempt to avoid HAZ010 Alternatively, ATC could issue an incorrect instruction to the UAV for example as a result of workload or misjudging the correct resolution HAZ Functional Hazard Assessment (FHA) Error Note this also applies to the Separation Provision Monitor and Instruction functions in Scenario 2. Page 47 of 74

48 Ref Function Functional Hazard Assessment (FHA) Guideword Scenario 1 Impact Hazard Scenario 2 Impact Hazard Intentional Deviation UAV Pilot makes intentional deviation from separation provision instruction provided by ATC e.g. Other aircraft does not comply with trajectory compliance which if unresolved by the ATC would lead to a loss of separation from ATC. HAZ005 UAV Pilot: The other aircraft may breach the separation minima or closest point of approach from the UAV perspective, which the UAV Pilot must still attempt to avoid HAZ010 Alternatively, ATC could issue an incorrect instruction to the UAV for example as a result of workload or misjudging the correct resolution HAZ006 Other aircraft carries out separation provision instruction too early which if unresolved by the ATC would lead to a loss of separation from ATC. HAZ005 UAV Pilot: The other aircraft may breach the separation minima or closest point of approach from the UAV perspective, which the UAV Pilot must still attempt to avoid HAZ010 Alternatively, ATC could issue an incorrect instruction to the UAV for example as a result of workload or misjudging the correct resolution HAZ006 If unresolved by ATC would lead to a loss of separation from ATC. HAZ005 HAZ010 Alternatively, ATC could issue an incorrect instruction to the UAV for example as a result of workload or misjudging the correct resolution HAZ006 UAV Pilot: The other aircraft may breach the separation minima or closest point of approach from the UAV perspective, which the UAV Pilot must still attempt to avoid Too Early Too Late Page 48 of 74

49 Functional Hazard Assessment (FHA) Ref Function Guideword Scenario 1 Impact Hazard Scenario 2 Impact Hazard 8.1 Flight Planning Loss ATC/UAV Pilot: Assumption A0013: Where no FPL is available an airborne FPL will be created. None UAV: Possibility that UAV may perform unsafe manoeuvres or landing following data link loss HAZ007 UAV: Where the FPL is lost then the UAV will not follow an agreed contingency plan following data link loss HAZ001 ATC/UAV Pilot: Errors in FPLs usually addressed during ATC - UAV Pilot RT, however, could lead to confusion. Potential cause of HAZ002/ HAZ006 UAV: Possibility that UAV may perform unsafe manoeuvres or landing following data link loss HAZ008 UAV: Errors in the flight plan could lead to incorrect implementation of contingency plans following data link loss HAZ Error 8.3 Intentional Deviation Not a hazard if coordinated with ATC None Not applicable N/A 8.4 Too Early As 8.2 See 8.2 As 8.2 See Too Late As 8.2 See 8.2 As 8.2 See 8.2 Page 49 of 74

50 Functional Hazard Assessment (FHA) Appendix D D.1 UAS Fault Trees UAS Scenario 1 D.1.1 Collision Avoidance Fault Tree5 Event Tree mitigations are stated in the positive but the failure of the mitigation can be modelled within an FTA, hence the top gate CA-PROVISION-OK is linked to the Scenario 1 ETAs and its failure is analysed from gate CA 5 Page 50 of 74

51 Functional Hazard Assessment (FHA) Page 51 of 74

52 Functional Hazard Assessment (FHA) D.1.2 Functional Failure Analyses to Hazard Linking D HAZ001 Page 52 of 74

53 D Functional Hazard Assessment (FHA) HAZ002 Page 53 of 74

54 D Functional Hazard Assessment (FHA) HAZ003 Page 54 of 74

55 D Functional Hazard Assessment (FHA) HAZ004 Page 55 of 74

56 D Functional Hazard Assessment (FHA) HAZ005 Page 56 of 74

57 D Functional Hazard Assessment (FHA) HAZ006 Page 57 of 74

58 Functional Hazard Assessment (FHA) D.2 UAS Scenario 2 D.2.1 Collision Avoidance Fault Tree (See Footnote 5) Page 58 of 74

59 Functional Hazard Assessment (FHA) D.2.2 Functional Failure Analysis to Hazard Linking D HAZ006 Page 59 of 74

60 D Functional Hazard Assessment (FHA) HAZ007 Page 60 of 74

61 D Functional Hazard Assessment (FHA) HAZ008 Page 61 of 74