SRC DOCUMENT 51. Review of the Wide Area Multilateration for Non Radar Areas (WAM-NRA) Preliminary Safety Case

Transcription

1 EUROPEAN ORGANISATION FOR THE SAFETY OF AIR NAVIGATION EUROCONTROL SAFETY REGULATION COMMISSION DOCUMENT (SRC DOC) SRC DOCUMENT 51 Review of the Wide Area Multilateration for Non Radar Areas (WAM-NRA) Preliminary Safety Case Edition : 1.0 Edition Date : 07 December 2012 Status : Released Issue Distribution : General Public Category : SRC Document SAFETY REGULATION COMMISSION

2 F.2 DOCUMENT CHARACTERISTICS TITLE SRC Document 51 Review of the Wide Area Multilateration for Non Radar Areas (WAM-NRA) Preliminary Safety Case Document Identifier Edition Number 1.0 srcdoc51_e1.0_web Edition Date Abstract This document denotes the report of the SRC Review Team ensuing from a review of the Preliminary Safety Case for Air Traffic Control Service in non radar areas using Wide Area Multilateration as Sole means of surveillance (PSC WAM-NRA). Keywords Safety WAM-NRA Review Document Focal Point(s) Tel Unit Gary MORTON DSS/OVS DOCUMENT INFORMATION Status Distribution Category Working Draft General Public Safety Regulatory Requirement Draft Issue Restricted EUROCONTROL Requirement Application Document Proposed Issue Restricted ESIMS ESARR Advisory Material Released Issue Restricted SRC SRC Document Restricted SRCCG DSS/OVS Document Restricted DSS/OVS Comment / Response Document COPIES OF SRC DELIVERABLES CAN BE OBTAINED FROM Oversight Division (DSS/OVS) EUROCONTROL Rue de la Fusée, 96 B-1130 Bruxelles Tel: Fax: sru@eurocontrol.int Website: Edition 1.0 Released Issue Page 2 of 14

3 F.3 DOCUMENT APPROVAL The following table identifies all management authorities who have approved this document. Authority Name and Signature Date Document Focal Point (DSS/OVS) «signed by Gary Morton» (Gary MORTON) Head of Division (DSS/OVS) «signed by Juan Vazquez Sanz» (Juan VÁZQUEZ-SANZ) Chairman, Safety Regulation Commission (SRC) «signed by Harry Daly» (Harry DALY) (Space Left Intentionally Blank) Edition 1.0 Released Issue Page 3 of 14

4 F.4 AMENDMENT RECORD The following table records the complete history of this document. Edition No. Date Reason for Change Pages Affected Aug-12 Creation. All Aug-12 Internal quality review. Document sent to SRCCG consultation Oct-12 Updated as a result of SRCCG consultation (RFC No. 1211) Dec-12 Document formally released after inclusion of SRC comments (RFC No. 1216). All All 8-14 (Space Left Intentionally Blank) Edition 1.0 Released Issue Page 4 of 14

5 F.5 CONTENTS Section Title Page Foreword F.1 Title Page 1 F.2 Document Characteristics... 2 F.3 Document Approval. 3 F.4 Amendment Record. 4 F.5 Contents... 5 F.6 Executive Summary... 6 SRC Document 51 Review of the Wide Area Multilateration for Non Radar Areas (WAM-NRA) Preliminary Safety Case 1. Introduction Items for States to Consider Corresponding EUROCAE and EUROCONTROL Documents. 2.2 Identification of Aircraft Limitation of Scope 2.4 Allocation of WAM Requirements Aircraft Equipage Issues Local Interference Effect on Other 1090 MHz Systems in Adjacent Environments. 2.8 Remote Surveillance Data 2.9 Separation Minima Differences Between the PSC and Current Local Operations and Environment 2.11 Use of PSC Assumptions, Limitations and Guidance Material ATC Licensing Rating and Endorsement Issues Human Factors and HMI Interface Horizontal Position Data Quality Use of PSC Argument and Evidence in Local Safety Cases Safety Targets 2.17 Risk Apportionment Identification of Hazards and Mitigations Other Systems Affected by WAM 2.20 Security Issues Safety Issues Arising Through Implementation 2.22 Unintended Use Reference Material 2.24 Items not Addressed by the PSC Conclusions Applicable and Planned Regulations / Standards Appendices A. WAM-NRA Overview Edition 1.0 Released Issue Page 5 of 14

6 F.6 EXECUTIVE SUMMARY This document denotes the report of the SRC Review team ensuing from a review of the Preliminary Safety Case for Air Traffic Control Service in non radar areas using Wide Area Multilateration as Sole means of surveillance (PSC WAM-NRA). Slovakia was the only State represented in the WAM-NRA Review Task Force in addition to DSS/OVS representatives. The comments and positions contained in this document are for information purposes only. They do not constitute formal approval, acceptance or certification or other legal commitment, which remain the responsibility of the authorities and entities concerned, and shall not be interpreted, or inferred as being such. This document is provided without any warranty of any kind, either express or implied. EUROCONTROL shall not be held liable for any direct or indirect loss resulting from the use of the review. (Space Left Intentionally Blank) Edition 1.0 Released Issue Page 6 of 14

7 1. INTRODUCTION This document denotes the report of the SRC Review team ensuing from a review of the Preliminary Safety Case (PSC) for Air Traffic Control Service in non radar area using Wide Area Multilateration as Sole means of surveillance (PSC WAM-NRA). It is considered possible that implementers may make use of this PSC information in local safety assurance documents produced for approval purposes. This document is issued to NSAs who are presented with such safety assurance documents to provide guidance on aspects to consider during the assessment of the local Safety Argument. 2. ITEMS FOR STATES TO CONSIDER 2.1 Corresponding EUROCAE and EUROCONTROL Documents For this application, there is no corresponding EUROCAE Safety, Performance and Interoperability standard. Although there is ED-142 Technical specification for wide area multilateration (WAM) systems, this document was not developed in conjunction with this PSC and the requirements in ED-142 might be insufficient. The status of ED-142 at the time of the implementation of a WAM-NRA system should be checked, because, at the time of this report, EUROCAE WG-51 SG4 has started work on composite ADS-B & WAM Ground Station Specification which is expected to replace ED Identification of Aircraft The PSC assumes aircraft are identified by use of Mode-A code. This decision was made to match current deployment situations. Any implications on local WAM-NRA system implementations that make use of Aircraft Identification will need to be further assessed. Note: work has commenced on a generic surveillance SPR (GEN-SUR) and corresponding Preliminary Safety Case to cover multiple surveillance sources including the use of Aircraft Identification. 2.3 Limitation of Scope The PSC does not consider the use of WAM in conjunction with other surveillance sources e.g. radar, ADS-B, etc. Any such considerations will need to be addressed by the local Safety Argument. 2.4 Allocation of WAM Requirements The WAM-NRA requirements have been derived at the level of the functional description of the system. This is the same approach taken for previous CASCADE PSCs. These functions can be accomplished in different architectures. Implementers will have to present an argument for the allocation of these requirements to the physical architecture as part of the local safety case (See PSC GM032). This might have implications for existing parts of the ATM infrastructure, in particular the existing ATC Processing (including tracking) and display system. Edition 1.0 Released Issue Page 7 of 14

8 2.5 Aircraft Equipage Issues The PSC assumes all aircraft in the airspace in which the WAM-NRA system provides surveillance are equipped with suitably certified equipment. These aircraft equipments must provide certain aircraft transponder functions and performance, including Mode-A and pressure altitude data (see PSC 7.5.1). There are different combinations of avionics implementations that can meet the above requirements. It will be necessary to ensure that the aircraft in the airspace meet these requirements. 2.6 Local Interference Mechanisms will be needed to manage the local Radio Frequency environment to control the possible effect on the local WAM-NRA system performance by other 1090MHZ interrogators. This would include, for example, the number of interrogators, to control possible interference sources e.g. FRUIT (see PSC GM 029). 2.7 Effect on Other 1090MHz Based Systems in Adjacent Environments The effect of active WAM systems on other environments (e.g. neighboring ATSU), for example, the effect of FRUIT (see GM 029) and the allocation of Mode S ground transponder interrogation codes, will need to be considered. 2.8 Remote Surveillance Data The contents of agreements between users and suppliers of remote WAM surveillance data will need to be assessed to ensure that the agreed performance is defined and acceptable for the service at the remote unit. 2.9 Separation Minima The specification of the separation minima to be applied in a local WAM-NRA operational environment is the responsibility of the implementer (subject to oversight by the NSA) who may prescribe greater separation minima than those specified in this PSC. Such separation minima will need to consider any requirements from ICAO or EASA that are in place at the time of the local implementation. Note: At the time of writing, ICAO has not explicitly approved separation minima for WAM-NRA in Doc Differences Between the PSC and Current Local Operations and Environment To validate the applicability of the assumptions and to assess the safety impact of any differences between the PSC assumed Operations and Environment and the local Operations and Environment when implementing a local WAM-NRA application, any differences of the typical operational environment defined in the PSC against the local operational environment will need to be assessed. In particular, where the local reference system is different from the characteristics of the reference radar based ATS system used in the PSC, the difference shall be addressed in the local safety case. (Space Left Intentionally Blank) Edition 1.0 Released Issue Page 8 of 14

9 2.11 Use of PSC Assumptions, Limitations and Guidance Material Assumptions are made in the PSC to support the safety argument. It will be necessary for each implementer to validate the applicability of these assumptions in their own operational environment, and if not valid, address them in their local Safety Case. The PSC also identifies Limitations and Guidance Material. It will be necessary for each implementer to consider the implications of these limitations and to consider the application of the guidance material in their own operational environment and provide arguments as to how they are addressed in their local Safety Case ATC Licensing Rating and Endorsement Issues Commission Regulation (EU) No. 805/2011, Article 11, on the use of specific endorsements will need to be considered as regards its applicability to WAM-NRA Human Factors and HMI Interface Although hazards have been identified at the controller working position level, the analysis has not assessed hazards specifically related to human factor aspects (man-machine design and implementation perspective, including equipment placement) which are dependent on the local implementation. The Review Team identified that developments in the area of Human Factors / performances case are taking place within EUROCONTROL AND SESAR. These approaches could be considered by implementers Horizontal Position Data Quality The PSC assumes that the WAM-NRA Logical Design includes the concept of a Horizontal Position Data Quality information that is associated with each WAM report (see A007, A008 and A009 of the PSC). The concept of horizontal position data Quality relates to the assurance that the accuracy and the data measurement integrity meet the appropriate WAM function requirements for the horizontal position. The implementation of this Horizontal Position Data Quality information will need to be assessed Use of PSC Argument and Evidence in Local Safety Cases European-wide guidance material contained in the PSC should be based on acceptable and accurate safety principles. These safety principles are continuously evolving with additional experience in application. The success and failure approach used in the PSC has resulted in a specific breakdown for the positioning of argument and evidence in the GSN and PSC chapters. Care must be used in applying the argument and the evidence contained in the PSC, particularly when applying a different structure or methodology consistent with a specific national approach Safety Targets The PSC claims to cover both airborne and ground components/elements/systems, etc. and claims that the safety target includes both of these elements within the ATM framework. An assessment of this claim in the local regulatory framework will be required regarding the use of ESARR 4 and ED-125 safety targets in the allocation of safety requirements for the airborne domain. Edition 1.0 Released Issue Page 9 of 14

10 The implications f National Safety Targets with the PSC use of different Safety Targets for the success and failure approach on the resulting requirements will need to be addressed as part of the Local Safety Argument Risk Apportionment The risk apportionment approach used in the PSC is based on the use of EUROCAE ED-126 (ADS-B-NRA) which is based on ESARR 4 / EUROCAE ED-125 and on the EUROCONTROL SAM and SAME methodology. These methodologies have not been assessed by the SRC and the applicability of this approach, when combined with any existing local risk apportionment approach, will need to be addressed by the Local Safety Argument. In particular, although the ATC service is the same using ADS-B-NRA or WAM-NRA, ground and onboard equipment are different in both cases, and effects of this assumption should be analysed to take them into account in local implementations as it could affect the risk assessment and mitigation Identification of Hazards and Mitigations The generic safety assessments for WAM-NRA are based on hazards and existing mitigations derived from experience in the reference environment. New technologies may have a safety-related impact on people, procedures and equipment internal and external to the WAM-NRA system being considered. As such, the hazard identification and risk analysis process at national level should be broadened, perhaps to include existing incident data, to identify possible hazards in all areas impacted by the WAM-NRA system in the local environment Other Systems Affected by WAM The PSC cannot identify all other systems that can be affected by the implementation of WAM-NRA, as it cannot consider all possible local implementations. Local implementers must consider situations where WAM-NRA implementation affects other technical systems, or interfaces with other ATSU or airspaces, in order to determine that the WAM-NRA does not adversely affect its operational environment, or other parts of the ATM System Security Issues WAM-NRA is, in common with other communication, navigation and surveillance technologies, sensitive to outside interference. The interference sources can be malicious or accidental and can occur intermittently or for an extended period. The PSC does not address the possible solutions to these aspects Safety Issues Arising Through Implementation The PSC does not address the implementation, transition and in-service stages of the safety lifecycle. These aspects will need to be addressed by the local safety argument Unintended Use The PSC does not address the abuse of, or intentional misuse of, information provided to the controller. These aspects will need to be addressed by the local safety argument. Edition 1.0 Released Issue Page 10 of 14

11 2.23 Reference Material In order to provide appropriate and sufficient evidence to demonstrate the claim through the proposed arguments, the PSC gathers information, as well as information from other standards and related activities (ICAO annexes and documents, EASA reference documents, other CASCADE Programme work and standards, etc.). The information presented in the PSC has been in some cases adapted and summarised from its original form in order to obtain a coherent and simplified document. Implementers will need to ensure that the PSC and any local safety argument should not supersede the assumptions, requirements and results made in these reference documents Items not Addressed by the PSC The introduction of WAM-NRA systems in areas without existing surveillance systems requires a number of activities which are not within the scope of the PSC, e.g. airspace design and controller training and licensing changes and these shall be identified and addressed in the local implementation. See PSC section 1.6 for further information. 3. CONCLUSIONS The Preliminary Safety Case for WAM-NRA sets out a generic argument and structure to support the claim the use of WAM to provide surveillance as sole means of surveillance to support Air Traffic Control Service (ATC) will be acceptably safe. Implementers choosing to deploy WAM-NRA will need to develop a Safety Argument for the change as required by Commission Implementing Regulation (EU) No. 1034/2011. Implementers may choose to make use of elements of the PSC, for example the generic set of safety arguments, contained within this safety argument, but must not rely on it alone. 4. APPLICABLE AND PLANNED REGULATIONS / STANDARDS Standards and other documents that could be applicable by NSA/States and ANSPs when considering WAM-NRA implementation are listed below. It is expected that the NSA shall review the standards and regulations in force at the time of a local implementation. EUROCONTROL - Safety Case Development Manual, DAP/SSH/091, Edition 2.2. Nov EUROCONTROL - ANS Safety Assessment Methodology (SAM) v2.1. Nov EUROCONTROL - Safety Regulatory Requirement 4 (ESARR 4), Risk Assessment and Mitigation in ATM. EUROCONTROL - Safety Regulatory Requirement 3 (ESARR 3), Safety Management Systems by ATM Service Providers. EUROCONTROL document SAME: Safety Assessment Made Easier, Edition 1.0, 15 January EUROCONTROL document SAME: Safety Assessment Made Easier, Part 2 under development at the time of edition of this PSC. Edition 1.0 Released Issue Page 11 of 14

12 EUROCONTROL SRC Document 20, Assessment of EUROCAE ED-78 as a means of compliance with ESARR 4, Edition December EUROCONTROL, Preliminary Safety Case for Enhanced Air Traffic Services in Non-Radar Area Using ADS-B Surveillance, Edition 1.1, 12 December EUROCONTROL, Preliminary Safety Case for Air Traffic Control Service in Radar Areas Using ADS-B Surveillance, Edition 2.0, December EUROCONTROL Specification for ATM Surveillance System Performance (Volumes 1 and 2). Edition date: March 2012 ICAO PANS ATM - Procedures for Air Navigation Services - Air Traffic Management, Document 4444, Fifteen edition 2007, ICAO PANS-OPS - Procedures for Air Navigation Services - Aircraft operations, Document 8168, fifth edition, ICAO Annex 10 Aeronautical Telecommunications, Volume IV Surveillance Radar and Collision Avoidance Systems, Edition 3. ICAO Annex 11 Air Traffic Services (Air Traffic Control Service, Flight Information Service, Alerting Service) 13th Edition, July 2001 including the adopted Amendments ICAO Doc Manual on Airspace Planning Methodology for the Determination of Separation Minima, First edition (through Amendment 1), ICAO, August EUROCAE ED-126 / RTCA DO-303 Safety Performance and Interoperability Requirements Document for ADS-B-NRA Application, December EUROCAE ED-78A / RTCA DO Guidelines for approval of the provision and use of Air Traffic Services supported by data communications. December EUROCAE ED-125 Process for specifying Risk Classification Scheme and deriving Safety Objectives in ATM (March 2010). EUROCAE ED-142, Technical specification for Wide Area Multilateration (WAM) systems, September Commission Implementing Regulation (EU) No. 1035/2011 of 17 October 2011 laying down common requirements for the provision of air navigation services and amending Regulations (EC) No. 482/2008 and (EU) No. 691/2010. Commission Implementing Regulation (EU) No. 1034/2011 of 17 October 2011 on safety oversight in air traffic management and air navigation services and amending Regulation (EU) No. 691/2010. Commission Implementing Regulation (EU) No 1207/2011 of 22 November 2011 laying down requirements for the performance and the interoperability of surveillance for the single European sky. Regulation (EC) No. 216/2008 of 20 February 2008 on common rules in the field of civil aviation and establishing a European Aviation Safety Agency, and repealing Council Directive 91/670/EEC, Regulation (EC) No. 1592/2002 and Directive 2004/36/EC. Commission Regulation (EU) No. 805/2011 of 10 August 2011 laying down detailed rules for air traffic controllers licenses and certain certificates pursuant to Regulation (EC) No. 216/2008 of the European Parliament and of the Council. Edition 1.0 Released Issue Page 12 of 14

13 EASA Certification Specification (CS) ADS-B out as included in EASA NPA Approval requirement for air-ground Datalink and ADS-B in support of Interoperability requirements. EASA AMC Airworthiness Certification of ADS-B NRA. Data Communication Safety and Performance Requirements, version H, February (Space Left Intentionally Blank) Edition 1.0 Released Issue Page 13 of 14

14 APPENDIX A WAM-NRA OVERVIEW Wide Area Multilateration (WAM) is a ground based Co-operative Independent Surveillance technique (like SSR or Mode S). It works by accurately computing the time difference of arrival (TDOA) of a 1090MHz transponder signal transmitted from an aircraft at a number of distributed ground-based receivers and uses this to calculate the location of the origin of the signal (i.e. the 3-D position of the aircraft). Information in the content of the signal received is used by the WAM system to derive the aircraft s identity and pressure altitude. Part of the EUROCONTROL CASCADE Programme, The WAM-NRA application is intended to enhance or support Air Traffic Services (ATC, FIS, Advisory and Alerting) of suitably equipped aircraft through the use of WAM surveillance in areas where no radar surveillance exists, or where an existing single SSR radar is to be decommissioned. WAM-NRA is the use of WAM as sole means of surveillance to support Air Traffic Service. ( *** ) Edition 1.0 Released Issue Page 14 of 14