MAXIMISING THE ATM POSITIVE CONTRIBUTION TO SAFETY -A BROADER APPROACH TO SAFETY ASSESSMENT

Transcription

1 MAXIMISING THE ATM POSITIVE CONTRIBUTION TO SAFETY -A BROADER APPROACH TO SAFETY ASSESSMENT Eric PERRIN (speaker) Derek FOWLER Ron PIERCE EUROCONTROL Safety R&D Seminar München, Germany October 2009

2 ADS-B B IN NON-RADAR AREAS HOW TO APPROACH SAFETY? Radar-like services in NRA using ADS-B Separation down to radar levels i.e. 5 nm or 3 nm ADS-B end-to-end system needs to be reliable even if it were 100% so, would that answer whether ADS-B would be safe enough to support 3-5 nm separation? No! Risk of implementing a perfectly reliable but unsafe ADS-B system

3 ADS-B B IN NON-RADAR AREAS HOW TO APPROACH SAFETY? Operational Environment What we WANT system to do Functions and Performance CANNOT CONTINUE TO FOCUS MAINLY ON FAILURE!! Radar ADS-B System in NRA Hazards Separation Provision Service Hazards Good basis for a case: Preexisting System- Generated ADS-B can provide the same functionality (i.e. data presented radar separation minima: accuracy, resolution, refresh rate to the Controller / support tools) and performance (data etc of the surveillance information presented to the ATCO. accuracy, resolution, latency, refresh rate, coverage etc) What we DON T want system to do - Integrity

4 A BROADER APPROACH TO RISK ASSESSMENT AND MITIGATION Success approach: to show that an ATM system will be acceptably safe in the absence of failure addresses the ATM contribution to aviation safety defined by FunctionalSafety Requirements Failure approach: to show that an ATM system will still be acceptably safe, taking account of the possibility of (infrequent) failure addresses the ATM contribution to aviation risk defined by Safety IntegrityRequirements

5 ICAO GLOBAL ATM OPERATIONAL CONCEPT 2005 Pre-existing existing Hazards Hazards Strategic Conflict Mgt Separation Provision Main ATM Functions Collision Avoidance Safety Nets Providence Accident System System -- Generated Generated Hazards Hazards People, Equipment, and procedures

6 ICAO GLOBAL ATM OPERATIONAL CONCEPT RISK GRAPH Acceptable Risk Pre-existing Risk Strategic Conflict Mgt Separation Provision R U Collision Avoidance R U Providence R U R A 0 Risk R

7 Accident R A FAULT TREE VIEW & 1-P S4 Providence OR F F3 & 1-P S3 Collision Avoidance OR F F2 & OR 1-P S2 F F1 Separation Provision System System -- generated Hazards & 1-P S1 Strategic Conflict Mgt Pre-existing Hazards F u Enables us to specify success (P nn ) as well as failure (F nn ) attributes

8 SAFETY REQUIREMENTS Safety requirements are specified for ATM to: maximizeits contribution to aviation safetyand minimize its contribution to the risk of an accident Safety Requirements cover, respectively: functionality & performance integrity (plus some additional f&p) Broader approach = success plus failure cases

9 GENERIC ARGUMENT STRUCTURE Cr001 <<Safe is defined by Safety Targets>> A0001 <<Assumptions to be declared and validated in the Safety Case>> Arg 0 <<Claim that something is safe>> <<Strategy to explain the rationale for decomposing Arg 0>> C001 Applies to <<Operational Environment>> J0001 <<Justification for the subject of the Claim>> Arg 1 <<Argument that <A> is true>> Arg 2 <<Argument that <B> is true>> Arg 3 <<Argument that <C> is true>> Arg 4 <<Argument that <D> is true>> [tbd] [tbd] [tbd] [tbd]

10 EVIDENCE How much? How obtained? How good? Simple answer is Safety Assurance

11 SAFETY ASSURANCE -GENERAL Assurance Level (AL) Objectives To give confidence Activities To achieve Evidence To produce

12 ARGUMENT-DRIVEN SAFETY ASSURANCE Safety Argument To satisfy To give confidence To achieve Assurance Level (AL) Safety Activities To produce Evidence But how do we develop a satisfactory Safety Argument?

13 WE USE A REQUIREMENTS-ENGINEERING ENGINEERING MODEL! Real World D S Specification S P, S R User Reqts R Design D System i/f Application Domain I D Implementation I Domain Properties P

14 AN ATM SAFETY VERSION Aviation World D S ATM Service-level Specification S P, S T Safety Targets T Design D ATM System i/f ATM User Domain I D Implementation I ATM User Domain Properties P This leads initially to.

15 Cr001 Acceptably safe is defined by the Safety Targets see Arg 1.1 A001 Assumptions as per section 8.1 of the PSC TOP LEVEL ARGUMENT Arg 0 SESAR En-route Operations will be acceptably safe. Argue on basis of a safe Specification and Logical Design, full Implementation of that design, safe Transition into service and Safety Monitoring for whole operational service life C001 Applies to the Operational Environment described in Section 2 of the En-route Safety Design Document J001 Justification as per Section 2.2 of the PSC Arg 1 SESAR En-route ATM system has been specified to be acceptably safe Figure 20 Arg 2 SESAR En-route ATM system has been designed to be acceptably safe Figure 21 Arg 3 SESAR En-route ATM system Design has been implemented completely & correctly Arg 4 Transition from current state to full SESAR Enroute ATM system will be acceptably safe [tbd] [tbd] [tbd] Arg 5 SESAR En-route ATM system will be shown to operate acceptably safely throughout its service life

16 LIFECYCLE VIEW -OVERALL System Safety Assurance Activities V0 Arg 0 Arg 1 Arg 2 Arg 4 Arg 3 Arg 5 Lower-level Safety Arguments Definition Design & Validation (High-level) Implementation & Integration Transfer into Operation Operation & Maintenance Evidence Arg 1 Arg 2 Arg 4 Arg 3 Arg 5 Arg 0 V1 V2 V3 V4 V5 V6 V7

17 PROCESS SUMMARY Real World' D S Design D I D P, S R User Reqts R Specification S Application System i/f Domain Cr001 Acceptably safe is defined by the Safety Targets see Arg 1.1 A001 Assumptions as per section 8.1 of the PSC Arg 0 SESAR En-route Operations will be acceptably safe. Argue on basis of a safe Specification and Logical Design, full Implementation of that design, safe Transition into service and Safety Monitoring for whole operational service life C001 Applies to the Operational Environment described in Section 2 of the En-route Safety Design Document J001 Justification as per Section 2.2 of the PSC Implementation I RE Model Domain Properties P Arg 1 SESAR En-route ATM system has been specified to be acceptably safe Figure 20 Arg 2 SESAR En-route ATM system has been designed to be acceptably safe Figure 21 Arg 3 SESAR En-route ATM system Design has been implemented completely & correctly Arg 4 Transition from current state to full SESAR Enroute ATM system will be acceptably safe Arg 5 SESAR En-route ATM system will be shown to operate acceptably safely throughout its service life [tbd] [tbd] [tbd] System Safety Assurance Activities Arg 0 Arg 5 Arg 4 Arg 3 Arg 2 Arg 1 Lower-level Safety Arguments Definition Design & Validation (High-level) Implementation & Integration Transfer into Operation Operation & Maintenance Evidence Arg 1 Arg 2 Arg 3 Arg 4 Arg 5 Arg 0 Safety Case Assurance Process

18

19 RBT Revisions & Updates Net Mgt. Airspace RBT Revision RBTs FPM.... SURV(G) ADS data 1 GCA SCD TCD ACAS RA data S&S SCR TCR Weather, NOTAMs, etc. Handover. COTR Adjacent Airspace TCICL TOLI/ TCICL CLR Aircraft. Flt Ctl Nav Data Nav AOC ACA PD(V) PD(H) Other Aircraft SURV(A) ASA

20 MTCD 1 2 ADS-B A&D- MAN Airspace Data APT data CTO / A 1 PLNR Non-standard COTR ADSECT RBT Rev & Update Conflicts RBT Rev & Update SDP(G) MONA FDP Prop RBT Rev SRNMC Independent Surveillance RBT Rev & Update NAVAIDS TC-SA RBT Rev & Update EXEC FCRW FMS TCT SNETS Requests, CLR, & Transfer TAWS 2 ALTSYS AP/FD A/F 1 RA RA Downlink ACAS TA SDP(A) ASAS Manual Inputs AC2 Mode A/C or S ADS-B

21 A FEW FUNCTIONAL SAFETY REQUIREMENTS The AMAN sub-function shall compute a Controlled Time of Overfly (CTO) for waypoints extending out well into En-route Airspace (typically as far as 200 nm) and down to a CTA at the Final Approach Fix or at a final merge point The AMAN sub-function shall generate speed advisories for Aircraft without an RTA capability The EXEC shall resolve any conflicts, as follows: where the situation is time-critical, issue an openloop clearance to one or both Aircraft involved, or where possible, and the situation is less time-critical, issue a trajectory change to resolve the conflict but return the Aircraft to its original route, or where proposed by the PLNR and judged appropriate, for crossing / passing traffic, delegate separation responsibility to the FCRW according to the agreed and authorized RBT

22 FCRW FMS FDP EXEC MTCD SDP(G) Aircraft wants to climb Conflict free 6 Aircraft climbs FCRW rejects Conflict FCRW accepts Aircraft climbs Repeat from 1