Is LVNL Safety Criteria a Means Of Compliance to

1

• Is LVNL Safety Criteria a Means Of Compliance to
• ESARR 4?
• Safety Regulation Unit
• EUROCONTROL
• Briefing
• 23 July 2003

2
APPROACH

• Draft SRC DOC 33 by SRU as preliminary input
• SRC Expert Panel meets to assess PMC-
  assessment can rely of draft SRC DOC 33
• SRC Expert Panel develops a recommendation to
  SRC, based on a finalised SRC DOC 33 justifying
  the recommendation
• SRC develops and promulgate its position and
  status of PMC/AMC

3
ANALYSIS (Doc 33)

• Factual and systematic analysis
• Mandatory provisions/Section 5 in more detail
• Types of analysis
• Detailed assessment against each ESARR 4
  requirement (Tables 2A page 14 and 2B page 20)
• Specifies ESARR 4 requirement and how LVNL Safety
  Criteria achieves the requirement
• Summary of this assessment in coverage table 1
  page 11

4
ANALYSIS (Doc 33)

• Issues captured within Table 2A and 2B analysis
  to aid Traceability
• Recapitulation of issues (section 4 page 27)
• Conclusions and recommendations per issue (Page
  28)
• Statement Of Compliance based on issues and
  coverage table 1 (section 5 Page 30)

5
RESULTS (1)

• ISSUE 1 The PMC does not address risk
  assessment and mitigation of all changes to the
  ATM System because
• The PMC does not define the risk allocation or
  TLS to Aircraft Systems and Aircraft Operations.
• The PMC does not address risk assessment and
  mitigation of changes and related hazards within
  the ATM domains of Aircraft Systems and Aircraft
  Operations.
• The PMC notes that methods of justifying design
  choices in the aircraft domain are outside the
  scope of the PMC.
• The PMC gives no guidance on how to allocate
  risks between domains through Safety
  Requirements.

6
RESULTS (2)

• ISSUE 2 The PMC repeats the work conducted in
  SRC Policy Document 1 on the basis that the ESARR
  figure does not have the correct scope
• ISSUE 3 The PMC does not indicate that the TLS
  derived is either
• Based on national experience
• Or consistent with ESARR 4 Fig A-2

7
RESULTS (3)

• ISSUE 4 The PMC does not address the increased
  Safety Objective required as a result of future
  traffic growth.

8
RESULTS (4)

• ISSUE 5 The PMC suggests a number of Critical
  ATM Sub products and assumes that each has an
  equal contribution to the ATM risk. If this
  assumption is not correct, it could result in the
  design of elements of the system which are
  insufficient. For example, if one of the
  Critical ATM sub products is presently less safe
  than assumed, but this contribution is balanced
  by another Critical Sub product being safer than
  expected, then a design change in the more safe
  critical ATM sub product that was allowed to meet
  a less safe design target based on a 1/40
  contribution might result in an system with lower
  overall safety.

9
RESULTS (5)

• ISSUE 6 The PMC suggests a method for
  including the ALARP principle that is intended to
  meets national requirements. However, it not
  evident that this meets other national frameworks
  for the ALARP principle.

10
CONCLUSIONS

• PMC meets partially ESARR 4
• Modifications to be made to existing parts
• Further developments needed to complement PMC
• Recommendations to owner to PMC to help
  improvements

11
Is LVNL Safety Criteria a Means Of Compliance
with ESARR 4? Safety Regulation
Unit EUROCONTROL Briefing 23 July 2003