D3.2a – BLUE MED FAB Safety Case (Part A: Regulatory aspects)

BLUE MED PROJECT PHASE 2: DEFINITION

WP3.1 - Safety

D3.2a – BLUE MED FAB Safety Case (Part A: Regulatory aspects)

Released Issue

Version 2.0

27/03//2012

D3.2a – BLUE MED FAB Safety Case

DOCUMENT IDENTIFICATION SHEET

BLUE MED D3.2a – BLUE MED FAB SAFETY CASE

DELIVERABLE REFERENCE NUMBER

PROJECT REFERENCE NUMBER

D3.2 - FAB SAFETY CASE

The scope of this document is to demonstrate that the BLUE MED FAB can be implemented in a manner which is acceptably safe. Thisappropriate evidences. The Safety Case complies with the applicable regulatory requirements and is presented in two distinct documents (D3.2a and D3.2b) for easy readability. This document (D3.2a) focuses on the regulatory aspects of the Safety Case

BLUE MED, FAB, SAFETY, CASE, RISK.

Contact Person:

Petros Stratis

Email:

[email protected]

DOCUMENT STATUS AND CLASSIFICATION

STATUS

Working draft Final Draft

CLASSIFICATION

Public Internal Confidential Restricted

BLUE MED WP3.1 – Safety

BLUE MED FAB Safety Case (Part A: Regulatory aspects)

DOCUMENT IDENTIFICATION SHEET

DOCUMENT DESCRIPTION

DOCUMENT TITLE

BLUE MED FAB SAFETY CASE – Part A: Regulatory aspects

DELIVERABLE REFERENCE NUMBER

PROJECT REFERENCE NUMBER EDITION:

EDITION DATE:

Abstract

The scope of this document is to demonstrate that the BLUE MED FAB can be implemented in a manner which is acceptably safe. This is claimed through a series of arguments, supported by appropriate evidences. The Safety Case complies with the applicable regulatory requirements and is presented in two distinct documents (D3.2a and D3.2b) for easy readability. This document (D3.2a) cuses on the regulatory aspects of the Safety Case.

Keywords

BLUE MED, FAB, SAFETY, CASE, RISK.

Tel:

+357 22 404192

Organisation:

DCAC

Fax:

+ 357 22 404195

Address:

Pindarou 27, Nicosia, Cyprus

DOCUMENT STATUS AND CLASSIFICATION

Proposed Issue Released Issue

of 31

Part A: Regulatory aspects

2.0

27/03/2012

The scope of this document is to demonstrate that the BLUE MED FAB can be implemented in a is claimed through a series of arguments, supported by

appropriate evidences. The Safety Case complies with the applicable regulatory requirements and is presented in two distinct documents (D3.2a and D3.2b) for easy readability. This document (D3.2a)

Organisation:

Pindarou 27, Nicosia, Cyprus


of 31

BLUE MED Project

Partner States

Cyprus

Greece

Italy

Malta

Albania

Egypt

Tunisia

For the list of contributors, please refer to the Appendix 1



AUTHORS

BLUE MED Project

Partner States Author WP Reviewers

Petros Stratis Evis Antonopoulos

--- Athina Lala

--- Maria Milena Renis

--- Francis Bezzina

--- Fisnik Tabaku

--- Salama Ramadan

--- Walha Mohamed Amin

1 : WP National Focal Point

CONTRIBUTORS


WP Reviewers1

Evis Antonopoulos

Athina Lala

Milena Renis

Francis Bezzina

Fisnik Tabaku

Salama Ramadan

Walha Mohamed Amin



Review Level

Program Management Office

Review Level Review Body

1st review level

Final review level

Approval Level

Governing Body

Leonidas Leonidou

Gregory Nanidis

Alessio Quaranta

John Gatt



REVIEW

Review Level Body Approval

Program Management Office Approval by correspondance

Review Body Body Approval

OPCG N.A.

TPCG N.A.

FCPCG N.A.

ANSP-SB Approval by correspondance

MCG Approval by correspondance

NSAC Approval by correspondance

APPROVAL

Approval Level Body Approval

Governing Body

Leonidas Leonidou

Gregory Nanidis

Alessio Quaranta

Gatt

Approval by correspondance

of 31







of 31

DOCUMENT CHANGE RECORD

The following table records the complete history of

ED. DATE

0.1 01/12/2009 Creation of the document

0.2 16/12/2009 Modification of initial safety argument as proposed by EUROCONTROL

0.3 15/03/2011 Revision, for

0.4 22/3/2011 Revision, safety argument structure changed to fit the type of changes expected

0.5 30/3/2011 Minor revision, fine tuned in view of WP3.1 meeting

0.6 10/6/2011 Minor revision, WP3.1 meeting

0.7 30/7/2011 Extensive reSarajevo

0.8 16/8/2011 Fine tuning

0.9 22/8/2011 Internal WP3.1 release for working level consultation

0.95 20/09/2011 Consolidation of comments received

0.95a 10/10/2011 Split doc in two parts (D3.2a and D3.2b, as per PM request)

0.95b 28/10/2011 PMO Quality revision

0.96 05/01/2012 Updated, following NSAC review

1.0 30/01/2012 Final, for the GB (after NSAC endorsement in Athens 11 Jan 2012)

2.0 27/03/2012 Released Issue



DOCUMENT CHANGE RECORD

The following table records the complete history of the successive editions of the document.

REASON FOR CHANGE SECTIONS/PAGES

Creation of the document

Modification of initial safety argument as proposed by EUROCONTROL

Revision, for compliance with the FAB IR

Revision, safety argument structure changed to fit the type of changes expected

Minor revision, fine tuned in view of WP3.1 meeting

Minor revision, WP3.1 meeting

Extensive re-structuring, after FABs ES2 workshop in

Internal WP3.1 release for working level consultation

Consolidation of comments received

Split doc in two parts (D3.2a and D3.2b, as per PM request)

PMO Quality revision

Updated, following NSAC review

Final, for the GB (after NSAC endorsement in Athens 11 Jan

Released Issue

the successive editions of the document.

SECTIONS/PAGES AFFECTED

All

10

All

All

All

All

All

All

All

All

All

All

All

All

-


1 GENERAL INFO ................................

2 INTRODUCTION ................................

3 REGULATORY REQUIREME

4 SCOPE - OPERATIONAL CONCEPT

5 DEFINITIONS ................................

6 RATIONALE FOR THE FA

7 ASSUMPTIONS ................................

8 SAFETY RELATED ORGAN

9 ACCEPTABILITY OF THE

10 BLUE MED FAB INITIAL SAFETY ARGUMENT

10.1 Safety arguments decomposition

10.1.1 Safety Culture ................................

10.1.2 Safety will be managed ................................

10.1.3 Safety Oversight ................................

11 SUMMARY – REGULATORY COMPLIANC

12 OVERALL SAFETY CASE

ANNEX 1 - PROPOSED BLUE MED SA

ANNEX 2 - INITIAL HAZARD IDENTIFICATION AND M

ANNEX 3 - SAFETY PLAN ................................

ANNEX 4 - INVESTIGATION OF ACC

APPENDIX 1 - LIST OF CONTRIBUTORS



TABLE OF CONTENTS

................................................................................................

................................................................................................

REGULATORY REQUIREMENTS ................................................................................................

OPERATIONAL CONCEPT................................................................

................................................................................................................................

RATIONALE FOR THE FAB IMPLEMENTATION (SAFETY CASE JUSTIFICAT

................................................................................................

SAFETY RELATED ORGANISATIONAL ARRANGEMENTS ................................

ACCEPTABILITY OF THE FAB SAFETY CASE ................................................................

SAFETY ARGUMENT................................................................

Safety arguments decomposition ................................................................................................

................................................................................................

................................................................................................

................................................................................................

REGULATORY COMPLIANCE MATRIX ................................................................

OVERALL SAFETY CASE CONCLUSIONS ................................................................

PROPOSED BLUE MED SAFETY POLICY ................................................................

IDENTIFICATION AND MITIGATIONS OF PLANNE

................................................................................................

INVESTIGATION OF ACCIDENTS AND SERIOUS INCIDENTS IN BLUE MED

LIST OF CONTRIBUTORS ................................................................

of 31

................................................................. 7

................................................................ 7

..................................... 8

................................................................ 9

..................................... 9

FETY CASE JUSTIFICATION) ...................10

................................................................10

..........................................................11

..............................................13

..............................................14

.......................................15

.................................................................15

...................................................16

.............................................................19

....................................20

....................................................21

............................................22

ITIGATIONS OF PLANNED CHANGES ........23

..........................................................28

NCIDENTS IN BLUE MED FAB ..........29

.................................................................31


of 31

1 GENERAL INFO

Document description: BLUE MED Safety Case

Rationale: WP3.1 deliverable (D3.2)

Author: WP3 Leader + WP3.1 national representatives

Distribution :

2 INTRODUCTION

This document supports the claim that the BLUE MED FAB will be implemented in a manner which is acceptably safe. Furthermore, it provides establishment of a functional airspace block, in accordance with the requirements of the FAB IR ((EU) 176/2011). It should be noted that, some of the required information is further detailed in other BLUE MED documents and deliverables to which this document cross

As per the relevant guidance materialthe required information to the Commission (in accordance with the FABcomplete Safety Case (SC). Therefore the Safety Case hereinupdated at regular intervals or as may be required, so as to adequately support the overall claim.

The present document is structured in a manner that can be easily reviewed by stakeholders concerned with regulatory compliance, such as the NSAs, the European Commission and other external stakeholders that may be relevant (e.g. EASA). It will present the initial safety argument on how safety in the FAB will be achieved and maintained and will answer, in a clear and crequirements of the FAB IR. It will include, inter alia, a high level safety assessment of the foreseen ATM/ANS related changes, presented as a series of hazards with associated mitigations.

It should be noted that the ownership of thit covers more than just ANSP operations. In this respect, the BLUE MED States, through the arrangements described herein, the State Level Agreement (SLA), the NSA Agreement and the FAB SMS roadmap (D3.3) will have the responsibility to maintain and update it so as to remain valid. In doing so, due regard must be given to the States’ Safety Plans required by ICAO, to which the actionscontained in this Safety Case will need to contribute, especially inof safety.

1 European Commission Guidance Material for the establishment and modification of Functional Airspace Blocks (FAB) Ver.1.0, da03/12/2010 ( Adopted)



BLUE MED Safety Case

WP3.1 deliverable (D3.2)

WP3 Leader + WP3.1 national representatives

This document supports the claim that the BLUE MED FAB will be implemented in a manner which is acceptably safe. Furthermore, it provides the safety related information required before the

airspace block, in accordance with the requirements of the FAB IR ((EU) 176/2011). It should be noted that, some of the required information is further detailed in other BLUE MED documents and deliverables to which this document cross-references.

the relevant guidance material1, prior to starting FAB operations and at the time of submission of the required information to the Commission (in accordance with the FAB-IR), there cannot yet be a complete Safety Case (SC). Therefore the Safety Case herein will be retained as a living document, updated at regular intervals or as may be required, so as to adequately support the overall claim.

The present document is structured in a manner that can be easily reviewed by stakeholders concerned compliance, such as the NSAs, the European Commission and other external

stakeholders that may be relevant (e.g. EASA). It will present the initial safety argument on how safety in the FAB will be achieved and maintained and will answer, in a clear and concise manner, to the requirements of the FAB IR. It will include, inter alia, a high level safety assessment of the foreseen ATM/ANS related changes, presented as a series of hazards with associated mitigations.

It should be noted that the ownership of the BLUE MED Safety Case belongs to the Member States, as it covers more than just ANSP operations. In this respect, the BLUE MED States, through the arrangements described herein, the State Level Agreement (SLA), the NSA Agreement and the FAB

3.3) will have the responsibility to maintain and update it so as to remain valid. In doing so, due regard must be given to the States’ Safety Plans required by ICAO, to which the actionscontained in this Safety Case will need to contribute, especially in the establishment of acceptable levels

European Commission Guidance Material for the establishment and modification of Functional Airspace Blocks (FAB) Ver.1.0, da

This document supports the claim that the BLUE MED FAB will be implemented in a manner which is the safety related information required before the

airspace block, in accordance with the requirements of the FAB IR ((EU) 176/2011). It should be noted that, some of the required information is further detailed in other BLUE

, prior to starting FAB operations and at the time of submission of IR), there cannot yet be a

will be retained as a living document, updated at regular intervals or as may be required, so as to adequately support the overall claim.

The present document is structured in a manner that can be easily reviewed by stakeholders concerned compliance, such as the NSAs, the European Commission and other external

stakeholders that may be relevant (e.g. EASA). It will present the initial safety argument on how safety oncise manner, to the

requirements of the FAB IR. It will include, inter alia, a high level safety assessment of the foreseen ATM/ANS related changes, presented as a series of hazards with associated mitigations.

e BLUE MED Safety Case belongs to the Member States, as it covers more than just ANSP operations. In this respect, the BLUE MED States, through the arrangements described herein, the State Level Agreement (SLA), the NSA Agreement and the FAB

3.3) will have the responsibility to maintain and update it so as to remain valid. In doing so, due regard must be given to the States’ Safety Plans required by ICAO, to which the actions

the establishment of acceptable levels

European Commission Guidance Material for the establishment and modification of Functional Airspace Blocks (FAB) Ver.1.0, dated


3 REGULATORY REQUIREME

• (EU) 176/2011: “Information to be provided before the establishment and modification of a

functional airspace block”

• (EC) No 1070/2009 “Amending Regulations (EC) No 549/2004, (EC)

551/2004 and (EC) No 552/2004 in order to improve the performance and sustainability of the

European aviation system

• (EU) 1034/2011: “on safety oversight in air traffic management and air navigation services and

amending Regulation (EU) No 691/2010”

• (EU) No 1035/2011: “laying down common requirements for the provision of air navigation

services and amending Regulations (EC) No 482/2008 and (EU) No 691/2010”.

4 SCOPE - OPERATIONAL CONCEPT

The geographical area under scope is the airspac

upper information regions (UIR) entrusted to the Member States by the ICAO Regional Air Navigation

Agreements, as identified hereunder:

• Athinai FIR;

• Hellas UIR;

• Nicosia FIR/UIR;

• Milan FIR/UIR;

• Rome FIR/ UIR;

• Brindisi FIR/UIR; and

• Malta FIR/UIR.

Those parts of the above listed FIR/UIR that do not form part of the FAB are listed

BLUE MED State Level Agreement.

The proposed BLUE MED operational concept is as described in the

Concept of Operations D1.1a Version 1.3, dated 10 Feb. 2010

D1.1b Version 1.0, dated Jan. 2011



REGULATORY REQUIREMENTS

Information to be provided before the establishment and modification of a

functional airspace block”

Amending Regulations (EC) No 549/2004, (EC) No 550/2004, (EC) No


European aviation system”

(EU) 1034/2011: “on safety oversight in air traffic management and air navigation services and

EU) No 691/2010”

(EU) No 1035/2011: “laying down common requirements for the provision of air navigation


OPERATIONAL CONCEPT

The geographical area under scope is the airspace of the flight information regions (FIR) as well as


Agreements, as identified hereunder:

Athinai FIR;

Hellas UIR;

Nicosia FIR/UIR;

Milan FIR/UIR;

FIR/ UIR;

Brindisi FIR/UIR; and

Malta FIR/UIR.

Those parts of the above listed FIR/UIR that do not form part of the FAB are listed

State Level Agreement.

The proposed BLUE MED operational concept is as described in the deliverables titled “

Concept of Operations D1.1a Version 1.3, dated 10 Feb. 2010” and “Detailed Concept of Operations

D1.1b Version 1.0, dated Jan. 2011”.

of 31

Information to be provided before the establishment and modification of a

No 550/2004, (EC) No


(EU) 1034/2011: “on safety oversight in air traffic management and air navigation services and

(EU) No 1035/2011: “laying down common requirements for the provision of air navigation


e of the flight information regions (FIR) as well as


Those parts of the above listed FIR/UIR that do not form part of the FAB are listed in Annex 1of the

deliverables titled “BLUE MED

Detailed Concept of Operations


of 31

5 DEFINITIONS

“Aerospace Performance Factor using multiple localized safety measures, e.g. reported incidents, causal factors, or other operational factors or constraints etc., weighted by subject moperations. The weighting may be

“Analytic Hierarchy Processing complex decisions, based on mathematicsgroup decision making.

“Air Traffic Management – ATM”(air traffic services, airspace management andand efficient movement of aircraft during all phases of operations.

“Change” means the application of any activity or system element that has not previously been part of the design envelope, normal operating environment or procedures of the organisation.

“Failure Case” means the demonstration (by arguments) that an ATM system will be acceptably safe, taking into account of the possibility of failures.

“Functional System” means a combination of systems, procedures and human resources organised to perform a function within the context of the ATM.

.

“Success Case” means the demonstration (by arguments) that an ATM system has sufficient functionality and performance for it to be acceptably safe in the absence of failure.

“Safety Case”: A comprehensive document containing the safety arguments, supporting evidence and implementation plan, demonstrating that a proposed change to an ATM system can be put intacceptably safe.

For any other terms used in this report, the definitions of (EC) 1070/2009 and (EC) 1315/2007 apply.



“Aerospace Performance Factor – APF” an approach to the measurement of safety performance using multiple localized safety measures, e.g. reported incidents, causal factors, or other operational factors or constraints etc., weighted by subject matter expert judgment, and normalized against system

may be achieved by the use of analytical hierarchy processing (AHP).

“Analytic Hierarchy Processing – AHP” is a structured technique for organizing and analyzing mathematics and subjective judgement, with particular application in

ATM” means the aggregation of the airborne and ground(air traffic services, airspace management and air traffic flow management) required to ensure the safe and efficient movement of aircraft during all phases of operations.

means the application of any activity or system element that has not previously been part of operating environment or procedures of the organisation.

means the demonstration (by arguments) that an ATM system will be acceptably safe, taking into account of the possibility of failures.

means a combination of systems, procedures and human resources organised to perform a function within the context of the ATM.

means the demonstration (by arguments) that an ATM system has sufficient performance for it to be acceptably safe in the absence of failure.

: A comprehensive document containing the safety arguments, supporting evidence and implementation plan, demonstrating that a proposed change to an ATM system can be put int


an approach to the measurement of safety performance using multiple localized safety measures, e.g. reported incidents, causal factors, or other operational

atter expert judgment, and normalized against system ical hierarchy processing (AHP).

is a structured technique for organizing and analyzing and subjective judgement, with particular application in

means the aggregation of the airborne and ground-based functions air traffic flow management) required to ensure the safe

means the application of any activity or system element that has not previously been part of operating environment or procedures of the organisation.

means the demonstration (by arguments) that an ATM system will be acceptably safe,

means a combination of systems, procedures and human resources

means the demonstration (by arguments) that an ATM system has sufficient

: A comprehensive document containing the safety arguments, supporting evidence and implementation plan, demonstrating that a proposed change to an ATM system can be put into service



6 RATIONALE FOR THE FAJUSTIFICATION)

The BLUE MED FAB is a response to regulatory requirements asuniform level of air navigation services in the central and east Mediterranean basin.

7 ASSUMPTIONS

• The Safety Case applies to the four EU States of BLUE MED (Cyprus, Greece Italy and

Malta), in which the SES

NSAs responsible for safety oversight and duly certified ANSPs which provide service within

the FAB in accordance with the SES regulations.

• All the planned operational/technical changes will

safety cases/assessments.

• The BLUE MED FAB will be initially developed, deployed and operated according to the

proposed BLUE MED operational concept (described in the deliverables titled “

Concept of Operations

Operations D1.1b Version 1.0, dated Jan. 2011

close cooperation between

harmonised processes for safety management.

• The deliverables of other Work Packages (particularly WP1, WP2 and WP6) are

sources of information with respect to the identification of

FAB.



RATIONALE FOR THE FAB IMPLEMENTATION (SA

The BLUE MED FAB is a response to regulatory requirements as well as an operational vision for a uniform level of air navigation services in the central and east Mediterranean basin.

The Safety Case applies to the four EU States of BLUE MED (Cyprus, Greece Italy and

in which the SES regulations are complied with. The four States have established


the FAB in accordance with the SES regulations.

All the planned operational/technical changes will be implemented and supported by local


The BLUE MED FAB will be initially developed, deployed and operated according to the

proposed BLUE MED operational concept (described in the deliverables titled “

Concept of Operations D1.1a Version 1.3, dated 10 Feb. 2010” and “

Operations D1.1b Version 1.0, dated Jan. 2011”). The operational concept foresees the

close cooperation between ANSPs for the coordinated implementation of changes, including

esses for safety management.

The deliverables of other Work Packages (particularly WP1, WP2 and WP6) are

of information with respect to the identification of the foreseen ATM

of 31

B IMPLEMENTATION (SAFETY CASE

well as an operational vision for a uniform level of air navigation services in the central and east Mediterranean basin.

The Safety Case applies to the four EU States of BLUE MED (Cyprus, Greece Italy and

regulations are complied with. The four States have established


be implemented and supported by local

The BLUE MED FAB will be initially developed, deployed and operated according to the

proposed BLUE MED operational concept (described in the deliverables titled “BLUE MED

” and “Detailed Concept of

. The operational concept foresees the

ANSPs for the coordinated implementation of changes, including

The deliverables of other Work Packages (particularly WP1, WP2 and WP6) are appropriate

the foreseen ATM changes in the


of 31

8 SAFETY RELATED ORGAN

The primary organizational arrangements foreseen to comply with the safety related requirements of

the FAB IR are,

• the BLUE MED NSA Committee

• the BLUE MED ANSP Safety Coordination Group

The NSA Committee will have the overall responsibilit

oversight requirements of the BLUE MED Safety Case

assigned to it. This Committee will answer directly to the BLUE MED Governing Board, which is the

highest level of Governance in the FAB. Further details on the workings of this Committee are included

in the BLUE MED NSA Agreement, as well as the FAB State Level Agreement.

The BLUE MED ANSP Safety Coordination Group

review, manage and monitor the

requirements of the FAB IR). Membership to the Group will primarily be from the BLUE MED ANSP

SMS units e.g. BLUE MED ANSPs’ Safety manage

to the ANSP and Safety Committees of BLUE MED. The group will also make use of operations and

engineering expertise from the ANSPs whenever deemed required for the FAB safety activities. ANSPs

shall endeavor to keep the membership consistent (at least in the initial period) to ensure harmonisation

and cohesion. Further details on the workings of this group are included in

Further to the above, and in accordance with Article 20,

BLUE MED Sate Level Agreement, the BLUE MED Governing Board can “set up Committees…and

working groups…to assist it in specific matters and approve the proposals of the Committees and

working groups”. In this respect, one additional organizational arrangement could be the setting up of a

BLUE MED State Safety Sub-

regulatory/oversight and ANSP’s organisations (including Military ANSPs, if deemed necess

would have the overall responsibility for maintaining the BLUE MED Safety Case.

sub-committee could be supporting



SAFETY RELATED ORGANISATIONAL ARRANGEMENTS


BLUE MED NSA Committee.

BLUE MED ANSP Safety Coordination Group,

The NSA Committee will have the overall responsibility for overseeing the implementation of

oversight requirements of the BLUE MED Safety Case, and the direct responsibility over the task

. This Committee will answer directly to the BLUE MED Governing Board, which is the

el of Governance in the FAB. Further details on the workings of this Committee are included

in the BLUE MED NSA Agreement, as well as the FAB State Level Agreement.

Safety Coordination Group will have ToRs and responsibilities and will

review, manage and monitor the BLUE MED FAB SMS Roadmap (which covers the ANSP related


SMS units e.g. BLUE MED ANSPs’ Safety managers or their appointed representatives and will report



eavor to keep the membership consistent (at least in the initial period) to ensure harmonisation

. Further details on the workings of this group are included in D3.3 - FAB SMS Roadmap

Further to the above, and in accordance with Article 20, “Competencies of the Governing Board” of the



pect, one additional organizational arrangement could be the setting up of a

-Committee which could include representatives from the State’s

regulatory/oversight and ANSP’s organisations (including Military ANSPs, if deemed necess

have the overall responsibility for maintaining the BLUE MED Safety Case.

supporting the NSAC on specific issues of safety.

ARRANGEMENTS


the implementation of the safety

, and the direct responsibility over the tasks

. This Committee will answer directly to the BLUE MED Governing Board, which is the

el of Governance in the FAB. Further details on the workings of this Committee are included

and responsibilities and will

(which covers the ANSP related


rs or their appointed representatives and will report



eavor to keep the membership consistent (at least in the initial period) to ensure harmonisation

FAB SMS Roadmap.

“Competencies of the Governing Board” of the



pect, one additional organizational arrangement could be the setting up of a

representatives from the State’s

regulatory/oversight and ANSP’s organisations (including Military ANSPs, if deemed necessary) and

have the overall responsibility for maintaining the BLUE MED Safety Case. Furthermore, this


The organizational chart

Figure 1: BLUE MED FAB Safety organisational arrangements (with respect to safety)

BLUE MED States Safety sub

(Comprises representatives of both the

NSA and ANSP Committees

reporting lines to be defined by the

Governing Body)

BLUE MED NSA

Committee



The organizational chart below summarizes these arrangements

BLUE MED FAB Safety organisational arrangements (with respect to safety)

BLUE MED FAB

Governing Board

BLUE MED States Safety sub‐committee

Comprises representatives of both the

NSA and ANSP Committees. ToRs and

reporting lines to be defined by the

)

BLUE MED NSA BLUE MED ANSP

Committee

BLUE MED ANSP

Safety Coordination

Group

BLUE MED Civil

Coordination

of 31

summarizes these arrangements:

BLUE MED FAB Safety organisational arrangements (with respect to safety)

BLUE MED ANSP

Safety Coordination

BLUE MED Civil ‐

Military

Coordination Group


of 31

9 ACCEPTABILITY OF THE

A Safety Case is deemed acceptable when it meets a number of prean overall safety claim (i.e. in this case, that the BLUE MED FAB will be moment of delivering the Safety Case, the following cav

• The BLUE MED FAB is not yet established.

• There is no unique BLUE MED NSA

• There is no common FAB SMS implemented accepted by the concerned NSAs (albeit one is planned, with a clear rimplementation)

• Consequently, there are no formal, commonly defined acceptability criteria for the FAB Safety Case, other than those mandated by the FAB Implementing Rule.

In view of the above, the criterion for acceptability of the BLUE MED SC

• SCr1: The FAB Reporting

The safety arguments elaborated in the following pages satisfy this criterion.

2 COMMISSION REGULATION (EU) No 176/2011

establishment and modification of a functional airspace block



ACCEPTABILITY OF THE FAB SAFETY CASE

A Safety Case is deemed acceptable when it meets a number of pre-set criteria, which, in turn support (i.e. in this case, that the BLUE MED FAB will be acceptably

moment of delivering the Safety Case, the following caveats hold true:

The BLUE MED FAB is not yet established.

There is no unique BLUE MED NSA or BLUE MED ANSP.

There is no common FAB SMS implemented by the concerned ANSPs accepted by the concerned NSAs (albeit one is planned, with a clear r

Consequently, there are no formal, commonly defined acceptability criteria for the FAB Safety Case, other than those mandated by the FAB Implementing Rule.

In view of the above, the criterion for acceptability of the BLUE MED SC is:

Reporting IR2 regulatory requirements are complied with

The safety arguments elaborated in the following pages satisfy this criterion.

COMMISSION REGULATION (EU) No 176/2011 of 24 February 2011 on the information to be provided before the

establishment and modification of a functional airspace block

set criteria, which, in turn support acceptably safe). At the

by the concerned ANSPs and subsequently accepted by the concerned NSAs (albeit one is planned, with a clear roadmap for

Consequently, there are no formal, commonly defined acceptability criteria for the FAB Safety

regulatory requirements are complied with

on the information to be provided before the


10 BLUE MED FAB INITIAL

The figure below shows the initial safety argument the basic arguments for safety in BLUE MED.

Figure 2:

The top level claim (Arg0) is decomposed into three principal Structured Notation (GSN)3 convention. The essence of this approach towards making a case is that an argument can only be considered to be true if each of the sub

3 GSN was originally developed by the University of York in the safety argument (requirements, claims, evidence and context) and (perhaps more significantly) the relationships that exist beelements (i.e. how individual requirements arcontext (environment) that is defined for the argument).EUROCONTROL in its Safety Assessment Methodolog

ACCEPTABILITY CRITERIA

Cr1 : The (EU) 176/2011 safety

regulatory requirements are

complied with

JUSTIFICATION 01:

FAB creation is both an

operational and a regulatory

requirement (SES I and SES II)

Arg. 1:

Safety Culture will be

developed

Str1.1

Provide direct and backing

evidence by means of

FAB Safety Policy, safety

culture surveys and after

care improvements that a

positive safety culture is

created, cultivated,

monitored and improved

in all the FAB



BLUE MED FAB INITIAL SAFETY ARGUMENT

The figure below shows the initial safety argument for the FAB, which presents, in graphical form the basic arguments for safety in BLUE MED.

Figure 2: BLUE MED Initial safety argument

) is decomposed into three principal Safety Arguments, using the Goal convention. The essence of this approach towards making a case is that an

argument can only be considered to be true if each of the sub-arguments is shown to be true.

GSN was originally developed by the University of York in the late 90s, as a graphical representation of the individual elements of any safety argument (requirements, claims, evidence and context) and (perhaps more significantly) the relationships that exist beelements (i.e. how individual requirements are supported by specific claims, how claims are supported by evidence and the assumed context (environment) that is defined for the argument). In ATM industry, the GSN has been further developed and adopted by EUROCONTROL in its Safety Assessment Methodology and Safety Case Development Manual.

OVERALL CLAIM (Arg 0):The FAB will be implemented

in a manner which is

acceptably safe

Arg. 2:

Safety will be managed

St00:

Demonstrate that safety is achieved

by success in three main pillars:

Safety Culture, Safety Management

and safety oversight, providing direct

and backing evidence that safety is

addressed as required

Str2.1


evidence that accidents and

incidents will be duly

investigated, safety

performance monitored,

safety targets set and that

the risks associated with

operational changes will be

managed in all the FAB

Safety Culture will be

developed


evidence by means of A

safety

culture surveys and after

care improvements that a

afety culture is

monitored and improved

of 31

for the FAB, which presents, in graphical form

Safety Arguments, using the Goal convention. The essence of this approach towards making a case is that an

arguments is shown to be true.

late 90s, as a graphical representation of the individual elements of any safety argument (requirements, claims, evidence and context) and (perhaps more significantly) the relationships that exist between these

e supported by specific claims, how claims are supported by evidence and the assumed In ATM industry, the GSN has been further developed and adopted by

Arg. 3:

Safety oversight on ATM/

ANS will be provided in a

coordinated manner

Str3.1


evidence that safety

oversight will be provided

to the FAB, in a

harmonised manner,

through the enhanced

cooperation of the BLUE

MED NSAs

CONTEXT:

‐ Current operations are

acceptably safe

‐ SES I / II requirements

‐ BM Concept of operations

ASSUMPTIONS:

The BLUE MED FAB will be established, at the

latest, by the 4th

of December 2012.

All the planned operational/technical changes

will be implemented and supported by local


Additional assumptions as per Section 7


of 31

10.1 Safety arguments decompositio

The three principal arguments and any subevidences supporting the arguments will be collected in time, enhancing the validity of the SC.

10.1.1 Safety Culture

Arg1 asserts that BLUE MED FAB will operate exists and which will be continuously environment and it will convey the values, commitments and the way forward the FAB. According to the FAB SMS Roadmap, this is planned for establishment), when it will be the FAB Safety Policy has already been prepared and it is included in

The FAB safety culture will be monitored and further developedEUROCONTROL has already developed the process for such a survey for ANSPs, althoughtime of writing), it is intended mainly for application at naalready undertaken this survey, nevertheless, a FAB wide survey will need some modification to the original to take into account and address the safety requirements at State level (e.g. well as regional and national differences. When a suitable survey has been designed, preferably at pan-european or FAB level, then BLUE MED will or further improvements in its environment. Until such time the safety culturachieved by individual ANSPs measurements and after care improvement plans.

Further to the above, due consideration will be given to developments with regards to the just culture arrangements foreseen in the SES II ATM performance scdevelopments during RP1 and will adjust its National Performance Plans (or FAB Performance Plans, if deemed necessary) to include such actions that will ensure that just culture exists and is implemented in the FAB.



Safety arguments decomposition

and any sub-arguments thereof support the overall safety claim. The evidences supporting the arguments will be collected in time, enhancing the validity of the SC.

asserts that BLUE MED FAB will operate in an environment where an underlying safety culture exists and which will be continuously developed. A FAB Safety Policy, will set the framework of this environment and it will convey the values, commitments and the way forward

FAB. According to the FAB SMS Roadmap, this is planned for 2012 (or in ), when it will be endorsed at BLUE MED Governing Board level. A provisional text for

the FAB Safety Policy has already been prepared and it is included in Annex 1.

safety culture will be monitored and further developed by means of sEUROCONTROL has already developed the process for such a survey for ANSPs, although

, it is intended mainly for application at national level. Some BLUE MED ANSPs have already undertaken this survey, nevertheless, a FAB wide survey will need some modification to the original to take into account and address the safety requirements at State level (e.g.

and national differences. When a suitable survey has been designed, preferably at european or FAB level, then BLUE MED will perform it and use its outcome to make corrections

or further improvements in its environment. Until such time the safety culture in BLUE MED by individual ANSPs measurements and after care improvement plans.

Further to the above, due consideration will be given to developments with regards to the just culture arrangements foreseen in the SES II ATM performance scheme. BLUE MED FAB will monitor developments during RP1 and will adjust its National Performance Plans (or FAB Performance Plans, if deemed necessary) to include such actions that will ensure that just culture exists and is

support the overall safety claim. The evidences supporting the arguments will be collected in time, enhancing the validity of the SC.

in an environment where an underlying safety culture . A FAB Safety Policy, will set the framework of this

for ensuring safety in 2012 (or in Year 1 of FAB

endorsed at BLUE MED Governing Board level. A provisional text for

by means of specific surveys. EUROCONTROL has already developed the process for such a survey for ANSPs, although (at the

tional level. Some BLUE MED ANSPs have already undertaken this survey, nevertheless, a FAB wide survey will need some modification to the original to take into account and address the safety requirements at State level (e.g. oversight) as

and national differences. When a suitable survey has been designed, preferably at it and use its outcome to make corrections

in BLUE MED will be by individual ANSPs measurements and after care improvement plans.

Further to the above, due consideration will be given to developments with regards to the just culture heme. BLUE MED FAB will monitor these

developments during RP1 and will adjust its National Performance Plans (or FAB Performance Plans, if deemed necessary) to include such actions that will ensure that just culture exists and is


10.1.2 Safety will be managed

Arg2 asserts that BLUE MED FAB will operate in an environment where both in a proactive and a reactive manner. In this respect, investigated (both at State and ANSP level)set and the risks associated with operational changes will be managed.

Arg2.1 asserts that accidents and incidents will be duly investigatedcan be sub-divided into two domains: the State domain, where accidents and serious incidents are normally investigated, and the ANSP domain, where less serto prevent any degradation from the high safety standards ANSPs like to retain.



Safety will be managed

asserts that BLUE MED FAB will operate in an environment where safety will be managed, both in a proactive and a reactive manner. In this respect, accidents and incidents will be duly investigated (both at State and ANSP level), FAB-wide safety performance monitored, safety targets set and the risks associated with operational changes will be managed.

Figure 3: BLUE MED Safety Arg. 2

asserts that accidents and incidents will be duly investigated. This very important safety activity divided into two domains: the State domain, where accidents and serious incidents are

normally investigated, and the ANSP domain, where less serious incidents are also to prevent any degradation from the high safety standards ANSPs like to retain.

of 31

safety will be managed, accidents and incidents will be duly

wide safety performance monitored, safety targets

. This very important safety activity divided into two domains: the State domain, where accidents and serious incidents are

also investigated so as


of 31

With regards to the State domain, the accident and serious incident investigation and the associated safety data collection, analysis and996/2010. The independent Accident Investigation Boardsoperate in an enhanced cooperation model, in accordance with Agreement (included in Annex 4 of this report for readability purposes).

With regards to incident investigation in the ANSP domain, the following actions have been planned in the BM FAB SMS roadmap:

In Year 1 of FAB establishment

• A common investigation process will

guidelines on ATM Occurrence Investigation.

• Harmonisation of national occurrence reporting and investigation processes shall begin,

agreeing, as a minimum, on the output

• Implementation of the Risk Analysis Tool (RAT) in the national occurrence investigation

processes.

• Agreement on a common

investigation results in a commonly accessible repository

EUROCONTROL TOKAI -

• Sharing within the FAB their (national) lesson dissemination material (e.g. safety bulletins)

Year 2 of FAB establishment

• Harmonisation of national SM

continue, aiming (in so far as practicable

Arg2.2 asserts that the FAB Safety Performance will be monitored and managed.this is, as per the regulatory requirement, functional airspace block. BLUE MED D3.3 in its entirety provides a roadmap with specific actions designed to achieve this goal. Particul

• A FAB-wide safety monitoring process shall be agreed (inputs and outputs as a minimum).

Adoption of common tools will be



With regards to the State domain, the accident and serious incident investigation and the associated is and exchange, will be conducted in accordance with Regulation (EU) Accident Investigation Boards of the BLUE MED States concerned, will

operate in an enhanced cooperation model, in accordance with Article 26 (included in Annex 4 of this report for readability purposes).

With regards to incident investigation in the ANSP domain, the following actions have been planned in

In Year 1 of FAB establishment:

common investigation process will be set-up and it will be based on the EUROCONTROL

guidelines on ATM Occurrence Investigation.

Harmonisation of national occurrence reporting and investigation processes shall begin,

on the output of the processes.

the Risk Analysis Tool (RAT) in the national occurrence investigation

common method of archiving FAB relevant safety occurrences and

investigation results in a commonly accessible repository (e.g. through the use of

- Tool Kit for ATM Occurrence Investigation)

Sharing within the FAB their (national) lesson dissemination material (e.g. safety bulletins)

Year 2 of FAB establishment (2013):

Harmonisation of national SMS process for occurrence reporting and investigation will

in so far as practicable) towards a unique occurrence reporting form.

asserts that the FAB Safety Performance will be monitored and managed.this is, as per the regulatory requirement, to avoid any degradation in safety performance within the

. BLUE MED D3.3 in its entirety provides a roadmap with specific actions achieve this goal. Particularly for safety performance, the following are foreseen:

wide safety monitoring process shall be agreed (inputs and outputs as a minimum).

Adoption of common tools will be recommended (e.g. APF);

With regards to the State domain, the accident and serious incident investigation and the associated in accordance with Regulation (EU)

of the BLUE MED States concerned, will of the State Level

With regards to incident investigation in the ANSP domain, the following actions have been planned in

be based on the EUROCONTROL

Harmonisation of national occurrence reporting and investigation processes shall begin,

the Risk Analysis Tool (RAT) in the national occurrence investigation

FAB relevant safety occurrences and

through the use of ECCAIRS or

Sharing within the FAB their (national) lesson dissemination material (e.g. safety bulletins)

S process for occurrence reporting and investigation will

reporting form.

asserts that the FAB Safety Performance will be monitored and managed. The intention of degradation in safety performance within the

. BLUE MED D3.3 in its entirety provides a roadmap with specific actions arly for safety performance, the following are foreseen:

wide safety monitoring process shall be agreed (inputs and outputs as a minimum).


• SES II compliant leading indicators

safety management) and appropriate targets

pan-European ones which are expected

• The effectiveness of safety management sha

methodology developed by EASA.

• FAB wide safety maturity will be assessed

European level by EASA.

Arg2.3 asserts that FAB safety targets will be set.arrangements for clearly identifying and allocating thethe setting of safety targets, the following are foreseen:


• A bi-annual FAB Safety Pro

(starting from the end of 2012), detailing specific FAB

associated with measurable safety targets

• The BLUE MED ANSPs shall relate and align the

individual designated ANSP Safety Plans to

performance targets.


• The top 5 safety concerns/risks in

expert judgment and, subsequently, complemented by data.

• SES II compliant FAB-wide

identified as well as the ones defined in future SES regul

• Safety targets for the FAB shall be proposed

Governance for formal adoption

be set by the EC in the framework of the Performance IR.

• Additional tools e.g. ASMT Automatic Safety Monitoring Tool for Safety Performance

Monitoring may be considered for adoption, initially at ANSP level and then at FAB level.

4 A safety target for the ANSP safety maturity has already been set through the endorsement of D3.3

MED Governing Body (At least Level 3 by end of 2014 for all ANSPs and Level 4 for all AN



SES II compliant leading indicators for RP1 will be de facto adopted (e.g. effectiveness of

and appropriate targets will be set. These will be further updated

which are expected to be set by the EC for RP2 (2014-

The effectiveness of safety management shall be measured, on an annual basis, by a

developed by EASA. .

FAB wide safety maturity will be assessed using the method agreed and developed at pan

asserts that FAB safety targets will be set. According to D3.3, wclearly identifying and allocating the responsibilities and interfaces with relation to

the setting of safety targets, the following are foreseen:

In Year 1 of FAB establishment (2012):

FAB Safety Programme will be produced at the last quarter of every second year

(starting from the end of 2012), detailing specific FAB-wide safety activities (e.g. surveys)

with measurable safety targets.

ANSPs shall relate and align the BLUE MED FAB Safety Programme

ANSP Safety Plans to ensure consistency with

of FAB establishment (2013):

The top 5 safety concerns/risks in BLUE MED FAB shall be established, based initially on

expert judgment and, subsequently, complemented by data.

wide lagging indicators shall be established, based on the key risk areas

as well as the ones defined in future SES regulations.

Safety targets for the FAB shall be proposed by NSAC to the BLUE MED high level

for formal adoption4. These will be aligned with future pan-European ones that might

be set by the EC in the framework of the Performance IR.

s e.g. ASMT Automatic Safety Monitoring Tool for Safety Performance

be considered for adoption, initially at ANSP level and then at FAB level.

A safety target for the ANSP safety maturity has already been set through the endorsement of D3.3 – FAB SMS Roadmap by the BLUE

At least Level 3 by end of 2014 for all ANSPs and Level 4 for all ANSPs by end of 2019

of 31

(e.g. effectiveness of

further updated with the

-2016).

ll be measured, on an annual basis, by a

method agreed and developed at pan-

D3.3, with regards to the responsibilities and interfaces with relation to

will be produced at the last quarter of every second year

wide safety activities (e.g. surveys)

Safety Programme with

ensure consistency with individual safety

FAB shall be established, based initially on

indicators shall be established, based on the key risk areas

BLUE MED high level

European ones that might

s e.g. ASMT Automatic Safety Monitoring Tool for Safety Performance

be considered for adoption, initially at ANSP level and then at FAB level.

FAB SMS Roadmap by the BLUE

SPs by end of 2019 )


of 31

• BLUE MED FAB safety performance will be further analysed, enhanced and aggregated, based

on input from all BLUE MED

indicators (based on the possible

Aerospace Performance Factor)

Arg2.4 asserts that operational changes will be safety assessed.ANSPs already perform the safety assessment of each change to the ATM Functional System as per the procedures accepted by the respective NSAs. Roadmap) contains an action plan on how the safety assessment processes of BLUE MED ANSPs will be harmonised. Finally, in Annex changes is included, containing a list of identified hazards and associated mitigations.

Arg2.5 asserts that FAB-wideFAB Safety Case (Part B: Beyond regulatory requirements)associated with the common implementation if implemented in the framework of the FAB. This is because the risks assessed by each BLUE MED ANSP individually can be more effectively mitigFAB framework and which act as additional safety barrier to hazards.demonstration of this sub-argument

10.1.3 Safety Oversight

The Blue Med NSAs have already in place a SES regulation compliant oversight system. In addition to this, Arg 3 asserts that manner by the NSA Committee, in the framework foreseen in the State Leaccordance with the BLUE MED



safety performance will be further analysed, enhanced and aggregated, based

BLUE MED designated ANSPs through a combination of leading and lagging

possible adoption of AHP - Analytical Hierarchy Process and APF

Aerospace Performance Factor)

asserts that operational changes will be safety assessed. As a result of certification process, ANSPs already perform the safety assessment of each change to the ATM Functional System as

accepted by the respective NSAs. Furthermore, BLUE MED D3.3) contains an action plan on how the safety assessment processes of BLUE MED ANSPs

will be harmonised. Finally, in Annex 2 of this SC an initial high level risk assessment of plan, containing a list of identified hazards and associated mitigations.

wide changes will be introduced with reduced risks. FAB Safety Case (Part B: Beyond regulatory requirements) demonstrates

common implementation of changes to the ATM functional systemif implemented in the framework of the FAB. This is because the risks assessed by each BLUE MED ANSP individually can be more effectively mitigated through the synergies that are possible in the FAB framework and which act as additional safety barrier to hazards. See D3.2 for an elaborate

argument.

The Blue Med NSAs have already in place a SES regulation compliant oversight system. In asserts that the safety of BLUE MED FAB will be overseen in a coordinated

manner by the NSA Committee, in the framework foreseen in the State Level FAB Agreement and in NSA Agreement.

safety performance will be further analysed, enhanced and aggregated, based

ANSPs through a combination of leading and lagging

Analytical Hierarchy Process and APF –

As a result of certification process, ANSPs already perform the safety assessment of each change to the ATM Functional System as

BLUE MED D3.3 (FAB SMS ) contains an action plan on how the safety assessment processes of BLUE MED ANSPs

assessment of planned , containing a list of identified hazards and associated mitigations.

D3.2b – BLUE MED demonstrates that the risks

of changes to the ATM functional systems will be lower if implemented in the framework of the FAB. This is because the risks assessed by each BLUE MED

ated through the synergies that are possible in the See D3.2 for an elaborate

The Blue Med NSAs have already in place a SES regulation compliant oversight system. In will be overseen in a coordinated

vel FAB Agreement and in


11 SUMMARY – REGULATORY COMPLIANC

The table below presents, at a glancesafety related reporting requirements of (EU) 176references to other BLUE MED documents and the safety arguments from the previous pages.

Ref (EU) 176/2011 requirement

(Annex, Part 2)

With regard to the functional airspace block safety case,

R1 (a) The common safety policy or plans to establish a common safety policy

R2 (b) A description of the arrangements with accident and incidentplans on how to address safety data collection, analysis and exchange;

R3 (c) A description of the system in place or planned to avoiddegradation in safety performance within the functional airspace block;

R4 (d) A description of the arrangements clearly identifying and allocating theand interfaces with relation to the setting of safety targets, safety oversight and the accompanying enforcement measures in regard to the provision of air navigation services within the functional airspace block;

R5 (e) Documentation and/or statements that the safety assessment including hazardidentification, risk assessment and mitigation has been conducted beforeoperational changes resulting from the establishment or modification of the functional airspace block;



REGULATORY COMPLIANCE MATRIX

at a glance, a summary as to how the BLUE MED FAB conforms to the requirements of (EU) 176/2011. It should be noted that the table contains cross

references to other BLUE MED documents and the safety arguments from the previous pages.

(EU) 176/2011 requirement

(Annex, Part 2)

Safety

Argument

Backing

evidence

functional airspace block safety case, the following information is hereby

The common safety policy or plans to establish a common safety policy

Arg. 1 D3.3 – FAB SMS Roadmap, 7.1

(b) A description of the arrangements dealing with accident and incident investigation and plans on how to address safety data collection,

Arg. 2.1 FAB State Level FAB Agreement Article26 D3.3 – FAB SMS Roadmap 7.4, 7.8, 8.7

(c) A description of the safety management system in place or planned to avoid degradation in safety performance within the

Arg. 2.2 D3.3 – FAB SMS

Roadmap 7.6, 7.7,

8.2, 8.7

(d) A description of the arrangements clearly allocating the responsibilities

and interfaces with relation to the setting of safety oversight and the

accompanying enforcement measures in regard provision of air navigation services within

the functional airspace block;

Arg. 2.3

Arg. 3

D3.3 – FAB SMS Roadmap 7.7, 8.2 NSA Agreement

(e) Documentation and/or statements that the safety assessment including hazard identification, risk assessment and mitigation has been conducted before introducing

resulting from the modification of the functional

Arg. 2.4 D3.2 (this document), Part B and Annex 2

of 31

to how the BLUE MED FAB conforms to the . It should be noted that the table contains cross

references to other BLUE MED documents and the safety arguments from the previous pages.

Backing

evidence

COMMENT

the following information is hereby provided:

FAB SMS Roadmap, 7.1

COMPLIANT

FAB State Level FAB Agreement

+ FAB SMS

Roadmap 7.4, 7.8,

COMPLIANT

FAB SMS

Roadmap 7.6, 7.7,

COMPLIANT

FAB SMS Roadmap 7.7, 8.2

NSA Agreement

COMPLIANT

D3.2 (this document), Part B and Annex 2

COMPLIANT


of 31

12 OVERALL SAFETY CASE

The arguments elaborated in the previous sections can be summarised as

• The Safety Regulatory requirements in relation to the FABs will be met,

• The safety in the FAB will be cultivated, developed, effectively managed and overseen,

• FAB relevant ATM/ANS changes will be further assessed prior to actual implementation,

case by case basis, in accordance with a defined and documented process.

Hence, the FAB can be implemented in a manner which is acceptably safe.



OVERALL SAFETY CASE CONCLUSIONS

The arguments elaborated in the previous sections can be summarised as follows:

The Safety Regulatory requirements in relation to the FABs will be met,

The safety in the FAB will be cultivated, developed, effectively managed and overseen,

FAB relevant ATM/ANS changes will be further assessed prior to actual implementation,



The safety in the FAB will be cultivated, developed, effectively managed and overseen,

FAB relevant ATM/ANS changes will be further assessed prior to actual implementation, on a




ANNEX 1 -

States commitment to Safety

In order for the BLUE MED FAB to contribute effectively to the overall Pan

the States of Cyprus, Greece, Italy and Malta will:

• jointly designated ANSPs to operate the FAB with the goal to increase Safety levels,

• give the responsibility to their NSAs

efficient oversight of the FAB, thus ensuring continuous improvements of safety;

• define responsibilities and accountabilities with their relevant Accident Investigation Boards as

well as the required safety data flows; and

• take initiatives to promote and continuously improve a common safety culture.

NSAs engagement for Safety

In order to ensure enhanced regulation and oversight of the BLUE MED FAB, the NSAs of Cyprus,

Greece, Italy and Malta will:

• make appropriate arrangements and commit the necessary resources to ensure the effective

safety oversight of the designated ANSPs ; and

• develop the necessary interfaces with the designated ANSPs.

ANSPs active contribution to Safety achievement

In order to ensure the required uniform safety standards within the FAB, ANSPs of BLUE MED will:

• commit on give safety the highest priority in delivering their services

• engage in the integration of their safety management system to ultimately design build and

maintain the FAB SMS;

• identify, co-ordinate, deploy and monitor



PROPOSED BLUE MED SAFETY POLICY

FAB to contribute effectively to the overall Pan-European Air traffic Safety,

the States of Cyprus, Greece, Italy and Malta will:

jointly designated ANSPs to operate the FAB with the goal to increase Safety levels,

give the responsibility to their NSAs to develop their own arrangements so as to ensure


define responsibilities and accountabilities with their relevant Accident Investigation Boards as

ty data flows; and

take initiatives to promote and continuously improve a common safety culture.

regulation and oversight of the BLUE MED FAB, the NSAs of Cyprus,

ppropriate arrangements and commit the necessary resources to ensure the effective

safety oversight of the designated ANSPs ; and

develop the necessary interfaces with the designated ANSPs.

ANSPs active contribution to Safety achievement

ure the required uniform safety standards within the FAB, ANSPs of BLUE MED will:

commit on give safety the highest priority in delivering their services

engage in the integration of their safety management system to ultimately design build and

ordinate, deploy and monitor common safety improvements

of 31

FETY POLICY

European Air traffic Safety,

jointly designated ANSPs to operate the FAB with the goal to increase Safety levels,

to develop their own arrangements so as to ensure


define responsibilities and accountabilities with their relevant Accident Investigation Boards as

take initiatives to promote and continuously improve a common safety culture.

regulation and oversight of the BLUE MED FAB, the NSAs of Cyprus,

ppropriate arrangements and commit the necessary resources to ensure the effective

ure the required uniform safety standards within the FAB, ANSPs of BLUE MED will:

engage in the integration of their safety management system to ultimately design build and


of 31

ANNEX 2 - INITIAL HAZARD IDENT

OF PLANNED CHANGES

The establishment of a FAB does not, by definition, mandate the implementation of any changes to the day-to-day operations of the ANSPs. establishment there are no “big bang” changes foreseenassociated with any immediate safety issueschanges are foreseen and it is deemed useful, even at this early stage, to provide an initial risk assessment of these changes.

Classical risk assessment is a function of the likelihood of ATM hazards and the severity of their effect. At the time of the SC submission, the details of the and technical elements that is associated with the planned changes are not yet available, hence the analysis that follows is restricted to hazard identificawill be revisited and a more complete assessment will be performed where and when each change is actually implemented. This will be particularly relevant in the case that the foreseen changes will be implemented at the external FAB boundaries with nonmay be needed.

The table on the next page summarises the results of the assessment performed in the framework of WP3.1, and is based on the vast safety and ATM/ANS expertise

HAZ ID

ATM Domain

Change description

1 AIRSPACE Implementation of a new ATS route network proposal



INITIAL HAZARD IDENTIFICATION AND MITIGA

OF PLANNED CHANGES

establishment of a FAB does not, by definition, mandate the implementation of any day operations of the ANSPs. In fact, on Day 1 of the BLUE MED FAB

establishment there are no “big bang” changes foreseen, hence its establishment is not associated with any immediate safety issues. Nevertheless, after establishment, operational

foreseen and it is deemed useful, even at this early stage, to provide an initial risk assessment of these changes.

risk assessment is a function of the likelihood of ATM hazards and the severity of their ffect. At the time of the SC submission, the details of the complex interaction of human, procedure

that is associated with the planned changes are not yet available, hence the analysis that follows is restricted to hazard identification and high level mitigations. This analysis will be revisited and a more complete assessment will be performed where and when each change

This will be particularly relevant in the case that the foreseen changes will ed at the external FAB boundaries with non-EU States, when additional mitigations

The table on the next page summarises the results of the assessment performed in the framework of WP3.1, and is based on the vast safety and ATM/ANS expertise of the group participants

Change description WHAT COULD GO WRONG

HAZARD(S)

Implementation of a new ATS route network proposal

Incorrect or inadequate airspace design, increasing airspace complexity ATCO error Pilot error Inadvertent penetration of P,R and D areas

ATC workload increase A/c deviation from planned/correct route Loss of nominal separation Uncontrolled/ unauthorised interaction between civil-military operations

IFICATION AND MITIGATIONS

establishment of a FAB does not, by definition, mandate the implementation of any specific In fact, on Day 1 of the BLUE MED FAB

, hence its establishment is not establishment, operational

foreseen and it is deemed useful, even at this early stage, to provide an initial risk

risk assessment is a function of the likelihood of ATM hazards and the severity of their complex interaction of human, procedure

that is associated with the planned changes are not yet available, hence the tion and high level mitigations. This analysis

will be revisited and a more complete assessment will be performed where and when each change This will be particularly relevant in the case that the foreseen changes will

EU States, when additional mitigations

The table on the next page summarises the results of the assessment performed in the framework of the group participants.

HAZARD(S) MITIGATIONS

ATC workload

A/c deviation from planned/correct

Loss of nominal

interaction between

Ensure good airspace design (usage of airspace design best practices, standards and tools) Revision of LoAs and civil-mil. coord. Training / awareness Correct + timely publication of new route(s) Implement automatic / software monitoring aids

Initial implementation during low traffic periods


HAZ ID

ATM Domain

Change description

2

AIRSPACE

Extension of upper limit of controlled airspace to FL660

3 AIRSPACE Harmonisation of route lateral separation minima (5 NM under consideration)

4 AIRSPACE Harmonisation of longitudinal separation minima at transfer of control




HAZARD(S)

Extension of upper limit of controlled airspace to FL660

Inadequate SUR coverage/accuracy Inappropriate / inadequate vertical/lateral separation standards Inadequate COMMS No MET info ATCO error w.r.t a/c performance

Pilot error (e.g. inadvertent entry into controlled airspace by MIL a/c)

Loss of separation Loss off communication with a/c Uncontrolled/ unauthorised interaction between civil-military operations

Harmonisation of en-route lateral separation minima (5 NM under

ATC error

Pilot error

Loss of nominal lateral separation

Harmonisation of

separation minima at transfer of control

ATC error Pilot error

Loss of nominal longitudinal separation (at FIR boundaries)

of 31


Loss of separation

Loss off communication with

interaction between

Periodic check Flight tests for calibration of equipment (for both COM and SUR)

Ensure enhanced civil/military coordination

Training,

Correct/timely publication of new airspace parameters

Ensure provision of MET info Training w.r.t to new procedures and a/c performance

Loss of nominal lateral separation

Training to acquire new skills STCA parameters adjustment Focused competency checks

Loss of nominal

separation (at FIR

Focused competency checks ATCO awareness / training Updating of LoAs / written procedures


of 31

HAZ ID

ATM Domain

Change description

5 AIRSPACE Partial implementation offree route operations (limited in geographical and/or time scope)




HAZARD(S)

implementation of free route operations (limited in geographical and/or

ATCO not fully aware of the details of the filed flight plan and/or route not specified Credible incorrect route Airspace constraints not updated Working methods no longer applicable due to change in traffic flows and patterns No proper procedures to interface with MIL traffic and MIL areas potential conflicts at the interface between Free route airspace and non Free Route Airspace Aircraft entering in the geographical Free route airspace outside the activation time Aircraft still in free route airspace while activation stops

Pilot error FDP unable to cope ATC error (coordination issues, sector configuration and management, workload)

A/c deviation from expected route ATC workloadincrease

Loss of separation


A/c deviation from expected route

ATC workload

Loss of separation

Implement automatic / software monitoring aids RTS for the airspace concerned Training Focused competency checks, Appropriate / timely notifications /publications Flow management / capacity review Test of FDP (in case big number of deviations causes a crash) Safety Nets adjustments (STCA & APW)


HAZ ID

ATM Domain

Change description

6 AIRSPACE Division FL between upper and lower airspace FL195 in all the FAB (change for GR, CY, TU, AL and EG)

7

ATC

Implementation of automatic coordination (OLDI) between ACC Units, including the extension in OLDI messages currently used




HAZARD(S)

Division FL between upper and lower airspace FL195 in all the FAB (change for GR, CY, TU, AL and

ATC error Consider if a change in airspace classification would induce any errors Errors in flight plan

Inadvertent entry into upper/lower airspace Lack of flight data in the correct sector

Implementation of

coordination (OLDI) between ACC Units, including the extension in OLDI messages currently

Corrupted coordination between FDPs OLDI message set incompatibility Incorrect/inefficient implementation of OLDI in HMI

Loss of automatic coordination function Partial loss of automatic coordination function

Credible but undetected error in automatic coordination

of 31


Inadvertent entry into upper/lower

Lack of flight data in the correct sector

Review of ATS route network for possible misalignment

Appropriate / timely notifications /publications Manual re-routing of flight plan at CWP – controller working position

Loss of automatic

Partial loss of

Credible but undetected error in

Manual coordination procedures (used as backup) Ensure that people are trained for them Appropriate alarms/software aids in the HMI to indicate if something is wrong and that manual coordination has been effected Development in accordance to an appropriate SWAL level Focused competency checks / training (for monitoring the correctness of the system) Training on degraded modes of operation


of 31

HAZ ID

ATM Domain

Change description

8 SUR Standardization of Radar Data transmission format (ASTERIX interface)

9 SUR Improvement of existing surveillance coverage at FIR Boundaries

10 HUM Harmonisation of ATCO competence through common training

11 SMS Implementation of FAB SMS




HAZARD(S)

Standardization of Radar Data transmission format (ASTERIX interface)

Corruption to radar data

Inaccurate information Loss of Radar Data

Improvement of existing surveillance coverage at FIR

Incompatibility of new radar with RDP

Corruption of Radar Data (loss of integrity)

Harmonisation of ATCO competence through common

Inadequate / improper training programme

ATC errors

Implementation of Ineffective SMS procedures defined

Ineffective SMS procedures defined


radar

Loss of Radar Data

Development in accordance to an appropriate SWAL level Dual (independent) RDP systems and resilient technical maintenance procedures Focused competency checks / training (for monitoring the correctness of the system) Training on degraded modes of operation

Corruption of Radar Data (loss of

Ensure proper integration of additional radar heads by pre-testing in off-line mode

Design training in accordance with best practices

Ineffective SMS procedures defined

Ensure that best practices are used


The actions below are designed to provide safety assurance for the implementation phase of the FAB:

Ref Action

1 Revisit the BLUE MED Safety Case and re

assess its validity. Update as necessary

2 Implement the FAB SMS roadmap actions,

as detailed in D3.3



ANNEX 3 - SAFETY PLAN


Responsible party(ies)

Revisit the BLUE MED Safety Case and re-

assess its validity. Update as necessary

BLUE MED Safety

Committee

Implement the FAB SMS roadmap actions, BLUE MED ANSP Safety

Coordination Board

of 31


Deadline

6 months after

the signing of

the State Level

FAB Agreement

Safety Details to be

found in D3.3


of 31

ANNEX 4 - INVESTIGATION OF ACC

INCIDENTS IN BLUE ME

• In the event of an accident or a serious incident according to the meaning of the Chicago Convention occurring in the airspace over the territory of a Member State or under its responsibility in accordance with ICAO rules (hereinafter referred to as “the Member State of occurrence”) and controlled by an air navigation service provider other than the proviwhose principal place of operations is/are located on the territory of the Member State of occurrence (hereinafter referred to as “the effective air navigation service provider”), the Member State of the effective air navigation service provider shadelay to the competent authorities of the Member State of occurrence by the most suitable means. The notification shall have the same content as a notification of Annex 13 of the Chicago Convention.

• At its request, the Memberaccording to Annex 13 to the Chicago Convention shall be provided with, and have access to, the necessary materials by all relevant air navigation service providers and competent authorities of the Member States in order to enable an investigation of the accident or the serious incident to be conducted. The Member State of the effective air navigation service provider shall therefore grant, in accordance with its national laws and regulations, conducting the investigation access to the premises, facilities and materials of the effective air navigation service providers and of its own competent authorities. The information provided shall be used only for the purpose for which it was githe consent of the Member State which provided the information.

• The Member State of the effective air navigation service provider shall have the opportunity to appoint an accredited representative to take part in t

• Any Member State which at the request of the State conducting the investigation provided information or access to its competent authorities or an air navigation service provider shall be entitled to appoint an accredited representative tprovisions of ICAO Annex 13 and relevant EU Legislation and related national law. The competent authorities of the State conducting the investigation shall provide the final investigation report in its nationwith any safety recommendations arising out of the investigation, to the competent authorities of the Member State of the effective air navigation service provider as well as, upon request, to the other Member States and to the BLUE MED Governing Board.

• The arrangements above shall supersede the provisions governing investigation of accidents and serious incidents in any existing bilateral agreements between any two Member States related to the provision of air traffic services.



INVESTIGATION OF ACCIDENTS AND SERIOUS

INCIDENTS IN BLUE MED FAB (SLA ART.26)

In the event of an accident or a serious incident according to the meaning of the Chicago occurring in the airspace over the territory of a Member State or under its

responsibility in accordance with ICAO rules (hereinafter referred to as “the Member State of occurrence”) and controlled by an air navigation service provider other than the proviwhose principal place of operations is/are located on the territory of the Member State of occurrence (hereinafter referred to as “the effective air navigation service provider”), the Member State of the effective air navigation service provider shall notify such event without delay to the competent authorities of the Member State of occurrence by the most suitable means. The notification shall have the same content as a notification of Annex 13 of the

At its request, the Member State of occurrence or the State conducting the investigation according to Annex 13 to the Chicago Convention shall be provided with, and have access to, the necessary materials by all relevant air navigation service providers and competent

the Member States in order to enable an investigation of the accident or the serious incident to be conducted. The Member State of the effective air navigation service provider shall therefore grant, in accordance with its national laws and regulations, conducting the investigation access to the premises, facilities and materials of the effective air navigation service providers and of its own competent authorities. The information provided shall be used only for the purpose for which it was given and shall not be made public without the consent of the Member State which provided the information.

The Member State of the effective air navigation service provider shall have the opportunity to appoint an accredited representative to take part in the investigation.

Any Member State which at the request of the State conducting the investigation provided information or access to its competent authorities or an air navigation service provider shall be entitled to appoint an accredited representative to participate in the investigation, as per the provisions of ICAO Annex 13 and relevant EU Legislation and related national law. The competent authorities of the State conducting the investigation shall provide the final investigation report in its national language of that state and an English translation, together with any safety recommendations arising out of the investigation, to the competent authorities of the Member State of the effective air navigation service provider as well as, upon request, to the other Member States and to the BLUE MED Governing Board.

The arrangements above shall supersede the provisions governing investigation of accidents and serious incidents in any existing bilateral agreements between any two Member States

e provision of air traffic services.

IDENTS AND SERIOUS

(SLA ART.26)

In the event of an accident or a serious incident according to the meaning of the Chicago occurring in the airspace over the territory of a Member State or under its

responsibility in accordance with ICAO rules (hereinafter referred to as “the Member State of occurrence”) and controlled by an air navigation service provider other than the provider(s) whose principal place of operations is/are located on the territory of the Member State of occurrence (hereinafter referred to as “the effective air navigation service provider”), the

ll notify such event without delay to the competent authorities of the Member State of occurrence by the most suitable means. The notification shall have the same content as a notification of Annex 13 of the

State of occurrence or the State conducting the investigation according to Annex 13 to the Chicago Convention shall be provided with, and have access to, the necessary materials by all relevant air navigation service providers and competent

the Member States in order to enable an investigation of the accident or the serious incident to be conducted. The Member State of the effective air navigation service provider shall therefore grant, in accordance with its national laws and regulations, the State conducting the investigation access to the premises, facilities and materials of the effective air navigation service providers and of its own competent authorities. The information provided

ven and shall not be made public without

The Member State of the effective air navigation service provider shall have the opportunity to

Any Member State which at the request of the State conducting the investigation provided information or access to its competent authorities or an air navigation service provider shall be

o participate in the investigation, as per the provisions of ICAO Annex 13 and relevant EU Legislation and related national law. The competent authorities of the State conducting the investigation shall provide the final

al language of that state and an English translation, together with any safety recommendations arising out of the investigation, to the competent authorities of the Member State of the effective air navigation service provider as well as, upon request, to

The arrangements above shall supersede the provisions governing investigation of accidents and serious incidents in any existing bilateral agreements between any two Member States


• All Member States shall have in place appropriate incident reporting mechanisms in conformity with international and European regulations.

• The Member States shall ensure that pertaining BLUE MED safetyreported, collected, protected, exchanged and disseminated.

• The sole objective of occurrence reporting is the prevention of accidents and incidents and not the attribution of blame or liability.



All Member States shall have in place appropriate incident reporting mechanisms in conformity with international and European regulations.

The Member States shall ensure that pertaining BLUE MED safety-related informreported, collected, protected, exchanged and disseminated.

The sole objective of occurrence reporting is the prevention of accidents and incidents and not the attribution of blame or liability.

of 31

All Member States shall have in place appropriate incident reporting mechanisms in conformity

related information is duly

The sole objective of occurrence reporting is the prevention of accidents and incidents and not


of 31

APPENDIX 1 - LIST OF CONTRIBUTORS

NAME

Fisnik Tabaku

Petros Stratis

Evis Antonopoulos

Salama Ramadan

Hassan Kamel

Amr Mohamed Amin

Athina Lala

Katerina Nezi

Maria Milena Renis

Barbara Cardinali

Claudio Cannavicci

Pierluigi D’Aloia

Francis Bezzina

Walha Mohamed Amin

Tony Licu

Gilles Le Galo



LIST OF CONTRIBUTORS

ORGANISATION STATE

CAA ALBANIA

DCAC CYPRUS

DCAC CYPRUS

NANSC EGYPT

NANSC EGYPT

NANSC EGYPT

HCAA GREECE

HCAA GREECE

ENAV ITALY

ENAV ITALY

ENAV ITALY

ENAV ITALY

MATS MALTA

OACA TUNISIA

EXPERT SUPPORT

EUROCONTROL

EUROCONTROL

STATE

ALBANIA

CYPRUS

CYPRUS

EGYPT

EGYPT

EGYPT

GREECE

GREECE

ITALY

ITALY

ITALY

ITALY

MALTA

TUNISIA

---

---

D3.2a – BLUE MED FAB Safety Case (Part A: Regulatory aspects)

Documents

Transcript of D3.2a – BLUE MED FAB Safety Case (Part A: Regulatory aspects)