APV/SBAS Safety Case for ACAC and ASECNA Regions

1. SBAS Implementation in theregions of ACAC and ASECNAFP7-GALILEO-2008-4.3.1 / FP7-GALILEO-2008-4.3.4Project with Community research funding

2. Introduction • SIRAJ (October 2010 – April 2012) is a project funded by the European Commission under the 7th Framework program. • Main objective: to evaluate the opportunities for EGNOS service extension to the areas covered by the ACAC and ASECNA, in the Civil Aviation domain. • Part of this evaluation consists of APV/SBAS Safety Cases of each airport.

3. APV/SBAS approach Definition APV SBAS (Satellite Based Augmentation System) is an extension of RNAV (GNSS) system. It provides more specific information, more accurate guidance than non-precision systems and the major benefit compared to non-precision: final approach vertical guidance. EGNOS System In Europe, it is supported by EGNOS system (European Geostationary Navigation Overlay Service). It consists of three geostationary satellites and a network of ground stations. EGNOS achieves its aim by transmitting a signal containing information on the reliability and accuracy of the positioning signals sent out by GPS. It allows users to determine their position to within 1.5 meters. European SBAS system has the following advantages: ─ Optimized approach routing from various arrival directions ─ Improved track keeping ─ Use of more flexible route and procedure designs ─ Limited need for ground infrastructure ─ Can be implemented in areas where ILS cannot be sited for terrain or obstacle reasons ─ Can provide approaches to more runways without additional infrastructure costs ─ Increase usability of many airports

4. Description • According to the European Commission regulation N° 2096/2005, any change in ATM system needs safety analysis. In this context, the implementation of an APV SBAS procedure requires a safety assessment. • A Safety Case consists of providing the demonstrable evidences that the APV SBAS approach procedure implemented at the airport is sufficiently safe in normal conditions and under failure conditions. The level of safety maintained from introduction to service and during the procedure is operational.

5. Methodology • EUROCONTROL has developed a generic safety assessment for the use of APV SBAS operations in Europe. • The methodology used within this safety assessment is derived from the process specifications defined within the EUROCONTROL Safety Assessment Methodology (SAM). The approach is based on the development of a Functional Hazard Analysis (FHA), a Preliminary System Safety Analysis (PSSA) and a System Safety Analysis (SSA).

6. Safety Case Methodology Safety Case Methodology SAM Methodology is based on the following steps: SAM Tie-bow: SSA FHA PSSA

7. APV/SBAS Safety Case Main safety arguments have to be established to ensure that the procedure and the APV/SBAS approaches are going to be safe. The aim of the Safety Case is to demonstrate that the use of APV SBAS approach procedures will be acceptably safe in operational service at the airport. Risk of accident shall not be greater than the one that currently exists at the airport and shall be reduced as far as reasonably practicable. Description of airport Operational Environment. Aspects related to APV/SBAS approaches: terrain, meteorology, airport configuration, navigation aids, infrastructure, traffic analysis, etc EUROCONTROL documents establish basic needs for APV/SBAS approaches related to the operational environment. - Concept of Operations for APV SBAS Approach (CONOPS) - Operational and Functional Model of LPV (FUN)

8. APV/SBAS Safety Case Examples of CONOPS assumptions: Examples of Functional Model assumptions:

9. APV/SBAS Safety Case • Hazards are the consequences of failures within the system, combination of failures and interactions with other systems and external events in the environment of operation. • All identifications and analysis have been established through brainstorming based on “APV generic safety case establishes general hazards”. The brainstorming group is composed of Pilots, ATCOs, Flight Procedure Designers and safety experts. • Steps to develop in this phase: • To identify potential hazards that may appear at an APV/SBAS approach. • The exposure time to the hazard • The ability to detect the hazard and the external event occurrence • The rate of development of the hazard (sudden, fast or slow) • To analyse every possible mitigation that may avoid the hazard or decrease its severity. • To study the worst credible scenario for each hazard. • To establish the severity class depending on the ending of each scenario.

10. APV/SBAS Safety Case 3. Hazard Identification - FHA Hazards analyzed by EUROCONTROL for an APV/SBAS approach. Safety case

11. APV/SBAS Safety Case 3. Hazard Identification - FHA External Mitigation Means (EMMs) are barriers outside the system being assessed which reduce the probabilities of the hazard effects to occur (last-moment safeguards enabling detection of hazards) or reduce the severity of the effects. EMMs are taken into account when assigning the severities to the hazard effects. The EMMs may work fully or partly on the hazard itself.

12. APV/SBAS Safety Case 3. Hazard Identification - FHA The worst credible effect in the APV/SBAS approach procedure should determine the severity class leading to the setting of the Safety Objective. The worst case scenario analyzes and identifies all possible outcomes for each hazard. The worst outcome will generate the worst scenario and severity will be established to each hazard depending on the results.

13. APV/SBAS Safety Case Fly low while intercepting Deviation is not towards Recovery via ATC Recovery with Visual cues Consequence Frequency the glide slope obstacle detection - radar Always Highly Probable Null Probable Success Null Null Missed Approach or Safe Highly Probable Landing Success Null Missed Approach or Safe Null Landing Success Missed Approach or Safe Null Landing Failure:OH3 Failure Failure Failure CFIT Null Success Missed Approach or Safe Improbable Landing Null Failure CFIT Improbable 3. Hazard Identification - FHA Event tree for OH3 at Dakar airport.

14. APV/SBAS Safety Case Safety Objectives have to be established after identifying all possible hazards with their respective worst credible scenario. Safety Objectives state the frequency with which a specific hazard might appear. For SIRAJ Safety Cases all frequency values considered are qualitative. ESARR4 document establishes the maximum frequency for each Severity Class

15. APV/SBAS Safety Case Logical architecture description: A document derived from EUROCONTROL LPV safety assesment facilitates a description of the LPV system. It explains the types of LPV systems and its implementation on the aircraft. Functional Safety Requirements (SR):Function Safety Requirements are placed on the system architecture. They have the purpose of minimizing the level of risk, as low as reasonably practical, ensuring the operation of each safety function within the APV SBAS operations at the airport. They are based on the logical model stated by EUROCONTROL. Safety Requirements for Integrity (IR): This kind of requirements are applied when a possible Hazard occurs. The main purpose of these requirements is to mitigate the frequency of these hazards and satisfy the Safety Objectives, established before. Both groups of Safety Requirements can be classified as: - Human Operators - Equipment - APV /SBAS approach procedure - Environment and others

16. APV/SBAS Safety Case After establishing and defining the Safety Requirements, the implementation inside the airport environment has to be acceptably safe. Safety Requirements are divided into four groups: - Airspace / APV procedure - ATC or AFIS (equipment, training and procedures) - Aircraft and aircrew (equipment, training and procedures) - Environment and others This section explains the introduction of the Safety Requirements into the airport. It also specifies the responsible group or authority that must apply each requirement. An example of these processes is as follows:

17. APV/SBAS Safety Case This part satisfies the main argument and the main criteria when the migration to the new APV SBAS is carried out. The migration to the APV/SBAS procedure has to be acceptably safe. • Actions to carry out during on-going operations: • Continuous monitoring. • Safety performance improvement. To check, analyze and solve any new hazard and improve current safety requirements. • Upgrades. Study ESSP status reports and check for upgrades within the EGNOS satellites signal. APV SBAS operations must only be used when enough EGNOS signal is available for this kind of approaches. • Monitoring system in place, operation and maintenance. Air navigation service provider and aerodrome operator are required to clearly demonstrate that the monitoring system is in place. Operation and maintenance of this system have to be managed by trained staff. • Airspace modifications. Safety Requirements and Safety Objectives have to be revised and changed if necessary for this procedure. • Correct procedures. • Incidents records and analysis.

18. APV/SBAS Safety Case Incidents and accidents may occur while applying APV SBAS procedures. It is necessary to establish a process to report and investigate these incidents. 1. Safety Incidents Reporting Process. An implemented system has to perform continuous safety reporting to detect, notify, collect and analyze all data from these unusual occurrences. It is also responsible for investigating the causes that originated the incident and suggesting recommendations to avoid it. 2. Incidents Reports. In case of an incident or accident, it is necessary to report, record, study and analyze the case. The incident report has to be very specific and complete. All information has to be gathered together in order to analyze it. EUROCONTROL provides generic incident reports. 3. Corrective Actions. The incident reports have to provide solutions and new measures to avoid these incidents, “learned lessons”. All modifications and new measures have to be proved safe for APV SBAS approaches.

19. APV/SBAS Safety Case SIRAJ Project has studied APV/SBAS approach Safety Cases for the following airports: - Al-Hoceima Airport, Morocco (ASECNA region) - Léopold Sédar Senghor Airport, Dakar, Senegal (ASECNA region) - Najran domestic Airport, Saudi Arabia (ACAC region) Dakar Al-Hoceima Najran

20. Al-Hoceima SC Safety Case characteristics: - Runway: 17/35 (2500 x 45m) - Radar: No radar available. - Approach lights: Threshold and edge lights. - Obstacles: No significant obstacles. - Navigation aids: VOR/DME available for RWY17.

21. Al-Hoceima SC Safety Case characteristics: - Does it satisfy the CONOPS Document?: Some statements that are not completely valid have been added to the Safety Requirements of the APV/SBAS procedure. - Does it satisfy the Functional Model Document?: All statements are valid for this airport. - Other aspects: this Safety Case includes an additional possible hazard: “Interference of the trajectory with Al-Hoceima town, Spanish prohibited area and British airspace”.

22. Dakar SC Safety Case characteristics: - Runway: Two runways. The one chosen for APV/SBAS approaches is Runway 18/36 (3490 x 45m) - Radar: Radar is available. No radar vectoring is provided. - Approach lights: Threshold and edge lights. - Obstacles: Few obstacles on both thresholds. - Navigation aids: VOR/DME, ALD/DME and NDB . ILS is available for RWY36. - Does it satisfy the CONOPS Document?: All statements are valid for this airport. - Does it satisfy the Functional Model Document?: All statements are valid. - Other aspects: Long Runway helps external mitigations.

23. Najran SC Safety Case characteristics: - Runway: 06/24 (3045 x 45m) - Radar: No radar available. AFIS in charge of TWR. - Approach lights: Threshold and edge lights. No approach lights available. - Obstacles: Few obstacles on both thresholds. - Navigation aids: VOR/DME for both thresholds and ILS/DME available for RWY06. - Does it satisfy the CONOPS Document?: All statements are valid for this airport. - Does it satisfy the Functional Model Document?: All statements are valid for this airport. - Other aspects: None.

24. Thank you