AMC & GM to SKPI — Issue 2, Amendment 1

Annex I to ED Decision 2015/028/R ‘AMC and GM to SKPI — Issue 2, Amendment 1’

The Annex to ED Decision 2014/035/R (AMC and GM for the implementation and measurement of safety (Key) Performance Indicators (S(K)PIs) — Issue 2) is amended as follows: The text of the amendment is arranged to show deleted, new or amended text as shown below:

1. deleted text is marked with strike through;

2. new or amended text is highlighted in grey; and

3. an ellipsis (…) indicates that the remaining text is unchanged in front of or following the reflected amendment.

GM1 SKPI General

A. Purpose

(…)

B. Objective

(…)

C. Definitions and acronyms/initialisms

Definitions

‘Airspace infringement’ is a flight into notified airspace without previously requesting and obtaining approval from the controlling authority of that airspace in accordance with international and national regulations. Notified airspace includes controlled airspace, restricted airspaces and transponder mandatory zones or radio mandatory zones as implemented by the Member States. ‘ATM-specific occurrences’ are events or situations where a provider’s ability to provide ATM, ATS, ASM or ATFM services is diminished or ceases. ‘ATM/ANS system security’ is a situation in which the ATM/ANS services are lost or disrupted as a result of breach of system security. ‘Inability to provide ATFCM services’ is an event in which elements in the ground Air Traffic Flow Management and Capacity system performances are unserviceable, insufficient, unavailable or corrupted resulting in the safety of traffic being impaired or prevented. ‘Best (good) practice’ is a method, initiative, process, approach, technique or activity that is believed to be more effective at delivering a particular outcome than other means. It implies accumulating and applying knowledge about what is working and what is not working, including lessons learned and the continuing process of learning, feedback, reflection and analysis. ‘Major incident’ is an incident associated with the operation of an aircraft, in which safety of aircraft may have been compromised, having led to a near collision between aircraft, with ground or obstacles (i.e. safety margins not respected which is not the result of an ATC instruction). ‘NM Flow Management’ is the Network Manager service that manages the overall ATFCM network in Europe and assists ANSPs to manage local capacity. ‘NM Flight planning’ is the centralised flight plan processing and distribution function operated by the Network Manager Operations. It manages and distributes flight plan data including related messages. ‘NM Airspace Data Management’ is the consolidated network view of the European airspace. The purpose of the Airspace Data Management is to manage and provide all necessary airspace information to feed the core Network Manager Operational systems and the systems of operational stakeholders. ‘NM CCAMS’ centrally selects an SSR code for each flight within its area of applicability and distribute them to the appropriate ATS unit. ‘Not determined’ means that insufficient information was available to determine the risk involved or inconclusive or conflicting evidence precluded such determination. ‘Pre-Tactical Flow Management’ is applied during the six days prior to the day of operations and consists of planning and coordination activities. This phase studies the demand for the day of the operation, compares it with the predicted available capacity on that day, and makes any necessary adjustments to the plan that was developed during the Strategic phase. The main objective of the pretactical phase is to optimise efficiency, and balance demand and capacity through an effective

organisation of resources (e.g. sector configuration management, use of scenarios, etc.) and the implementation of a wide range of appropriate ATFCM measures. The work methodology is based on a CDM process between the stakeholders (e.g. the NM, FMPs, AOs).The output is the ATFCM Daily Plan (ADP) published via ATFCM Notification Message (ANM) or Network News and via the NOP portal. ‘Occurrence with no safety effect’ is an occurrence which has no safety significance. ‘Reliability factor’ is the level of confidence in the assessment (scoring) undertaken, based on the data available. ‘Runway incursion’ is any occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle or person on the protected area of a surface designated for the landing and take-off of aircraft. ‘Safety culture’ means the shared beliefs, assumptions and values of an organisation. ‘Safety plan’ is a high-level safety issues assessment and related action plan. The safety plan is a key element of the safety programme. ‘Safety programme’ is an integrated set of regulations and activities aimed at improving safety. ‘Separation minima infringement’ means a situation in which prescribed separation minima were not maintained between aircraft. ‘Serious incident’ is an incident involving circumstances indicating that there was a high probability of an accident and is associated with the operation of an aircraft, which in the case of a manned aircraft, takes place between the time any person boards the aircraft with the intention of flight until such time as all such persons have disembarked, or in the case of an unmanned aircraft, takes place between the time the aircraft is ready to move with the purpose of flight until such time it comes to rest at the end of the flight and the primary propulsion system is shut down. ‘Significant incident’ is an incident involving circumstances indicating that an accident, a serious or major incident could have occurred if the risk had not been managed within safety margins, or if another aircraft had been in the vicinity. ‘Strategic Flow Management’ takes place seven days or more prior to the day of operations and includes research, planning and coordination activities through a Collaborative Decision Making (CDM) process. This phase comprises a continuous data collection with a review of procedures and measures directed towards an early identification of major demand/capacity imbalances (such as: axis management, air shows, major sport events, military exercises, etc.). When imbalances are identified, the NM is responsible for the overall coordination and execution of strategic ATFCM planning to optimise all available capacity and achieve performance targets. The output of this phase is the Network Operations Plan (NOP). ‘Tactical/Real-Time Flow Management’ takes place on the day of operations and involves considering in real time those events that affect the ADP, and then applying any necessary modifications . This phase is aimed at ensuring that the measures taken during the strategic and pre-tactical phases are the minimum required to solve the demand/capacity imbalances.

Acronyms/Initialisms

A/D MAN Arrival/Departure Manager AMC Acceptable Means of Compliance ANSP Air Navigation Service Provider A-SMGCS Advanced Surface Movement Guidance & Control System ATC Air Traffic Control

ATCO Air Traffic Controller ATFCM Air Traffic Flow and Capacity Management ATM Air Traffic Management ATS Air Traffic Services CCAMS Centralised Code Assignment and Management System CISM Critical Incident Stress Management CWP Controller Working Position EoSM Effectiveness of Safety Management FAB Functional Airspace Block JC Just Culture GM Guidance Material KPI Key Performance Indicator MO Management Objective MTCD Medium Term Conflict Detection NM Network Manager NSA National Supervisory Authority QMS Quality Management System RAT Risk Analysis Tool (…) (…) (…)

II Effectiveness of Safety Mangement KPI

(…)

III Severity classification based on the risk analysis tool methodology

AMC4 SKPI Severity classification based on the risk analysis tool methodology — General

GENERAL DESCRIPTION The severity part of the risk analysis tool methodology dedicated to operational occurrences should follow the principle of evaluating several criteria and allocating a certain score to each criterion, depending on how severe each criterion is evaluated to be. The RAT methodology addresses both technical and operational occurrences via slightly different manners. Each criterion should have a limited number of options with corresponding scores. Some criteria have an ATM Ground and an ATM Airborne component, and both scores should be counted when evaluating the ATM Overall score. Other criteria should be only relevant either for ATM Ground or ATM Airborne. The overall score for the severity of an occurrence should be the sum of the scores allocated to each applicable individual criterion. The overall score for the severity of an occurrence should be built from the sum of the score allocated to the risk of collision/proximity (itself a sum of the score allocated to the separation and the score allocated to the rate of closure) and the degree of controllability over the occurrence. The severity of the ATM-specific occurrences should refer to the service provider’s capability to provide safe ATM/CNS services. The criteria which should be considered are: the service affected, service/function provided, operational function, type of failure, extent of the failure, scope and duration. The severity of the occurrences reported by Member States should be the ATM Overall. For ATMspecific occurrences, the ATM Overall coincides with the ATM Ground severity. The scoring system defines a range of points that should be used for each scored criterion. Default scores are shown for each criterion (e.g. 0, 3, 5). However, the default scores should be adapted according to the circumstances of the occurrence. Member States should ensure that arrangements are in place for the reporting of the ATM Overall severity score.

AMC5 SKPI Severity classification based on the risk analysis tool methodology — Methodology for Separation Minima Infringements

(…)

A. Risk of collision

The risk of collision should be determined by the sum of the scores for the following sub-criteria: 1. Separation — based solely on the minimum distance achieved between aircraft or aircraft and obstacles. The greatest value between the horizontal and vertical in percentage of the applicable separation should be considered. 2. Rate of closure — based on the vertical and horizontal speed, measured at the moment the separation is infringed. The greatest of the predefined intervals for each of the horizontal and vertical speeds should be considered for the evaluation, if the separation is lost after the crossing point (i.e. if the aircraft are on diverging headings when the separation is lost, then the rate of closure is considered ‘noneNONE’). The following table should be used to determine the scores of the criteria ‘separation’ and ‘rate of closure’.

Risk of collision ATM ATM ATM oOverall RF weight gGround aAirborne

0 to 10 20 Minimum separation achieved 0 0 ATM Ground

n

o Separation > 75 % minimum 1 1 OR ati ATM ar Separation > 50 %, < = 75 % minimum 3 3 p aAirborne Se Separation > 25 %, < = 50 % minimum 7 7

Separation <= 25 % minimum 10 10 0 to 5 10 Rate of closure NONE 0 0 ATM Ground Rate of closure LOW 1 1 OR re (< = 85 knots, < = 1 000 ft/mn) ATM su aAirborne lo Rate of closure MEDIUM (> 85 and < = 205 2 2 f c knots, > 1 000 and < = 2 000 ft/mn)

o

Rate of closure HIGH (> 205 and 4 4

Rate

< = 700 knots, > 2 000 and < = 4 000 ft/mn) Rate of closure VERY HIGH 5 5 (> 700 knots, > 4 000 ft/mn)

For the risk of collision, either ATM Ground or ATM Airborne severity should be scored, not both. The ATM Airborne severity should be used only in cases where ATC is not responsible for providing separation (i.e. certain classes of airspaces; e.g. close encounter between IFR and VFR flights in Class E airspace) is to be scored for events where ATM Ground contribution is None or Indirect (aggravating). The ATM Ground severity is to be scored when the ATM Ground contribution is Direct (causal) or Indirect (contributing).

B. Controllability

(…) Potential Cconflict detection should refer to ATM Ground detection; therefore, the ATM Overall score should have the same score as ATM Ground. ATM Airborne should not be scored here. There are three possible scenarios:  ‘Potential conflict DETECTED’ includes cases where the conflict is detected but ATC decided to accept the situation the air traffic controller was aware of the situation as part of his/her normal scan of the traffic scenario. This option should also be scored when detection was made with the support of a ground-based safety net that gives sufficient time to the air traffic control staff to form a plan for solving the hazardous situation and also to implement it.  ‘Potential conflict detected LATE’ when there is not enough time to make and/or execute the plan. It should not be scored whenever separation is lost; consideration should be taken with regard to the circumstances involved. In units with short term confict alert (STCA) with ‘lookahead’ time (predictive STCA) the conflict could be detected due to the predictive STCA. If ATCO became aware of the conflict only through the predictive STCA, then it should be scored as ‘Potential conflict detected LATE’ should be scored if the potential conflict was detected late,

eventually with the support of a current system warning, but if there was still time to form a plan and execute it.  The score ‘Potential conflict NOT detected’ is self-explanatory.  When ‘Potential conflict NOT detected’ is scored, then also ‘NO Plan’ and ‘NO Execution’ should be scored. In cases such as level busts or other incidents where ATC cannot form prior plan, potential conflict detection should not be applicable and a zero should be scored to maintain the Reliability Factor (RF) tracked as explained in Ssection D.

ATM ATM ATM RF gGround aAirborne oOverall weight

Potential conflict DETECTED 0

n

o Potential conflict detected 0 to 5 3

cti

LATE ATM 10 Gground Dete Potential conflict NOT 5 detected

Planning refers to the ATM Ground plan and, therefore, the ATM Overall score should have the same score as ATM Ground. ATM Airborne should not be scored here. The performance, the timing and efficiency of the ATM Ground planning should be assessed. The plan refers to the first plan developed by ATC to solve the potentially hazardous/conflict situation detected in the previous step maintain the required separation/safety margins. This plan should be referred to in the subsequent execution steps but not necessarily in the recovery step.  When the planning is either late or does not lead to a timely and effective resolution of the potential conflict, then ‘Plan INADEQUATE’ should be scored.  When ‘Conflict NOT detected’ is scored, then also ‘NO Plan’ and ‘NO Execution’ should be scored.  Whenever potential conflict detection is not applicable (such as level bust cases), then the planning sub-criterion is not applicable and a zero should be scored to maintain the Reliability Factor tracked as explained in Ssection D.

ATM ATM ATM RF gGround aAirborne oOverall weight

Plan CORRECT 0

g

0 to 5

in

n Plan INADEQUATE 3 ATM 10

an

Pl Gground NO plan 5

Execution refers in general to ATM Ground execution in accordance with the developed plan but it should have ATM Ground and ATM Airborne components. Execution refers to the execution of the first plan developed by ATC to solve the detected hazardous/conflict situationmaintain the required separation/safety margins. When assessing the execution, the time and efficiency of that execution

should be assessed. Airborne execution of the received instructions/clearances should be scored as ATM Airborne. Ground safety nets (STCA) (Short-Term Conflict Alert or other similar ground safety net) (…) Recovery from the actual incident is the phase requiring immediate action to restore the safety margins (e.g. separation) or at least to confine the hazard. Recovery starts from the moment the safety margins have been breached (potentially due to an inadequate or missing initial plan to solve the hazardous situation maintain the required separation/safety margins). This sub-criterion applies to both ATM Ground and ATM Airborne. Therefore, ATM Overall should be the sum of the ATM Ground and ATM Airborne values. Airborne Ssafety Nnets (TCAS) – (…)

(…)

Airborne execution of TCAS RA (…) (…)

C. Final scores

(…)

D. Reliability Ffactor

(…)

E. ATM Ground performance

The ATM Ground (i.e. ANSP) performance is particularly important in case of complex events involving several ANSPs. This part of the assessment determines whether the ‘Risk of Collision’ values should be placed under ATM Ground or ATM Airborne in the marksheet. The following options are available for scoring the ATM Ground performance:

Direct (causal)

Where at least one ATM Ground contribution was judged to be DIRECTLY in the causal chain of events leading to an incident. Without that ATM Ground contribution, it is considered that the occurrence would not have happened.

Indirect (contributing)

Where no ATM Ground event was judged to be DIRECTLY in the causal chain of events leading to an incident, but where at least one ATM event contributed to the level of risk or played a role in the emergence of the occurrence encountered by the aircraft. Without such ATM Ground contribution, it is considered that the occurrence might still have happened.

Indirect (aggravating)

Where no ATM Ground event was judged to be DIRECTLY in the causal chain of events leading to an incident, but where at least one ATM event increased the level of risk or worsened the occurrence encountered by the aircraft. Without such ATM Ground contribution, it is considered that the occurrence might still have happened.

None (no involvement)

When no ATM Ground contribution was judged to be either direct or indirect in the causal chain of events leading to an incident. In such case, a State authority reporting the application of the RAT methodology via the annual summary template (AST) mechanism shall map the ATM Ground performance of the event –scored as N (no involvement)- against one of the categories given in Section F below (A, B, C, E or D).

Not assessed

Self-explanatory.

F. Severity classification scheme

The following severity classification scheme is applicable for the following operational occurrences:

1. A — Serious incident

An incident involving circumstances indicating that an accident nearly occurred.

2. B — Major incident

An incident associated with the operation of an aircraft, in which the safety of the aircraft may have been compromised, having led to a near collision between aircraft, with ground or obstacles (i.e. safety margins were not respected; in this case, not as a result of an ATC instruction).

3. C — Significant incident

An incident involving circumstances indicating that an accident, or a serious or major incident could have occurred if the risk had not been managed within the safety margins, or if another aircraft had been in the vicinity.

4. E — No safety effect

An incident which has no safety effect.

5. D — Not determined

Insufficient information was available to determine the severity, or inconclusive or conflicting evidence precluded such determination (RF < 70 %).

GM8 SKPI Severity classification based on the risk analysis tool methodology — Methodology for Separation Minima Infringements — Controllability score determination

The score of controllability may be used to facilitate an evaluation of the amount of hazard or entropy. If the situation is controlled, even if separation is lost, it is nevertheless recovered by the ATM system and not by chance. For this step, the typical defence barriers as they apply chronologically may be followed. The ATM Ground elements may be used to evaluate whether and how ATC (‘ATC’ means not only the ATCO, but the ATCO supported by the ATM system) worked the conflict situation between the aircraft later involved in the actual occurrence. The global picture should be considered and not only the two aircraft between which the required standard separation was lost. In certain cases while trying to work an aircraft pair, ATC could generate an occurrence between another pair. All aircraft relevant to the occurrence under analysis should be considered.

AMC6 SKPI Severity cClassification based on the risk analysis tool methodology — Methodology for Runway Incursions

(…)

A. Risk of collision

(…) 2. Rate of closure — based on the vertical and horizontal speed, measured at the moment the safety margin is considered to have been lost. The greatest of the predefined intervals for each of the horizontal and vertical speeds isare to be considered for the evaluation. Depending on the situation, speed intervals should be applied as follows:  More than one aircraft — no standard separation defined; and  Aircraft with ground movement.

In cases of unauthorised entry on the runway when no other aircraft/vehicle/person iswas present, the rate of closure should be ‘NONE’.

More than one aircraft — Aircraft with ground ATM ATM ATM RF no standard separation movement gGround aAirborne oOverall weight defined

Rate of closure NONE Rate of closure NONE 0 0 0 to 5 ATM Rate of closure LOW 1 1 Rate of closure LOW Ground (<= 50 knots, (<= 20 knots)

OR

<= 500 ft/mnmin) ATM Rate of closure 2 2 aAirborne Rate of closure MEDIUM re MEDIUM (> 20 and (> 50 and <= 100 knots,

su

o <= 40 knots) > 500 and

cl

f <= 1 000 ft/mnmin) te o Rate of closure HIGH 4 4 Rate of closure HIGH

ra

R (> 100 and <= 250 knots, (> 40 and <= 80 knots) > 1 000 and <= 2 000 ft/mnmin) Rate of closure VERY HIGH Rate of closure VERY 5 5 (> 250 knots, HIGH (> 80 knots) > 2 000 ft/mnmin)

For the risk of collision, either ATM Ground or ATM Airborne severity should be scored, and not both ATM Ground and ATM Airborne. The ATM Airborne severity should be used only in cases where ATC is not responsible for providing separation is to be scored for events where ATM Ground contribution is None or Indirect (aggravating). The ATM Ground severity is to be scored when the ATM Ground contribution is Direct (causal) or Indirect (contributing).

B. Controllability

The scoring for controllability should follow the same logic as in AMC5 Ssection B, with only a few exceptions, as follows:

 STCA is not appropriate for this encounter, hence it should be replaced by more general aerodrome ground safety nets, such as RIMCAS (Runway Incursion Monitoring and Collision Avoidance System (RIMCAS);  Airborne sSafety nNets (TCAS) is not normally available when Runway Incursions occur, therefore only pilot see-and-avoid action should be considered. Lack of see-and-avoid should be scored in the case of low visibility, and IMC, runway slope or other aspects of aerodrome design/layoutconditions.  All other sections are identical with the previous scenario, with the exception of the sSafety nNets where A-SMGCS (Advanced Surface Movement Guidance & Control System (A-SMGCS) or RIMCAS should be considered, and the see-and-avoid part where driver action should also be taken into account, alongside that of the pilot.

The controllability score should be defined by the following aspects: 1. Potential Cconflict detection; 2. Planning; 3. Execution; 4. General ground safety nets, (e.g. A-SMGCS); 5. Recovery;

6. Airborne sSafety nNets (see-and-avoid);

7. Pilot/driver execution of see-and-avoid.

The controllability scoring should be identical in all aspects with Ssection B of AMC5 SKPI.

C. Final scores

The final scoring should be identical in all aspects with Ssection C of AMC5 SKPI.

D. Reliability Factor

The Reliability Factor evaluation should be identical to the description in Ssection D of AMC5 SKPI.

E. ATM Ground performance

The ATM Ground performance evaluation should be identical to the description in section E of AMC5 SKPI.

F. Severity classification scheme

The severity classification scheme should be identical to the description in Section F of AMC5 SKPI.

AMC7 SKPI Severity classification based on the risk analysis tool methodology — Methodology for ATM-specific occurrences

A. Overview

The ATM-specific occurrences severity evaluation should be based on a combination of criteria. For each criterion, a number of options should be available. The combination of the chosen options for each criterion should provide the severity of an ATMspecific occurrence.

The following criteria should be considered when determining the severity of an ATM-specific occurrence: 1. Service affected Entry criteria; 2. Service/Function provided; 3. Operational function; 4. Type of failure; 5. Extension Service affected; 6. Scope Extension; and 7. Duration Scope.

B. Options for ATM-specific occurrences

The following options should be considered when evaluating each criterion in AMC7 SKPI Ssection A: 1. Criterion ‘Service affected’ – the effect of the system failure should be assigned to one of the following services: a. (Upper) Area Control Centre — ATC service for controlled flights in a block of airspace; b. Approach Control — ATC service for arriving or departing controlled flights; c. Aerodrome Control — ATC service for aerodrome traffic; d. Oceanic Control — ATC service for controlled flights over the high seas; and e. Flight Information Service — service provided for the purpose of giving advice and information useful for the safe and efficient conduct of flights. 1. Criterion ‘entry eriteria’ — a RAT score must be applied when the event being scored has operational consequences, defined as when: a. ATC or pilot has to apply mitigating measures in order to restore or maintain safe operations as a result of the ATM-specific occurrence; OR b. it is determined that no such mitigating measures were available (i.e. no action possible); OR c. ATC or pilot concludes that mitigating measures were not required on this occasion due to the current operational conditions (e.g. favourable weather, low traffic levels, etc.); OR d. it is determined that ATC or pilot had been unknowingly operating with corrupt information. There is no requirement to apply the RAT methodology for technical events where an operational function is not affected. However, when an operational function is affected but the event does not have any operational consequences, the severity should automatically be ‘E’ — No safety effect. The following flow chart illustrates how to determine whether a technical failure should be scored as an ATM-specific event and classify its severity using the RAT methodology in accordance with the provisions of the performance scheme Regulation.

Figure 4: ATM-specific occurrences — Flow chart to determine RAT applicability

2. Criterion ‘Service/Ffunction provided’ — the following options should be available for the Service/Ffunction criterion: a. Communication — aeronautical fixed and mobile services to enable ground-to-ground, airto-ground and air-to-air communications for ATC purposes;

b. Navigation — those facilities and services that provide aircraft with positioning and timing information; c. Surveillance — those facilities and services used to determine the respective positions of aircraft to allow safe separation; d. Air Traffic Services (ATS) supported by automation — the various flight information services, alerting services, air traffic advisory services and ATC services (area, approach and aerodrome control services); e. Airspace management — a planning function with the primary objective of maximising the utilisation of available airspace by dynamic time-sharing and, at times, the segregation of airspace among various categories of airspace users on the basis of short-term needs; f. Air Traffic Flow and Capacity Management — the air traffic flow management is a function established with the objective of contributing to a safe, orderly and expeditious flow of air traffic by ensuring that ATC capacity is utilised to the maximum extent possible, and that the traffic volume is compatible with the capacities declared by the appropriate air traffic service providers; and g. Information Sservice— a service established within the defined area of coverage responsible for the provision of aeronautical information and data necessary for the safety, regularity and efficiency of air navigation;. 3. Criterion ‘Operational function’ — the selected option for the criterion ‘Service/Function provided’ should be considered when selecting the option for the criterion ‘Operational function’. The following options should be available: a. For Communication services: — Air/G–ground communication — two-way communication between aircraft and stations or locations on the surface of the Eearth; — Ground/G–ground communication — two-way communication between stations or locations on the surface of the Eearth. b. For Navigation services: — Navigation fFunction. — Instrument navigation. — Visual navigation. — Satellite navigation. c. For Surveillance services: — Air sSurveillance — those facilities and services used to determine the respective positions of aircraft in the air to ensure safe separation; — Ground sSurveillance — those facilities and services used to determine the respective positions of aircraft on the ground to allow the detection of potential conflicts; — Surface mMovement gGuidance and cControl — a function providing routing, guidance and surveillance for the control of aircraft and vehicles in order to maintain the declared surface movement rate under all weather conditions within the aerodrome visibility operational level while maintaining the required level of safety. d. For ATS supported by automation:

— Flight Plan Information data processing and surveillance data processing — specified information provided to air traffic service units, relative to an intended flight or portion of a flight of an aircraft; — Flight Information and Alert provision of Flight Information (e.g. last position in support to alerting services); — OpsOperations rRoom mManagement cCapability — the functions which enables to combine/split sectors, assign roles on controllers working position; — Decision-mMaking sSupport tTools — such as mMeidium-tTerm cConflict dDetection, aArrival/dDeparture mManager, cCollaborative dDecision-mMaking; and — Safety nNets — a (ground-based) safety net is a functionality within the ATM system that is assigned by the ANSP with the sole purpose of monitoring the environment of operations in order to provide timely alerts of an increased risk to flight safety which may include resolution advice. e. For Airspace Management: — Real-tTime aAirspace eEnvironment — the display on the executive air traffic controller Controllers Working Position of the entire airspace configuration at a given time (e.g. restricted/danger areas). f. For Air Traffic Flow and Capacity Management: — Tactical & Real Time — the function that provides traffic prediction, flow monitoring and warning; g. For Support Information Services: — Aeronautical Information — provision of aeronautical information and data necessary for the safety, regularity and efficiency of air navigation; — Meteorological Information — meteorological report, analysis, forecast and any other statement relating to existing or expected meteorological conditions. 4. Criterion ‘Type of failure’ — the following options should be available for the ‘Type of failure’ criterion: a. Total loss of service/function — the service/function is not available to the controller or pilot; b. Partial loss of service/function — not all of the service/function is are available to ATC or pilot (e.g. loss of one or several sub-functions); c. Redundancy reduction — loss of a technical backup. There are fewer technical ways to provide the service/function; d. Undetected corruption of service/function — data presented is incorrect but is not detected and used as being correct — if the corruption is detected, it means the function will have to be removed totally (total loss of function) or partially (partial loss of function); e. Loss of supervision — unable to control or monitor the function. If this means that the main function has to be removed, then this would be a total loss; f. Corruption of supervision — undetected corruption of supervision. It has no impact unless a second action takes place. If left alone, there will be no impact. If an operator

does something in response to an incorrect indication, then a different type of failure could occur. 5. Criterion ‘Extension’ — the physical extension of the failure should be categorised as one of the following options: a. Controller Working Position — one Controller Working Position (CWP); b. Sector suite — a set of CWPs which work together to control a sector(s); c. Multiple suites — self-explanatory; d. Unit — as applicable, the entire ACC/UAC/APP operations room, the whole Tower, etc.

5. Criterion ‘Service affected’ — the effect of the system failure should be assigned to one of the following services: a. (Upper) Area Control Centre — ATC service for controlled flights in a block of airspace; b. Approach control — ATC service for arriving or departing of controlled flights; c. Aerodrome control — ATC service for aerodrome traffic; d. Oceanic control — ATC service for controlled flights over the high seas; e. Flight Information Service — service provided for the purpose of giving advice and information useful for the safe and efficient conduct of flights. 6. Criterion ‘Scope’ — the operational scope of the effect should be classified as one of the following options: a. One — one frequency, one aircraft as applicable; b. Some — as applicable more than one frequency, more than one a/c, etc., and less than all; c. All — all frequencies, all aircraft as applicable. 6. Criterion ‘Extension’ — the physical extension of the failure should be categorised as one of the following options: a. Controller Working Position (CWP) — one (CWP); b. Sector suite — a set of CWPs which work together to control a sector(s); c. Multiple suites — self-explanatory; d. Unit — as applicable, the entire ACC/UAC/APP operations room, the whole tower, etc.

7. Criterion ‘Duration’ — T1 is the time interval between the initiation of the technical event and the moment when it triggers actual or potential operational consequences either for the air traffic controller (ATCO) or the pilot. e. Duration less than T1 — this option should be chosen when the technical failure did not last long enough to trigger actual or potential operational consequences on the air traffic controller or the pilot. In such a case the severity of the ATM-specific occurrence should have no impact on the air traffic services and should be classified with severity E.

Consequently, there is no need for the user to further apply the RAT methodology for this technical failure (just record the severity E); f. Duration greater than or equal to T1 — this option should be selected when the technical failure lasted longer than or equally to T1 and triggered actual or potential operational consequences on the air traffic controller or the pilot. 7. Criterion ‘Scope’ — the operational scope of the effect should be classified as one of the following options: a. One — one frequency ATCO–pilot communication, one aircraft, as applicable; b. Some — as applicable, more than one frequency ATCO–pilot communication, more than one aircraft, etc., and less than all; c. All — all frequencies ATCO–pilot communication(s), all aircraft, as applicable.

C. Options for ATM-specific occurrences for the Network Manager

This section is exclusively applicable to the Network Manager. 1. Combination of criteria to assess NM ATM specific occurrences a. Criterion ‘Service provided’ - Air Traffic Flow Capacity Management (ATCFM) b. Criterion ‘Operational function’ - ATCFM Tactical/Real-Time (ATFCM-NMT) - ATFCM Pre-tactical (NMT) - ATFCM Strategic (NMS) c. Criterion ‘Type of failure’ - Total loss of function - Partial loss of function - Undetected corruption of function d. Criterion ‘Service affected’ - NM Flow management - NM Flight Planning - NM Airspace Data Management - NM CCAMS e. Criterion ‘Extension’ - NM position - NM multiple positions - NM Unit (NMOC – all Network Manager Operations Centre) f. Criterion ‘Scope’ - One (flight plan or airspace volume or code) - Some (flight plans or airspace volumes or codes) - All (flight plans or airspace volumes or codes)

CD. Severity

(…)

GM11 SKPI Severity classification based on the risk analysis tool methodology — Methodology for ATM-specific occurrences

A. Examples of some criteria for evaluating ATM-specific occurrences

Criterion ‘type of failure’

(…)

Figure 45 — : Total loss and redundancy reduction in air-ground communication

Criterion ‘extension’

(…)

Figure 56 — : ATC unit, sectors and suites

Criterion ‘Scope’

The table below gives an indication of what ‘one/some/all’ represents for different operational functions (criterion ‘Sscope’).

Services Operational functions Scope (how many … were impacted)

Communication aAir/G–ground Ccommunication cCommunication(s) ATCO/–pPilot Communication gGround/G–ground Ccommunication cCommunication(s) ATCO/ –ATCO Navigation nNavigation pPilots(s) Surveillance aAir Ssurveillance dDisplayed Rradar Ttrack(s) Surveillance gGround Ssurveillance dDisplayed Rradar Ttrack(s) Surveillance sSurface Mmovement Gguidance and aAircraft(s)/Vvehicle(s) Ccontrol ATS supported by fFlight and Ssurveillance Pprocessing fFlight Pplans(s) automation ATS supported by OPS Rroom Mmanagement N/A (extension should be sufficient) automation ATS supported by dDecision-Mmaking Ssupport fFlight(s) automation ATS supported by sSafety nNets Potential cConflict(s) automation ATS supported by rReal-Ttime Aairspace Eenvironment rRoute(s), Area(s), … automation Air Traffic Flow tTactical & Rreal Ttime fFlight(s) Capacity Management Information aAeronautical Iinformation iInformation Ttype(s) Sservices Information mMeteorological Iinformation iInformation Ttype(s) Sservices

Criterion ‘Duration’

When criterion ‘Duration’ is evaluated, T1 should be used for separating technical glitches with no operational consequences from failures that impact the ANSP ability to provide ATM services. Some of the values of T1 may be predefined, for example when they are part of the SLA between the technical and operational units (departments) or when they are part of the ATS unit safety case. When the value of T1 is predefined by the ANSP, it should be done based on inputs provided by the ATCOs and/or pilots. Alternatively, if a T1 is not predefined at the moment of the investigation, the evaluation of the ‘duration’ criterion may be done by determining if a particular occurrence/failure triggered actual or potential operational consequences (the criterion should be scored greater than or equal to T1). This value cannot be established at European level as it is dependent on the functionalities of the ATM provider’s system architecture, airspace complexity, traffic load and concept of operations. When choosing the option ‘less than T1’ or ‘greater than or equal to T1’ there is no need to know exactly the duration of the event but whether it has a potential or real operational impact, i.e. is greater, or not, than the T1 value established locally. Typical examples of operational impact where ‘Duration’ is greater than or equal to T1:  ATC/Pilot had to do something different;  ATC/Pilot is presented with incorrect, reduced or no information;  Workload increase;  Capacity reduction;  Reduced ability to provide safe services;  ATCO can no longer cope with the situation.

Criterion ‘Entry Criteria’

In order to ease the understanding of operational consequences, the following four scenarios complemented by examples, illustrate the ATM/ANS system both in a steady state and in failure modes. It is acknowledged that ‘redundancy reduction’ and ‘loss/partial loss/corruption of supervision’ are types of technical events that do not qualify for an ATM-specific occurrence and, therefore, their severity should not be assessed using the RAT methodology in the framework of Regulation (EU) No 390/2013 (the performance scheme Regulation). — Steady state of the technical system (no failure) The chart below illustrates a steady state where the ATM system delivers all operational functions as expected.

Figure 7: ATM-specific occurrences — ATM system in a steady state

— ATM specific technical event with a potential or real operational impact. Scenario A: ATC or pilot

has to apply mitigating measures in order to restore or maintain safe operations as a result of the ATM-specific occurrence.

Example 1: Technical event with an immediate operational consequence. The chart below provides the occurrence timeline in case of a total failure of an operational function. In the given example the failure has an operational impact on the ability to provide ATM services (this could be the case in a total failure of the air-–ground communication function, or total failure of surveillance function; see examples 1 and 3 below).

Figure 8: ATM-specific occurrences — Immediate operational consequence

The following moments are depicted on the timeline of the occurrence: T0 Technical event commences. This could be a total or partial loss of service. T1 Technical event triggers operational consequences on ATCO or pilot immediately and requires a RAT score higher than E. T1 to T2 Potential safety impact on ATC or pilot. T2 ATC or pilot now is operating with reduced but safe level of service. T3 The technical event finishes. T2 to T4 Business effect on ATC or pilot (e.g. regulations applied). T4 ATC/pilot returns to the desired level of activity.

— ATM-specific technical event with a potential or real operational impact

The chart bellow provides the occurrence timeline in case of a total failure of an operational function. In the given example the failure has an operational impact on the ability to provide ATM services (this could be the case in a total failure of the air-ground communication function, total failure of surveillance function; see examples 1 and 3 below). Example 2: Technical event with a delayed operational consequence. The chart below provides the occurrence timeline in case of a failure which, after a period of time, results in an operational consequence.

Figure 9: ATM-specific occurrences — Delayed operational consequence

The following moments are depicted on the time line of the occurrence:

T0 ATM-specific technical event Technical event commences. This could be a total or partial loss of service. T0 to T1 ATM-specific technical event has no operational impact as the ATC maintain desired traffic level ATC or pilot have no visibility of the event, or deal with it with no operational consequences. T1 ATM-specific technical event triggers operational consequences on ATC controller or pilot ATC or pilot can no longer tolerate the technical event. Operational consequences commence. At this point, the event becomes an ATM-specific occurrence and requires a RAT score higher than E. T1 to T2 Potential safety impact on ATC or pilot. T2 ATC or pilot now is operating with reduced but safe level of service. T3 The ATM-specific technical event The technical event finishes. T1 to T4 Business effect on ATC or pPilot (e.g. regulations applied). T4 ATC returns to the desired traffic levels.

— Redundancy reduction The chart below illustrates the occurrence timeline in the case of a redundancy reduction, Corrupted Supervision or Loss of Supervision where ATC or Pilot need to act differently, resulting in an Operational Consequence.

T3T3 T0 Time

T0 ATM-specific technical event commences. T1 Does not take place T2 Does not take place T0 to T3 ATM-specific technical event has no impact. ATC maintain desired traffic level. T3 ATM-specific technical event finishes. T4 Does not take place

— Scenario B: It is determined that no such mitigating measures were available (i.e. no action

possible).

Example 3: Technical event has operational consequences, but ATC or pilot have no mitigating measures available. The chart below illustrates a technical event which engineering, ATC and pilot are aware of but are unable to mitigate.

Figure 10: ATM-specific occurrences — Operational consequences with no mitigation

The following moments are depicted on the timeline of the occurrence: T0 Technical event commences. T1 ATC and pilot operate with no mitigation. A RAT score higher than E is required. T1 to T2 Potential safety impact on ATC or pilot. T3 The ATM-specific technical event finishes.

— Scenario C: ATC or pilot concludes that mitigating measures were not required on this occasion

due to the current operational conditions (e.g. favourable weather, low traffic levels, etc.).

Example 4: Failure with no operational consequence at the time. The chart below illustrates the occurrence timeline in the case of a failure where ATC or pilot concludes that mitigating measures were not required on this occasion due to the current operational conditions (e.g. favourable weather, low traffic levels, etc.).

Figure 11: ATM-specific occurrences — Failure with no operational consequence at the time

The following moments are depicted on the timeline of the occurrence: T0 Technical event commences. T1 Does not take place because the desired level of activity can be maintained. T2 Does not take place. T0 to T3 Although the technical event has no operational consequence at the time, a RAT score higher than E is required because there would be consequences under other operational conditions. T3 Technical occurrence finishes. T4 Does not take place.

— Scenario D: It is determined that ATC or pilot had been unknowingly operating with corrupt

information.

Example 5: Technical event provides misleading information. The chart below illustrates a technical event which is at the time unknown to engineering, ATC or pilot, and provides corrupt information to ATC or pilot which they believe to be correct.

Figure 12: ATM-specific occurrences — Operating with corrupt information

The following moments are depicted on the timeline of the occurrence: T0 Technical event commences. T1 ATC or pilot operate unaware of the misleading information being provided. A RAT score higher than E is required. T1 to T2 Potential safety impact on ATC or pilot. T3 The ATM-specific technical event finishes.

B. Look-up table

Following the selection of criteria options described in this AMC97 SKPI, the severity for an ATMspecific occurrence, including NM ATM-specific, may be determined by identifying the appropriate combination in the look-up table presented in Appendix 1 to GM1011 SKPI — Look-up table for severity classification of ATM-specific occurrences’ and retrieving the predetermined severity in the column ‘Severity’. The look-up table contains all the realistic combinations of the criteria described in this GM. An occurrence code is uniquely assigned to each combination.

It is to be noted that in case of combination of criteria that are not realistic, the severity is marked ‘X’ in the look-up table. In such case, the severity can not be determined (Category D). Therefore, the user should try to map a given failure to the credible combination available in the look-up table. A severity is predefined for each of the identified realistic combinations. An example of a section of this look-up table is given below:

Figure 613 —: Extract of the look-up table in Appendix 1 to GM11 SKPI

C. Examples for ATM-specific occurrences

In some cases the time at which operational consequences are encountered is predetermined by the ANSP in their safety cases. This aligns to T1 as described in the charts above.

Example 1

All communications with aircraft were lost in the sector South in the ACC X. The failure lasted 1 min 12 sec. The service provided was ‘cCommunication’. As the communication was lost with the aircraft, the operational function affected is ‘aAir-–gGround cCommunication’. No communication with the aircraft in the sector was possible during that time; therefore, the type of failure is ‘Total loss of function’. Service affected is ‘Area Control Centre’. The sector South was only ACC sector affected by the failure. As such, the extension is ‘Sector Suite’. In this case the communication with all aircraft in the sector was lost and therefore the scope is ‘All’. In ACC x, the time at which the operational consequences occur, i.e. T1 on the charts above, is predefined for the total loss of air–ground communication function as being T1 = 20 seconds. In the ACC x, the T1 is predefined for Total loss of Air-Ground communication function as being T1 = 20 seconds. As the total duration of failure is 1 min 12 sec, the duration is higher than T1 and, therefore, the RAT look-up table may be used. For these selected options, the corresponding combination in the look-up table is as follows:

Code Service Services Operatio- Type Extension Scope Duration T1 Severity aAffected nal of functions failure Air/– Total Area Ground loss of AR- control Commu- commu- fun- Sector AGC/120 services nication nication ction suite All > T1 ~20 s A

Therefore, the sSeverity for the failure in Example 1 is ‘A — Serious inability to provide safe ATM services’.

Example 2

Due to telecom failure there is loss of redundancy of some frequencies affecting several sectors in APP Z. There were two such occurrences at APP Z: one on day D which lasted 5 minutes and the other on day D+2 which lasted two hours. The service provided was ‘communication’. As the redundancy is for radio communication with the aircraft, the operational function affected is ‘air-ground communication’. The type of failure is ‘redundancy reduction’ and affects several sectors and several frequencies; therefore, the extension is ‘multiple suites’ and scope ‘some’. In the APP Z, the local procedure requires that in case of loss of back-up frequencies (i.e. redundancies), capacity limitations are put in place after 30 minutes, which is our T1. Therefore, duration of the failure on day D is less than T1 is directly classified as ‘E — No effect on ATM services’ and there is no need to use the look-up table. For the failure on day D+2 the duration is greater than or equal to T1 and therefore. The look-up table might be used and the corresponding combination is: Code Service Services Operatio- Type Extension Scope Duration T1 Severity Affected nal of functions failure Air/ Total Area Ground loss of AR- control Commu- commu- funct- Sector AGC/120 services nication nication ion suite All > T1 ~20s A

Therefore the severity for the failure in Example 2 on day D+2 is ‘C — Ability to provide safe but degraded ATM services’.

Example 23

Total failure of the radar data processing system (normal and back-up) in an ACC (duration 2 minutes). Service affected = Area control services. The service is ‘surveillance’ and the operational function is ‘air surveillance in the area control services’. It is a total loss of function which extends to the whole unit and affects all targets. For the combination above, T1 is set to ~ 40s, therefore, Duration is > T1 and, therefore, the look-up table might be used and the corresponding combination is: There is no predetermined T1 time for this failure at this particular ACC; however, operational consequences were encountered as defined above. Therefore, the look-up table might be used and the corresponding combination is as follows:

Service affected Services Operational Type of failure Extension Sco Durat T1 Seve Code functions pe ion rity AP- AGC/31 Approach Communi- Air/Ground Redundancy Multiple So 180 1 control services cation communi-cation reduction suites me > T1 0 s C

Code Service Services Operational Type of Extension Scope Duration T1 Severity affected functions failure Area Not AR- control Survei- Total loss speci ASV/100 services llance Air surveillance of function Unit All > T1 -fied A

Therefore, the sSeverity for the failure in Example 2 is ‘A — Serious inability to provide safe ATM services’.

AMC8 SKPI RAT methodology — Monitoring mechanism

The Member States’ points of contact, established in accordance with Directive 2003/42/EC Regulation (EU) No 376/2014 and Commission Regulation (EC) No 1330/2007, should collect verified information regarding the application of the RAT methodology for the reported occurrences within the scope of Commission Regulation (EU) No 691/2010390/2013as amended by Regulation (EU) No 1216/2011. When the Member States report on the monitoring of the performance plans and targets in accordance with Article 1718 of Commission Regulation (EU) No 691/2010390/2013, they should report the percentage of occurrences the severity of which has been evaluated by the application of the RAT methodology. For the application of the severity classification on an individual basis for all occurrences within the scope of the Rregulation, Member States should provide the data by making use of existing safety data reporting mechanisms, that is, either the European Central Repository and/or the Annual Summary Template (AST) mechanism, with enhancements where needed.