The Safety Register

EUROC ONTROL

ICAO 2012 Task Force Safety Register

Edition No. : 0.200 Draft Edition Issue Date : 15 Apr 2010 Author : HKO Reference : STD/SQS/SAM Copy No. :  stamp here CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM Document Control

Copyright Notice

© 2010 European Organisation for the Safety of Air Navigation (EUROCONTROL). All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of EUROCONTROL.

Approval Table

AUTHORITY DATE SIGNATURE

Author 9th of December 2010

Henk Korteweg Secretary ICAO 2012 FPL TF

Chairman ICAO 2012 FPL TF

Document Identification

Full Title: The Safety Register Total Number of Pages: 25

Edition: 0.200 Draft ii CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM

Edition History

Edition No. Edition Author Reason Issue Date 0.100 06 Dec 2010 H. Korteweg First Draft 0.200 Updated with additional Safety Considerations in area 8, 12, 14, 17 and 19 provided by Skyguide

Review Table

Edition No. Review type, scope, Reviewers Date Conclusion depth & focus

Edition: 0.200 Draft iii CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM Table of Contents

1 Executive Summary...... 5

2 Introduction...... 6 2.1 Purpose and disclaimer...... 6 2.2 Intended audience...... 6 2.3 Editorial note...... 6

3 Safety scanning description...... 7 3.1 Safety Scanning Workshop...... 7 3.2 Safety scanning methodology...... 7 3.3 Process related to Safety Scanning...... 8

4 Results of the Workshop...... 8 4.1 General...... 9 4.1.1 Relevant reference documentation...... 9 4.1.2 Setting the context and scope...... 9 4.1.3 Initial conclusion on scope and context...... 10 4.2 Safety management...... 11 4.2.1 Safety Planning...... 11 4.2.2 Planning of safety achievement...... 11 4.2.3 Planning of safety assurance...... 12 4.3 Operational safety...... 12 4.3.1 Procedures...... 12 4.3.2 Operating environment...... 13 4.3.3 Competence...... 14 4.3.4 Human-machine interaction...... 16 4.3.5 Communication...... 17 4.3.6 Reliability...... 18 4.4 Safety architecture...... 18 4.4.1 Transparency...... 19 4.4.2 Redundancy...... 20 4.4.3 Interdependence...... 20 4.4.4 Integrity...... 22 4.4.5 Maintainability...... 23

DOCUMENT FINAL PAGE...... 25

Edition: 0.200 Draft iv CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM

1 Executive Summary The Safety Scan process is intended to provide a high level assessment of the impact to systems, procedures and processes brought about by the implementation of Amendment 1 to PANS-ATM, on 15th November 2012. These PANS-ATM flight planning changes introduce new data items and also modify the basic data structure of some existing data items increasing significantly the volume and complexity of CNS related capabilities that can be provided. They also introduce the ability to submit a flight plan up to 120 hours in advance of the Estimated Off Block Time. These represent fundamental modifications to the existing flight planning provisions which will impact globally all systems and personnel involved in the processing and handling of flight plans and flight plan data. It is perhaps not surprising therefore that the main areas of concern identified by the scan, and illustrated within the diagrams below, involve:

- The need to ensure the necessary knowledge and competencies are acquired by all affected staff involved in aircraft operations and/or ATM operations; - The interoperability and interdependence of systems and their related data exchanges from flight plan creation systems right through the chain to radar data processing systems, airport systems and possibly even flight management systems, including all related man/machine interfaces.

Less obvious perhaps, were the concerns related to the deployment and transition period and in particular the potential impact that significant changes implemented simultaneously worldwide may have if different interpretations of the changes result in a lack of harmonisation. Inter- regional coordination and the need for robust testing activities were highlighted in addition to concerns related to redundancy and the need to consider contingency arrangements.

Edition: 0.200 Draft 5 CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM

2 Introduction

(1) This chapter describes the purpose of this document and its intended audience.

2.1 Purpose and disclaimer

(1) The purpose of this document is to provide a report on the Safety Scanning workshop conducted for the implementation of the changes resulting from changes to the ICAO flight plan, commonly referred to as “ICAO 2012”.

(2) This Safety Register aims both to raise safety awareness and to provide input to the planning of safety activities by providers and users of the pan-European ATM Network in support to the implementation of ICAO 2012.

(3) This Safety Register is by no means intended to replace or be reused as a singular safety argument which may be legally required by competent authorities for approval of changes related to ATM functional systems e.g. as required trough SES regulations or ESARR provisions.

(4) Verifiable resolution of Safety Considerations raised in this Safety Register could however be considered as additional evidence as part of a complete safety argument to satisfy the needs of competent authorities.

(5) This Safety Register does intend to provide an advanced “check-list” of Safety Considerations which should be worthwhile to providers and users within the pan-European Network to consider and effectively resolve prior to the implementation date of ICAO 2012, i.e. 15th of November 2012, 00.00 UTC.

(6) The final purpose of this Safety Register (and the consequent resolution of the raised Safety Considerations) is to achieve increased confidence, both, with providers and users of the pan- European Network and competent authorities responsible for overseeing safety, that ICAO 2012 can be implemented in an acceptably safe manner.

(7) This safety Register is to be considered as a living document which will evolve over time towards the effective implementation of ICAO 2012.

2.2 Intended audience

(1) The primarily intended audience of this document is the EUROCONTROL, ICAO 2012 FPL Task Force.

(2) The information contained in the Safety Register may also be of interest to a wider audience affected by the global implementation of ICAO 2012.

2.3 Editorial note

(1) This document is written in a EUROCONTROL CFMU format. As of the 1st of January 2011, the CFMU will be part of the EUROCONTROL Directorate Network Management.

(2) The Safety Scanning Methodology and related Tool IPR are subject to DG EUROCONTROL.

Edition: 0.200 Draft 6 CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM 3 Safety scanning description

(1) This chapter provides a short description of the Safety Scanning workshop which led to the creation of this safety register. It also provides a short description of the used methodology and the envisaged process related to the ICAO 2012 FPL TF.

3.1 Safety Scanning Workshop

(1) The “ICAO 2012” Safety Scanning workshop took place on the 6th of December 2010 at EUROCONTROL Headquarters in Brussels, Belgium.

(2) The Workshop was organized as part of the activities of the EUROCONTROL, ICAO 2012 FPL Task Force.

(3) Approximately 25 experts coming mainly from pan-European ATS providers attended the Workshop. One Airline Operator was present. The ICAO Paris Office was participating in the Workshop. No military of General Aviation representation was involved. Participant information has been collected by the Task Force secretary.

(4) The Safety Scanning took approximately 3 hours and 15 minutes (divided by a lunch break) and was moderated by a EUROCONTROL CFMU senior safety expert. The atmosphere at the workshop was positive and participation was constructive.

(5) The Safety Scanning workshop mainly focussed on Operational Safety and Safety Architecture issues related to the implementation of ICAO 2012. It did not address possible hazards arising from the changes to the FPL form itself.

3.2 Safety scanning methodology

(1) At the time this Safety Register is written (December 2010), the Safety Scanning methodology is undergoing final preparation for a Request for Comment by the EUROCONTROL Safety Regulation Commission (SRC). Formal publication is envisaged in the course of 2011. The tool and supporting material must therefore at this point in time be considered as draft.

(2) The methodology can be, in short, best described as expert based brainstorming using a credible set of criteria for safe design (so called Safety Fundamentals).

(3) These Safety Fundamentals cover 4 main areas which are considered as relevant for safety; a) (Safety) Regulation b) Safety Management Systems (SMS) c) Operational Safety d) Safety Architecture

(4) The methodology is supported by an MS EXCEL based application which contains an elaborate set of questions which are based on these Safety Fundamentals.

(5) The methodology can be used for a moderated discussion in a multi-stakeholder environment, but is also usable for individuals as a benchmark to verify safety aspects.

(6) The methodology focuses on success based Safety Assessment and Resolution in the conceptual and design phases of a change prior to the implementation of a change. It does not comprise of failure based Risk Assessment and Mitigation which is currently more commonly used in industrialization or implementation phases of a change.

3.3 Process related to Safety Scanning

(1) At this first workshop the Safety Scanning Tool was used to identify Safety Considerations.

(2) The Safety Considerations represent a snap-shot at the time of safety issues that are considered by the Task Force as relevant for resolution prior to the implementation of ICAO 2012.

(3) The Safety Considerations are captured in this Safety Register.

(4) The Safety Register will be offered to the ICAO 2012 FPL TF at the next meeting.

(5) After acceptance of the Safety Register the ICAO 2012 FPL TF will be asked to; a) Identify possible resolutions to the raised Safety Considerations; b) Propose which stakeholder (e.g. provider, user, regulator) should take action for the proposed resolution; c) Propose a timeframe by which the resolution should be successfully deployed in relation to the implementation date of ICAO 2012.

(6) The safety Register is envisaged to capture these questions, thereby becoming a central reference source to keep track of the proposed resolutions. Effectively, the Safety Register becomes in this way an action list which can be used as a reference during future TF meetings.

(7) The envisaged benefit of having this single reference source is that all stakeholders have a transparent view on the developments related to the implementation. It would also allow timely identification if the implementation would be endangered when resolutions could not be implemented in time.

(8) With the growing maturity of the implementation process and the growing general impact of the changes resulting from ICAO 2012, the ICAO 2012 FPL TF may consider an additional Safety Scanning at a later point in time.

4 Results of the Workshop

(1) This chapter represents the detailed outcome of the workshop.

(2) The results are presented in tables, linked to the structure of the safety Fundamentals.

(3) Safety Fundamentals that were considered as not affected by ICAO 2012 are not referred to in this overview of the results.

(4) The structure of the table in the General section describes in free text the appreciation of the experts of the current status of work.

(5) The structure of the more detailed tables is as follows: a) Numerical references to the Safety Fundamentals1 and the workshop b) Question related to the Safety Fundamental c) Safety Consideration d) Resolution e) Responsibility f) Timeframe

1 For explanation see section 3.1 and 3.2 on scope of the Workshop vs. scope of Safety Fundamentals. Edition: 0.200 Draft 8 CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM

4.2 General

4.2.1 Relevant reference documentation

(1) The following reference documentation was considered relevant for the current phase of the ICAO 2012 implementation; [1] ICAO State Letter AN13/2.1-08/50 25th June 2008, [2] ICAO State Letter AN13/2.1-09/9 6th Feb. 2009, [3] CFMU URD 1.2 June 2010, [4] ICAO 2012 TF Presentations

4.2.2 Setting the context and scope

(1) This section reflects the general appreciation of the involved TF members at the time of the safety Scanning workshop with respect to the implementation of ICAO 2012. 1 What is the level of maturity of the Implementation of ICAO 2012? SST1 The CFMU system specifications are mature. Discussions about the effects of ICAO 2012 are still ongoing so the actual “design” for implementation is not complete yet. E.g.;  FPL field 18 is considered as a "moving target"  The discussion on the use of EUR is still ongoing at ICAO level The interfaces outside Europe interface are currently still "unclear", especially towards Africa. Operator/ANSP systems specifications are in general currently under development.

In average; the maturity is considered as “development phase/pre-design” especially at ANSP/Operator level. 1.1 Who is affected by the Implementation of ICAO 2012 and why? SST1 In general everybody involved with flight plans (non-exhaustive):  CFMU IFPS,  ANSP,  Aerodrome Operators,  Flight planning service providers & their customers,  Pilots,  ATCOs,  Flight Data Operators,  Military,  General Aviation  Airport Operators,  CRCO, 1.2 Has the goal of the Implementation of ICAO 2012 been jointly set by the stakeholders? SST1 ICAO consultation mechanisms have been used as the basis of this change. Not all affected stakeholders may have been consulted to the full extent possible. ICAO Flight Plan study group worked on the content of this change. 1.3 How much would the implementation of the Implementation of ICAO 2012 change the functionality and the boundaries of the current situation? SST1 The use of DOF is a significant impact on this change. Use of Flight Plan Strips may be affected. FDP systems that use aircraft capability to calculate separation assurance will be impacted. Edition: 0.200 Draft 9 CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM

Use of Arrival and Departure procedures may be impacted. 1.4 Are there any constraints for implementation of the Implementation of ICAO 2012? SST1 Yes: a) ICAO State letters (Ref: [1] and [2]) b) Fixed implementation date c) Level of implementation at neighbour states, also with those who have none-IFPS neighbours d) AFTN constraints for “line of format messaging” e) System supplier capability to deploy all systems prior to set date

4.2.3 Initial conclusion on scope and context

(1) Although possibly perceived by some as a minor change to the ICAO Flight Plan and its use, the impact on the Total Network can not be underestimated as; a) All providers and users of Flight Plans and Flight Plan information seem affected, b) Global, regional and local coordination is required with neighbours with different applications and capabilities, c) Interdependencies between functional systems (people, procedures, systems) are affected, d) There are strict implementation limits, e) Supplier capabilities to deliver required system updates prior to O-date may be an issue

(2) Due to the identified scope and context, this change should be considered as a major change to the ATM functional system which includes the notion of the Total System as the impact of the changes extends beyond Air Traffic Service Providers.

4.3 Safety management

(1) Although not intended in the scope of this workshop some comments were raised which would fall in the category of SMS related Safety Fundamentals. These comments are included in this report for the sake of completeness. Safety Managers at the respective ATS providers which are subject to SES or ESARR requirements should be consulted on the full scope of the SMS Safety Fundamentals related to the ICAO 2012 change.

4.3.1 Safety Planning No. Safety Fundamental & Safety Consideration Resolution By Whom By When 8 Does the implementation of the Implementation of ICAO 2012 have an effect on the usual safety planning procedures and processes of the organisation? SST1 The Airport Operators, ANSPs and CFMU will need to consider the possibility of an increase in FPL rejections (at least during transition phase), which may require additional resources to cope.

4.3.2 Planning of safety achievement No. Safety Fundamental & Safety Consideration Resolution By Whom By When 9 Are the aspects of safety achievement addressed when planning for the implementation of the Implementation of ICAO 2012? SST1 The creation of “Safety Cases” related to the implementation should be considered subject to possible safety regulatory requirements? Testing and validation prior to implementation seems the most appropriate way to ensure safe implementation given the type of change.

4.3.3 Planning of safety assurance No. Safety Fundamental & Safety Consideration Resolution By Whom By When 10 Will safety assurance activities, conducted under an SMS, change due to the implementation of the Implementation of ICAO 2012? SST1 Internal monitoring mechanisms (e.g. occurrence reporting) should be reviewed especially on equipment level (e.g. recording and playback facilities)

4.4 Operational safety

(1) This section addresses Safety Considerations related to operational safety aspects.

4.4.1 Procedures No. Safety Fundamental & Safety Consideration Resolution By Whom By When 12 Does the implementation of the Implementation of ICAO 2012 result in changes in procedures? SST1 Yes, the following non-exhaustive list was identified:

a) Temporary procedures should be considered for the different "switches" in the transition to ICAO 2012 b) Flight Plan filing procedures in general for all involved actors will need to be reviewed c) Letters of Agreement need to be reviewed (neighbour relationship) d) FDO assistants for manual correction/ introduction of FPL e) FPL will be stored up to 5 days in advance,

which is currently not the case for GA, which implies new procedures f) GA filers of the FPL need to be more aware where to send the FPL g) Some additional IFPS procedures will be required h) Procedures for ATCOs coming from new FPL information. Indications in the FPL that affect the actions of ATCOs require consideration (e.g. AFIL) i) Procedures for creation and release of Aeronautical Information require review j) AOs to consider procedures to ensure consistency with FPL information and actual equipment availability on board k) AOs to consider procedures to ensure consistency with FPL information and actual crew certification on board l) AIPs should be reviewed as some FPL filing procedures are also described in them. 12.1 Are changes in procedures implied by the Implementation of ICAO 2012 well defined by the stakeholders? SST1 No, work to be done based on e.g. this Safety Register. 12.2 Are the tasks resulting from the Implementation of ICAO 2012 already clear enough to be well documented in procedures? No, not all tasks are yet clear based on e.g. this Safety Register.

4.4.2 Operating environment No. Safety Fundamental & Safety Consideration Resolution By Whom By When 13.1 Is traffic mix a safety-related consideration for the Implementation of ICAO 2012? SST1 Yes, the impact on ICAO 2012 implementation for, IFR/VFR and GAT/OAT should be considered from a FPL filer and FPL processing perspective. ICAO 2012 discussions currently focus on IFR/GAT.

4.4.3 Competence No. Safety Fundamental & Safety Consideration Resolution By Whom By When 14 Does the Implementation of ICAO 2012 change the required competences of any staff affected by the Implementation of ICAO 2012 at any operational level? SST1 Yes, the following non-exhaustive list of staff was ICAO for identified which may require training or as a minimum phraseology awareness information:

a) FDAs, b) ATCO e.g. what does FPL data mean (e.g. P for PRNAV) c) Pilots (for filing of FPL) d) General all actors involved in filing FPL e) Flight service centre (FIS, VFR support to pilots) f) IFPS operators g) System manufacturers (with respect to content of the change) Edition: 0.200 Draft 14 CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM

h) Dispatchers i) Maintainers of environmental data j) ARO staff (awareness) k) ATCO for phraseology. l) Airspace Designers (taking into account new information e.g. for procedural design) 14.1 Does the Implementation of ICAO 2012 change competence requirements for involved staff? SST1 Yes;

Aircraft capability requirements are now available on a much more detailed level. The understanding of this "newly available" information could increase the competence requirements on staff as more understanding may be needed.

Some ANSPs may receive FPL from different sources than IFPS. ANSP staff will have to decide which FPL actually should be fed into the system (collective addresses need to be considered in the detailed analysis). 14.2 Does the Implementation of ICAO 2012 change training requirements for involved staff? SST1 Possibly, see 14.1. 14.3 Can the required competence be sufficiently built up prior to the implementation of the Implementation of ICAO 2012? SST1 Some concern is that not all "flight-plan-filers" will be able in time to file in accordance to the new formats.

Consideration will need to be given that all people that Edition: 0.200 Draft 15 CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM

provide FPL to ANSPs will provide information in accordance with the new formats.

ANSPs and CFMU are likely to be in time.

Regulators/NSAs/State bodies may want to support this notion (if not already asked by the ANSP).

4.4.4 Human-machine interaction No. Safety Fundamental & Safety Consideration Resolution By Whom By When 15 Does the Implementation of ICAO 2012 have an effect on Human-Machine Interaction (HMI)? Yes, the following non-exhaustive list of HMI or organizations with HMI applications were identified which may require changes.

a) CFMU b) CFPS c) ATCO d) FDA e) Flight plan working positions at Flight Planning services, Possibly on electronic flight pack (to be determined). f) Electronic flight plans g) Possibly in the FMS (to be checked)

15.1 Does the Implementation of ICAO 2012 involve changes in workstation ergonomics or working environment, (e.g., computer interfaces, radar

screens, etc)? Possibly, to be considered at local level. 15.2 Is a possible increase of workload or task complexity resulting from the implementation of the Implementation of ICAO 2012 for all involved actors a consideration? Yes, see all the above. This could become an issue, especially during the transition period.

4.4.5 Communication No. Safety Fundamental & Safety Consideration Resolution By Whom By When 17 Does the implementation of the Implementation of ICAO 2012 affect the interaction between people at any operational level? Yes, the following non-exhaustive list of possible ICAO for changes to people interaction have been identified which phraseology may need further investigation;.

a) Between pilot/ATCO (e.g. AFIL) b) Between ATCOs and FDA (competence issue), c) Between FMP staff and CFMU helpdesk (procedures), d) Pilot and ADEP Phraseology (to be investigated) e) To be considered/investigate; the use of "significant point" f) Between anybody and the CFMU helpdesk (increased communication expected when IFPS starts rejecting FPL in old format. Edition: 0.200 Draft 17 CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM

g) At AO between "crewing" management and flight planning content (e.g. competence of the crew to deal with the capabilities presented in the FPL) 17.2 Will the implementation of the Implementation of ICAO 2012 shift the ways of communication? Possibly, the inclusion of FPL communication into the CFMU e-helpdesk is currently under consideration.

4.4.6 Reliability No. Safety Fundamental & Safety Consideration Resolution By Whom By When 18 Is the possible impact on reliability of the current operational environment or existing good practices a consideration? SST1 Possibly; Reliability of the output could be at stake during the transition period. Transition period will require strong and clear management.

Post-transition, aircraft equipment failure/maintenance regimes may lead to inconsistencies between FPL information and aircraft capabilities (see also 12. Procedures).

4.5 Safety architecture

(1) This section addresses Safety Considerations related to safety architecture aspects.

4.5.1 Transparency No. Safety Fundamental & Safety Consideration Resolution By Whom By When 19 Is the description of the Implementation of ICAO 2012 transparent, clear and complete? SST1 No, there are still a number of open issues. A non- ICAO for exhaustive list is; phraseology

a) Will other regions accept EUR in their FPL (ICAO/EUR usage) b) What will the length of field 10a or 10b be (needed for e.g. HMI) c) Field 10 could contain more than the AFTN 69 characters? Note: IFPS will provide a line-break to enable the message sending. ANSPs will need to consider how to process this format. Solution should come from ICAO (preferably soon). d) ICAO does not approve or disapprove use of EUR, but will be discussed through regional Supps. Doc. 7030. Besides ICAO 7030 it can be published via AIP. Conversation is still ongoing. e) Use of "Significant Point" is still unclear to some? Note: Significant point has not been changed in notion except with the inclusion of distance and bearing (to be included in awareness package). f) Technical design planning to be considered at ANSP and others. It is considered in general as “not ready” at this point in time. Edition: 0.200 Draft 19 CFMU EUROCONTROL Document Title: Document Reference: The Safety Register STD/SQS/SAM

g) Issue of need for phraseology is to be investigated

Note: CFMU translation service is ready for deployment and specification is available.

4.5.2 Redundancy No. Safety Fundamental & Safety Consideration Resolution By Whom By When 20 Is redundancy a consideration for the Implementation of ICAO 2012, either as a matter of concept or based on a safety need? SST1 Partially, there are some areas of concern:

a) No fall-back scenario is considered at the transition point (151112), i.e. there is no Global recovery plan. b) AOs are considering some redundancy as they want a "clear" switch. c) Translation function is a means for redundancy. Not to make switch 2 is an option if there is global delay or issues.

4.5.3 Interdependence No. Safety Fundamental & Safety Consideration Resolution By Whom By When 21 Is there a change in dependency with other operational elements? SST1 Yes, the following non-exhaustive list provides an overview of identified interdependencies with other operational elements that may be affected by this FPL change.

a) Decision support tools b) Safety nets c) Interface with CFMU systems (rejection of incorrectly filed FPL by the IFPS) d) Mixture of FPL formats during transition e) Between FDPS and HMI and vice versa f) Interface between FDP/HMI and RDP (depends on local design) g) OLDI h) DMAN-AMAN tools i) AO FPL software j) AO electronic flight packs k) Aircraft Maintenance systems (e.g. MEL) l) Stand Allocation and Management systems m) CDM systems n) AIDC (oceanic interface, similar to OLDI) o) Data preparation systems (DPR/Data preparation; environmental data, matrices for local translation etc.) p) Military systems (to be raised within the State), Note: military groups coming to Eurocontrol have received information? q) Simulators

21.1 How much does the performance of the Implementation of ICAO 2012 depend on the performance of other air transport operational elements? SST1 Many dependencies; basically this change affects “everybody” 21.2 Does the performance of the Implementation of ICAO 2012 have the potential to affect the performance of other air transport operational elements? SST1 Yes;

Many Network/aviation systems will be modified at the same time. This has not happened for a very long time.

Simultaneous implementation/modifications require strong coordination (also outside Europe). 21.3 Does the implementation of the Implementation of ICAO 2012 rely on changes to or requirements on other air transport operational elements? SST1 Yes; see 21.2 21.4 Does the Implementation of ICAO 2012 increase the interaction with other air transport operational elements in their current operation? SST1 Yes; See section on communication. Validation/testing arrangements should be considered.

4.5.4 Integrity No. Safety Fundamental & Safety Consideration Resolution By Whom By When 23 Is the possibility of the Implementation of ICAO 2012 providing harmful outputs a consideration? SST1 Yes, there is a strong sense in the TF that systems that

are affected should be tested.

a) There is a possible dilution of information, inside the translation function (from field 10 to Field 18) which makes it more difficult to withdraw the information. b) Harmful output can be a possibility if the integrity of the input (i.e. the new format FPL) is not consistently applied. c) As a principle; message checking systems may lose output due to integrity of the input. 23.2 Is it proposed to monitor the integrity of the output of the Implementation of ICAO 2012 and how? SST1 Possibly;

a) Input and Output monitoring is to be discussed and agreed upon. b) To be discussed also between Safety Manager at ATSP and NSA. c) Early new FPL filing is considered as a pre- operational monitoring.

4.5.5 Maintainability No. Safety Fundamental & Safety Consideration Resolution By Whom By When 24 Will it be difficult to fix any errors occurring after the Implementation of ICAO 2012 is implemented? SST1 Possibly; no significant changes are expected but more consideration is needed.

a) ANSPs may have to maintain systems to support prolonged processing of old-format FPL post 2012 and identification of ANSPs that have not made the transition. b) The simultaneous multi-system change may bring new risks that are yet unknown and will need to be further looked at Note: logical modelling related to interdependence may provide more information c) Type of error determines the possibility for fixing

END OF LISTS

DOCUMENT FINAL PAGE

To properly report any fault, or to propose a modification concerning the present document, please refer to: - for faults, the CFMU Systems Incident Management Procedure, ref. STD-CM/PRO/SIMP - for modifications, the Change Control Procedure, ref. STD-CM/PRO/CCPUG

Edition: 0.200 Draft 25