S.L. 499.45 Art. 10ATM hazard identification and risk assessment and mitigation.

(1) A provider of air traffic management shall comply with the requirements of ESARR 4 to ensure that hazard identification as well as risk assessment and mitigation are systematically conducted for any changes to those parts of the air traffic management system and supporting services within his managerial control, in a manner which addresses -

(a) the complete life cycle of the constituted part of the ATM system under consideration, from initial planning and definition to post implementation operation, maintenance and decommissioning;

(b) the airborne and ground components of the ATM system through cooperation with responsible parties; and

(c) the three different types of ATM elements (human, procedures and equipment), the interaction between these elements and the interaction between the constituent part under consideration and the remainder of the ATM system.

(2) The hazard identification, risk assessment and mitigation processes shall include:

(a) a determination of the scope, boundaries and interfaces of the constituent part being considered, as well as the identification of the functions that the constituent part is to perform and the environment of operations in which it is intended to operate;

(b) a determination of the safety objectives to be placed on the constituent part, incorporating:

(i) an identification of ATM-related credible hazards and failure conditions, together with their combined effects;

(ii) an assessment of the effects they may have on the safety of aircraft, as well as an assessment of the severity of those effects, using the severity classification scheme provided in ESARR 3 Appendix A; and

(iii) a determination of their tolerability, in terms of the hazard’s maximum probability of occurrence, derived from the severity and the maximum probability of the hazard’s effects, in a manner consistent with ESARR 3 Appendix A;

(c) the derivation, as appropriate, of a risk mitigation strategy which -

(i) specifies the defences to be implemented to protect against the risk-bearing hazards;

(ii) includes, as necessary, the development of safety requirements potentially bearing on the constituent part under consideration, or other parts of the ATM System, or equivalent of operations; and

(iii) presents an assurance of its feasibility and effectiveness;

(d) verification that all identified safety objectives and safety requirements have been met -

(i) prior to its implementation of the change;

(ii) during any transition phase into operational service;

(iii) during its operational life; and

(iv) during any transition phase till decommissioning.

(3) The results, associated rationales and evidence of the risk assessment and mitigation processes, including hazard identification, shall be collated and documented in a manner which ensures that -

(a) correct and complete arguments are established to demonstrate that the constituent part under consideration, as well as the overall ATM System are, and will remain, tolerably safe including, as appropriate, specifications of any predictive, monitoring or survey techniques being used; and

(b) all safety requirements related to the implementation of a change are traceable to the intended operations and, or functions.