Regulation 2008/482 - Software safety assurance system to be implemented by air navigation service providers and amending Annex II to Regulation (EC) No 2096/2005 - Main contents

EN

Official Journal of the European Union

L 141/5

Pursuant to Regulation (EC) No 550/2004, the Commission is required to identify and adopt the relevant provisions of the Eurocontrol Safety Regulatory Requirements (ESARRs), taking into account existing Community legislation. ESARR 6 entitled ‘Software in ATM systems’ provides a set of safety regulatory requirements for the implementation of a software safety assurance system.

Commission Regulation (EC) No 2096/2005 of 20 December 2005 laying down common requirements for the provision of air navigation services (2) states in the last sentence of Recital 12 that ‘The relevant provisions of ESARR 1 on safety oversight in ATM, and of ESARR 6 on software in ATM systems, should be identified and adopted by way of separate Community acts.’

Annex II to Regulation (EC) No 2096/2005 requires providers of air traffic services to implement a safety management system as well as safety requirements for risk assessment and mitigation with regard to changes. Within the framework of its safety management system, and as part of its risk assessment and mitigation activities with regard to changes, a provider of air traffic services should define and implement a software safety assurance system to deal specifically with software related aspects.

The prime software safety objective to be met for functional systems that contain software is to ensure that the risks associated with the use of software in the European Air Traffic Management network systems (EATMN software) have been reduced to a tolerable level.

This Regulation should not cover military operations and training as referred to in Article 1(2) of Regulation (EC) No 549/2004 of the European Parliament and of the Council of 10 March 2004 laying down the framework for the creation of the single European sky (the framework Regulation) (3).

Annex II to Regulation (EC) No 2096/2005 should therefore be amended accordingly.

The measures provided for in this Regulation are in accordance with the opinion of the Single Sky Committee,

‘software’ means computer programmes and corresponding configuration data, including non-developmental software, but excluding electronic items, namely application specific integrated circuits, programmable gate arrays or solid-state logic controllers;

‘configuration data’ means data that configures a generic software system to a particular instance of its use;

‘non-developmental software’ means a software not developed for the current contract;

‘safety assurance’ means all planned and systematic actions necessary to provide adequate confidence that a product, a service, an organisation or a functional system achieves acceptable or tolerable safety;

‘organisation’ means either an ATS provider, a CNS provider or an entity providing ATFM or ASM;

‘functional system’ means a combination of systems, procedures and human resources organised to perform a function within the context of ATM;

‘risk’ means the combination of the overall probability, or frequency of occurrence of a harmful effect induced by a hazard and the severity of that effect;

‘hazard’ means any condition, event, or circumstance which could induce an accident;

‘new software’ means a software that has been ordered or for which binding contracts have been signed after the entry into force of this Regulation;

‘safety objective’ means a qualitative or quantitative statement that defines the maximum frequency or probability at which a hazard can be expected to occur;

‘safety requirement’ means a risk-mitigation means, defined from the risk-mitigation strategy that achieves a particular safety objective, including organisational, operational, procedural, functional, performance, and interoperability requirements or environment characteristics;

‘cutover or hot swapping’ means the approach of replacing European air traffic management network (EATMN) system components or software while the system is operational;

‘software safety requirement’ means a description of what is to be produced by the software given the inputs and constraints, and if met, ensures that EATMN software performs safely and according to operational need;

‘EATMN software’ means software used in the EATMN systems referred to in Article 1;

‘requirements validity’ means the confirmation by examination and provision of objective evidence that the particular requirements for a specific use are as intended;

‘achieved with independence’ means, for software verification process activities, that the verification process activities are performed by a person(s) other than the developer of the item being verified;

‘software malfunction’ means the inability of a programme to perform a required function correctly;

‘software failure’ means the inability of a programme to perform a required function;

‘COTS’ means a commercial available application sold by vendors through public catalogue listings and not intended to be customised or enhanced;

‘software components’ means a building block that can be fitted or connected together with other reusable blocks of software to combine and create a custom software application;

‘independent software components’ means those software components which are not rendered inoperative by the same failure condition that causes the hazard;

‘software timing performances’ means the time allowed for the software to respond to given inputs or to periodic events, and/or the performance of the software in terms of transactions or messages handled per unit time;

‘software capacity’ means the ability of the software to handle a given amount of data flow;

‘accuracy’ means the required precision of the computed results;

‘software resource usage’ means the amount of resources within the computer system that can be used by the application software;

‘software robustness’ means the behaviour of the software in the event of unexpected inputs, hardware faults and power supply interruptions, either in the computer system itself or in connected devices;

‘overload tolerance’ means the behaviour of the system in the event of, and in particular its tolerance to, inputs occurring at a greater rate than expected during normal operation of the system;

‘correct and complete EATMN software verification’ means all software safety requirements which correctly state what is required of the software component by the risk assessment and mitigation process and their implementation is demonstrated to the level required by the software assurance level;

‘software life cycle data’ means the data that is produced during the software life cycle to plan, direct, explain, define, record, or provide evidence of activities; this data enables the software life cycle processes, system or equipment approval and post-approval modification of the software product;

‘software life cycle’ means:

‘system safety requirement’ means a safety requirement derived for a functional system.

the software safety requirements correctly state what is required by the software, in order to meet safety objectives and requirements, as identified by the risk assessment and mitigation process;

traceability is addressed in respect of all software safety requirements;

the software implementation contains no functions which adversely affect safety;

the EATMN software satisfies its requirements with a level of confidence which is consistent with the criticality of the software;

assurances are provided confirming that the general safety requirements set out in points (a) to (d) are satisfied, and the arguments that demonstrate the required assurances are at all times derived from:

is documented, specifically as part of the overall risk assessment and mitigation documentation;

allocates software assurance levels to all operational EATMN software in compliance with the requirements set out in Annex I;

includes assurances of:

determines the rigour to which the assurances are established; the rigour must be defined for each software assurance level, and increase as the software increases in criticality; for that purpose:

uses feedback of EATMN software experience to confirm that the software safety assurance system and the assignment of assurance levels are appropriate. For that purpose, the effects from a software malfunction or failure reported according to the relevant requirements on reporting and assessment of safety occurrences shall be assessed in comparison with the effects identified for the system concerned as per the severity classification scheme established in Section 3.2.4 of Annex II to Regulation (EC) No 2096/2005.

The software assurance level shall relate the rigour of the software assurances to the criticality of EATMN software by using the severity classification scheme set out in Section 4 of point 3.2.4 of Annex II to Regulation (EC) No 2096/2005 combined with the likelihood of the occurrence of a certain adverse effect. A minimum of four software assurance levels shall be identified, with software assurance level 1 indicating the most critical level.

An allocated software assurance level shall be commensurate with the most severe effect that software malfunctions or failures may cause, as referred to in Section 4 of point 3.2.4 of Annex II to Regulation (EC) No 2096/2005. This shall, in particular, take into account the risks associated with software malfunctions or failures and the architectural and/or procedural defences identified.

EATMN software components that cannot be shown to be independent of one another shall be allocated the software assurance level of the most critical of the dependent components.

Software safety requirements shall specify the functional behaviour in nominal and downgraded modes, of the EATMN software, timing performances, capacity, accuracy, software resource usage on the target hardware, robustness to abnormal operating conditions and overload tolerance, as appropriate.

Software safety requirements shall be complete and correct, and compliant with the system safety requirements.

The functional behaviour of the EATMN software, timing performances, capacity, accuracy, software resource usage on the target hardware, robustness to abnormal operating conditions and overload tolerance, shall comply with the software requirements.

The EATMN software shall be adequately verified by analysis and/or testing and/or equivalent means, as agreed with the national supervisory authority.

The verification of the EATMN software shall be correct and complete.

Configuration identification, traceability and status accounting shall exist such that the software life cycle data can be shown to be under configuration control throughout the EATMN software life cycle.

Problem reporting, tracking and corrective actions shall exist such that safety related problems associated with the software can be shown to have been mitigated.

Retrieval and release procedures shall exist such that the software life cycle data can be regenerated and delivered throughout the EATMN software life cycle.

Each software safety requirement shall be traced to the same level of design at which its satisfaction is demonstrated.

Each software safety requirement, at each level in the design at which its satisfaction is demonstrated, shall be traced to a system safety requirement.