Technical Proposal for Unmanned Aircraft Systems (UAS) Safety Case Development

Transcription

1 Response to Task Requirement Sheet T Technical Proposal for Unmanned Aircraft Systems (UAS) Safety Case Reference Date: 15 Dec 2008 Issue: V1.0 Prepared by: Alan Simpson Checked by: Joanne Stoker Authorised by: Mike Sotirakos Distribution: EUROCONTROL Ebeni Holger Matthiesen Sales File Christopher Machin Commercial in Confidence

2 Technical Copyright The layout, style, logo and contents of this document are copyright of Ebeni Limited No part of this document may be reproduced without the prior written permission of Ebeni Limited. All rights reserved. Configuration Control Issue Date Comments v0.1 Draft 10 Dec 2008 Initial draft for internal review v1.0 Definitive 15 Dec 2008 Definitive Issue for Release Commercial in Confidence Page 2 of 61

3 Technical Table of Contents 1 Introduction General Background Ebeni UAS and ATM Experience Overview of Ebeni Limited Contents of this Proposal 7 2 Technical Approach Technical Appreciation Introduction Understanding of the Key Safety Issues Overall Safety Argument Implementation Plan Overview Safety Assessment FHA/PSSA Workshop Post Workshop Activities Staffing the Study 12 3 Meeting the Required Experience Criteria Experience Requirement Experience Requirement Experience Requirement Experience Requirement Experience Requirement Experience Requirement Experience Requirement Experience Requirement Experience Requirement Experience Requirement Work Plan and Project Management Work Breakdown Schedule of Deliverables Meetings Assumptions Dependencies Risks Working Arrangements 20 Appendix A Curriculum Vitae 23 Commercial in Confidence Page 3 of 61

4 Technical 1 Introduction 1.1 General This technical proposal is submitted by Ebeni Limited in response to EUROCONTROL s Task Requirement Sheet T on of an Unmanned Aircraft [1]. A financial proposal is provided under separate cover within Form AF3/2TRS (Financial Proposal and Price Declaration). 1.2 Background The evolution of aerospace technologies in the field of Unmanned Aircraft Systems (UAS), including automatic/autonomous operations, will impact European ATM as regards new military and civil UAS applications. UAS will represent new challenges as well as new opportunities for ATM design in the future in the context of both SESAR and beyond (vision 2050), for the benefit of both manned and unmanned aviation. The EUROCONTROL Agency, in executing its responsibilities associated with the management of the pan-european ATM network, must ensure that UAS do not negatively impact overall levels of ATM security, safety, capacity and efficiencies. Assuring the safety of UAS operations in non-segregated airspace requires a significant update to key elements of extant regulations and standards. UAS have yet to establish a good safety record and there are many challenges both regulatory and technological to be resolved before such operations can become common place. of a coherent regulatory framework (i.e. regulations, standards, etc.) for certifying UAS systems must be argued as acceptably safe within the context of the whole operational Air Traffic environment. 1.3 Ebeni UAS and ATM Experience Having assessed the TRS requirements and noted the timeframe and need for flexibility, Ebeni believes it possesses all the necessary attributes to perform the task and offers: Extensive experience in assessing the safety of actual and theoretical UAS operations in all classes of airspace In-depth competence in the areas of safety assessment and the development of safety requirements, especially within the EUROCONTROL environment for a whole range of projects including Military UAV OAT Task Force, Overall ATM/CNS Target Architecture (OATA), Mode S, ACAS II, EUROAT, RVSM, etc. Substantial experience in the UAS industry with subject matter experts in, for example, UAS airworthiness, ground control system and control link safety A wealth of analytical and reporting capability consistent with a commitment to the provision of a high-quality consultancy service Practical knowledge of EU Commission directives in regards the European Aviation Safety Regulatory environment including ESARRs, SES and associated Implementing Rules Availability of personnel with the necessary expertise and flexibility to accommodate change. Commercial in Confidence Page 4 of 61

5 Technical Ebeni proposes Alan Simpson as the technical lead for the work supported by Joanne Stoker, Ed Macfarlane and Vicky Brennan. Alan has over 20 years experience as a safety engineer and has worked in the UAS industry for the last 7 years specialising in the safety issues associated with operating UAS in non-segregated airspace and taking an active role in helping the UAS industry to understand the safety issues of UAS operations in the ATM environment. Jo has over 10 years experience as a safety engineer extensively in the ATM domain and has worked with Alan on a number of EUROCONTROL safety tasks including the development of safety requirements for the EUROCONTROL Military UAV OAT Task Force deliverable. Vicky is an experienced Safety Consultant and Independent Safety Advisor/Auditor with a strong background in the assessment of military aircraft and other military systems for certification, including synthetic environments and simulator training systems. Over the last 5 years Vicky has specialised in the assessment and development of unmanned air vehicle systems (UAVS), dealing with new systems and operating environments and their affect on safety. Vicky s last role was as the Technical Authority for the Safety Case Programme for the Watchkeeper System. She led a team of Safety Engineers dedicated to the assessment of this highly complex and extensively integrated UAV System and her expertise is frequently sought by new suppliers of UAV s to the MOD. Ed is a Safety Engineer with four years practical safety engineering experience gained within the Air Traffic Management (ATM), Nuclear and Oil industries. Ed has worked across a wide range of different industries concentrating on safety and risk assessment. Most recently Ed has been supporting EUROCONTROL s Regulatory Unit on a task to assess the data integrity requirements of Data Items published in Aeronautical Information Publications (AIP) that are not covered by ICAO Annex 15 et al. This task supports the development of the harmonised list of data items for use between Data Providers and Data Users. This work forms part of the DQR Means of Compliance for the ADQ Implementing Rule. Additional specialist engineers/experts can be called upon to support the team if necessary, including experts in UAS operations, UAS security and Air Traffic Control. Further detail of all team members is provided in Section 3 below together with specific roles and working arrangements. A copy of each CV can be found at Appendix A. 1.4 Overview of Ebeni Limited Ebeni Limited was established in 2004 by a team of professional engineers with extensive experience across the ATM, Aerospace, Defence, Rail and Finance markets. Since that time Ebeni has grown year on year and expanded its customer base to include many blue chip companies and organisations including: EUROCONTROL (HQ and CFMU), NATS, SELEX SI, Terma, Thales and BAE Systems. Ebeni provides highlevel expertise in safety and operational risk assessment and management, mission or business critical applications offering a reliable, high-quality capability. We offer a very high level of practical experience, know-how, contacts, and confidentiality. Clients know that working with Ebeni will provide them an innovative solution whist providing excellent value for money. Ebeni s business is built on the principle of providing real benefit to its customers and prides itself on understanding what the client needs and going the extra mile to ensure it is delivered to the client. The Ebeni team has worked successfully within the UAS domain on a number of projects including: Commercial in Confidence Page 5 of 61

6 Technical Derivation of safety requirements and development of a Safety Assurance Report on the Draft EUROCONTROL Specifications for the Use of Military Unmanned Aerial Vehicles as Operational Air Traffic Outside Segregated Airspace Safety assessment supporting research into the requirements for Sense and Avoid systems from an ATM perspective in all classes of airspace as part of the UK funded Autonomous Systems Technology Related Airborne Evaluation and Assessment (ASTRAEA) project Ongoing support to a UK Defence Contractor in various UAS development programmes Safety assessment and safety case development for the WATCHKEEPER Tactical UAS, both air vehicle and ground control systems, operating in segregated and non-segregated airspace Preliminary safety assessment of NATO specifications for Sense and Avoid Systems Participants in the EUROCONTROL/JAA taskforce for UAVS operations Ongoing association with the work of EUROCAE Working Group 73 In addition, Ebeni has worked successfully with EUROCONTROL on a number of projects including: Undertaking the safety assurance of the EUROCONTROL Harmonised Rules for Operational Air Traffic (OAT) under Instrument Flight Rules (IFR) inside controlled Airspace of the ECAC Area (EUROAT) Developing the Safety Summary Report and undertaking the safety assessment of the Overall ATM/CNS Target Architecture (OATA) Developing a Post-Implementation Safety Argument for ACAS II Developing outline safety cases for European Commission Interoperability Mandate Implementing Rules for Initial Flight Planning, Co-Ordination and Transfer, Aeronautical Data Quality, Mode S Interoperability and Surveillance Performance and Interoperability Provision of ongoing safety support to EUROCONTROL s Regulatory Unit (RU) in relation to the development of several European Commission Interoperability Mandates, primarily for Aeronautical Information Services Developing a retrospective safety case and undertaking safety assessments for the EUROCONTROL European Aeronautical Information Service (AIS) Database (EAD) System and its associated Services Ongoing in-service maintenance of the EAD Safety Case to reflect new releases of the system and providing safety guidance to support member state ANSPs using EAD Updating the EUROCONTROL Safety Case Manual In addition Ebeni works extensively with ATM equipment manufacturers and ANSPs across Europe and in other industries such as Aviation and Defence. Commercial in Confidence Page 6 of 61

7 Technical 1.5 Contents of this Proposal Section 2 contains our analysis of the task, the requirements that must be taken into account in developing a solution and our detailed technical approach. Section 3 demonstrates how our proposed team and approach meets EUROCONTROL s required experience for the project. Section 4 contains information on how we will implement the work including details of our proposed Work Breakdown Structure for the project, project resources, a schedule of deliverables, assumptions and dependencies. Annex A contains full CVs for each member of our core team. Commercial in Confidence Page 7 of 61

8 Technical 2 Technical Approach This section presents our understanding of the technical issues associated with undertaking the task and our approach for delivering all outputs in a timely and efficient manner. The approach detailed below has been written in response to the Task Specification [1]. 2.1 Technical Appreciation Introduction Unmanned Aerial Systems (UAS) are set to become part of everyday air traffic operations perhaps within the next few years / decades; however there are significant challenges that need to be addressed in order to seamlessly introduce UAS into non segregated airspace. Ebeni has already conducted significant research to identify some of the safety challenges in achieving this objective in the context of the current regulatory framework as part of the UK funded ASTRAEA project. That research was based on how one might rigorously argue the safety of UAS operations in nonsegregated airspace from an Air Traffic Management (ATM) perspective; adapting the EUROCONTROL UAS OAT TF safety work 1 and using the EUROCONTROL combined success and failure approach. Current UAS operations are largely constrained to designated danger areas or within temporary restricted areas of airspace, commonly known as segregated airspace, or are flown under special arrangements over the sea or high altitude. On some occasions, UAS operations are permitted in an extremely limited environment outside segregated airspace. To exploit fully the unique operational capabilities of current and future UAS and thus realise the potential commercial benefits of UAS, there is a desire to be able to access all classes of airspace and operate across national borders and airspace boundaries. Such operations must be acceptably safe but regulation should not become so inflexible or burdensome that the commercial benefits are unnecessarily lost. The viability of the commercial market for UAS especially is heavily dependent on unfettered access to the same airspace as manned civilian operations, at least in like for like operations, for example in overnight cargo transportation. Whilst it is essential that UAS demonstrate an equivalent level of safety compared to manned operations the current regulatory framework has evolved around the concept of the pilot-in-the-cockpit. There is a need to develop UAS solutions that assure an equivalent level of safety for UAS operations, which in turn will require adaptation of the current regulatory framework to allow for the concept of the pilot-not-in-the-cockpit without compromising the safety of other airspace users Understanding of the Key Safety Issues One of the major issues facing UAS operations is the demonstration of equivalence (in particular for See and Avoid) in the context of an evolving ATM environment. It is very important that all involved in the UAS industry understand that the current ATM environment is not static. Achieving equivalence with manned operations is not a fixed target as there are many significant changes proposed (e.g. through SESAR) that aim to improve operational efficiency and performance or enhance safety. On the whole proposed changes to the ATM environment could be seen as advantageous to UAS operations as more and more functions within the environment are automated thus there is a significant opportunity for the UAS industry and ANSPs to influence the shape of the future ATM environment to support wider UAS operations. 1 The research looked more closely at the role of collision avoidance and the interaction with separation provision functions, although excluded the landing/take-off phase of flight as there are currently specific issues associated with UAS operations at this stage, necessitating the provision of separate automatic landing aids for UAVs. Commercial in Confidence Page 8 of 61

9 Technical Other safety issues to be addressed include, but are by no means limited to: The reliability of the UAV and Data Link as this is key to minimising the workload impact on ATC arising from excessive instigation of emergency or contingency procedures. Interaction with ACAS II. Whilst current TCAS cannot be fitted to UAVs (for a variety of performance and integrity reasons), a substantial increase in the amount of non-fitted aircraft could undermine the overall efficacy of ACAS II. Although an automated response to a Resolution Advisory (RA) improves the performance of TCAS (poor pilot response is a major contributor to inadequate RA response) the current system still relies on the pilot as the final arbiter on Collision Avoidance manoeuvres. The EUROCONTROL UAV specifications imply that automated responses should be the exception (see UAV8 in [Error! Reference source not found.]) although the NATO Sense & Avoid specifications suggest otherwise (see CAS8 and CAS9 in [8]). An equivalent to pilot visual acquisition, even if only operating in controlled airspace, remains a major barrier to unfettered UAS operations Overall Safety Argument The task as defined within the Task Requirement Sheet is to develop an ATM safety assessment for UAS so as to identify a set of ATM safety requirements, over and above the existing ATM regulatory safety requirements, which, if implemented, will ensure that the introduction of UAS into non-segregated airspace will be acceptably safe. The safety assessment will consider two defined UAS operating scenarios in order to provide a realistic context into which UAS will be operated. Scenario 1 covers UAS operations in Class A, B or C airspace flying IFR in en-route only which may also be beyond the visual line of sight of the pilot-incommand Scenario 2 covers UAS operations in airspace where VFR flight is permitted and the pilot-in-command has direct line of sight of the UAV 2 For ease of understanding a separate safety argument and Preliminary Safety Case (PSC) are to be produced for each scenario. A separate report summarising the findings for non-safety experts will also be produced aimed at a broad readership within the UAS community. The safety assessment and the PSCs will be carried out in line with ESARR 4 [6] using the EUROCONTROL Safety Assessment Methodology (SAM) [3], including the success and failure safety argument approaches. The high-level safety argument will be developed in the early stages of the project and will address the overall claim that UAS operations are acceptably, in principle, in the context of the scope of operations defined for each scenario. The PSC will only focus on the evidence for the adequacy of safety requirements for each operational scenario and include guidance on issues associated with satisfaction of this argument in TMA and other argument strands, i.e. for implementation, transition and operational safety monitoring. Each safety argument will aim to show that: 1. The UAS Concept in the given scenario is intrinsically sound. 2. Everything necessary has been specified, as safety requirements for functionality and performance of the various elements (covering airspace, equipment, people and procedures) of the UAS concept of operations, to 2 It may be of interest to EUROCONTROL that we have already conducted safety assessments on VFR operations beyond the pilot visual line of sight and the implications therefore for UAS operations. We would be happy to discuss inclusion of this work in the consideration of this scenario, if appropriate. Commercial in Confidence Page 9 of 61

10 Technical ensure that the eventual implementation will be safe, in the absence of failure of/within those elements. 3. The UAS concept of operations, at a functional and logical-architecture level, is complete, coherent and operates correctly (in a dynamic sense) under all foreseeable normal operational conditions. 4. The UAS concept of operations is robust against all foreseeable abnormal conditions (including failures external to the UAS concept of operations). 5. Any risks introduced as a result of failures internal to the UAS concept of operations, have been assessed, and mitigated adequately, and that those mitigations have been captured as additional safety requirements. 6. All safety requirements have been shown to be realisable i.e. are capable of being satisfied by the various elements of a typical implementation (using people, procedures, available technology as appropriate). 7. All Evidence relating to the arguments is trustworthy. 2.2 Implementation Plan Overview Our proposed approach is based on the tasks identified in the TRS. The initial activity will be to determine an appropriate safety criteria and high-level safety argument for each scenario. The Military UAV OAT safety assessments utilised a relative safety criteria in order to derive safety requirements. The approach taken was based on assuring the risk to airspace users with UAS operating being no worse than the risk when no UAS are operating i.e. without UAS and that all identified risks being reduced as far as reasonably practicable (ESARR 3 [5]). This relative safety argument approach may also be appropriate, and is recommended, for this TRS but will be re-examined in consultation with the relevant stakeholders. Step 1 Safety Assessment Plan including: The Safety Criteria, defining what is safe in the context of the UAS concept of operations, taking account of the objectives of various stakeholders A Safety Argument, using Goal-Structuring Notation (GSN), as to why the UAS concept of operations would in principle (i.e. subject to proper implementation) satisfy the specified Safety Criteria A definition of the Safety Activities needed to gather the Evidence required to support each strand of the Safety Argument, as well as the links and relationships between Safety Activities and the Safety Argument A clear description of the proposed safety methodologies and techniques, and precisely how they will be employed on the safety assessment A clear description of the proposed human-factor methodologies and techniques, and precisely how they will be integrated into the safety assessment The means and resources (including those required from EUROCONTROL) to carry out Safety Activities within the Project Responsibilities and accountabilities for Safety Activities Commercial in Confidence Page 10 of 61

11 Technical The safety deliverables associated with the safety activities The allocation of safety activities and safety deliverables in the progression of the UAS project The relationships and dependencies between successive safety activities and associated safety deliverables The detailed schedule and milestones for conducting safety activities and releasing associated safety deliverables Step 2 Perform safety assessments in accordance with the Safety Assessment Plan including: Undertaking the activities to address all elements of the safety argument Perform a FHA and PSSA on the UAS operational concepts, which shall include all fact finding, workshops and meetings with experts Presentations to identified working groups Step 3 - Production of the Preliminary Safety Cases including of a Preliminary Safety Case for each of the two scenarios as defined in the SCDM [2] The detail of the Safety Assessment Plan and schedule will be presented for agreement at the kick-off meeting at EUROCONTROL HQ, which is to be organised at the beginning of the contract. Once agreed we will remain flexible and adaptable to respond to changing circumstances, within the scope of the study. Any changes will be agreed in advance with the EUROCONTROL UAS Activity Manager Safety Assessment The overall objectives for the FHA/PSSA activity will be as follows to ensure that sufficient and necessary evidence is gathered to substantiate that the safety requirements are adequate in the context and scope of the defined operational scenarios. This approach below is based on a relative safety criterion but is also largely applicable to an absolute safety criterion although there would be no need to develop models, hazards etc for the without UAS situation. Define and verify the scope and boundary of the analysis being undertaken. Define and validate the UAS Operational Models, Functional and logical architecture models applicable to the present ( without UAS ) and new ( with UAS ) situations. Identify and confirm the hazards applicable to UAS operations in the without- UAS and with UAS situations. Categorise hazards into those that are common to both and those that are unique. Where UAS could credibly alter the consequences or causes of the common hazards then: o Identify the potential consequences of each hazard, taking into account the available mitigations, using Event Tree Analysis. Commercial in Confidence Page 11 of 61

12 Technical o Identify the possible causes of each hazard, using Fault Tree Analysis. Identify potential consequences and possible causes for any unique hazards. Compare the hazards, consequences and causes for the without UAS and with UAS situations to determine the risk delta. Identify any potential safety issues from the introduction of UAS to segregated airspace or particular known safety issues with current technology. Document results and conclusions in the FHA/PSSA Report FHA/PSSA Workshop The FHA/PSSA Workshop will need to be organised as soon as possible following contract award and should be attended by key EUROCONTROL stakeholders in addition to our ATM and UAS domain specialists. Other stakeholders from, for example, the Military UAV OAT Task Force, EUROCAE WG73 and NATO should also be invited but attendance is not mandatory. We propose that the workshop is facilitated by safety specialists from Ebeni and chaired by EUROCONTROL. The location of the workshop could be EUROCONTROL HQ or in the UK as deemed appropriate. A briefing pack for the workshop will be issued one week prior to the workshop for all attendees. The briefing pack will contain the proposed agenda, the outputs of the preworkshop activities and an overview of the workshop objectives and methodology. FHA/PSSA workshop minutes will be produced one working week after the workshop capturing the results of the discussions and the validated versions of outputs from the pre-workshop activities Post Workshop Activities Following the FHA/PSSA Workshop all the output will be consolidated and reviewed, followed by further, more detailed, safety and risk analysis activities. This will include the derivation of the Bow-Tie model through construction of Fault Trees and Event Trees using the appropriate software tools, to complete the cause/consequence models. These models will then be used to derive the necessary risk mitigations to maintain present ( without UAS ) safety levels and identify areas for practicable risk reduction. The results of the risk assessment will be used to derive safety requirements. The results of the above activities will be documented in the FHA/PSSA Report together with the derivation of safety requirements for UAS operations in each of the two scenarios. A final version of the FHA/PSSA Report will be produced based on incorporation of EUROCONTROL review comments 2.3 Staffing the Study Ebeni proposes to deploy a small team of safety specialists to undertake the safety activities. The Ebeni team comprises a number of specialists who have the appropriate skills with which to address the issues contained in the TRS. Short profiles of these team members are provided below and full CVs can be found at Appendix A. Alan Simpson BSc (Hons), CEng, MIET, MSaRS Alan is a highly experienced safety engineer with over 20 years experience in critical systems engineering, analysis and project management. He has Commercial in Confidence Page 12 of 61

13 Technical detailed knowledge of many mission, avionics, armament, unmanned air vehicle and air traffic management systems as well as automotive, metro signalling and train control systems. Alan has controlled and implemented a variety of Safety Engineering, System Engineering and Assurance programmes within the Air Traffic, aviation and rail industries, in the UK and overseas, encompassing a range of roles and responsibilities, specialising in complex high integrity systems and concepts. Alan has worked directly with EUROCONTROL on all of ATM Safety projects referred to in section 1.3 of this proposal, as well as the UAS research projects for ASTRAEA and UAS operational safety assessments for UK and US based defence contractors. Jo Stoker BSc (Hons), MIET, MSaRS Jo is an experienced System Safety Engineer and Project Manager with over 10 years experience across the whole system safety lifecycle in a number of different industries, specifically the Air Traffic Management, Avionics and Automotive sectors. Jo has also supported all of the EUROCONTROL safety projects referred to in section 1.3. With Alan, Jo carried out the safety assurance of draft specifications for flying Military Unmanned Aerial Vehicles in non-segregated airspace. She has also contributed to safety assessments of avionic equipments for military aircraft upgrades. Ed Macfarlane BEng (Hons) MSc Ed is a Safety Engineer and has 4 years safety engineering experience gained predominately within the Nuclear and Oil industries. Ed has worked across a wide range of different industries concentrating on safety and risk assessment. This has involved the running and co-ordination of HAZOP (HAZard & OPerability), HAZID (HAZard IDentification) and Process FMEA studies, mechanical assessment and design of items, risk & reliability assessment and fault tree analysis on oil and gas projects. ED has worked with EUROCONTROL on the ADQ Mandate (DQR Community Specification and Safety Assessments) and worked with Alan on the ASTRAEA UAS research project. Vicky Brennan BSc MSc Vicky is an experienced Safety Consultant and Independent Safety Advisor/Auditor with a strong background in the assessment of military aircraft and other military systems for certification, including synthetic environments and simulator training systems. She has specialised in Safety and Software and has contributed significantly to committees forming policy for safety critical systems, software development and certification, particularly within the MOD. She is the Technical Authority and a Project Safety Authority for a number of major programmes and is also responsible within those roles for the training and mentoring of more junior staff. Over the last 5 years Vicky has specialised in the assessment and development of unmanned air vehicle systems (UAVS), dealing with new systems and operating environments and their affect on safety. Vicky s last role was as the Technical Authority for the Safety Case Programme for the Watchkeeper System. She led a team of Safety Engineers dedicated to the assessment of this highly complex and extensively integrated UAV System and her expertise is frequently sought by new suppliers of UAV s to the MOD. Commercial in Confidence Page 13 of 61

14 Technical 3 Meeting the Required Experience Criteria This section presents how our proposed team meets all the required experience specified within the Task Requirement Sheet [1]. We propose this work is led by Alan Simpson as the main contact, supported by Jo Stoker and Ed Macfarlane, with additional in-depth UAS domain knowledge from Vicky Brennan. We strongly believe that our team is ideally qualified to undertake this work and that there are a number of compelling reasons for selecting Ebeni to undertake this project: Our extensive experience in the UAS field, specifically in undertaking safety assessments for ATM and UAS related projects Our involvement in UAS and ATM related projects which we believe significantly reduces the learning time and report preparation cost for EUROCONTROL Our experience and familiarity with the development of safety cases for a wide variety of EUROCONTROL programmes We have previously demonstrated that we deliver the required quality deliverables on time and to budget We will apply an innovative, effective, pragmatic and proven technical approach Our commitment to deliver to quality, budget and time The proven track record of the team within EUROCONTROL and wider industry We provide excellent value for money Ebeni believe that subject to the stated risks, assumptions and dependencies, we can provide the safety engineering excellence necessary to support the work successfully on this contract. 3.1 Experience Requirement 1. Demonstrate thorough and exhaustive competence in the field of aviation and ATM safety and safety risk assessment. The team has over 50 years experience in safety engineering and management with significant experience in constructing safety cases and conducting safety and risk assessments in the ATM, aviation and other domains as highlighted in section 1.3 and in addition: Safety assessments of Unmanned Air Vehicle and Ground Control Stations for UK and US based defence contractors Independent Safety Assessments for military aircraft and avionics systems Study into the integration of Safety and Security Evaluation System and Software Safety Cases for safety-critical avionics equipment Commercial in Confidence Page 14 of 61

15 Technical 3.2 Experience Requirement 2. Demonstrate a thorough and exhaustive understanding of the legal and regulatory framework for aviation safety. Through involvement in a number of EUROCONTROL and related ANSP and aerospace manufacturer based projects the team is aware of the specific roles of European Aviation Safety Agency (EASA) and the EUROCONTROL Safety Regulation Commission (SRC) and Regulatory Unit (RU) and has working knowledge of ESARRs, Single European Sky (SES) regulations and associated Implementing Rules and ICAO Annexes (specifically Annexes 2, 3, 4, 8, 10, 11, 12, 14 & 15) as well as a number of Acceptable Means of Compliance (AMCs; previously Temporary Guidance Leaflets or TGLs) issued by EASA as guidance material to Aircraft Operators in meeting requirements for airworthiness and operational approvals for specific flight operations. 3.3 Experience Requirement 3. Demonstrate thorough and exhaustive experience in the field of the application of the EUROCONTROL Safety Assessment Methodologies in ATM. The team has over 20 years experience in safety engineering and management with significant experience in constructing safety cases and conducting safety and risk assessments in ATM and other domains. The team has extensive experience of producing FHAs and PSSAs which require analytical skills the results of which lead to the identification of key issues which were then addressed in the associated safety case including: Undertaking the safety assurance process on the Draft EUROCONTROL Specifications for the Use of Military UAVs as OAT outside segregated airspace RVSM Pre-implementation and Post Implementation safety cases at EUROCONTROL HQ of a Post-implementation safety argument for ACAS II Conceptual operations of Tactical Unmanned Air Vehicles (TUAV) in Civil Airspace Safety analysis for European Commission Mandates Implementing Rules for Aeronautical Data Integrity (ADI), Mode S Interrogator Code Allocation, Co- Ordination and Transfer and Initial Flight Planning EUROCONTROL Safe Aeronautical Data study and maintenance of the safety case for the European Aeronautical Information Service (AIS) Database (EAD) system for EUROCONTROL Safety assessment of many systems used for ATC including Primary and Secondary Radars, ATC display and information systems, CCTV and precision time systems Study into the integration of Safety and Security Evaluation System and Software Safety Cases for safety-critical avionics equipment The team was also responsible, with EUROCONTROL HQ, for the development and update of the Safety Case Manual [2], based on 10 years experience of developing and reviewing safety cases in various industries. Commercial in Confidence Page 15 of 61

16 Technical 3.4 Experience Requirement 4. Demonstrate thorough and exhaustive understanding of the environment and constraints which apply to conducting safety-related work within the EUROCONTROL and its Stakeholders. In all our work with clients including EUROCONTROL we are committed to getting the right result within the scope and objectives of the work, recognising that plans often need to adapt. For this study we will remain flexible and adaptable to changing circumstances in order to achieve a mutually acceptable outcome. Our practical skills and knowledge have given us extensive experience of both the technical and political challenges with safety regimes in operational environments and through our previous work with EUROCONTROL and other clients we understand these challenges. 3.5 Experience Requirement 5. Provide clear evidence of skills and expertise to provide the support required, as described in the specification [1]. Please refer to sections 1 and 2 of this proposal. 3.6 Experience Requirement 6. Demonstrate fluency in reading and writing English and excellent report drafting skills. All of the core project team are native English speakers. All of the team are experienced in writing clear, well-structured reports on complex issues, for example the EUROCONTROL Safety Case Manual. We are happy to provide examples of their skills in this area on request. 3.7 Experience Requirement 7. Propose personnel which are: a) Able to work in an international environment within the confines of being multicultural and multi-disciplinary b) Autonomous and resourceful c) Excellent in interpersonal and communication skills (listening) d) Consensus-seeking e) Solution-oriented f) Respected as safety 3 professional within the aviation community The key members of the Ebeni Team are well known to EUROCONTROL and have continually demonstrated capabilities in these areas as part of the ongoing successful delivery of a variety of EUROCONTROL projects as listed in section Task Requirement Sheet T [1] states security professional however it has been confirmed that this should read safety professional. Commercial in Confidence Page 16 of 61

17 Technical 3.8 Experience Requirement 8. Provide detailed C.V. s of relevant personnel. Please refer to the CVs provided in Appendix A. 3.9 Experience Requirement 9. Original thinking, additional ideas and individuality towards the specifications will be considered an important factor in the tender assessment Please refer to all sections of this proposal Experience Requirement 10. Demonstrate a strong commitment to quality. Ebeni operates an ISO 9001 accredited Quality Management System (QMS). In addition, the team proposed to carry out this contract have successful track records of working in highly regulated industries following strict quality and safety standards. Overall, EUROCONTROL can be confident that the work performed under this Task Requirement Sheet will be carried out to the highest standards and within the required timescales. Commercial in Confidence Page 17 of 61

18 Technical 4 Work Plan and Project Management 4.1 Work Breakdown Ebeni will carry out the tasks by means of the following work packages. Work Package & Sub-tasks Task Description Missions 1100 Kick-off meeting 1200 FHA/PSSA Workshop 1300 Ad hoc/progress Meetings 1400 Presentation of findings Study Plan (WP 01) 2100 Study Plan 2200 Project monitoring and scheduling Structured Safety Argument (WP 02) 3100 Develop safety argument 3200 Review CONOPS and other EUROCONTROL documents Safety Assessment Plan (WP 03) 4100 Develop Safety Assessment Plan 4200 Finalise Safety Assessment Plan Safety Assessment (WP 04) 5100 Develop functional and logical models 5200 Produce FHA/PSSA Workshop Briefing Material 5300 Produce FHA/PSSA Workshop Minutes 5400 Consequence analysis 5500 Causal analysis 5600 Safety Objectives and requirements definition 5700 Produce Draft FHA/PSSA Report 5800 Produce Final FHA/PSSA Report Preliminary Safety Case SCEN1 (WP 05) 6100 Produce Draft Preliminary Safety Case (SC1) 6200 Produce Final Preliminary Safety Case (SC1) Preliminary Safety Case SCEN2 (WP 06) 7100 Produce Draft Preliminary Safety Case (SC2) 7200 Produce Final Preliminary Safety Case (SC2) High Level UAS Domain Report 8100 Draft UAS domain report 8200 Final UAS domain report Presentation of findings 9100 Develop presentation of findings Table 4-1 Work Breakdown Structure Commercial in Confidence Page 18 of 61

19 Technical 4.2 Schedule of Deliverables The expected timescale for task based on our work breakdown and estimated effort is approximately 6 months following contract award. The following table shows the key milestones along with a proposed payment profile. This profile is based on the profile provided in the TRS. Ref Deliverable Percentage Payment Proposed Date D1 (WP01) Study Plan 10% 01 April 2009 D2 (WP02) Structured Safety Argument 10% 15 April 2009 D3 (WP03) Safety Assessment Plan 10% 15 May 2009 D4 (WP04) Safety Assessment 10% 01 September 2009 D5 (WP05) Preliminary Safety Case (SC1) 10% 01 September 2009 D6 D7 (WP06) Preliminary Safety Case (SC2) and UAS Industry Summary Report Final acceptance of all deliverables Presentation of findings 20% 01 September % 01 October 2009 Table 4-2 Proposed Payment Profile All documents will be written in English and be delivered as hardcopies (x2) as well as on soft copy on a CD-ROM and via electronic transfer. 4.3 Meetings The following meetings have been identified and will be required throughout the project: Kick off meeting where Ebeni Limited and EUROCONTROL will agree on the details of the Study Plan (1 day meeting, 2 people) FHA/PSSA Workshop to be held at EUROCONTROL HQ, Brussels or the UK as agreed (2 day workshop, 3 people) Ad hoc progress meetings to be held at EUROCONTROL HQ, Brussels at dates to be agreed between Ebeni Limited and EUROCONTROL (2, 1 day meetings, 1 person) Final Presentation of Findings to be held at EUROCONTROL HQ, Brussels (1 day meeting, 1 person) Ebeni Limited will take notes/minutes for each meeting and manage any actions agreed during each meeting. 4.4 Assumptions The following assumptions have been made in order to scope the work to be carried out: The duration of the project for will not exceed 6 calendar months For each deliverable document the WBS includes one revision following incorporation of comments, unless otherwise stated Commercial in Confidence Page 19 of 61

20 Technical No additional meetings other than those specified in section 4.3 will be required It is assumed that all meetings will be held at EUROCONTROL HQ, Brussels. EUROCONTROL will be responsible for any venue costs for any meeting (e.g. room hire) Deliverables are deemed to be acceptable to EUROCONTROL if either EUROCONTROL notify acceptance of the document or comments are not received within the defined return period for comments. The default period is 10 working days (2 weeks) Mission costs will be charged according to EUROCONTROL s mission guidelines 4.5 Dependencies 4.6 Risks The successful delivery of the task depends on the following: 1. Provision of identified input to tasks when required 2. Timely access to relevant documentation and personnel (as necessary) 3. Any programme slippage (due to non-availability of dependencies) will result in delays to work completion and could result in additional costs 4. The proposed team is currently available to undertake this work; however, availability is subject to change. Any proposed staff changes will be discussed and agreed with EUROCONTROL beforehand The following risks have been identified: 1. Timescales cannot be met Whilst the timescales presented in the Technical Specification [1] are not challenging, the Ebeni Project Manger will liaise closely with the EUROCONTROL UAS Activity Manager to identify any difficulties in meeting them. 2. Increases in scope The Ebeni project manager will be closely monitoring the project. In case the scope of the work being undertaken needs to change, this will be communicated immediately to EUROCONTROL with a justification and estimated impact of the changes. 3. Additional Meetings required by EUROCONTROL We will be in regular contact with EUROCONTROL to identify and cost any additional meetings that EUROCONTROL may require over and above those outlined above. 4.7 Working Arrangements The work will be carried out mainly at Ebeni s premises in the UK, with visits to EUROCONTROL HQ, Brussels as required. Provision has been made within the financial proposal for up to 6 person trips to support the TRS. Commercial in Confidence Page 20 of 61

21 Technical Ebeni will provide electronic mail project status reports to the EUROCONTROL UAS Activity Task Manager on a regular basis which will detail project progress, action status, identified risks and any issues that require resolution from EUROCONTROL. This will enable the EUROCONTROL UAS Activity Manager to have a clear picture of the projects progress and an awareness of any issues that need to be resolved. Commercial in Confidence Page 21 of 61

22 Technical References No Reference Document Title Issue/Date 1 TRS T Unmanned Aircraft Systems (UAS) Safety Case November DAP/SAF/091 Safety Case Manual Version Nov SAF.ET1.ST MAN-01 Air Navigation System Safety Assessment Methodology Edition October ESARR 2 Reporting and Analysis of Safety Occurrences in ATM 5 ESARR3 Use of Safety Management System by ATM Service Providers Edition Nov 2000 Edition July ESARR4 Risk Assessment and Mitigation in ATM Edition Apr EUROCONTROL Specifications for the Use of Military Unmanned Aerial Vehicles as Operational Air Traffic Outside Segregated Airspace 8 PfP (NNAG-JCGUAV) WP(2006)0002REV0 02 Sense And Avoid Requirements For Unmanned Aerial Vehicle Systems Operating In Non-Segregated Airspace Version April 2007 Commercial in Confidence Page 22 of 61

23 Technical Appendix A Curriculum Vitae Commercial in Confidence Page 23 of 61

24 Technical Alan Simpson BEng, CEng, MIEE, MSaRS Résumé Alan is a highly experienced safety engineer with over 20 years in critical systems engineering, analysis and project management. He has detailed knowledge of many mission, avionics, armament, unmanned air vehicle and air traffic management systems as well as automotive, metro signalling and train control systems. Alan has controlled and implemented a variety of Safety Engineering, System Engineering and Assurance programmes within the aviation and rail industries, in the UK and overseas, encompassing a range of roles and responsibilities, specialising in complex high integrity systems. For the past 10 years as a principal safety consultant, mainly in the Aerospace & Defence markets, Alan has carried out a significant number of Safety Engineering and Safety Management roles and assignments including: Safety consultant to major projects developing safety critical systems in the Defence and ATM domains including WATCHKEEPER TUAV, Radar and other ATCE at aerodromes and Enroute centres in the UK; Safety consultant for a number of EUROCONTROL ATM programmes including: OATA, Military UAVS Specifications, ACAS II, EAD, RVSM Implementation, EC Mandates for Data link Integrity, Aeronautical Data, Coordination and Transfer and Initial Flight Planning, Safe Aeronautical Data and the EUROCONTROL Safety Case Manual; Lead UK Advisor on Safety to one of the WATCHKEEPER TUAV programme (SIAP Phase) prime contractors and their major sub-contractors; Lead Consultant for the Independent Safety Evaluation of Hawk Trainer for the Royal Australian Air Force; Lead Systems and Safety Engineer responsible for the development of a SIL4 Stores Management System for Tornado CSP; Designated Safety Authority for a major safety critical systems consultancy; Expert Witness; Safety consultant to a range of other Aerospace & Defence Programmes, for example;, ASTOR, Electronic Flight Strips, Engine Health Monitoring, Primary/Secondary Radar and IFF systems; Review or construction of over 100 (mostly GSN based) Safety Cases; Representative on the JAA / EUROCONTROL Task Force for Certification of UAVS in civilian airspace. Alan has led several research studies in safety and reliability for next generation avionics systems, including the Certification of Integrated Modular Avionics based architectures and COTS components. He is one of the key figures behind the development of several risk-directed engineering approaches including: White-Box safety engineering, Safety requirements using Jackson, the MoD sponsored SafSec Methodology and a safety-oriented approach to Operational Risk modelling. Whilst at Westinghouse Signals Alan was the Systems Assurance Manager for a number of signalling and train control programmes including the Jubilee Line Extension Re-signalling Commercial in Confidence Page 24 of 61

25 Technical Project. Alan is a chartered engineer and member of the Institute of Electrical Engineers. He has published and presented numerous papers on specifying system and software safety requirements, safety engineering and safety assurance. Professional History Director Ebeni Limited 2004 Present Company Safety Authority Praxis Critical Systems ALTRAN Group Safety & Reliability Consultant Safety & Reliability Consultant Department Safety Manager Praxis Critical Systems ALTRAN Group Praxis Plc Westinghouse Signals Limited Project Safety Engineer Westinghouse Signals Limited Senior Reliability & Flight Safety Engineer Smiths Industries Aerospace & Defence Profile Company Director and Safety Authority for Ebeni Limited. Company Safety Authority - Praxis Critical Systems Ltd Member of the ALTRAN Group. Managed several multi-million pound safety programmes in Rail, Aerospace and Defence industries. Developed and brought to market several best practice methodologies in risk - Safety Service Line Manager. Involved in multi-national programmes for Unmanned Air Vehicle Systems. Career History Ebeni Limited Director and Senior Safety Consultant October 2008 present Technical Safety Lead EUROCONTROL Mode S Technical safety lead for the safety assurance process to support updates to the Mode S Safety Case. The work includes Safety Assessment and Safety Case development for Mode S operations using Secondary Surveillance Radars (Mode S). September 2007 March 2008 Technical Safety Lead Safety Assessment of Sense and Avoid Concepts for UAS Operations Technical safety lead supporting a major UK company with the safety aspects of Sense and Avoid System concepts for future civil and military Unmanned Air System operations in all classes of airspace. The work includes Design Safety Assessment of Commercial in Confidence Page 25 of 61