Helicopter Point in Space Operations in controlled and … · 2019. 12. 18. · Helicopter Point in Space operations in controlled and uncontrolled airspace Generic Safety Case DOCUMENT

Helicopter Point in Space

Operations in controlled and

Uncontrolled airspace

Generic Safety Case

Page 1 Edition: 1.4

Helicopter Point in Space operations in controlled and

uncontrolled airspace

Generic Safety Case

Part I:Report

Part II: Guidance material for PinS Departure

Part III: Guidance material for PinS Approach

Edition Number : 1.4

Edition Date : 02/10/2019

Status : Released Issue

Intended for : ANSP/ Helicopter Operator/

Heliport Operator

Category : Public

Helicopter Point in Space operations in controlled and uncontrolled airspace

Generic Safety Case

DOCUMENT CHARACTERISTICS

TITLE


Generic Safety Case Report Publications Reference:

Document Identifier Edition Number: 1.4

Edition Date: 02/10/2019

Abstract

This document presents the results of the safety assessment for helicopter Point in Space (PinS) approach and departure operations in controlled and uncontrolled airspace.

This generic safety case covers the different lifecycle stages of the change from definition to operation.

Part I of this document is the generic safety case report which includes all the details/rationale for the safety assessment.

Two Safety Case Guidance Materials for the local deployment based on this generic safety case report are provided in Part II for PinS departure and in Part III for PinS approach. Part II and III are the main parts of the document to be used for the local deployment.

A local safety assessment should be conducted based on these documents to verify completeness and correctness of the generic safety case considering the local operational environment and any local specific regulation.

The Project Owner shall verify that the Safety argument presented in this generic safety case is applicable and acceptable for the local deployment. This safety argument should be presented and accepted by the Competent Authority.

The deployment of helicopter PinS operations is a multi-actor change and therefore requires coordination between different stakeholders (service providers, heliport/landing site operator and helicopter operators). This coordination is essential to ensure a safe deployment.

Keywords

Safety Case PinS Helicopter operations

Authors

Bruno Rabiller / EUROCONTROL

Contact Person(s) Tel Unit

Bruno Rabiller +33 1 69 88 69 13 DECMA Safety

STATUS, AUDIENCE AND ACCESSIBILITY

Status Intended for Accessible via

Draft General Public Intranet

Proposed Issue EUROCONTROL Extranet

Released Issue Restricted Internet (www.eurocontrol.int)


Generic Safety Case

DOCUMENT APPROVAL

The following table identifies all management authorities who have successively approved the present issue of this document.


Generic Safety Case

DOCUMENT CHANGE RECORD

The following table records the complete history of the successive editions of the present document.

EDITION NUMBER

EDITION DATE

REASON FOR CHANGE

0.1 27/07/2018 Initial working draft

0.2 30/08/2018 Update according review

1.0 23/11/2018 Update following PinS/LLR safety Workshop in Lisbon (22nd and 23rd October 2018)

1.1 14/12/2018 Minor modifications regarding responsibilities of the safety requirements

1.2 21/12/2018 Minor modifications for alignment with safety case guidance material

1.3 07/03/2019 Modification following final review

1.4 02/10/2019

Merging of the generic safety case report and the two Safety Case Guidance Material for the local deployment (PinS departure and PinS approach) into a single document.

Final EUROCONTROL internal review.

Publications EUROCONTROL Headquarters 96 Rue de la Fusée B-1130 BRUSSELS Tel: +32 (0)2 729 4715 Fax: +32 (0)2 729 5149 E-mail: [email protected]

mailto:[email protected]


Generic Safety Case

CONTENTS

DOCUMENT CHARACTERISTICS ..................................................................................... 2

DOCUMENT APPROVAL ................................................................................................... 3

DOCUMENT CHANGE RECORD ....................................................................................... 4

CONTENTS ......................................................................................................................... 5

LIST OF FIGURES ............................................................................................................ 14

LIST OF TABLES .............................................................................................................. 15

EXECUTIVE SUMMARY ................................................................................................... 18

Part I — Helicopter Point in Space operations in controlled and uncontrolled airspace — Generic Safety Case Report ............................................................... 19

1 Generic safety case report ..................................................................................... 20

1.1 Purpose of the document ............................................................................................ 20

1.2 Scope of the document ................................................................................................ 20

1.3 Intended readership ..................................................................................................... 20

1.4 Safety assessment background .................................................................................. 21

1.5 Abbreviations ............................................................................................................... 22

1.6 Definitions ..................................................................................................................... 25

1.7 Reference material ....................................................................................................... 28

2 Background on current VFR helicopter operations ............................................. 29

2.1 Description of current operations ............................................................................... 29

2.2 Safety of current operations ........................................................................................ 30

3 Point in Space Change overview ........................................................................... 32

3.1 Concept of Operations ................................................................................................. 32

3.1.1 PinS departure operations ................................................................................... 32

3.1.1.1 PinS “proceed visually” departure ................................................................. 32 3.1.1.2 PinS “proceed VFR” departure ....................................................................... 34 3.1.1.3 Main differences between PinS “proceed visually” and “proceed VFR”

departure .......................................................................................................... 35 3.1.1.4 Navigation Specifications for PinS departure ............................................... 36

3.1.2 PinS approach operations ................................................................................... 37

3.1.2.1 PinS “proceed visually” approach ................................................................. 37 3.1.2.2 PinS “proceed VFR” approach ....................................................................... 39 3.1.2.3 Main differences between PinS “proceed visually ” and “proceed VFR”

approach .......................................................................................................... 41

3.2 Operational Environment key characteristics ............................................................ 43

3.2.1 Heliport / landing location .................................................................................... 43

3.2.2 Route structure ..................................................................................................... 43

3.2.2.1 Route structure for PinS departure ................................................................ 43


Generic Safety Case

3.2.2.2 Route structure for PinS approach................................................................. 44

3.2.3 Controlled Airspace .............................................................................................. 44

3.2.4 Uncontrolled Airspace ......................................................................................... 44

3.2.5 Density/complexity of traffic nearby the PinS procedure .................................. 45

3.2.6 Weather conditions .............................................................................................. 45

3.2.7 Aircraft eligibility and ATM capabilities in terms of CNS ................................... 45

3.2.7.1 Radiocommunication ...................................................................................... 45 3.2.7.2 Surveillance ..................................................................................................... 45 3.2.7.3 Navigation ........................................................................................................ 45

3.3 Current operating methods & baseline ....................................................................... 45

3.4 New operating methods on the PinS operations ....................................................... 46

4 Overall Safety Assurance Strategy and Safety Argument ................................... 47

4.1 Safety assurance strategy and argument structure ................................................... 47

4.2 Arg 0- Overall safety argument- top level ................................................................... 48

4.3 Arg 1- Definition of helicopter PinS operations at service level to be acceptably safe ................................................................................................................................ 49

4.4 Arg 2- Helicopter PinS operations have been specified and designed to be acceptably safe ............................................................................................................. 49

4.5 Arg 3- Helicopter PinS operations are implemented to meet the Safety Requirements ............................................................................................................... 50

4.6 Arg 4- Transfer into operations of helicopter PinS operations is acceptably safe ....................................................................................................................................... 51

4.7 Arg 5- Helicopter PinS operations remain acceptably safe during operational service ........................................................................................................................... 52

5 Safety Assessment at operational service level ................................................... 53

5.1 Safety Impact and Criteria ........................................................................................... 53

5.1.1 Safety Impact and Criteria for PinS departure operations ................................. 53

5.1.1.1 Relevant ATM/ANS “pre-existing” hazards .................................................... 53 5.1.1.2 Safety impact analysis .................................................................................... 53

5.1.1.2.1 Impact on MAC risk ............................................................................... 53 5.1.1.2.2 Impact on CFIT risk ............................................................................... 54 5.1.1.2.3 Impact on Loss of Control- Inflight Risk .............................................. 55

5.1.1.3 Safety Criteria (SAC) ....................................................................................... 55 5.1.1.3.1 In controlled airspace ........................................................................... 55 5.1.1.3.2 In uncontrolled airspace ....................................................................... 55 5.1.1.3.3 In controlled and uncontrolled airspace .............................................. 56

5.1.2 Safety Impact and Criteria for PinS approach operations ................................. 56

5.1.2.1 Relevant ATM/ANS “pre-existing” hazards .................................................... 56 5.1.2.2 Safety impact analysis .................................................................................... 56

5.1.2.2.1 Impact on MAC risk ............................................................................... 56 5.1.2.2.2 Impact on CFIT risk ............................................................................... 58 5.1.2.2.3 Impact on Loss of Control - Inflight Risk ............................................. 58 5.1.2.2.4 Impact on Landing Accident risk ......................................................... 58

5.1.2.3 Safety Criteria (SAC) ....................................................................................... 58 5.1.2.3.1 In controlled airspace ........................................................................... 58 5.1.2.3.2 In uncontrolled airspace ....................................................................... 59 5.1.2.3.3 In controlled and uncontrolled airspaces ............................................ 59

5.2 Safety Objectives in Normal operations ..................................................................... 59


Generic Safety Case

5.2.1 Safety Objective in Normal operations for PinS departure ................................ 59

5.2.1.1 Controlled airspace ......................................................................................... 59 5.2.1.2 Uncontrolled airspace ..................................................................................... 62

5.2.2 Safety Objective in Normal operations for PinS approach ................................ 64

5.2.2.1 Controlled airspace ......................................................................................... 64 5.2.2.2 Uncontrolled airspace ..................................................................................... 66

5.3 Safety Objectives in Abnormal operations ................................................................. 68

5.3.1 Safety Objective in Abnormal operations for PinS departure ........................... 68

5.3.1.1 Abnormal scenarios ........................................................................................ 68 5.3.1.2 Derivation of Safety Objectives for Abnormal operations ............................ 70

5.3.2 Safety Objective in Abnormal operations for PinS approach ............................ 70

5.3.2.1 Abnormal scenarios ........................................................................................ 70 5.3.2.2 Derivation of Safety Objectives for Abnormal operations ............................ 72

5.4 Safety Objectives in Faulted operations ..................................................................... 74

5.4.1 Safety Objective in Faulted operations for PinS departure ............................... 74

5.4.1.1 Identification and analysis of Operational Hazards ...................................... 74 5.4.1.2 Safety Objectives associated to the Operational Hazards ............................ 76

5.4.2 Safety Objectives in Faulted operations for PinS approach .............................. 78

5.4.2.1 Identification and analysis of Operational Hazards ...................................... 78 5.4.2.2 Safety Objectives associated to the Operational Hazards ............................ 80

5.5 Safety Criteria achievability: validation strategy & objectives .................................. 83

5.5.1 Validation strategy for PinS departure operations ............................................. 83

5.5.2 Validation strategy for PinS approach operations ............................................. 91

6 Safety assessment- Design level ......................................................................... 101

6.1 Functional System design analysis in Controlled airspace .................................... 101

6.1.1 PinS Functional System logical model ............................................................. 101

6.1.2 Derivation of Safety Requirements – Normal operations ................................ 107

6.1.3 Derivation of Safety Requirements –Abnormal operations ............................. 107

6.1.4 Derivation of Safety Requirements – Faulted operations ................................ 107

6.1.5 Derived Safety Requirements in controlled airspace –consolidated view ..... 107

6.1.5.1 Consolidated Safety Requirements for PinS departure in controlled airspace .......................................................................................................... 107

6.1.5.2 Consolidated Safety Requirements for PinS approach in controlled airspace .......................................................................................................... 112

6.2 Functional System design analysis in uncontrolled airspace ................................. 116

6.2.1 PinS Functional System logical model ............................................................. 116

6.2.2 Derivation of Safety Requirements – Normal operations ................................ 122

6.2.3 Derivation of Safety Requirements – Abnormal operations ............................ 122

6.2.4 Derivation of Safety Requirements – Faulted operations ................................ 123

6.2.5 Derived Safety Requirements – Consolidated view ......................................... 123

6.2.5.1 Consolidated Safety Requirements for PinS departure in uncontrolled airspace .......................................................................................................... 123

6.2.5.2 Consolidated Safety Requirements for PinS approach in uncontrolled airspace .......................................................................................................... 127

7 Safety assurance for Implementation .................................................................. 132

8 Safety assurance for Transfer into operation ..................................................... 134


Generic Safety Case

9 Safety assurance in Operation ............................................................................. 135

10 Assumptions, Recommendations and Issues .................................................... 136

10.1 PinS departure ............................................................................................................ 136

10.1.1 Controlled airspace ............................................................................................ 136

10.1.1.1 Assumptions log ........................................................................................... 136 10.1.1.2 Recommendation log .................................................................................... 139 10.1.1.3 Issue log ......................................................................................................... 139

10.1.2 Uncontrolled airspace ........................................................................................ 139


10.2 PinS approach ............................................................................................................ 142

10.2.1 Controlled airspace ............................................................................................ 142


10.2.2 Uncontrolled airspace ........................................................................................ 147


11 Conclusions ........................................................................................................... 151

ANNEX A – Operational Hazards identification & analysis & allocation of Safety Objectives .............................................................................................................. 152

A.1 Operational Hazards identification and analysis ..................................................... 152

A.1.1 PinS departure operational hazards .................................................................. 153

A.1.2 PinS approach operational hazards .................................................................. 156

A.2 Applicable risk models .............................................................................................. 161

A.3 Allocation of Safety Objectives- Generic illustration based on SRM...................... 166

A.4 Allocating Criticality ................................................................................................... 168

ANNEX B – Detailed derivation of Safety Requirements for Normal and Abnormal operations .............................................................................................................. 170

B.1 Detailed derivation of Safety Requirements for PinS departure operations .......... 170

B.1.1 Controlled airspace ............................................................................................ 170

B.1.1.1 Normal operations ......................................................................................... 170 B.1.1.2 Abnormal operations ..................................................................................... 178

B.1.2 Uncontrolled airspace ........................................................................................ 179


B.2 Detailed derivation of Safety Requirements for PinS approach operations ........... 187

B.2.1 Controlled airspace ............................................................................................ 187


B.2.2 Uncontrolled airspace ........................................................................................ 199



Generic Safety Case

ANNEX C – Detailed derivation of Safety Requirements for Faulted operations ..... 210

C.1 Controlled Airspace ................................................................................................... 210

C.1.1 Hazards Hz_DEP_01 & Hz_APR_01: Helicopter deviates from expected PinS (approach or departure) instrument segment towards terrain in controlled airspace ............................................................................................. 210

C.1.2 Hazards Hz_DEP_05 & Hz_APR_05: Helicopter deviates from expected PinS (approach or departure) instrument segment towards IFR or known VFR aircraft, in controlled airspace ................................................................... 219

C.1.3 Hazards Hz_DEP_10 & Hz_APR_10: IFR or known VFR traffic flies towards helicopter established on the PinS procedure in controlled airspace ............ 223

C.1.4 Hazards Hz_DEP_15 & Hz_APR_15 : Helicopter deviates from expected flight path towards terrain, during visual segment of the PinS “proceed visually” (approach or departure) in controlled airspace ................................ 227

C.1.5 Hazard Hz_DEP_20 & Hz_APR_20: Helicopter deviates from expected flight path towards IFR or known VFR, during visual segment of the PinS “proceed visually” (approach or departure) in controlled airspace ................ 233

C.1.6 Hazard Hz-APR_25: Helicopter fails to decelerate and/or prepare landing during the visual segment of the PinS approach, in controlled airspace ....... 237

C.2 Uncontrolled Airspace ............................................................................................... 239

C.2.1 Hazard Hz_DEP_50 & Hz_APR_50 Helicopter deviates from expected PinS (approach or departure) instrument segments towards terrain in uncontrolled airspace ........................................................................................ 239

C.2.2 Hazard Hz_DEP_55 & Hz_APR_55 Helicopter deviates from expected PinS (approach or departure) instrument segments towards other traffic in uncontrolled airspace ........................................................................................ 248

C.2.3 Hazard Hz_DEP_60 & Hz_APR_60 Other traffic deviates towards helicopter established on the PinS (approach or departure) procedure in uncontrolled airspace ........................................................................................ 251

C.2.4 Hazard Hz_DEP_65 & Hz_APR_65 Helicopter deviates from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” (approach or departure) procedure in uncontrolled airspace.......... 257

C.2.5 Hazard Hz_DEP_70 & Hz_APR_70 Helicopter deviates from expected flight path towards IFR or known VFR, during visual segment of the PinS “proceed visually” (approach or departure) in controlled airspace ................ 264

C.2.6 Hazard Hz-APR_75: Helicopter fails to decelerate and/or prepare landing during the visual segment of the PinS approach, in uncontrolled airspace .. 266

Part II — Safety Case Guidance Material for local deployment of Helicopter Point in Space departure operations in controlled and uncontrolled airspace ......... 269

12 Helicopter PinS departure operations ................................................................. 270

13 Objective of the Safety Case Guidance Material for deployment of PinS departure operations............................................................................................. 271

14 Safety Argument .................................................................................................... 272

14.1 Introduction to safety argument ................................................................................ 272

14.2 Safety argument for deployment of PinS departure operations ............................. 273

15 Guidance material for development of local safety case for deployment of helicopter PinS departure operations.................................................................. 276


Generic Safety Case

15.1 Guidance for verification of operational environment to implement the PinS departure operations .................................................................................................. 276

15.2 Guidance for verification of the applicability of the generic Safety Argument for helicopter PinS departure operations ....................................................................... 276

15.3 Guidance for development of safety assurance relating to local specification and design of PinS departure operations ................................................................. 277

15.3.1 Guidance for specification of GNSS service .................................................... 277

15.3.2 Guidance for specification of Flight Procedure Design ................................... 278

15.3.3 Guidance for specification of Aeronautical Information Service .................... 278

15.3.4 Guidance for specification of MET service ....................................................... 279

15.3.5 Guidance for specification of Air Traffic Service ............................................. 280

15.3.6 Guidance for specification of heliport/departure site operations ................... 281

15.3.7 Guidance for specification of helicopter operations and certification ........... 281

15.3.8 Guidance for specification completeness and correctness ............................ 282

15.4 Guidance for development of safety assurance relating to local implementation of PinS departure operations .................................................................................... 283

15.4.1 Guidance for implementation of GNSS service ................................................ 283

15.4.2 Guidance for implementation of Flight Procedure Design .............................. 283

15.4.3 Guidance for implementation of Aeronautical Information service ................ 284

15.4.4 Guidance for implementation of MET service .................................................. 285

15.4.5 Guidance for implementation of Air Traffic Services ....................................... 286

15.4.6 Guidance for implementation of heliport/departure site operations ............... 286

15.4.7 Guidance for implementation of helicopter operations and certification ....... 287

15.5 Guidance for development of safety assurance relating to the transition from current VFR departure to PinS departure operations .............................................. 287

15.6 Guidance for development of safety assurance relating to the PinS departure operations through its service life ............................................................................ 289

15.6.1 Guidance for safe GNSS service through PinS service life ............................. 289

15.6.2 Guidance for safe Flight Procedure Design through PinS service life ........... 289

15.6.3 Guidance for safe Aeronautical Information Service through PinS service life ........................................................................................................................ 290

15.6.4 Guidance for safe MET Service through PinS service life ............................... 290

15.6.5 Guidance for safe Air Traffic Service through PinS service life ...................... 290

15.6.6 Guidance for safe heliport/departure site operations through PinS service life ........................................................................................................................ 291

15.6.7 Guidance for safe helicopter operations and certification through PinS service life ........................................................................................................... 291

ANNEX D – Reference material ..................................................................................... 292

ANNEX E – Safety Requirements from the generic safety case ................................ 293

E.1 Safety Requirements applicable to GNSS domain ................................................... 294

E.2 Safety Requirements applicable to Flight Procedure Design domain .................... 294

E.3 Safety Requirements applicable to AIS domain ....................................................... 297

E.4 Safety Requirements applicable to MET domain ..................................................... 299

E.5 Safety Requirements applicable to ATS domain ...................................................... 300

E.6 Safety Requirements applicable to heliport/departure site domain........................ 304

E.7 Safety Requirements applicable to helicopter domain ............................................ 304


Generic Safety Case

ANNEX F – Recommendations from the generic safety case .................................... 309

F.1 Safety Recommendations applicable to GNSS domain ........................................... 309

F.2 Safety Recommendations applicable to Flight Procedure Design domain ............ 309

F.3 Safety Recommendations applicable to AIS domain ............................................... 309

F.4 Safety Recommendations applicable to MET domain ............................................. 309

F.5 Safety Recommendations applicable to ATS domain .............................................. 309

F.6 Safety Recommendations applicable to heliport domain ........................................ 309

F.7 Safety Recommendations applicable to helicopter domain .................................... 310

ANNEX G – Assumptions from the generic safety case ............................................. 311

G.1 Assumptions applicable to GNSS domain ............................................................... 311

G.2 Assumptions applicable to Flight Procedure Design domain ................................. 311

G.3 Assumptions applicable to AIS domain .................................................................... 311

G.4 Assumptions applicable to MET domain .................................................................. 311

G.5 Assumptions applicable to ATS domain .................................................................. 312

G.6 Assumptions applicable to heliport domain ............................................................. 312

G.7 Assumptions applicable to helicopter domain ......................................................... 312

Part III — Safety Case Guidance Material for local deployment of Helicopter Point in Space approach operations in controlled and uncontrolled airspace .................................................................................................................. 313

16 Helicopter PinS approach operations.................................................................. 314

17 Objective of the Safety Case Guidance Material for deployment of PinS approach operations ............................................................................................. 315

18 Safety Argument .................................................................................................... 316

18.1 Introduction to safety argument ................................................................................ 316

18.2 Safety argument for deployment of PinS approach operations .............................. 317

19 Guidance material for development of local safety case for deployment of helicopter PinS approach operations .................................................................. 320

19.1 Guidance for verification of operational environment to implement the PinS approach operations .................................................................................................. 320

19.2 Guidance for verification of the applicability of the generic Safety Argument for helicopter PinS approach operations ....................................................................... 320

19.3 Guidance for development of safety assurance relating to local specifications and design of PinS approach operations ................................................................. 321

19.3.1 Guidance for specification of GNSS service .................................................... 321

19.3.2 Guidance for specification of Flight Procedure Design ................................... 322

19.3.3 Guidance for specification of Aeronautical Information Service .................... 323

19.3.4 Guidance for specification of MET service ....................................................... 324

19.3.5 Guidance for specification of Air Traffic Service ............................................. 324

19.3.6 Guidance for specification of heliport/landing site operations ....................... 325

19.3.7 Guidance for specification of helicopter operations and certification ........... 326

19.3.8 Guidance for specification completeness and correctness ............................ 327

19.4 Guidance for development of safety assurance relating to local implementation


Generic Safety Case

of PinS approach operations ..................................................................................... 327

19.4.1 Guidance for implementation of GNSS service ................................................ 327

19.4.2 Guidance for implementation of Flight Procedure Design .............................. 328

19.4.3 Guidance for implementation of Aeronautical Information service ................ 329

19.4.4 Guidance for implementation of MET service .................................................. 329

19.4.5 Guidance for implementation of Air Traffic Service ......................................... 330

19.4.6 Guidance for implementation of heliport operations ....................................... 331

19.4.7 Guidance for implementation of helicopter operations and certification ....... 332

19.5 Guidance for development of safety assurance relating to the transition from current VFR approach to PinS approach operations ............................................... 332

19.6 Guidance for development of safety assurance relating to the PinS approach operations through its service life ............................................................................ 333

19.6.1 Guidance for safe GNSS service through PinS service life ............................. 333

19.6.2 Guidance for safe Flight Procedure Design through PinS service life ........... 333

19.6.3 Guidance for safe Aeronautical Information Service through PinS service life ........................................................................................................................ 334

19.6.4 Guidance for safe MET Service through PinS service life ............................... 334

19.6.5 Guidance for safe Air Traffic Service through PinS service life ...................... 335

19.6.6 Guidance for safe heliport operations through PinS service life .................... 335

19.6.7 Guidance for safe helicopter operations and certification through PinS service life ........................................................................................................... 336

ANNEX H – Reference material ..................................................................................... 337

ANNEX I – Safety Requirements from the generic safety case ................................. 338

I.1 Safety Requirements applicable to GNSS domain ................................................... 339

I.2 Safety Requirements applicable to Flight Procedure Design domain .................... 339

I.3 Safety Requirements applicable to AIS domain ....................................................... 343

I.4 Safety Requirements applicable to MET domain ..................................................... 345

I.5 Safety Requirements applicable to ATS domain ...................................................... 346

I.6 Safety Requirements applicable to heliport/landing Site domain ........................... 350

I.7 Safety Requirements applicable to helicopter domain ............................................ 351

ANNEX J – Recommendations from the generic safety case .................................... 357

J.1 Safety Recommendations applicable to GNSS domain ........................................... 357

J.2 Safety Recommendations applicable to Flight Procedure Design domain ............ 357

J.3 Safety Recommendations applicable to AIS domain ............................................... 357

J.4 Safety Recommendations applicable to MET domain ............................................. 357

J.5 Safety Recommendations applicable to ATS domain .............................................. 358

J.6 Safety Recommendations applicable to heliport domain ........................................ 358

J.7 Safety Recommendations applicable to helicopter domain .................................... 358

ANNEX K – Assumptions from the generic safety case ............................................. 360

K.1 Assumptions applicable to GNSS domain ............................................................... 360

K.2 Assumptions applicable to Flight Procedure Design domain ................................. 360

K.3 Assumptions applicable to AIS domain .................................................................... 360

K.4 Assumptions applicable to MET domain .................................................................. 360

K.5 Assumptions applicable to ATS domain .................................................................. 361


Generic Safety Case

K.6 Assumptions applicable to heliport domain ............................................................. 361

K.7 Assumptions applicable to helicopter domain ......................................................... 361


Generic Safety Case

LIST OF FIGURES

Figure 3-1: Example of PinS “proceed visually” departure from the FATO with direct visual segment ..................................................................................................... 34

Figure 3-2: Example of PinS “proceed VFR” departure from the FATO ........................... 35

Figure 3-3: RNP1 and RNP0.3 protection areas ................................................................. 37

Figure 3-4: Example of PinS “proceed visually” approach down to LPV minima with direct visual segment ..................................................................................................... 39

Figure 3-5: Example of PinS “proceed VFR” approach down to LPV minima with direct VFR segment ........................................................................................................ 41

Figure 4-1: Top level safety Argument ............................................................................... 48

Figure 6-1: PinS departure and approach Controlled Functional System logical model................................................................................................................... 102

Figure 6-2: PinS departure and approach Uncontrolled Functional System logical model................................................................................................................... 118

Figure A-1: Simplified MAC model for Controlled airspace & associated Severity Classification Scheme ....................................................................................... 161

Figure A-2: Simplified MAC model for Uncontrolled airspace & associated Severity Classification Scheme ....................................................................................... 162

Figure A-3: Simplified CFIT model for Controlled airspace & associated Severity Classification Scheme ....................................................................................... 163

Figure A-4: Simplified CFIT model for Uncontrolled airspace & associated Severity Classification Scheme ....................................................................................... 164

Figure A-5: Simplified Runway Excursion model ............................................................ 165

Figure C-1: Hz_DEP_01 & Hz_APR_01 Fault tree ............................................................ 211


Figure C-3: Hz_DEP_010 & Hz_APR_010 Fault tree ........................................................ 224

Figure C-4: Hz_DEP_015 & Hz_APR_15 Fault tree .......................................................... 228


Figure C-6: Hz_APR_25 Fault tree .................................................................................... 237

Figure C-7: Hz_DEP_50 & Hz_APR_50 Fault Tree ........................................................... 241



Figure C-10: Hz_DEP_65 & Hz_APR_65 Fault Tree ......................................................... 258

Figure C-11: Hz_DEP_70 & Hz_APR_70 Fault Tree ......................................................... 264

Figure C-12: Hz_APR_75 Fault tree .................................................................................. 267

Figure 14-1: Exemple of typical safety Argument ............................................................ 272

Figure 14-2: Safety argument for PinS departure operations ......................................... 274

Figure18-1: Exemple of a typical safety Argument .......................................................... 316

Figure18-2: Safety argument for PinS approach operations .......................................... 318


Generic Safety Case

LIST OF TABLES

Table 3-1: ATS Airspace classes C & D - Services provided ............................................ 44

Table 3-2: ATS Airspace classes G- Services provided .................................................... 45

Table 5-1. Safety Objectives in controlled airspace-Normal operations .......................... 62

Table 5-2. Safety Objectives in uncontrolled airspace - Normal operations .................... 64

Table 5-3. Safety Objectives in controlled airspace - Normal PinS approach operations ............................................................................................................. 66

Table 5-4. Safety Objectives in uncontrolled airspace - Normal PinS approach operations ............................................................................................................................... 68

Table 5-5. Safety Objectives in controlled and uncontrolled airspace - Abnormal PinS departure operations ............................................................................................ 70

Table 5-6. Safety Objectives in controlled and uncontrolled airspace - Abnormal PinS approach operations ............................................................................................ 74

Table 5-7. Consolidated list of PinS departure Operational Hazards ............................... 76

Table 5-8. Pins departure Safety Objectives associated to the Operational Hazards ..... 78

Table 5-9. Consolidated list of PinS approach Operational Hazards ............................... 80

Table 5-10. Safety Objectives associated to the PinS approach Operational Hazards ... 82

Table 5-11. Safety Objectives validation table – PinS departure operations in controlled airspace ................................................................................................................. 87

Table 5-12. Safety Objectives validation table - PinS departure operations in uncontrolled airspace ................................................................................................................. 90

Table 5-13. Safety Objectives validation table – PinS departure operations in controlled airspace ................................................................................................................. 96

Table 5-14. Safety Objectives validation table - PinS departure operations in uncontrolled airspace ............................................................................................................... 100

Table 6-1. Consolidated list of safety requirements for PinS departure in controlled airspace ............................................................................................................... 111

Table 6-2. Consolidated list of safety requirements for PinS approach in controlled airspace ............................................................................................................... 116

Table 6-3. Consolidated list of safety requirements for PinS departure in uncontrolled airspace ............................................................................................................... 127

Table 6-4. Consolidated list of safety requirements for PinS approach in uncontrolled airspace ............................................................................................................... 131

Table 10-1: Assumptions log for PinS departure in controlled airspace ....................... 138

Table 10-2: Recommendations log for PinS departure in controlled airspace .............. 139

Table 10-3: Issue log for PinS departure in controlled airspace .................................... 139

Table 10-4: Assumptions log for PinS departure in uncontrolled airspace ................... 142

Table 10-5: Recommendation log for PinS departure in uncontrolled airspace ............ 142

Table 10-6: Issue log for PinS departure in uncontrolled airspace ................................ 142

Table 10-7: Assumptions log for PinS approach in controlled airspace ........................ 146

Table 10-8: Recommendations log for PinS approach in controlled airspace .............. 147

Table 10-9: Issue log for PinS approach in controlled airspace ..................................... 147

Table 10-10: Assumptions log for PinS approach in uncontrolled airspace ................. 149

Table 10-11: Recommendation log for PinS approach in uncontrolled airspace .......... 150

Table 10-12: Issue log for PinS approach in uncontrolled airspace ............................... 150


Generic Safety Case

Table A-1. PinS approach Hazid table .............................................................................. 156

Table A-2: RCS for MAC in controlled airspace ............................................................... 166

Table A-3. RCS for MAC in uncontrolled airspace (to be consolidated) ........................ 167

Table A-4. RCS for CFIT in controlled airspace ............................................................... 167

Table A-5. RCS for CFIT in uncontrolled airspace ........................................................... 167

Table A-6. Maximum hazard number per severity class ................................................. 168

Table A-7. Frequency & level of criticality ........................................................................ 168

Table C-1: Derivation of Mitigation/Safety Requirements for Hazards Hz_DEP_01 & Hz_APR_01 ......................................................................................................... 218

Table C-2: Derivation of Mitigation/Safety Requirements for Hazard Hz_DEP_05 & Hz_APR_05 ......................................................................................................... 222

Table C-3: Derivation of Mitigation/Safety Requirements for Hazard Hz_APR_10 & Hz_DEP_10.......................................................................................................... 226

Table C-4: Derivation of Mitigation/Safety Requirements for Hazards Hz_DEP_15 & Hz_APR_15 ......................................................................................................... 233


Table C-6: Derivation of Mitigation/Safety Requirements for Hazards Hz_APR_25 ...... 238

Table C-7: Derivation of Mitigation/Safety Requirements for Hz_DEP_50 & Hz_APR_50 ......................................................................................................... 247





Table C-12: Derivation of Mitigation/Safety Requirements for Hazard Hz_APR_75 ...... 268

Table E-1: Safety Requirements applicable to GNSS domain ........................................ 294

Table E-2: Safety Requirements applicable to Flight Procedure Design domain .......... 297

Table E-3: Safety Requirements applicable to AIS domain ............................................. 299

Table E-4: Safety Requirements applicable to MET domain ........................................... 299

Table E-5: Safety Requirements applicable to ATS domain ........................................... 303

Table E-6: Safety Requirements applicable to heliport domain ..................................... 304

Table E-7: Safety Requirements applicable to helicopter domain .................................. 308

Table F-1: Safety Recommendations applicable to ATS domain .................................... 309

Table F-2: Safety Recommendations applicable to helicopter domain .......................... 310

Table G-1: Assumption applicable to AIS domain ........................................................... 311

Table G-2: Assumption applicable to ATS domain .......................................................... 312

Table I-1: Safety Requirements applicable to GNSS domain .......................................... 339

Table I-2: Safety Requirements applicable to Flight Procedure Design domain ........... 342

TableI-3 : Safety Requirements applicable to AIS domain .............................................. 344

Table I-4: Safety Requirements applicable to MET domain ............................................ 345

TableI-5 : Safety Requirements applicable to ATS domain ............................................. 350

TableI-6 : Safety Requirements applicable to heliport domain ....................................... 351

Table I-7: Safety Requirements applicable to helicopter domain ................................... 356


Generic Safety Case

TableJ-1 : Safety Recommendations applicable to ATS domain .................................... 358

TableJ-2: Safety Recommendations applicable to helicopter domain ........................... 359

Table K-1: Assumption applicable to AIS domain ........................................................... 360

Table K-2: Assumption applicable to ATS domain .......................................................... 361


Generic Safety Case

EXECUTIVE SUMMARY

This document presents the results of the safety assessment for helicopter Point in Space (PinS) departure and approach operations in controlled and uncontrolled airspace.

Part I of this document is the generic safety case report and covers the full lifecycle of the change from definition to operation.

Two Safety Case Guidance Materials for the local deployment based on this generic safety case report are provided in Part II for PinS departure and in Part III for PinS approach. Part II and III are the main parts of the document to be used for the local deployment.

A local safety assessment should be conducted based on these documents to verify completeness and correctness of the generic safety case considering the local operational environment and any specific local regulation.



This document provides a list of safety requirements for implementation and operations addressing normal operational conditions, abnormal operational conditions and failure conditions. Different sets of requirements have been identified to cover the different possible implementations (approach and departure, controlled and uncontrolled airspace, PinS proceed visually and PinS proceed VFR).

This generic safety case presents the assurance that the Safety Requirements are complete, correct and realistic for this type of operations in controlled (Class C and D) and uncontrolled airspace (Class G). A PinS procedure completely inside an airspace class E has not been considered. However, it is important to note that helicopter landing sites may be served by PinS procedures starting, ending or passing through airspace of class E. In such case, the assumption made by this safety case is to request the most demanding requirements (associated to the controlled or uncontrolled airspace).

In uncontrolled airspace, several requirements have been identified to mitigate the risk of mid-air collision like the establishment of Radio Mandatory Zone (RMZ), blind-call transmissions, depiction of the PinS procedure on VFR chart to inform all airspace users, AIC publication and use of onbard traffic advisory system or equivalent system to enhance the see and avoid between the IFR helicopter and other aircraft in the vicinity (VFR or IFR). The implementation of these safety requirements and recommendations should be decided locally by the Project Owner in charge of the local safety case considering the number of simultaneous flights planned on the PinS procedure, the traffic density in the vicinity of the procedure considering all airspace users, the complexity of the airspace, the availability or not of an Aerodrome Flight Information Service, etc…

In controlled and uncontrolled airspace several abnormal conditions (external events possibly affecting the safety of operations) have been identified at generic level and have been mitigated by the definition of contingency procedures at the helicopter operator level. The completeness and correctness of these generic mitigations shall be verified by the operator and/or ANSPs/Competent Authorities considering the specificity of the local operational environment (e.g. obstacle-rich environment or flat areas, possible reliance on conventional navaids, helicopter equipment, etc…).


Generic Safety Case

Part I —

Helicopter Point in Space operations in controlled and

uncontrolled airspace —

Generic Safety Case Report


Generic Safety Case

1 Generic safety case report

1.1 Purpose of the document

This document (Part I) presents the results of the safety assessment for helicopter Point in Space (PinS) departure (DEP) and approach (APR) operations, in controlled and uncontrolled airspace, in a form of a generic safety case report.

This document supports a local safety case, addressing helicopter PinS operations, and the acceptance by the Competent Authority. In controlled airspace the safety assessment should be presented and coordinated by the Air Traffic Service Provider whereas in uncontrolled airspace it is the Air Traffic Service Provider and/or the helicopter operator and/or the heliport/landing site operator who should present and coordinate the safety assessment.

This generic safety case was developed under the umbrella of the FLAG Helicopter Group which was created originally as an advisory group for the 5-Lives H2020 project co-funded by the European GNSS Agency.

The FLAG is supported by GSA, EUROCONTROL and EASA and is now composed of a representative European helicopter operators, ANS providers, regulatory and national aviation authorities in order to harmonize the implementation of E-GNSS operations for rotorcraft in Europe.

Contributors involved in the development of this generic safety case:

EUROCONTROL Safety Lead with the support of Programme, Navigation and Standardisation units

Authorities: ANAC, DSAC, ENAC, FOCA and EASA

Helicopter operators: REGA (Switzerland); Norskluftambulanse (Norway); BABCOCK France, Spain, Portugal, Italy ; NucleoElicotteri and Airgreen (Italy); BMI (Austria); Sécurité Civile (France); OEAMTC (Austria)

Helicopters manufacturers: AIRBUS and LEONARDO

ANSPs: AUSTROCONTROL; DSNA; ENAV, Skyguide and NAV Portugal

Aerodrome: Caproni Aeroporto (Italy)

Engineering and project coordination: PildoLabs

Three safety workshops have been organized to consolidate the development of this generic safety case. Coordination with EASA and ICAO operations AWO Helicopter panels has also been organised for joint reviews, contributions and dissemination. It should be noted that the content of this generic safety case has already been considered to develop some local safety cases.

1.2 Scope of the document

The scope of this document addresses the different lifecycles from definition to operation for helicopter Point in Space (PinS) departure and approach operations, in controlled airspace (Class C and D) and uncontrolled airspace (Class G). A PinS procedure completely inside an airspace class E has not been considered. However, it is important to note that helicopter landing sites may be served by PinS procedures starting, ending or passing through airspace of class E. In such case, the assumption made by this safety case is to require the most demanding requirements ( associated to the controlled or the uncontrolled airspace).

1.3 Intended readership

This generic safety case report is intended to be read and used by the following:


Generic Safety Case

ANSP

Helicopter Operators

Heliport/landing site Operators

Competent Authorities (EASA, National Supervisory Authorities…)

Other stakeholders interested in deploying PinS operations.

1.4 Safety assessment background

The following safety documents/presentations have been considered:

Clean Sky (Garden/Care): Safety analysis of SNI Aircraft and Rotorcraft IFR operations at airport.

NLR Study for implementation of IFR GA operations in airspace Class G in Switzerland (NLR-CR-2014-049)

HELIOS Safety Assessment of IFR in Class G Airspace (P1756D4000)

DGAC Démonstration de sécurité- Mise en œuvre de procédures de type « Point In Space » (PinS) dans le cadre du groupe de travail Hélicoptères Tout Temps (HTT)

SESAR PROuD Local Safety Assessment (Norway and Switzerland)


Generic Safety Case

1.5 Abbreviations

Term Definition

A/C Aircraft

ADS-B Automatic Dependent Surveillance-Broadcast

AFIS Aerodrome Flight Information Service

AFISO Aerodrome Flight information Service Officer

AFM Aircraft Flight Manual

AIC Aeronautical Information Circular

AIP Aeronautical Information Publication

AIRAC Aeronautical Information Regulation And Control

AIS Aeronautical Information Services

AISP Aeronautical Information Service Provider

ALT Altitude

ANS Air Navigation Service(s)

ANSP Air Navigation Service Provider

APCH Approach

APR Approach

ARG Argument

ATC Air Traffic Control

ATCO Air Traffic Control Officer

ATM Air Traffic Management

ATS Air Traffic Services

ATSP Air Traffic Service Provider

CAA Civil Aviation Authority

Cb Cumulonimbus

CNS Communication Navigation Surveillance

CFIT Controlled Flight Into Terrain

CTR Control zone

DAT Data Link

DEP Departure

DME Distance Measuring Equipment

EASA European Aviation Safety Agency

EC Electronic Conspicuity

EFB Electronic Flight Bag

EGNOS European Geostationary Navigation Overlay Service

E-GNSS Enhanced GNSS

ESSP European SBAS Service Provider

ETD Estimated Time of Departure


Generic Safety Case

Term Definition

FAF Final Arrival Fix

FATO Final Approach and Take-Off area

FISO Flight Information Service Officer

FMS Flight Management System

FPD Flight Procedure Design

FPLN Flight Plan

FS Functional System

GA General Aviation

GPS Global Positioning System

GNSS Global Navigation Satellite System

GSN Goal-Structuring Notation

HAS Height Above Surface

HAZID HAZard IDentification

HEMS Helicopter Emergency Medical Service

HMI Human Machine Interface

HTAWS Helicopter Terrain Awareness and Warning System

IAF Initial Approach Fix

ICAO International Civil Aviation Organization

ID Identification

IDF Initial Departure Fix

IFP Instrument Flight Procedure

IFR Instrument Flight Rules

IMC Instrument Meteorological Conditions

KPI Key Performance Indicator

LLR Low Level Route

LNAV Lateral Navigation

LOC Loss of Control

LOC-I Loss of Control-Inflight

LPV Localizer Performance with Vertical Guidance

MAC Mid Air Collision

MAPt Missed Approach Point

MCA Minimum Crossing Altitude

MDA Minimum Descent Altitude

MET Meteorological

MOC Minimum Obstacle Clearance

MSL Mean Sea Level

MSAW Minimum Safe Altitude Warning


Generic Safety Case

Term Definition

ND Navigation Display

NMAC Near Mid Air Collision

NM Network Manager

NSA National Supervisory Authorities

OCA/H Obstacle Clearance Altitude/Height

OCH Obstacle Clearance Height

OHA Operational Hazard Assessment

OIS Obstacle Identification Surface

OLS Obstacle Limitation Surface(s)

OPS Operations

PBN Performance Based Navigation

PinS Point in Space

PSSA Preliminary System Safety Assessment

QNH Atmospheric Pressure at Nautical Height

RAIM Receiver Autonomous Integrity Monitoring

RCS Risk Classification Scheme

RF Radius to Fix

RM Risk Model

RMZ Radio Mandatory Zone

RNAV Area Navigation

RNP Required Navigation Performance

RNP APCH RNP Approach

RPAS Remotely Piloted Aircraft Systems

SAC Safety Criteria

SARPS Standards and Recommended Practices (ICAO)

SBAS Satellite Based Augmentation System

SC Severity Classification

SCGM Safety Case Guidance Material

SCS Severity Classification Scheme

SDD Service Definition Document

SERA Standardized European Rules of the Air

SID Standard Instrument Departure

SO Safety Objective

SR Safety Requirement

SRM Safety Reference Material

SSA System Safety Assessment

STAR Standard Arrival Route


Generic Safety Case

Term Definition

SW Software

TAS Traffic Advisory System

TF Track to Fix

TL Transition Level

TLOF Touchdown and Lift-Off Area

TMA Terminal Manoeuvring Area

TMZ Transponder Mandatory Zone

TSE Total System Error

UAV Unmanned Aerial Vehicle

UIMC Unintended Flight in IMC

VFR Visual Flight Rules

VLA Very Light Aircraft

VMC Visual Meteorological Conditions

VNAV Vertical Navigation

VOR VHF Omnidirectional Range

VSDG Visual Segment Design Gradient

V&V Validation and Verification

WPT Waypoint

1.6 Definitions

Term Definition

Competent Authority

Means one or more entities designated by a Member State and having the necessary powers and allocated responsibilities for performing the tasks related to certification, oversight and enforcement in accordance with the EASA Basic Regulation ((EU) No 2018/1139) and with the delegated and implementing acts adopted on the basis thereof, and with Regulation (EC) No 549/2004.

Electronic Conspicuity

Electronic Conspicuity (EC) is an umbrella term for a range of technologies that, in their most basic form, transmit the position of the host aircraft to other airspace users operating compatible equipment. More advanced devices can also transmit and receive, displaying and alerting pilots to other/conflicting traffic who have compatible EC devices. EC devices turn the traditional ‘see and avoid’ concept into ‘see, BE SEEN, and avoid’.

Definition from CAA UK (see CAP 13911)

1 CAP 1391: Electronic conspicuity devices - Version 2 dated 11 April 2018


Generic Safety Case

Term Definition

FLARM

FLARM is a traffic awareness and collision avoidance technology for General Aviation, light aircraft, and UAVs. FLARM is an electronic system used to selectively alert pilots to potential collisions between aircraft. It is not formally an implementation of ADS-B, as it is optimized for the specific needs of light aircraft, not for long-range communication or ATC interaction.

Hazard

Any condition, event, or circumstance which could induce harmful effects (e.g. an accident). This covers both pre-existing aviation hazards (not caused by ATM/ANS functional systems) and “system-generated hazards” i.e. new hazards introduced by the failure of the ATM/ANS functional systems.

HEMS

Helicopter Emergency Medical Service (HEMS) – A flight by a helicopter operating under a HEMS approval, the purpose of which is to facilitate emergency medical assistance, where immediate and rapid transportation is essential, by carrying:

Medical personnel; or

Medical supplies (equipment, blood, organs, drugs); or

Ill or injured persons and other persons directly involved.

Landing Location A marked or unmarked area that has the same physical characteristics as a visual heliport Final Aapproach and Ttake-Off area (FATO).

MAPt

Missed approach point (MAPt). That point in an instrument approach procedure at or before which the prescribed missed approach procedure must be initiated in order to ensure that the minimum obstacle clearance is not infringed.

Operational hazard

A “system-generated” hazard (i.e. which results from failure of the ATM/ANS functional system) identified at the level of the Operational services delivered to the airspace user i.e. a level that is independent of the architecture of the system.

Point in Space approach (PinS)

The Point-in-Space approach is based on GNSS and is an approach procedure designed for helicopters only. It is aligned with a reference point located to permit subsequent flight manoeuvring or approach and landing using visual manoeuvring in adequate visual conditions to see and avoid obstacles.

Point in Space (PinS) visual segment

The segment of a helicopter PinS procedure between a point (MAPt or IDF) and the heliport or the landing location.

RNP

There are different levels of RNP. A performance value of RNP 0.3, for example, assures that the aircraft has the capability of remaining within 0.3 of a nautical mile to the right or left side of the centerline 95 percent of the time. In addition an on-board performance monitoring is required for RNP: the aircraft, or aircraft and pilot in combination, is required to monitor the Total System Error (TSE), and to provide an alert if the accuracy requirement is not met or if the probability that the TSE exceeds twice the accuracy value (0.6Nm for RNP 0.3) is larger than 10–5.


Generic Safety Case

Term Definition

SBAS Satellite-based augmentation system (SBAS). A wide coverage augmentation system in which the user receives augmentation information from a satellite-based transmitter.

Touchdown and Lift-Off area (TLOF)

An area on which a helicopter may touch down or lift off.

VMC

Visual meteorological conditions (VMC) are the meteorological conditions expressed in terms of visibility, distance from cloud, and ceiling equal to or better than specified minima (as defined by the regulation e.g. SERA in Europe).


Generic Safety Case

1.7 Reference material

[RD 1] ICAO, Doc 4444, Procedures for Air Navigation Services - Air Traffic Management (PANS-ATM), Sixteenth Edition, 2016

[RD 2] SESAR P16.06.01, Task T16.06.01-006, SESAR Safety Reference Material, Edition 00.04.00, 24th of March 2016

[RD 3] SESAR P16.06.01, Task T16.06.01-006, Guidance to Apply the SESAR Safety Reference Material, Edition 00.03.00, 9th of May 2016

[RD 4] (EU) No 923/2012 and (EU) No 2016/1185 laying down the common rules of the air and operational provisions regarding services and procedures in air navigation

[RD 5] (EU) No 1207/2011 laying down requirements for the performance and the interoperability of surveillance for the single European sky

[RD 6] (EU) No 2017/373 common requirements for providers of ATM/ANS

[RD 7] (EU) No 73/2010 on the quality of aeronautical data/information.

[RD 8] ICAO, Doc 8168, PANS Aircraft Operations, Volume I- Flight Procedures, Sixth Edition 2018

[RD 9] ICAO, Doc 8168, PANS Aircraft Operations, Volume II- Construction of Visual and Instrument Flight Procedures, Sixth Edition 2014

[RD 10] ICAO Doc 9906 Quality Assurance Manual for Flight Procedure Design, First Edition 2009

[RD 11] ICAO Annex 4 Aeronautical Charts, Eleventh Edition 2009

[RD 12] ICAO Annex 10 Aeronautical Telecommunications- Vol I, Sixth Edition 2006

[RD 13] ICAO Annex 15 Aeronautical Information Services, Fourteenth Edition 2013

[RD 14] EUROCAE ED-76/RTCA DO-200A Standards for Processing Aeronautical Data

[RD 15] (EU) No 965/2012 Air Operations

[RD 16] EASA detailed report for SPT.089 included in PIA GA FW Leisure

[RD 17] FAA AC20-138D Airworthiness Approval of Positioning and Navigation Systems (Including Change 2) dated 28 March 2014

[RD 18] ICAO Doc 9613 PBN Manual, Fourth Edition 2013

[RD 19] ICAO Doc 8071 Vol II Manual on Testing of Radio Navigation Aids, Fifth Edition 2007

[RD 20] ICAO Annex 14 Aerodrome Volume II –Heliports, Fourth Edition 2013

[RD 21] (EU) No 748/2012 Airworthiness and environmental certification

[RD 22] (EU) No 2018/1048 - Airspace Usage Requirements and Operating Procedures concerning Performance-Based Navigation


Generic Safety Case

2 Background on current VFR helicopter operations

2.1 Description of current operations

Currently, most helicopter operations are conducted under Visual Flight Rules2 where the “see and avoid” principle prevails. For helicopters at and below 900 m (3 000 ft) above MSL or 300 m (1 000 ft) above terrain, whichever is the highest:

By day (see [RD 4] SERA 5001):

o in airspace classes F and G, flight visibility shall not be less than 800 m, provided that the pilot maintains continuous sight of the surface and if manoeuvred at a speed that will give adequate opportunity to observe other traffic or obstacles in time to avoid collision;

o in airspace classes B,C, D and E, flight visibility shall not be less than 5 km, the distance from cloud being not less than 1 500 m horizontally and 300 m (1 000 ft) vertically;

At night: flight visibility shall not be less than 5 km, provided that the pilot maintains continuous sight of the surface and the ceiling be less than 450 m (1 500 ft) (see [RD 4] SERA 5005 (c) 3);

Flight visibility minima lower than those specified above may be permitted for helicopters in special cases, such as medical flights, search and rescue operations and fire-fighting. (see [RD 4] SERA 5001 and 5005). Different helicopter operators conduct different missions: HEMS, private transport, law enforcement, aerial work, oil platforms, etc ;

The part of the airspace where VFR approaches and departures are performed is shared with other types of aircraft such as Ultralight, Very light aircraft, gliders in particular in the vicinity of airports in airspace class G.

Usually, helicopter operators have to face significant weather and terrain-related challenges when performing specific flight operations (e.g. civil transport, medical emergencies, etc.). For those reasons and for decades, helicopter operations were suitably confined to flying only when they could meet strict visibility standards (VMC conditions), limiting drastically their access in controlled airspace and accordingly the operations to and from airports. In addition, low cloud, fog, rain, snow, the presence of mountains and valleys could seriously affect safety and success of concerned operations.

Nowadays, the GNSS technology enhanced by SBAS systems (without the need of ground infrastructures) allows designing specific IFR approach and departure procedures, named Point-in-Space (PinS) procedures. The GNSS technology provides the appropriate accuracy, integrity and availability for these new helicopter operations in controlled or uncontrolled airspace considering the limitation associated to the current heliport infrastructure (non-instrument heliport). Furthermore, the ICAO PBN concept [RD 18], thanks to the development of RNP APCH, RNP1 and RNP0.3 navigation specifications, makes a wide range of benefits available, facilitating the full integration of helicopter operations into the ATM system.

Such dedicated helicopter flight procedures not only increase the TMAs’ sectors capacities, but should improve safety, flight efficiency, equity, accessibility and reduce the environmental impact (noise and pollution) in the airspace within the Terminal Manoeuvring Area (TMA).

Current IFR helicopter advanced on-board avionics are compliant with the technical system requirements needed to fly these new procedures with very high accuracy (RNP1/RNP0.3/RNP APCH) within 1.0/0.3 nautical miles on either side of the nominal flight path at least 95% of the time

2 According to the NTSB (National Transportation Safety Board), 89% of all helicopter flights over 10 years are VFR.


Generic Safety Case

and even more accurate for approach procedures.

This translates into a greater ATCO confidence in the track-keeping performance of traffic movements, allowing to place trajectories closer together.

IFR PinS procedures represent the best facilitation to allow helicopter operations on non-instrument heliports in controlled and uncontrolled airspace and at the same time, they support connectivity between airports/heliports included in the TMA airspace, thanks to the implementation of the IFR Low Level Routes concept.

Helicopters reach their best operational performances when flying unconstrained in VFR, an operating mode heavily dependent upon weather conditions and visibility. However, this way of operating can be adversely affected by foggy or cloudy weather and icing conditions, which can prevent helicopters to proceed VFR or make them subject to delays when operating to/from a controlled airspace (i.e: CTR) in a dense medium complexity ATM airspace.

Currently, all modern twin engine helicopters are IFR certified and characterized by advanced avionic standards. When flying to/from an instrument heliport or landing location (airports mainly, as few heliports are instrument heliports), due to the lack of helicopter-specific procedures, they will use the same flight procedures originally designed for fixed-wing aircraft.

These approach and departure procedures, being specifically designed for fixed-wing aircraft, are constraining for helicopters with important limitations on their operations, as they have flight trajectories and profiles which are not optimized for helicopters. In particular, helicopters have different needs, capabilities and performances in terms of manoeuvrability, descent rate and speed profile.

Forcing helicopters along the same published procedures designed for fixed wing can delay their operations to/from airports, and to/from airspace with a negative impact on the operations of both helicopter and commercial fixed-wing aircraft, increasing also Air Traffic Controllers’ workload.

Rather than proceeding directly to a final destination, helicopters are routed in such a way that additional flight time is required, fuel management becomes a critical factor and delay can make the difference between life and death for rescue operations.

2.2 Safety of current operations

Accident/incident data are insufficient when narrowed down to VFR operations due to a lack of accurate exposure data.

However, a literature survey shows that helicopter operations are becoming increasingly safer but still suffer from fatal accidents. Better equipment and better training have helped to reduce by half the mortality in Europe and the US over the last 6 years.3

In 2016, the FAA provided the following figures over a period ranging from 2009 – 20134 (analysis of

104 helicopter crashes):

16% of crashes were classified UIMC (Unintended Flight in IMC), highest just after the LOC (Loss of Control),

second highest rate of crashes were rescue operations (after private transport).

3 Article “Helicopter Safety News”, March 8th 2017, provided by IHST (International Helicopter Safety Team) - http://www.ihst.org/ -

4 2016 Rotorcraft Safety Conference- FAA – “Accidents Investigations Lessons learned” – M. Hemann and S. Tyrell - https://www.faa.gov/news/conferences_events/2016_rotorcraft_safety/


Generic Safety Case

According to pilots, deteriorating weather conditions are the main factor towards UIMCs. Weather reports are neither easily nor quickly obtained for an emergency take off; nor precise enough as they do not cover disturbances created by the terrain, or are simply outside from the MET coverage network. Rescue operations are especially concerned since they will operate in difficult or hostile surroundings with a high stress factor for the pilot due to the time constraint of the operation.

Further limitations/elements will impact the safety of operations:

Helicopters not approved for IFR operations: flights in adverse weather conditions cannot be conducted. This seriously reduces the number of rotations. Operators hesitate to convert to IFR due to high and often long routing IFR routes, resulting in increased risk for VFR operations in poor weather and/or inadvertent IMC. Inadvertent IMC has been one of the highest causes of accidents – with operators often not investing in training and certifying for this capability;

The transition of daylight to night is recognised as being difficult to handle for the pilot as her/his vision and the sharpness of contrast rapidly diminishes;

Changing weather conditions (in or near mountains, forests, sea) can rapidly lead to dangerous situations for the crew and passengers;

Sharp increase in Ultralight, VLA, gliders traffic and the complexity of the mix with other traditional users is leading to a situation where the “see and avoid” principle becomes more and more difficult to apply;

Obstacles (windmill fields, cranes, etc) are not always clearly identified;

Technical issues such as de-icing and anti-icing equipment, etc.

Missing helicopter-dedicated IFR Infrastructure

Missing local weather information for the low altitude part of the flight

Missing dedicated CNS low level infrastructure (such as ADS-B)

Missing accurate obstacle and terrain data


Generic Safety Case

3 Point in Space Change overview

3.1 Concept of Operations

The Point-in-Space (PinS) concept is a flight operation based on GNSS and designed for helicopters only. It relies on the possibility for the pilot to conduct flight under Instrument Meteorological Conditions (IMC) to/from a PinS and not directly to/from the heliport. Those procedures enable heliport or landing site operator to implement IFR procedures on non-instrument FATO5 (Final Approach and Take-Off) located on aerodromes or isolated heliports as well as landing locations.

Another interest of the PinS concept is the flexibility to position the PinS in order to deal with heliports generally located in obstacle-rich environments (heliports on hospitals for instance). For approach, this flexibility allows a lower Obstacle Clearance Height (OCH) than with the direct procedure due to the position of the MAPt which can be located away from the FATO and makes the missed approach less critical regarding the obstacles.

Two kinds of PinS operations are possible: PinS departure operations and PinS approach operations. The scope of this document covers all published procedures, including the ones with possible restrictions of use (e.g. restricted for some operations only or to some operators only).

3.1.1 PinS departure operations

PinS concept for departures can be summarized as follows:

The pilot proceeds using visual references from the FATO to a Point in Space called the IDF (Initial Departure Fix). This part of the operation is the visual flight phase. PinS procedures are built based on visual criteria and are defined according to ICAO Doc 8168 Volume lI [RD 9]. Two types of visual flight phase are possible:

o “proceed visually” procedure.

o “proceed VFR” procedure

The instrument flight phase starts once the pilot has passed the IDF at or above a certain altitude (MCA: Minimum Crossing Altitude).

3.1.1.1 PinS “proceed visually” departure

PinS “proceed visually” departure operations are developed for non-instrument heliports or landing locations compliant with ICAO Annex 14 Volume II [RD 9], but not necessarily compliant with Appendix 2 of ICAO Annex 14 [RD 20] relating to instrument heliports. These operations do not require Visual Meteorological Conditions for the visual flight phase.

The PinS “proceed visually” approach operations include:

The visual flight phase, based on the following features:

o Flight rules: The visual flight phase of a “proceed visually” operation is performed under Instrument Flight Rules (i.e. Visual Meteorological Condition are not required during this phase of flight).

o Procedure design:

This phase relies on a published visual flight procedure.

When applicable, the visual segment of a “proceed visually” operation is protected by specific obstacle protection and identification of surfaces.

Two types of visual segment can be designed:

Direct Visual Segment: the direct visual segment is a leg from the heliport/landing location direct to the IDF. Visual Segment Design

5 PinS operations can also be implemented on non-instrument runways located on aerodromes but this kind of operations are not part of

the scope of this document.


Generic Safety Case

Gradient (VSDG) and IDF MCA are published.

Manoeuvring Visual Segment: Visual manoeuvre around the heliport/ landing location to reach the IDF from a direction other than directly to IDF. The centre line(s) and direction(s) of the take-off climb surface(s) taken into account for the protection of the manoeuvring visual segment shall be indicated. This type of segment is out of scope of the present safety case.

o Operating method:

The definition of the operating minima (visibility and ceiling), depending on the kind of operation, is under the responsibility of the helicopter operator.

Prior to initiate the departure from the FATO,

The pilot checks that the local visibility and ceiling conditions provided by the meteorological service comply with the operating minima requirements;

The helicopter shall depart on an IFR clearance and fly visually towards the IDF in controlled airspace

The pilot conducts the flight under Instrument Flight Rules (IFR) from the FATO to the IDF. The pilot climbs towards the IDF to or above the authorized altitude (IDF MCA)

The pilot navigates by visual reference to the earth’s surface; the visibility shall be sufficient to see and avoid obstacles

If it is not possible to continue visually to cross the IDF at or above the IDF MCA, the pilot shall abort the procedure and return to the heliport or landing location

The instrument flight phase based on the following features;

o Flight rules: The Instrument flight phase is performed under Instrument Flight Rules (i.e. it does not require Visual Meteorological Conditions) from the IDF at or above IDF MCA.

o Procedure design:

The instrument flight phase relies on a published instrument departure procedure. Procedure Design Gradient (PDG) and Minimum Crossing Altitude (IDF MCA) are published on the chart.

At the IDF, track change is permitted at a maximum of 30°

The departure instrument flight procedure is designed according to Navigation Specification RNP1 or RNP0.3.

The segments of the instrument departure procedure are protected from obstacles (Minimum Obstacle Clearance)

o Operating method:

The pilot conducts the flight under Instrument Flight Rules (IFR) from the IDF based on instrument navigation to the Low Level Route (or to other existing routes/SID/STAR/approach or without any route structure) and respects lateral and vertical constraints when applicable.


Generic Safety Case

Figure 3-1: Example of PinS “proceed visually” departure from the FATO with direct visual segment

3.1.1.2 PinS “proceed VFR” departure

PinS “proceed VFR” departure operations are developed for heliports or landing locations that may not meet the standard for a non-instrument heliport (i.e. heliport may not comply with ICAO Annex 14) [RD 20], similarly to current VFR operations. These operations require Visual Meteorological Conditions for the visual flight phase.

The PinS “proceed VFR” approach operations include:

The visual flight phase, based on the following features

o Flight rules: The visual flight phase of a “proceed VFR” operation is performed under Visual Flight Rules (i.e. Visual Meteorological Condition are required during this phase of flight)

o Procedure design:

This phase relies on a VFR trajectory, published or not

The visual segment of a “proceed VFR” operation is not protected from obstacles. The pilot is responsible to see and avoid obstacles (Visual Flight Rules).

o Operating method:

The definition of the operating minima (visibility and ceiling) depending on the kind of operation is the responsibility of the operator.

Prior to initiate the departure, the pilot checks that the local visibility and ceiling conditions provided by the meteorological service complies with the applicable VMC requirements related to the airspace class;

The helicopter shall depart on a VFR clearance and fly visually towards the IDF in controlled airspace

The pilot conducts the flight under Visual Flight Rules (VFR) from the FATO to the IDF;

The pilot ensures that VMC are maintained all along the visual segment of a “proceed VFR” operation


Generic Safety Case

The pilot climbs towards the IDF at or above the authorized altitude (MCA).

Prior to reaching the IDF, an IFR clearance shall be obtained from the ATCO responsible for that controlled airspace

Passing the IDF at or above the IDF MCA, the pilot switches from VFR to IFR flight (he starts the IFR flight)

The instrument flight phase, is similar to the one for PinS “proceed visually” departure.

Figure 3-2: Example of PinS “proceed VFR” departure from the FATO

3.1.1.3 Main differences between PinS “proceed visually” and “proceed VFR” departure

The following table highlights the main differences between “proceed visually” and “proceed VFR” procedures for PinS departure operations:

Proceed visually Proceed VFR

Flight rules for the visual flight phase

IFR (VMC not required) VFR (VMC required)

Visual flight phase procedure design

Published visual flight procedure

Identification of obstacles and protection when applicable

Promulgation: o Direct visual segment

VSDG , MCA IDF o Manoeuvring visual segment

(out of scope of the present assessment) MCA IDF

VFR trajectory published or not

Not protected from obstacles

See and avoid obstacles (VFR)

Flight rules for the instrument flight phase

IFR


Generic Safety Case


Instrument flight phase procedure design

Published IFR procedure

PDG , MCA IDF published

At IDF, track change of 30° maximum is permitted

Navigation specification RNP1 or RNP0.3

Protected from obstacles (MOC)

Operating method

Operating minima To be defined by helicopter operator in terms of:

Visibility

ceiling

To be defined by helicopter operator depending on the VMC minima related to the airspace class

Prior to initiate departure from FATO

Visibility/ceiling conditions provided by meteorological service or equivalent

Flight crew verify compliance of MET information with operating minima requirements

In controlled airspace: Departure clearance (IFR or VFR depending on the procedure)

From FATO to IDF Pilot flies visually in IFR towards the IDF

Pilot navigates by visual reference to the earth’s surface and the visibility shall be sufficient to see and avoid obstacles

Pilot flies visually in VFR towards the IDF


Transition from visual flight phase to Instrument flight phase

Passing the IDF at or above the IDF MCA

Passing the IDF at or above the IDF MCA

In controlled airspace: IFR clearance needed to proceed on instrument segment

Switch from VFR to IFR flight

If no possibility to reach the IDF at or above IDF MCA, pilot aborts procedure and return to heliport or landing location

From IDF Pilot continues flying in IFR based on instrument navigation to LLR or other existing routes/SID/STAR/approach (or without any route structure) and respects lateral and vertical constraints when applicable

3.1.1.4 Navigation Specifications for PinS departure

The departure route can be designed according to different Navigation Specifications. RNP1 and RNP 0.3 can be considered according to airspace constraints, which imply a tighter semi-width corridor for RNP 0.3.

Design requirements are already defined: RNP 1 in general and RNP 0.3 where necessary (constraining environment). According to the ICAO PBN manual [RD 18], chapter 7 “implementing RNP0.3”, a number of navigation systems using GNSS for positioning are capable of performing RNP0.3 operations if suitably integrated into the flight display system. The RNP0.3 specifications take advantage of known functionality, on-board performance monitoring and alerting capability of many TSO-C145/C146 GPS systems, which are installed in a wide range of IFR helicopters.


Generic Safety Case

Figure 3-3: RNP1 and RNP0.3 protection areas

3.1.2 PinS approach operations

PinS concept for approaches can be summarized as follows:

The pilot conducts the flight under Instrument Flight Rules (IFR) from the Initial Approach Fix (IAF) to a Point-in-Space (PinS), which is considered as a missed approach point (MAPt). This part of the operation is the instrument flight phase.

Then,

o if appropriate visual references are obtained, the pilot proceeds using visual references from the PinS to the FATO. This part of the operation is the visual flight phase;

o if appropriate visual references are not obtained, the pilot performs an instrument missed approach procedures. This operation is part of the instrument flight phase.

Two types of PinS approach procedures are possible:

PinS “proceed visually” approach

PinS “proceed VFR” approach

These two types of operations are described below.

3.1.2.1 PinS “proceed visually” approach

PinS “proceed visually” approach operations are developed for non-instrument heliports or landing locations compliant with ICAO Annex 14 Volume II [RD 20], but not necessarily compliant with Appendix 2 of ICAO Annex 14 relating to instrument heliport. These operations do not require Visual Meteorological Conditions for the visual flight phase.


Generic Safety Case

The PinS “proceed visually” approach operations include:

The instrument flight phase based on the following features;

o Flight rules: The instrument flight phase is performed under Instrument Flight Rules (i.e. it does not require Visual Meteorological Conditions)

o Procedure design:

The instrument flight phase relies on a published approach instrument flight procedure

The approach instrument flight procedure is designed according to Navigation Specification RNP APCH. It may be published with LNAV minima and/or LPV minima6. It is assumed that only Obstacle Clearance Height (OCH) is published.

The definition of the operating minima (Minimum Descent Altitude or Decision Altitude) depending on the kind of operation and visibility minima is under helicopter operator responsibility.

The segment of the approach instrument flight procedure are protected from obstacles (Minimum Obstacle Clearance)

o Operating method:

Prior to initiating the approach, the pilot checks that the local visibility conditions provided by the meteorological service complies with the visibility minima requirements defined by the operator;

The pilot conducts the flight under Instrument Flight Rules (IFR) from the Initial Approach Fix (IAF) to the Point-in-Space (PinS). The pilot descends towards the PinS to the authorized altitude (MDA or DA) depending on the type of operation (LNAV or LPV)

At or prior the PinS, the pilot checks if the heliport or landing location or visual references associated with it can be acquired:

If appropriate visual references are obtained, the pilot proceeds using visual references from the PinS to the FATO (see “visual flight phase”)

If appropriate visual references are not obtained, the pilot executes an instrument missed approach (see “instrument missed approach phase”)


o Flight rules: The visual flight phase of a “proceed visually” operation is performed under Instrument Flight Rules (i.e. Visual Meteorological Conditions are not required during this phase of flight, it is only required to see the heliport or landing location or visual references associated with it)

o Procedure design:

This phase relies on a published visual flight procedure

The visual segment of a “proceed visually” operation is protected by specific obstacle protection and identification surfaces

Two types of visual segment can be designed

Direct Visual Segment: the direct visual segment is a leg, which may contain a limited single turn, from the PinS direct to the heliport/landing location or via a Descent Point (DP) to the heliport/ landing location. Course changes are permitted at either the PinS or the DP (if established) but not at both. The maximum course change is 30º.

Manoeuvering Visual Segment: the visual manoeuvre from the PinS

6 LNAV/VNAV minima are not part of the scope of this document as less relevant for helicopters community.


Generic Safety Case

around the heliport/ landing location to land from a direction other than directly from the PinS. This type of segment is out of scope of the present safety case.

o Operating method: the pilot conducts the flight under Instrument Flight Rules (IFR) from the Point-in-Space (PinS) to the FATO.

A possible instrument missed approach phase, based on the following features:

o Flight rules: The missed approach phase is performed under Instrument Flight Rules (i.e. it does not require Visual Meteorological Conditions)

o Procedure design:

The instrument flight phase relies on a published instrument missed approach procedure

The missed approach instrument flight procedure is designed according to Navigation Specification RNP APCH or RNP 0.3.

The segments of the instrument missed approach procedure are protected from obstacles (Minimum Obstacle Clearance)

Figure 3-4: Example of PinS “proceed visually” approach down to LPV minima with direct visual segment

3.1.2.2 PinS “proceed VFR” approach

PinS “proceed VFR” approach operations are developed for heliports or landing locations that may not meet the standard for a non-instrument heliport (i.e. heliports may not comply with ICAO Annex 14), similarly to current VFR operations. These operations require Visual Meteorological Conditions for the visual flight phase.

The PinS “proceed VFR” approach operations include:

The instrument flight phase, is similar to the one for PinS “proceed visually” except for the decision criteria at the PinS/MAPt. The instrument flight phase is based on the following features;

o Flight rules: The instrument flight phase is performed under Instrument Flight Rules (i.e. it does not require Visual Meteorological Condition)

o Procedure design:

The instrument flight phase relies on a published approach instrument flight procedure

The definition of the operating minima (Minimum Descent Altitude or Decision Altitude) depending on the kind of operation and visibility minima is under helicopter operator responsibility.


Generic Safety Case

The approach instrument flight procedure is designed according to Navigation Specification RNP APCH. It may be published with LNAV minima and/or LPV minima7. It is assumed that only Obstacle Clearance Height (OCH) is published.

The segments of the approach instrument flight procedure are protected from obstacles (Minimum Obstacle Clearance)

Only a HAS (Height Above Surface) diagram is published at the MAPt to aid the pilot in transition from IFR to VFR at the MAPt. It represents “the difference in height between the OCA and the elevation of the highest terrain, water surface or obstacle within a radius of at least 1.5 km (0.8 NM) from the MAPt” as well as the inbound course to the MAPT [ICAO Doc 8168 Volume I [RD 9]]

o Operating method:

Prior to initiate the approach, the pilot checks that the local visibility and ceiling conditions provided by the meteorological service comply with the applicable VMC requirements defined by the operator;

The pilot conducts the flight under Instrument Flight Rules (IFR) from the Initial Approach Fix (IAF) to the Point in Space (PinS). The pilot descends towards the PinS to the authorized altitude (MDA or DA) depending on the type of operation (LNAV or LPV)

At or prior the PinS, the pilot checks if the applicable visibility minima is obtained by detecting appropriate visual references as currently:

If applicable visibility minima is obtained, the pilot switches from IFR to VFR flight (he cancels the IFR flight) and proceeds using visual references from the PinS to the FATO (see “visual flight phase”)

If applicable visibility minima is not obtained, the pilot executes an instrument missed approach (see “instrument missed approach phase”)


o Flight rules: The visual flight phase of a “proceed VFR” operation is performed under Visual Flight Rules (i.e. Visual Meteorological Conditions are required during this phase of flight)

o Procedure design:

This phase relies on a VFR trajectory published or not

The visual segment of a “proceed VFR” operation is not protected from obstacles. The pilot is responsible to see and avoid obstacles (Visual Flight Rules).

o Operating method:

The pilot conducts the flight under Visual Flight Rules (VFR) from the Point-in-Space (PinS) to the FATO.

The pilot ensures that VMC are obtained all along the visual segment of a “proceed VFR” operation

A possible instrument missed approach phase, based on the following features

o Flight rules: The missed approach phase is performed under Instrument Flight Rules (i.e. it does not require Visual Meteorological Conditions)

o Procedure design:

The instrument flight phase relies on a published instrument missed approach procedure

The missed approach instrument flight procedure is designed according to

7 LNAV/VNAV minima are not part of the scope of this document as less relevant for helicopters community.


Generic Safety Case

Navigation Specification RNP APCH or RNP 0.3.

The segments of the instrument missed approach procedure are protected from obstacles (Minimum Obstacle Clearance)

Figure 3-5: Example of PinS “proceed VFR” approach down to LPV minima with direct VFR segment

3.1.2.3 Main differences between PinS “proceed visually ” and “proceed VFR” approach

The following table highlights the main differences between “proceed visually ” and “proceed VFR” procedures for PinS approach operations:


Flight rules for the instrument flight phase

IFR

Instrument flight phase procedure design

Published IFR procedure

OCH is published

Navigation specification RNP APCH

Protected from obstacles (MOC)

Flight rules for the visual flight phase

IFR (VMC not required) VFR (VMC required)

Visual flight phase procedure design

Published visual flight procedure

Identification of obstacles and protection when applicable

Two kinds of visual segments: o Direct visual segment o Manoeuvring visual segment

(out of scope of the present assessment)

VFR trajectory published or not

Not protected from obstacles

See and avoid obstacles (VFR)

Operating method

Instrument

segment

Platform

Visual

segment

PinS

MAPt

DH ≥ 250ft

VMC minima obtained

Instrument Missed

Approach


Generic Safety Case


Operating minima To be defined by helicopter operator in terms of MDA/DA

To be defined by helicopter operator in terms of MDA/DA and depending on the VMC minima related to the airspace class

Prior to departure Local meteorological conditions provided by meteorological service or

equivalent

Flight crew verify compliance of MET information with operating minima requirements

Prior to initiate the approach

Pilot flies in IFR based on instrument navigation

Pilot respects lateral and vertical constraints when applicable

Transition from visual flight phase to Instrument flight phase

Pilot verify if appropriate visual reference are obtained at or prior the PinS

Pilot verify if appropriate visual reference and VMC minima are obtained at or prior the PinS

Pilot switch from IFR to VFR flight

If visual reference are not obtained at the PinS, pilot perfoms a missed approach procedure

From PinS to FATO

Pilot flies visually in IFR towards the FATO

Pilot complies with the published constraints of the visual segment


Pilot flies visually in VFR towards the FATO



Generic Safety Case

3.2 Operational Environment key characteristics

In this section, the following key relevant characteristics of the departure and approach operational environments are reviewed, as these are expected to influence the helicopter operation safety risk assessment:

Heliport/landing location

Route structure

Controlled airspace


Density/complexity of traffic nearby the route structure

Weather conditions

ATM capabilities in terms of CNS

3.2.1 Heliport / landing location

Several heliport configurations are considered in this generic safety case:

Heliport or landing location co-located or not with an aerodrome

Heliport or landing location in controlled airspace (class C, and D) where Air Traffic Control service is provided

Heliport or landing location in uncontrolled airspace (class G) where Aerodrome Flight Information Service is provided

Heliport or landing location in uncontrolled airspace (class G) where no Aerodrome Flight Information Service is provided

Three types of heliports are considered:

Instrument heliports/ compliant with ICAO Annex 14 Volume II [RD 20] (including its appendix 2). PinS “proceed visually” or “proceed VFR” can be performed on these heliports.

Non-instrument heliports compliant with ICAO Annex 14 Volume II [RD 20]. PinS “proceed visually” or “proceed VFR” can be performed on these heliports.

Landing locations which do not need to be compliant with ICAO Annex 14 Volume II [RD 20]. Only PinS “proceed VFR” can be performed on these landing locations. PinS “proceed VFR” operations do not impose additional requirement on these landing locations compared to existing VFR departure or approach operations.

3.2.2 Route structure

3.2.2.1 Route structure for PinS departure

The route structure for a PinS departure is composed of:

A visual segment designed to connect the heliport or landing location with the initial departure fixed (IDF); and

An instrument segment connecting the Initial Departure Fix with the Low Level Routes (or other existing routes/SID/STAR or without connection with any route structure)

The PinS departure procedure is designed in compliance with ICAO Doc 8168 Vol II [RD 9].

The instrument segment can be RNP1 or RNP0.3.

This current version of the generic safety case does not address PinS departure with Radius to Fix (RF) leg.


Generic Safety Case

The PinS departure procedure is designed to ensure as much as possible strategic separation with other arrivals and departure flows.

3.2.2.2 Route structure for PinS approach

The route structure for a PinS approach is composed of:

An instrument segment from the Initial Approach Fix to the PinS; and

A visual segment from the PinS to the heliport or landing location

An instrument missed approach procedure is also published as part of the PinS route structure in case appropriate visual references are not obtained at the PinS/MAPt.

The PinS approach procedure is designed in compliance with ICAO Doc 8168 Vol II [RD 9].

The instrument segments are RNP APCH. LNAV and LPV minima are considered.

This current version of the generic safety case does not address PinS approach with Radius to Fix (RF) leg.

The PinS approach procedure is designed to ensure as much as possible strategic separation with other arrivals and departure flows.

A PinS approach without connection to FATO is also possible as well as a PinS approach serving multiple destinations. These specific cases are out of scope of the present safety case.

3.2.3 Controlled Airspace

Controlled airspace, when considering PinS operations, is limited to airspace classes C and D.

In such airspace ATS services are provided in accordance with Table 3-1 which is an extract of the SERA regulation[RD 4].

Table 3-1: ATS Airspace classes C & D - Services provided

3.2.4 Uncontrolled Airspace

Uncontrolled airspace is relative to airspace class G.

In such airspace ATS services are provided in accordance with Table 3-2 which is an extract of the SERA regulation[RD 4].


Generic Safety Case

Table 3-2: ATS Airspace classes G- Services provided

3.2.5 Density/complexity of traffic nearby the PinS procedure

Density/complexity of traffic nearby the PinS procedure is managed by the ATC in controlled airspace. It is assumed that any PinS approaches and departures have, as far as practicable, strategic separation with other adjacent routes or procedures.

In uncontrolled airspace, it is assumed that any PinS approaches and departures are designed to avoid, as far as practicable, areas which are already congested by other aviation activities (gliding, parachuting…)

3.2.6 Weather conditions

All kinds of weather conditions should be considered from IMC to VMC including degraded visual environment.

3.2.7 Aircraft eligibility and ATM capabilities in terms of CNS

Helicopters are equipped and certified in accordance with the relevant airworthiness criteria including the associated certification specifications (CS 27, 29) [RD 21] and are operated according to the EASA Air Operations regulation [RD 15].

3.2.7.1 Radiocommunication

In controlled airspace radio communication is mandatory in class C and D.

IFR helicopters must be equipped with radio communication system in uncontrolled airspace class G. For IFR and VFR, continuous two-way air-ground communication is required only inside RMZ as defined in SERA [RD 4] .

3.2.7.2 Surveillance

IFR helicopters are equipped with secondary surveillance radar transponders ([RD 5]).

In uncontrolled airspace class G, all aircraft must be equipped with secondary surveillance radar transponders if flying within TMZ (Transponder Mandatory Zone) as defined in SERA [RD 4] .

3.2.7.3 Navigation

IFR helicopters are equipped with the navigation system able to navigate on the PinS departure or approach procedure (RNP1, RNP0.3 or RNP APCH depending on the procedure) and are equipped also with “conventional” navigation system in accordance with the regulation [RD 22].

3.3 Current operating methods & baseline

Most of the current helicopter onshore operations are conducted in VFR and to/from visual heliports or landing location (compliant or not to ICAO Annex 14 Vol II [RD 20] requirements).

Helicopters are mostly operated for fast and direct transportation: they can fly a direct link with virtually no delay to/from visual heliports or landing locations. However, if weather conditions do not allow VFR flight (VMC not fulfilled), the flight takes on a significantly different route structure in order to fly in IMC by considering the current IFR route structure and instrument departure/approach which are not optimal for helicopter operations and are sometimes not available.


Generic Safety Case

The accessibility of the heliport or landing location is one of the main issues of helicopter operators as it can induce the cancellation of the mission.

IFR helicopter approach and departure procedures can only be designed on an instrument runway or FATO. However few FATO comply with instrument heliport requirements as such requirements are very constraining and expensive for the heliport or landing location operators.

In addition, the IFR approach and departure procedures developed for fixed-wing aircraft are often not adapted to helicopters as they do not offer the direct routing that helicopter operators need.

Helicopter applications (corporate, offshore oil&gas support, search & rescue, Emergency Medical Services (HEMS)) require absolute flexibility supported by point-to-point IFR access to both congested airports and inaccessible locations. This implies, for instance, not only the development of IFR approach and departure procedures for helicopters, but also a net of dedicated routes which are helicopter-tailored, aimed to facilitate increased helicopter operations and to maintain a high safety level in that airspace.

3.4 New operating methods on the PinS operations

New operating methods will allow conducting helicopter operations in IFR on a published PinS approach or departure procedure to/from visual heliports or landing location based on Performance Based Navigation (PBN).

PBN represents a fundamental shift from sensor-based to performance-based navigation and offers a number of advantages over the sensor-specific method of developing airspace and obstacle clearance criteria, i.e. it:

reduces the need to maintain sensor-specific routes and procedures, and their associated costs;

avoids the need for developing sensor-specific operations with each new evolution of navigation systems, which would be cost-prohibitive;

allows for more efficient use of airspace (route placement, fuel efficiency and noise abatement).

Satellite-based instrumental flight procedures are radically changing the way helicopters are operated, improving intermodal transport and both ATM and flight efficiency. The goal is a synchronised and predictable European ATM system, where partners and stakeholders are aware of the business and operational situations and collaborate to optimise the network.

The introduction of RNP will optimise routes structures and automation. Helicopters characteristics/needs and Airspace management needs can be matched by developing PBN based PinS procedures in Medium dense / Medium complexity airspace.

This helicopter operational improvement is expected to bring significant benefits:

Increase safety level

Improve efficiency

Reduce marginal VMC flights

Reduce costs

Increase airspace capacity

Improve access to busy and dense/complexity TMA architecture

Reduce the environmental impact of noise and pollution (i.e.: reduce fuel burn, reduce flight time)

Improve the level of life-critical service

The helicopter operator and the flight crew should respect the operational requirements associated to the PinS approach (RNP APCH) and PinS departure (RNP 1 or RNP 0.3).


Generic Safety Case

4 Overall Safety Assurance Strategy and Safety Argument

4.1 Safety assurance strategy and argument structure

The safety assurance for helicopter departure and approach PinS operations shall cover the full lifecycle:

Definition at service level,

Operational specification and design of the “functional system” supporting PinS helicopter operations (procedures, human resources, equipment at ground and airborne levels and for all relevant domains),

Implementation,

Transfer into operation and

Operation including safety monitoring.

The following operating modes/conditions are addressed in this safety assessment:

Normal operating conditions

Degraded modes (associated to abnormal and failure conditions).

The safety assurance strategy to demonstrate that helicopter operations on departures and approaches are acceptably safe has been defined based on the following inputs:

Safety criteria have been defined for such operations,

All actors (service providers and operators) from each domain have been identified,

All lifecycle stages are addressed from the definition to the operation,

Safety requirements for all responsible actors have been allocated to support compliance with safety criteria,

Safety requirements for all responsible actors have been satisfied during the implementation phase,

The transition from current operations to PinS operations is addressed from a safety point of view,

The safety performance of helicopter departure and approach PinS operations is monitored during the service life.

This generic safety case is proposed to be organized as a reasoned and structured safety argument substantiated by the supporting safety evidence.

The safety assurance strategy is outlined through the safety argument, break down in sub-arguments driven by the system lifecycle phases.

The safety argument is presented in the next sub-sections of the current chapter using the GSN (Goal-Structuring Notation, which provides a graphical means of setting out hierarchical safety arguments, with textural annotations and references to supporting evidence).

The summary of the safety evidences is listed in the lower part of the argument figures (blue shaded text).

The detail of the safety evidence (content, justification, how it has been produced, and traceability to references or data sources) is provided in the remaining chapters of this report.


Generic Safety Case

4.2 Arg 0- Overall safety argument- top level

The top level (Arg 0) of the overall safety argument for why helicopter PinS operations are considered safe is set out in Figure 4-1.

The arguments follow the main lifecycle phases of the project from the definition at operational service level to the operations throughout service life. For each of these phases evidence needs to be generated demonstrating that the selected high-level safety criteria (Cr01) are met within the defined context (C01) and considering Justification (J0001).

Figure 4-1: Top level safety Argument


Generic Safety Case

4.3 Arg 1- Definition of helicopter PinS operations at service level to be acceptably safe

4.4 Arg 2- Helicopter PinS operations have been specified and designed to be acceptably safe

Arg 2.1GNSS & EGNOS & RAIM

are designed to deliver the required navigation

performance on the PinS

procedures

Cr002Acceptably safe is defined by

the Safety Objectives derived

under Argument 1.2

Arg 2.2Criteria for the design of the PinS

procedure are specified to ensure safe operations

Arg 2.3PinS departure and

approach chart/publication are

designed to ensure

safe PinS operations

§6 Safety assessment at design level

Arg 2 Helicopter PinS

operations will be

designed to be

acceptably safe

Arg 2.5MET information are

designed to ensure safe PinS operations

Arg 2.6ATS provides ATC or FIS

service in accordance with the class of airspace

considering the traffic on

PinS procedure

Arg 2.8Helicopter

operations and flight crew training are

designed to ensure

safe PinS operations

Arg 2.7Airborne equipment and helicopter

installation criteria are designed for safe PinS operations

Arg 2.4Heliport or

landing area are designed to

ensure safe PinS

operations


Generic Safety Case

4.5 Arg 3- Helicopter PinS operations are implemented to meet the Safety Requirements


Generic Safety Case

4.6 Arg 4- Transfer into operations of helicopter PinS operations is acceptably safe


Generic Safety Case

4.7 Arg 5- Helicopter PinS operations remain acceptably safe during operational service


Generic Safety Case

5 Safety Assessment at operational service level

5.1 Safety Impact and Criteria

This section identifies the safety impact of the PinS operations and defines the associated Safety Criteria. Different impact and criteria are respectively defined for PinS departure operations (see section 5.1.1) and PinS approach operations (see section 5.1.2).

5.1.1 Safety Impact and Criteria for PinS departure operations

5.1.1.1 Relevant ATM/ANS “pre-existing” hazards

The following table identifies the list of pre-existing aviation hazards relevant for helicopter PinS departure operations:

Pre-existing Aviation Hazards [Hp] ATM-related accident type & Risk model

Hp#1 A situation in which the intended trajectories of two or more aircraft are in conflict

Mid-Air Collision (MAC). See A.2 for more details.

Hp#2 A situation where the intended trajectory of an aircraft is in conflict with terrain or an obstacle

Controlled Flight Into Terrain (CFIT) model. See A.2 for more details.

Hp#3 Encounters with adverse weather Loss of Control (LOC) or CFIT -No Risk model for LOC

Hp#4 Penetration of restricted airspace No Risk model

5.1.1.2 Safety impact analysis

This section presents an understanding of the safety impact of helicopter departures on the pre-existing hazard, in view of the establishment of the Safety Criteria.

An analysis of the potential safety implications of these helicopter operations PinS departures is undertaken for each of the accident risks identified as relevant at Section 5.1.1.1.

5.1.1.2.1 Impact on MAC risk

5.1.1.2.1.1 MAC risk in controlled airspace

The risk of Mid-Air Collision for IFR flights in airspace classes C or D shall remain the same when PinS departure operations are implemented, compared to current operations conducted in VFR, since:

The design of the departure PinS procedure includes strategic separation between PinS departures and other departures/arrivals/routes, as far as possible. If strategic separation cannot be provided, dedicated mitigation means relying on ATC shall be put in place to maintain separation between aircraft flying on these different procedures.

The design of the PinS procedure can include strategic separation with restricted areas. If there is no strategic separation, the separation with restricted airspace is managed tactically by ATC.

Rules of the air are applied, more particularly:

o The risk of Mid-Air Collision between helicopters operating on the instrument segment of the PinS departure is mitigated by the ATC.


Generic Safety Case

o The risk of Mid-Air Collision between helicopters operating on the instrument segment of the PinS departure and other IFR aircraft flying in the vicinity of the PinS departure procedure is mitigated by ATC. This separation is facilitated by the strategic separation of routes and procedures.

o The risk of Mid-Air Collision between helicopters operating on the instrument segment of the PinS departure and VFR aircraft flying in the vicinity of the PinS departure procedure is mitigated by ATC as far as feasible (traffic information about VFR flights provided as far as possible) and by pilots (see and avoid principle).

o The risk of Mid-Air Collision between helicopters operating on the visual segment of the PinS departure is mitigated by the ATC (control service or traffic information depending on airspace class and flight rules applicable to the PinS visual segment).

o The risk of Mid-Air Collision between helicopters operating on the visual segment of the PinS departure and other IFR/VFR aircraft flying in the vicinity of the PinS departure procedure is mitigated by ATC as far as feasible (traffic information about VFR flights provided as far as possible) and by pilots (see and avoid principle).

It should be noted that for the helicopter operations conducted in IFR thanks to PinS, there is a safety improvement compared to the operations conducted previously in VFR. Indeed separation with other IFR aircraft is provided by ATC and not by relying on the see and avoid principle. However, this benefit is compensated by a possible increase of traffic induced by implementation of PinS.

5.1.1.2.1.2 MAC risk in uncontrolled airspace

The risk of Mid-Air Collision for IFR flights in airspace class G shall remain the same, when PinS departure operations are implemented, compared to current operations conducted in VFR, since:

The design of the departure PinS procedure includes strategic separation between the PinS departure and other departures/arrivals/routes, as far as possible

The design of the PinS procedure includes strategic separation with restricted areas.


o The risk of Mid-Air Collision between helicopters operating on the PinS departure should be mitigated by pilots, helicopter operators or heliport / landing location operator.

o The risk of Mid-Air Collision between helicopters operating on the PinS departure and other IFR or VFR aircraft flying in the vicinity of the PinS departure procedure should be mitigated by pilots, helicopter operators or heliport / landing location operator.

From [RD 16], an aircraft is around 400 times more likely to be involved in a MAC incident (NMAC) outside controlled airspace than inside it. Safety records for general aviation have not significantly improved in the last decade. MAC/NMAC is not in the top-5 causes of fatal GA accidents but Visual Flight Rules safety barriers are weak by design. A portion of the general aviation community has invested in voluntary equipment of low-cost electronic conspicuity devices to enhance the fragile “see and avoid” safety barrier.

5.1.1.2.2 Impact on CFIT risk

The risk of CFIT shall be reduced, when PinS departure operations are implemented, compared to current operations conducted in VFR, since:

The instrument segment of the PinS departure is designed to prevent loss of separation with terrain/obstacle.

The visual segment of the PinS departure “proceed visually” procedure is protected by specific obstacle protection and identification surfaces and relevant obstacles are published on charts.

The compatibility between the climb gradient and the helicopter speed/autopilot capabilities is considered during the design of the procedure.


Generic Safety Case

There is no risk of inadvertent entry into IMC for the instrument phase of the departure, which is an important cause of CFIT accidents for certain helicopter operations in VFR. The risk of entry into IMC is still applicable for the visual phase of the departure but with a shorter exposure time.

The use of remote QNH could impact the CFIT risk and have to be mitigated.

Note: Several accident precursors to CFIT exist and one is called “Controlled Flight Towards Terrain” as illustrated in A.2. This accident precursor should not be confused with “Controlled Flight Into Terrain” which is the accident

5.1.1.2.3 Impact on Loss of Control- Inflight Risk

The risk of LOC-I shall be reduced, when PinS departure operations are implemented, compared to current operations conducted in VFR, since there is no risk of inadvertent entry into IMC for the instrument phase of the departure, which is an important cause of loss of control for helicopter operations in VFR. The risk of entry into IMC leading to loss of control is still applicable for the visual flight phase of the departure but with a shorter exposure time.

However, the risk of severe weather encounter when a helicopter is flying the departure procedure, which could lead to loss of control, needs to be mitigated:

The flight crew should have relevant MET information available before the flight.

5.1.1.3 Safety Criteria (SAC)

Considering the above assessed potential safety impact of helicopter PinS departure operations, this sub-section defines the set of Safety Criteria (SAC).

Safety Criteria (SAC) define the acceptable level of safety (i.e. accident and incident risk level) to be achieved by the Concept of Operations under assessment.

5.1.1.3.1 In controlled airspace

SAC-DEP_MAC_CTRL#1: The number of strategic conflicts between IFR flights shall not increase in controlled airspace with the introduction of PinS departure operations.

SAC-DEP_MAC_CTRL#2: The number of imminent collisions between IFR and VFR flights shall not increase in controlled airspace with the introduction of PinS departure operations.

SAC-DEP_MAC_CTRL#3: The number of tactical conflicts between IFR flights shall not increase in controlled airspace with the introduction of PinS departure operations.

5.1.1.3.2 In uncontrolled airspace

SAC-DEP_MAC_UNCTRL#1: The number of strategic conflicts between IFR flights shall not increase in uncontrolled airspace with the introduction of PinS departure operations.

SAC-DEP_MAC_UNCTRL#2: The number of imminent collisions between IFR and VFR flights shall not increase in uncontrolled airspace with the introduction of PinS departure operations.

SAC-DEP_MAC_UNCTRL#3: The number of imminent collisions between IFR flights shall not increase in uncontrolled airspace with the introduction of PinS departure operations.


Generic Safety Case

5.1.1.3.3 In controlled and uncontrolled airspace

SAC-PinS_CFIT: The number of Controlled Flight Towards Terrain shall be reduced with the introduction of PinS departure operations compared to current VFR helicopter operations.

SAC-PinS_LOC-I: The number of Loss of Control-Inflight events shall not increase with the introduction of PinS departure operations compared to current VFR helicopter operations.

5.1.2 Safety Impact and Criteria for PinS approach operations

5.1.2.1 Relevant ATM/ANS “pre-existing” hazards

The following table identifies the list of pre-existing aviation hazards relevant for helicopter PinS approach operations:

Pre-existing Aviation Hazards [Hp] ATM-related accident type & Risk model

Hp#1 A situation in which the intended trajectories of two or more aircraft are in conflict

Mid-Air Collision (MAC)

Hp#2 A situation where the intended trajectory of an aircraft is in conflict with terrain or an obstacle

Controlled Flight Into Terrain (CFIT) model

Hp#3 Encounters with adverse weather Loss of Control (LOC) or CFIT - No risk model available for LOC

Hp#4 Penetration of restricted airspace No risk model available for restricted airspace infringement

Hp#5 Situation where the helicopter lands outside of the FATO

Landing Accident

5.1.2.2 Safety impact analysis

This section presents an understanding of the safety impact of helicopter PinS approach operations on the pre-existing hazards, in view of the establishment of the Safety Criteria.

An analysis of the potential safety implications of these helicopter PinS approach operations is undertaken for each of the accident risks identified as relevant at Section 5.1.2.1.

5.1.2.2.1 Impact on MAC risk

5.1.2.2.1.1 MAC risk in controlled airspace

The risk of Mid-Air Collision for IFR flights in airspace classes C or D shall remain the same, when PinS approach operations are implemented, since:

The design of the approach PinS procedure includes strategic separation between PinS approach and other departures/arrivals/routes, as far as possible. If strategic separation cannot be provided, dedicated mitigation means relying on ATC shall be put in place to maintain separation between aircraft flying on these different procedures.


Generic Safety Case

The design of the PinS procedure can include strategic separation with restricted areas. If there is no strategic separation, the separation with restricted airspace is managed tactically by ATC.


o The risk of Mid-Air Collision between helicopters operating on the instrument segment of the PinS approach is mitigated by the ATC.

o The risk of Mid-Air Collision between helicopters operating on the instrument segment of the PinS approach and other IFR aircraft flying in the vicinity of the PinS approach procedure is mitigated by ATC. This separation is facilitated by the strategic separation of routes and procedures.

o The risk of Mid-Air Collision between helicopters operating on the instrument segment of the PinS approach and VFR aircraft flying in the vicinity of the PinS approach procedure is mitigated by ATC as far as feasible (traffic information about VFR flights provided as far as possible) and by pilots (See and Avoid principle).

o The risk of Mid-Air Collision between helicopters operating on the visual segment of the PinS approach is mitigated by the ATC (control service or traffic information depending on airspace class and flight rules applicable to the PinS visual segment).

o The risk of Mid-Air Collision between helicopters operating on the visual segment of the PinS approach and other IFR/VFR aircraft flying in the vicinity of the PinS approach procedure is mitigated by ATC as far as feasible (traffic information about VFR flights provided as far as possible) and by pilots (See and Avoid principle).

It should be noted that for the helicopter operations conducted in IFR thanks to PinS, there is an improvement compared to the operations conducted previously in VFR. Indeed separation with other IFR aircraft is provided by ATC and not by relying on the See and Avoid principle. However, this benefit is compensated by a possible increase of traffic induced by the implementation of PinS.

5.1.2.2.1.2 MAC risk in uncontrolled airspace

The risk of Mid Air Collision for IFR flights in airspace class G shall remain the same, compared to current operations conducted in VFR, since:

The design of the PinS approach procedure includes strategic separation between PinS approach and other departures/arrivals/routes, as far as possible

The design of the PinS procedure includes strategic separation with restricted areas.


o The risk of Mid-Air Collision between helicopters operating on the PinS approach should be mitigated by pilots, helicopter operators or heliport / landing location operator.

o The risk of Mid-Air Collision between helicopters operating on the PinS approach and other IFR or VFR aircraft flying in the vicinity of the PinS approach procedure should be mitigated by pilots, helicopter operators or heliport / landing location operator.

From [RD 16], an aircraft is around 400 times more likely to be involved in a MAC incident (NMAC) outside controlled airspace than inside it. Safety records for general aviation have not significantly improved in the last decade. MAC/NMAC is not in the top-5 causes of fatal GA accidents but Visual Flight Rules safety barriers are weak by design. A portion of the general aviation community has invested in voluntary equipment of low cost electronic conspicuity devices to enhance the fragile “see and avoid” safety barrier.


Generic Safety Case

5.1.2.2.2 Impact on CFIT risk

The risk of CFIT shall be reduced, when PinS approach operations are implemented, compared to current operations conducted in VFR, since:

The instrument segment of the PinS approach is designed to prevent loss of separation with terrain/obstacle.

The visual segment of the PinS “proceed visually” procedure is protected by specific obstacle protection and identification surfaces and relevant obstacles are published on charts.

The compatibility between the descent gradient and the helicopter speed/autopilot capabilities is considered during the design of the procedure. MAPt location and approach visual segments are designed to facilitate acquisition, deceleration and landing.

There is no risk of inadvertent entry into IMC for the instrument phase of the approach, which is an important cause of CFIT accidents for certain helicopter operations in VFR. The risk of entry into IMC is still applicable for the visual phase of the approach but with a shorter exposure time.

The use of remote QNH could impact the CFIT risk and would have to be mitigated.

5.1.2.2.3 Impact on Loss of Control - Inflight Risk

The risk of LOC-I shall be reduced, when PinS approach operations are implemented, compared to current operations conducted in VFR, since there is no risk of inadvertent entry into IMC for the instrument phase of the approach, which is an important cause of Loss of Control for helicopter operations in VFR. The risk of entry into IMC leading to Loss of Control is still applicable for the visual phase of the approach but with a shorter exposure time.

However, the risk of severe weather encounter when a helicopter is flying the approach procedure, which could lead to loss of control, needs to be mitigated:

The flight crew should have relevant MET information available before the flight.

In order to prepare the landing, MET information at destination/PinS should be confirmed during the approach.

5.1.2.2.4 Impact on Landing Accident risk

The risk of a Landing Accident shall be reduced, when PinS approach operations are implemented, compared to current operations conducted in VFR since:

With a PinS approach procedure, pilots are always flying the same procedure, with the same descent gradient, always in the same direction with an assessment of the obstacles for the instrument flight phase. This contributes to reduce human error during the instrument flight phase. The risk of unstable approach is still applicable for the visual phase of the approach but with a shorter exposure time.

The compatibility between the descent gradient and the helicopter speed/autopilot capabilities is considered during the design of the procedure.

5.1.2.3 Safety Criteria (SAC)

Considering the above assessed potential safety impact of helicopter PinS approach operations, this sub-section defines the set of Safety Criteria (SAC).

Safety Criteria (SAC) define the acceptable level of safety (i.e. accident and incident risk level) to be achieved by the Concept of Operations under assessment.

5.1.2.3.1 In controlled airspace

SAC-APR_MAC_CTRL#1: The number of strategic conflicts between IFR flights shall not increase in controlled airspace with the introduction of PinS approach operations.


Generic Safety Case

SAC-APR_MAC_CTRL#2: The number of tactical conflicts between IFR flights shall not increase in controlled airspace with the introduction of PinS approach operations.

SAC-APR_MAC_CTRL#3: The number of imminent collisions between IFR/VFR flights depending on the kind of visual segment and VFR flights shall not increase in controlled airspace with the introduction of PinS approach operations.

5.1.2.3.2 In uncontrolled airspace

SAC-APR_MAC_UNCTRL#1: The number of strategic conflicts between IFR flights shall not increase in uncontrolled airspace with the introduction of PinS approach operations.

SAC-APR_MAC_UNCTRL#2: The number of imminent collisions between IFR flights shall not increase in uncontrolled airspace with the introduction of PinS approach operations.

SAC-APR_MAC_UNCTRL#3: The number of imminent collisions between IFR and VFR flights shall not increase in uncontrolled airspace with the introduction of PinS approach operations .

5.1.2.3.3 In controlled and uncontrolled airspaces

SAC-APR_CFIT: The number of Controlled Flight Towards Terrain shall be reduced with the introduction of PinS approach operations compared to current VFR helicopter approach operations.

SAC-APR_LOC-I: The number of Loss of Control-Inflight events shall not increase with the introduction of PinS approach operations compared to current VFR helicopter approach operations.

SAC-APR_LA: The number of Landing Accidents shall be reduced with the introduction of PinS approach operations compared to current VFR helicopter approach operations.

5.2 Safety Objectives in Normal operations

This section defines the Safety Objectives in normal PinS operations. Different Safety Objectives are defined for PinS departure operations (see section 5.2.1) and PinS approach operations (see section 5.2.2).

5.2.1 Safety Objective in Normal operations for PinS departure

5.2.1.1 Controlled airspace

The ATM/ANS services relevant for helicopter PinS departure operations are listed in the following table

Relevant ATM/ANS Services

Establish adequate spacing between departure and approach routes

Establish and maintain separation between aircraft during the visual flight phase of the PinS departure


Generic Safety Case

Separate aircraft from terrain/obstacles on the visual flight phase of the PinS departure

Facilitate transition from visual flight phase to instrument flight phase of the PinS Departure

Separate aircraft from terrain/obstacles on the instrument flight phase of the PinS departure

Establish and maintain separation between aircraft during the instrument flight phase of the PinS departure

Facilitate transition from the PinS departure to the low level enroute network, if applicable

Inform A/C about other traffic

Prevent helicopters from penetrating prohibited/restricted areas

Relevant Supporting services (AIS, MET, CNS…)

Provide communication service to A/C and ATC

Provide navigation service to A/C

Provide surveillance service to ATC

Provide MET information to helicopter and ATC

The following safety objectives (Table 5-1) are formulated in order for PinS helicopter departure operations to meet the SAC in normal operating conditions (fault-free conditions). The safety objectives focus on the change involved by operations on the PinS.

ANS service Achieved by/ Success Case Safety Objective8 Ref. SAC


SO_DEP_CTRL#1. Spacing between departure procedures and between approach and departure procedure shall be determined considering navigation performance, separation minima, traffic density, sector size andcontroller procedures / HMI

SAC-DEP_MAC_CTRL#1

Establish and maintain separation between aircraft during the visual flight phase of the PinS departure

SO_DEP_CTRL#2. ATC shall separate traffic during the visual segment of the PinS departure for “proceed visually” operation

SO_DEP_CTRL#3. ATC shall maintain separation between A/C during the visual segment of the PinS departure for “proceed visually” operation

SO_DEP_CTRL#4. ATC shall provide traffic information to A/C during the visual segment of the PinS departure for “proceed VFR” operation

SO_DEP_CTRL#5. Each pilot shall maintain separation with other A/C during the visual segment of the PinS departure for “proceed VFR” operation

SAC-APR_MAC_CTRL#2


SO_DEP_CTRL#6. The visual segment of the PinS “proceed visually” departure procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles

SO_DEP_CTRL#7. Helicopters shall respect lateral and vertical constraints, if applicable, of the visual segment of the PinS “proceed visually” departure procedure

SO_DEP_CTRL#8. Pilots shall see and avoid the obstacles during visual segment of the PinS departure procedure

SAC-DEP_CFIT

8 Success case Safety Objectives are high-level safety requirements defined at the operational level


Generic Safety Case



SO_DEP_CTRL#9. The PinS departure shall be designed and promulgated to facilitate the transition between the visual flight phase to the instrument flight phase.

SO_DEP_CTRL#10. Helicopters shall perform transition between visual flight phase and instrument flight phase, if visual references are maintained until reaching the IDF at or above the IDF MCA.

SO_DEP_CTRL#11. Helicopters shall abort and return to heliport or landing location if visual references are no longer maintained until reaching the IDF at or above the MCA IDF during PinS departure procedure.

SAC-DEP_MAC_CTRL#2

SAC-DEP_CFIT


SO_DEP_CTRL#12. The instrument segments of the PinS departure procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacle.s

SO_DEP_CTRL#13. Helicopters shall respect the lateral path of the instrument segments of the PinS departure procedure.

SO_DEP_CTRL#14. Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS departure procedure including compensation for low temperature.

SAC-DEP_CFIT

Establish and maintain separation between aircraft during the instrument flight phase on the PinS departure

SO_DEP_CTRL#15. Helicopter operators shall submit a flight plan or equivalent information to ATC.

SO_DEP_CTRL#16. ATC shall separate traffic during the instrument flight phase of the PinS departure.

SO_DEP_CTRL#17. ATC shall maintain separation between A/C during the instrument flight phase of the PinS departure.

SAC-DEP_MAC_CTRL#2

Facilitate transition from PinS Departure to low level Enroute Network

SO_DEP_CTRL#18. The instrument segment of the PinS departure shall be designed and promulgated to facilitate the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable.

SO_DEP_CTRL#19. Helicopters shall perform the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable

SAC-DEP_MAC_CTRL#2

SAC-APR_CFIT


SO_DEP_CTRL#20. ATS shall inform helicopters conducting the PinS departure about other known traffic

SAC-DEP_MAC_CTRL#3

Prevent aircraft to penetrate prohibited/restricted areas

SO_DEP_CTRL#21. The PinS departure procedure shall be designed and promulgated to ensure separation from the prohibited airspace / restricted areas in the vicinity of the heliport/landing location.

SO_DEP_CTRL#22. If the PinS departure is not strategically separated from prohibited/restricted areas, ATC shall ensure separation between helicopters on the PinS departure and prohibited/restricted areas.

SO_DEP_CTRL#23. Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS departure.

SAC-DEP_MAC_CTRL#1

SAC-DEP_MAC_CTRL#2

SAC-DEP_MAC_CTRL#3


Generic Safety Case


Provide MET information

SO_DEP_CTRL#24. Helicopters shall be informed of the local MET conditions

SAC-DEP_LOC-I SAC-DEP_CFIT

Table 5-1. Safety Objectives in controlled airspace-Normal operations

5.2.1.2 Uncontrolled airspace

The Services relevant for helicopter PinS departure operations are listed in the following table

Relevant Services


Establish and maintain spacing between aircraft during the visual or instrument flight phase of the PinS departure






Prevent aircraft from penetrating prohibited/restricted areas


Provide communication service to A/C


Provide MET information to helicopters

The following safety objectives (Table 5-2) are formulated in order for PinS helicopter departure operations to meet the SAC in normal operating conditions (fault-free conditions). The safety objectives focus on the change involved by operations on the PinS.


Establish adequate spacing between arrival and departing routes

SO_DEP_UNCTRL#1. Spacing between departure procedures and between approach and departure procedure shall be determined considering navigation performance and traffic density.

SAC-DEP_MAC_UNCTRL#1

Establish and maintain spacing between aircraft during the visual or instrument flight phase of the PinS departure

SO_DEP_UNCTRL#2. Operational use of the PinS departure shall be coordinated between involved entities. SO_DEP_UNCTRL#3. Each pilot shall maintain visual separation with other A/C, in VMC conditions, during the visual and instrument flight phase (in VMC condition) of the PinS departure.

SAC-APR_MAC_ UNCTRL #2



Generic Safety Case



SO_DEP_UNCTRL#4. The visual segment of the PinS “proceed visually” departure procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles SO_DEP_UNCTRL#5. Helicopters shall respect lateral and vertical constraints if applicable of the visual segment of the PinS “proceed visually” departure procedure SO_DEP_UNCTRL#6. Pilots shall see and avoid the obstacles during visual segment of the PinS departure procedure

SAC-DEP_CFIT

Facilitate transition from departing visual segment to PinS Departure

SO_DEP_UNCTRL#7. The PinS departure shall be designed and promulgated to facilitate the transition between the visual flight phase to the instrument flight phase. SO_DEP_UNCTRL#8. Helicopters shall perform transition between visual flight phase and instrument flight phase, if visual references are maintained until reaching the IDF at or above the IDF MCA. SO_DEP_UNCTRL#9. Helicopters shall abort and return to heliport or landing location if visual references are no longer maintained until reaching the IDF at or above the MCA IDF.

SAC-DEP_MAC_ UNCTRL #2

SAC-DEP_CFIT


SO_DEP_UNCTRL#10. The instrument segments of the PinS departure procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles. SO_DEP_UNCTRL#11. Helicopters shall respect the lateral path of the instrument segments of the PinS departure procedure. SO_DEP_UNCTRL#12. Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS departure procedure including compensation for low temperature.

SAC-DEP_CFIT


SO_DEP_UNCTRL#13. The instrument segment of the PinS departure shall be designed and promulgated to facilitate the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable. SO_DEP_UNCTRL#14. Helicopters shall perform the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable.


SAC-DEP_CFIT


SO_DEP_UNCTRL#15. Helicopters shall inform other A/C about their position and flight intent.


Prevent aircraft to penetrate prohibited/restricted areas

SO_DEP_UNCTRL#16. The PinS departure procedure shall be designed and promulgated to ensure separation from the prohibited airspace/restricted areas in the vicinity of the heliport/landing location. SO_DEP_UNCTRL#17. Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS departure.





Generic Safety Case



SO_DEP_UNCTRL#18. Helicopters shall be informed of the local MET conditions.

SAC-DEP_LOC-I SAC-DEP_CFIT

Table 5-2. Safety Objectives in uncontrolled airspace - Normal operations

5.2.2 Safety Objective in Normal operations for PinS approach

5.2.2.1 Controlled airspace

The ATM/ANS services relevant for helicopter PinS approach operations are listed in the following table:

Relevant ATM/ANS Services

Establish adequate spacing between approach and departing routes

Facilitate transition from the low level en-route network to the PinS approach, if applicable

Separate aircraft from terrain/obstacles on the instrument flight phase of the PinS approach

Establish and maintain separation between aircraft during the instrument flight phase of the PinS approach

Facilitate transition from instrument flight phase to visual flight phase of the PinS approach

Separate aircraft from terrain/obstacles on the visual flight phase of the PinS approach

Establish and maintain separation between aircraft during the visual flight phase of the PinS approach

Facilitate deceleration and landing




Provide communication service to A/C and ATC


Provide surveillance service to ATC

Provide MET information to helicopters and ATC

The following safety objectives (Table 5-3) are formulated in order for PinS helicopter approach operations to meet the SAC in normal operating conditions (fault-free conditions). The safety objectives focus on the change involved by operations on the PinS.

ATM/ANS

services

Achieved by/ Success Case Safety Objective10 Ref. SAC


SO_APR_CTRL#1. Spacing between approach procedures and between approach and departure procedure shall be determined considering navigation performance, separation minima, traffic density, sector size and controller procedures / HMI.

SAC-APR_MAC_CTRL#1

Facilitate transition from the low level en-route network to

SO_APR_CTRL#2. The instrument segment of the PinS approach shall be designed and promulgated to facilitate the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach.

SAC-APR_MAC_CTRL#2



Generic Safety Case

ATM/ANS

services


the PinS approach, if applicable

SO_APR_CTRL#3. Helicopters shall perform the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach.


SO_APR_CTRL#4. The instrument segments of the PinS approach procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles. SO_APR_CTRL#5. Helicopters shall respect the lateral path of the instrument segments of the PinS approach procedure. SO_APR_CTRL#6. Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS approach procedure including compensation for low temperature.

SAC-APR_CFIT

Establish and maintain separation between aircraft during the instrument flight phase of the PinS approach

SO_APR_CTRL#7. Helicopter operators shall submit a flight plan or equivalent information to ATC. SO_APR_CTRL#8. ATC shall separate traffic during the instrument flight phase of the PinS approach. SO_APR_CTRL#9. ATC shall maintain separation between A/C during the instrument flight phase of the PinS approach.

SAC-APR_MAC_CTRL#2


SO_APR_CTRL#10. The PinS approach shall be designed and promulgated to facilitate the transition between the instrument flight phase to visual flight phase. SO_APR_CTRL#11. An instrument missed approach shall be designed and promulgated to support situations where visual references are not obtained at the PinS. SO_APR_CTRL#12. Helicopters shall perform transition between instrument flight phase and visual flight phase, if visual references are obtained at or prior the MAPt. SO_APR_CTRL#13. Helicopters shall execute the published missed approach if visual references are not obtained at or prior the PinS.

SAC-APR_MAC_CTRL#2

SAC-APR_CFIT


SO_APR_CTRL#14. The visual segment of the PinS “proceed visually” approach procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles. SO_APR_CTRL#15. Helicopters shall respect lateral and vertical constraints if applicable of the visual segment of the PinS “proceed visually” approach procedure. SO_APR_CTRL#16. Pilots shall see and avoid the obstacles during visual segment of the PinS approach procedure.

SAC-APR_CFIT

Establish and maintain separation between aircraft during the visual flight phase of the PinS approach

SO_APR_CTRL#17. ATC shall separate traffic during the visual segment of the PinS approach for “proceed visually” operation. SO_APR_CTRL#18. ATC shall maintain separation between A/C during the visual segment of the PinS approach for “proceed visually” operation. SO_APR_CTRL#19. ATC shall provide traffic information to A/C during the visual segment of the PinS approach for “proceed VFR” operation.

SAC-APR_MAC_CTRL#2


Generic Safety Case

ATM/ANS

services


SO_APR_CTRL#20. Each pilot shall maintain separation with other A/C during the visual segment of the PinS approach for “proceed VFR” operation.


SO_APR_CTRL#21. The instrument and visual segments of the PinS approach shall be designed to facilitate deceleration and landing.

SAC-APR_LA


SO_APR_CTRL#22. ATS shall inform helicopters conducting the PinS approach about other known traffic

SAC-APR_MAC_CTRL#3

Prevent helicopter to penetrate prohibited/restricted areas

SO_APR_CTRL#23. The PinS approach procedure shall be designed and promulgated to ensure separation from the prohibited airspace/restricted areas in the vicinity of the heliport/landing location. SO_APR_CTRL#24. If the PinS approach is not strategically separated from prohibited/restricted areas, ATC shall ensure separation between helicopters on the PinS approach and prohibited/restricted areas. SO_APR_CTRL#25. Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS approach.

SAC-APR_MAC_CTRL#1 SAC-APR_MAC_CTRL#2 SAC-APR_MAC_CTRL#3


SO_APR_CTRL#26. Helicopters shall be informed of the forecasted MET conditions at destination heliport/landing location. SO_APR_CTRL#27. Helicopters shall be informed of the forecasted MET conditions at alternate heliport if required.

SAC-APR_CFIT SAC-APR_LOC-I

Table 5-3. Safety Objectives in controlled airspace - Normal PinS approach operations

5.2.2.2 Uncontrolled airspace

The Services relevant for helicopter PinS approach operations are listed in the following table

Services






Establish and maintain spacing between aircraft during the instrument and visual flight phase of the PinS approach




Relevant Supporting services (AIS, MET, CNS,…)

Provide Communication service to A/C

Provide Navigation service to A/C

Provide MET information to helicopters

The following safety objectives (Table 5-4) are formulated in order for PinS helicopter operations to meet the SAC in normal operating conditions (fault-free conditions). The safety objectives focus on the change involved by operations on the PinS.


Generic Safety Case

ATM/ANS

services



SO_APR_UNCTRL#1. Spacing between approach procedures and between approach and departure procedures shall be determined considering navigation performance and traffic density.

SAC-APR_MAC_UNCTRL#1


SO_APR_UNCTRL#2. The instrument segment of the PinS approach shall be designed and promulgated to facilitate the transition between the low level route and the PinS approach SO_APR_UNCTRL#3. Helicopters shall perform the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach.


Separate aircraft from terrain/obstacles on the instrument segment of the PinS approach

SO_APR_UNCTRL#4. The instrument segments of the PinS approach procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles. SO_APR_UNCTRL#5. Helicopters shall respect the lateral path of the instrument segments of the PinS approach procedure. SO_APR_UNCTRL#6. Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS approach procedure including compensation for low temperature.

SAC-APR_CFIT

Facilitate transition from instrument segment to visual segment of the PinS approach

SO_APR_UNCTRL#7. The PinS approach shall be designed and promulgated to facilitate the transition between the instrument flight phase to visual flight phase. SO_APR_UNCTRL#8. Helicopters shall perform transition between instrument flight phase and visual flight phase, if visibility requirements are obtained at or prior the MAPt. SO_APR_UNCTRL#9. Helicopters shall execute the published missed approach if visibility requirements are not obtained at or prior the PinS.

SAC-APR_MAC_UNCTRL#2 SAC-APR_CFIT

Separate aircraft from terrain/obstacles on the visual segment of the PinS approach

SO_APR_UNCTRL#10. The visual segment of the PinS “proceed visually” approach procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles. SO_APR_UNCTRL#11. Helicopters shall respect lateral and vertical constraints if applicable of the visual segment of the PinS “proceed visually” approach procedure SO_APR_UNCTRL#12. Pilots shall see and avoid the obstacles during visual segment of the PinS approach procedure.

SAC-APR_CFIT

Establish and maintain spacing between during the instrument and visual flight phase of the PinS approach

SO_APR_UNCTRL#13. Operational use of the PinS Approach shall be coordinated between involved entities. SO_APR_UNCTRL#14. Each pilot shall maintain visual separation with other A/C, in VMC conditions, during the instrument and visual flight phase of the PinS approach.



SO_APR_UNCTRL#15. The instrument and visual segments of the PinS approach shall be designed to facilitate deceleration and landing.

SAC-APR_LA



Generic Safety Case

ATM/ANS

services



SO_APR_UNCTRL#16. Helicopters shall inform other A/C about their position and flight intent


Prevent helicopters to penetrate prohibited/restricted areas

SO_APR_UNCTRL#17. The PinS approach procedure shall be designed and promulgated to ensure separation from the prohibited airspace/restricted areas in the vicinity of the heliport/landing location. SO_APR_UNCTRL#18. Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS approach.

SAC-APR_MAC_UNCTRL#1 SAC-APR_MAC_UNCTRL#2 SAC-APR_MAC_UNCTRL#3


SO_APR_UNCTRL#19. Helicopters shall be informed of the forecasted MET conditions at destination heliport/landing location. SO_APR_UNCTRL#20. Helicopters shall be informed of the forecasted MET conditions at alternate heliport if required.

SAC-APR_CFIT SAC-APR_LOC-I

Table 5-4. Safety Objectives in uncontrolled airspace - Normal PinS approach operations

5.3 Safety Objectives in Abnormal operations

The purpose of this section is to assess the ability of PinS helicopter operations to work through (robustness), or at least recover from (resilience), any abnormal conditions that might be encountered relatively infrequently (these might be conditions external to the scope of the PinS implementation and therefore not under control).

This section defines the Safety Objectives in normal PinS operations. Different Safety Objectives are defined for PinS departure operations (see section 5.3.1) and PinS approach operations (see section 5.3.2).

5.3.1 Safety Objective in Abnormal operations for PinS departure

5.3.1.1 Abnormal scenarios

The following abnormal conditions have been identified from a generic point of view:

ID Abnormal Scenario

1 Loss of GNSS/SBAS signal or degradation of GNSS/SBAS signal performance

2 Loss of communication

3 Icing conditions

4 Degradation of visibility conditions / inadvertent IMC

5 Thunderstorms

In the following paragraphs, each abnormal scenario is assessed for potential risk and mitigations are derived where necessary in the form of Safety Objectives that are further consolidated under the following sub-sections.


Generic Safety Case

1. Loss of GNSS/SBAS signal or degradation of GNSS/SBAS signal performance

Different mitigations could be defined when such abnormal conditions are encountered, such as conventional navigation, dead reckoning, VFR reversion when feasible, etc… therefore a precise and generic contingency procedure cannot be derived but shall be developed by the helicopter operator considering the local operational environment and the helicopter equipage.

SO_DEP_CTRL#25. In case of loss of RNP navigation during the instrument segment of the PinS departure, the pilot shall revert to contingency procedures and inform ATS as soon as possible when in controlled airspace. SO_DEP_UNCTRL#19. In case of loss of RNP navigation, the pilot shall revert to contingency procedures and inform other aircraft and, if applicable, the Aerodrome Flight Information Service in uncontrolled airspace as soon as possible.

2. Loss of communication

SO_DEP_CTRL#26. In case of loss of communication in controlled airspace, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications. SO_DEP_UNCTRL#20. In case of loss of communication in uncontrolled airspace where RMZ is promulgated, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications.

3. Icing Conditions

With ice, helicopters face 2 problems: ice changes the shape of the airfoil and therefore there is a loss on the efficiency of the rotor system and it adds significant weight to the helicopter.

Even if PinS operations is performed at altitudes that limit icing conditions, such an event cannot be excluded from the safety assessment.

SO_DEP_CTRL#27. In case of icing conditions in controlled airspace, a flight crew contingency procedure shall be defined considering the operational environment of the PinS departure. SO_DEP_UNCTRL#21. In case of icing conditions in uncontrolled airspace, a contingency procedure shall be defined considering the operational environment of the PinS departure.

4. Degradation of visibility conditions / inadvertent IMC

The safety objectives defined for normal operations in 5.2.1 and relative to the inability to maintain visual references before reaching the IDF apply to this abnormal condition. These safety objectives are the following:

SO_DEP_CTRL#11 Helicopters shall abort and return to heliport or landing location if visual references are no longer maintained until reaching the IDF at or above the MCA IDF SO_DEP_UNCTRL#9 Helicopters shall abort and return to heliport or landing location if visual references are no longer maintained until reaching the IDF at or above the MCA IDF.

5. Thunderstorms

If the weather brief shows the presence of thunderstorms and CB activity, an airborne weather radar should be used to detect and avoid:

REC_DEP_CTRL#1. Helicopters conducting PinS departure procedures in controlled airspace should be operated with means to provide relevant weather updates. Issue_DEP_CTRL#1. The provision of weather information through on-board Electronic Flight Bags should be further assessed. REC_DEP_UNCTRL#1. Helicopters conducting PinS departure procedures in uncontrolled airspace should be operated with means to provide relevant weather updates.


Generic Safety Case

Issue_DEP_UNCTRL#1. The provision of weather information through on-board Electronic Flight Bags should be further assessed.

5.3.1.2 Derivation of Safety Objectives for Abnormal operations

The following Safety Objectives12 considering above abnormal conditions have been derived:

SO ID Description Abnormal

Scenario Ref. SAC

Controlled airspace

SO_DEP_CTRL#25

In case of loss of RNP navigation during the instrument segment of the PinS departure, the pilot shall revert to contingency procedures and inform ATS as soon as

possible when in controlled airspace.

#1 SAC-DEP_MAC_CTRL#2

SAC-DEP_MAC_CTRL#3

SAC-DEP_CFIT

SO_DEP_CTRL#26

In case of loss of communication in controlled airspace, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground

communications.

#2 SAC-DEP_MAC_CTRL#2

SAC-DEP_MAC_CTRL#3

SO_DEP_CTRL#27

In case of icing conditions in controlled airspace, a flight crew contingency procedure shall be defined considering the operational environment of the PinS departure.

#3 SAC-DEP_LOC-I SAC-DEP _CFIT


SO_DEP_UNCTRL#19

In case of loss of RNP navigation, the pilot shall revert to contingency procedures and inform other aircraft and, if applicable, the Aerodrome Flight Information Service in uncontrolled airspace.

#1 SAC-DEP_MAC_UNCTRL#2


SAC-PinS_CFIT

SO_DEP_UNCTRL#20

In case of loss of communication in uncontrolled airspace where RMZ is promulgated, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications.

#2 SAC-DEP_MAC_UNCTRL#2


SO_DEP_UNCTRL#21

In case of icing conditions in uncontrolled airspace, a contingency procedure shall be defined considering the operational environment of the PinS departure.

#3 SAC-DEP_LOC-I SAC-DEP_CFIT

Table 5-5. Safety Objectives in controlled and uncontrolled airspace - Abnormal PinS departure operations

5.3.2 Safety Objective in Abnormal operations for PinS approach

5.3.2.1 Abnormal scenarios

The following abnormal conditions have been identified from a generic point of view:

12 It is important to consider that these Safety Objectives have been determined as generic Safety Objectives and obviously should be

adapted to the local operational environment and helicopter equipage


Generic Safety Case

ID Abnormal Scenario

1 Loss of GNSS/SBAS signal or degradation of GNSS/SBAS signal performance

2 Loss of communication

3 Icing conditions

4 Inadvertent IMC

5 Peak of traffic

6 Thunderstorms

Note: RPAS insertion in airspace is not addressed in this safety assessment.

In the following paragraphs, each abnormal scenario is assessed for potential risk and mitigations are derived where necessary, in the form of Safety Objectives that are further consolidated under the following sub-sections.

1. Loss of GNSS/SBAS signal or degradation of GNSS/SBAS signal performance

Different mitigations could be defined when such abnormal conditions are encountered such as conventional navigation, dead feckoning, use of airborne navigation procedure, emergency descent procedure at minimum IFR speed, VFR reversion when feasible, etc… therefore a precise and generic contingency procedure cannot be derived but shall be developed by the helicopter operator considering the local operational environment and the helicopter equipage.

SO_APR_CTRL#28. In case of loss of RNP navigation during instrument segment of the PinS approach, the pilot shall revert to contingency procedures and inform ATS as soon as possible when in controlled airspace.

SO_APR_UNCTRL#21. In case of loss of RNP navigation during instrument segment of the PinS approach, the pilot shall revert to contingency procedures and inform other aircraft and if applicable the Aerodrome Flight Information Service in uncontrolled airspace as soon as possible.

2. Loss of communication

SO_APR_CTRL#29. In case of loss of communication in controlled airspace, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications.

SO_APR_UNCTRL#22. In case of loss of communication in uncontrolled airspace, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications.

3. Icing Conditions

With ice, helicopters face 2 problems: ice changes the shape of the airfoil and therefore there is a loss on the efficiency of the rotor system and it adds significant weight to the helicopter.

Even if PinS operations are performed at altitudes that limit icing conditions such an event cannot be excluded from the safety assessment.

SO_APR_CTRL#30. In case of icing conditions in controlled airspace, a contingency procedure shall be defined considering the operational environment of the PinS approach. SO_APR_UNCTRL#23. In case of icing conditions in uncontrolled airspace, a contingency procedure shall be defined considering the operational environment of the PinS approach.


Generic Safety Case

4. Degradation of visibility conditions / inadvertent IMC

Inadvertent IMC leads to a loss of visual reference and inability to continue the procedure.

SO_APR_CTRL#31. In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR” operation in controlled airspace, the pilot shall apply VFR contingency procedures (as currently done in VFR) and inform ATS as soon as possible. SO_APR_CTRL#32. In case of degradation of visibility conditions during the visual segment of a PinS “proceed visually” operation in controlled airspace, the pilot shall apply contingency procedures considering the operational environment of the PinS approach and inform ATS as soon as possible. SO_APR_UNCTRL#24. In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR” operation in uncontrolled airspace, then, the pilot shall apply VFR contingency procedures (as currently done in VFR) and inform other aircraft as soon as possible. SO_APR_UNCTRL#25. In case of degradation of visibility conditions during the visual segment of a PinS “proceed visually” operation in uncontrolled airspace, the pilot shall apply contingency procedures considering the operational environment of the PinS approach and inform other aircraft as soon as possible.

5. Peak of traffic

SO_APR_CTRL#33. ATC shall ensure separation of traffic in situation of peak of traffic in controlled airspace taking benefit of holdings published on the PinS approach procedure, if any.

Peak of traffic is less relevant for uncontrolled airspace as uncontrolled airspace are normally limited to area with low traffic density. However, holdings might be beneficial for the helicopter pilot if for instance the PinS procedure is already in use by another helicopter.:

SO_APR_UNCTRL#26. Pilots shall ensure separation with other traffic in situation of peak of traffic in uncontrolled airspace taking benefit from holdings published on the PinS approach procedure, if any.

6. Thunderstorms

If the weather brief shows the presence of thunderstorms and CB activity, an airborne weather radar or an on-board Electronic Flight Bag (EFB) weather application should be used to avoid thunderstorms:

REC_APR_CTRL#1. Helicopters conducting PinS approach procedures in controlled airspace should be operated with means to provide relevant weather updates.

Issue_APR_CTRL#1. The provision of weather information through on board Electronic Flight Bags should be further assessed.

REC_APR_UNCTRL#1. Helicopters conducting PinS approach procedures in uncontrolled airspace should be operated with means to provide relevant weather updates.

Issue_APR_UNCTRL#1. The provision of weather information through on board Electronic Flight Bags should be further assessed.

5.3.2.2 Derivation of Safety Objectives for Abnormal operations

The Safety Objectives13 considering abnormal conditions are summarized in the following table:

13 It is important to consider that these Safety Objectives have been determined as generic Safety Objectives and obviously should be

adapted to the local operational environment and helicopter equipage


Generic Safety Case

SO ID Description Abnormal

Scenario Ref. SAC

Controlled airspace

SO_APR_CTRL#28

In case of loss of RNP navigation during instrument segment of the PinS approach, the pilot shall revert to contingency procedures and inform ATS as soon as possible when in controlled airspace.

#1 SAC-APR_MAC_CTRL#2

SAC-APR_MAC_CTRL#3

SAC-APR_CFIT

SO_APR_CTRL#29

In case of loss of communication in controlled airspace, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications.

#2 SAC-APR_MAC_CTRL#2

SAC-APR _MAC_CTRL#3

SO_APR_CTRL#30

In case of icing conditions in controlled airspace, a contingency procedure shall be defined considering the operational environment of the PinS approach.

#3 SAC- APR_LOC-I SAC- APR_CFIT

SO_APR_CTRL#31

In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR” operation in controlled airspace, the pilot shall apply VFR contingency procedures (as currently done in VFR) and inform ATS as soon as possible.

#4 SAC- APR_MAC_CTRL#2

SAC- APR_MAC_CTRL#3

SAC- APR_CFIT

SO_APR_CTRL#32

In case of degradation of visibility conditions during the visual segment of a PinS “proceed visually” operation in controlled airspace, the pilot shall apply contingency procedures considering the operational environment of the PinS approach and inform ATS as soon as possible.


SAC- APR_MAC_CTRL#3

SAC- APR_CFIT

SO_APR_CTRL#33

ATC shall ensure separation of traffic in situation of peak of traffic in controlled airspace taking benefit of holdings published on the PinS approach procedure, if any.


SAC- APR_MAC_CTRL#3


SO_APR_UNCTRL#21

In case of loss of RNP navigation during instrument segment of the PinS approach, the pilot shall revert to contingency procedures and inform other aircraft and if applicable the Aerodrome Flight Information Service in uncontrolled airspace.

#1 SAC-PinS_MAC_UNCTRL#2

SAC-PinS_MAC_UNCTRL#3

SAC-PinS_CFIT

SO_APR_UNCTRL#22

In case of loss of communication in uncontrolled airspace, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications.

#2 SAC- APR_MAC_UNCTRL#2

SAC- APR_MAC_UNCTRL#3

SO_APR_UNCTRL#23

In case of icing conditions in uncontrolled airspace, a contingency procedure shall be defined considering the operational environment of the PinS approach.

#3 SAC- APR_LOC-I SAC- APR_CFIT


Generic Safety Case

SO_APR_UNCTRL#24

In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR” operation in uncontrolled airspace, then, the pilot shall apply VFR contingency procedures (as currently done in VFR) and inform other aircraft as soon as possible.



SAC-PinS_CFIT

SO_APR_UNCTRL#25

In case of degradation of visibility conditions during the visual segment of a PinS “proceed visually” operation in uncontrolled airspace, the pilot shall apply contingency procedures considering the operational environment of the PinS approach and inform other aircraft as soon as possible.



SAC- APR_CFIT

SO_APR_UNCTRL#26

Pilots shall ensure separation with other traffic in situation of peak of traffic in uncontrolled airspace taking benefit from holdings published on the PinS approach procedure, if any.



SAC- APR_CFIT

Table 5-6. Safety Objectives in controlled and uncontrolled airspace - Abnormal PinS approach operations

5.4 Safety Objectives in Faulted operations

This section concerns operations in the case of internal failures (OHA). It undertakes the assessment of possible adverse effects that failures internal to the end-to-end system supporting PinS helicopter operations might have upon the provision of the relevant operations and aims at deriving safety objectives (failure approach) to mitigate against these effects.

This section provides the list of the identified Operational Hazards, their operational effects, with the mitigation of those effects and the associated severity.

5.4.1 Safety Objective in Faulted operations for PinS departure

5.4.1.1 Identification and analysis of Operational Hazards

The introduction of PinS helicopter operations might induce additional hazards or might involve modifications of the characteristics of the hazards already existing in current operations.

Two hazard identification sessions have been held:

One in Strasbourg in June 2017 with representatives from France and Switzerland.

One in Trento in November 2017 with representatives from Italy, France, Switzerland and Norway.

These two hazard identification sessions involved procedure designers, ATC, pilots, authorities and safety experts.


Generic Safety Case

During the HAZID sessions the operational hazards relevant for helicopter PinS departure operations have been identified and their consequences have been assessed. The Operational Hazards are defined as closely as possible to the level of the ATM/ANS service delivered to airspace users. The identification of the operational hazards has been initiated from the list of (success) Safety Objectives in Normal operations of section5.2.1, complemented with the brainstorming involving the workshop representatives. The detailed process and intermediary results are presented in section A.1.

The Table 5-7 below provides the consolidated list of operational hazards:

ID Hazard description Operational effects Mitigation of effects (ref.

Risk model)

Severity

In controlled airspace Hz_DEP_01 Helicopter deviates from

expected PinS departure instrument segments towards terrain in controlled airspace.

The helicopter might collide with terrain/obstacle following lateral or vertical deviation.

- ATCO detection - MSAW if fitted - Pilot visual avoidance (see

and avoid) - HTAWS if fitted

CFIT SC 3a Controlled Flight Toward terrain

Hz-DEP_05 Helicopter deviates from expected PinS departure instrument segments towards IFR or known VFR aircraft in controlled airspace.

The helicopter might collide with other aircraft following lateral or vertical deviation.

- ATCO detects and solves conflicts between IFR flights

- ATCO provides traffic information about VFR flights and traffic avoidance advice on request

- TAS, FLARM or others (efficiency to be evaluated)

MAC SC 4a Tactical Conflict

Hz_DEP_10 IFR or known VFR traffic flies towards helicopter established on the PinS departure procedure in controlled airspace.

Aircraft might collide with helicopter established on the PinS departure procedure.

- ATCO detects and solves conflicts between IFR flights.



MAC-SC4a Tactical Conflict

Hz_DEP_15 Helicopter deviates from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” departure, in controlled airspace.

The helicopter might collide with terrain/obstacle.


and avoid) HTAWS if fitted


Hz_DEP_20 Helicopter deviates from expected flight path, towards IFR or known VFR aircraft, during visual segment of the PinS “proceed visually” departure, in controlled airspace.

The helicopter might collide with other aircraft following lateral or vertical deviation





In Uncontrolled airspace


Generic Safety Case


Risk model)

Severity

Hz_DEP_50 Helicopter deviates from expected PinS departure instrument segments towards terrain in uncontrolled airspace.


- Pilot visual avoidance (see and avoid)

- HTAWS if fitted

CFIT SC 2 Imminent CFIT

Hz_DEP_55 Helicopter deviates from expected PinS departure instrument segments towards other aircraft, in uncontrolled airspace.



- Pilot visual warning - TAS, FLARM or others

(efficiency to be evaluated)

MAC SC 2b Imminent collision

Hz_DEP_60 Other traffic flies towards helicopter established on the PinS departure procedure in uncontrolled airspace.

Aircraft might collide with IFR aircraft established on the PinS departure procedure.



(efficiency to be evaluated


Hz_DEP_65 Helicopter deviates from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” departure in uncontrolled airspace.



- HTAWS if fitted


Hz_DEP_70 Helicopter deviates from expected flight path, towards other aircraft, during visual segment of the PinS “proceed visually” departure in uncontrolled airspace.






Table 5-7. Consolidated list of PinS departure Operational Hazards

Note: the risk of deviation from the expected PinS segment towards unknown VFR and the risk of an unknown VFR flying towards the PinS are considered as not applicable as these risks already exist in current operations (i.e. without PinS) and they are not impacted by the introduction of PinS (i.e. no increase of the probability of unknown VFR in airspace class C and D with the introduction of PinS).

In the tables of Annex A.1 the mitigation of effects (in terms of protection against their propagation) provides reference to the safety barriers of the risk models (

The severity of the hazard effects has been allocated according to the Severity Classification Schemes (SCS) based on the MAC and CFIT risk models in controlled and uncontrolled airspace provided in section A.1.

5.4.1.2 Safety Objectives associated to the Operational Hazards

According to the SRM [RD 2] and to a majority of ANSPs’ safety assessment methodologies, Safety Objectives are formulated to limit the frequency at which the Operational Hazards could be allowed to occur (within SRM these SOs are called “reliability/integrity” SOs in order to distinguish them from the “functionality/performance” SOs derived for normal operations at §5.1.2 and abnormal operations at §5.3).


Generic Safety Case

The reliability/integrity SOs allocation is performed using a Risk Classification Scheme (RCS) which might be specific to each operational environment. It is up to the helicopter operator to define the applicable risk classification scheme or any alternate method in collaboration with the relevant ANSP/Competent Authority responsible for the safety level of the class of airspace where the PinS departure will be implemented.

Either quantitative SOs are derived (based on the local RCS) or risk is qualitatively assessed.

If quantitative SOs are chosen, this generic safety case illustrates in Annex A.3 the allocation of quantitative Safety Objectives using a generic RCS (note that for each accident type a dedicated RCS is provided). If the helicopter operator in collaboration with the relevant ANSP/Competent Authority defines a different RCS or an alternate method then the quantitative figures of the following Safety Objectives must be modified accordingly.

Hazard ref

(hazard severity)

Safety Objectives (integrity/reliability)

Safety Objectives in Controlled Airspace

Hz_DEP_01 SO_DEP_CTRL#28. Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS departure instrument segment towards terrain, in controlled airspace, leading to controlled flight towards terrain shall not be greater than 2X10-7 per flight.

Hz_DEP_05 SO_DEP_CTRL#29. Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS departure instrument segment towards IFR or know VFR aircraft, in controlled airspace, leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.

Hz_DEP_10 SO_DEP_CTRL#30. Frequency of occurrence of IFR aircraft or known VFR aircraft flying towards helicopters established on the PinS departure in controlled airspace leading to tactical conflict shall not be greater than 3.33X10-

5 per flight hour. Hz_DEP_15 SO_DEP_CTRL#31. Frequency of occurrence of helicopters deviating from

expected flight path, towards terrain, during visual segment of the PinS “proceed visually” departure, in controlled airspace, leading to controlled flight towards terrain shall not be greater than 2X10-7 per flight.

Hz_DEP_20 SO_DEP_CTRL#32. Frequency of occurrence of helicopters deviating from expected flight path, towards IFR or know VFR aircraft, during visual segment of the PinS “proceed visually” departure, in controlled airspace, leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.

Safety Objectives in Uncontrolled Airspace

Hz_DEP_50 SO_DEP_UNCTRL#22. Frequency of occurrence of helicopters deviating laterally or vertically from published PinS departure instrument segment towards terrain in uncontrolled airspace leading to imminent CFIT shall not be greater than 1X10-7 per flight hour.

Hz_DEP_55 SO_DEP_UNCTRL#23. Frequency of occurrence of helicopters deviating laterally or vertically from published PinS departure instrument segment towards other aircraft, in uncontrolled airspace, leading to imminent collision with other traffic shall not be greater than 1X10-5 per flight hour.

Hz_DEP_60 SO_DEP_UNCTRL#24. Frequency of occurrence of other aircraft flying towards helicopters established on the PinS departure instrument segment, in uncontrolled airspace, leading to imminent collision shall not be greater than 1X10-5 per flight hour.


Generic Safety Case

Hazard ref

(hazard severity)


Hz_DEP_65 SO_DEP_UNCTRL#25. Frequency of occurrence of helicopters deviating from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” departure, in uncontrolled airspace, leading to imminent CFIT shall not be greater than 1X10-7 per flight hour.

Hz_DEP_70 SO_DEP_UNCTRL#26. Frequency of occurrence of helicopters deviating laterally or vertically from expected flight path, towards other aircraft, during visual segment of the PinS “proceed visually” departure, in uncontrolled airspace, leading to imminent collision with other traffic shall not be greater than 1X10-5 per flight hour.

Table 5-8. Pins departure Safety Objectives associated to the Operational Hazards

5.4.2 Safety Objectives in Faulted operations for PinS approach

5.4.2.1 Identification and analysis of Operational Hazards

The introduction of PinS helicopter operations might induce additional hazards or might involve modifications of the characteristics of the hazards already existing in current operations.

Two hazard identification sessions have been held:

One in Strasbourg in June 2017 with representatives from France and Switzerland

One in Trento in November 2017 with representatives from France and Italy

These two hazard identification sessions involved procedure designers, ATC, pilots, authorities and safety experts.

During the HAZID session the operational hazards relevant for helicopter PinS approach operations have been identified and their consequences have been assessed. The Operational Hazards are defined as close as possible to the level of the ATM/ANS service delivered to airspace users. The identification of the operational hazards has been initiated from the list of (success) Safety Objectives in Normal operations of section 5.2.2, complemented with the brainstorming involving the workshop representatives. The detailed process and intermediary results are presented in section A.1.

The Table 5-9 below provides the consolidated list of operational hazards:


Risk model)

Severity

In controlled airspace Hz_APR_01 Helicopter deviates from

expected PinS approach instrument segments towards terrain in controlled airspace.



and avoid) - HTAWS if fitted


Hz-APR_05 Helicopter deviates from expected PinS approach instrument segments towards IFR or known VFR aircraft in controlled airspace.







Generic Safety Case


Risk model)

Severity

In controlled airspace Hz_APR_10 IFR or known VFR traffic flies

towards helicopter established on the PinS approach procedure in controlled airspace.

Aircraft might collide with helicopter established on the PinS approach procedure.

- ATCO detects and solves conflicts between IFR flights.



MAC-SC4a Tactical Conflict

Hz_APR_15 Helicopter deviates from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” approach in controlled airspace.





Hz_APR_20 Helicopter deviates from expected flight path, towards IFR or known VFR aircraft, during visual segment of the PinS “proceed visually” approach in controlled airspace.





Hz_APR_25 Helicopter fails to decelerate and/or prepare landing during the visual segment of the PinS approach, in controlled airspace.

The helicopter might collide with other aircraft following lateral or vertical deviation .




RE SC3 Unstable approach

In Uncontrolled airspace Hz_APR_50 Helicopter deviates from

expected PinS approach instrument segments towards terrain in uncontrolled airspace.

The aircraft might collide with terrain/obstacle following lateral or vertical deviation.


- HTAWS if fitted


Hz_APR_55 Helicopter deviates from expected PinS approach instrument segments towards other aircraft, in uncontrolled airspace.

The aircraft might collide with other aircraft following lateral or vertical deviation.





Hz_APR_60 Other traffic flies towards helicopter established on the PinS approach procedure in uncontrolled airspace.

Aircraft might collide with IFR aircraft established on the PinS approach procedure.






Generic Safety Case


Risk model)

Severity

In controlled airspace Hz_APR_65 Helicopter deviates from

expected flight path, towards terrain, during visual segment of the PinS “proceed visually” approach in uncontrolled airspace.



- HTAWS if fitted


Hz_APR_70 Helicopter deviates from expected flight path, towards other aircraft, during visual segment of the PinS “proceed visually” approach in uncontrolled airspace.

The aircraft might collide with other aircraft following lateral or vertical deviation.





Hz_APR_75 Helicopter fails to decelerate and/or prepare landing during the visual segment of the PinS approach, in uncontrolled airspace.

The helicopter might fail to land on the landing location.

- Flight crew correct / adapt short final trajectory

- Go around

RE SC3 Unstable approach

Table 5-9. Consolidated list of PinS approach Operational Hazards

Note: the risk of deviation from the expected PinS segment towards unknown VFR and the risk of an unknown VFR flying towards the PinS are considered as not applicable as these risks already exist in current operations (i.e. without PinS) and they are not impacted by the introduction of PinS (i.e. no increase of the probability of unknown VFR in airspace class C and D with the introduction of PinS).

In the table the mitigation of effects (in terms of protection against their propagation) provides reference to the safety barriers of the risk models (see ANNEX A – ).

The severity of the hazard effects has been allocated according to the Severity Classification Schemes (SCS) based on the MAC and CFIT risk models in controlled and uncontrolled airspace provided in section A.1.

5.4.2.2 Safety Objectives associated to the Operational Hazards

According to the SRM [RD 2] and to a majority of ANSPs’ safety assessment methodologies, Safety Objectives are formulated to limit the frequency at which the Operational Hazards could be allowed to occur (within SRM these SOs are called “reliability/integrity” SOs in order to distinguish them from the “functionality/performance” SOs derived for Normal operations at §5.2.2 and abnormal operations at §5.3).

The reliability/integrity SOs allocation is performed using a Risk Classification Scheme (RCS) which might be specific to each operational environment. It is up to the helicopter operator to define the applicable risk classification scheme or any alternate method in collaboration with the relevant ANSP/Competent Authority responsible for the safety level of the class of airspace where the PinS approach will be implemented.

Either quantitative SOs are derived (based on the local RCS) or risk is qualitatively assessed.


Generic Safety Case

If quantitative SOs are chosen, this generic safety case illustrates in section A.3 the allocation of quantitative Safety Objectives using a generic RCS (note that for each accident type a dedicated RCS is provided). If the helicopter operator in collaboration with the relevant ANSP/Competent Authority defines a different RCS or an alternate method then the quantitative figures of the following Safety Objectives must be modified accordingly.

Note : as no safety target is defined so far for the runway excursion risk, a quantitative safety objective of 1x10-4 per flight is defined for the hazards Hz_APR_25 and Hz_APR_70 based on operational expertise and common sense.

Hazard ref (hazard severity)


Safety Objectives in Controlled Airspace

Hz_APR_01 SO_APR_CTRL#34. Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS approach instrument segment towards terrain, in controlled airspace, leading to controlled flight towards terrain shall not be greater than 2X10-7 per flight.

Hz_APR_05 SO_APR_CTRL#35. Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS approach instrument segment towards IFR or know VFR aircraft, in controlled airspace, leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.

Hz_APR_10 SO_APR_CTRL#36. Frequency of occurrence of IFR aircraft or known VFR aircraft flying towards helicopters established on the PinS approach in controlled airspace leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.

Hz_APR_15 SO_APR_CTRL#37. Frequency of occurrence of helicopters deviating from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” approach, in controlled airspace, leading to controlled flight towards terrain shall not be greater than 2X10-7 per flight.

Hz_APR_20 SO_APR_CTRL#38. Frequency of occurrence of helicopters deviating from expected flight path, towards IFR or know VFR aircraft, during visual segment of the PinS “proceed visually” approach, in controlled airspace, leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.

Hz_APR_25 SO_APR_CTRL#39. Frequency of occurrence of helicopters failing to decelerate and/or prepare landing during the visual segment of the PinS approach leading to unstable approach in controlled airspace shall be not greater than 1x10-4 per flight.

Safety Objectives in Uncontrolled Airspace

Hz_APR_50 SO_APR_UNCTRL#27. Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS approach instrument segment towards terrain, in uncontrolled airspace, leading to imminent CFIT shall not be greater than 1X10-7 per flight hour.

Hz_APR_55 SO_APR_UNCTRL#28. Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS approach instrument segment towards other aircraft, in uncontrolled airspace, leading to imminent collision with other traffic shall not be greater than 1X10-5 per flight hour.

Hz_APR_60 SO_APR_UNCTRL#29. Frequency of occurrence of other aircraft flying towards helicopters established on the PinS approach instrument segment, in uncontrolled airspace, leading to imminent collision shall not be greater than 1X10-5 per flight hour.

Hz_APR_65 SO_APR_UNCTRL#30. Frequency of occurrence of helicopters deviating from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” approach, in uncontrolled airspace, leading to imminent CFIT shall not be greater than 1X10-7 per flight hour.


Generic Safety Case

Hazard ref (hazard severity)


Hz_APR_65 SO_APR_UNCTRL#31. Frequency of occurrence of helicopters deviating from expected flight path, towards other aircraft, during visual segment of the PinS “proceed visually” approach, in uncontrolled airspace, leading to imminent collision with other traffic shall not be greater than 1X10-5 per flight hour.

Hz_APR_70 SO_APR_UNCTRL#32. Frequency of occurrence of helicopters failing to decelerate and/or prepare landing during the visual segment of the PinS approach leading to unstable approach in uncontrolled airspace shall be not greater than 1x10-4 per flight.

Table 5-10. Safety Objectives associated to the PinS approach Operational Hazards


Generic Safety Case

5.5 Safety Criteria achievability: validation strategy & objectives

This section presents the validation strategy for demonstrating that a PinS helicopter operation meets the defined SAC.

The following means are employed for the validation of helicopter PinS operations:

Analysis of the Functional System (FS) design

Practical experience and expert-based judgment

Note: No safety objective has been validated through live trial until now. This section will be updated in future versions of the document with reference to future live trial activities.

The demonstration that the specified PinS helicopter operations meets the SAC is validated when the design fulfils each of the Safety Objectives (SOs) derived from the SAC in the previous sub-sections.

The next sections (section 5.5.1 for PinS departure operations and section 5.5.2 for PinS approach operations) outline the validation strategy by indicating what validation means have been employed towards each Safety Objective.

The Functional System design analysis will be driven by the Safety Objectives and supported by the use of a Logical Model. The analysis will be conducted in section 6.1 for Normal operations, Abnormal operations and Faulted operations in controlled airspace and 6.2 for Normal operations, Abnormal operations and Faulted operations in uncontrolled airspace. The analysis under Faulted operations will produce a causal analysis of each Operational Hazard, assess the risk and define mitigation such as to fulfil the Safety Objective associated to the Operational Hazard.

5.5.1 Validation strategy for PinS departure operations

Controlled Airspace (Class C and D)

SO ID Description Validation means Addressed

in Section

SO_DEP_CTRL#1

Spacing between departure procedures and between approach and departure procedure shall be determined considering navigation performance, separation minima, traffic density, sector size andcontroller procedures / HMI

Practical operational experience on airspace design and expert-based judgment

FS design analysis

6.1.2

SO_DEP_CTRL#2

ATC shall separate traffic during the visual segment of the PinS departure for “proceed visually” operation.

Practical ATC operational experience and expert-based judgment

FS design analysis

6.1.2

SO_DEP_CTRL#3

ATC shall maintain separation between A/C during the visual segment of the PinS departure for “proceed visually” operation.


FS design analysis

6.1.2

SO_DEP_CTRL#4

ATC shall provide traffic information to A/C during the visual segment of the PinS departure for “proceed VFR” operation.


FS design analysis

6.1.2

SO_DEP_CTRL#5

Each pilot shall maintain separation with other A/C during the visual segment of the PinS departure for “proceed VFR” operation.

Flight crew training

FS design analysis

6.1.2


Generic Safety Case



in Section

SO_DEP_CTRL#6

The visual segment of the PinS “proceed visually” departure procedure shall be designed and promulgated to prevent

A/C from colliding with terrain and obstacles.

Practical operational experience on procedure design/publication and expert-based judgment

FS design analysis

6.1.2

SO_DEP_CTRL#7

Helicopters shall respect lateral and vertical constraints, if applicable, of the visual segment of the PinS “proceed

visually” departure procedure.

A/C certification

Aircraft Operator approval


FS design analysis

6.1.2

SO_DEP_CTRL#8

Pilots shall see and avoid the obstacles during visual segment of the PinS departure procedure.


FS design analysis

6.1.2

SO_DEP_CTRL#9

The PinS departure shall be designed and promulgated to facilitate the transition between the visual flight phase to the instrument flight phase.


FS design analysis

6.1.2

SO_DEP_CTRL#10

Helicopters shall perform transition between visual flight phase and instrument flight phase, if visual references are maintained until reaching the IDF at or above the IDF MCA.



FS design analysis

6.1.2

SO_DEP_CTRL#11

Helicopters shall abort and return to heliport or landing location if visual references are no longer maintained until reaching the IDF at or above the MCA IDF.


FS design analysis

6.1.2

SO_DEP_CTRL#12

The instrument segments of the PinS departure procedure shall be designed and promulgated to prevent A/C from

colliding with terrain and obstacle.ss.


FS design analysis

6.1.2

SO_DEP_CTRL#13

Helicopters shall respect the lateral path of the instrument segments of the PinS departure procedure.

A/C certification



FS design analysis

6.1.2

SO_DEP_CTRL#14

Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS departure procedure.

A/C certification



FS design analysis

6.1.2


Generic Safety Case



in Section

SO_DEP_CTRL#15

Helicopter operators shall submit a flight plan.

Practical Aircraft operator experience and expert-based judgment

IFPS check for helicopter route

FS design analysis

6.1.2

SO_DEP_CTRL#16

ATC shall separate traffic during the instrument flight phase of the PinS departure.


FS design analysis

6.1.2

SO_DEP_CTRL#17

ATC shall maintain separation between A/C during the instrument flight phase of the PinS departure.


FS design analysis

6.1.2

SO_DEP_CTRL#18

The instrument segment of the PinS departure shall be designed and promulgated to facilitate the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable.


FS design analysis

6.1.2

SO_DEP_CTRL#19

Helicopters shall perform the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable.

A/C certification



FS design analysis

6.1.2

SO_DEP_CTRL#20

ATS shall inform helicopters conducting the PinS departure about other known traffic.


FS design analysis

6.1.2

SO_DEP_CTRL#21

The PinS departure procedure shall be designed and promulgated to ensure separation from the prohibited airspace / restricted areas in the vicinity of the heliport/landing location.


FS design analysis

6.1.2

SO_DEP_CTRL#22

If the PinS departure is not strategically separated from prohibited/restricted areas, ATC shall ensure separation between helicopters on the PinS departure and prohibited/restricted areas.

Practical operational experience and expert-based judgment

FS design analysis

6.1.2

SO_DEP_CTRL#23

Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS departure.


FS design analysis

6.1.2

SO_DEP_CTRL#24

Helicopters shall be informed of the local MET conditions.


FS design analysis

6.1.2


Generic Safety Case



in Section

SO_DEP_CTRL#25

In case of loss of RNP navigation during the instrument segment of the PinS departure, the pilot shall revert to contingency procedures and inform ATS as soon as possible when in controlled airspace.

Practical pilot experience and expert-based judgment

FS design analysis

6.1.3

SO_DEP_CTRL#26



FS design analysis

6.1.3

SO_DEP_CTRL#27

In case of icing conditions in controlled airspace, a flight crew contingency procedure shall be defined considering the operational environment of the PinS departure.


FS design analysis

6.1.3

SO_DEP_CTRL#28

Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS departure instrument segment towards terrain, in controlled airspace, leading to controlled flight towards terrain shall not be greater than 2X10-7 per flight.

FS design analysis 6.1.4

SO_DEP_CTRL#29

Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS departure instrument segment towards IFR or know VFR aircraft, in controlled airspace, leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.


SO_DEP_CTRL#30

Frequency of occurrence of IFR aircraft or known VFR aircraft flying towards helicopters established on the PinS departure in controlled airspace leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.


SO_DEP_CTRL#31

Frequency of occurrence of helicopters deviating from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” departure, in controlled airspace, leading to controlled flight towards terrain shall not be greater than 2X10-7 per flight.



Generic Safety Case



in Section

SO_DEP_CTRL#32

Frequency of occurrence of helicopters deviating from expected flight path, towards IFR or know VFR aircraft, during visual segment of the PinS “proceed visually” departure, in controlled airspace, leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.


Table 5-11. Safety Objectives validation table – PinS departure operations in controlled airspace

Uncontrolled Airspace (Class G)


in Section

SO_DEP_UNCTRL#1

Spacing between departure procedures and between approach and departure procedure shall be determined considering navigation performance and

traffic density.


FS design analysis

6.2.2

SO_DEP_UNCTRL#2

Operational use of the PinS departure shall be coordinated between involved

entities.


FS design analysis

6.2.2

SO_DEP_UNCTRL#3

Each pilot shall maintain visual separation with other A/C, in VMC conditions, during the visual and instrument flight phase (in VMC

condition) of the PinS departure.

A/C certification



FS design analysis

6.2.2

SO_DEP_UNCTRL#4

The visual segment of the PinS “proceed visually” departure procedure shall be designed and promulgated to

prevent A/C from colliding with terrain and obstacles.


FS design analysis

6.2.2

SO_DEP_UNCTRL#5

Helicopters shall respect lateral and vertical constraints if applicable of the visual segment of the PinS “proceed visually” departure procedure.

A/C certification



FS design analysis

6.2.2

SO_DEP_UNCTRL#6

Pilots shall see and avoid the obstacles during visual segment of the PinS departure procedure.


FS design analysis

6.2.2


Generic Safety Case



in Section

SO_DEP_UNCTRL#7

The PinS departure shall be designed and promulgated to facilitate the transition between the visual flight phase to the instrument flight phase.


FS design analysis

6.2.2

SO_DEP_UNCTRL#8


A/C certification



FS design analysis

6.2.2

SO_DEP_UNCTRL#9

Helicopters shall abort and return to heliport or landing location if visual references are no longer maintained until reaching the IDF at or above the MCA IDF.

A/C certification



FS design analysis

6.2.2

SO_DEP_UNCTRL#10


colliding with terrain and obstacles.


FS design analysis

6.2.2

SO_DEP_UNCTRL#11

Helicopters shall respect the lateral path of the instrument segments of the PinS departure procedure.

A/C certification



FS design analysis

6.2.2

SO_DEP_UNCTRL#12

Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS departure procedure.

A/C certification



FS design analysis

6.2.2

SO_DEP_UNCTRL#13

The instrument segment of the PinS departure shall be designed and promulgated to facilitate the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable.


FS design analysis

6.2.2

SO_DEP_UNCTRL#14

Helicopters shall perform the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable.

A/C certification



FS design analysis

6.2.2


Generic Safety Case



in Section

SO_DEP_UNCTRL#15

Helicopters shall inform other A/C about their position and flight intent.

A/C certification



FS design analysis

6.2.2

SO_DEP_UNCTRL#16

The PinS departure procedure shall be designed and promulgated to ensure separation from the prohibited airspace/restricted areas in the vicinity of the heliport/landing location.


FS design analysis

6.2.2

SO_DEP_UNCTRL#17

Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS departure.


FS design analysis

6.2.2

SO_DEP_UNCTRL#18

Helicopters shall be informed of the local MET conditions.


FS design analysis

6.2.2

SO_DEP_UNCTRL#19

In case of loss of RNP navigation, the pilot shall revert to contingency procedures and inform other aircraft and, if applicable, the Aerodrome Flight Information Service in uncontrolled airspace.


FS design analysis

6.2.3

SO_DEP_UNCTRL#20

In case of loss of communication in uncontrolled airspace where RMZ is promulgated, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications.


FS design analysis

6.2.3

SO_DEP_UNCTRL#21

In case of icing conditions in uncontrolled airspace, a contingency procedure shall be defined considering the operational environment of the PinS departure.


FS design analysis

6.2.3

SO_DEP_UNCTRL#22

Frequency of occurrence of helicopters deviating laterally or vertically from published PinS departure instrument segment towards terrain in uncontrolled airspace leading to imminent CFIT shall not be greater than 1X10-7 per flight hour.



Generic Safety Case



in Section

SO_DEP_UNCTRL#23

Frequency of occurrence of helicopters deviating laterally or vertically from published PinS departure instrument segment towards other aircraft, in uncontrolled airspace, leading to imminent collision with other traffic shall not be greater than 1X10-5 per flight hour.


SO_DEP_UNCTRL#24

Frequency of occurrence of other aircraft flying towards helicopters established on the PinS departure instrument segment, in uncontrolled airspace, leading to imminent collision shall not be greater than 1X10-5 per flight hour.


SO_DEP_UNCTRL#25

Frequency of occurrence of helicopters deviating from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” departure, in uncontrolled airspace, leading to imminent CFIT shall not be greater than 1X10-7 per flight hour.


SO_DEP_UNCTRL#26

Frequency of occurrence of helicopters deviating laterally or vertically from expected flight path, towards other aircraft, during visual segment of the PinS “proceed visually” departure, in uncontrolled airspace, leading to imminent collision with other traffic shall

not be greater than 1X10-5 per flight hour.


Table 5-12. Safety Objectives validation table - PinS departure operations in uncontrolled airspace


Generic Safety Case

5.5.2 Validation strategy for PinS approach operations

Controlled airspace (Class C and D)


in Section

SO_APR_CTRL#1

Spacing between approach procedures and between approach and departure procedure shall be determined considering navigation performance, separation minima, traffic density, sector size and controller procedures / HMI


FS design analysis

6.1.2

SO_APR_CTRL#2

The instrument segment of the PinS approach shall be designed and promulgated to facilitate the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach.


FS design analysis

6.1.2

SO_APR_CTRL#3

Helicopters shall perform the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach.

A/C certification



FS design analysis

6.1.2

SO_APR_CTRL#4

The instrument segments of the PinS approach procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles.


FS design analysis

6.1.2

SO_APR_CTRL#5

Helicopters shall respect the lateral path of the instrument segments of the PinS approach procedure.

A/C certification



FS design analysis

6.1.2

SO_APR_CTRL#6

Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS approach procedure.

A/C certification



FS design analysis

6.1.2

SO_APR_CTRL#7

Helicopter operators shall submit a flight plan.

Practical Aircraft operator experience and expert-based judgment

IFPS check for helicopter route

FS design analysis

6.1.2


Generic Safety Case



in Section

SO_APR_CTRL#8

ATC shall separate traffic during the instrument flight phase of the PinS approach.


FS design analysis

6.1.2

SO_APR_CTRL#9

ATC shall maintain separation between A/C during the instrument flight phase of the PinS approach.


FS design analysis

6.1.2

SO_APR_CTRL#10

The PinS approach shall be designed and promulgated to facilitate the transition between the instrument flight phase to visual flight phase.


FS design analysis

6.1.2

SO_APR_CTRL#11

An instrument missed approach shall be designed and promulgated to support situations where visual references are not obtained at the PinS.


FS design analysis

6.1.2

SO_APR_CTRL#12

Helicopters shall perform transition between instrument flight phase and visual flight phase, if visual references are obtained at or prior the MAPt.


FS design analysis

6.1.2

SO_APR_CTRL#13

Helicopters shall execute the published missed approach if visual references are not obtained at or prior the PinS.


FS design analysis

6.1.2

SO_APR_CTRL#14

The visual segment of the PinS “proceed visually” approach procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles.


FS design analysis

6.1.2

SO_APR_CTRL#15

Helicopters shall respect lateral and vertical constraints if applicable of the visual segment of the PinS “proceed visually” approach procedure.


FS design analysis

6.1.2

SO_APR_CTRL#16

Pilots shall see and avoid the obstacles during visual segment of the PinS approach procedure.


FS design analysis

6.1.2

SO_APR_CTRL#17

ATC shall separate traffic during the visual segment of the PinS approach for “proceed visually” operations.


FS design analysis

6.1.2


Generic Safety Case



in Section

SO_APR_CTRL#18

ATC shall maintain separation between A/C during the visual segment of the PinS approach for “proceed visually” operations.


FS design analysis

6.1.2

SO_APR_CTRL#19

ATC shall provide traffic information to A/C during the visual segment of the PinS approach for “proceed VFR” operations.


FS design analysis

6.1.2

SO_APR_CTRL#20

Each pilot shall maintain separation with other A/C during the visual segment of the PinS approach for “proceed VFR” operations.


FS design analysis

6.1.2

SO_APR_CTRL#21

The instrument and visual segments of the PinS approach shall be designed to facilitate deceleration and landing.


FS design analysis

6.1.2

SO_APR_CTRL#22

ATS shall inform helicopters conducting the PinS approach about other known traffic.


FS design analysis

6.1.2

SO_APR_CTRL#23

The PinS approach procedure shall be designed and promulgated to ensure separation from the prohibited airspace/restricted areas in the vicinity of the heliport/landing


FS design analysis

6.1.2

SO_APR_CTRL#24

If the PinS approach is not strategically separated from prohibited/restricted areas, ATC shall ensure separation between helicopters on the PinS approach and prohibited/restricted areas.


FS design analysis

6.1.2

SO_APR_CTRL#25

Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS approach.


FS design analysis

6.1.2

SO_APR_CTRL#26

Helicopters shall be informed of the forecasted MET conditions at destination


FS design analysis

6.1.2


Generic Safety Case



in Section

SO_APR_CTRL#27

Helicopters shall be informed of the forecasted MET conditions at alternate heliport


FS design analysis

6.1.2

SO_APR_CTRL#28

In case of loss of RNP navigation during instrument segment of the PinS approach, the pilot shall revert to contingency procedures and inform ATS as soon as possible when in controlled

airspace.


FS design analysis

6.1.3

SO_APR_CTRL#29



FS design analysis

6.1.3

SO_APR_CTRL#30

In case of icing conditions in controlled airspace, a contingency procedure shall be defined considering the operational environment of the PinS approach.


FS design analysis

6.1.3

SO_APR_CTRL#31

In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR” operation in controlled airspace, the pilot shall apply VFR contingency procedures (as currently done in VFR) and inform ATS.


FS design analysis

6.1.3

SO_APR_CTRL#32

In case of degradation of visibility conditions during the visual segment of a PinS “proceed visually” operation in controlled airspace, the pilot shall apply contingency procedures considering the operational environment of the PinS approach and inform ATS as soon as possible.


FS design analysis

6.1.3

SO_APR_CTRL#33

ATC shall ensure separation of traffic in situation of peak of traffic in controlled airspace taking benefit of holdings published on the PinS approach procedure, if any.


FS design analysis

6.1.3


Generic Safety Case



in Section

SO_APR_CTRL#34

Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS approach instrument segment towards terrain, in controlled airspace, leading to controlled flight towards terrain shall not be greater than 2X10-7 per flight.


SO_APR_CTRL#35

Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS approach instrument segment towards IFR or know VFR aircraft, in controlled airspace, leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.


SO_APR_CTRL#36

Frequency of occurrence of IFR aircraft or known VFR aircraft flying towards helicopters established on the PinS approach in controlled airspace leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.


SO_APR_CTRL#37

Frequency of occurrence of helicopters deviating from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” approach, in controlled airspace, leading to controlled flight towards terrain shall not be greater than 2X10-7 per flight.


SO_APR_CTRL#38

Frequency of occurrence of helicopters deviating from expected flight path, towards IFR or know VFR aircraft, during visual segment of the PinS “proceed visually” approach, in controlled airspace, leading to tactical conflict shall not be greater than 3.33X10-5 per flight hour.



Generic Safety Case



in Section

SO_APR_CTRL#39

Frequency of occurrence of helicopters failing to decelerate and/or prepare landing during the visual segment of the PinS approach leading to unstable approach in controlled airspace shall be not greater than 1x10-4 per flight.


Table 5-13. Safety Objectives validation table – PinS departure operations in controlled airspace

Uncontrolled airspace (Class G)


in Section

SO_APR_UNCTRL#1

Spacing between approach procedures and between approach and departure procedures shall be determined considering navigation performance and traffic density.


FS design analysis

6.2.2

SO_APR_UNCTRL#2

The instrument segment of the PinS approach shall be designed and promulgated to facilitate the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach.


FS design analysis

6.2.2

SO_APR_UNCTRL#3

Helicopters shall perform the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach.

A/C certification



FS design analysis

6.2.2

SO_APR_UNCTRL#4

The instrument segments of the PinS approach procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles.


FS design analysis

6.2.2

SO_APR_UNCTRL#5

Helicopters shall respect the lateral path of the instrument segments of the PinS approach procedure.

A/C certification



FS design analysis

6.2.2


Generic Safety Case



in Section

SO_APR_UNCTRL#6

Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS approach procedure.

A/C certification



FS design analysis

6.2.2

SO_APR_UNCTRL#7

The PinS approach shall be designed and promulgated to facilitate the transition between the instrument flight phase to visual flight phase.


FS design analysis

6.2.2

SO_APR_UNCTRL#8

Helicopters shall perform transition between instrument flight phase and visual flight phase, if visibility requirements are obtained at or prior the MAPt.

A/C certification



FS design analysis

6.2.2

SO_APR_UNCTRL#9

Helicopters shall execute the published missed approach if visibility requirements are not obtained at or prior the PinS.

A/C certification



FS design analysis

6.2.2

SO_APR_UNCTRL#10

The visual segment of the PinS “proceed visually” approach procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles.


FS design analysis

6.2.2

SO_APR_UNCTRL#11

Helicopters shall respect lateral and vertical constraints if applicable of the visual segment of the PinS “proceed visually” approach procedure.

A/C certification



FS design analysis

6.2.2

SO_APR_UNCTRL#12

Pilots shall see and avoid the obstacles during visual segment of the PinS approach procedure.


FS design analysis

6.2.2

SO_APR_UNCTRL#13

Operational use of the PinS Approach shall be coordinated between involved entities.


FS design analysis

6.2.2


Generic Safety Case



in Section

SO_APR_UNCTRL#14

Each pilot shall maintain visual separation with other A/C, in VMC conditions, during the instrument and visual flight phase of the PinS approach.

A/C certification



FS design analysis

6.2.2

SO_APR_UNCTRL#15

The instrument and visual segments of the PinS approach shall be designed to facilitate deceleration and landing.


FS design analysis

6.2.2

SO_APR_UNCTRL#16

Helicopters shall inform other A/C about their position and flight intent.

A/C certification



FS design analysis

6.2.2

SO_APR_UNCTRL#17

The PinS approach procedure shall be designed and promulgated to ensure separation from the prohibited airspace/restricted areas in the vicinity of the heliport/landing


FS design analysis

6.2.2

SO_APR_UNCTRL#18

Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS approach.


FS design analysis

6.2.2

SO_APR_UNCTRL#19

Helicopters shall be informed of the forecasted MET conditions at destination heliport/landing location.


FS design analysis

6.2.2

SO_APR_UNCTRL#20

Helicopters shall be informed of the forecasted MET conditions at alternate heliport.


FS design analysis

6.2.2

SO_APR_UNCTRL#21

In case of loss of RNP navigation during instrument segment of the PinS approach, the pilot shall revert to contingency procedures and inform other aircraft and if applicable the Aerodrome Flight Information Service in uncontrolled airspace.


FS design analysis

6.1.3


Generic Safety Case



in Section

SO_APR_UNCTRL#22

In case of loss of communication in uncontrolled airspace, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications.


FS design analysis

6.2.3

SO_APR_UNCTRL#23

In case of icing conditions in uncontrolled airspace, a contingency procedure shall be defined considering the operational environment of the PinS approach.


FS design analysis

6.2.3

SO_APR_UNCTRL#24

In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR” operation in uncontrolled airspace, then, the pilot shall apply VFR contingency procedures (as currently done in VFR) and inform other aircraft as soon as possible.


FS design analysis

6.2.3

SO_APR_UNCTRL#25

In case of degradation of visibility conditions during the visual segment of a PinS “proceed visually” operation in uncontrolled airspace, the pilot shall apply contingency procedures considering the operational environment of the PinS approach and inform other aircraft as soon as possible.


FS design analysis

6.2.3

SO_APR_UNCTRL#27

Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS approach instrument segment towards terrain, in uncontrolled airspace, leading to imminent CFIT shall not be greater than 1X10-7 per flight hour.



Generic Safety Case



in Section

SO_APR_UNCTRL#28

Frequency of occurrence of helicopters deviating laterally or vertically from expected PinS approach instrument segment towards other aircraft, in uncontrolled airspace, leading to imminent collision with other traffic shall not be greater than 1X10-5 per flight hour.


SO_APR_UNCTRL#29

Frequency of occurrence of other aircraft flying towards helicopters established on the PinS approach instrument segment, in uncontrolled airspace, leading to imminent collision shall not be greater than 1X10-5 per flight hour.


SO_APR_UNCTRL#30

Frequency of occurrence of helicopters deviating from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” approach, in uncontrolled airspace, leading to imminent CFIT shall not be greater than 1X10-7 per flight hour.


SO_APR_UNCTRL#31

Frequency of occurrence of helicopters deviating from expected flight path, towards other aircraft, during visual segment of the PinS “proceed visually” approach, in uncontrolled airspace, leading to imminent collision with other traffic shall not be greater than 1X10-5 per flight hour.


SO_APR_UNCTRL#32

Frequency of occurrence of helicopters failing to decelerate and/or prepare landing during the visual segment of the PinS approach leading to unstable approach in uncontrolled airspace shall be not greater than 1x10-4 per flight.


Table 5-14. Safety Objectives validation table - PinS departure operations in uncontrolled airspace


Generic Safety Case

6 Safety assessment- Design level

The design analysis of the Functional System enabling the PinS helicopter operations is a major tool for validating the design from a safety perspective i.e. ensuring that a correct and complete set of Safety Requirements has been derived such as all the Safety Objectives addressing the Functional System are fulfilled. The design analysis is performed:

for Normal operations: see section 6.1.2 for PinS departure and approach operations in controlled airspace and 6.2.2 for PinS departure and approach operations in uncontrolled airspace.

for Abnormal operations: see section 6.1.3 for PinS departure and approach operations in controlled airspace and 6.2.3 for PinS departure and approach operations in uncontrolled airspace.

and for Faulted operations: see section 6.1.4 for PinS departure and approach operations in controlled airspace and 6.2.4 for PinS departure and approach operations in uncontrolled airspace).

The design analysis is supported by a logical model of the PinS Functional System. The logical model of PinS operations in controlled and uncontrolled airspace are respectively described in sections 6.1.1 and 6.2.1.

6.1 Functional System design analysis in Controlled airspace

6.1.1 PinS Functional System logical model

The PinS Functional System applicable to PinS departure and approach operations can be modelled via a high-level architectural representation of the main elements (people, equipment and procedures) performing the PinS helicopter operations as per Figure 6-1 and addressing all domains (all sub-arguments of Argument 2 – see section 4.4).

The symbols used in the Logical model are as follows:

xxx

xxx

xxx

xxx

Set of operational nodes associated to

a domain (e.g. aircraft, ANSP )

System / service node. Could be machine based

or combination of machine and human

Human node

Optional node

xxx

On demand needline. « Xxx » the name of

the information.

Continuous needline. « Xxx » the name of

the information.


Generic Safety Case

Figure 6-1: PinS departure and approach Controlled Functional System logical model

Flight Procedure

Design

Flight procedure verification & validation

05: Proc verification andvalidation

GPS Service

Provider

SBAS Service

ProviderAIS Provider

06: PinS Procedure (incl. MA

procedure)

Flight Crew

RNAV sub-system

Flight Control & Display sub-

system

Conv nav sub-

system

Altitude sub-

system

HTAWS

01: GPS Signal

40: Conv Nav data

03: SBAS SIgnal

VFR A/C

IFR A/C

Flight Planning

MET provider

Nav DB integrator & packer

ATCo

Surv sub-system

Flight Inspection

Helicopter operator

Traffic advisory system

25: PinS Clearance26: ATC tactical clearance

27: QNH28: ATC Control29: Traffic Info

30: MET update

24: Surv data

02: GPS status

04: SBAS status

23: GNSS Signal verification

Heliport / landing location

08: PinS chart10: RAIM NOTAM11: SBAS NOTAM

08: PinS chart(incl. MA)

09: AIP/AIC10: RAIM NOTAM11: SBAS NOTAM

08: PinS chart (inc. MA)

09: AIP/AIC

13: Nav database

14: PinS chart(incl. MA)


18: Flight Operation procedures and training19: MET info

48: Operating minima

46: MET info

46: MET info

22: Approved FPL

31: ATC Control

32: Appropriate Air Traffic Service depending on airspace class

22: Approved FPL

21: FPL request

47: Platform visual information

44: See and avoid

41: Traffic Alert

38: QNH setting

39: Altitude

34: RNAV Nav data

35: H/C pos ition

33: PinS selection

36: Display & guidance selection

07: Aeronautical data

37: Display & guidance

data

45: Electronic detection

20: Nav Database

49: See and avoid(only for proceed VFR)

50: Obstable alert

42: Readback43: Specific request


Generic Safety Case

Edition: 1.4 Page 103

The following table describes the Logical Model operational information.

item # Information Sending node

Receiving node Usage(receiving node)

GNSS Signal Service Provision

01 GPS Signal GPS service provider

RNP helicopter subsystem

To receive and decode GPS satellite signal

02 GPS Status GPS service provider

AIS Provider or (RNAV sub-system)

To be informed on the status of the GPS navigation infrastructure (GPS satellite)

To elaborate RAIM availability predictions when necessary

Note : some RNAV subsystem are directly able to predict RAIM availability based on GPS status message

03 SBAS Signal (if SBAS required)

SBAS RNP helicopter subsystem

To receive and decode SBAS signal

04 SBAS Status (if SBAS required)

SBAS AIS Provider To be informed on the status of the SBAS navigation infrastructure

To receive SBAS NOTAM proposal

Flight Procedure Design (FPD) Service Provider

05 Procedure verification and validation

Flight Procedure Verification and Validation

Flight procedure design

To verify that procedure has been designed in accordance with design criteria

To validate the flyability of the procedure

06 PinS Procedure (including missed approach procedure)

Flight Procedure design

AIS Provider

To obtain all data relevant for the aeronautical information publication (PinS chart and coding proposal)

Flight inspection To assess GNSS signal performance along the trajectory

AIS Provider

07 Aeronautical data

AIS Provider Flight Procedure design

To obtain all relevant validated aeronautical data in order to design the procedure (i.e. obstacle data, heliport coordinates, other surrounding instrument flight procedures…)

08

PinS Chart and coding proposal (including missed approach chart)

AIS Provider

Helicopter Operator

To be informed on the depiction/characteristics of the PinS procedure

NavDB Integrator

& packer

ATCO

09 AIP/AIC AIS Provider Aircraft Operator To be informed of generic PinS procedure requirements (operational limitation, required approval and certification, etc…)

NavDB Integrator

& packer

10 RAIM AIS Provider Aircraft Operator Only if SBAS is not used


Generic Safety Case




NOTAM ATCO To be informed about the GPS RAIM availability on the PinS procedure

No requirement for the ATCO to use RAIM NOTAM

11 SBAS NOTAM

AIS Provider Aircraft Operator To be informed about the SBAS availability on the PinS procedure


SBAS NOTAM could be regional.

ATCO

DAT Provider

13 Nav Data Base

NavDB integrator

& packer

Helicopter Operator

To obtain the navigation database including all relevant data for the PinS procedure

Helicopter operator

14 PinS Chart Helicopter Operator

Flight Crew To obtain the PinS chart (paper or electronic) for the flight in accordance with the operator’s rule/format

15 AIP/AIC Helicopter Operator

Flight Crew To be informed of generic PinS procedure requirements (operational limitation, etc…) in accordance with the operator’s rule/format

16 RAIM NOTAM

Helicopter Operator

Flight Crew Required only if SBAS is not used

To be informed about the GPS RAIM availability on the PinS procedure in accordance with the operator’s rule/format

17 SBAS NOTAM

Helicopter Operator

Flight Crew To be informed about the SBAS availability on the PinS procedure in accordance with the operator’s rule/format

18 Flight operations procedures and training

Helicopter Operator

Flight Crew To be informed of appropriate procedures relevant for PinS operations including contingency procedures and to be trained on these normal and abnormal procedures

19 MET info Helicopter Operator

Flight Crew To be informed about the weather forecast on the PinS procedure in accordance with the operator’s rule/format

48 Operating Minima

Helicopter Operator

Flight Crew To check that operating minima for the PinS operations are obtained

20 Nav Data Base

Helicopter Operator

RNP aircraft Subsystem

To load the Navigation Data Base in the RNAV/FMS system in order to fly the PinS procedure appropriately

21 FPL request Helicopter Operator

Flight Planning To approve the aircraft operator flight plan including the PinS departure and/or approach

Network Manager (NM)

22 Approved FPL

Flight Planning

Aircraft Operator To be informed on the status of the submitted flight plan


Generic Safety Case




ATCO To be informed on the helicopter flight plan including the PinS departure and/or approach

ATSP

23 GNSS Signal verification

Flight Inspection


To verify the GPS and SBAS signal on the PinS procedure (e.g. absence of permanent jamming…)

24 Surveillance information

Surveillance sub-system

ATCO To obtain surveillance information from IFR flight and VFR flight when required

To separate Aircraft under control

25 Clearance ATCO Flight Crew To respect ATC clearances for the PinS

26 Tactical Clearances

ATCO Flight Crew To respect ATC instructions on the PinS procedure (e.g.vectoring, altitude change, speed,..)

27 QNH ATCO Flight Crew To obtain QNH for the PinS approach

28 ATC control ATCO Flight Crew To separate helicopter on the PinS procedure from other controlled aircraft

29 Traffic information

ATCO Flight crew To obtain traffic information of other aircraft in the vicinity (only ATC known A/C)

30 MET update ATCO Flight crew To obtain updated MET info on the PinS procedure

31 ATC Control ATCO IFR A/C To separate IFR from IFR in airspace class C and D

To separate IFR from VFR in airspace class C

32 Appropriate Air Traffic Service depending on airspace class

ATCO VFR A/C To separate VFR from IFR in airspace class C

To provide traffic information about VFR flight in airspace class C and D

Helicopter

33 PinS selection

Flight Crew RNAV subsystem To select the PinS departure or approach procedure

34 RNAV nav Data

RNAV subsystem

Flight Control and Display

To display lateral and vertical (when applicable) deviation from the desired path and distance to next waypoint

To guide the aircraft respecting the lateral and vertical (when applicable) desired path

To raise alert in case of loss of position integrity and availability

35 Helicopter position data

RNAV subsystem

HTAWS To obtain precise aircraft position for the Terrain Awareness Warning System

50 Obstacle alert

HTAWS Flight crew To provide alert (advisory and/or warning) in case of detection of near CFIT


Generic Safety Case




36 Display and guidance selection

Flight Crew Flight Control and Display

To provide display and guidance mode in accordance with pilot’s selection.

37 Display and guidance data


Flight Crew To verify the PinS procedure to be flown


To monitor lateral and vertical (when applicable) deviation

To verify altitude

To be informed about alert/failure (flag)

38 QNH setting Flight Crew Altitude sub-system

To receive QNH setting for altitude computation/correction

39 Altitude Altitude sub-system


To display barometric altitude (pilot should apply any relevant correction for temperature as per basic airmanship)

40 Conv Nav data

Conventional navigation sub-system


To display Conventional navigation information when required by regulation (VOR, DME..)

41 Traffic Advisory System

Traffic Info Flight Crew To improve the situational awareness regarding other A/C in the vicinity

To take evasive manoeuvre

42 Readback Flight Crew ATCO To confirm pilot acknowledgment of ATC clearances/instructions

43 Specific request

Flight Crew ATCO To be informed about pilot’s request

44 See and Avoid

Flight Crew VFR A/C VFR A/C actively search for potential conflict and avoid collision with helicopters flying the PinS approach procedure

VFR A/C Flight Crew During visual segment “proceed VFR”, flight crew of the helicopter actively search for potential conflict and avoid collision with VFR aircraft in the vicinity

49 See and Avoid

IFR A/C Flight Crew During visual segment “proceed VFR”, flight crew of the helicopter actively search for potential conflict and avoid collision with IFR aircraft in the vicinity

45 Electronic A/C detection

VFR A/C Traffic Advisory System

To detect electronically other A/C in the vicinity of the helicopter

IFR A/C

MET Provider

46 MET Info MET provider Aircraft Operator To be informed about the weather forecast on the PinS procedure

ATCO To be informed about the weather forecast on the airspace under its responsibility

Heliport / landing site operator

47 Heliport visual information

Heliport / Landing location

Flight Crew To provide sufficient FATO visual information and lighting for landing


Generic Safety Case


6.1.2 Derivation of Safety Requirements – Normal operations

Each of the Safety Objectives for Normal operations in controlled airspace (defined at section 5.2.1.1 for PinS departure and 5.2.2.1 for PinS approach) is mapped onto the PinS Functional System model in view of identifying the human, procedural or equipment elements that need to concur to the satisfaction of the safety objective and from there, to derive the appropriate Safety Requirements addressing those elements.

The detailed safety requirement derivation process is provided in ANNEX B – section B.1.1.1 for PinS departure and section B.2.1.1 for PinS approach.

6.1.3 Derivation of Safety Requirements –Abnormal operations

Taking advantage of the analysis of each Abnormal scenario, the Safety Objectives for Abnormal operations (defined at section 5.3.1 for PinS departure and 5.3.2 for PinS approach) are mapped onto the PinS Functional System model in view to derive the appropriate Safety Requirements addressing the Functional System elements that concur to the satisfaction of each safety objective.

The detailed safety requirement derivation process is provided in ANNEX B – section B.1.1.2 for PinS departure and section B.2.1.1 for PinS approach.

6.1.4 Derivation of Safety Requirements – Faulted operations

The objective of the Functional System design analysis under Faulted operations (PSSA) consists in determining how the system architecture (encompassing people, procedures, equipment) designed for PinS can be made safe in presence of internal system failures. For that purpose, the method consists in apportioning the Safety Objectives of each operational hazard into Safety Requirements to elements of the system driven by the analysis of the hazard causes.

Various methods are available to perform the causal analysis of the operational hazards.

One of them is the Fault tree analysis, used to identify the causes of hazards and combinations thereof, to assess the frequency of occurrences of the hazards (based on the knowledge on the frequency of occurrences of the hazard causes and the effectiveness of the mitigations) and ultimately to derive, if necessary, additional mitigations for preventing the hazard occurrences. Fault trees have been produced for PinS hazards in controlled airspace and are presented in ANNEX C – section C.1.

For each operational hazard, the main causes have been submitted to the participants’ discussion & validation together with the existing mitigations allowing to prevent the hazard occurrences or to protect against the propagation of the hazard effects. When necessary (with regard to the severity allocated to the operational hazard within the workshop and the qualitative estimation of the hazard occurrences) additional mitigations have been derived as Safety Requirements for the Faulted operations.

These Safety Requirements have been consolidated, together with all the other safety requirements derived within this section 6 (addressing the safety assessment at the design level), in the next sub-section 6.1.5

6.1.5 Derived Safety Requirements in controlled airspace –consolidated view

6.1.5.1 Consolidated Safety Requirements for PinS departure in controlled airspace

The next Table 6-1 is consolidating the Safety Requirements derived within the Functional System design analysis of the PinS departure for Normal, Abnormal and Faulted operations. For each safety requirement, this table indicates:


Generic Safety Case


The domain to which the requirement applies (FPD, ATSP, AIS…)

The applicability to the types of PinS departure: proceed visually, proceed VFR or both

The ID of the safety objective at the origin of the requirement

SR ID & description Domain Applicability Ref. SO ID

SR_DEP_CTRL#1: The flight procedure design shall, as far as practicable, ensure strategic separation between PinS departure procedures and between PinS departure and other procedures considering navigation performance and airspace constraints (sector size, other trajectories in the vicinity, restricted areas…)…

FPD Both SO_DEP_CTRL#1

SR_DEP_CTRL#2: The flight procedure design shall take into account ATC constraints such as separation minima, traffic density, sector size and controller procedures / HMI


SR_DEP_CTRL#3: The flight crew shall request to the controller the PinS take-off and departure clearance, prior to departure, when flying a “proceed visually” departure procedure.

Helicopter Proceed visually

SO_DEP_CTRL#2

SR_DEP_CTRL#4: The flight crew shall coordinate with ATC, before take off, about the Estimated Time of Departure (ETD) when flying a “proceed VFR” departure procedure.

Helicopter Proceed VFR SO_DEP_CTRL#2

SR_DEP_CTRL#5: The ATC controller shall give a PinS take-off and departure clearance to the flight crew, prior to departure, when flying a “proceed visually” departure procedure.

ATSP Proceed visually

SO_DEP_CTRL#2

SR_DEP_CTRL#6: The aeronautical, terrain and obstacle data used in the design of the helicopter PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SO_DEP_CTRL#12

SR_DEP_CTRL#7: The PinS departure procedure (i.e. visual segment when applicable, instrument segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.

FPD Both

SO_DEP_CTRL#6 SO_DEP_CTRL#9

SO_DEP_CTRL#12

SR_DEP_CTRL#8: The verification and validation of the PinS departure procedure shall be made in accordance with the quality process specified in ICAO Doc 9906

FPD Both


SO_DEP_CTRL#12

SR_DEP_CTRL#9: The PinS departure procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate the required aircraft navigation capability to fly the procedure (e.g. RNP1 or RNP0.3).

AIS Both


SO_DEP_CTRL#12

SR_DEP_CTRL#10: The AIS provider shall define the naming and phraseology associated with the PinS departure in accordance with ICAO rule to ensure consistency between operator (FMS, phraseology) and ATS (Phraseology).

AIS Both

SO_DEP_CTRL#6

SR_DEP_CTRL#11: The AIS provider shall inform airspace users (e.g. through AIC) about the implementation of a PinS departure and the possible increase of IFR traffic in the the vicinity of the heliport / departure location.

AIS Both

SO_DEP_CTRL#6

SR_DEP_CTRL#12: The promulgation of PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.

AIS Both


SR_DEP_CTRL#13: The flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS “proceed visually” departure chart. For proceed visually with direct segment, lateral and vertical path are indicated on the chart.


SO_DEP_CTRL#7


Generic Safety Case



SR_DEP_CTRL#14: The procedure designer shall depict the relevant obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart.

FPD Proceed visually

SO_DEP_CTRL#8

SR_DEP_CTRL#15: The procedure designer shall depict, on the PinS “proceed VFR” chart, the relevant obstacles in the vicinity of the heliport or departure location.

FPD Proceed VFR SO_DEP_CTRL#8

SR_DEP_CTRL#16 : The ATC controller shall give appropriate speed and altitude instructions to the flight crews if needed to facilicate the transition between the visual flight phase and the instrument flight phase (i.e. to facilitate the compliance with published altitude or speed constraints).

ATSP Both SO_DEP_CTRL#9

SR_DEP_CTRL#17: The helicopter operator shall determine the operating minima applicable for the PinS departure operations in accordance with AIR OPS.

Helicopter operator

Both SO_DEP_CTRL#10

SR_DEP_CTRL#18: The flight Crew shall monitor if the visual references are maintained during visual flight phase until reaching the IDF at or above IDF MCA.

Helicopter Both SO_DEP_CTRL#10

SR_DEP_CTRL#19: The flight crew shall perform transition to instrument segment when reaching the IDF at or above the IDF MCA. Helicopter Both SO_DEP_CTRL#10

SR_DEP_CTRL#20: The flight crew shall request to Controller the PinS departure clearance at or prior the IDF, when flying a “proceed VFR” departure procedure.

Helicopter Proceed VFR SO_DEP_CTRL#10

SR_DEP_CTRL#21: The ATC controller shall give a PinS departure clearance to the flight crew at or prior the IDF, when flying a “Proceed

VFR” departure procedure.

ATSP Proceed VFR SO_DEP_CTRL#10

SR_DEP_CTRL#22: The helicopter’s operator shall define a contingency procedure for the case of degradation of visibility conditions leading to a loss of the required visual reference, during the visual segment of a PinS departure.

Helicopter operator

Proceed Visually

SO_DEP_CTRL#11

SR_DEP_CTRL#23: In case of loss of the required visual reference before reaching the IDF, the flight crew shall respect the helicopter operator’s contingency procedures and inform the controller as soon as possible.


SR_DEP_CTRL#24: The GNSS signal in space (GPS and SBAS if required) shall be compliant with ICAO Annex 10 SARPS on the PinS departure procedure.

GNSS/SBAS service provider

Both SO_DEP_CTRL#13

SR_DEP_CTRL#25: The flight crew shall not modify the PinS procedure stored in the navigation database as defined in AIR OPS. Helicopter Both SO_DEP_CTRL#13

SR_DEP_CTRL#26: The flight crew shall select the PinS departure procedure in the RNAV system’s flight plan. Helicopter Both SO_DEP_CTRL#13

SR_DEP_CTRL#27: The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument segment of the PinS departure procedure.


SR_DEP_CTRL#28: The ATC controller shall provide the QNH

information to the flight crew for the helicopter PinS departure. ATSP Both SO_DEP_CTRL#14

SR_DEP_CTRL#29: The PinS departure chart shall specify the QNH source (local or remote). FPD Both SO_DEP_CTRL#14

SR_DEP_CTRL#30: The flight procedure designer shall take into account appropriate margins when using remote QNH, as defined in PANS OPS.



Generic Safety Case



SR_DEP_CTRL#31: The State / ANSP shall define a departure site indicator/identifier allocation scheme for any departure site without an ICAO code.

ATSP / State Both SO_DEP_CTRL#15

SR_DEP_CTRL#32: If not exempted, the Helicopter Operator shall submit the flight plan to the Network Manager including the PinS departure.


SR_DEP_CTRL#33: The local ATS or Network Manager shall be able to validate the helicopter flight plan including PinS departure procedure.

NM/ATSP Both SO_DEP_CTRL#15

SR_DEP_CTRL#34: The flight procedure design shall take into account the transition between PinS departure and the low level route or other existing routes/SID/STAR (RNP values, altitudes, speed constraints, waypoints).


SR_DEP_CTRL#35: The ATC controller shall give appropriate clearance (speed and altitude) if needed to facilitate the transition between the PinS departure and the low level route or other existing routes/SID/STAR (i.e. to facilitate the compliance with published

altitude or speed constraints).

ATSP Both SO_DEP_CTRL#19

SR_DEP_CTRL#36: The flight crew shall comply with constraints published on the flight procedure and with the ATCO clearance relating to the transition between the Pins departure and the low level route (or other existing routes/SID/STAR).


SR_DEP_CTRL#37: The Flight Control and Display sub-system shall display an appropriate full scale deflection during the transition between the PinS departure and the low level route (or other existing routes/SID/STAR/approach) to avoid disturbance of the flight crew.


SR_DEP_CTRL#38: The procedure designer shall be provided with data relating to prohibited and restricted areas in the vicinity of the heliport / departure location.

FPD AIS

Both SO_DEP_CTRL#21

SR_DEP_CTRL#39: The procedure designer shall, as far as practicable, ensure strategic separation between the PinS departure and the prohibited and restricted areas in the vicinity of the heliport / departure location.


SR_DEP_CTRL#40: The PinS departure chart shall clearly indicate the prohibited/restricted areas in the vicinity of the route.

FPD AIS

Both SO_DEP_CTRL#23

SR_DEP_CTRL#41: Local MET information at the departure heliport/departure location shall be provided to the ATCO and helicopter operator. This local MET information can be provided either by an aeronautical meteorological service compliant with ICAO Annex 3 at destination or an equivalent meteorological service with approval from local Competent Authority or an aeronautical meteorological service compliant with ICAO Annex 3 at neighboring airport with approval from local Competent Authority.

MET provider Both SO_DEP_CTRL#24

SR_DEP_CTRL#42: Local MET information shall include at the minimum the following information: visibility, ceiling and QNH. MET provider Both SO_DEP_CTRL#24

SR_DEP_CTRL#43: The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on the PinS departure and considering the local environment.

Helicopter operator

Both SO_DEP_CTRL#25


Generic Safety Case



SR_DEP_CTRL#44: In case of loss of RNP capability on the PinS departure procedure, the flight crew shall respect the helicopter operator’s contingency procedures (e.g. conventional navigation or dead reckoning).


SR_DEP_CTRL#45: The flight crew shall inform controller about the loss of RNP capability on the PinS departure procedure and about the

contingency procedure.


SR_DEP_CTRL#46: The helicopter operator shall define a contingency procedure adapted to the operational environment in case of icing conditions encountered on the PinS departure.

Helicopter operator

Both SO_DEP_CTRL#27

SR_DEP_CTRL#47: In case of icing conditions on the PinS departure procedure, flight crews shall respect the helicopter operator’s contingency procedures.


SR_DEP_CTRL#48: The AIS provider shall verify the consistency between the PinS procedure validated by procedure design and the proposal to be published.

AIS Both

SO_DEP_CTRL#28 SO_DEP_CTRL#29 SO_DEP_CTRL#31 SO_DEP_CTRL#32

SR_DEP_CTRL#49: The flight crew shall verify the consistency between the PinS departure procedure on the chart and the aircraft display (FPLN, ND…).

Helicopter Both SO_DEP_CTRL#28 SO_DEP_CTRL#29

SR_DEP_CTRL#50: The flight crew shall be trained on RNAV navigation, PinS departure procedure and associated contingency procedures. Helicopter Both

SO_DEP_CTRL#28 SO_DEP_CTRL#29 SO_DEP_CTRL#30 SO_DEP_CTRL#31 SO_DEP_CTRL#32

SR_DEP_CTRL#51: The ATC controllers shall be briefed on the RNAV navigation and on helicopter PinS departure procedure.

ATSP Both

SO_DEP_CTRL#28 SO_DEP_CTRL#29 SO_DEP_CTRL#30 SO_DEP_CTRL#31 SO_DEP_CTRL#32

SR_DEP_CTRL#52: In radar environment, the PinS departure procedure shall be displayed, on demand, on the controller working position to facilitate the detection of deviation from the expected trajectory and the recognition of a potential conflict.

ATSP Both SO_DEP_CTRL#29 SO_DEP_CTRL#32

SR_DEP_CTRL#53: In radar environment, the radar display shall provide an adequate traffic picture to depict IFR aircraft and VFR aircraft equipped with transponder on the PinS departure and in the vicinity of the PinS procedure.

Helicopter Both SO_DEP_CTRL#29 SO_DEP_CTRL#32

SR_DEP_CTRL#54: The PinS departure shall be clearly depicted on VFR charts to inform pilots of helicopter traffic in this area. AIS Both SO_DEP_CTRL#30

SR_DEP_CTRL#55. The heliport or landing location where PinS departure “proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14 Vol II applicable to non-instrument heliport/landing location (physical characteristics, obstacle environment, visual aids,..)...

Heliport operator

Proceed Visually

SO_DEP_CTRL#9

SR_DEP_CTRL#56. The heliport or landing location where PinS departure “proceed VFR” are performed shall not require any additional requirements compared to VFR departure conducted on this heliport/landing location (physical characteristics, obstacle environment, visual aids,..)..

Heliport operator

Proceed VFR SO_DEP_CTRL#9

Table 6-1. Consolidated list of safety requirements for PinS departure in controlled airspace


Generic Safety Case


6.1.5.2 Consolidated Safety Requirements for PinS approach in controlled airspace

The next Table 6-2 is consolidating the Safety Requirements derived within the Functional System design analysis of the PinS approach for Normal, Abnormal and Faulted operations. For each safety requirement, this table indicates:


The applicability to the types of PinS approach: proceed visually, proceed VFR or both



SR_APR_CTRL#1: The flight procedure design shall, as far as practicable, ensure strategic separation between PinS approaches procedures and between PinS approach and other procedures considering navigation performance and airspace constraints (sector size, other trajectories in the vicinity, restricted areas…)…

FPD Both SO_APR_CTRL#1

SR_APR_CTRL#2: The flight procedure design shall take into account ATC constraints such as separation minima, traffic density, sector

size, controller procedures / HMI… FPD Both SO_APR_CTRL#1

SR_APR_CTRL#3: When applicable, the flight procedure design shall take into account the transition between the low level route (or other existing routes/SID/STAR) and the PinS approach (RNP values, altitudes, speed constraints, waypoints).


SR_APR_CTRL#4: The ATC controller shall give appropriate clearance when needed to facilitate the transition between the low level route (or other existing routes/SID/STAR) and the PinS approach (i.e. to facilitate the compliance with published altitude or speed

constraints).

ATSP Both SO_APR_CTRL#3

SR_APR_CTRL#5: The flight crew shall comply with constraints published on the flight procedure and with the ATCO clearance relating to transition between the low level route (or other existing routes/SID/STAR) and the PinS approach.

Helicopter Both SO_APR_CTRL#3

SR_APR_CTRL#6: The Flight Control and Display sub-system shall display an appropriate full scale deflection during transition between the low level route (or other existing routes/SID/STAR) and the PinS approach to avoid disturbance of the flight crew.


SR_APR_CTRL#7: The aeronautical, terrain and obstacle data used in the design of the helicopter PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SO_APR_CTRL#14

SR_APR_CTRL#8: The PinS approach procedure (i.e. initial approach segment, intermediate approach segment, final approach segment, missed approach and, if applicable visual segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.

FPD Both

SO_APR_CTRL#4 SO_APR_CTRL#10 SO_APR_CTRL#11 SO_APR_CTRL#14 SO_APR_CTRL#21

SR_APR_CTRL#9: The verification and validation of the PinS approach procedure shall be made in accordance with the quality process specified in ICAO Doc 9906.

FPD Both

SO_APR_CTRL#4 SO_APR_CTRL#10 SO_APR_CTRL#11 SO_APR_CTRL#14


Generic Safety Case



SR_APR_CTRL#10: The PinS approach procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate in particular the OCA/H and the required aircraft navigation capability to fly the procedure (e.g. RNP APCH).

AIS Both


SR_APR_CTRL#11: The AIS provider shall define the naming and phraseology associated with the PinS approach in accordance with ICAO rules to ensure consistency between operator (FMS, phraseology) and ATS (Phraseology).

AIS Both SO_APR_CTRL#4

SR_APR_CTRL#12: The AIS provider shall inform airspace users (e.g. through AIC) about the implementation of a PinS approach and the possible increase of IFR traffic in the the vicinity of the heliport / landing location.

AIS Both SO_APR_CTRL#4

SR_APR_CTRL#13: The promulgation of a PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.

AIS Both


SR_APR_CTRL#14: The GNSS signal in space (GPS and SBAS if required) shall be compliant with ICAO Annex 10 SARPS on the PinS approach procedure.


Both SO_APR_CTRL#5

SR_APR_CTRL#15: The flight crew shall not modify the PinS procedure stored in the navigation database as defined in AIR OPS. Helicopter Both SO_APR_CTRL#5

SR_APR_CTRL#16: The flight crew shall select the PinS approach procedure in the RNAV system’s flight plan. Helicopter Both SO_APR_CTRL#5

SR_APR_CTRL#17: The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument segment of the PinS approach procedure.


SR_APR_CTRL#18: The ATC controller shall provide the QNH

information to the flight crew for the helicopter PinS approach. ATSP Both SO_APR_CTRL#6

SR_APR_CTRL#19: The PinS approach chart shall specify the QNH source (local or remote) to be used

FPD AIS

Both SO_APR_CTRL#6

SR_APR_CTRL#20: The flight procedure designer shall take into account appropriate margins when using remote QNH, as defined in PANS OPS.


SR_APR_CTRL#21: The flight crew shall set the appropriate QNH (local QNH or remote QNH) for the PinS approach.


SR_APR_CTRL#22: The State / ANSP shall define a landing site indicator/identifier allocation scheme for any landing site without an ICAO code.


SR_APR_CTRL#23: If not exempted, the helicopter operator shall submit the flight plan to the Network Manager including the PinS approach.

Helicopter operator

Both SO_APR_CTRL#7

SR_APR_CTRL#24: The local ATS or Network Manager shall be able to validate the helicopter flight plan including the PinS approach procedure.

ATSP / NM Both SO_APR_CTRL#7

SR_APR_CTRL#25: The flight crew shall request to the controller for the clearance to initiate the PinS approach. Helicopter Both

SO_APR_CTRL#8 SO_APR_CTRL#17


Generic Safety Case



SR_APR_CTRL#26: The ATC controller shall give a clearance to the

flight crew to initiate the PinS approach. ATSP Both SO_APR_CTRL#8

SO_APR_CTRL#17

SR_APR_CTRL#27: The ATC controller shall give appropriate speed and altitude instructions to the flight crew if needed to facilitate the transition between the instrument flight phase and the visual flight phase (i.e. to facilitate the compliance with published altitude or speed constraints).


SR_APR_CTRL#28: The helicopter operator shall determine the operating minima applicable for the PinS approach operations in accordance with AIR OPS.

Helicopter operator

Both SO_APR_CTRL#12

SR_APR_CTRL#29: The flight crew shall check, during flight, before starting the PinS approach (i.e. before IAF), if the latest visibility conditions at destination – and, if different, in the vicinity of the approach -are compliant with operating minima.


SR_APR_CTRL#30: The flight crew shall abort the PinS approach and plan another approach if the predicted visibility conditions at destination are not compliant with operating minima.


SR_APR_CTRL#31: The heliport or landing location where PinS approach “proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14 Vol II applicable to non-instrument heliport (physical characteristics, obstacle environment, visual aids,..).

Heliport operator

Proceed visually

SO_APR_CTRL#12

SR_APR_CTRL#32: The heliport or landing location where PinS approach “proceed VFR” are performed shall not require additional requirements compared to VFR approach conducted on this heliport/landing location (physical characteristics, obstacle environment, visual aids,..).

Heliport operator

Proceed VFR SO_APR_CTRL#12

SR_APR_CTRL#33: The flight procedure design shall take into account the flight validation’s feedback during the flight validation, in particular for the definition of the appropriate visual references associated with the heliport or landing location.


SO_APR_CTRL#12

SR_APR_CTRL#34: The procedure designer shall depict, on the PinS “proceed visually” chart, visual references associated with the heliport or landing location.


SO_APR_CTRL#12

SR_APR_CTRL#35: The flight crew shall perform the transition to the visual segment “proceed visually” if the heliport (or landing location) or direct visual references associated with it can be acquired at or prior the MAPt.


SO_APR_CTRL#12

SR_APR_CTRL#36: The flight crew shall perform the transition to the visual segment “proceed VFR” if the applicable operating minima are obtained at or prior the MAPt.

Helicopter Proceed VFR SO_APR_CTRL#12

SR_APR_CTRL#37: The flight crew shall cancel the IFR flight when transitioning to the “proceed VFR” visual segment or after landed in accordance with local agreement.


SR_APR_CTRL#38: The flight crew shall perform a missed approach if the heliport (or landing location) or visual references associated with it cannot be acquired at or prior the MAPt of a “proceed visually” approach.


SO_APR_CTRL#13

SR_APR_CTRL#39: The flight crew shall perform a missed approach if the applicable operating minima are not obtained at or prior the MAPt of a “proceed VFR” approach.



Generic Safety Case



SR_APR_CTRL#40: The flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS “proceed visually” approach chart. For direct visual segment, lateral and vertical path are indicated on the chart.


SO_APR_CTRL#15

SR_APR_CTRL#41: The procedure designer shall depict the relevant obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart.


SO_APR_CTRL#16

SR_APR_CTRL#42: The procedure designer shall present the HAS (Height Above Surface), on the PinS “proceed VFR” chart. FPD Proceed VFR SO_APR_CTRL#16

SR_APR_CTRL#43: The procedure designer shall depict, on the PinS “proceed VFR” chart, the relevant obstacles in the vicinity of the visual segment.

FPD Proceed VFR SO_APR_CTRL#16

SR_APR_CTRL#44: The procedure designer shall be provided with data relating to prohibited and restricted areas in the vicinity of the heliport / landing location.

FPD AIS

Both SO_APR_CTRL#23

SR_APR_CTRL#45: The procedure designer shall, as far as practicable, ensure strategic separation between the PinS approach and the prohibited and restricted areas in the vicinity of the heliport / landing location.


SR_APR_CTRL#46: The PinS approach chart shall clearly indicate the prohibited/restricted areas in the vicinity of the route.

FPD AIS

Both SO_APR_CTRL#25

SR_APR_CTRL#47: Local MET information at the destination heliport/landing location shall be provided to the ATCO and helicopter operator. These local MET information can be provided either by: an aeronautical meteorological service compliant with ICAO Annex 3 at destination or, an equivalent meteorological service (e.g. based on Webcam or other dedicated tools) with approval from local Competent Authority or, an aeronautical meteorological service compliant with ICAO Annex 3 at neighboring airport with approval from local Competent Authority.

MET provider Both SO_APR_CTRL#26

SR_APR_CTRL#48: Local MET information shall include at the minimum the following information: visibility, ceiling and QNH. MET provider Both SO_APR_CTRL#26

SR_APR_CTRL#49: The ATC controller shall inform the flight crew about change of MET conditions at the destination heliport or landing

location. ATSP Both SO_APR_CTRL#26

SR_APR_CTRL#50: The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on the PinS approach and considering the local environment.

Helicopter operator

Both SO_APR_CTRL#28

SR_APR_CTRL#51: In case of loss of RNP capability on the PinS approach procedure, flight crews shall respect the helicopter operator’s contingency procedures (e.g. conventional navigation or dead reckoning).


SR_APR_CTRL#52: The flight crew shall inform the controller about the loss of RNP capability on the PinS approach procedure and about

the contingency procedure.


SR_APR_CTRL#53: The helicopter operator shall define a contingency procedure adapted to the operational environment for the case of icing conditions encountered on the PinS approach.

Helicopter operator

Both SO_APR_CTRL#30

SR_APR_CTRL#54: In case of icing conditions on the PinS approach procedure, flight crews shall respect the helicopter operator’s contingency procedures.



Generic Safety Case



SR_APR_CTRL#55: The helicopter operator shall define a contingency procedure for the case of degradation of visibility conditions, leading to a loss of the required visual reference, during the visual segment of a PinS “proceed visually” approach.

Helicopter operator

Proceed visually

SO_APR_CTRL#32

SR_APR_CTRL#56: In case of degradation of visibility conditions, leading to a loss of the required visual reference, during the visual segment of a PinS “proceed visually” approach, flight crews shall respect the helicopter operator’s contingency procedures and inform as soon as possible the controller.


SO_APR_CTRL#32

SR_APR_CTRL#57: ATC shall provide appropriate air traffic services, in accordance with airspace class and helicopter flight rules, in situation of peak of traffic, taking benefit of the published holdings if any.


SR_APR_CTRL#58: The AIS provider shall implement a quality assurance process to verify and validate the PinS approach procedure with the procedure designer, before publication.

AIS Both


SR_APR_CTRL#59: The flight crew shall verify the consistency between the PinS approach procedure on the chart and the aircraft display (FPLN, ND…)

Helicopter Both SO_APR_CTRL#34 SO_APR_CTRL#35

SR_APR_CTRL#60: The flight crew shall be trained on RNAV navigation, PinS approach procedure and associated contingency procedures

Helicopter Both

SO_APR_CTRL#34 SO_APR_CTRL#35 SO_APR_CTRL#36 SO_APR_CTRL#37 SO_APR_CTRL#38 SO_APR_CTRL#39

SR_APR_CTRL#61: The ATC Controllers shall be briefed on the RNAV navigation and on helicopter PinS approach procedure.

ATSP Both

SO_APR_CTRL#34 SO_APR_CTRL#35 SO_APR_CTRL#36 SO_APR_CTRL#37 SO_APR_CTRL#38 SO_APR_CTRL#39

SR_APR_CTRL#62: In radar environment, the PinS approach procedure shall be displayed, on demand, on the controller working position to facilitate the detection of deviation from the expected trajectory and the recognition of a potential conflict.

ATSP Both SO_APR_CTRL#35 SO_APR_CTRL#38

SR_APR_CTRL#63: In radar environment, the radar display shall provide an adequate traffic picture to depict IFR aircraft and VFR aircraft equipped with transponder on the PinS approach and in the vicinity of the PinS procedure.

ATSP Both SO_APR_CTRL#35 SO_APR_CTRL#38

SR_APR_CTRL#64: The PinS approach shall be clearly depicted on VFR charts to inform pilots of helicopter traffic in this area. AIS Both SO_APR_CTRL#36

Table 6-2. Consolidated list of safety requirements for PinS approach in controlled airspace

6.2 Functional System design analysis in uncontrolled airspace

6.2.1 PinS Functional System logical model

The PinS Functional System applicable to PinS departure and approach operations can be modelled via a high-level architectural representation of the main elements (people, equipment and procedures) performing the PinS helicopter operations as per Figure 6-2 and addressing all domains (all sub-arguments of Argument 2 –see section 4.4).


Generic Safety Case


The symbols used in the Logical model are as follows:

xxx

xxx

xxx

xxx

Set of operational nodes associated to

a domain (e.g. aircraft, ANSP )

System / service node. Could be machine based

or combination of machine and human

Human node

Optional node

xxx

On demand needline. « Xxx » the name of

the information.

Continuous needline. « Xxx » the name of

the information.


Generic Safety Case


Figure 6-2: PinS departure and approach Uncontrolled Functional System logical model

Flight Procedure

Design

Flight procedure validation

05: Proc validation

GPS Service

Provider

SBAS Service

Provider

AIS Provider

06: PinS Procedure (incl. MA

procedure)

Flight Crew

RNAV sub-system

Flight Control & Display sub-

system

Conv nav sub-

system

Altitude sub-

system

HTAWS

01: GPS Signal

42: Conv Nav data

03: SBAS SIgnal

VFR A/C

IFR A/C

MET provider

Nav DB integrator & packer

AFISo

Surv sub-system

Flight Inspection

Helicopter operator


28 : Information Request (VFRFISO)29: Flight information (FISOVFR)

30a: QNH30b: MET update

23: Surv data

02: GPS status04: SBAS status

22: GNSS Signal verification

Heliport / landing location

08: PinS chart(incl. MA chart)

10: RAIM NOTAM11: SBAS NOTAM




09: AIP/AIC

13: Nav database



18: Flight Operation procedures and training19: MET info

20: Operating minima49: MET info

49: MET info

26 : Information Request (VFRFISO)27: Flight information (FISOVFR)

24 : Information Request (VFRFISo)25: Flight information (FISOVFR)

50: Heliport/landing sitevisual information

45: See and avoid46 : Blind call (F/CVFR)

44: Traffic Alert

40: QNH setting

41: Altitude

35: RNAV Nav data

36: H/C pos ition

34: PinS selection

38: Display & guidance selection

07: Aeronautical data

39: Display & guidance

data

43: Electronic detection

21: Nav Database

47: See and avoid48 : Blind call (F/CIFR)

37: Obstable alert


Generic Safety Case


The following table describes the Logical Model operational information.



GNSS Signal Service Provision

01 GPS Signal GPS service provider

RNP helicopter subsystem

To receive and decode GPS satellite signal

02 GPS Status GPS service provider

AIS Provider or (RNAV sub-system)

To be informed on the status of the GPS navigation infrastructure (GPS satellite)

To elaborate RAIM availability predictions when necessary

Note : some RNAV subsystem are directly able to predict RAIM availability based on GPS status message

03 SBAS Signal (if SBAS required)

SBAS RNP helicopter subsystem

To receive and decode SBAS signal

04 SBAS Status (if SBAS required)

SBAS AIS Provider To be informed on the status of the SBAS navigation infrastructure

To receive SBAS NOTAM proposal

Flight Procedure Design (FPD) Service Provider

05 Procedure verification and validation

Flight Procedure Verification and Validation


To verify that procedure has been designed in accordance with design criteria

To validate the flyability of the procedure

06 PinS Procedure (including missed approach procedure)


AIS Provider

To obtain all data relevant for the aeronautical information publication (PinS chart and coding proposal)

Flight inspection To assess GNSS signal performance along the trajectory

AIS Provider

07 Aeronautical data

AIS Provider Flight Procedure design

To obtain all relevant validated aeronautical data in order to design the procedure (i.e. obstacle data, heliport coordinates, other surrounding instrument flight procedures…)

08

PinS Chart and coding proposal (including missed approach chart)

AIS Provider

Helicopter Operator

To be informed on the depiction/characteristics of the PinS procedure

NavDB Integrator

& packer

AFISO

09 AIP/AIC AIS Provider Aircraft Operator To be informed of generic PinS procedure requirements (operational limitation, required approval and certification, etc…)

NavDB Integrator

& packer

10 RAIM AIS Provider Aircraft Operator Only if SBAS is not used


Generic Safety Case




NOTAM AFISO To be informed about the GPS RAIM availability on the PinS procedure


11 SBAS NOTAM

AIS Provider Aircraft Operator To be informed about the SBAS availability on the PinS procedure


SBAS NOTAM could be regional.

ATCO

DAT Provider

13 Nav Data Base

NavDB integrator

& packer

Helicopter Operator

To obtain the navigation database including all relevant data for the PinS procedure

Helicopter operator

14 PinS Chart Helicopter Operator

Flight Crew To obtain the PinS chart (paper or electronic) for the flight in accordance with the operator’s rule/format

15 AIP/AIC Helicopter Operator

Flight Crew To be informed of generic PinS procedure requirements (operational limitation, etc…) in accordance with the operator’s rule/format

16 RAIM NOTAM

Helicopter Operator

Flight Crew Required only if SBAS is not used

To be informed about the GPS RAIM availability on the PinS procedure in accordance with the operator’s rule/format

17 SBAS NOTAM

Helicopter Operator

Flight Crew To be informed about the SBAS availability on the PinS procedure in accordance with the operator’s rule/format

18 Flight operations procedures and training

Helicopter Operator

Flight Crew To be informed of appropriate procedures relevant for PinS operations including contingency procedures and to be trained on these normal and abnormal procedures

19 MET info Helicopter Operator

Flight Crew To be informed about the weather forecast on the PinS procedure in accordance with the operator’s rule/format

20 Operating Minima

Helicopter Operator

Flight Crew To check that operating minima for the PinS operations are obtained

21 Nav Data Base

Helicopter Operator

RNP aircraft Subsystem

To load the Navigation Data Base in the RNAV/FMS system in order to fly the PinS procedure appropriately

ATSP

22 GNSS Signal verification

Flight Inspection


To verify the GPS and SBAS signal on the PinS procedure (e.g. absence of permanent jamming…)

23 Surveillance information

Surveillance sub-system

AFISO To obtain surveillance information from IFR flight and VFR flight (if equipped)


Generic Safety Case




24 Information request

VFR A/C AFISO To receive information request from VFR A/C (e.g. assistance)

25 Flight Information

AFISO VFR A/C To receive flight information if requested


IFR A/C AFISO To receive information request from IFR A/C (e.g. assistance)


AFISO IFR A/C To receive flight information if requested


Flight Crew AFISO To receive information request from helicopter flight crew (e.g. assistance)


AFISO Flight Crew To receive flight information if requested

30a QNH AFISO Flight Crew To obtain QNH for the PinS approach

30b MET update AFISO Flight Crew To obtain updated MET info on the PinS procedure

Helicopter

34 PinS selection

Flight Crew RNAV subsystem To select the PinS departure or approach procedure

35 RNAV nav Data

RNAV subsystem


To display lateral and vertical (when applicable) deviation from the desired path and distance to next waypoint

To guide the aircraft respecting the lateral and vertical (when applicable) desired path


36 Helicopter position data

RNAV subsystem

HTAWS To obtain precise aircraft position for the Terrain Awareness Warning System

37 Obstacle alert

HTAWS Flight crew To provide alert (advisory and/or warning) in case of detection of near CFIT

38 Display and guidance selection

Flight Crew Flight Control and Display

To provide display and guidance mode in accordance with pilot’s selection.

39 Display and guidance data


Flight Crew To verify the PinS procedure to be flown


To monitor lateral and vertical (when applicable) deviation

To verify altitude

To be informed about alert/failure (flag)

40 QNH setting Flight Crew Altitude sub-system

To receive QNH setting for altitude computation/correction

41 Altitude Altitude sub-system


To display barometric altitude (pilot should apply any relevant correction for temperature as per basic airmanship)

42 Conv Nav data

Conventional navigation sub-system


To display Conventional navigation information when required by regulation (VOR, DME..)


Generic Safety Case




43 Electronic A/C detection

VFR A/C Traffic Advisory System

To detect electronically other A/C in the vicinity of the helicopter

IFR A/C

44 Traffic Advisory System

Traffic Info Flight Crew To improve the situational awareness regarding other A/C in the vicinity

To take evasive manoeuvre

45 See and Avoid

Flight Crew VFR A/C Actively search for potential aircraft and avoid collision with aircraft in the vicinity

VFR A/C Flight Crew

46 Blind call Flight Crew VFR A/C To be informed about the IFR helicopter flight on the PinS

47 See and Avoid

IFR A/C Flight Crew Actively search for potential aircraft and avoid collision with aircraft in the vicinity

Flight Crew IFR A/C

48 Blind call Flight Crew IFR A/C To be informed about the IFR helicopter flight on the PinS

MET Provider

49 MET Info MET provider Aircraft Operator To be informed about the weather forecast on the PinS procedure

AFISO To be informed about the weather forecast on the airspace under its responsibility

Heliport / landing site operator

50 Heliport visual information

Heliport / Landing location

Flight Crew To provide sufficient FATO visual information and lighting for landing

6.2.2 Derivation of Safety Requirements – Normal operations

Each of the Safety Objectives for Normal operations in uncontrolled airspace (defined at section 5.2.1.2 for PinS departure and 5.2.2.2 for PinS approach) is mapped onto the PinS Functional System model in view of identifying the human, procedural or equipment elements that need to concur to the satisfaction of the safety objectives and from there, to derive the appropriate Safety Requirements addressing those elements.

The detailed safety requirements derivation process is provided in ANNEX B – section for B.1.2.1 PinS departure and section B.2.2.1 for PinS approach.

6.2.3 Derivation of Safety Requirements – Abnormal operations

Taking advantage of the analysis of each Abnormal scenario (performed at section 5.1.2), the Safety Objectives for Abnormal operations identified in that section are mapped onto the PinS Functional System model in view to derive the appropriate Safety Requirements addressing the Functional System elements that concur to the satisfaction of each safety objective.

The detailed safety requirements derivation process is provided in ANNEX B – section B.1.1.2 for PinS departure and B.1.2.2 for PinS approach.


Generic Safety Case


6.2.4 Derivation of Safety Requirements – Faulted operations

The objective of the Functional System design analysis under Faulted operations (PSSA) consists in determining how the system architecture (encompassing people, procedures, equipment) designed for PinS can be made safe in presence of internal system failures. For that purpose, the method consists in apportioning the Safety Objectives of each Operational hazard into Safety Requirements to elements of the system driven by the analysis of the hazard causes.

Various methods are available to perform the causal analysis of the operational hazards.

One of them is the Fault tree analysis, used to identify the causes of hazards and combinations thereof, to assess the frequency of occurrences of the hazards (based on the knowledge on the frequency of occurrences of the hazard causes and the effectiveness of the mitigations) and ultimately to derive, if necessary, additional mitigations for preventing the hazard occurrences. Fault trees have been produced for PinS hazards in uncontrolled airspace and are presented in ANNEX C – section C.2.

For each operational hazard, the main causes have been submitted to the Participants’ discussion & validation together with the existing mitigations allowing to prevent the hazard occurrences or to protect against the propagation of the hazard effects. When necessary (with regard to the severity allocated to the operational hazard within the workshop and the qualitative estimation of the hazard occurrences) additional mitigations have been derived as Safety Requirements for the Faulted operations.

These Safety Requirements have been consolidated, together with all the other safety requirements derived within this section 6 (addressing the safety assessment at the design level), in the next sub-section 6.2.5

6.2.5 Derived Safety Requirements – Consolidated view

6.2.5.1 Consolidated Safety Requirements for PinS departure in uncontrolled airspace





Note: Requirements in italics despite they are tagged as UNCTRL requirements are identical to requirements derived for the controlled airspace.


SR_DEP_UNCTRL#1: The flight procedure design shall, as far as practicable, ensure strategic separation between PinS departure procedures and between the PinS departure and other procedures considering navigation performance and airspace constraints (other trajectories in the vicinity, restricted areas…).…

FPD Both SO_DEP_UNCTRL#1

SR_DEP_UNCTRL#2: ATSPs shall ensure coordination between entities (e.g. FIS, ATCO, AFIS, heliport/departure site…) for the operational use of the PinS departure.

ATSP Both SO_DEP_UNCTRL#2

SR_DEP_UNCTRL#3: The AIS shall publish in the AIP the operational PinS usage restrictions if any.

AIS Both SO_DEP_UNCTRL#2


Generic Safety Case



SR_DEP_UNCTRL#4: The aeronautical, terrain and obstacle data used in the design of the helicopter PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.

FPD Both SO_DEP_UNCTRL#4 SO_DEP_UNCTRL#7

SO_DEP_UNCTRL#10

SR_DEP_UNCTRL#5: The PinS departure procedure (i.e. visual segment when applicable, instrument segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.


SO_DEP_UNCTRL#10

SR_DEP_UNCTRL#6: The verification and validation of the PinS departure procedure shall be made in accordance with the quality process specified in ICAO Doc 9906.


SO_DEP_UNCTRL#10

SR_DEP_UNCTRL#7: The PinS departure procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate the required aircraft navigation capability to fly the procedure (e.g. RNP1 or RNP0.3).

AIS Both SO_DEP_UNCTRL#4 SO_DEP_UNCTRL#7

SO_DEP_UNCTRL#10

SR_DEP_UNCTRL#8: The AIS provider shall define the naming and phraseology associated with the PinS departure in accordance with ICAO rule to ensure consistency between operator (FMS, phraseology) and ATS (Phraseology).


SR_DEP_UNCTRL#9: The AIS provider shall inform airspace users (e.g. through AIC) about the implementation of a PinS departure and the possible increase of IFR traffic in the the vicinity of the heliport / departure location.


SR_DEP_UNCTRL#10: The promulgation of the PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.

AIS Both SO_DEP_UNCTRL#4 SO_DEP_UNCTRL#7

SO_DEP_UNCTRL#10

SR_DEP_UNCTRL#11: The Flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS “proceed visually” departure chart. For proceed visually with direct segment, lateral and vertical path are indicated on the chart.

Helicopter Proceed visually SO_DEP_UNCTRL#5

SR_DEP_UNCTRL#12: The procedure designer shall depict the relevant obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart.

FPD Proceed visually SO_DEP_UNCTRL#6

SR_DEP_UNCTRL#13: The procedure designer shall depict, on the PinS “proceed VFR” chart, the relevant obstacles in the vicinity of the heliport or departure location.

FPD Proceed VFR SO_DEP_UNCTRL#6

SR_DEP_UNCTRL#14: The helicopter operator shall determine the operating minima applicable for the PinS departure operations in accordance with AIR OPS.

Helicopter operator

Both SO_DEP_UNCTRL#8

SR_DEP_UNCTRL#15: The flight Crew shall monitor if the visual references are maintained during visual flight phase until reaching the IDF at or above IDF MCA.

Helicopter Both SO_DEP_UNCTRL#8

SR_DEP_UNCTRL#16: The flight crew shall perform transition to instrument segment when reaching the IDF at or above the IDF MCA. Helicopter Both

SO_DEP_UNCTRL#8

SR_DEP_UNCTRL#17: The helicopter’s operator shall define a contingency procedure for the case of degradation of visibility conditions leading to a loss of the required visual reference, during the visual segment of a PinS departure.

Helicopter operator

Proceed Visually SO_DEP_UNCTRL#9


Generic Safety Case



SR_DEP_UNCTRL#18: In case of loss of the required visual reference before reaching the IDF, flight crew shall respect helicopter operator’s contingency procedures and inform the Aerodrome Flight Information Service Officer when available.


SR_DEP_UNCTRL#19: The GNSS signal in space (GPS and SBAS if required) shall be compliant with ICAO Annex 10 SARPS on the PinS departure procedure.



SR_DEP_UNCTRL#20: The flight crew shall not modify the PinS procedure stored in the navigation database as defined in AIR OPS. Helicopter Both SO_DEP_UNCTRL#11

SR_DEP_UNCTRL#21: The flight crew shall select the PinS departure procedure in the RNAV system’s flight plan. Helicopter Both SO_DEP_UNCTRL#11

SR_DEP_UNCTRL#22: The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument segment of the PinS departure procedure.


SR_DEP_UNCTRL#23: Wherever available, AFISO or departure site operator shall provide the local QNH information to the Flight Crew for the helicopter PinS departure.

ATSO Heliport operator


SR_DEP_UNCTRL#24: The PinS departure chart shall specify the QNH source (local or remote). FPD Both SO_DEP_UNCTRL#12

SR_DEP_UNCTRL#25: The flight procedure designer shall take into account appropriate margins when using remote QNH, as defined in PANS OPS.


SR_DEP_UNCTRL#26: If applicable, the flight procedure design shall take into account the transition between the PinS departure and the low level route or other existing routes/SID/STAR (RNP values, altitudes, speed constraints, waypoints).


SR_DEP_UNCTRL#27: The Flight Control and Display sub-system shall display an appropriate full scale deflection during transition between the PinS departure and the low level route (or other existing routes/SID/STAR) to avoid disturbance of the flight crew.


SR_DEP_UNCTRL#28: The flight crew shall comply with constraints published on the flight procedure relating to transition between the Pins departure and the low level route (or other existing routes/SID/STAR).


SR_DEP_UNCTRL#29: The flight crew established on the PinS departure shall transmit regularly their position and flight intent to inform other helicopters operating on the PinS departure and other aircraft flying in the vicinity of the PinS departure.


SR_DEP_UNCTRL#30: VFR or IFR pilots flying in the vicinity of the PinS departure shall transmit regularly their position and flight intent to inform helicopters established on the PinS departure.


SR_DEP_UNCTRL#31: A Radio Mandatory Zone (RMZ) shall be defined around the PinS departure in order to maintain continuous air-ground voice communication watch and establish two-way communication, as necessary, on the appropriate communication channel, unless it is shown that mitigating the risk of conflict between IFR and VFR is not required considering the airspace structure, traffic density, traffic complexity and the current level of safety associated to aircraft operations in this airspace.


SR_DEP_UNCTRL#32: The procedure designer shall be provided with data relating to prohibited and restricted areas in the vicinity of the heliport / departure location.

FPD AIS



Generic Safety Case



SR_DEP_UNCTRL#33: The procedure designer shall, as far as practicable, ensure strategic separation between the PinS departure and prohibited and restricted areas in the vicinity of the heliport / departure location.


SR_DEP_UNCTRL#34: The PinS departure chart shall clearly indicate the prohibited/restricted areas in the vicinity of the route.

FPD AIS


SR_DEP_UNCTRL#35: Local MET information at the departure heliport / departure location shall be provided to the AFISO, when available, and to the helicopter operator. This local MET information can be provided either by: an aeronautical meteorological service compliant with ICAO Annex 3 at destination airport or, an equivalent meteorological service not compliant with ICAO Annex 3 with approval from local Competent Authority or, an aeronautical meteorological service compliant with ICAO Annex 3 at neighboring

airport with approval from local Competent Authority.

MET provider Both SO_DEP_UNCTRL#18

SR_DEP_UNCTRL#36: Local MET information shall include at the minimum the following information: visibility, ceiling and QNH. MET provider Both SO_DEP_UNCTRL#18

SR_DEP_UNCTRL#37: The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on the PinS departure and considering the local environment.

Helicopter operator


SR_DEP_UNCTRL#38: In case of loss of RNP capability on the PinS departure procedure, flight crews shall respect the helicopter operator’s contingency procedures (e.g. conventional navigation or dead reckoning).


SR_DEP_UNCTRL#39: The helicopter operator shall define a contingency procedure adapted to the operational environment in case of icing conditions encountered on the PinS departure.

Helicopter operator


SR_DEP_UNCTRL#40: In case of icing conditions on the PinS departure procedure, flight crews shall respect the helicopter operator’s contingency procedures.


SR_DEP_UNCTRL#41: The AIS provider shall verify the consistency between the PinS procedure validated by procedure design and the proposal to be published.

AIS Both

SO_DEP_UNCTRL#22SO_DEP_UNCTRL#23SO_DEP_UNCTRL#25SO_DEP_UNCTRL#26

SR_DEP_UNCTRL#42: The flight crew shall verify the consistency between the PinS departure procedure on the chart and the aircraft display (FPLN, ND…)

Helicopter Both SO_DEP_UNCTRL#22SO_DEP_UNCTRL#23

SR_DEP_UNCTRL#43: The flight crew shall be trained on RNAV navigation, PinS departure procedure and associated contingency procedures. Helicopter Both

SO_DEP_UNCTRL#22SO_DEP_UNCTRL#23SO_DEP_UNCTRL#24SO_DEP_UNCTRL#25SO_DEP_UNCTRL#26

SR_DEP_UNCTRL#44: The PinS departure shall be clearly depicted on VFR charts to inform pilots of helicopter traffic in this area. AIS Both SO_DEP_UNCTRL#24

SR_DEP_UNCTRL#45: IFR helicopters flying the PinS departure in uncontrolled airspace shall be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this route (i.e. a traffic advisory system), unless it is shown that mitigating the risk of conflict with VFR and IFR is not required considering the airspace structure and the traffic density and complexity.



Generic Safety Case



SR_DEP_UNCTRL#46. The heliport or landing location where PinS departure “proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14 Vol II applicable to non-instrument heliports (physical characteristics, obstacle environment, visual aids,..)...

Heliport operator

Proceed Visually SO_DEP_UNCTRL#7

SR_DEP_UNCTRL#47. The heliport or landing location where PinS departure “proceed VFR” are performed shall not require additional requirements compared to VFR departure conducted on this heliport/landing location (physical characteristics, obstacle environment, visual aids,..).

Heliport operator

Proceed VFR SO_DEP_UNCTRL#7

Table 6-3. Consolidated list of safety requirements for PinS departure in uncontrolled airspace

6.2.5.2 Consolidated Safety Requirements for PinS approach in uncontrolled airspace







SR_APR_UNCTRL#1: The flight procedure design shall, as far as practicable, ensure strategic separation between PinS approaches procedures and between PinS approaches and other procedures considering navigation performance and airspace constraints (other trajectories in the vicinity, restricted areas…)…

FPD Both SO_APR_UNCTRL#1

SR_APR_UNCTRL#2: When applicable, the flight procedure design shall take into account the transition between the low level route (or other existing routes/SID/STAR) and the PinS approach (RNP values, altitudes, speed constraints, waypoints).


SR_APR_UNCTRL#3: The flight crew shall comply with constraints published on the flight procedure relating to transition between

the low level route (or other existing routes/SID/STAR) and the

PinS approach.

Helicopter Both SO_APR_UNCTRL#3

SR_APR_UNCTRL#4: The Flight Control and Display sub-system shall display an appropriate full scale deflection during transition between the low level route (or other existing routes/SID/STAR)

and the PinS approach to avoid disturbance of the flight crew.


SR_APR_UNCTRL#5: The aeronautical, terrain and obstacle data used in the design of the helicopter PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SO_APR_UNCTRL#10


Generic Safety Case



SR_APR_UNCTRL#6: The PinS approach procedure (i.e. initial approach segment, intermediate approach segment, final approach segment, missed approach and, if applicable visual segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.

FPD Both

SO_APR_UNCTRL#4 SO_APR_UNCTRL#7

SO_APR_UNCTRL#10 SO_APR_UNCTRL#15

SR_APR_UNCTRL#7: The verification and validation of the PinS approach procedure shall be made in accordance with the quality process specified in ICAO Doc 9906.

FPD Both SO_APR_UNCTRL#4 SO_APR_UNCTRL#7

SO_APR_UNCTRL#10

SR_APR_UNCTRL#8: The PinS approach procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate in particular the OCA/H and the required aircraft navigation capability to fly the procedure (e.g. RNP APCH).

AIS Both SO_APR_UNCTRL#4 SO_APR_UNCTRL#7

SO_APR_UNCTRL#10

SR_APR_UNCTRL#9: The AIS provider shall define the naming and phraseology associated with the PinS approach in accordance with ICAO rule to ensure consistency between operator (FMS, phraseology) and ATS (Phraseology).

AIS Both SO_APR_UNCTRL#4

SR_APR_UNCTRL#10: The AIS Provider shall inform airspace users (e.g. through AIC) about the implementation of a PinS approach and the possible increase of IFR traffic in the the vicinity of the heliport / landing location.

AIS Both SO_APR_UNCTRL#4

SR_APR_UNCTRL#11: The promulgation of a PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.

AIS Both SO_APR_UNCTRL#4 SO_APR_UNCTRL#7

SO_APR_UNCTRL#10

SR_APR_UNCTRL#12: The GNSS signal in space (GPS and SBAS if required) shall be compliant with ICAO Annex 10 SARPS on the PinS approach procedure.


Both SO_APR_UNCTRL#5

SR_APR_UNCTRL#13: The flight crew shall not modify the PinS procedure stored in the navigation database as defined in AIR OPS.


SR_APR_UNCTRL#14: The flight crew shall select the PinS approach procedure in the RNAV system’s flight plan. Helicopter Both SO_APR_UNCTRL#5

SR_APR_UNCTRL#15: The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument segment of the PinS approach procedure.


SR_APR_UNCTRL#16: Wherever available, the AFISO or landing site operator shall provide the local QNH information to the flight crew for the helicopter PinS approach.

ATSO Heliport operator


SR_APR_UNCTRL#17: The PinS approach chart shall specify the QNH source (local or remote) to be used.

FPD AIS


SR_APR_UNCTRL#18: The flight procedure designer shall take into account appropriate margins when using remote QNH, as defined in PANS OPS.


SR_APR_UNCTRL#19: The flight crew shall set the appropriate QNH (local QNH or remote QNH) for the PinS approach. Helicopter Both SO_APR_UNCTRL#6

SR_APR_UNCTRL#20: The helicopter operator shall determine the operating minima applicable for the PinS approach operations in accordance with AIR OPS.

Helicopter operator



Generic Safety Case



SR_APR_UNCTRL#21: The flight crew shall check, during flight, before starting the PinS approach (i.e. before IAF), if the latest visibility conditions at destination – and, if different, in the vicinity of the approach -are compliant with operating minima.


SR_APR_UNCTRL#22: The flight crew shall abort the PinS approach and plan another approach if the predicted visibility conditions at destination are not compliant with operating minima.


SR_APR_UNCTRL#23: The heliport or landing location where PinS approach “proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14 Vol II applicable to non-instrument heliports (physical characteristics, obstacle environment, visual aids,..)..

Heliport operator

Proceed visually SO_APR_UNCTRL#8

SR_APR_UNCTRL#24: The heliport or landing location where PinS approach “proceed VFR” are performed shall not require additional requirements compared to VFR approach conducted on this heliport/landing location (physical characteristics, obstacle environment, visual aids,..).

Heliport operator

Proceed VFR SO_APR_UNCTRL#8

SR_APR_UNCTRL#25: The flight procedure design shall take into account the flight validation’s feedback, in particular for the definition of the appropriate visual references associated with the heliport or landing location.


SR_APR_UNCTRL#26: The procedure designer shall depict, on the PinS “proceed visually” chart, visual references associated with the heliport or landing location.

FPD Proceed visually SO_APR_UNCTRL#8

SR_APR_UNCTRL#27: The flight crew shall perform the transition to the visual segment “proceed visually” if the heliport (or landing location) or direct visual references associated with it can be acquired at or prior the MAPt.

Helicopter Proceed visually SO_APR_UNCTRL#8

SR_APR_UNCTRL#28: The flight crew shall perform the transition to the visual segment “proceed VFR” if the applicable operating minima are obtained at or prior the MAPt.

Helicopter Proceed VFR SO_APR_UNCTRL#8

SR_APR_UNCTRL#29: The flight crew shall perform a missed approach if the heliport (or landing location) or visual references associated with it cannot be acquired at or prior the MAPt of a “proceed visually” approach.


SR_APR_UNCTRL#30: The flight crew shall perform a missed approach if the applicable operating minima are not obtained at or prior the MAPt of a “proceed VFR” approach.


SR_APR_UNCTRL#31: The flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS “proceed visually” approach chart. For “proceed visually” with direct segment, lateral and vertical path are indicated on the chart.


SR_APR_UNCTRL#32: The procedure designer shall depict the relevant obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart.

FPD Proceed visually SO_APR_UNCTRL#12

SR_APR_UNCTRL#33: The procedure designer shall present the HAS (Height Above Surface), on the PinS “proceed VFR” chart. FPD Proceed VFR SO_APR_UNCTRL#12

SR_APR_UNCTRL#34: The procedure designer shall depict, on the PinS “proceed VFR” chart, the relevant obstacles in the vicinity of the visual segment.

FPD Proceed VFR SO_APR_UNCTRL#12


Generic Safety Case



SR_APR_UNCTRL#35: ATSPs shall ensure coordination between entities (e.g. FIS, ATCO, AFIS, heliport/landing site…) for the operational use of the PinS approach.

ATSP Both SO_APR_UNCTRL#13

SR_APR_UNCTRL#36: The AIS shall publish in the AIP the operational PinS usage restrictions, if any. AIS Both SO_APR_UNCTRL#13

SR_APR_UNCTRL#37: The flight crew established on the PinS approach shall transmit regularly their position and flight intent to inform other helicopters operating on the PinS aproach and

other aircraft flying in the vicinity of the PinS approach.


SR_APR_UNCTRL#38: VFR or IFR pilots flying in the vicinity of the PinS approach shall transmit regularly their position and flight intent to inform helicopters established on the PinS approach.

Other traffic Both SO_APR_UNCTRL#16

SR_APR_UNCTRL#39: A Radio Mandatory Zone (RMZ) shall be defined around the PinS approach in order to maintain continuous air-ground voice communication watch and establish two-way communication, as necessary, on the appropriate communication channel, unless it is shown that mitigating the risk of conflict between IFR and VFR is not required considering the airspace structure, traffic density, traffic complexity and the current level of safety associated to aircraft operations in this airspace.


SR_APR_UNCTRL#40: The procedure designer shall be provided with data relating to prohibited and restricted areas in the vicinity of the heliport / landing location.

AIS FPD


SR_APR_UNCTRL#41: The procedure designer shall, as far as practicable, ensure strategic separation between the PinS approach and prohibited and restricted areas in the vicinity of the heliport / landing location.


SR_APR_UNCTRL#42: The PinS approach chart shall clearly indicate the prohibited/restricted areas in the vicinity of the route.

FPD AIS


SR_APR_UNCTRL#43: Local MET information at destination heliport/landing location shall be provided to the AFISO, when available, and helicopter operator. These local MET information can be provided either by: an aeronautical meteorological service compliant with ICAO Annex 3 at destination or, an equivalent meteorological service (e.g. based on Webcam or other dedicated tool) with approval from local Competent Authority or, an aeronautical meteorological service compliant with ICAO Annex 3 at neighboring airport with approval from local Competent Authority.

MET provider Both SO_APR_UNCTRL#19

SR_APR_UNCTRL#44: MET information shall include at the minimum the following information: visibility, ceiling and QNH. MET provider Both SO_APR_UNCTRL#19

SR_APR_UNCTRL#45: The AFISO, when available, shall inform the flight crew about change of MET conditions at destination heliport or landing location.

AFISO Both SO_APR_UNCTRL#19

SR_APR_UNCTRL#46: When no AFISO is available, the flight crew shall obtain up-to-date MET information, when necessary, based on appropriate air/ground mean defined by the operator and approved by local authority.


SR_APR_UNCTRL#47: The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on the PinS approach and considering the local environment.

Helicopter operator



Generic Safety Case



SR_APR_UNCTRL#48: In case of loss of RNP capability on the PinS approach procedure, flight crews shall respect the helicopter operator’s contingency procedures (e.g. conventional navigation or dead reckoning).


SR_APR_UNCTRL#49: The helicopter operator shall define a contingency procedure adapted to the operational environment for the case of icing conditions encountered on the PinS approach.

Helicopter operator


SR_APR_UNCTRL#50: In case of icing conditions on the PinS approach procedure, the flight crew shall respect the helicopter operator’s contingency procedures.


SR_APR_UNCTRL#51: The helicopter operator shall define a contingency procedure for the case of degradation of visibility conditions, leading to a loss of the required visual reference, during the visual segment of a PinS “proceed visually” approach.

Helicopter operator

Proceed visually SO_APR_UNCTRL#25

SR_APR_UNCTRL#52: In case of degradation of visibility conditions, leading to a loss of the required visual reference, during the visual segment of a PinS “proceed visually” approach, the flight crew shall respect the helicopter operator’s contingency procedures and inform the Aerodrome Flight Information Service Officer.


SR_APR_UNCTRL#53: AIS provider shall implement a quality assurance process to verify and validate the PinS approach procedure with the procedure designer, before publication.

AIS Both

SO_APR_UNCTRL#27SO_APR_UNCTRL#28SO_APR_UNCTRL#30SO_APR_UNCTRL#31

SR_APR_UNCTRL#54: The flight crew shall verify the consistency between the PinS approach procedure on the chart and the aircraft display (FPLN, ND…).

Helicopter Both SO_APR_UNCTRL#27SO_APR_UNCTRL#28

SR_APR_UNCTRL#55: The flight crew shall be trained on RNAV navigation, PinS approach procedure and associated contingency procedures.

Helicopter Both

SO_APR_UNCTRL#27SO_APR_UNCTRL#28SO_APR_UNCTRL#29SO_APR_UNCTRL#30SO_APR_UNCTRL#31SO_APR_UNCTRL#32

SR_APR_UNCTRL#56: The PinS approach shall be clearly depicted on VFR charts to inform helicopter pilots of traffic in this area. AIS Both SO_APR_UNCTRL#29

SR_APR_UNCTRL#57: IFR helicopters flying the PinS approach in uncontrolled airspace shall be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this route (i.e. a traffic advisory system), unless it is shown that mitigating the risk of conflict with VFR and IFR is not required considering the airspace structure and the traffic density and complexity.


Table 6-4. Consolidated list of safety requirements for PinS approach in uncontrolled airspace


Generic Safety Case


7 Safety assurance for Implementation

System Safety Assessment (SSA) will be developed by the Air Traffic Service Provider (ATSP) with the support of helicopter operator(s) and heliport/landing site operator (and documented in the local Safety Case/ local Safety Assessment).

The main goal of the SSA is to collect evidences and to provide assurance that each Functional System element (people, procedures, equipment) meets its Safety Requirements as defined within the Preliminary System Safety Assessment (PSSA) that has been conducted at section 6 (Safety assessment Design level). However, note that additional Safety Requirements might be derived during Implementation & Integration, in accordance with any need for further refinement and clarification of the design (as an example, HMI design will need to be detailed in view of the implementation; activities like life trials might contribute to the design refinement, for procedures, working method and HMI).

With regard to the Implementation phase, the SSA process outcome is mainly documented in a table in which for every Safety Requirement derived and further consolidated at Section 6.1.5 (Controlled airspace) or 6.2.5 (Uncontrolled airspace), the evidence of its implementation is provided.

Depending on the element of the Functional System addressed by a Safety Requirement, that evidence might concern:

For Navigation provision (GNSS and EGNOS): indicating reference to ESSP document for SBAS coverage and performance and verification results of the signal on the PinS departure or approach procedure.

For the PinS procedure design: providing a procedure design report and a procedure validation report.

For the publication: providing the PinS chart as published in the AIP.

For heliport/landing location: providing evidence that requirements associated to heliport/landing location physical characteristics, obstacle environment, visual aids,…are implemented considering the type of procedure to be conducted (approach, departure, proceed visual or proceed VFR).

For MET information: indicating reference to MET information forecasted on the PinS procedure by the MET service provider or any equivalent information provided by the heliport/landing site operator or helicopter operator.

For ATS Procedures and Training of ATCOs/AFISOs: indicating specific paragraphs of the Training or Operating Manuals where the requirement is fulfilled, together with a short description;

For ATS communication and surveillance: indicating that radio communication coverage and surveillance coverage (if required) have been verified all along the PinS procedure through modelling verification or actual flights.

For ATS Ground Equipment: First providing justification for the required level of assurance and the associated selected techniques according to the integrity required. Then providing evidence from system Verification and Validation (V&V, based on, inter alia, analysis and/or testing) and/or from Service experience (data from previous operational use of the product) and/or from compliance with Standards.

For Aircraft certification: indicating that installation will comply with relevant EASA regulation applicable to the required PBN operations associated to the PinS procedure.

For Aircraft operator: indicating that they will comply with relevant EASA regulation applicable to the required PBN operations associated to the PinS procedure.

For flight crew: indicating that they will comply with relevant EASA regulation applicable to


Generic Safety Case


the required PBN operations associated to the PinS procedure.


Generic Safety Case


8 Safety assurance for Transfer into operation

With regard to the Transfer to operation phase (encompassing site installation, shadow mode operation, switch to operations processes…), the SSA process should include:

ATM/ANS risk identification and mitigation:

Ensure that transfer phase Safety Requirements for the installation of different ground equipment, or change of ATM/ANS procedures are defined such that risks induced by transfer phase on on-going ANS operations are acceptable. Then ensure these requirements are met and document the evidence;

Verify that Functional System elements continue to meet their Safety Requirements, with regard to those operational environment aspects that might slightly differ from the operational environment assumed in the safety assessment.

Validate the system as transferred into operation with respect to users' Safety expectations and collect evidence resulting from the system evaluation with respect to Safety, as performed by its end users – e.g. Operational trials, Transition analysis, Operational Readiness Review.

Heliport/landing site Operator risk identification and mitigation:

Ensure that change of heliport/landing site procedures are defined such that risks induced by transfer phase on on-going heliport/landing site operations are acceptable. Then ensure these requirements are met and document the evidence;


Validate the system as transferred into operations with respect to users' Safety expectations and collect evidence resulting from the system evaluation with respect to Safety, as performed by its end users – e.g. Operational trials, Transition analysis, Operational Readiness Review.

Helicopter Operator risk identification and mitigation:

Ensure that change of flight crew procedures are defined such that risks induced by transfer phase on on-going helicopter operations are acceptable. Then ensure these requirements are met and document the evidence;


Validate the system as transferred into operations with respect to users' Safety expectations and collect evidence resulting from the system evaluation with respect to Safety, as performed by its end users – e.g. Operational trials, Transition analysis, Operational Readiness Review.


Generic Safety Case


9 Safety assurance in Operation

With regard to the Operation & Maintenance phase, the SSA process should tackle the Continuous data collection and monitoring of safety performances and the Safety assessment of maintenance or planned interventions.

Safety risk monitoring of changes shall be conducted as part of the ANSP, heliport/landing site operator and helicopter operator safety management processes and applicable regulatory obligations. The Safety Key Performance Indicators (KPIs) shall be determined together with the means for measuring them.


Generic Safety Case


10 Assumptions, Recommendations and Issues

10.1 PinS departure

10.1.1 Controlled airspace

10.1.1.1 Assumptions log

The following assumptions are applicable to PinS departure operations in controlled airspace:

Assumption Domain Applicability Ref. SO ID Validation

ASS_DEP_CTRL#1: The ATC controller establishes separation between helicopters operating on the visual segment of the PinS “proceed visually” departure in accordance with prescribed minima.


SO_DEP_CTRL#2 Basic ATCO

training

ASS_DEP_CTRL#2: The ATC controller separates helicopters established on the visual segment of the PinS “proceed visually” departure procedure with other IFR aircraft in the vicinity of the PinS departure.



training

ASS_DEP_CTRL#3: The ATC controller separates helicopters established on the visual segment of the PinS “proceed visually” departure procedure with VFR aircraft in the vicinity of the PinS departure, in airspace class C.



training

ASS_DEP_CTRL#4: The ATC controller maintains separation between aircraft during the visual segment of the PinS “proceed visually” departure in accordance with prescribed minima and with

airspace class.



training

ASS_DEP_CTRL#5: The ATC controller provides traffic information about IFR flights to helicopters established on the visual segment of the PinS

“proceed VFR” departure

ATSP Proceed VFR SO_DEP_CTRL#4 Basic ATCO

training

ASS_DEP_CTRL#6: The flight crew established on the visual segment of the PinS “proceed VFR” departure actively searches for potentially conflicting traffic.

Helicopter

Proceed VFR SO_DEP_CTRL#5 Basic

airmanship

ASS_DEP_CTRL#7: When fitted, traffic advisory system or equivalent system facilitates visual acquisition of the aircraft.

Helicopter

Both SO_DEP_CTRL#5

Helicopter certification

ASS_DEP_CTRL#8: The flight crew actively seeks for potential obstacle during visual segment of the PinS “proceed visually” or “proceed VFR” departure.

Helicopter

Both

SO_DEP_CTRL#8 Basic

airmanship

ASS_DEP_CTRL#9: When fitted, HTAWS provides alert to the flight crew when a risk of collision with an obstacle is detected.

Helicopter

Both SO_DEP_CTRL#8 Helicopter

certification


Generic Safety Case



ASS_DEP_CTRL#10: The flight crew checks during pre-flight if the predicted visibility conditions at local departure heliport/location are compliant

with operating minima.

Helicopter

Both SO_DEP_CTRL#10 Basic

airmanship

ASS_DEP_CTRL#11: The flight crew prepares the departure in accordance with local MET

information.

Helicopter


airmanship

ASS_DEP_CTRL#12: The navigation data base is provided by an approved Type 2 DAT provider (EU N°2017/373) or the processes of producing and updating the navigation data base shall meet the standards specified in EUROCAE ED-76/RTCA DO-200A (e.g. Letter Of Acceptance or equivalent process).

DAT provider

Both SO_DEP_CTRL#13 Operator

certification

ASS_DEP_CTRL#13:The helicopter operator uses a navigation data base which satisfies the requirements of the CS ACNS and IR AIROPS (or equivalent OPS regulation) in order to meet standards of integrity that are adequate for the intended use of the electronic navigation data.

Helicopter operator

Both SO_DEP_CTRL#13 Operator

certification

ASS_DEP_CTRL#14: The flight crew respects the displayed RNAV lateral navigation information if the flight is conducted in manual mode or using

Flight director.

Helicopter


airmanship

ASS_DEP_CTRL#15: The RNAV subsystem and the flight guidance system guide laterally the helicopter in accordance with the instrument segment of the PinS departure, as coded in the navigation database, if flight is conducted in autopilot mode coupled to the navigation source.

Helicopter


certification

ASS_DEP_CTRL#16: The flight crew sets the

appropriate QNH for the PinS departure. Helicopter


airmanship

ASS_DEP_CTRL#17: The flight crew selects and respects the altitude profile/constraints depicted on the PinS departure flight chart if the flight is conducted in manual mode or using Flight director.

Helicopter


airmanship

ASS_DEP_CTRL#18: The Flight Management System and the altitude sub-system ensure compliance with vertical profile/constraints of the PinS departure, if the flight is conducted in autopilot VNAV mode.

Helicopter


certification

ASS_DEP_CTRL#19: The Network Manager approves the helicopter flight plan and informs the Aircraft Operator following flight plan acceptance.

NM Both SO_DEP_CTRL#15 NM basic

functionality

ASS_DEP_CTRL#20: The Network Manager distributes the approved helicopter flight plan to relevant Air Traffic Service units.

NM Both SO_DEP_CTRL#15 NM basic

functionality


Generic Safety Case



ASS_DEP_CTRL#21: The ATC controller establishes separation between helicopters operating on the instrument segment of the PinS departure in accordance with prescribed minima.

ATSP Both SO_DEP_CTRL#16 Basic ATCO

training

ASS_DEP_CTRL#22: The ATC controller separates helicopters established on the instrument segment of the PinS departure procedure with other IFR aircraft in the vicinity of the departure, in airspace class C and D.


training

ASS_DEP_CTRL#23: The ATC controller separates helicopters established on the instrument segment of the PinS departure procedure with VFR aircraft in the vicinity of the departure, in airspace class C.


training

ASS_DEP_CTRL#24: The ATC controller maintains separation between aircraft on the instrument segment of the PinS departure in accordance with prescribed minima and airspace class.


training

ASS_DEP_CTRL#25: The ATC controller provides traffic information about VFR flights to helicopters established on the PinS departure in accordance with airspace class.


training

ASS_DEP_CTRL#26: Coordination procedures are implemented between the ATSP and operator regarding the activation/de-activation of

prohibited/restricted airspace. ATSP Both SO_DEP_CTRL#22

To be verified through

local safety case

ASS_DEP_CTRL#27: The AIP defines local contingency procedure to be applied by flight crew in case of radio communication failure. AIS Both SO_DEP_CTRL#26


local safety case

ASS_DEP_CTRL#28: In case of radio communication failure, the flight crew flies the procedure/route in accordance with the flight planning and sets the transponder to Code 7600 to indicate the loss of air-ground communications.

Helicopter


airmanship

ASS_DEP_CTRL#29: The RNAV airborne systems based on GPS and/or SBAS is certified in accordance with EASA regulation and approved for the RNP requirement required by the published PinS departure procedure.

Helicopter

Both SO_DEP_CTRL#28 SO_DEP_CTRL#29


ASS_DEP_CTRL#30: The aircraft control and guidance system is certified in accordance with EASA regulation

Helicopter



ASS_DEP_CTRL#31: The aircraft altimeter is approved in accordance with EASA regulation.

Helicopter



Table 10-1: Assumptions log for PinS departure in controlled airspace


Generic Safety Case


10.1.1.2 Recommendation log

The following recommendations are applicable to PinS departure operations in controlled airspace:

Recommendation Domain Applicability

REC_DEP_CTRL#1: Helicopters conducting PinS departure procedures in controlled airspace should be operated with means to provide relevant weather updates.

Helicopter Both

REC_DEP_CTRL#2: All aircraft operating in the vicinity of the PinS departure should be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) device.

Other traffic Both

REC_DEP_CTRL#3: IFR helicopters flying the PinS departure should be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this route (i.e. a traffic advisory system).

Helicopter Both

REC_DEP_CTRL#4: Helicopters flying the PinS departure should be equipped with HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacle database should be kept up to date.

Other traffic Both

REC_DEP_CTRL#5: The State / ANSP should ensure consistency between States regarding the local heliport / landing site indicator/identifier allocation scheme (e.g. standardization at ICAO level).

ATSP Both

Table 10-2: Recommendations log for PinS departure in controlled airspace

10.1.1.3 Issue log

The following issues should be resolved for PinS departure operations in controlled airspace:

Issue Resolution

Issue_DEP_CTRL#1: The provision of weather information through on-board Electronic Flight Bags should be further assessed.

Cannot be solved at the level of this safety assessment.

Table 10-3: Issue log for PinS departure in controlled airspace

10.1.2 Uncontrolled airspace


The following assumptions are applicable to PinS departure operations in uncontrolled airspace:


Generic Safety Case



ASS_DEP_UNCTRL#1: The flight crew actively searches for conflicting traffic, during instrument and visual flight phase of the PinS, when weather conditions permit (see and avoid) based on traffic information provided by other aircraft and by flight information services when available.

Helicopter Both SO_DEP_UNCTRL#3 Basic

airmanship

ASS_DEP_UNCTRL#2: When fitted, traffic advisory system or equivalent system facilitates visual acquisition of the aircraft.

Helicopter Both SO_DEP_UNCTRL#3 Helicopter

certification

ASS_DEP_UNCTRL#3: VFR or IFR pilots flying in the vicinity of the PinS departure actively search for conflicting traffic when weather conditions permit (see and avoid) based on traffic information provided by other aircraft and by flight information services when available.


airmanship

ASS_DEP_UNCTRL#4: The flight crew actively seeks for potential obstacle during visual segment of the PinS “proceed visually” or “proceed VFR” departure.


airmanship

ASS_DEP_UNCTRL#5: When fitted, HTAWS provides alert to the flight crew when a risk of collision with an obstacle is detected.

Helicopter Both SO_DEP_UNCTRL#6 Helicopter

certification

ASS_DEP_UNCTRL#6:The flight crew checks during pre-flight if the predicted visibility conditions at local heliport or landing location are compliant with operating minima.


airmanship

ASS_DEP_UNCTRL#7: The flight crew prepares flight plan in accordance with local MET information.


airmanship

ASS_DEP_UNCTRL#8: The navigation data base is provided by an approved Type 2 DAT provider (EU N°2017/373) or the processes of producing and updating the navigation data base shall meet the standards specified in EUROCAE ED-76/RTCA DO-200A (e.g. Letter Of Acceptance or equivalent process).

DAT provider


1 Operator

certification

ASS_DEP_UNCTRL#9: The helicopter operator uses a navigation data base which satisfies the requirements of the CS ACNS and IR AIROPS (or equivalent OPS regulation) in order to meet standards of integrity that are adequate for the intended use of the electronic navigation data.

Helicopter operator


1 Operator

certification

ASS_DEP_UNCTRL#10:The flight crew respects the displayed RNAV lateral navigation information if flight is conducted in manual mode or using Flight director.


1 Basic

airmanship


Generic Safety Case



ASS_DEP_UNCTRL#11: The RNAV subsystem and the flight guidance system guide laterally the helicopter in accordance with the instrument segment of the PinS departure, as coded in the navigation database, if flight is conducted in autopilot mode coupled to the navigation source.


1 Helicopter

certification

ASS_DEP_UNCTRL#12: The flight crew sets the appropriate QNH for the PinS departure.


2 Basic

airmanship

ASS_DEP_UNCTRL#13: The flight crew selects and respects the altitude profile/constraints depicted on the PinS departure flight chart if flight is conducted in manual mode or using Flight director.


2 Basic

airmanship

ASS_DEP_UNCTRL#14: The Flight Management System and the altitude sub-system ensure compliance with vertical constraints of the PinS departure, if the flight is conducted in autopilot VNAV mode.


2 Helicopter

certification

ASS_DEP_UNCTRL#15: When AFIS is available and for known traffic, the Aerodrome Flight Information Service Officer provides information about helicopters established on the PinS departure and aircraft in the vicinities of the PinS departure.


5 Basic AFISO

training

ASS_DEP_UNCTRL#16: The AIP defines local contingency procedure to be applied by flight crews in case of radio communication failure. AIS Both

SO_DEP_UNCTRL#20


local safety case

ASS_DEP_UNCTRL#17: In case of radio communication failure, the flight crew flies the procedure/route in accordance with the flight planning and sets the transponder to Code 7600 to indicate the loss of air-ground communications.


0 Basic

airmanship

ASS_DEP_UNCTRL#18: The RNAV airborne systems based on GPS and/or SBAS is certified in accordance with EASA regulation and approved for the RNP requirement required by the published PinS departure procedure.

Helicopter Both

SO_DEP_UNCTRL#22

SO_DEP_UNCTRL#23


ASS_DEP_UNCTRL#19: The aircraft control and guidance system is certified in accordance with EASA regulation.

Helicopter Both SO_DEP_UNCTRL#22SO_DEP_UNCTRL#

23


ASS_DEP_UNCTRL#20: The aircraft altimeter is approved in accordance with EASA regulation.

Helicopter Both

SO_DEP_UNCTRL#22

SO_DEP_UNCTRL#23



Generic Safety Case



ASS_DEP_UNCTRL#21: All IFR aircraft are equipped with secondary surveillance radar transponders in uncontrolled airspace.


4 Helicopter

certification

Table 10-4: Assumptions log for PinS departure in uncontrolled airspace


The following recommendations are applicable to PinS departure operations in uncontrolled airspace:


REC_DEP_UNCTRL#1: Helicopters conducting PinS departure procedures in uncontrolled airspace should be operated with means to provide relevant weather updates.

Helicopter Both

REC_DEP_UNCTRL#2: All aircraft operating in the vicinity of the PinS departure should be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) device.

Other traffic Both

REC_DEP_UNCTRL#3: Helicopters flying the PinS departure procedure should be equipped with HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacle database should be kept up to date.

Helicopter Both

Table 10-5: Recommendation log for PinS departure in uncontrolled airspace

10.1.2.3 Issue log

The following issues should be resolved for PinS departure operations in uncontrolled airspace:

Issue Resolution

Issue_DEP_UNCTRL#1: The provision of weather information through on-board Electronic Flight Bags should be further assessed.


Table 10-6: Issue log for PinS departure in uncontrolled airspace

10.2 PinS approach

10.2.1 Controlled airspace


The following assumptions are applicable to PinS approach operations in controlled airspace:


Generic Safety Case



ASS_APR_CTRL#1: The navigation database is provided by an approved Type 2 DAT provider (EU N°2017/373) or the processes of producing and updating the navigation database shall meet the standards specified in EUROCAE ED-76/RTCA DO-200A (e.g. Letter Of Acceptance or equivalent process).

DAT provider

Both SO_APR_CTRL#5 Operator

certification

ASS_APR_CTRL#2: The helicopter operator uses a navigation data base which satisfies the requirements of the CS ACNS and IR OPS (or equivalent OPS regulation) in order to meet standards of integrity that are adequate for the intended use of the electronic navigation data.

Helicopter operator

Both SO_APR_CTRL#5 Operator

certification

ASS_APR_CTRL#3: The flight crew respects the displayed RNAV lateral navigation information if the flight is conducted in manual mode or using Flight director.

Helicopter Both SO_APR_CTRL#5 Basic

airmanship

ASS_APR_CTRL#4: The RNAV subsystem and the flight guidance system guide laterally the helicopter in accordance with the instrument segment of the PinS approach, as coded in the navigation database, if the flight is conducted in autopilot mode coupled to the navigation source.

Helicopter Both SO_APR_CTRL#5 Helicopter

certification

ASS_APR_CTRL#5: The flight crew selects and respects the altitude profile/constraints depicted on the PinS approach flight chart.


airmanship

ASS_APR_CTRL#6: The Flight Management System and the altitude sub-system ensure compliance with vertical constraints of the intial and intermediate segment of the PinS approach, if flight is conducted in autopilot VNAV mode.


certification

ASS_APR_CTRL#7: The helicopter operator and flight crew ensure compliance with CS ACNS when flying the final segment of the PinS approach (either with LNAV or LPV minima).

Helicopter Both SO_APR_CTRL#6 Operator

certification

ASS_APR_CTRL#8: The Network Manager approves the helicopter flight plan and informs the Aircraft Operator following flight plan acceptance

NM Both SO_APR_CTRL#7 NM basic

functionality

ASS_APR_CTRL#9: The Network Manager distributes the approved helicopter flight plan to relevant Air Traffic Service units.

NM Both SO_APR_CTRL#7 NM basic

functionality


Generic Safety Case



ASS_APR_CTRL#10: The ATC controller establishes separation between helicopters operating on the instrument segment of the PinS approach in accordance with

prescribed minima.

ATSP Both SO_APR_CTRL#8 Basic ATCO

training

ASS_APR_CTRL#11: The ATC controller separates helicopters established on the instrument segment of the PinS approach procedure with other IFR aircraft in the

vicinity of the approach.


training

ASS_APR_CTRL#12: The ATC controller separates helicopters established on the instrument segment of the PinS approach procedure with VFR aircraft in the vicinity

of the approach, in airspace class C.


training

ASS_APR_CTRL#13: The ATC controller maintains separation between aircraft during the instrument segment of the PinS approach in accordance with prescribed

minima.


training

ASS_APR_CTRL#14: The flight crew checks during pre-flight if the predicted visibility conditions at destination are compliant with operating minima.


airmanship

ASS_APR_CTRL#15: The flight crew prepares flight plan (and particularly alternate heliport/landing site) in accordance with predicted MET information at destination.


airmanship

ASS_APR_CTRL#16: The flight crew actively seeks any potential obstacles during the visual segment of the PinS “proceed visually” or “proceed VFR” approach.


airmanship

ASS_APR_CTRL#17: When fitted, HTAWS provides alert to the flight crew when a risk of collision with an obstacle is detected.

Helicopter Both SO_APR_CTRL#16 Operator

certification

ASS_APR_CTRL#18: The ATC controller establishes separation between helicopters operating on the visual segment of the PinS “proceed visually” approach in accordance with prescribed minima.

ATSP Proceed visually SO_APR_CTRL#17 Basic ATCO

training

ASS_APR_CTRL#19: The ATC controller separates helicopters established on the visual segment of the PinS “proceed visually” approach procedure with other IFR aircraft in the vicinity of the PinS approach.


training


Generic Safety Case



ASS_APR_CTRL#20: The ATC controller separates helicopters established on the visual segment of the PinS “proceed visually” approach procedure with VFR aircraft in the vicinity of the PinS approach, in airspace class C.


training

ASS_APR_CTRL#21: The ATC controller maintains separation between aircraft during the visual segment of the PinS “proceed visually” approach in accordance with prescribed minima.


training

ASS_APR_CTRL#22: The ATC controller provides traffic information about IFR flights to helicopters established on the visual segment of the PinS “proceed VFR” approach in airspace class D.

ATSP Proceed VFR SO_APR_CTRL#19 Basic ATCO

training

ASS_APR_CTRL#23: The flight crew established on the visual segment of the PinS “proceed VFR” approach actively search for potentially conflicting traffic in all controlled airspace classes.

Helicopter Proceed VFR SO_APR_CTRL#20 Basic

airmanship

ASS_APR_CTRL#24: When fitted, traffic advisory system or equivalent system facilitates visual acquisition of the aircraft.


certification

ASS_APR_CTRL#25: The ATC controller provides traffic information about VFR flights to helicopters established on PinS approach in accordance with airspace

class.


training

ASS_APR_CTRL#26: Coordination procedures are implemented between ATSP and operator regarding the activation of prohibited/restricted airspace.

ATSP Both SO_APR_CTRL#24 To be verified through local safety case

ASS_APR_CTRL#27: Local MET information at the alternate destination is provided to the helicopter operator. MET

provider Both SO_APR_CTRL#27

Verification of the availability

of this information is

basic airmanship

ASS_APR_CTRL#28: The AIP defines local contingency procedure to be applied by flight crews in case of radio communication failure.

AIS Both SO_APR_CTRL#29 To be verified through local safety case

ASS_APR_CTRL#29: In case of radio communication failure, flight crews shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 to indicate the loss of air-ground communications.


airmanship


Generic Safety Case



ASS_APR_CTRL#30: In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR”, the flight crew respects the helicopter operator’s VFR contingency procedures (as for any VFR operation).

Helicopter Proceed VFR SO_APR_CTRL#31 Operator

certification

ASS_APR_CTRL#31: The RNAV airborne systems based on GPS and/or SBAS is certified in accordance with EASA regulation and approved for the RNP requirement required by the published PinS approach procedure.



ASS_APR_CTRL#32: The aircraft control and guidance system is certified in accordance with EASA regulation



ASS_APR_CTRL#33: The aircraft altimeter is approved in accordance with EASA regulation



Table 10-7: Assumptions log for PinS approach in controlled airspace


The following recommendations are applicable to PinS approach operations in controlled airspace:


REC_APR_CTRL#1: Helicopters conducting PinS approach procedures in controlled airspace should be operated with means to provide relevant weather updates.

Helicopter Both

REC_APR_CTRL#2: The State / ANSP should ensure consistency between States regarding the local heliport / landing site indicator/identifier allocation scheme (e.g. standardization at ICAO level).

ATSP Both

REC_APR_CTRL#3: The procedure designer should depict on the PinS “proceed VFR” chart, elements allowing to identify if VMC minima are satisfied.

FPD Proceed VFR

REC_APR_CTRL#4: Helicopters flying the PinS approach should be equipped with HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacle database should be kept up to date.

Helicopter Both

REC_APR_CTRL#5: All aircraft operating in the vicinity of the PinS approach should be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) device.

Helicopter Both

REC_APR_CTRL#6: IFR helicopters flying the PinS approach should be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this procedure (i.e. a traffic advisory system).

Helicopter Both

REC_APR_CTRL#7: The design of the PinS approach procedure should include holdings designed in accordance

FPD Both


Generic Safety Case



with ICAO PANS OPS criteria.

Table 10-8: Recommendations log for PinS approach in controlled airspace

10.2.1.3 Issue log

The following issues should be resolved for PinS approach operations in controlled airspace:

Issue Resolution

Issue_APR_CTRL#1. The provision of weather information through on board Electronic Flight Bags should be further assessed.


Issue_APR_CTRL#2. Possible issue on phraseology with PinS multi-destination (out of scope of current safety case).

Not solved but is out of scope of current safety case.

Table 10-9: Issue log for PinS approach in controlled airspace

10.2.2 Uncontrolled airspace


The following assumptions are applicable to PinS approach operations:


ASS_APR_UNCTRL#1: The navigation data base is provided by an approved Type 2 DAT provider (EU N°2017/373) or the processes of producing and updating the navigation data base shall meet the standards specified in EUROCAE ED-76/RTCA DO-200A (e.g. Letter Of Acceptance or equivalent process).

DAT provider

Both SO_APR_UNCTRL#5 Operator

certification

ASS_APR_UNCTRL#2: The helicopter operator uses a navigation data base which satisfies the requirements of the CS ACNS and IR AIROPS (or equivalent OPS regulation) in order to meet standards of integrity that are adequate for the intended use of the electronic navigation data.

Helicopter Both SO_APR_UNCTRL#5 Operator

certification

ASS_APR_UNCTRL#3: The flight crew respects the displayed RNAV lateral navigation information if the flight is conducted in manual mode or using Flight director.

Helicopter Both SO_APR_UNCTRL#5 Basic

airmanship

ASS_APR_UNCTRL#4: The RNAV subsystem and the flight guidance system guide laterally the helicopter in accordance with the instrument segment of the PinS approach, as coded in the navigation database, if flight is conducted in autopilot mode coupled to the navigation source.

Helicopter Both SO_APR_UNCTRL#5 Helicopter

certification


Generic Safety Case



ASS_APR_UNCTRL#5: The flight crew shall select and respect the altitude profile/constraints depicted on the PinS approach flight chart if flight is conducted in manual mode or using Flight director.


airmanship

ASS_APR_UNCTRL#6: The Flight Management System and the altitude sub-system ensure compliance with vertical constraints of the intial and intermediate segment of the PinS approach, if flight is conducted in autopilot VNAV mode.

Helicopter Both SO_APR_UNCTRL#6 Helicopter

certification

ASS_APR_UNCTRL#7: The helicopter operator and flight crew ensure compliance with CS ACNS when flying the final segment of the PinS approach (either with LNAV or LPV minima).

Helicopter operator


Operator certification

ASS_APR_UNCTRL#8: The flight crew checks during pre-flight if the predicted visibility conditions at destination are compliant with operating minima.


airmanship

ASS_APR_UNCTRL#9: The flight crew prepares the flight plan (and particularly alternate airport) in accordance with predicted MET information at destination.


airmanship

ASS_APR_UNCTRL#10: The flight crew actively seeks for potential obstacles during the visual segment of the PinS “proceed visually” or “proceed VFR” approach.


Basic airmanship

ASS_APR_UNCTRL#11: When fitted, HTAWS provides alert to the flight crew when a risk of collision with an obstacle is detected.



ASS_APR_UNCTRL#12: The flight crew actively searches for conflicting traffic, during instrument and visual flight phase of the PinS, when weather conditions permit (see and avoid) based on traffic information provided by other aircraft and by flight information services when available.


Basic airmanship

ASS_APR_UNCTRL#13: When fitted, traffic advisory system or equivalent system facilitates visual acquisition of the aircraft.



ASS_APR_UNCTRL#14: VFR or IFR pilots flying in the vicinity of the PinS approach actively search for conflicting traffic when weather conditions permit (see and avoid) based on traffic information provided by other aircraft and by flight information services when available.

Other Traffic


Basic airmanship


Generic Safety Case



ASS_APR_UNCTRL#15: When AFIS is available and for known traffic, the Aerodrome Flight Information Service Officer provides information about helicopters established on the PinS approach and aircraft in the vicinity of the PinS approach.


Basic AFISO training

ASS_APR_UNCTRL#16: Local MET information at alternate heliport / landing location is provided to the helicopter operator.

MET provider


Verification of the

availability of this

information is basic

airmanship

ASS_APR_UNCTRL#17: The AIP defines local contingency procedure to be applied by flight crews in case of radio communication failure. AIS Both

SO_APR_UNCTRL#22


local safety case

ASS_APR_UNCTRL#18: In case of radio communication failure, the flight crew flies the procedure/route in accordance with the flight planning and set the transponder to Code 7600 to indicate the loss of air-ground communications.


Basic airmanship

ASS_APR_UNCTRL#19: In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR”, the flight crew respects the helicopter operator’s VFR contingency procedures (as for any VFR operation).


Basic airmanship

ASS_APR_UNCTRL#20: The RNAV airborne systems based on GPS and/or SBAS is certified in accordance with EASA regulation and approved for the RNP requirement required by the published PinS approach procedure.

Helicopter Both

SO_APR_UNCTRL#27

SO_APR_UNCTRL#28


ASS_APR_UNCTRL#21: The aircraft control and guidance system is certified in accordance with EASA regulation

Helicopter Both SO_APR_UNCTRL#27SO_APR_UNCTRL#28


ASS_APR_UNCTRL#22: The aircraft altimeter is approved in accordance with EASA regulation.

Helicopter Both

SO_APR_UNCTRL#27

SO_APR_UNCTRL#28


ASS_APR_UNCTRL#23: All IFR aircraft are equipped with secondary surveillance transponders in uncontrolled airspace.



Table 10-10: Assumptions log for PinS approach in uncontrolled airspace


The following recommendations are applicable to PinS approach operations:


Generic Safety Case



REC_APR_UNCTRL#1: Helicopters conducting PinS approach procedures in uncontrolled airspace should be operated with means to provide relevant weather updates.

Helicopter Both

REC_APR_UNCTRL#2: The procedure designer should depict on the PinS “proceed VFR” chart, elements allowing to identify if VMC minima are satisfied.

FPD Proceed VFR

REC_APR_UNCTRL#3: The helicopter flying the PinS approach should be equipped with HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacle database should be kept up to date.

Helicopter Both

REC_APR_UNCTRL#4: The design of the PinS approach procedure should include holdings designed in accordance with ICAO PANS OPS criteria, depending on local environment and constraints.

FPD Both

REC_APR_UNCTRL#5: All aircraft operating in the vicinity of the PinS approach should be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) devices.

Helicopter Both

Table 10-11: Recommendation log for PinS approach in uncontrolled airspace

10.2.2.3 Issue log

The following issues should be resolved for PinS approach operations in uncontrolled airspace:

Issue Resolution

Issue_APR_UNCTRL#1: The provision of weather information through on board Electronic Flight Bags should be further assessed.


Table 10-12: Issue log for PinS approach in uncontrolled airspace


Generic Safety Case


11 Conclusions

This document (Part I) contains the Safety Assessment for helicopter PinS departure and approach operations in controlled and uncontrolled airspace in the form of a generic safety case report.

This operational safety assessment started by the identification of Safety Criteria describing what is acceptably safe for helicopter PinS departure and approach operations. Then Safety Objectives were derived at operational level to satisfy the Safety criteria in normal, abnormal and failure conditions. Finally when the high-level design architecture supporting the operational level was defined, Safety Requirements in normal/abnormal conditions and considering failure aspects were derived to satisfy the Safety Objectives.

Three safety workshops have been conducted to discuss and validate the Safety Criteria, the Safety Objectives and the Safety Requirements considering a generic operational scenario.

This generic safety case report presents the assurance that the Safety Requirements are complete, correct and realistic for this type of operation.



In uncontrolled airspace, several requirements have been identified to mitigate the risk of mid-air collision like the establishment of Radio Mandatory Zone (RMZ), blind-call transmissions, depiction of the PinS procedure on VFR chart to inform all airspace users, AIC publication and use of onboard traffic advisory system or equivalent system to enhance the see and avoid between the IFR helicopter and other aircraft in the vicinity (VFR or IFR). The implementation of these safety requirements and recommendations should be decided locally considering the number of simultaneous flights planned on the PinS procedure, the traffic density in the vicinity of the route considering all airspace users, the complexity of the airspace, the availability or not of an Aerodrome Flight information Service, etc…

In controlled and uncontrolled airspace several abnormal conditions (external events affecting possibly the safety of the operations) have been identified at generic level and have been mitigated by the definition of contingency procedures at the helicopter operator level. The completeness and correctness of these generic mitigations shall be verified by the operator and/or ANSPs/Competent Authorities considering the specificity of the local operational environment (e.g. rich obstacle environment or flat areas, possible reliance on conventional navaids, helicopter equipment, etc…).


Generic Safety Case


ANNEX A – Operational Hazards identification & analysis & allocation of Safety Objectives

A.1 Operational Hazards identification and analysis

A Hazard identification session has been held at Strasbourg/France in June 2017.

During the HAZID session the operational hazards relevant for PinS helicopter operations have been identified and their consequences have been assessed.

The identification of the operational hazards has been driven by:

the list of (success) Safety Objectives in Normal operations from section 5.2

the brainstorming involving the workshop participants including 6 pilots

The operational effects and their mitigation in terms of protection against their propagation provides reference to the safety barriers of the MAC model (see Figure A-1 in controlled airspace and Figure A-2 in uncontrolled airspace) and the CFIT model (see Figure A-3 in controlled airspace and Figure A-4 in uncontrolled airspace).

The hazard effects severity indicated in the last column of the Hazid table (Table A-1. PinS approach Hazid table) has been allocated by the safety experts after the HAZID session using the Severity Classification Scheme based on the MAC and CFIT risk models. This severity allocation is intended for the wider usage of the generic safety case in other PinS implementations.

A second workshop was organized in Trento/Italy in November 2017 where results of the previous workshop were validated.

A third and final safety workshop was organised in Lisbon in October 2018 where final open points and comments have been addressed, in particular

Requirements on heliport / landing site (e.g. lighting, marking) for PinS proceed VFR

Provision of MET information on heliport / landing site without MET service provider

Enhanced see and avoid in uncontrolled airspace

Landing site / heliport without ICAO code

Clearance for PinS departure

Minutes of these three safety workshops have been issued.

The following sections present:

Hazard identified and assessed for PinS departure operations (see section A.1.1)

Hazard identified and assessed for PinS approach operations (see section A.1.2)


Generic Safety Case


A.1.1 PinS departure operational hazards

Hazard Operational effects

Causes Preventive mitigations External Mitigations

Severity

Helicopter deviates from expected PinS instrument segments towards terrain or towards aircraft in controlled airspace

The helicopter might collide with terrain/obstacle or other aircraft during PinS departure following a lateral or vertical deviation from planned trajectory in controlled airspace

- Emergency turn-back - GPS and/or SBAS failure - Erroneous Coding - Wrong pilot’s entry (route,

RNP value…) - Wrong ATC clearance - A/C RNP non compliance - Pilot not qualified - RNAV/ RNP system failure - Autopilot failure - Unclear QNH to be used

below TL

- Reduce speed Vy turn and inform ATC - ICAO Annex 10 compliance, RAIM

prediction if SBAS not fitted - Procedure design, publication and coding

assurance process - Clear RNP x PinS departure Publication - RNPx Flight crew training - RNP x certification (CS -ACNS)

considering demanding and non-demanding environment

- Autopilot/FD required - Database validation at each AIRAC cycle

(only for rich obstacle environment) - ATCO training - Information of traffic in vicinity of the

route (MAC risk) - Regional QNH or different QNH provided

on the route by ATC (MAC risk) - Information of the published route to all

airspace users

Deviation towards terrain - ATCO detection

with or without radar

- MSAW if fitted - Pilot visual

avoidance (see and avoid)

- HTAWS if fitted or a device providing a moving map display, own-ship position, and obstacles.

CFIT-SC3a (imminent CFIT prevented by ATC CFIT avoidance)

Deviation towards other aircraft - ATCO detection




MAC SC 4a Tactical Conflict (IFR or known VFR traffic)


Generic Safety Case




Severity

Helicopter deviates from expected PinS instrument segments towards terrain or towards aircraft in uncontrolled airspace

The helicopter might collide with terrain/obstacle or other aircraft during PinS departure following a lateral or vertical deviation from planned trajectory in uncontrolled airspace

Same as above except that ATC cause does not apply

Same as above except that ATC mitigation does not apply

Deviation towards terrain - Pilot visual



CFIT-SC2

(near CFIT prevented by pilot/airborne avoidance)

Deviation towards other aircraft - Pilot visual



MAC-SC2b

(Imminent collision: airborne collision avoidance prevents near collision)

Other traffic deviates towards A/C established on the PinS departure procedure in controlled airspace

Aircraft might collide with helicopter established on departure procedure in controlled airspace

- Inadequate ATS information about traffic in the vicinity

- Unclear Aeronautical information (VFR charting)

- Unknown traffic - …

- AIP informs pilot of PinS departure: the PinS departure is clearly depicted on VFR charts

- Less VFR traffic in Degraded Visual Environment

- ATCO detect and solve the conflict between IFR and VFR


- TAS alert or equivalent

MAC-SC4a Tactical Conflict (IFR or known VFR traffic)


Generic Safety Case




Severity

Other traffic deviates towards A/C established on the PinS departure procedure in uncontrolled airspace

Aircraft might collide with helicopter established on departure procedure in uncontrolled airspace

- Inadequate traffic information provided via RT

- Unclear aeronautical information (VFR charting)

- Unknown traffic - - …

- Additional mitigations because ATC barrier is not present:

- All aircraft equipped with transponder - IFR A/C equipped with TAS or equivalent - IFR A/C informs about its intent and

position on the approach

- Pilot see and avoid - TAS alert or

equivalent

MAC-SC2b


Helicopter deviates from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” in controlled airspace

The helicopter might collide with terrain/obstacle during visual segment of a “PinS visually” departure following a lateral or vertical deviation from expected flight path in controlled airspace

- MET conditions - Procedure design issue

(visual segment not consistent with rotorcraft performance)

- Charting issue - Control of obstacles not well

managed - Pilot error - Unclear QNH to be used

below TL

- Local MET information available at the departure

- Procedure design and publication assurance process

- The departure Chart clearly depicts the visual segment (direct segment or manoeuvring area) and associated obstacle

- Pilot training - Regional QNH or different QNH provided

on the route by ATC (MAC risk)








Generic Safety Case




Severity

Helicopter deviates from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” in uncontrolled airspace

The helicopter might collide with terrain/obstacle during visual segment of a “PinS visually” departure following a lateral or vertical deviation from expected flight path in controlled airspace





below TL

- Local MET information available at the departure


- The approach Chart clearly depicts the visual segment (direct segment or manoeuvring area) and associated obstacle






CFIT-SC2


A.1.2 PinS approach operational hazards

Table A-1. PinS approach Hazid table



Severity

The helicopter might collide with terrain / obstacle or other aircraft during PinS approach following a lateral or vertical deviation from planned trajectory in controlled airspace

- Emergency turn-back - GPS loss - Erroneous Coding - Wrong pilot’s entry (route,

RNP value,…) - Wrong ATC clearance - A/C RNP non compliance - Pilot not qualified - RNAV system failure

- Reduce speed Vy turn and inform ATC - ICAO Annex 10 compliance, RAIM

prediction if SBAS not fitted - Procedure design, publication and coding

assurance process - Clear RNP x PinS approach Publication - RNPx Flight crew training

Deviation toward terrain - ATCO detection






Generic Safety Case




Severity

Helicopter deviates from expected PinS instrument segments towards terrain or towards aircraft in controlled airspace

- Autopilot failure - Unclear QNH to be used

below TL

- RNP x certification (CS -ACNS) considering demanding and non-demanding environment

- Autopilot/FD required - Database validation at each Airac cycle

(only for rich obstacle environment) - ATCO training - Information of traffic in vicinity of the

route (MAC risk) - Regional QNH or different QNH provided

on the route by ATC (MAC risk) - Information of the published route to all

airspace users


Deviation towards other aircraft - ATCO detection




MAC SC 4a Tactical Conflict (IFR or known VFR traffic)

Helicopter deviates from expected PinS instrument segments towards terrain or towards aircraft in uncontrolled airspace

The helicopter might collide with terrain / obstacle or other aircraft during PinS approach following a lateral or vertical deviation from planned trajectory in uncontrolled airspace

Same as above except that ATC cause does not apply

Same as above except that ATC mitigation does not apply




CFIT-SC2



Generic Safety Case




Severity

Deviation towards other aircraft - Pilot visual



MAC-SC2b


Other traffic deviates towards A/C established on the PinS approach procedure in controlled airspace

Aircraft might collide with helicopter established on approach procedure in controlled airspace

- Inadequate ATS information about traffic in the vicinity

- Unclear Aeronautical information (VFR charting)

- …

- AIP informs pilot of PinS Approach: the PinS approach is clearly depicted on VFR charts

- Less VFR traffic in marginal weather conditions

- ATCO detect and solve the conflict between IFR and VFR


- TAS alert or equivalent

MAC-SC4a Tactical Conflict (IFR or known VFR traffic)

Other traffic deviates towards A/C established on the PinS approach procedure in uncontrolled airspace

Aircraft might collide with helicopter established on approach procedure in uncontrolled airspace

- Inadequate traffic information provided via RT

- Unclear aeronautical information (VFR charting)

- Additional mitigations because ATC barrier is not present:

- All aircraft equipped with transponder - IFR A/C equipped with TAS or equivalent - IFR A/C informs about its intent and

position on the approach

- Pilot see and avoid - TAS alert or

equivalent

MAC-SC2b



Generic Safety Case




Severity

Helicopter deviates from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” in controlled airspace

The helicopter might collide with terrain / obstacle during visual segment of a “PinS visually” approach following a lateral or vertical deviation from expected flight path in controlled airspace

- MET conditions - Helipad lighting/marking - Procedure design issue




below TL

- Local MET information available for the arrival

- Helipad with appropriate lighting/marking











Helicopter deviates from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” in uncontrolled airspace

The helicopter might collide with terrain / obstacle during visual segment of a “PinS visually” approach following a lateral or vertical deviation from expected flight path in controlled airspace

- MET conditions - Helipad lighting/marking - Procedure design issue




below TL

- Local MET information available for the arrival

- Helipad with appropriate lighting/marking








CFIT-SC2



Generic Safety Case




Severity

Helicopter fails to decelerate and/or prepare landing during the visual segment of the PinS approach, in controlled or uncontrolled airspace

The helicopter might fail to land on the landing location



- Pilot error (pilot does not comply with speed restrictions)

- …

- MET information available for the arrival - Procedure design and publication

assurance process - Pilot training

- Flight crew correct / adapt short final

- Go around

RE-SC3

(unstable approach)


Generic Safety Case


A.2 Applicable risk models

Pre-Existing

Hazards

TR

AF

FIC

B12

Mid-Long Term DCB + Strategic

Str

ate

gic

Ma

na

ge

me

nt

Re

so

lve

s o

ve

r d

em

an

d o

r u

nd

er

ca

pa

city (

mid

-lo

ng

te

rm)

an

d

pro

vid

es a

de

qu

ate

re

so

urc

es

(hu

ma

n, p

roce

du

res, e

qu

ipm

en

t)

the

reb

y r

ed

ucin

g th

e p

ote

ntia

l fo

r

futu

re c

on

flic

ts

B5-9

Tactical Conflict Management AT

Co

Mo

nito

rs fo

r p

ote

ntia

l

co

nflic

ts.

De

tects

an

d

reso

lve

s th

em

be

fore

the

y r

esu

lt in

lo

sse

s

of se

pa

ratio

n

Severity Class Scheme for Mid-air CollisionMAC BARRIER MODEL- Controlled Airspace

A situation where an aircraft

comes into physical contact

with another aircraft in the

air.

MAC-SC1

A situation where an

imminent collision was not

mitigated by an airborne

collision avoidance but for

which geometry has

prevented physical contact.

MAC-SC2a

A situation where airborne

collision avoidance prevents

near collision

MAC-SC2b


imminent collision was

prevented by ATC Collision

prevention

MAC-SC3


imminent infringement

coming from a crew/aircraft

induced conflict was

prevented by tactical conflict

management

MAC-SC4a


imminent infringement

coming from a planned

conflict was prevented by

tactical conflict management

MAC-SC4b

A situation where, on the day

of operations, a tactical

conflict (planned) was

prevented by Traffic

Planning and

Synchronization.

MAC-SC5

B0

Providence

Co

nfl

ict

Ge

om

etr

y

No

n-in

ters

ectin

g

Tra

jecto

rie

s.

Co

llisio

n

avo

ide

d b

y c

ha

nce

with

ou

t a

ny in

terv

en

tio

n

B1

Visual Warning

B2

ACAS Warning Pilo

t/C

rew

De

tects

(vis

ua

lly o

r b

y

AC

AS

RA

) a

n im

min

en

t

co

llisio

n a

nd

ca

rrie

s o

ut

su

cce

ssfu

l a

vo

ida

nce

actio

ns

B3

STCA Warning

B4

ATCo Expedite

AT

Co

De

tects

(w

ith

or

with

ou

t

ST

CA

) im

min

en

t o

r

actu

al lo

sse

s o

f

se

pa

ratio

n a

nd

acts

to

resto

re s

afe

se

pa

ratio

n

Strategic

Conflict

MF5.3

Pre-Tactical

Conflict

MF5.2

ATC Induced

PreTactical

Conflicts

MF9.1

Near MAC

Accident

MF3a

MAC

Accident

MF3

Imminent

Collision

MF4

Imminent

Infringement

MF5-9

Induced

Tactical

Conflicts

MF6.1Planned

Tactical

conflict

MF5.1

Induced

Tactical

Conflicts

MF7.1

B11

Short Term DCB

Ne

two

rk M

an

ag

em

en

t

Re

mo

ve

s s

ho

rt te

rm

ove

rlo

ad

s a

nd

hig

h

co

mp

lexity s

itu

atio

ns

red

ucin

g th

e p

ote

ntia

l fo

r

futu

re c

on

flic

ts

B10

Traffic Planning & Sychronisation

Pla

nn

er/

AT

Co

Pre

ve

nts

po

ten

tia

l

co

nflic

ts fro

m b

eco

min

g

tactica

l co

nflic

ts th

ere

by

red

ucin

g ta

ctica

l

inte

rve

ntio

n

Figure A-1: Simplified MAC model for Controlled airspace & associated Severity Classification Scheme


Generic Safety Case


Severity Class Scheme for Mid-air CollisionMAC BARRIER MODEL- Uncontrolled Airspace

Pre-Existing

Hazards

TR

AF

FIC


comes into physical contact

with another aircraft in the

air.

MAC-SC1


imminent collision was not

mitigated by an airborne

collision avoidance but for

which geometry has

prevented physical contact.

MAC-SC2a

A situation where airborne

collision avoidance prevents

near collision

MAC-SC2b


imminent collision with an

unknown traffic was

prevented by pilot conflict

detection

MAC-SC3a

B0

Providence

Co

nfl

ict

Ge

om

etr

y

No

n-in

ters

ectin

g

Tra

jecto

rie

s.

Co

llisio

n

avo

ide

d b

y c

ha

nce

with

ou

t a

ny in

terv

en

tio

n

B1

Visual Warning

B2

ACAS Warning (if installed) Pilo

t/C

rew

De

tects

(vis

ua

lly o

r b

y

AC

AS

RA

) a

n im

min

en

t

co

llisio

n a

nd

ca

rrie

s o

ut

su

cce

ssfu

l a

vo

ida

nce

actio

ns

B3

Pilot Conflict Detection

Pilo

t/C

rew

Se

arc

h a

ctive

ly fo

r p

ote

ntia

lly

co

nflic

tin

g tra

ffic

vis

ua

lly a

nd

po

ssib

ly a

ide

d b

y e

lectr

on

ic

assis

tan

ce

(A

CA

S T

A,

TA

S, …

)

Near MAC

Accident

MF3a

MAC

Accident

MF3

Imminent

Collision

MF4

Imminent

Infringement

with known

traffic

MF6

B4

Flight Information

AT

CO

/FIS

O

Pro

vid

es flig

ht in

form

atio

n

to IF

R a

nd

VF

R flig

hts

Imminent

Infringement

with unknown

traffic

MF5A situation where an

imminent collision with a

known traffic was prevented

by pilot conflict detection

MAC-SC3b

Figure A-2: Simplified MAC model for Uncontrolled airspace & associated Severity Classification Scheme


Generic Safety Case


CFIT

Accident

B0

Providence

Severity Class Scheme for CFIT CFIT BARRIER MODEL- Controlled Airspace

B2

Visual Warning

B1

A/C Ground

Proximity Warning

B3

ATC CFIT Avoidance

Manoeuvre near

terrain, water or

obstacle

B4

Flight Crew Monitoring

Co

nfl

ict

Ge

om

etr

y

No

n-in

ters

ectin

g a

/c-

Te

rra

in T

raje

cto

rie

s (

su

ch

as h

igh

te

rra

in)

CF

IT

avo

ide

d b

y C

ha

ng

e

with

ou

t a

ny in

terv

en

tio

n

Near CFIT

Accident

Controlled

Flight

Towards

Terrain

Flight towards

terrain

commandedF

lig

ht

Cre

w

De

tects

(vis

ua

lly o

r b

y

GP

WS

/TA

WS

) a

n

imm

ine

nt C

FIT

an

d

ca

rrie

s o

ut su

cce

ssfu

l

avo

ida

nce

actio

ns

AT

Co

De

tects

(w

ith

or

with

ou

t

MS

AW

) im

min

en

t o

r

actu

al lo

sse

s o

f sa

fe

gro

un

d s

ep

ara

tio

n a

nd

acts

to

pre

ve

nt C

FIT

Flig

ht

Cre

w

Mo

nito

rs fo

r p

ote

ntia

l

da

ng

ers

as r

eg

ard

s p

roxim

ity

to te

rra

in.

De

tects

an

d

reso

lve

s th

em

be

fore

th

ey

resu

lt in

CF

IT r

isks

FTT

commanded

by ATC

FTT

commanded by

pilot

FTT

commanded by

systems

TR

AF

FIC

CF2a

CF4

CF5-8

FTT

commanded

by ANS

CF2

CF5 CF6 CF7 CF8

Imminent

CFIT

CF3

A situation where

a CFTT is

prevented by pilot

tactical CFIT

resolution (flight

crew monitoring)

CFIT- SC3b

A situation where

an imminent CFIT

was not mitigated

by pilot/airborne

avoidance and

hence the aircraft

collides with

terrain/water/

obstacle

CFIT- SC1

ATC gives

instruction to

manœuvre near

terrain, obstacle or

water

Pilot needs to

manoeuvre near


water

A/C systems

manoeuvre near


water

Route and/or

procedure

designed by ANS

near terrain,

obstacle or water

Pre-Existing

Hazards

A situation where

a near CFIT was

prevented by

pilot/airborne

avoidance

CFIT- SC2

A situation where

an imminent CFIT

was prevented by

ATC CFIT

avoidance

CFIT- SC3a

B8Route/procedure

design and

publication

B7ATC Flight

Management

B6FMS/RNAV/Flight

Control

Management

B5Pilot trajectory

Management

Figure A-3: Simplified CFIT model for Controlled airspace & associated Severity Classification Scheme


Generic Safety Case


CFIT

Accident

B0

Providence

Severity Class Scheme for CFIT CFIT BARRIER MODEL- Uncontrolled Airspace

B2

Visual Warning

B1

A/C Ground

Proximity Warning

Manoeuvre near

terrain, water or

obstacle

B3

Flight Crew Monitoring

Co

nfl

ict

Ge

om

etr

y

No

n-in

ters

ectin

g a

/c-

Te

rra

in T

raje

cto

rie

s (

su

ch

as h

igh

te

rra

in)

CF

IT

avo

ide

d b

y C

ha

ng

e

with

ou

t a

ny in

terv

en

tio

n

Near CFIT

Accident

Flight towards

terrain

commanded

Flig

ht

Cre

w

De

tects

(vis

ua

lly o

r b

y

GP

WS

/TA

WS

) a

n

imm

ine

nt C

FIT

an

d

ca

rrie

s o

ut su

cce

ssfu

l

avo

ida

nce

actio

ns

Flig

ht

Cre

w

Mo

nito

rs fo

r p

ote

ntia

l

da

ng

ers

as r

eg

ard

s p

roxim

ity

to te

rra

in. D

ete

cts

an

d

reso

lve

s th

em

be

fore

th

ey

resu

lt in

CF

IT r

isks

FTT

commanded by

pilot

FTT

commanded by

systems

TR

AF

FIC

CF2a

CF4-6

FTT

commanded

by ANS

CF2

CF4 CF5 CF6

Imminent

CFIT

CF3

A situation where

aN imminent

CFIT is prevented

by pilot tactical

CFIT resolution

(flight crew

monitoring)

CFIT- SC3

A situation where

an imminent CFIT

was not mitigated

by pilot/airborne

avoidance and

hence the aircraft

collides with

terrain/water/

obstacle

CFIT- SC1

Pilot needs to

manoeuvre near


water

A/C systems

manoeuvre near


water

Route and/or

procedure

designed by ANS

near terrain,

obstacle or water

Pre-Existing

Hazards

A situation where

a near CFIT was

prevented by

pilot/airborne

avoidance

CFIT- SC2

B6Route/procedure

design and

publication

B5FMS/RNAV/Flight

Control

Management

B4Pilot trajectory

Management

Figure A-4: Simplified CFIT model for Uncontrolled airspace & associated Severity Classification Scheme


Generic Safety Case


Figure A-5: Simplified Runway Excursion model

TR

AF

FIC

Severity Class Scheme for Runway Excursion (related to landing only)AIM RWY EXC BARRIER MODEL (Landing) v0.3


departs from the runway

surface (veer off or overrun)

RE-SC1


unstable touchdown or a

touchdown outside TDZ

does not end in a near

runway excursion due to the

breaking and deceleration

action by the crew/AC

RE-SC2b


unstable approach does not

end as imminent runway

excursion due to short final

management by crew/AC

RE-SC3

Near Runway

Excursion

REF3a

RWY

Excursion

REF1

B0

Providence

Unstable

Touchdown

REF6

Touchdown

outside TDZ

REF5

Stabilised

Touchdown in

TDZ

REF4

Unstable

approach

REF8

Stable

approach

REF7

Approach

Attempt

REF9

Accident prevented by « just

providence »

RE-SC2a

REF

10

-12

RW

Y C

on

dit

ion

s an

d s

uit

abili

ty f

or

fin

al a

pp

roac

hApproach

Attempt

REF9

Approach

Attempt

REF9

Un

suit

able

ru

nw

ayW

eath

er a

ffec

tin

g R

WY

suit

abili

ty

RE

B5

Ma

na

ge

me

nt o

f R

un

wa

y

co

nd

itio

ns w

rt w

ea

the

r

REF14

REF13

REB3

Stabilisation in final approach

Pilo

t co

rre

ct /a

da

pt

lan

din

g p

ara

me

ters

co

nsid

erin

g th

e c

urr

en

t

we

ath

er

co

nd

itio

ns a

nd

info

rma

tio

n p

rovid

ed

by

AT

C to

en

su

re a

n s

tab

le

ap

pro

ach.

ATC/pilot to check/

ensure weather

conditions are suitable

for landing (considering

wind, turbulences, rain,

snow, etc.).

Pilo

t co

rre

ct

/ad

ap

t

run

wa

y d

ece

lera

tio

n

an

d s

top

pin

g

pa

ram

ete

rs c

on

sid

erin

g

the

cu

rre

nt w

ea

the

r a

nd

run

wa

y c

on

ditio

ns to

en

su

re n

om

ina

l la

nd

ing.

TR

AF

FIC


approach attempted to a

runway where conditions are

not suitable for landing is

detected and the approach is

broken off

RE-SC4

Approach

broken off

RE

B4

Ma

na

ge

me

nt o

f R

un

wa

y

su

ita

bili

ty c

on

ditio

ns

ATC/pilot to check/

ensure runway

conditions are sufficient

and suitable for landing

(runway distance,

friction, surfance

markings, visibility, etc.)

REB2

Management of short final and flare

Pilo

t co

rre

ct /a

da

pt sh

ort

fin

al a

nd

fla

re p

ara

me

ters

co

nsid

ere

din

g th

e c

urr

en

t

we

ath

er

an

d r

un

wa

y

co

nd

itio

ns to

en

su

re a

n

sta

ble

to

uch

do

wn

.

REB1

Crew/AC runway deceleration / stopping

action

Imminent RWY

Excursion


Generic Safety Case


A.3 Allocation of Safety Objectives- Generic illustration based on SRM

The current safety case guidance illustrates the allocation of quantitative Safety Objectives (reliability/integrity SOs) using the generic RCS (Risk Classification Scheme) proposed by SRM [RD 3] Guidance D (note that for each accident type a dedicated RCS is provided).

The following method to calculate SO for a given hazard is proposed in SRM [RD 3] Guidance E:

IMN

MTFoOSO

classseverityrelevant

__

where:

• MTFoO stands for the Maximum Tolerable Frequency of Occurrence being the maximum probability of the hazard’s effect given the severity, as defined in the RCS (see RCS for MAC accident at Table A-2 (controlled airspace) and Table A-3 (uncontrolled airspace) and RCS for CFIT accident at Table A-4 (controlled airspace) and Table A-5 (uncontrolled airspace)).

• N is the overall number of operational hazards for a given severity class at a given barrier as obtained from Table A-6 below (corresponding to Table 5 in E.4 of [RD 2])

• IM is the Impact Modification factor to take account of additional information regarding the operational effect of the hazard, in particular related to the number of aircraft exposed to the operational hazard. In the current context IM is set to 1.

Severity Class

Hazardous situation Operational Effect MTFoO [per fh]

MAC-SC1 A situation where an aircraft comes into physical contact with another aircraft in the air.

Accident - Mid-air collision (MF3)

1e-9

MAC-SC2a

A situation where an imminent collision was not mitigated by an airborne collision avoidance but for which geometry has prevented physical contact.

Near Mid-Air Collision (MF3a)

1e-6

MAC-SC2b A situation where airborne collision avoidance prevents near collision

Imminent Collision (MF4)

1e-5

MAC-SC3 A situation where an imminent collision was prevented by ATC Collision prevention

Imminent Infringement (MF5-8)

1e-4

MAC-SC4a A situation where an imminent infringement coming from a crew/aircraft induced conflict was prevented by tactical conflict management

Tactical Conflict (crew/aircraft induced)

(MF6.1) 1e-3

MAC-SC4b A situation where an imminent infringement coming from a planned conflict was prevented by tactical conflict management

Tactical Conflict (planned) (MF5.1)

1e-2

MAC-SC5 A situation where, on the day of operations, a tactical conflict (planned) was prevented by Traffic Planning and Synchronization.

Pre tactical conflict (MF5.2)

1e-1

Table A-2: RCS for MAC in controlled airspace


Generic Safety Case


Severity Class

Hazardous situation Operational Effect MTFoO [per fh]

MAC-SC1 A situation where an aircraft comes into physical contact with another aircraft in the air.

Accident - Mid-air collision (MF3)

1e-7

(1e-9 *400 =4e-7 then

rounded)

MAC-SC2a

A situation where an imminent collision was not mitigated by an airborne collision avoidance but for which geometry has prevented physical contact.

Near Mid-Air Collision (MF3a)

1e-5 (1e-6 *400 = 4e-4 then rounded)

MAC-SC2b A situation where airborne collision avoidance prevents near collision

Imminent Collision (MF4)

1e-4

MAC-SC3 (a &b)

A situation where an imminent collision was prevented by pilot conflict detection

Imminent infringement ( (MF5 & MF6)

1e-3

Table A-3. RCS for MAC in uncontrolled airspace (to be consolidated)

Severity Class

Hazardous situation Operational Effect MTFoO

[per flgt]

CFIT-SC1 A situation where an imminent CFIT is not mitigated by pilot/airborne avoidance and hence the aircraft collides with terrain/water/obstacle

CFIT Accident (CF2) Near CFIT (CF2a)

1e-8

CFIT-SC2 A situation where a near CFIT is prevented by pilot/airborne avoidance

Imminent CFIT (CF3)

1e-6

CFIT-SC3a A situation where an imminent CFIT is prevented by ATC CFIT avoidance

Controlled flight towards terrain (CF4)

1e-5

CFIT-SC3b A situation where a controlled flight towards terrain is prevented by pilot tactical CFIT resolution (flight crew monitoring)

Flight towards terrain commanded

(CF5-8) 1e-5

Table A-4. RCS for CFIT in controlled airspace

Severity Class

Hazardous situation Operational Effect MTFoO

[per flgt]

CFIT-SC1 A situation where an imminent CFIT is not mitigated by pilot/airborne avoidance and hence the aircraft collides with terrain/water/ obstacle

CFIT Accident (CF2) Near CFIT (CF2a)

1e-8

CFIT-SC2 A situation where a near CFIT is prevented by pilot/airborne avoidance

Imminent CFIT (CF3)

1e-6

CFIT-SC3 A situation where a controlled flight towards terrain is prevented by pilot tactical CFIT resolution (flight crew monitoring)

Flight towards terrain commanded

(CF4-6) 1e-5

Table A-5. RCS for CFIT in uncontrolled airspace


Generic Safety Case


Severity Class

Number of hazards per Severity Class per Accident Type

MAC controlled airspace

MAC uncontrolled airspace

CFIT controlled airspace

CFIT uncontrolled airspace

SC1 1 1 5 5

SC2 n/a n/a 10 10

SC2a 5 5 n/a n/a

SC2b 10 10 n/a n/a

SC3 25 n/a n/a 50

SC3a n/a 10 (TBD) 50 n/a

SC3b n/a 10 (TBD) 50 n/a

SC4 n/a n/a n/a n/a

SC4a 30 n/a n/a n/a

SC4b 30 n/a n/a n/a

SC5 100 n/a n/a n/a

Table A-6. Maximum hazard number per severity class

A.4 Allocating Criticality

The process is described in SRM [RD 3] Guidance K.3

The Level of Criticality is allocated based on the quantitative SO derived from the standard SO setting process in the SRM.

Level of Criticality Frequency for CFIT in controlled/uncontrolled airspace and

MAC in controlled airspace

Frequency for MAC in uncontrolled airspace

Extreme Criticality

E1 < 10-9 per movement or per flight/hour < 10-7 per flight/hour

E2 < 10-8 per movement or per flight/hour < 10-6 per flight/hour

High

Criticality

H1 < 10-7 per movement or per flight/hour < 10-5 per flight/hour

H2 < 10-6 per movement or per flight/hour < 10-4 per flight/hour

Medium

Criticality

M1 < 10-5 per movement or per flight/hour < 10-3 per flight/hour

M2 < 10-4 per movement or per flight/hour < 10-2 per flight/hour

Low

Criticality L1 < 10-3 per movement or per flight/hour

< 10-1 per flight/hour

Table A-7. Frequency & level of criticality

Conversion of the frequency of occurrences to different units is to be done as necessary depending on the different risk model metrics used to define the Safety Objectives (per approach, per flight, per flight hour) and the needs of the project safety assessment.

Note: As there is no criticality allocation for the runway excursion risk model defined in the SRM [RD 2], it has been assumed for Hz_APR_25 and Hz_APR_75 a frequency not greater than 10-4 per flight hour for a criticality level at M1 for controlled and uncontrolled airspaces.

A set of 3 Principles are also proposed in the method:

P1 – Preventing unsafe design - (P1a) No single human error should lead directly to an event defined as extremely critical - (P1b). No flight crew / ATCO error combining with a maintenance staff error should lead

directly to an event defined as extremely critical


Generic Safety Case


P2 – Evidence exists of the human contribution to safety - P2: The human contributes positively to the safety objectives; evidence is available and is of a

high or medium quality.

P3 – No evidence for the human contribution to safety

- P3: The human may contribute positively to the safety objectives, but no evidence is available or is of low quality.


Generic Safety Case


ANNEX B – Detailed derivation of Safety Requirements for Normal and Abnormal operations

B.1 Detailed derivation of Safety Requirements for PinS departure operations

B.1.1 Controlled airspace

B.1.1.1 Normal operations

The table below derives assumptions and Safety Requirements for Normal PinS departure operations by mapping the Safety Objectives for Normal operations onto the related elements of the PinS Functional system logical model from Section 6.1.1.

Safety Objectives (Normal operations)

Safety Requirements Maps on to / Data flow (Logical Model)

SO_DEP_CTRL#1 Spacing between departure procedures and between approach and departure procedure shall be determined considering navigation performance, separation minima, traffic density, sector size andcontroller procedures / HMI

SR_DEP_CTRL#1. The flight procedure design shall, as far as practicable, ensure strategic separation between PinS departure procedures and between PinS departure and other procedures considering navigation performance and airspace constraints (sector size, other trajectories in the vicinity, restricted areas…)… SR_DEP_CTRL#2. The flight procedure design shall take into account ATC constraints such as separation minima, traffic density, sector size and controller procedures / HMI.

Flight Procedure Design

SO_DEP_CTRL#2 ATC shall separate traffic during the visual segment of the PinS departure for “proceed visually” operation

SR_DEP_CTRL#3. The flight crew shall request to the controller the PinS take-off and departure clearance, prior to departure, when flying a “proceed visually” departure procedure. Note: A single clearance is issued by the ATCO at the departure for the complete PinS departure (including instrument segment). SR_DEP_CTRL#4. The flight crew shall coordinate with ATC, before take off, about the Estimated Time of Departure (ETD) when flying a “proceed VFR” departure procedure.

Pilot (25 PinS clearance)

SR_DEP_CTRL#5. The ATC controller shall give a PinS take-off and departure clearance to the flight crew, prior to departure, when flying a “proceed visually” departure procedure. Note: A single clearance is issued by the ATCO at the departure for the complete PinS departure (including instrument segment).

ATCO Pilot (25 PinS clearance)

ASS_DEP_CTRL#1. The ATC controller establishes separation between helicopters operating on the visual segment of the PinS “proceed visually” departure in accordance with prescribed minima.

ATCO Pilot (28 ATC control)


Generic Safety Case




ASS_DEP_CTRL#2. The ATC controller separates helicopters established on the visual segment of the PinS “proceed visually” departure procedure with other IFR aircraft in the vicinity of the PinS departure.

ATCO Pilot (26 ATC tactical clearance)

ATCO IFR A/C (31 ATC control)

ASS_DEP_CTRL#3. The ATC controller separates helicopters established on the visual segment of the PinS “proceed visually” departure procedure with VFR aircraft in the vicinity of the PinS departure, in airspace class C. Note: Requirements relating to provision of traffic information with VFR in airspace class D are derived through assessment of SO_DEP_CTRL#20.


ATCO VFR A/C (32 No ATC control except in class C)

SO_DEP_CTRL#3 ATC shall maintain separation between A/C during the visual segment of the PinS departure for “proceed visually” operation

ASS_DEP_CTRL#4. The ATC controller maintains separation between aircraft during the visual segment of the PinS “proceed visually” departure in accordance with prescribed minima and with airspace class.


SO_DEP_CTRL#4 ATC shall provide traffic information to A/C during the visual segment of the PinS departure for “proceed VFR” operation

ASS_DEP_CTRL#5. The ATC controller provides traffic information about IFR flights to helicopters established on the visual segment of the PinS “proceed VFR” departure in airspace class D. Remark: Requirements regarding provision of traffic information about VFR flight are defined below through assessment of SO_DEP_CTRL#20.

ATCO Flight crew (47 Traffic information)

SO_DEP_CTRL#5 Each pilot shall maintain separation with other A/C during the visual segment of the PinS departure for “proceed VFR” operation

ASS_DEP_CTRL#6. The flight crew established on the visual segment of the PinS “proceed VFR” departure actively searches for potentially conflicting traffic.

REC_DEP_CTRL#2. All aircraft operating in the vicinity of the PinS departure should be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) device. REC_DEP_CTRL#3. IFR helicopters flying the PinS departure should be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this route (i.e. a traffic advisory system). ASS_DEP_CTRL#7. When fitted, traffic advisory system or equivalent system facilitates visual acquisition of the aircraft.

SO_DEP_CTRL#6 The visual segment of the PinS “proceed visually” departure procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles

SR_DEP_CTRL#6. The aeronautical, terrain and obstacle data used in the design of the helicopter PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.

AIS Provider Flight Procedure design (07: aeronautical data)

SR_DEP_CTRL#7. The PinS departure procedure (i.e. visual segment when applicable, instrument segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure



Generic Safety Case




SR_DEP_CTRL#8. The verification and validation of the PinS departure procedure shall be made in accordance with the quality process specified in ICAO Doc 9906

Flight procedure validation Flight procedure design (05: procedure validation)

SR_DEP_CTRL#9. The PinS departure procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate the required aircraft navigation capability to fly the procedure (e.g. RNP1 or RNP0.3). SR_DEP_CTRL#10. The AIS provider shall define the naming and phraseology associated with the PinS departure in accordance with ICAO rule to ensure consistency between operator (FMS, phraseology) and ATS (Phraseology). SR_DEP_CTRL#11. The AIS provider shall inform airspace users (e.g. through AIC) about the implementation of a PinS departure and the possible increase of IFR traffic in the the vicinity of the heliport / departure location.

AIS Provider NavDB integrator & packer, Helicopter operator and ATCO (08: PinS chart)

SR_DEP_CTRL#12. The promulgation of PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.

AIS provider (PinS procedure)

SO_DEP_CTRL#7 Helicopters shall respect lateral and vertical constraints, if applicable, of the visual segment of the PinS “proceed visually” departure procedure

SR_DEP_CTRL#13. The flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS “proceed visually” departure chart. For proceed visually with direct segment, lateral and vertical path are indicated on the chart.

Helicopter operator Flight crew (14 PinS chart)

SO_DEP_CTRL#8 Pilots shall see and avoid the obstacles during visual segment of the PinS departure procedure

SR_DEP_CTRL#14. The procedure designer shall depict the relevant obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart.

Flight procedure design AIS provider (06: PinS procedure)

AIS Provider Helicopter (08: PinS chart)

Helicopter operator Flight Crew (14 PinS chart)

SR_DEP_CTRL#15. The procedure designer shall depict, on the PinS “proceed VFR” chart, the relevant obstacles in the vicinity of the heliport or departure location.





Generic Safety Case




ASS_DEP_CTRL#8. The flight crew actively seeks for potential obstacle during visual segment of the PinS “proceed visually” or “proceed VFR” departure.

Flight crew

REC_DEP_CTRL#4. Helicopters flying the PinS departure should be equipped with HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacle database should be kept up to date. ASS_DEP_CTRL#9. When fitted, HTAWS provides alert to the flight crew when a risk of collision with an obstacle is detected

HTAWS Flight Crew (53 obstacle alert)

SO_DEP_CTRL#9 The PinS departure shall be designed and promulgated to facilitate the transition between the visual flight phase to the instrument flight phase.

SR_DEP_CTRL#7 The PinS departure procedure (i.e. visual segment when applicable, instrument segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure. Note : Compliance with PANS OPS will ensure appropriate transition between visual flight phase and instrument flight phase


SR_DEP_CTRL#8 The verification and validation of the PinS departure procedure shall be made in accordance with the quality process specified in ICAO Doc 9906


SR_DEP_CTRL#9 The PinS departure procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate the required aircraft navigation capability to fly the procedure (e.g. RNP1 or RNP0.3).


SR_DEP_CTRL#12 The promulgation of PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SR_DEP_CTRL#16. The ATC controller shall give appropriate speed and altitude instructions to the flight crews if needed to facilicate the transition between the visual flight phase and the instrument flight phase (i.e. to facilitate the compliance with published altitude or speed constraints).

ATCO Flight crew (28 : ATC control)

SR_DEP_CTRL#55. The heliport or landing location where PinS departure “proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14 Vol II applicable to non-instrument heliport (physical characteristics, obstacle environment, visual aids,..)..

Heliport/landing site Flight crew (47: Platform visual information)

SR_DEP_CTRL#56. The heliport or landing location where PinS departure “proceed VFR” are performed shall not require additional requirements compared to VFR departure conducted on this heliport/landing location (physical characteristics, obstacle environment, visual aids,..).


SO_DEP_CTRL#10 Helicopters shall perform transition between visual

SR_DEP_CTRL#17. The helicopter operator shall determine the operating minima applicable for the PinS departure operations in accordance with AIR OPS.

Helicopter operator Flight crew (48 : operating minima)


Generic Safety Case




flight phase and instrument flight phase, if visual references are maintained until reaching the IDF at or above the IDF MCA.

ASS_DEP_CTRL#10. The flight crew checks during pre-flight if the predicted visibility conditions at local departure heliport/location are compliant with operating minima. Note: : Requirements relating to provision of MET information to the flight crew by MET provider and ATCO are derived below through assessment of SO_DEP_CTRL#24

Flight crew

ASS_DEP_CTRL#11. The flight crew prepares the departure in accordance with local MET information.

Flight crew

SR_DEP_CTRL#18. The flight Crew shall monitor if the visual references are maintained during visual flight phase until reaching the IDF at or above IDF MCA.

Flight crew

SR_DEP_CTRL#19. The flight crew shall perform transition to instrument segment when reaching the IDF at or above the IDF MCA.

Helicopter operator Flight crew (18: Flight operations procedure)

SR_DEP_CTRL#20. The flight crew shall request to Controller the PinS departure clearance at or prior the IDF, when flying a “proceed VFR” departure procedure.

Pilot ATCO (25 PinS clearance)

SR_DEP_CTRL#21. The ATC controller shall give a PinS departure clearance to the flight crew at or prior the IDF, when flying a “Proceed VFR” departure procedure.


SO_DEP_CTRL#11 Helicopters shall abort and return to heliport or landing location if visual references are no longer maintained until reaching the IDF at or above the MCA IDF

SR_DEP_CTRL#22. The helicopter’s operator shall define a contingency procedure for the case of degradation of visibility conditions leading to a loss of the required visual reference, during the visual segment of a PinS departure.

Helicopter operator Flight crew (18: Flight operations procedures and training)

SR_DEP_CTRL#23. In case of loss of the required visual reference before reaching the IDF, the flight crew shall respect the helicopter operator’s contingency procedures and inform the controller as soon as possible.

Flight crew

SO_DEP_CTRL#12 The instrument segments of the PinS departure procedure shall be designed and promulgated to prevent A/C

from colliding with terrain

and obstacle.ss.

SR_DEP_CTRL#6 The aeronautical, terrain and obstacle data used in the design of the helicopter PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SR_DEP_CTRL#7 The PinS departure procedure (i.e. visual segment when applicable, instrument segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.


SR_DEP_CTRL#8 The verification and validation of the PinS departure procedure shall be made in accordance with the quality process specified in ICAO Doc 9906


SR_DEP_CTRL#9 The PinS departure procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate the required aircraft navigation capability to fly the procedure (e.g. RNP1 or RNP0.3).



Generic Safety Case




SR_DEP_CTRL#12 The promulgation of PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SO_DEP_CTRL#13 Helicopters shall respect the lateral path of the instrument segments of the PinS departure procedure

SR_DEP_CTRL#24. The GNSS signal in space (GPS and SBAS if required) shall be compliant with ICAO Annex 10 SARPS on the PinS departure procedure.

GPS RNAV subsystem (01 GPS signal)

SBAS RNAV subsystem (03: SBAS signal)

ASS_DEP_CTRL#12. The navigation data base is provided by an approved Type 2 DAT provider (EU N°2017/373) or the processes of producing and updating the navigation data base shall meet the standards specified in EUROCAE ED-76/RTCA DO-200A (e.g. Letter Of Acceptance or equivalent process).

NavDB integrator & packer Helicopter Operator (13: Nav Data Base)

ASS_DEP_CTRL#13. The helicopter operator uses a navigation data base which satisfies the requirements of the CS ACNS and IR AIROPS (or equivalent OPS regulation) in order to meet standards of integrity that are adequate for the intended use of the electronic navigation data. SR_DEP_CTRL#25. The flight crew shall not modify the PinS procedure stored in the navigation database as defined in AIR OPS.

Helicopter Operator RNAV subsystem (20: Nav Data Base)

SR_DEP_CTRL#26. The flight crew shall select the PinS departure procedure in the RNAV system’s flight plan.

Flight Crew RNAV subsystem (33: PinS selection)

SR_DEP_CTRL#27. The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument segment of the PinS departure procedure.

RNAV subsystem Flight control & display (34: RNP nav data)

ASS_DEP_CTRL#14. The flight crew respects the displayed RNAV lateral navigation information if the flight is conducted in manual mode or using Flight director.

Flight crew Flight control & display (36 display & guidance selection)

Flight control & display Flight Crew (37: Display and guidance data)

ASS_DEP_CTRL#15. The RNAV subsystem and the flight guidance system guide laterally the helicopter in accordance with the instrument segment of the PinS departure, as coded in the navigation database, if flight is conducted in autopilot mode coupled to the navigation source.



SO_DEP_CTRL#14 Helicopters shall respect the vertical profile/constraints of

SR_DEP_CTRL#28. The ATC controller shall provide the QNH information to the flight crew for the helicopter PinS departure.

ATCO Flight Crew (27: QNH)


Generic Safety Case




the instrument segments of the PinS departure procedure

SR_DEP_CTRL#29. The PinS departure chart shall specify the QNH source (local or remote).

AIS Provider Helicopter operator (08: PinS chart)

SR_DEP_CTRL#30. The flight procedure designer shall take into account appropriate margins when using remote QNH, as defined in PANS OPS.


ASS_DEP_CTRL#16. The flight crew sets the appropriate QNH for the PinS departure.

Flight Crew Alt Sys (38: QNH setting)

ASS_DEP_CTRL#17. The flight crew selects and respects the altitude profile/constraints depicted on the PinS departure flight chart if the flight is conducted in manual mode or using Flight director.

Alt Sys Flight control & display (39: altitude)


ASS_DEP_CTRL#18. The Flight Management System and the altitude sub-system ensure compliance with vertical profile/constraints of the PinS departure, if the flight is conducted in autopilot VNAV mode.



SO_DEP_CTRL#15 Helicopter operators shall submit a flight plan

SR_DEP_CTRL#31. The State / ANSP shall define a departure site indicator/identifier allocation scheme for any departure site without an ICAO code. REC_DEP_CTRL#5. The State / ANSP should ensure consistency between States regarding the local heliport / landing site indicator/identifier allocation scheme (e.g. standardization at ICAO level). SR_DEP_CTRL#32. If not exempted, the Helicopter Operator shall submit the flight plan to the Network Manager including the PinS departure.

Air operator Flight Planning (21: FPL request)

SR_DEP_CTRL#33. The local ATS or Network Manager shall be able to validate the helicopter flight plan including PinS departure procedure.

Flight Planning

ASS_DEP_CTRL#19. The Network Manager approves the helicopter flight plan and informs the Aircraft Operator following flight plan acceptance.

Flight Planning Air operator (22 Approved FPL)

ASS_DEP_CTRL#20. The Network Manager distributes the approved helicopter flight plan to relevant Air Traffic Service units.

Flight Planning ATCO (22 Approved FPL)

SO_DEP_CTRL#16 ATC shall separate traffic during the instrument flight phase of the PinS departure

ASS_DEP_CTRL#21. The ATC controller establishes separation between helicopters operating on the instrument segment of the PinS departure in accordance with prescribed minima.


ASS_DEP_CTRL#22. The ATC controller separates helicopters established on the instrument segment of the PinS departure procedure with other IFR aircraft in the vicinity of the departure, in airspace class C and D.




Generic Safety Case




ASS_DEP_CTRL#23. The ATC controller separates helicopters established on the instrument segment of the PinS departure procedure with VFR aircraft in the vicinity of the departure, in airspace class C Note: See SO_DEP_CTRL#20 for provision of traffic information in classes D and E where separation is not provided with VFR aircraft.



SO_DEP_CTRL#17 ATC shall maintain separation between A/C during the instrument flight phase of the PinS departure

ASS_DEP_CTRL#24. The ATC controller maintains separation between aircraft on the instrument segment of the PinS departure in accordance with prescribed minima and airspace class.



SO_DEP_CTRL#18 The instrument segment of the PinS departure shall be designed and promulgated to facilitate the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable

SR_DEP_CTRL#34. The flight procedure design shall take into account the transition between PinS departure and the low level route or other existing routes/SID/STAR (RNP values, altitudes, speed constraints, waypoints).


SO_DEP_CTRL#19 Helicopters shall perform the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable

SR_DEP_CTRL#35. The ATC controller shall give appropriate clearance (speed and altitude) if needed to facilitate the transition between the PinS departure and the low level route or other existing routes/SID/STAR (i.e. to facilitate the compliance with published altitude or speed constraints).

Flight crew

SR_DEP_CTRL#36. The flight crew shall comply with constraints published on the flight procedure and with the ATCO clearance relating to the transition between the Pins departure and the low level route (or other existing routes/SID/STAR).

Flight crew

SR_DEP_CTRL#37. The Flight Control and Display sub-system shall display an appropriate full scale deflection during the transition between the PinS departure and the low level route (or other existing routes/SID/STAR/approach) to avoid disturbance of the flight crew.

Flight Control and Display sub-system Flight crew (37: Display and guidance data)

SO_DEP_CTRL#20 ATS shall inform helicopters conducting the PinS departure about other known traffic

ASS_DEP_CTRL#25. The ATC controller provides traffic information about VFR flights to helicopters established on the PinS departure in accordance with airspace class.


SO_DEP_CTRL#21 The PinS departure procedure shall be designed and promulgated to ensure separation from the prohibited airspace / restricted areas in the vicinity of the heliport/landing location

SR_DEP_CTRL#38. The procedure designer shall be provided with data relating to prohibited and restricted areas in the vicinity of the heliport / departure location.

AIS Provider Flight procedure design (07: Aeronautical data)

SR_DEP_CTRL#39. The procedure designer shall, as far as practicable, ensure strategic separation between the PinS departure and the prohibited and restricted areas in the vicinity of the heliport / departure location.



Generic Safety Case




SO_DEP_CTRL#22 If the PinS departure is not strategically separated from prohibited/restricted areas, ATC shall ensure separation between helicopters on the PinS departure and prohibited/restricted areas

ASS_DEP_CTRL#26. Coordination procedures are implemented between the ATSP and operator regarding the activation/de-activation of prohibited/restricted airspace.

ATCO Flight crew (26: ATC tactical clearance)

SO_DEP_CTRL#23 Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS departure

SR_DEP_CTRL#40. The PinS departure chart shall clearly indicate the prohibited/restricted areas in the vicinity of the route.




SO_DEP_CTRL#24 Helicopters shall be informed of the local MET conditions

SR_DEP_CTRL#41. Local MET information at the departure heliport/departure location shall be provided to the ATCO and helicopter operator. This local MET information can be provided either by an aeronautical meteorological service compliant with ICAO Annex 3 at destination or an equivalent meteorological service with approval from local Competent Authority or an aeronautical meteorological service compliant with ICAO Annex 3 at neighboring airport with approval from local Competent Authority.

MET Helicopter operator and ATCO (46: MET info)

SR_DEP_CTRL#42. Local MET information shall include at the minimum the following information: visibility, ceiling and QNH.


B.1.1.2 Abnormal operations

The table below derives assumptions and Safety Requirements for Abnormal PinS departure by mapping the Safety Objectives (Functionality and Performance) for abnormal operations onto the related elements of the PinS Functional system logical model from Section 6.1.1.

Safety Objectives (Abnormal operations)


SO_DEP_CTRL#25 In case of loss of RNP navigation during the instrument segment of the PinS departure, the pilot shall revert to contingency procedures and inform ATS as soon as possible when in controlled airspace

SR_DEP_CTRL#43. The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on the PinS departure and considering the local environment.


SR_DEP_CTRL#44. In case of loss of RNP capability on the PinS departure procedure, the flight crew shall respect the helicopter operator’s contingency procedures (e.g. conventional navigation or dead reckoning).

Conv nav sub-syst Flight control & display (40: Conv Nav data)

Flight crew


Generic Safety Case




SR_DEP_CTRL#45. The flight crew shall inform controller about the loss of RNP capability on the PinS departure procedure and about the contingency procedure.

Flight crew ATCO (43: Specific Request)

SO_DEP_CTRL#26 In case of loss of communication in controlled airspace, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications

ASS_DEP_CTRL#27. The AIP defines local contingency procedure to be applied by flight crew in case of radio communication failure. ASS_DEP_CTRL#28. In case of radio communication failure, the flight crew flies the procedure/route in accordance with the flight planning and sets the transponder to Code 7600 to indicate the loss of air-ground communications

Flight crew

SO_DEP_CTRL#27 In case of icing conditions in controlled airspace, a flight crew contingency procedure shall be defined considering the operational environment of the PinS departure.

SR_DEP_CTRL#46. The helicopter operator shall define a contingency procedure adapted to the operational environment in case of icing conditions encountered on the PinS departure.


SR_DEP_CTRL#47. In case of icing conditions on the PinS departure procedure, flight crews shall respect the helicopter operator’s contingency procedures.

Flight crew

B.1.2 Uncontrolled airspace


The table below derives assumptions and Safety Requirements for normal PinS departure operations by mapping the Safety Objectives (Functionality and Performance) for Normal operations onto the related elements of the PinS Functional system logical model from Section 6.2.1.




SO_DEP_UNCTRL#1

Spacing between departure procedures and between approach and departure procedure shall be determined considering navigation performance

and traffic density

SR_DEP_UNCTRL#1. The flight procedure design shall, as far as practicable, ensure strategic separation between PinS departure procedures and between the PinS departure and other procedures considering navigation performance and airspace constraints (other trajectories in the vicinity, restricted areas…).…


SO_DEP_UNCTRL#2

Operational use of the PinS departure shall be coordinated between involved entities.

SR_DEP_UNCTRL#2. ATSPs shall ensure coordination between entities (e.g. FIS, ATCO, AFIS, heliport/departure site…) for the operational use of the PinS departure.

ATSP

SR_DEP_UNCTRL#3. The AIS shall publish in the AIP the operational PinS usage restrictions if any.

AIS


Generic Safety Case




SO_DEP_UNCTRL#3

Each pilot shall maintain visual separation with other A/C, in VMC conditions, during the visual and instrument flight phase (in VMC condition) of the PinS departure

ASS_DEP_UNCTRL#1. The flight crew actively searches for conflicting traffic, during instrument and visual flight phase of the PinS, when weather conditions permit (see and avoid) based on traffic information provided by other aircraft and by flight information services when available. Note : A requirement is defined through the failure case for the equipage of traffic advisory system for IFR helicopter REC_DEP_UNCTRL#2. All aircraft operating in the vicinity of the PinS departure should be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) device. ASS_DEP_UNCTRL#2. When fitted, traffic advisory system or equivalent system facilitates visual acquisition of the aircraft.

Flight crew VFR & IFR (45: see and avoid, 47: see and avoid)

ASS_DEP_UNCTRL#3. VFR or IFR pilots flying in the vicinity of the PinS departure actively search for conflicting traffic when weather conditions permit (see and avoid) based on traffic information provided by other aircraft and by flight information services when available.

VFR & IFR Flight crew (45: see and avoid, 47: see and avoid)

SO_DEP_UNCTRL#4

The visual segment of the PinS “proceed visually” departure procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles

SR_DEP_UNCTRL#4. The aeronautical, terrain and obstacle data used in the design of the helicopter PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SR_DEP_UNCTRL#5. The PinS departure procedure (i.e. visual segment when applicable, instrument segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.


SR_DEP_UNCTRL#6. The verification and validation of the PinS departure procedure shall be made in accordance with the quality process specified in ICAO Doc 9906.



Generic Safety Case




SR_DEP_UNCTRL#7. The PinS departure procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate the required aircraft navigation capability to fly the procedure (e.g. RNP1 or RNP0.3). SR_DEP_UNCTRL#8. The AIS provider shall define the naming and phraseology associated with the PinS departure in accordance with ICAO rule to ensure consistency between operator (FMS, phraseology) and ATS (Phraseology). SR_DEP_UNCTRL#9. The AIS provider shall inform airspace users (e.g. through AIC) about the implementation of a PinS departure and the possible increase of IFR traffic in the the vicinity of the heliport / departure location.


SR_DEP_UNCTRL#10. The promulgation of the PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SO_DEP_UNCTRL#5 Helicopters shall respect lateral and vertical constraints if applicable of the visual segment of the PinS “proceed visually” departure procedure

SR_DEP_UNCTRL#11. The Flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS “proceed visually” departure chart. For proceed visually with direct segment, lateral and vertical path are indicated on the chart.


SO_DEP_UNCTRL#6

Pilots shall see and avoid the obstacles during visual segment of the PinS departure procedure

SR_DEP_UNCTRL#12. The procedure designer shall depict the relevant obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart.




SR_DEP_UNCTRL#13. The procedure designer shall depict, on the PinS “proceed VFR” chart, the relevant obstacles in the vicinity of the heliport or departure location.




ASS_DEP_UNCTRL#4. The flight crew actively seeks for potential obstacle during visual segment of the PinS “proceed visually” or “proceed VFR” departure.

Flight crew


Generic Safety Case




REC_DEP_UNCTRL#3. Helicopters flying the PinS departure procedure should be equipped with HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacle database should be kept up to date. ASS_DEP_UNCTRL#5. When fitted, HTAWS provides alert to the flight crew when a risk of collision with an obstacle is detected.


SO_DEP_UNCTRL#7 The PinS departure shall be designed and promulgated to facilitate the transition between the visual flight phase to the instrument flight phase.

SR_DEP_UNCTRL#5 The PinS departure procedure (i.e. visual segment when applicable, instrument segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.


SR_DEP_UNCTRL#6 The verification and validation of the PinS departure procedure shall be made in accordance with the quality process specified in ICAO Doc 9906.


SR_DEP_UNCTRL#7 The PinS departure procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate the required aircraft navigation capability to fly the procedure (e.g. RNP1 or RNP0.3)


SR_DEP_UNCTRL#10 The promulgation of the PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SR_DEP_UNCTRL#46. The heliport or landing location where PinS departures “proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14 Vol II applicable to non-instrument heliport (physical characteristics, obstacle environment, visual aids,..)..


SR_DEP_UNCTRL#47. The heliport or landing location where PinS departures “proceed VFR” are performed shall not require additional requirements compared to VFR departure conducted on this heliport/landing location (physical characteristics, obstacle environment, visual aids,..).


SO_DEP_UNCTRL#8


SR_DEP_UNCTRL#14. The helicopter operator shall determine the operating minima applicable for the PinS departure operations in accordance with AIR OPS


ASS_DEP_UNCTRL#6. The flight crew checks during pre-flight if the predicted visibility conditions at local heliport or landing location are compliant with operating minima. Note: : Requirements relating to provision of MET information to the flight crew are derived below through assessment of SO_DEP_UNCTRL#18

Flight crew

ASS_DEP_UNCTRL#7. The flight crew prepares flight plan in accordance with local MET information.

Flight crew


Generic Safety Case




SR_DEP_UNCTRL#15. The flight Crew shall monitor if the visual references are maintained during visual flight phase until reaching the IDF at or above IDF MCA.

Flight crew

SR_DEP_UNCTRL#16. The flight crew shall perform transition to instrument segment when reaching the IDF at or above the IDF MCA.


SO_DEP_UNCTRL#9

Helicopters shall abort and return to heliport or landing location if visual references are no longer maintained until reaching the IDF at or above the MCA IDF

SR_DEP_UNCTRL#17. The helicopter’s operator shall define a contingency procedure for the case of degradation of visibility conditions leading to a loss of the required visual reference, during the visual segment of a PinS departure.


SR_DEP_UNCTRL#18. In case of loss of the required visual reference before reaching the IDF, flight crew shall respect helicopter operator’s contingency procedures and inform the Aerodrome Flight Information Service Officer when available.

Flight crew

SO_DEP_UNCTRL#10


colliding with terrain and obstacles

SR_DEP_UNCTRL#4 The aeronautical, terrain and obstacle data used in the design of the helicopter PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information


SR_DEP_UNCTRL#5 The PinS departure procedure (i.e. visual segment when applicable, instrument segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.


SR_DEP_UNCTRL#6 The verification and validation of the PinS departure procedure shall be made in accordance with the quality process specified in ICAO Doc 9906.


SR_DEP_UNCTRL#7 The PinS departure procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate the required aircraft navigation capability to fly the procedure (e.g. RNP1 or RNP0.3).


SR_DEP_UNCTRL#10 The promulgation of the PinS departure procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SO_DEP_UNCTRL#11 Helicopters shall respect the lateral path of the instrument segments of the PinS departure procedure

SR_DEP_UNCTRL#19. The GNSS signal in space (GPS and SBAS if required) shall be compliant with ICAO Annex 10 SARPS on the PinS departure procedure.




Generic Safety Case




ASS_DEP_UNCTRL#8. The navigation data base is provided by an approved Type 2 DAT provider (EU N°2017/373) or the processes of producing and updating the navigation data base shall meet the standards specified in EUROCAE ED-76/RTCA DO-200A (e.g. Letter Of Acceptance or equivalent process).


ASS_DEP_UNCTRL#9. The helicopter operator uses a navigation data base which satisfies the requirements of the CS ACNS and IR AIROPS (or equivalent OPS regulation) in order to meet standards of integrity that are adequate for the intended use of the electronic navigation data. SR_DEP_UNCTRL#20. The flight crew shall not modify the PinS procedure stored in the navigation database as defined in AIR OPS.


SR_DEP_UNCTRL#21. The flight crew shall select the PinS departure procedure in the RNAV system’s flight plan.

Flight crew RNAV subsystem (34: PinS selection)

SR_DEP_UNCTRL#22. The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument segment of the PinS departure procedure.


ASS_DEP_UNCTRL#10. The flight crew respects the displayed RNAV lateral navigation information if flight is conducted in manual mode or using Flight director.

Flight crew Flight control & display (38: display & guidance selection)


ASS_DEP_UNCTRL#11. The RNAV subsystem and the flight guidance system guide laterally the helicopter in accordance with the instrument segment of the PinS departure, as coded in the navigation database, if flight is conducted in autopilot mode coupled to the navigation source.

Flight crew Flight control & display (38: display & guidance selection)


SO_DEP_UNCTRL#12 Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS departure procedure

SR_DEP_UNCTRL#23. Wherever available, AFISO or departure site operator shall provide the local QNH information to the Flight Crew for the helicopter PinS departure

AFISO Flight Crew (30: QNH)

SR_DEP_UNCTRL#24. The PinS departure chart shall specify the QNH source (local or remote).


SR_DEP_UNCTRL#25. The flight procedure designer shall take into account appropriate margins when using remote QNH, as defined in PANS OPS.


ASS_DEP_UNCTRL#12. The flight crew sets the appropriate QNH for the PinS departure.

Flight crew Alt Sys (40: QNH setting)


Generic Safety Case




ASS_DEP_UNCTRL#13. The flight crew selects and respects the altitude profile/constraints depicted on the PinS departure flight chart if flight is conducted in manual mode or using Flight director.



ASS_DEP_UNCTRL#14. The Flight Management System and the altitude sub-system ensure compliance with vertical constraints of the PinS departure, if the flight is conducted in autopilot VNAV mode.



SO_DEP_UNCTRL#13The instrument segment of the PinS departure shall be designed and promulgated to facilitate the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable

SR_DEP_UNCTRL#26. If applicable, the flight procedure design shall take into account the transition between the PinS departure and the low level route or other existing routes/SID/STAR (RNP values, altitudes, speed constraints, waypoints).


SO_DEP_UNCTRL#14 Helicopters shall perform the transition between the PinS departure and the low level route or other existing routes/SID/STAR when applicable

SR_DEP_UNCTRL#27. The Flight Control and Display sub-system shall display an appropriate full scale deflection during transition between the PinS departure and the low level route (or other existing routes/SID/STAR) to avoid disturbance of the flight crew.


SR_DEP_UNCTRL#28. The flight crew shall comply with constraints published on the flight procedure relating to transition between the Pins departure and the low level route (or other existing routes/SID/STAR).

Flight crew

SO_DEP_UNCTRL#15 Helicopters shall inform other A/C about their position and flight intent

SR_DEP_UNCTRL#29. The flight crew established on the PinS departure shall transmit regularly their position and flight intent to inform other helicopters operating on the PinS departure and other aircraft flying in the vicinity of the PinS departure.

Flight crew VFR & IFR

VFR & IFR Flight crew

(46: blind call, 48: blind call)

SR_DEP_UNCTRL#30. VFR or IFR pilots flying in the vicinity of the PinS departure shall transmit regularly their position and flight intent to inform helicopters established on the PinS departure.





Generic Safety Case




SR_DEP_UNCTRL#31. A Radio Mandatory Zone (RMZ) shall be defined around the PinS departure in order to maintain continuous air-ground voice communication watch and establish two-way communication, as necessary, on the appropriate communication channel, unless it is shown that mitigating the risk of conflict between IFR and VFR is not required considering the airspace structure, traffic density, traffic complexity and the current level of safety associated to aircraft operations in this airspace.

Flight crew Flight crew

ASS_DEP_UNCTRL#15. When AFIS is available and for known traffic, the Aerodrome Flight Information Service Officer provides information about helicopters established on the PinS departure and aircraft in the vicinities of the PinS departure.

AFISO Flight Crew (29: Flight information)

SO_DEP_UNCTRL#16 The PinS departure procedure shall be designed and promulgated to ensure separation from the prohibited airspace/restricted areas in the vicinity of the heliport/landing location

SR_DEP_UNCTRL#32. The procedure designer shall be provided with data relating to prohibited and restricted areas in the vicinity of the heliport / departure location.


SR_DEP_UNCTRL#33. The procedure designer shall, as far as practicable, ensure strategic separation between the PinS departure and prohibited and restricted areas in the vicinity of the heliport / departure location.


SO_DEP_UNCTRL#17 Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS departure

SR_DEP_UNCTRL#34. The PinS departure chart shall clearly indicate the prohibited/restricted areas in the vicinity of the route.




SO_DEP_UNCTRL#18 Helicopters shall be informed of the local MET conditions

SR_DEP_UNCTRL#35. Local MET information at the departure heliport / departure location shall be provided to the AFISO, when available, and to the helicopter operator. This local MET information can be provided either by: an aeronautical meteorological service compliant with ICAO Annex 3 at destination airport or, an equivalent meteorological service not compliant with ICAO Annex 3 with approval from local Competent Authority or, an aeronautical meteorological service compliant with ICAO Annex 3 at neighboring airport

with approval from local Competent Authority.


SR_DEP_UNCTRL#36. Local MET information shall include at the minimum the following information: visibility, ceiling and QNH.



Generic Safety Case



The table below derives assumptions and Safety Requirements for Abnormal PinS departure operations by mapping the Safety Objectives (Functionality and Performance) for abnormal operations onto the related elements of the PinS Functional system logical model from Section 6.2.1.



SO_DEP_UNCTRL#19: In case of loss of RNP navigation, the pilot shall revert to contingency procedures and inform other aircraft and, if applicable, the Aerodrome Flight Information Service in uncontrolled airspace

SR_DEP_UNCTRL#37. The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on the PinS departure and considering the local environment.


SR_DEP_UNCTRL#38. In case of loss of RNP capability on the PinS departure procedure, flight crews shall respect the helicopter operator’s contingency procedures (e.g. conventional navigation or dead reckoning).


Flight crew

SO_DEP_UNCTRL#20: In case of loss of communication in uncontrolled airspace where RMZ is promulgated, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications

ASS_DEP_UNCTRL#16. The AIP defines local contingency procedure to be applied by flight crews in case of radio communication failure. ASS_DEP_UNCTRL#17. In case of radio communication failure, the flight crew flies the procedure/route in accordance with the flight planning and sets the transponder to Code 7600 to indicate the loss of air-ground communications.

Flight crew

SO_DEP_UNCTRL#21: In case of icing conditions in uncontrolled airspace, a contingency procedure shall be defined considering the operational environment of the PinS departure

SR_DEP_UNCTRL#39. The helicopter operator shall define a contingency procedure adapted to the operational environment in case of icing conditions encountered on the PinS departure.


SR_DEP_UNCTRL#40. In case of icing conditions on the PinS departure procedure, flight crews shall respect the helicopter operator’s contingency procedures.

Flight crew

B.2 Detailed derivation of Safety Requirements for PinS approach operations

B.2.1 Controlled airspace


The table below derives assumptions and Safety Requirements for Normal PinS approach operations by mapping the Safety Objectives for Normal operations onto the related elements of the PinS Functional system logical model from Section 6.1.1.


Generic Safety Case




SO_APR_CTRL#1: Spacing between approach procedures and between approach and departure procedure shall be determined considering navigation performance, separation minima, traffic density, sector size and controller procedures / HMI

SR_APR_CTRL#1. The flight procedure design shall, as far as practicable, ensure strategic separation between PinS approaches procedures and between PinS approach and other procedures considering navigation performance and airspace constraints (sector size, other trajectories in the vicinity, restricted areas…)…

SR_APR_CTRL#2. The flight procedure design shall take into account ATC constraints such as separation minima, traffic density, sector size, controller procedures / HMI…


SO_APR_CTRL#2: The instrument segment of the PinS approach shall be designed and promulgated to facilitate the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach

SR_APR_CTRL#3. When applicable, the flight procedure design shall take into account the transition between the low level route (or other existing routes/SID/STAR) and the PinS approach (RNP values, altitudes, speed constraints, waypoints).


SO_APR_CTRL#3: Helicopters shall perform the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach

SR_APR_CTRL#4. The ATC controller shall give appropriate clearance when needed to facilitate the transition between the low level route (or other existing routes/SID/STAR) and the PinS approach (i.e. to facilitate the compliance with published altitude or speed constraints).

ATCO Flight crew (26: tactical clearance)

SR_APR_CTRL#5. The flight crew shall comply with constraints published on the flight procedure and with the ATCO clearance relating to transition between the low level route (or other existing routes/SID/STAR) and the PinS approach.

Flight crew

SR_APR_CTRL#6. The Flight Control and Display sub-system shall display an appropriate full scale deflection during transition between the low level route (or other existing routes/SID/STAR) and the PinS approach to avoid disturbance of the flight crew.


SO_APR_CTRL#4: The instrument segments of the PinS approach procedure shall be designed and promulgated to prevent A/C from colliding with terrain and obstacles

SR_APR_CTRL#7. The aeronautical, terrain and obstacle data used in the design of the helicopter PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SR_APR_CTRL#8. The PinS approach procedure (i.e. initial approach segment, intermediate approach segment, final approach segment, missed approach and, if applicable visual segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.


SR_APR_CTRL#9. The verification and validation of the PinS approach procedure shall be made in accordance with the quality process specified in ICAO Doc 9906.



Generic Safety Case




SR_APR_CTRL#10. The PinS approach procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate in particular the OCA/H and the required aircraft navigation capability to fly the procedure (e.g. RNP APCH).

SR_APR_CTRL#11. The AIS provider shall define the naming and phraseology associated with the PinS approach in accordance with ICAO rules to ensure consistency between operator (FMS, phraseology) and ATS (Phraseology).

SR_APR_CTRL#12. The AIS provider shall inform airspace users (e.g. through AIC) about the implementation of a PinS approach and the possible increase of IFR traffic in the the vicinity of the heliport / landing location.


SR_APR_CTRL#13. The promulgation of a PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SO_APR_CTRL#5: Helicopters shall respect the lateral path of the instrument segments of the PinS approach procedure

SR_APR_CTRL#14. The GNSS signal in space (GPS and SBAS if required) shall be compliant with ICAO Annex 10 SARPS on the PinS approach procedure.



ASS_APR_CTRL#1. The navigation database is provided by an approved Type 2 DAT provider (EU N°2017/373) or the processes of producing and updating the navigation database shall meet the standards specified in EUROCAE ED-76/RTCA DO-200A (e.g. Letter Of Acceptance or equivalent process).


ASS_APR_CTRL#2. The helicopter operator uses a navigation data base which satisfies the requirements of the CS ACNS and IR OPS (or equivalent OPS regulation) in order to meet standards of integrity that are adequate for the intended use of the electronic navigation data. SR_APR_CTRL#15. The flight crew shall not modify the

PinS procedure stored in the navigation database as defined in AIR OPS.


SR_APR_CTRL#16. The flight crew shall select the PinS approach procedure in the RNAV system’s flight plan.


SR_APR_CTRL#17. The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument segment of the PinS approach procedure.


ASS_APR_CTRL#3. The flight crew respects the displayed RNAV lateral navigation information if the flight is conducted in manual mode or using Flight director.


Flight control & display Flight Crew (37:


Generic Safety Case



Safety Requirements Maps on to / Data flow (Logical Model) Display and guidance data)

ASS_APR_CTRL#4. The RNAV subsystem and the flight guidance system guide laterally the helicopter in accordance with the instrument segment of the PinS approach, as coded in the navigation database, if the flight is conducted in autopilot mode coupled to the navigation source.



SO_APR_CTRL#6: Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS approach procedure

SR_APR_CTRL#18. The ATC controller shall provide the QNH information to the flight crew for the helicopter PinS approach.

ATCO Flight Crew (27: QNH)

SR_APR_CTRL#19. The PinS approach chart shall specify the QNH source (local or remote) to be used.


SR_APR_CTRL#20. The flight procedure designer shall take into account appropriate margins when using remote QNH, as defined in PANS OPS.


SR_APR_CTRL#21. The flight crew shall set the appropriate QNH (local QNH or remote QNH) for the PinS approach.


ASS_APR_CTRL#5. The flight crew selects and respects the altitude profile/constraints depicted on the PinS approach flight chart.



ASS_APR_CTRL#6. The Flight Management System and the altitude sub-system ensure compliance with vertical constraints of the intial and intermediate segment of the PinS approach, if flight is conducted in autopilot VNAV mode.



ASS_APR_CTRL#7. The helicopter operator and flight crew ensure compliance with CS ACNS when flying the final segment of the PinS approach (either with LNAV or LPV minima).

Helicopter operator

Flight Crew

SO_APR_CTRL#7: Helicopter operators shall submit a flight plan

SR_APR_CTRL#22. The State / ANSP shall define a landing site indicator/identifier allocation scheme for any landing site without an ICAO code.

REC_APR_CTRL#2. The State / ANSP should ensure consistency between States regarding the local heliport / landing site indicator/identifier allocation scheme (e.g. standardization at ICAO level). SR_APR_CTRL#23. If not exempted, the helicopter

operator shall submit the flight plan to the Network Manager including the PinS approach.

Air operator Flight Planning (21: FPL request)

SR_APR_CTRL#24. The local ATS or Network Manager shall be able to validate the helicopter flight plan including the PinS approach procedure.

Flight Planning


Generic Safety Case




ASS_APR_CTRL#8. The Network Manager approves the helicopter flight plan and informs the Aircraft Operator following flight plan acceptance

Flight Planning Air operator (22 Approved FPL)

ASS_APR_CTRL#9. The Network Manager distributes the approved helicopter flight plan to relevant Air Traffic Service units

Flight Planning ATCO (22 Approved FPL)

SO_APR_CTRL#8: ATC shall separate traffic during the instrument flight phase of the PinS approach

SR_APR_CTRL#25. The flight crew shall request to the controller for the clearance to initiate the PinS approach.

Issue_APR_CTRL#2. Possible issue on phraseology with PinS multi-destination (out of scope of current safety case).

Pilot ATCO (43 Specific Request)

SR_APR_CTRL#26. The ATC controller shall give a clearance to the flight crew to initiate the PinS approach.


ASS_APR_CTRL#10. The ATC controller establishes separation between helicopters operating on the instrument segment of the PinS approach in accordance with prescribed minima.


ASS_APR_CTRL#11. The ATC controller separates helicopters established on the instrument segment of the PinS approach procedure with other IFR aircraft in the vicinity of the approach.



ASS_APR_CTRL#12. The ATC controller separates helicopters established on the instrument segment of the PinS approach procedure with VFR aircraft in the vicinity of the approach, in airspace class C. Note: See SO_APR_CTRL#22 for provision of traffic information in classes D where separation is not provided with VFR aircraft.



SO_APR_CTRL#9: ATC shall maintain separation between A/C during the instrument flight phase of the PinS approach

ASS_APR_CTRL#13. The ATC controller maintains separation between aircraft during the instrument segment of the PinS approach in accordance with prescribed minima and airspace class.


SO_APR_CTRL#10: The PinS approach shall be designed and promulgated to facilitate the transition between the instrument flight phase to visual flight phase

SR_APR_CTRL#8: The PinS approach procedure (i.e. initial approach segment, intermediate approach segment, final approach segment, missed approach and, if applicable visual segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure. Note : PANS OPS includes specific criteria for the transition between instrument flight phase and visual flight phase (e.g. calculation of the OCA/H shall include an add-on value to ensure adequate transition between instrument flight phase and visual flight phase.







Generic Safety Case






SR_APR_CTRL#27. The ATC controller shall give appropriate speed and altitude instructions to the flight crew if needed to facilitate the transition between the instrument flight phase and the visual flight phase (i.e. to facilitate the compliance with published altitude or speed constraints).


SO_APR_CTRL#11: An instrument missed approach shall be designed and promulgated to support situations where visual references are not obtained at the PinS.




Flight procedure validation flight procedure design (05: procedure validation)





SO_APR_CTRL#12: Helicopters shall perform transition between instrument flight phase and visual flight phase, if visual references are obtained at or prior the MAPt

SR_APR_CTRL#28. The helicopter operator shall determine the operating minima applicable for the PinS approach operations in accordance with AIR OPS, operator approval and flight crew training.

Helicopter operator flight crew (48 : operating minima)

ASS_APR_CTRL#14. The flight crew checks during pre-flight if the predicted visibility conditions at destination are compliant with operating minima. Note: Requirements relating to provision of MET information to the flight crew by MET provider and ATCO are derived below through assessment of SO_APR_CTRL#26.

Flight crew

ASS_APR_CTRL#15. The flight crew prepares flight plan (and particularly alternate heliport/landing site) in accordance with predicted MET information at destination.

Flight crew

SR_APR_CTRL#29. The flight crew shall check, during flight, before starting the PinS approach (i.e. before IAF), if the latest visibility conditions at destination – and, if different, in the vicinity of the approach -are compliant with operating minima.

Flight crew

SR_APR_CTRL#30. The flight crew shall abort the PinS approach and plan another approach if the predicted visibility conditions at destination are not compliant with operating minima.

Flight crew


Generic Safety Case




SR_APR_CTRL#31. The heliport or landing location where PinS approach “proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14 Vol II applicable to non-instrument heliport (physical characteristics, obstacle environment, visual aids,..).


SR_APR_CTRL#32. The heliport or landing location where PinS approach “proceed VFR” are performed shall not require additional requirements compared to VFR approach conducted on this heliport/landing location (physical characteristics, obstacle environment, visual aids,..).


SR_APR_CTRL#33. The flight procedure design shall take into account the flight validation’s feedback during the flight validation, in particular for the definition of the appropriate visual references associated with the heliport or landing location.

SR_APR_CTRL#34. The procedure designer shall depict, on the PinS “proceed visually” chart, visual references associated with the heliport or landing location.




SR_APR_CTRL#35. The flight crew shall perform the transition to the visual segment “proceed visually” if the heliport (or landing location) or direct visual references associated with it can be acquired at or prior the MAPt.


REC_APR_CTRL#3. The procedure designer should depict on the PinS “proceed VFR” chart, elements allowing to identify if VMC minima are satisfied.




SR_APR_CTRL#36. The flight crew shall perform the transition to the visual segment “proceed VFR” if the applicable operating minima are obtained at or prior the MAPt.


SR_APR_CTRL#37. The flight crew shall cancel the IFR flight when transitioning to the “proceed VFR” visual segment or after landed in accordance with local agreement.


SO_APR_CTRL#13: Helicopters shall execute the published missed approach if visual references are not obtained at or prior the PinS

SR_APR_CTRL#38. The flight crew shall perform a missed approach if the heliport (or landing location) or visual references associated with it cannot be acquired at or prior the MAPt of a “proceed visually” approach.

Helicopter operator Flight crew (18: Flight operations procedure

SR_APR_CTRL#39. The flight crew shall perform a missed approach if the applicable operating minima are not obtained at or prior the MAPt of a “proceed VFR” approach.


SO_APR_CTRL#14: The visual segment of the PinS “proceed visually” approach procedure shall be designed and

SR_APR_CTRL#7. The aeronautical, terrain and obstacle data used in the design of the helicopter PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.



Generic Safety Case




promulgated to prevent A/C from colliding with terrain and obstacles









SO_APR_CTRL#15: Helicopters shall respect lateral and vertical constraints if applicable of the visual segment of the PinS “proceed visually” approach procedure

SR_APR_CTRL#40. The flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS “proceed visually” approach chart. For direct visual segment, lateral and vertical path are indicated on the chart.


SO_APR_CTRL#16: Pilots shall see and avoid the obstacles during visual segment of the PinS approach procedure

SR_APR_CTRL#41. The procedure designer shall depict the relevant obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart.




SR_APR_CTRL#42. The procedure designer shall present the HAS (Height Above Surface), on the PinS “proceed VFR” chart.

SR_APR_CTRL#43. The procedure designer shall depict, on the PinS “proceed VFR” chart, the relevant obstacles in the vicinity of the visual segment.




ASS_APR_CTRL#16. The flight crew actively seeks any potential obstacles during the visual segment of the PinS “proceed visually” or “proceed VFR” approach.

Flight crew


Generic Safety Case




REC_APR_CTRL#4. Helicopters flying the PinS approach should be equipped with HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacle database should be kept up to date. ASS_APR_CTRL#17. When fitted, HTAWS provides alert to the flight crew when a risk of collision with an obstacle is detected.


SO_APR_CTRL#17: ATC shall separate traffic during the visual segment of the PinS approach for “proceed visually” operation

SR_APR_CTRL#25: The flight crew shall request to the controller for the clearance to initiate the PinS approach. Note: A single clearance is issued by the ATCO at the IAF for the complete PinS approach (including visual segment).

Pilot ATCO (43 Specific Request)

SR_APR_CTRL#26: The ATC controller shall give a clearance to the flight crew to initiate the PinS approach. Note: A single clearance is issued by the ATCO at the IAF for the complete PinS approach (including visual segment).


ASS_APR_CTRL#18. The ATC controller establishes separation between helicopters operating on the visual segment of the PinS “proceed visually” approach in accordance with prescribed minima.


ASS_APR_CTRL#19. The ATC controller separates helicopters established on the visual segment of the PinS “proceed visually” approach procedure with other IFR aircraft in the vicinity of the PinS approach.



ASS_APR_CTRL#20. The ATC controller separates helicopters established on the visual segment of the PinS “proceed visually” approach procedure with VFR aircraft in the vicinity of the PinS approach, in airspace class C. Note: Requirements relating to provision of traffic information with VFR in airspace classes D and E are derived through assessment of SO_APR_CTRL#22.



SO_APR_CTRL#18: ATC shall maintain separation between A/C during the visual segment of the PinS approach for “proceed visually” operation

ASS_APR_CTRL#21. The ATC controller maintains separation between aircraft during the visual segment of the PinS “proceed visually” approach in accordance with prescribed minima and with airspace class.


SO_APR_CTRL#19: ATC shall provide traffic information to A/C during the visual segment of the PinS approach for “proceed VFR” operation

ASS_APR_CTRL#22. The ATC controller provides traffic information about IFR flights to helicopters established on the visual segment of the PinS “proceed VFR” approach in airspace class D. Remark: Requirements regarding provision of traffic information about VFR flight are defined below through assessment of SO_APR_CTRL#22.


SO_APR_CTRL#20: Each pilot shall maintain separation with other A/C during the visual segment of the PinS approach for “proceed VFR” operation

ASS_APR_CTRL#23. The flight crew established on the visual segment of the PinS “proceed VFR” approach actively search for potentially conflicting traffic in all controlled airspace classes.

Flight crew VFR A/C (44: see and avoid) Flight vrew IFR A/C (49: see and avoid)

REC_APR_CTRL#5. All aircraft operating in the vicinity of the PinS approach should be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) device.



Generic Safety Case




REC_APR_CTRL#6. IFR helicopters flying the PinS approach should be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this procedure (i.e. a traffic advisory system). ASS_APR_CTRL#24. When fitted, traffic advisory system or equivalent system facilitates visual acquisition of the aircraft.

SO_APR_CTRL#21: The instrument and visual segments of the PinS approach shall be designed to facilitate deceleration and landing

SR_APR_CTRL#8: The PinS approach procedure (i.e. initial approach segment, intermediate approach segment, final approach segment, missed approach and, if applicable visual segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure. Note: The compliance of the procedure with ICAO PANS OPS criteria will ensure that the procedure will be flyable and will facilitate the deceleration and landing.


SO_APR_CTRL#22: ATS shall inform helicopters conducting the PinS approach about other known traffic

ASS_APR_CTRL#25. The ATC controller provides traffic information about VFR flights to helicopters established on PinS approach in accordance with airspace class.


SO_APR_CTRL#23: The PinS approach procedure shall be designed and promulgated to ensure separation from the prohibited airspace/restricted areas in the vicinity of the heliport/landing

SR_APR_CTRL#44. The procedure designer shall be provided with data relating to prohibited and restricted areas in the vicinity of the heliport / landing location.


SR_APR_CTRL#45. The procedure designer shall, as far as practicable, ensure strategic separation between the PinS approach and the prohibited and restricted areas in the vicinity of the heliport / landing location.


SO_APR_CTRL#24: If the PinS approach is not strategically separated from prohibited/restricted areas, ATC shall ensure separation between helicopters on the PinS approach and prohibited/restricted areas

ASS_APR_CTRL#26. Coordination procedures are implemented between ATSP and operator regarding the activation of prohibited/restricted airspace.

ATCO Flight crew (26: ATC tactical clearance)

SO_APR_CTRL#25: Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS approach

SR_APR_CTRL#46. The PinS approach chart shall clearly indicate the prohibited/restricted areas in the vicinity of the route.





Generic Safety Case




SO_APR_CTRL#26: Helicopters shall be informed of the forecasted MET conditions at destination

SR_APR_CTRL#47. Local MET information at the destination heliport/landing location shall be provided to the ATCO and helicopter operator. These local MET information can be provided either by: an aeronautical meteorological service compliant with ICAO Annex 3 at destination or, an equivalent meteorological service (e.g. based on Webcam or other dedicated tools) with approval from local Competent Authority or, an aeronautical meteorological service compliant with ICAO Annex 3 at neighboring airport with approval from local Competent Authority.


SR_APR_CTRL#48. Local MET information shall include at the minimum the following information: visibility, ceiling and QNH.


SR_APR_CTRL#49. The ATC controller shall inform the flight crew about change of MET conditions at the destination heliport or landing location.

ATCO Flight crew ( 30: MET update)

SO_APR_CTRL#27: Helicopters shall be informed of the forecasted MET conditions at alternate heliport

ASS_APR_CTRL#27. Local MET information at the alternate destination is provided to the helicopter operator.



The table below derives assumptions and Safety Requirements for Abnormal PinS approach operations by mapping the Safety Objectives (Functionality and Performance) for abnormal operations onto the related elements of the PinS Functional system logical model from Section 6.1.1.



SO_APR_CTRL#28: In case of loss of RNP navigation during instrument segment of the PinS approach, the pilot shall revert to contingency procedures and inform ATS as soon as possible when in controlled airspace

SR_APR_CTRL#50. The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on the PinS approach and considering the local environment.


SR_APR_CTRL#51. In case of loss of RNP capability on the PinS approach procedure, flight crews shall respect the helicopter operator’s contingency procedures (e.g. conventional navigation or dead reckoning).

Flight crew


SR_APR_CTRL#52. The flight crew shall inform the controller about the loss of RNP capability on the PinS approach procedure and about the contingency procedure.

Flight crew ATCO (43: Specific Request)

SO_APR_CTRL#29: In case of loss of communication in controlled airspace, the pilot shall fly the

ASS_APR_CTRL#28. The AIP defines local contingency procedure to be applied by flight crews in case of radio communication failure.

Flight crew


Generic Safety Case




procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications

ASS_APR_CTRL#29. In case of radio communication failure, flight crews shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 to indicate the loss of air-ground communications.

SO_APR_CTRL#30: In case of icing conditions in controlled airspace, a contingency procedure shall be defined considering the operational environment of the PinS approach.

SR_APR_CTRL#53. The helicopter operator shall define a contingency procedure adapted to the operational environment for the case of icing conditions encountered on the PinS approach.

Helicopter operator Flight crew (18: Flight operation procedures and training)

SR_APR_CTRL#54. In case of icing conditions on the PinS approach procedure, flight crews shall respect the helicopter operator’s contingency procedures.

Flight crew

SO_APR_CTRL#31: In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR” operation in controlled airspace, the pilot shall apply VFR contingency procedures (as currently done in VFR) and inform ATS

ASS_APR_CTRL#30. In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR”, the flight crew respects the helicopter operator’s VFR contingency procedures (as for any VFR operation).

Flight crew

SO_APR_CTRL#32: In case of degradation of visibility conditions during the visual segment of a PinS “proceed visually” operation in controlled airspace, the pilot shall apply contingency procedures considering the operational environment of the PinS approach and inform ATS as soon as possible

SR_APR_CTRL#55. The helicopter operator shall define a contingency procedure for the case of degradation of visibility conditions, leading to a loss of the required visual reference, during the visual segment of a PinS “proceed visually” approach.


SR_APR_CTRL#56. In case of degradation of visibility conditions, leading to a loss of the required visual reference, during the visual segment of a PinS “proceed visually” approach, flight crews shall respect the helicopter operator’s contingency procedures and inform as soon as possible the controller.

Flight crew

SO_APR_CTRL#33: ATC shall ensure separation of traffic in situation of peak of traffic in controlled airspace taking benefit of holdings published on the PinS approach procedure, if any

REC_APR_CTRL#7. The design of the PinS approach procedure should include holdings designed in accordance with ICAO PANS OPS criteria, depending on local environment and constraints.


SR_APR_CTRL#57. ATC shall provide appropriate air traffic services, in accordance with airspace class and helicopter flight rules, in situation of peak of traffic, taking benefit of the published holdings if any.

ATCO IFR flight (31: ATC control)


Generic Safety Case


B.2.2 Uncontrolled airspace


The table below derives assumptions and Safety Requirements for Normal PinS departure operations by mapping the Safety Objectives (Functionality and Performance) for Normal operations onto the related elements of the PinS Functional system logical model from Section 6.2.1.


Safety Objectives (Functionality and Performance –Normal operations)


SO_APR_UNCTRL#1: Spacing between approach procedures and between approach and departure procedures shall be determined considering navigation performance and traffic density.

SR_APR_UNCTRL#1. The flight procedure design shall, as far as practicable, ensure strategic separation between PinS approaches procedures and between PinS approaches and other procedures considering navigation performance and airspace constraints (other trajectories in the vicinity, restricted areas…)…


SO_APR_UNCTRL#2: The instrument segment of the PinS approach shall be designed and promulgated to facilitate the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach

SR_APR_UNCTRL#2. When applicable, the flight procedure design shall take into account the transition between the low level route (or other existing routes/SID/STAR) and the PinS approach (RNP values, altitudes, speed constraints, waypoints).


SO_APR_UNCTRL#3 : Helicopters shall perform the transition between the low level route or other existing routes/SID/STAR, when applicable, and the PinS approach

SR_APR_UNCTRL#3. The flight crew shall comply with constraints published on the flight procedure relating to transition between the low level route (or other existing routes/SID/STAR) and the PinS approach.

Flight crew

SR_APR_UNCTRL#4. The Flight Control and Display sub-system shall display an appropriate full scale deflection during transition between the low level route (or other existing routes/SID/STAR) and the PinS approach to avoid disturbance of the flight crew.


SO_APR_UNCTRL#4: The instrument segments of the PinS approach procedure shall be designed and promulgated to prevent

SR_APR_UNCTRL#5. The aeronautical, terrain and obstacle data used in the design of the helicopter PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.



Generic Safety Case




A/C from colliding with terrain and obstacles

SR_APR_UNCTRL#6. The PinS approach procedure (i.e. initial approach segment, intermediate approach segment, final approach segment, missed approach and, if applicable visual segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.


SR_APR_UNCTRL#7. The verification and validation of the PinS approach procedure shall be made in accordance with the quality process specified in ICAO Doc 9906.


SR_APR_UNCTRL#8. The PinS approach procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate in particular the OCA/H and the required aircraft navigation capability to fly the procedure (e.g. RNP APCH). SR_APR_UNCTRL#9. The AIS provider shall define the naming and phraseology associated with the PinS approach in accordance with ICAO rule to ensure consistency between operator (FMS, phraseology) and ATS (Phraseology). SR_APR_UNCTRL#10. The AIS Provider shall inform airspace users (e.g. through AIC) about the implementation of a PinS approach and the possible increase of IFR traffic in the the vicinity of the heliport / landing location.


SR_APR_UNCTRL#11. The promulgation of a PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SO_APR_UNCTRL#5: Helicopters shall respect the lateral path of the instrument segments of the PinS approach procedure

SR_APR_UNCTRL#12. The GNSS signal in space (GPS and SBAS if required) shall be compliant with ICAO Annex 10 SARPS on the PinS approach procedure.



ASS_APR_UNCTRL#1. The navigation data base is provided by an approved Type 2 DAT provider (EU N°2017/373) or the processes of producing and updating the navigation data base shall meet the standards specified in EUROCAE ED-76/RTCA DO-200A (e.g. Letter Of Acceptance or equivalent process).


ASS_APR_UNCTRL#2. The helicopter operator uses a navigation data base which satisfies the requirements of the CS ACNS and IR AIROPS (or equivalent OPS regulation) in order to meet standards of integrity that are adequate for the intended use of the electronic navigation data. SR_APR_UNCTRL#13. The flight crew shall not modify the PinS procedure stored in the navigation database as defined in AIR OPS.


SR_APR_UNCTRL#14. The flight crew shall select the PinS approach procedure in the RNAV system’s flight plan.



Generic Safety Case




SR_APR_UNCTRL#15. The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument segment of the PinS approach procedure.

RNAV subsystem Flight control & display (35: RNAV nav data)

ASS_APR_UNCTRL#3. The flight crew respects the displayed RNAV lateral navigation information if the flight is conducted in manual mode or using Flight director.



ASS_APR_UNCTRL#4. The RNAV subsystem and the flight guidance system guide laterally the helicopter in accordance with the instrument segment of the PinS approach, as coded in the navigation database, if flight is conducted in autopilot mode coupled to the navigation source.



SO_APR_UNCTRL#6: Helicopters shall respect the vertical profile/constraints of the instrument segments of the PinS approach procedure

SR_APR_UNCTRL#16. Wherever available, the AFISO or landing site operator shall provide the local QNH information to the flight crew for the helicopter PinS approach.

AFISO Flight Crew (30: QNH)

SR_APR_UNCTRL#17. The PinS approach chart shall specify the QNH source (local or remote) to be used.


SR_APR_UNCTRL#18. The flight procedure designer shall take into account appropriate margins when using remote QNH, as defined in PANS OPS.


SR_APR_UNCTRL#19. The flight crew shall set the appropriate QNH (local QNH or remote QNH) for the PinS approach.


ASS_APR_UNCTRL#5. The flight crew shall select and respect the altitude profile/constraints depicted on the PinS approach flight chart if flight is conducted in manual mode or using Flight director.



ASS_APR_UNCTRL#6. The Flight Management System and the altitude sub-system ensure compliance with vertical constraints of the intial and intermediate segment of the PinS approach, if flight is conducted in autopilot VNAV mode.



ASS_APR_UNCTRL#7. The helicopter operator and flight crew ensure compliance with CS ACNS when flying the final segment of the PinS approach (either with LNAV or LPV minima).

Helicopter operator

Flight crew


Generic Safety Case




SO_APR_UNCTRL#7: The PinS approach shall be designed and promulgated to facilitate the transition between the instrument flight phase to visual flight phase

SR_APR_UNCTRL#6. The PinS approach procedure (i.e. initial approach segment, intermediate approach segment, final approach segment, missed approach and, if applicable visual segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure. Note : PANS OPS includes specific criteria for the transition between instrument flight phase and visual flight phase (e.g. calculation of the OCA/H shall include an add-on value to ensure adequate transition between instrument flight phase and visual flight phase.




SR_APR_UNCTRL#8. The PinS approach procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate in particular the OCA/H and the required aircraft navigation capability to fly the procedure (e.g. RNP APCH).


SR_APR_UNCTRL#11. The promulgation of a PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical data/information.


SO_APR_UNCTRL#8: Helicopters shall perform transition between instrument flight phase and visual flight phase, if visibility requirements are obtained at or prior the MAPt

SR_APR_UNCTRL#20. The helicopter operator shall determine the operating minima applicable for the PinS approach operations in accordance with AIR OPS.


ASS_APR_UNCTRL#8. The flight crew checks during pre-flight if the predicted visibility conditions at destination are compliant with operating minima. Note: Requirements relating to provision of MET information to the flight crew by MET provider and ATCO are derived below through assessment of SO_APR_UNCTRL#19.

Flight crew

ASS_APR_UNCTRL#9. The flight crew prepares the flight plan (and particularly alternate airport) in accordance with predicted MET information at destination.

Flight crew

SR_APR_UNCTRL#21. The flight crew shall check, during flight, before starting the PinS approach (i.e. before IAF), if the latest visibility conditions at destination – and, if different, in the vicinity of the approach -are compliant with operating minima.

Flight crew

SR_APR_UNCTRL#22. The flight crew shall abort the PinS approach and plan another approach if the predicted visibility conditions at destination are not compliant with operating minima.

Flight crew

SR_APR_UNCTRL#23. The heliport or landing location where PinS approach “proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14 Vol II applicable to non-instrument heliports (physical characteristics, obstacle environment, visual aids,..)..

Heliport/landing site Flight crew (50: Heliport / landing location visual information)


Generic Safety Case




SR_APR_UNCTRL#24. The heliport or landing location where PinS approach “proceed VFR” are performed shall not require additional requirements compared to VFR approach conducted on this heliport/landing location (physical characteristics, obstacle environment, visual aids,..).

Heliport/landing site Flight crew (50: Heliport / landing location visual information)

SR_APR_UNCTRL#25. The flight procedure design shall take into account the flight validation’s feedback, in particular for the definition of the appropriate visual references associated with the heliport or landing location. SR_APR_UNCTRL#26. The procedure designer shall depict, on the PinS “proceed visually” chart, visual references associated with the heliport or landing location.




SR_APR_UNCTRL#27. The flight crew shall perform the transition to the visual segment “proceed visually” if the heliport (or landing location) or direct visual references associated with it can be acquired at or prior the MAPt.


REC_APR_UNCTRL#2. The procedure designer should depict on the PinS “proceed VFR” chart, elements allowing to identify if VMC minima are satisfied.




SR_APR_UNCTRL#28. The flight crew shall perform the transition to the visual segment “proceed VFR” if the applicable operating minima are obtained at or prior the MAPt.


SO_APR_UNCTRL#9: Helicopters shall execute the published missed approach if visibility requirements are not obtained at or prior the PinS

SR_APR_UNCTRL#29. The flight crew shall perform a missed approach if the heliport (or landing location) or visual references associated with it cannot be acquired at or prior the MAPt of a “proceed visually” approach.


SR_APR_UNCTRL#30. The flight crew shall perform a missed approach if the applicable operating minima are not obtained at or prior the MAPt of a “proceed VFR” approach.


SO_APR_UNCTRL#10: The visual segment of the PinS “proceed visually” approach procedure shall be designed and promulgated to prevent

SR_APR_UNCTRL#5. The aeronautical, terrain and obstacle data used in the design of the helicopter PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality of aeronautical

data/information.



Generic Safety Case




A/C from colliding with terrain and obstacles

SR_APR_UNCTRL#6. The PinS approach procedure (i.e. initial approach segment, intermediate approach segment, final approach segment, missed approach and, if applicable visual segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure.




SR_APR_UNCTRL#8. The PinS approach procedure shall be published in the state AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate in particular the OCA/H and the required aircraft

navigation capability to fly the procedure (e.g. RNP APCH).


SR_APR_UNCTRL#11. The promulgation of a PinS approach procedure shall comply with the appropriate data quality requirements of ICAO Annex 15 and respect the European Regulation N°73/2010 on the quality of aeronautical

data/information.


SO_APR_UNCTRL#11: Helicopters shall respect lateral and vertical constraints if applicable of the visual segment of the PinS “proceed visually” approach procedure

SR_APR_UNCTRL#31. The flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS “proceed visually” approach chart. For “proceed visually” with direct segment, lateral and vertical path are indicated on the chart.


SO_APR_UNCTRL#12: Pilots shall see and avoid the obstacles during visual segment of the PinS approach procedure

SR_APR_UNCTRL#32. The procedure designer shall depict the relevant obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart.




SR_APR_UNCTRL#33. The procedure designer shall present the HAS (Height Above Surface), on the PinS “proceed VFR” chart. SR_APR_UNCTRL#34. The procedure designer shall depict, on the PinS “proceed VFR” chart, the relevant obstacles in the vicinity of the visual segment.





Generic Safety Case




ASS_APR_UNCTRL#10. The flight crew actively seeks for potential obstacles during the visual segment of the PinS “proceed visually” or “proceed VFR” approach.

Flight crew

REC_APR_UNCTRL#3. The helicopter flying the PinS approach should be equipped with HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacle database should be kept up to date. ASS_APR_UNCTRL#11. When fitted, HTAWS provides alert to the flight crew when a risk of collision with an obstacle is detected.


SO_APR_UNCTRL#13: Operational use of the PinS Approach shall be coordinated between

involved entities.

SR_APR_UNCTRL#35. ATSPs shall ensure coordination between entities (e.g. FIS, ATCO, AFIS, heliport/landing site…) for the operational use of the PinS approach.

ATSP

SR_APR_UNCTRL#36. The AIS shall publish in the AIP the operational PinS usage restrictions, if any.

AIS

REC_APR_UNCTRL#4. The design of the PinS approach procedure should include holdings designed in accordance with ICAO PANS OPS criteria, depending on local environment and constraints.

FPD

SO_APR_UNCTRL#14: Each pilot shall maintain visual separation with other A/C, in VMC conditions, during the instrument and visual flight phase of the PinS approach

ASS_APR_UNCTRL#12. The flight crew actively searches for conflicting traffic, during instrument and visual flight phase of the PinS, when weather conditions permit (see and avoid) based on traffic information provided by other aircraft and by flight information services when available. Note : A requirement is defined through the failure case for the equipage of traffic advisory system for IFR helicopter. REC_APR_UNCTRL#5. All aircraft operating in the vicinity of the PinS approach should be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) devices. ASS_APR_UNCTRL#13. When fitted, traffic advisory system or equivalent system facilitates visual acquisition of the aircraft.

Flight crew VFR & IFR (45: see and avoid, 47: see and avoid)

ASS_APR_UNCTRL#14. VFR or IFR pilots flying in the vicinity of the PinS approach actively search for conflicting traffic when weather conditions permit (see and avoid) based on traffic information provided by other aircraft and by flight information services when available.

VFR & IFR Flight crew (45: see and avoid, 47: see and avoid)

SO_APR_UNCTRL#15: The instrument and visual segments of the PinS approach shall be designed to facilitate deceleration and landing

SR_APR_UNCTRL#6. The PinS approach procedure (i.e. initial approach segment, intermediate approach segment, final approach segment, missed approach and, if applicable visual segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure. Note: The compliance of the procedure with ICAO PANS OPS criteria will ensure that the procedure will be flyable and will facilitate the deceleration and landing.



Generic Safety Case




SO_APR_UNCTRL#16 : Helicopters shall inform other A/C about their position and flight intent

SR_APR_UNCTRL#37. The flight crew established on the PinS approach shall transmit regularly their position and flight intent to inform other helicopters operating on the PinS aproach and other aircraft flying in the vicinity of the PinS approach.




SR_APR_UNCTRL#38. VFR or IFR pilots flying in the vicinity of the PinS approach shall transmit regularly their position and flight intent to inform helicopters established on the PinS approach.




SR_APR_UNCTRL#39. A Radio Mandatory Zone (RMZ) shall be defined around the PinS approach in order to maintain continuous air-ground voice communication watch and establish two-way communication, as necessary, on the appropriate communication channel, unless it is shown that mitigating the risk of conflict between IFR and VFR is not required considering the airspace structure, traffic density, traffic complexity and the current level of safety associated to aircraft operations in this airspace.

Flight crew Flight crew

ASS_APR_UNCTRL#15. When AFIS is available and for known traffic, the Aerodrome Flight Information Service Officer provides information about helicopters established on the PinS approach and aircraft in the vicinity of the PinS approach.

AFISO Flight Crew (29: Flight information)

SO_APR_UNCTRL#17: The PinS approach procedure shall be designed and promulgated to ensure separation from the prohibited airspace/restricted areas in the vicinity of the heliport/landing

SR_APR_UNCTRL#40. The procedure designer shall be provided with data relating to prohibited and restricted areas in the vicinity of the heliport / landing location.


SR_APR_UNCTRL#41. The procedure designer shall, as far as practicable, ensure strategic separation between the PinS approach and prohibited and restricted areas in the vicinity of the heliport / landing location.


SO_APR_UNCTRL#18: Helicopters shall be informed about prohibited/restricted areas in the vicinity of the PinS approach

SR_APR_UNCTRL#42. The PinS approach chart shall clearly indicate the prohibited/restricted areas in the vicinity of the route.





Generic Safety Case




SO_APR_UNCTRL#19: Helicopters shall be informed of the forecasted MET conditions at destination heliport/landing location

SR_APR_UNCTRL#43. Local MET information at destination heliport/landing location shall be provided to the AFISO, when available, and helicopter operator. These local MET information can be provided either by: an aeronautical meteorological service compliant with ICAO Annex 3 at destination or, an equivalent meteorological service (e.g. based on Webcam or other dedicated tool) with approval from local Competent Authority or, an aeronautical meteorological service compliant with ICAO Annex 3 at neighboring airport with approval from local Competent Authority.


SR_APR_UNCTRL#44. MET information shall include at the minimum the following information: visibility, ceiling and QNH.


SR_APR_UNCTRL#45. The AFISO, when available, shall inform the flight crew about change of MET conditions at destination heliport or landing location. SR_APR_UNCTRL#46. When no AFISO is available, the flight crew shall obtain up-to-date MET information, when necessary, based on appropriate air/ground mean defined by the operator and approved by local authority.

AFISO Flight crew (30b: MET update)

SO_APR_UNCTRL#20: Helicopters shall be informed of the forecasted MET conditions at alternate heliport

ASS_APR_UNCTRL#16. Local MET information at alternate heliport / landing location is provided to the helicopter operator.



The table below derives Safety assumptions and Requirements for Abnormal PinS approach operations in uncontrolled airspace by mapping the Safety Objectives (Functionality and Performance) for abnormal operations onto the related elements of the PinS Functional system logical model from Section 6.1.1.

Note: Requirements in italics despite being tagged as UNCTRL requirements are identical to requirements derived for the controlled airspace.

Safety Objectives (Functionality and Performance –Abnormal operations)


SO_APR_UNCTRL#21: In case of loss of RNP navigation during instrument segment of

SR_APR_UNCTRL#47. The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on the PinS approach and considering the local environment.



Generic Safety Case




the PinS approach, the pilot shall revert to contingency procedures and inform other aircraft and if applicable the Aerodrome Flight Information Service in uncontrolled airspace

SR_APR_UNCTRL#48. In case of loss of RNP capability on the PinS approach procedure, flight crews shall respect the helicopter operator’s contingency procedures (e.g. conventional navigation or dead reckoning).

Flight Crew


SO_APR_UNCTRL#22: In case of loss of communication in uncontrolled airspace, the pilot shall fly the procedure/route in accordance with the flight planning and set transponder to Code 7600 or the ADS-B transmitter to indicate the loss of air-ground communications

ASS_APR_UNCTRL#17. The AIP defines local contingency procedure to be applied by flight crews in case of radio communication failure. ASS_APR_UNCTRL#18. In case of radio communication failure, the flight crew flies the procedure/route in accordance with the flight planning and set the transponder to Code 7600 to indicate the loss of air-ground communications.

Flight crew

SO_APR_UNCTRL#23: In case of icing conditions in uncontrolled airspace, a contingency procedure shall be defined considering the operational environment of the PinS approach.

SR_APR_UNCTRL#49. The helicopter operator shall define a contingency procedure adapted to the operational environment for the case of icing conditions encountered on the PinS approach.


SR_APR_UNCTRL#50. In case of icing conditions on the PinS approach procedure, the flight crew shall respect the helicopter operator’s contingency procedures.

Flight crew

SO_APR_UNCTRL#24: In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR” operation in uncontrolled airspace, then, the pilot shall apply VFR contingency procedures (as currently done in VFR) and inform other aircraft as soon as possible

ASS_APR_UNCTRL#19. In case of inadvertent entry into IMC during the visual segment of a PinS “proceed VFR”, the flight crew respects the helicopter operator’s VFR contingency procedures (as for any VFR operation).

Flight crew

SO_APR_UNCTRL#25: In case of degradation of visibility conditions during the visual

SR_APR_UNCTRL#51. The helicopter operator shall define a contingency procedure for the case of degradation of visibility conditions, leading to a loss of the required visual reference, during the visual segment of a PinS “proceed visually” approach.



Generic Safety Case




segment of a PinS “proceed visually” operation in uncontrolled airspace, the pilot shall apply contingency procedures considering the operational environment of the PinS approach and inform other aircraft as soon as possible

SR_APR_UNCTRL#52. In case of degradation of visibility conditions, leading to a loss of the required visual reference, during the visual segment of a PinS “proceed visually” approach, the flight crew shall respect the helicopter operator’s contingency procedures and inform the Aerodrome Flight Information Service Officer when available.

Flight crew


Generic Safety Case


ANNEX C – Detailed derivation of Safety Requirements for Faulted operations

This section identifies the causes of the hazards identified in section 5.4 and derives safety requirements for faulted operations, based on the Safety Objectives associated to the Operational Hazards (cf. section 5.4.1 for safety objectives associated to PinS departure operational hazards and section 5.4.2 for safety objectives associated to PinS approach operational hazards).

As similar hazards are identified for PinS approach and departure (e.g. HZ_DEP_01 “Helicopter deviates from expected PinS departure instrument segments towards terrain in controlled airspace” and HZ_APR_01 “Helicopter deviates from expected PinS approach instrument segments towards terrain in controlled airspace”), the same fault tree is used to derive the safety requirements for PinS departure and approach operations in the following sections. When a cause is only applicable to one type of operation (i.e. approach or departure), it is highlighted with a specific color in the fault tree. One hazard is specific to approach operations (helicopter fails to decelerate and/or prepare landing during visual segment of the PinS approach) and not applicable to departure. This hazard is assessed in section C.1.6 for controlled airspace and section C.2.6 for uncontrolled airspace.

C.1 Controlled Airspace

C.1.1 Hazards Hz_DEP_01 & Hz_APR_01: Helicopter deviates from expected PinS (approach or departure) instrument segment towards terrain in controlled airspace

Section 5.4 describes in more detail those hazards which occur during helicopter PinS approach or departure operations, where the failures could be:

A lateral deviation from the PinS instrument segment towards terrain

A vertical deviation from the PinS instrument segment towards terrain

These hazards could lead to a controlled flight towards terrain classified with a severity SC 3a.

Basic causes for such failures have been captured in the Hz_DEP_01 & Hz_APR_01 Fault Tree below (see Figure C-1). Two main branches are described in this fault tree: the lateral deviation on the left side and the vertical deviation of the right side. It is shown in the fault tree by the undeveloped event (deviation is towards terrain) that the allocated probability to the functional system is directly related to the operational environment (obstacle-rich or non-obstacle-rich).

The basic causes are related to air, ground or spatial elements failures and could be human or equipment related.


Generic Safety Case


Frequency of occurrence of helicopter deviating laterally or vertically from expected PinS (approach or departure) instrument segment, in controlled

airspace, leading to Controlled flight towards terrain shall not be greater than 2X10-7 per flight

Frequency of occurrence of deviating laterally from the expected PinS leading to a controlled flight toward terrain shall not be greater than

1X10-7 per flight

Frequency of occurrence of deviating vertically from the expected PinS leading to a controlled flight toward terrain shall not be greater than

1X10-7 per flight

High Criticality H1

High Criticality H1

RNAV Procedure

design error

RNAV AIS publication

error

A/C Navigation data base

error

Wrong lateral route flown

Nav data base corruption

FCRW does not detect the NDB

corruption

A/c system failure

Deviating Laterally from a correct PinS loaded in

the nav system

RNAV system lateral failure

A/C Flight Control and

guidance system failure

Flight Crew deviation in

manual piloting mode

Inadequate ATCO

instruction on the PinS

PinS corruption at design /

publication

Wrong FC selection of

the PinS

Flight Crew error in

managing Lateral

guidance mode

Lateral deviation from the PinS

Deviation is toward terrain

RNAV_Proc_Design_Er RNAV_AIS_Pub_Er A/C_NDB_Er Und_NDB_Er

Wrg_PinS_Sel

A/C_RNAV_Lat_Fail A/C_Guidance_Fail

Lat_Guid_Mngt_Er

FC_Deviates_Lat

Wrg_ATCO_Instr

Hz_DEP_01 - CFIT SC3aHz_APR_01 - CFIT SC3a

Probability associated to the environment (rich obstacle

or non-rich obstacle environment)

P=1x10-1 ( in non -rich obstacle environment)

NAV SIS error

NAV_SIS_Er

Note: Criticality level and propagating criticality rule in

accordance with the SRM Hybrid Fault Tree Method. See Appendix A of this document.

A/c system failure

Deviating verticaly from the expected PinS

Altimeter system failure





Inadequate ATCO



managing Vertical

guidance mode


A/C_Alt_Fail A/C_Guidance_Fail

Vert_Guid_Mngt_Er

FC_Deviates_Vert

Wrg_ATCO_Instr_Vert

Error in QNH

QNH_Error

P=1x10-1 ( in non -rich obstacle

environment)

RNAV Procedure

design error


error

PinS corruption at

design /publication

RNAV_Proc_Design_Er RNAV_AIS_Pub_Er

RNAV system vertical failure

(for LPV minima only)

Common cause of failure

High Criticality H2

High Criticality H2

High Criticality H2

High Criticality H2

A/C_RNAV_Vert_Fail


NAV SIS error (for APR and LPV minima only)

NAV_SIS_Er


Figure C-1: Hz_DEP_01 & Hz_APR_01 Fault tree


Generic Safety Case


Table C-1 below describes the basic causes of the Hazard Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objectives. Column “mitigation / safety requirement” identifies distinct safety requirements for PinS departure and PinS approach operations.

Type of failure Cause Id Cause description Mitigation/Safety Requirement

Lateral Deviation from the PinS (approach or departure) procedure

RNAV Procedure design error RNAV_Proc_Design_Er The RNAV procedure design is not designed in accordance with the rules. PinS DEPARTURE

See SR_DEP_CTRL#7

PinS APPROACH

See SR_APR_CTRL#8

The RNAV design error is not detected during the procedure validation process (ground and/or flight).

PinS DEPARTURE

See SR_DEP_CTRL#8

PinS APPROACH

See SR_APR_CTRL#9

There is an error in the survey for the PinS procedure design. PinS DEPARTURE

See SR_DEP_CTRL#6

PinS APPROACH

See SR_APR_CTRL#7

RNAV AIS publication Error RNAV_AIS_Pub_Er The AIP (including procedure charts) includes errors on the RNAV procedure (e.g. WPT location, course…) despite a correct procedure design.

PinS DEPARTURE

See SR_DEP_CTRL#9 and SR_DEP_CTRL#12

SR_DEP_CTRL#48. The AIS provider shall verify the consistency between the PinS procedure validated by procedure design and the proposal to be published

PinS APPROACH

See SR_APR_CTRL#10 and SR_APR_CTRL#13


Generic Safety Case



SR_APR_CTRL#58. The AIS provider shall implement a quality assurance process to verify and validate the PinS approach procedure with the procedure designer, before publication.

Aircraft navigation database error

A/C_NDB_Er The aircraft navigation data base used by the onboard navigation system includes an incorrect PinS procedure despite the procedure publication was correct.

PinS DEPARTURE

See ASS_DEP_CTRL#12 and ASS_DEP_CTRL#13

PinS APPROACH

See ASS_APR_CTRL#1 and ASS_APR_CTRL#2

Flight crew does not detect the NDB corruption

Und_NDB_Er The flight crew does not detect an inconsistency between the AIS publication and the procedure loaded in the RNP system.

PinS DEPARTURE

SR_DEP_CTRL#49. The flight crew shall verify the consistency between the PinS departure procedure on the chart and the aircraft display (FPLN, ND…)

PinS APPROACH

SR_APR_CTRL#59. The flight crew shall verify the consistency between the PinS approach procedure on the chart and the aircraft display (FPLN, ND…)

Flight crew does not select the correct PinS

Wrg_PinS_Sel The flight crew does not insert the correct PinS in the Flight Guidance and Selection system. PinS DEPARTURE

See SR_DEP_CTRL#26

PinS APPROACH

See SR_APR_CTRL#16


Generic Safety Case



Lateral deviation due to aircraft RNAV system failure

A/C_RNAV_Fail_Lat

The aircraft RNAV system provides incorrect lateral deviation despite a correct defined path to be flown. Note: The RNAV system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

ASS_DEP_CTRL#29. The RNAV airborne systems based on GPS and/or SBAS is certified in accordance with EASA regulation and approved for the RNP requirement required by the published PinS departure procedure

PinS APPROACH

ASS_APR_CTRL#31. The RNAV airborne systems based on GPS and/or SBAS is certified in accordance with EASA regulation and approved for the RNP requirement required by the published PinS approach procedure

Loss of the lateral deviation due to aircraft RNAV system failure. Note: The RNAV system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

See ASS_DEP_UNCTRL#18

PinS APPROACH

See ASS_APR_UNCTRL#20

Aircraft Flight Control and Guidance system failure

A/C_Guidance_Fail The Aircraft Control and Guidance system provides incorrect lateral guidance on the PinS procedure despite correct lateral information from the aircraft RNAV system. Note: The Aircraft Control and Guidance system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

ASS_DEP_CTRL#30. The aircraft control and guidance system is certified in accordance with EASA regulation

PinS APPROACH

ASS_APR_CTRL#32. The aircraft control and guidance system is certified in accordance with EASA regulation

Flight crew error in managing the lateral guidance modes

Lat_Guidance_Mngt_Er The flight crew does not manage properly the selection of the lateral guidance mode and RNAV navigation source is not coupled to the guidance system.

PinS DEPARTURE


Generic Safety Case



SR_DEP_CTRL#50. The flight crew shall be trained on RNAV navigation, PinS departure procedure and associated contingency procedures.

PinS APPROACH

SR_APR_CTRL#60. The flight crew shall be trained on RNAV navigation, PinS approach procedure and associated contingency procedures

Flight crew deviates from lateral displayed guidance in manual piloting mode

FC_Deviates_Lat In manual or FD mode, the flight crew deviates laterally from a correct displayed guidance. PinS DEPARTURE

See SR_DEP_CTRL#27, ASS_DEP_CTRL#14 and SR_DEP_CTRL#50

PinS APPROACH

See SR_APR_CTRL#17, ASS_APR_CTRL#3 and SR_APR_CTRL#60

Inadequate ATCO instructions on the PinS procedure

Wrg_ATCO_Instr The ATCO provides inadequate instructions/clearance just before joining the PinS procedure or on the PinS procedure.

PinS DEPARTURE

See SR_DEP_CTRL#5 and SR_DEP_CTRL#21

SR_DEP_CTRL#51. The ATC controllers shall be briefed on the RNAV navigation and on helicopter PinS departure procedure

PinS APPROACH

See SR_APR_CTRL#26

SR_APR_CTRL#61. The ATC Controllers shall be briefed on the RNAV navigation and on helicopter PinS approach procedure

Erroneous Nav Signal In Space (SIS)

NAV_SIS_Er An undetected erroneous NAV Signal In Space (GNSS, SBAS) is transmitted to airspace users. PinS DEPARTURE

See SR_DEP_CTRL#24

PinS APPROACH

See SR_APR_CTRL#14


Generic Safety Case



Vertical Deviation from the PinS (approach or departure) procedure

RNAV procedure design error RNAV_Proc_Design_Er The vertical path of the PinS procedure is not designed in accordance with the rules. PinS DEPARTURE

See SR_DEP_CTRL#7

PinS APPROACH

See SR_APR_CTRL#8

The design error is not detected during the procedure validation process (ground and/or flight)

PinS DEPARTURE

See SR_DEP_CTRL#8

PinS APPROACH

See SR_APR_CTRL#9

There is an error in the survey of the route design PinS DEPARTURE

See SR_DEP_CTRL#6

PinS APPROACH

See SR_APR_CTRL#7

AIS publication error AIS_Pub_Er The AIP (including procedure charts) includes errors on the vertical path (e.g., altitude value, altitude constraints (AT, AT or above, etc…) despite a correct procedure design.

PinS DEPARTURE

See SR_DEP_CTRL#9, SR_DEP_CTRL#12 and SR_DEP_CTRL#48

PinS APPROACH

See SR_APR_CTRL#10, SR_APR_CTRL#13 and SR_APR_CTRL#58

Altimeter system failure A/C_Alt_Fail

The aircraft altimeter system provides incorrect altitude despite correct QNH setting. PinS DEPARTURE


Generic Safety Case



ASS_DEP_CTRL#31. The aircraft altimeter is approved in accordance with EASA regulation

PinS APPROACH

ASS_APR_CTRL#33. The aircraft altimeter is approved in accordance with EASA regulation

Aircraft RNAV system failure in vertical

A/C_RNAV_Vert_Fail

The aircraft RNAV system provides incorrect vertical deviation despite a correct defined path to be flown. Note: The RNAV system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

See ASS_DEP_CTRL#29

PinS APPROACH

See ASS_APR_CTRL#31

Loss of the vertical deviation due to aircraft RNAV system failure Note: The RNAV system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

See ASS_DEP_CTRL#29

PinS APPROACH

See ASS_APR_CTRL#31


A/C_Guidance_Fail The Aircraft Control and Guidance system provides incorrect Vertical guidance on the PinS procedure. Note: The Aircraft Control and Guidance system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

See ASS_DEP_CTRL#30

PinS APPROACH

See ASS_APR_CTRL#32

Flight crew error in managing the vertical guidance modes

Vert_Guidance_Mngt_Er The flight crew does not manage properly the selection of the vertical guidance mode. PinS DEPARTURE

See ASS_DEP_CTRL#18 and SR_DEP_CTRL#50

PinS APPROACH

See ASS_APR_CTRL#6 and SR_APR_CTRL#60


Generic Safety Case



Flight crew deviates from vertical path in manual piloting mode

FC_Deviates_Vert In manual or FD mode, the flight crew deviates vertically from the altitude depicted on the chart. PinS DEPARTURE


PinS APPROACH



Wrg_ATCO_Instr The ATCO provides inadequate instructions/ clearance before joining the PinS procedure or on the PinS procedure.

PinS DEPARTURE

See SR_DEP_CTRL#5, SR_DEP_CTRL#16 , SR_DEP_CTRL#21 and SR_DEP_CTRL#51

PinS APPROACH


Error in QNH QNH_Error The ATCO provides a wrong QNH with an error exceeding the vertical safety margin and flight crew does not detect the error.

PinS DEPARTURE

See SR_DEP_CTRL#28

PinS APPROACH

See SR_APR_CTRL#18

The flight crew selects the wrong QNH despite the ATCO providing the correct one. PinS DEPARTURE

See SR_DEP_CTRL#29, SR_DEP_CTRL#30 and ASS_DEP_CTRL#16

PinS APPROACH


Table C-1: Derivation of Mitigation/Safety Requirements for Hazards Hz_DEP_01 & Hz_APR_01


Generic Safety Case


C.1.2 Hazards Hz_DEP_05 & Hz_APR_05: Helicopter deviates from expected PinS (approach or departure) instrument segment towards IFR or known VFR aircraft, in controlled airspace

Section 5.4 describes in more details these hazards which occur during helicopter PinS approach or departure operations, where the failure could be:

a deviation from the PinS instrument segment towards an IFR flight

a deviation from the PinS instrument segment towards a known VFR flight

These hazard could lead to a tactical conflict in airspace class C or D which is classified with a severity SC4a.

Basic causes for such failures have been captured in the Hz_DEP_05 & Hz_APR_05 Fault Tree below (See Figure C-2). The basic causes are related to air, ground or spatial elements failures and could be human or equipment related.


Generic Safety Case


Frequency of occurrence of deviating laterally or vertically from expected Pins (approach or departure) instrument segment, in controlled airspace, leading to tactical conflict shall not be

greater than 3.33X10-5 per flight hour or 3.33X10-5 per flight (*)

ATC does not detect the conflict induced by the helicopter

deviation

At least one IFR Aircraft is in the vicinity of the PinS procedure

P=1

Inadequate traffic picture for IFR

flight

Inc_IFR_Radar_Pict

ATCo fail to detect and solve

the conflict

ATC_Fail_IFR

P2 mitigation (effective risk

reduction)


accordance with the SRM Hybrid Fault Tree Method.

See Appendix A of this document

Medium Criticallity M2

(*) For simplification it is assumed that the duration

of the flight is 1 hour


ATC does not detect the conflict induced by the

helicopter deviation

At least one VFR Aircraft is in the vicinity of the PinS procedure and

is kwown by ATC

P=1

Inadequate traffic picture for VFR

flight

Inc_VFR_Radar_Pict


the conflict

ATC_Fail_VFR


reduction)

Conflict between helicopter and IFR flight

Conflict between helicopter and known VFR traffic


Hz_DEP_05 - MAC SC4aHz_APR_05 - MAC SC4a

ATC does not detect the deviation from the

expected PinS procedure

ATC_Fail_PinS

Undetected lateral deviation from expected

PinS procedure

Lateral or vertical deviation from expected

PinS procedure during instrument segment

From Hz_DEP_01 & Hz_APR_01 Fault Tree



ATC_Fail_PinS


PinS procedure




Low Criticallity L1 (High Criticality allocated on this

cause from Hz PinS 01)

Low Criticallity L1

Low Criticallity L1




Table C-2 below describes the basic causes of the Hz PinS 05 Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objective. Column “mitigation / safety requirement” identifies distinct safety requirements for PinS departure and PinS approach operations.


Generic Safety Case




Lateral or vertical deviation from expected PinS procedure

The helicopter deviates from the expected PinS procedure

See Hz_DEP_01 & Hz_APR_01 Fault Tree (Figure C-1)

Note: A low criticality is required on this cause from the analysis on this hazard whereas a high criticality was required from the analysis of hazards Hz_DEP_01 & Hz_APR_01

ATC does not detect the deviation from the expected PinS procedure

ATC_Fail_PinS Despite an adequate traffic picture, the controller fails to detect a deviation of the helicopter from the expected PinS procedure.

PinS DEPARTURE

SR_DEP_CTRL#52. In radar environment, the PinS departure procedure shall be displayed, on demand, on the controller working position to facilitate the detection of deviation from the expected trajectory and the recognition of a potential conflict.

PinS APPROACH

SR_APR_CTRL#62. In radar environment, the PinS approach procedure shall be displayed, on demand, on the controller working position to facilitate the detection of deviation from the expected trajectory and the recognition of a potential conflict.

One IFR aircraft is in the vicinity of the PinS procedure

To be conservative it is assumed that there is at least one IFR aircraft in the vicinity of the helicopter which deviates from the PinS procedure (Probability = 1)

Inadequate traffic picture for IFR flight Inc_IFR_Radar_Pict The traffic picture is inadequate for IFR aircraft PinS DEPARTURE

SR_DEP_CTRL#53. In radar environment, the radar display shall provide an adequate traffic picture to depict IFR aircraft and VFR aircraft equipped with transponder on the PinS departure and in the vicinity of the PinS procedure.

PinS APPROACH

SR_APR_CTRL#63. In radar environment, the radar display shall provide an adequate traffic picture to depict IFR aircraft and VFR aircraft equipped with transponder on the PinS approach and in the vicinity of the PinS procedure.


Generic Safety Case



ATCO fails to detect and solve the conflict

ATC_Fail_IFR Despite an adequate traffic picture, the controller fails to detect and solve the conflict between the helicopter and another IFR flight.

PinS DEPARTURE

See ASS_DEP_CTRL#22, SR_DEP_CTRL#51 and SR_DEP_CTRL#52

PinS APPROACH

See ASS_APR_CTRL#11, SR_APR_CTRL#61 and SR_APR_CTRL#62



The helicopter deviates from the expected PinS procedure





• PinS DEPARTURE

See SR_DEP_CTRL#52

• PinS APPROACH

See SR_APR_CTRL#62

One VFR aircraft is in the vicinity of the PinS procedure and is known by ATC

To be conservative it is assumed that there is at least one VFR aircraft in the vicinity of the helicopter which deviates from the PinS procedure (Probability = 1)

Inadequate traffic picture for VFR flight

Inc_VFR_Radar_Pict The traffic picture is inadequate for VFR aircraft Note: because the traffic is known it is assumed that the VFR aircraft is equipped with a transponder switched to on.

PinS DEPARTURE

See SR_DEP_CTRL#53

PinS APPROACH

See SR_APR_CTRL#63


ATC_Fail_VFR Despite an adequate traffic picture or a reported position from the VFR pilot, the controller fails to detect and solve the conflict between the helicopter and the known VFR.

PinS DEPARTURE


PinS APPROACH


Table C-2: Derivation of Mitigation/Safety Requirements for Hazard Hz_DEP_05 & Hz_APR_05


Generic Safety Case


C.1.3 Hazards Hz_DEP_10 & Hz_APR_10: IFR or known VFR traffic flies towards helicopter established on the PinS procedure in controlled airspace


an IFR aircraft flying towards helicopter established on the PinS procedure

a known VFR aircraft flying towards helicopter established on the PinS procedure

These hazards could lead to a tactical conflict in airspace class C or D which is classified with a severity SC4a.



Generic Safety Case


Frequency of occurrence of IFR aircraft or known VFR aircraft flying towards helicopter established on the PinS procedure in controlled airspace leading to Tactical conflict shall not be greater than

3.33X10-5 per flight hour or 3.33X10-5 per flight (*)

IFR aircraft flies towards helicopter established on PinS

procedure

ATC does not detect the conflict induced by the IFR aircraft


flight

Inc_IFR_Radar_Pict


the conflict

ATC_Fail_IFR


reduction)





(*) For simplification it is assumed that the duration of

the flight is 1 hour


ATC does not detect the conflict induced by the VFR

aircraft


flight

Inc_VFR_Radar_Pict


the conflict

ATC_Fail_VFR


reduction)

Conflict between IFR flight and helicopter

Conflict between known VFR traffic and helicopter


VFR aircraft flies towards helicopter established on PinS

procedure

VFR A/C forget presence of the

PinS

VFR_Forget_PinS

One helicopter is on the PinS procedure in the

vicinity of the IFR traffic

P=1

One helicopter is on the PinS procedure in the

vicinity of the known VFR traffic

P=1


IFR aircraft flies towards helicopter established on the

PinS

No strategic separation between PinS procedure and others IFR routes/procedures

Separation_IFP_PinS

IFR A/C does not respect his flight

plan

Fail_IFR_FPL

Low Criticallity L1 Low Criticallity

L1



Generic Safety Case


Table C-3 below describes the basic causes of the Hz_DEP_10a & Hz_APR_10a Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objective.


Conflict between IFR flight and helicopter

One helicopter is on the PinS procedure in the vicinity of the IFR traffic

To be conservative it is assumed that there is at least one helicopter on the PinS procedure in the vicinity of the IFR traffic

(Probability = 1)

No strategic separation between PinS procedure and other IFR routes/procedures

Separation_IFP_PinS Procedure design does not include strategic separation between the PinS and other instrument flight procedures in the vicinity.

PinS DEPARTURE

See SR_DEP_CTRL#1

PinS APPROACH

See SR_APR_CTRL#1

IFR aircraft does not respect its flight plan

Fail_IFR_FPL

The IFR aircraft does not respect its flight plan or the deviation to the flight plan is not coordinated with the controller.

No specific requirement because this is a basic airmanship principle (IFR aircraft will respect their

flight plan)

Inadequate traffic picture for IFR flight Inc_IFR_Radar_Pict The traffic picture is inadequate for IFR aircraft. PinS DEPARTURE

See SR_DEP_CTRL#53

PinS APPROACH

See SR_APR_CTRL#63


ATC_Fail_IFR The controller despite an adequate traffic picture fails to detect and solve the conflict between the helicopter and another IFR flight.

PinS DEPARTURE


PinS APPROACH


Conflict between known VFR traffic and helicopter


Generic Safety Case



One helicopter is on the PinS procedure in the vicinity of the known VFR traffic

To be conservative it is assumed that there is at least one helicopter on the PinS procedure in the vicinity of the known VFR traffic

(Probability = 1)

VFR A/C forgets presence of the PinS procedure

VFR_forget_PinS The pilot of the VFR aircraft is not properly informed about the helicopter PinS procedure. PinS DEPARTURE

SR_DEP_CTRL#54. The PinS departure shall be clearly depicted on VFR charts to inform pilots of helicopter traffic in this area.

PinS APPROACH

SR_APR_CTRL#64. The PinS approach shall be clearly depicted on VFR charts to inform pilots of helicopter traffic in this area.


Inc_VFR_Radar_Pict The traffic picture is inadequate for VFR aircraft Note: Because the traffic is known it is assumed that the VFR aircraft is equipped with a transponder switched to on.

PinS DEPARTURE

See SR_DEP_CTRL#53

PinS APPROACH

See SR_APR_CTRL#63

ATCO fails to react properly to solve conflict

ATC_Fail_VFR The controller despite an adequate traffic picture fails to detect and solve the conflict between the helicopter and the known VFR flight.

PinS DEPARTURE


PinS APPROACH


Table C-3: Derivation of Mitigation/Safety Requirements for Hazard Hz_APR_10 & Hz_DEP_10


Generic Safety Case


C.1.4 Hazards Hz_DEP_15 & Hz_APR_15 : Helicopter deviates from expected flight path towards terrain, during visual segment of the PinS “proceed visually” (approach or departure) in controlled airspace


A lateral deviation from the PinS visual segment towards terrain

A vertical deviation from the PinS visual segment towards terrain

These hazards could lead to a controlled flight towards terrain classified with a severity SC 3a.

Basic causes for such failures have been captured in the Hz_DEP_15 & Hz_APR_15 Fault Tree below (See Figure C-4). Two main branches are described in this fault tree: the lateral deviation on the left side and the vertical deviation of the right side. It is shown in the fault tree by the undeveloped event (deviation is towards terrain) that the allocated probability to the functional system is directly related to the operational environment (obstacle-rich or non-obstacle-rich).



Generic Safety Case


Frequency of occurrence of helicopter deviating laterally or vertically from expected flight path towards terrain, during visual segment of the PinS

proceed visually (approach or departure) in controlled airspace , leading to Controlled flight towards terrain shall not be greater than 2X10-7 per flight

Frequency of occurrence of deviating laterally from the expected PinS « proceed visually »

leading to a controlled flight toward terrain shall not be greater than 1X10-7 per flight

Frequency of occurrence of deviating vertically from the expected PinS « proceed visually »


High Criticality H1

High Criticality H1

RNAV Procedure

design error


error



publication


the PinS


RNAV_AIS_Pub_Er

Hz_DEP_15 - CFIT SC3aHz_APR_15 - CFIT SC3a










Inadequate ATCO



managing Vertical

guidance mode


A/C_Alt_FailVert_Guid_Mngt_Er

FC_Deviates_Vert

Wrg_ATCO_Instr_Vert

Error in QNH

QNH_Error


environment)

RNAV Procedure

design error


error

PinS corruption at

design /publication


Wrg_LLR_Sel

Loss of visual reference

Unexpected degradation of

visibility conditions

Failure of lightning /

marking on the heliport

Heli_light_failVis i_Degra



Inadequate ATCO


FC_Deviates_Lat

Wrg_ATCO_Instr




Failure of lightning / marking on the

heliport


High Criticality H2

High Criticality H2

RNAV_Proc_Design_Er



Generic Safety Case


Table C-4 below describes the basic causes of the Hazard Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objective. The column “mitigation / safety requirement” identifies distinct safety requirements for PinS departure and PinS approach operations. Many of the causes and mitigations identified in this table are similar to the ones identified for Hz_DEP_15 & Hz_APR_15 relating to deviation towards terrain during the instrument segment.



RNAV procedure design error RNAV_Proc_Design_Er The RNAV procedure design is not designed in accordance with the rules. PinS DEPARTURE

See SR_DEP_CTRL#7

PinS APPROACH

See SR_APR_CTRL#8


PinS DEPARTURE

See SR_DEP_CTRL#8

PinS APPROACH

See SR_APR_CTRL#9


See SR_DEP_CTRL#6

PinS APPROACH

See SR_APR_CTRL#7

RNAV AIS publication error RNAV_AIS_Pub_Er The AIP (including procedure charts) includes error on the RNAV procedure (e.g. WPT location, course…) despite a correct procedure design.

PinS DEPARTURE


PinS APPROACH



Wrg_PinS_Sel The flight crew does not insert the correct PinS in the Flight Guidance and Selection system PinS DEPARTURE

See SR_DEP_CTRL#26


Generic Safety Case



PinS APPROACH

See SR_APR_CTRL#16


Visi_Degra Unexpected degradation of visibility conditions. PinS DEPARTURE


PinS APPROACH

See ASS_APR_CTRL#14, SR_APR_CTRL#29, SR_APR_CTRL#55 and SR_APR_CTRL#56

Heli_light_fail Failure of lighting / marking on the heliport Note: these causes is only applicable to PinS approach operations (not to PinS departure).

PinS APPROACH

See SR_APR_CTRL#31



See SR_DEP_CTRL#27, ASS_DEP_CTRL#14 and SR_DEP_CTRL#50

PinS APPROACH

See SR_APR_CTRL#17, ASS_APR_CTRL#3 and SR_APR_CTRL#60


Wrg_ATCO_Instr The ATCO provides inadequate instructions/ clearance just before joining the PinS procedure or on the PinS procedure.

PinS DEPARTURE


PinS APPROACH


Vertical Deviation from the PinS (approach or departure) procedure


Generic Safety Case




See SR_DEP_CTRL#7

PinS APPROACH

See SR_APR_CTRL#8

The design error is not detected during the procedure validation process (ground and/or flight)

PinS DEPARTURE

See SR_DEP_CTRL#8

PinS APPROACH

See SR_APR_CTRL#9

There is an error in the survey of the route design. PinS DEPARTURE

See SR_DEP_CTRL#6

PinS APPROACH

See SR_APR_CTRL#7

AIS publication error AIS_Pub_Er The AIP (including procedure charts) includes errors on the vertical path (e.g., Altitude value, altitude constraints (AT, AT or above, etc…) despite a correct procedure design.

PinS DEPARTURE


PinS APPROACH




See ASS_DEP_CTRL#31

PinS APPROACH

See ASS_APR_CTRL#33




Generic Safety Case




PinS APPROACH





PinS APPROACH



Wrg_ATCO_Instr The ATCO provides inadequate instructions/ clearance before joining the PinS procedure or on the PinS procedure.

PinS DEPARTURE

See SR_DEP_CTRL#5, SR_DEP_CTRL#16 , SR_DEP_CTRL#21 and SR_DEP_CTRL#51

PinS APPROACH



Visi_Degra Unexpected degradation of visibility conditions.

PinS DEPARTURE


PinS APPROACH


Heli_light_fail Failure of lighting / marking on the heliport Note: these causes are only applicable to PinS approach operations (not to PinS departure)

PinS APPROACH

See SR_APR_CTRL#31


Generic Safety Case



Error in QNH QNH_Error The ATCO provides a wrong QNH with an error exceeding the vertical safety margin and flight crew does not detect the error.

PinS DEPARTURE

See SR_DEP_CTRL#28

PinS APPROACH

See SR_APR_CTRL#18

The flight crew selects the wrong QNH despite the ATCO providing the correct one. PinS DEPARTURE

See SR_DEP_CTRL#29, SR_DEP_CTRL#30 and ASS_DEP_CTRL#16

PinS APPROACH


Table C-4: Derivation of Mitigation/Safety Requirements for Hazards Hz_DEP_15 & Hz_APR_15

C.1.5 Hazard Hz_DEP_20 & Hz_APR_20: Helicopter deviates from expected flight path towards IFR or known VFR, during visual segment of the PinS “proceed visually” (approach or departure) in controlled airspace


a deviation from the PinS visual segment towards an IFR flight

a deviation from the PinS visual segment towards a known VFR flight

These hazard could lead to a tactical conflict in airspace class C or D which is classified with a severity SC4a.



Generic Safety Case


Frequency of occurrence of helicopter deviating from expected flight path, towards IFR or know VFR aircraft, during visual segment of the PinS "proceed visually" departure, in controlled airspace,

leading to Tactical conflict shall not be greater than 3.33X10-5 per flight hour or 3.33X10-5 per flight (*)

ATC does not detect the conflict induced by the helicopter

deviation


P=1


flight

Inc_IFR_Radar_Pict


the conflict

ATC_Fail_IFR


reduction)





(*) For simplification it is

assumed that the duration



ATC does not detect the conflict induced by the


At least one VFR Aircraft is in the vicinity of the PinS procedure and

is kwown by ATC

P=1


flight

Inc_VFR_Radar_Pict


the conflict

ATC_Fail_VFR


reduction)







ATC_Fail_PinS


PinS procedure


PinS procedure during visual segment




ATC_Fail_PinS


PinS procedure


PinS procedure during visual segment




Low Criticallity L1

Low Criticallity L1




Table C-5 below describes the basic causes of the Hz PinS 20 Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objective. The column “mitigation / safety requirement” identifies distinct safety requirements for PinS departure and PinS approach operations. Many of the causes and mitigations identified in this table are similar to the ones identified for Hz_DEP_20 & Hz_APR_20 relating to deviation towards terrain during the instrument segment.


Generic Safety Case





The helicopter deviates from the expected PinS procedure during visual segment





PinS DEPARTURE

See SR_DEP_CTRL#52

PinS APPROACH

See SR_APR_CTRL#62

One IFR aircraft is in the vicinity of the PinS procedure

To be conservative it is assumed that there is at least one IFR aircraft in the vicinity of the helicopter which deviates from the PinS procedure (Probability = 1)

Inadequate traffic picture for IFR flight Inc_IFR_Radar_Pict The traffic picture is inadequate for IFR aircraft. PinS DEPARTURE

See SR_DEP_CTRL#53

PinS APPROACH

See SR_APR_CTRL#63


ATC_Fail_IFR Despite an adequate traffic picture, the controller fails to detect and solve the conflict between a helicopter and another IFR flight.

PinS DEPARTURE


PinS APPROACH




The helicopter deviates from the expected PinS procedure during visual segment




Generic Safety Case





PinS DEPARTURE

See SR_DEP_CTRL#52

PinS APPROACH

See SR_APR_CTRL#62

One VFR aircraft is in the vicinity of the PinS procedure and is known by ATC

To be conservative it is assumed that there is at least one VFR aircraft in the vicinity of the helicopter which deviates from the PinS procedure (Probability = 1)


Inc_VFR_Radar_Pict The traffic picture is inadequate for VFR aircraft. Note: because the traffic is known it is assumed that the VFR aircraft is equipped with a transponder switched on

PinS DEPARTURE

See SR_DEP_CTRL#53

PinS APPROACH

See SR_APR_CTRL#63


ATC_Fail_VFR Despite an adequate traffic picture or a reported position from the VFR pilot, the controller fails to detect and solve the conflict between the helicopter and the known VFR.

PinS DEPARTURE


PinS APPROACH




Generic Safety Case


C.1.6 Hazard Hz-APR_25: Helicopter fails to decelerate and/or prepare landing during the visual segment of the PinS approach, in controlled airspace

Section 5.4 describes in more details these hazards which occur during helicopter PinS approach (this hazard is not relevant for PinS departure)

This hazard could lead to an unstable approach classified with a severity SC 3.

Basic causes for such failures have been captured in Hz_APR_25 Fault Tree below (See Figure C-6).The basic causes are related to air, ground or spatial elements failures and could be human or equipment related.

Frequency of occurrence of helicopter Helicopter failing to decelerate and/or prepare landing during the visual segment of the PinS approach leading to

unstable approach in controlled airspace shall be not greater than 1x10-4 per flight

Hz_APR_25 - RE SC3Note: Criticality level and

propagating criticality rule in accordance with the SRM

Hybrid Fault Tree Method. See Appendix A of this document.

On board system failure (altimeter,

auto-pilot )

Wrong application of operational

procedure by theFlight Crew

A/C_Sys_FailFC_Fail

RNAV Procedure

design error


error

PinS corruption at

design /publication







RNAV_AIS_Pub_Er RNAV_Proc_Design_Er

Figure C-6: Hz_APR_25 Fault tree

Table C-6 below describes the basic causes of the Hazard Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objectives.


Generic Safety Case



RNAV procedure design error RNAV_Proc_Design_Er The RNAV procedure design is not designed in accordance with the rules. PinS APPROACH

See SR_APR_CTRL#8


PinS APPROACH

See SR_APR_CTRL#9

There is an error in the survey for the PinS procedure design. PinS APPROACH

See SR_APR_CTRL#7

RNAV AIS publication error RNAV_AIS_Pub_Er The AIP (including procedure charts) includes errors on the RNAV procedure (e.g. WPT location, course…) despite a correct procedure design.

PinS APPROACH


On board system failure (altimeter, auto-pilot…)

A/C_Sys_Fail Failure of an on board system (altimeter, auto-pilot, flight control system…) leading to failure to decelerate properly despite a correct procedure design

Already covered by mitigations and requirements identified for previous hazards (QNH_Error, A/C_Alt_Fail)

Wrong application of operational procedure by the flight crew

FC_Fail Wrong application of the operational procedure by the flight crew despite a correct procedure design

PinS APPROACH



Visi_Degra Unexpected degradation of visibility conditions. PinS APPROACH


Heli_light_fail Failure of lighting / marking on the heliport PinS APPROACH

See SR_APR_CTRL#31

Table C-6: Derivation of Mitigation/Safety Requirements for Hazards Hz_APR_25


Generic Safety Case


C.2 Uncontrolled Airspace

C.2.1 Hazard Hz_DEP_50 & Hz_APR_50 Helicopter deviates from expected PinS (approach or departure) instrument segments towards terrain in uncontrolled airspace


A lateral deviation from the PinS instrument segment towards terrain

A vertical deviation from the PinS instrument segment towards terrain

These hazards could lead to an imminent CFIT classified with a severity SC 2.

Basic causes for such failures have been captured in the Hz_DEP_50 & Hz_APR_50 Fault Tree below (See Figure C-7). Two main branches are described in

this fault tree: the lateral deviation on the left side and the vertical deviation of the right side. It is shown in the fault tree by the undeveloped event (deviation is towards terrain) that the allocated probability to the functional system is directly related to the operational environment (obstacle-rich or non-obstacle-rich).



Generic Safety Case


Frequency of occurrence of helicopter deviating laterally or vertically from published PinS (departure or approach) instrument segment towards terrain in uncontrolled airspace leading to imminent CFIT shall not be greater than 1X10-

7 per flight hour

Frequency of occurrence of deviating laterally from the expected PinS leading to a controlled flight toward terrain shall not be greater than

5X10-8 per flight

Frequency of occurrence of deviating vertically from the expected PinS leading to a controlled flight toward terrain shall not be greater than

5X10-8 per flight

High Criticality H1

High Criticality H1

RNAV Procedure

design error


error

A/C Navigation data base

error

Wrong lateral route flown

Nav data base corruption

FCRW does not detect the NDB

corruption

A/c system failure

Deviating Laterally from a correct PinS loaded in

the nav system

RNAV system lateral failure






publication


the PinS


managing Lateral

guidance mode



RNAV_Proc_Design_Er RNAV_AIS_Pub_Er A/C_NDB_Er Und_NDB_Er

Wrg_PinS_Sel

A/C_RNAV_Lat_Fail A/C_Guidance_Fail

Lat_Guid_Mngt_Er

FC_Deviates_Lat

Hz_DEP_50 - CFIT SC2Hz_APR_50 - CFIT SC2




NAV SIS error

NAV_SIS_Er



A/c system failure








managing Vertical

guidance mode


A/C_Alt_Fail A/C_Guidance_Fail

Vert_Guid_Mngt_Er

FC_Deviates_Vert

Error in QNH

QNH_Error


environment)

RNAV Procedure

design error


error

PinS corruption at

design /publication


High Criticality H2

High Criticality H2

High Criticality H2

High Criticality H2


RNAV system vertical failure

(for LPV minima only)

A/C_RNAV_vert_Fail

NAV SIS error (for APR and LPV minima only)

NAV_SIS_Er



Generic Safety Case


Figure C-7: Hz_DEP_50 & Hz_APR_50 Fault Tree

Table C-7 below describes the basic causes of the Hz_DEP_50 and Hz_APR_50 Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objective.


Lateral Deviation from the PinS

RNP procedure design error RNP_Proc_Design_Er The RNAV procedure design is not designed in accordance with the rules. PinS DEPARTURE

See SR_DEP_UNCTRL#5

PinS APPROACH

See SR_APR_UNCTRL#6

The RNAV design error is not detected during the procedure validation process (ground and/or flight). PinS DEPARTURE

See SR_DEP_UNCTRL#6

PinS APPROACH

See SR_APR_UNCTRL#7


See SR_DEP_UNCTRL#4

PinS APPROACH

See SR_APR_UNCTRL#5


Generic Safety Case


Type of failure Cause Id Cause description Mitigation/Safety Requirement RNAV AIS publication error RNAV_AIS_Pub_Er The AIP (including procedure charts) includes errors

on the RNAV procedure (e.g. WPT location, course…) despite a correct procedure design.

PinS DEPARTURE

See SR_DEP_UNCTRL#7 and SR_DEP_UNCTRL#10

SR_DEP_UNCTRL#41. The AIS provider shall verify the consistency between the PinS procedure validated by procedure design and the proposal to be published.

PinS APPROACH

See SR_APR_UNCTRL#8 and SR_APR_UNCTRL#11

SR_APR_UNCTRL#53. AIS provider shall implement a quality assurance process to verify and validate the PinS approach procedure with the procedure designer, before publication.

Aircraft navigation data base error A/C_NDB_Er The aircraft navigation database used by the onboard navigation system includes an incorrect PinS procedure despite the procedure publication was correct.

PinS DEPARTURE

See ASS_DEP_UNCTRL#8 and ASS_DEP_UNCTRL#9

PinS APPROACH

SeeASS_APR_UNCTRL#1 and ASS_APR_UNCTRL#2

Flight crew does not detect the NDB corruption

Und_NDB_Er The flight crew does not detect an inconsistency between the AIS publication and the procedure loaded in the RNP system.

PinS DEPARTURE

SR_DEP_UNCTRL#42. The flight crew shall verify the consistency between the PinS departure procedure on the chart and the aircraft display (FPLN, ND…).

PinS APPROACH

SR_APR_UNCTRL#54. The flight crew shall verify the consistency between the PinS approach procedure on the chart and the aircraft display (FPLN, ND…)


Generic Safety Case


Type of failure Cause Id Cause description Mitigation/Safety Requirement Flight crew does not select the correct PinS

Wrg_PinS_Sel The flight crew does not insert the correct PinS in the Flight Guidance and Selection system. PinS DEPARTURE

See SR_DEP_UNCTRL#21

PinS APPROACH

See SR_APR_UNCTRL#14 Aircraft RNAV system failure in lateral

A/C_RNAV_Fail_Lat

The aircraft RNAV system provides incorrect lateral deviation despite a correct defined path to be flown. Note: The RNAV system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

ASS_DEP_UNCTRL#18. The RNAV airborne systems based on GPS and/or SBAS is certified in accordance with EASA regulation and approved for the RNP requirement required by the published PinS departure procedure.

PinS APPROACH

ASS_APR_UNCTRL#20. The RNAV airborne systems based on GPS and/or SBAS is certified in accordance with EASA regulation and approved for the RNP requirement required by the published PinS approach procedure.

Loss of the lateral deviation due to aircraft RNAV system failure. Note: The RNAV system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE


PinS APPROACH



A/C_Guidance_Fail The Aircraft Control and Guidance system provides incorrect lateral guidance on the PinS procedure despite correct lateral information from the aircraft RNAV system. Note: The Aircraft Control and Guidance system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

ASS_DEP_UNCTRL#19. The aircraft control and guidance system is certified in accordance with EASA regulation.

PinS APPROACH

ASS_APR_UNCTRL#21. The aircraft control and guidance system is certified in accordance with EASA regulation .


Generic Safety Case


Type of failure Cause Id Cause description Mitigation/Safety Requirement Flight crew error in managing the lateral guidance modes

Lat_Guidance_Mngt_Er The flight crew does not manage properly the selection of the lateral guidance mode and RNAV navigation source is not coupled to the guidance system.

PinS DEPARTURE

SR_DEP_UNCTRL#43. The flight crew shall be trained on RNAV navigation, PinS departure procedure and associated contingency procedures.

PinS APPROACH

SR_APR_UNCTRL#55. The flight crew shall be trained on RNAV navigation, PinS approach procedure and associated contingency procedures.



See SR_DEP_UNCTRL#22, ASS_DEP_UNCTRL#10 and SR_DEP_UNCTRL#43

PinS APPROACH

SeeSR_APR_UNCTRL#15, ASS_APR_UNCTRL#3 and SR_APR_UNCTRL#55

Erroneous Nav Signal In Space (SIS)

NAV_SIS_Er An undetected erroneous NAV Signal In Space (GNSS, SBAS) is transmitted to airspace users. PinS DEPARTURE


PinS APPROACH

SeeSR_APR_UNCTRL#12

Vertical Deviation from the PinS


See SR_DEP_UNCTRL#5

PinS APPROACH

See SR_APR_UNCTRL#6


Generic Safety Case


Type of failure Cause Id Cause description Mitigation/Safety Requirement The design error is not detected during the procedure validation process (ground and/or flight). PinS DEPARTURE

See SR_DEP_UNCTRL#6

PinS APPROACH

See SR_APR_UNCTRL#7

There is an error in the survey of the route design.

PinS DEPARTURE

See SR_DEP_UNCTRL#4

PinS APPROACH

See SR_APR_UNCTRL#5

AIS publication error AIS_Pub_Er The AIP (including procedure charts) includes errors

on the vertical path (e.g., altitude value, altitude constraints (AT, AT or above, etc…) despite a correct procedure design.

PinS DEPARTURE

See SR_DEP_UNCTRL#7, SR_DEP_UNCTRL#10 and SR_DEP_UNCTRL#41

PinS APPROACH

See SR_APR_UNCTRL#8, SR_APR_UNCTRL#11 and SR_APR_UNCTRL#53



ASS_DEP_UNCTRL#20. The aircraft altimeter is approved in accordance with EASA regulation

PinS APPROACH

ASS_APR_UNCTRL#22. The aircraft altimeter is approved in accordance with EASA regulation

Aircraft RNAV system failure in vertical

A/C_RNAV_Vert_Fail

The aircraft RNAV system provides incorrect vertical deviation despite a correct defined path to be flown. Note: The RNAV system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

See ASS_DEP_CTRL#29

PinS APPROACH

See ASS_APR_CTRL#31


Generic Safety Case


Type of failure Cause Id Cause description Mitigation/Safety Requirement Loss of the vertical deviation due to aircraft RNAV system failure. Note: The RNAV system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE

See ASS_DEP_CTRL#29

PinS APPROACH

See ASS_APR_CTRL#31


A/C_Guidance_Fail The Aircraft Control and Guidance system provides incorrect vertical guidance on the PinS procedure. Note: The Aircraft Control and Guidance system is a common cause of failure leading to lateral and vertical deviation from expected PinS trajectory.

PinS DEPARTURE


PinS APPROACH

See ASS_APR_UNCTRL#21 Flight crew error in managing the vertical guidance modes


See ASS_DEP_UNCTRL#14 and SR_DEP_UNCTRL#43

PinS APPROACH

See ASS_APR_UNCTRL#6 and SR_APR_UNCTRL#55




PinS APPROACH


Error in QNH QNH_Error The AFISO or landing site operator provides a wrong QNH with an error exceeding the vertical safety margin and flight crew does not detect the error.

PinS DEPARTURE


PinS APPROACH

See SR_APR_UNCTRL#16


Generic Safety Case


Type of failure Cause Id Cause description Mitigation/Safety Requirement The flight crew selects the wrong QNH despite the AFISO or landing site operator providing the correct one.

PinS DEPARTURE

See ASS_DEP_UNCTRL#12, SR_DEP_UNCTRL#25 and SR_DEP_UNCTRL#24

PinS APPROACH


Table C-7: Derivation of Mitigation/Safety Requirements for Hz_DEP_50 & Hz_APR_50


Generic Safety Case


C.2.2 Hazard Hz_DEP_55 & Hz_APR_55 Helicopter deviates from expected PinS (approach or departure) instrument segments towards other traffic in uncontrolled airspace


a deviation from the PinS instrument segment towards an IFR flight

a deviation from the PinS instrument segment towards a known VFR flight

These hazard could lead to an imminent collision in airspace class G which is classified with a severity SC2b.

Basic causes for such failures have been captured in the Hz_DEP_55 & Hz_APR_55 Fault Tree below (See Figure C-8). The basic causes are related to air,

ground or spatial elements failures and could be human or equipment related.


Generic Safety Case


Frequency of occurrence of helicopter deviating laterally or vertically from published PinS (departure or approach) instrument segment towards other aircraft, in uncontrolled airspace, leading to imminent collision with other traffic shall not be greater than 1X10-5 per flight hour

Flight crew do not detect accurately the IFR aircraft


P=1

No blind call is transmitted by

IFR flight

No_BlindCall_trans

F/C fail to see and avoid other

aircraft

FC_Fail_IFR


reduction)




High Criticallity H1




Flight crew do not detect accurately the VFR aircraft

At least one VFR Aircraft is in the vicinity of the PinS procedure

P=1


VFR flight

No_BlindCall_trans


aircraft

FC_Fail_VFR


reduction)




Hz_DEP_55 - MAC SC2bHz_APR_55 - MAC SC2b







High Criticality H2 (Extreme Criticality allocated on this






Generic Safety Case


Table C-8 below describes the basic causes of the Hz_DEP_55 & Hz_APR_55 Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objective.


Conflict between Helicopter and IFR flight

Lateral or vertical deviation from published PinS (departure or approach) procedure

The helicopter deviates from the PinS

See Hz#PinS_50 Fault Tree

At least one IFR aircraft is in the vincinity of the PinS procedure

To be conservative it is assumed in VMC conditions that there is at least one IFR aircraft in the vicinity of the helicopter which deviates from the PinS procedure (Probability = 1)

F/C fails to see and avoid other aircraft

FC_fail_IFR The flight crew operating an aircraft shall maintain vigilance so as to see and avoid other aircraft. Pilots should also keep in mind their responsibility for continuously maintaining a vigilant lookout considering that most midair collision accidents and reported near-MAC incidents occur during good weather conditions and during daylight hours.

PinS DEPARTURE

See ASS_DEP_UNCTRL#1, REC_DEP_UNCTRL#2, ASS_DEP_UNCTRL#2, ASS_DEP_UNCTRL#3 and SR_DEP_UNCTRL#29

PinS APPROACH

See ASS_APR_UNCTRL#12, REC_APR_UNCTRL#5, ASS_APR_UNCTRL#13, ASS_APR_UNCTRL#14 and SR_APR_UNCTRL#38

No blind call is transmitted by IFR traffic

No_BlindCall_trans IFR pilots flying in the vicinity of PinS procedure do not transmit regularly their position and flight intent. PinS DEPARTURE

See SR_DEP_UNCTRL#30, SR_DEP_UNCTRL#31 and ASS_DEP_UNCTRL#15

PinS APPROACH

See SR_APR_UNCTRL#38, SR_APR_UNCTRL#39 and ASS_APR_UNCTRL#15





At least one VFR aircraft is in the vicinity of the PinS procedure

To be conservative it is assumed in VMC conditions that there is at least one IFR aircraft in the vicinity of the helicopter which deviates from the PinS procedure (Probability = 1)


Generic Safety Case



F/C fail to see and avoid other aircraft FC_fail_VFR The flight crew operating an aircraft shall maintain vigilance so as to see and avoid other aircraft. Pilots should also keep in mind their responsibility for continuously maintaining a vigilant lookout considering that most midair collision accidents and reported near-MAC incidents occur during good VFR weather conditions and during daylight hours.

PinS DEPARTURE


PinS APPROACH



No_BlindCall_trans VFR pilot flying in the vicinity of PinS procedure does not transmit regularly their position and flight intent. PinS DEPARTURE


PinS APPROACH



C.2.3 Hazard Hz_DEP_60 & Hz_APR_60 Other traffic deviates towards helicopter established on the PinS (approach or departure) procedure in uncontrolled airspace


an IFR aircraft flying towards helicopter established on the PinS procedure

a known VFR aircraft flying towards helicopter established on the PinS procedure

These hazards could lead to an imminent collision in airspace class G which is classified with a severity SC2b.

Basic causes for such failures have been captured in the Hz_DEP_60 & Hz_APR_60 Fault Tree below (See Figure C-9). The basic causes are related to air,

ground or spatial elements failures and could be human or equipment related.


Generic Safety Case


Frequency of occurrence of other aircraft flying towards helicopter established on the PinS (departure or approach) instrument segment, in uncontrolled airspace, leading to imminent

collision shall not be greater than 1X10-5 per flight hour

Flight crew does not detect the imminent collision between

other traffic and helicopter in VMC conditions

No blind call is transmitted to

other A/C

No_BlindCall_trans

F/C fail to detect and solve the

conflict in VMC conditions

FC_Fail_AC_VMC


reduction)








Flight crew does not detect the conflict induced by the


No blind call is transmitted to

other A/C

No_BlindCall_trans


aircraft in IMC conditions

FC_Fail_AC_IMC

P2 mitigation (effective risk reduction with traffic

advisory system)

Imminent collision between other traffic and helicopter in VMC

conditions

Imminent collision between other traffic and helicopter in IMC

conditions



Other traffic flies toward helicopter established on PinS

(departure or approach) instrument segment in VMC

conditions

Other A/C forget presence of the

PinS

Traffic_Forget_PinS

Other traffic is in the vicinity of the PinS

(departure or approach) instrument segment in

VMC conditions

P=1

One helicopter is established on the PinS (departure or approach)

instrument segment

P=1

IFR A/C flies toward helicopter established on PinS in IMC

conditions

VFR A/C flies toward helicopter established on PinS in IMC

conditions

One VFR Aircraft is in the vicinity of the PinS (departure or approach)

instrument segment in IMC conditions

P=0One helicopter is

established on the PinS (departure or approach)

instrument segment

P=1

Other traffic flies toward helicopter established on PinS

(departure or approach) instrument segment in IMC

conditions

No strategic separation between PinS procedure and others IFR routes/

procedures

Separation_IFR_PinS

Other IFR A/C is in the vicinity of the PinS

(departure or approach) instrument segment in

IMC conditions

P=0.1

One helicopter is established on the PinS (departure or approach)

instrument segment

P=1



Note: The see and avoid is less efficient in IMC

conditions without traffic advisory system



Generic Safety Case


The Table below describes the basic causes of the Hz_DEP_60 & Hz_APR_60 Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objectives.


Imminent collision between other traffic and helicopter in VMC conditions

One helicopter is established on the PinS (departure or approach) instrument segment

To be conservative it is assumed that there is at least one helicopter on PinS (departure or approach segment) in the vicinity of other traffic (Probability = 1)

Other traffic is in the vicinity of the PinS (departure or approach) instrument segment

To be conservative it is assumed that there is other traffic in the vicinity of a PinS (departure or approach) segment (Probability = 1)

Other aircraft forget presence of the PinS (departure or arrival) segment

Traffic_Forget_PinS The flight crewt of the other aircraft is not properly informed about the helicopter established on the PinS PinS DEPARTURE

See SR_DEP_UNCTRL#9

SR_DEP_UNCTRL#44. The PinS departure shall be clearly depicted on VFR charts to inform pilots of helicopter traffic in this area.

PinS APPROACH


SR_APR_UNCTRL#56. The PinS approach shall be clearly depicted on VFR charts to inform helicopter pilots of traffic in this area.

No blind call is transmitted to other A/C

No_BlindCall_trans The helicopter flight crewt established on PinS does not transmit regularly position and flight intent PinS DEPARTURE


PinS APPROACH

See SR_APR_UNCTRL#36 , SR_APR_UNCTRL#37 and SR_APR_UNCTRL#39


Generic Safety Case



Flight crew fail to see and avoid other aircraft in VMC conditions

FC_Fail_AC_VMC The flight crew operating a VFR helicopter shall maintain vigilance so as to see and avoid other aircraft. Note: Recommendations are defined regarding the traffic advisory system or equivalent system for VFR. However, it is not considered as an efficient mitigation mean as it is not mandatory.

PinS DEPARTURE

See ASS_DEP_UNCTRL#1, REC_DEP_UNCTRL#2, ASS_DEP_UNCTRL#2, SR_DEP_UNCTRL#30 and SR_DEP_UNCTRL#31

PinS APPROACH

See ASS_APR_UNCTRL#12, REC_APR_UNCTRL#5, ASS_APR_UNCTRL#13, SR_APR_UNCTRL#38 and SR_APR_UNCTRL#39

Imminent collision between other VFR traffic and helicopter in IMC conditions



One VFR aircraft is in the vicinity of the PinS (departure or approach) instrument segment and is unknown by F/C

It is assumed in IMC condition, at low altitude and in Class G that probability of having VFR aircraft in the vicinity of the helicopter is null (Probability = 0)

Imminent collision between other IFR traffic and helicopter in IMC conditions



Other IFR aircraft is in the vicinity of the PinS (departure or approach) instrument segment

It is assumed in IMC conditions, at low altitude and in Class G that probability of having IFR aircraft in the vicinity of the helicopter is low (probability =0,1)

No strategic separation between PinS procedure and other IFR routes/ procedures

Separation_IFR_ PinS Procedure design does not include strategic separation between the PinS and other instrument flight procedure in the vicinity.

PinS DEPARTURE

See SR_DEP_UNCTRL#1

PinS APPROACH

See SR_APR_UNCTRL#1


Generic Safety Case



No blind call is transmitted to other A/C

No_BlindCall_trans The helicopter flight crew established on PinS does not transmit regularly position and flight intent PinS DEPARTURE


PinS APPROACH

See SR_APR_UNCTRL#36 , SR_APR_UNCTRL#37 and SR_APR_UNCTRL#39

F/C fails to see and avoid other aircraft in IMC conditions

FC_Fail_AC_IMC The flight crew operating an IFR aircraft shall maintain vigilance so as to see and avoid other aircraft in uncontrolled airspace. Note: See and avoid not really efficient in IMC conditions. Additional requirement is defined regarding the use of a system enhancing the see and avoid (i.e. traffic advisoty system) for IFR.

PinS DEPARTURE

See ASS_DEP_UNCTRL#1, SR_DEP_UNCTRL#30, SR_DEP_UNCTRL#31

SR_DEP_UNCTRL#45. IFR helicopters flying the PinS departure in uncontrolled airspace shall be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this route (i.e. a traffic advisory system), unless it is shown that mitigating the risk of conflict with VFR and IFR is not required considering the airspace structure and the traffic density and complexity. ASS_DEP_UNCTRL#21. All IFR aircraft are equipped with secondary surveillance radar transponders in uncontrolled airspace.

PinS APPROACH

See ASS_APR_UNCTRL#12, SR_APR_UNCTRL#38 and SR_APR_UNCTRL#39 SR_APR_UNCTRL#57. IFR helicopters flying the PinS approach in uncontrolled airspace shall be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this route (i.e. a traffic advisory system), unless it is shown that mitigating the risk of conflict with VFR and IFR is not required considering the airspace structure and the traffic density and complexity.

ASS_APR_UNCTRL#23. All IFR aircraft are equipped with secondary surveillance transponders in uncontrolled airspace.


Generic Safety Case




Generic Safety Case


C.2.4 Hazard Hz_DEP_65 & Hz_APR_65 Helicopter deviates from expected flight path, towards terrain, during visual segment of the PinS “proceed visually” (approach or departure) procedure in uncontrolled airspace


A lateral deviation from the PinS visual segment towards terrain

A vertical deviation from the PinS visual segment towards terrain

These hazards could lead to an imminent CFIT classified with a severity SC 2.

Basic causes for such failures have been captured in the Hz_DEP_65 & Hz_APR_65 Fault Tree below (See Figure C-10). Two main branches are described

in this fault tree: the lateral deviation on the left side and the vertical deviation of the right side. It is shown in the fault tree by the undeveloped event (Deviation is towards terrain) that the allocated probability to the functional system is directly related to the operational environment (obstacle-rich or non-obstacle-rich).



Generic Safety Case


Frequency of occurrence of helicopter deviating from expected flight path, towards terrain, during visual segment of the PinS proceed visually

departure or approach, in uncontrolled airspace, leading to imminent CFIT shall not be greater than 1X10-7 per flight hour

Frequency of occurrence of deviating laterally from the expected PinS « proceed visually »


Frequency of occurrence of deviating vertically from the expected PinS « proceed visually »


High Criticality H1

Extreme Criticality E1

RNAV Procedure

design error


error



publication


the PinS


RNAV_AIS_Pub_Er

Hz_DEP_65 - CFIT SC2Hz_APR_65 - CFIT SC2











managing Vertical

guidance mode


A/C_Alt_FailVert_Guid_Mngt_Er

FC_Deviates_Vert

Error in QNH

QNH_Error


environment)

RNAV Procedure

design error


error

PinS corruption at

design /publication


Wrg_PinS_Sel









FC_Deviates_Lat




Failure of lightning / marking on the

heliport


High Criticality H2

High Criticality H2

RNAV_Proc_Design_Er

Extreme Criticality E1


Table C-10 below describes the basic causes of the Hazard Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objective. The column “mitigation / safety requirement” identifies distinct safety requirements for PinS departure and PinS approach operations. Many of


Generic Safety Case


the causes and mitigations identified in this table are similar to the ones identified for Hz_DEP_65 & Hz_APR_65 relating to deviation towards terrain during the instrument segment.



RNAV procedure design error RNAV_Proc_Design_Er The RNAV procedure design is not designed in accordance with the rules. PinS DEPARTURE

See SR_DEP_UNCTRL#5

PinS APPROACH

See SR_APR_UNCTRL#6


PinS DEPARTURE

See SR_DEP_UNCTRL#6

PinS APPROACH

See SR_APR_UNCTRL#7


See SR_DEP_UNCTRL#4

PinS APPROACH

See SR_APR_UNCTRL#5

RNAV AIS publication error RNAV_AIS_Pub_Er The AIP (including procedure charts) includes error on the RNAV procedure (e.g. WPT location, course…) despite a correct procedure design.

PinS DEPARTURE


PinS APPROACH



Generic Safety Case




Wrg_PinS_Sel The flight crew does not insert the correct PinS in the Flight Guidance and Selection system PinS DEPARTURE


PinS APPROACH



Visi_Degra Unexpected degradation of visibility conditions

PinS DEPARTURE


PinS APPROACH

See ASS_APR_UNCTRL#8, SR_APR_UNCTRL#21, SR_APR_UNCTRL#51 and SR_APR_UNCTRL#52


PinS APPROACH



FC_Deviates_Lat In manual or FD mode, the flight crew deviates laterally from a correct displayed guidance PinS DEPARTURE

See SR_DEP_UNCTRL#22, ASS_DEP_UNCTRL#10 and SR_DEP_UNCTRL#43

PinS APPROACH

SeeSR_APR_UNCTRL#15, ASS_APR_UNCTRL#3 and SR_APR_UNCTRL#55

RNAV procedure design error RNAV_Proc_Design_Er The vertical path of the PinS procedure is not designed in accordance with the rules PinS DEPARTURE

See SR_DEP_UNCTRL#5

PinS APPROACH

See SR_APR_UNCTRL#6


Generic Safety Case



The design error is not detected during the procedure validation process (ground and/or flight).

PinS DEPARTURE

See SR_DEP_UNCTRL#6

PinS APPROACH

See SR_APR_UNCTRL#7

There is an error in the survey of the route design. PinS DEPARTURE

See SR_DEP_UNCTRL#4

PinS APPROACH

See SR_APR_UNCTRL#5

AIS publication error AIS_Pub_Er The AIP (including procedure charts) includes error on the vertical path (e.g., altitude value, altitude constraints (AT, AT or above, etc…) despite a correct procedure design.

PinS DEPARTURE


PinS APPROACH





PinS APPROACH



Generic Safety Case






PinS APPROACH



FC_Deviates_Vert In manual or FD mode, the flight crew deviates vertically from the altitude depicted on the chart.

PinS DEPARTURE


PinS APPROACH



Visi_Degra Unexpected degradation of visibility conditions. PinS DEPARTURE


PinS APPROACH



PinS APPROACH


Error in QNH QNH_Error The AFISO or landing site operator provides a wrong QNH with an error exceeding the vertical safety margin and flight crew does not detect the error.

PinS DEPARTURE


PinS APPROACH



Generic Safety Case



The flight crew selects the wrong QNH despite the AFISO or landing site operator providing the correct one

PinS DEPARTURE


PinS APPROACH




Generic Safety Case


C.2.5 Hazard Hz_DEP_70 & Hz_APR_70 Helicopter deviates from expected flight path towards IFR or known VFR, during visual segment of the PinS “proceed visually” (approach or departure) in controlled airspace

Frequency of helicopter deviating laterally or vertically expected flight path, towards other aircraft, during visual segment of the PinS proceed visually departure or approach, in uncontrolled

airspace, leading to imminent collision with other traffic shall not be greater than 1X10-5 per flight hour

Flight crew do not detect accurately the IFR aircraft


P=1


IFR flight

No_BlindCall_trans


aircraft

ATC_Fail_IFR


reduction)








Flight crew do not detect accurately the VFR aircraft

At least one VFR Aircraft is in the vicinity of the PinS procedure

P=1


VFR flight

No_BlindCall_trans


aircraft

ATC_Fail_VFR


reduction)






PinS procedure during visual segment of the

PinS proceed visually



PinS procedure during visual segment of the

PinS proceed visually








Generic Safety Case


Table C-11 below describes the basic causes of the Hz_DEP_70 & Hz_APR_70 Fault Tree and identifies the mitigations/safety requirements necessary to satisfy the associated Safety Objective.


Conflict between Helicopter and IFR flight




At least one IFR aircraft is in the vincinity of the PinS procedure

To be conservative it is assumed in VMC condition that there is at least one IFR aircraft in the vicinity of the helicopter which deviates from the PinS procedure (Probability = 1)

Flight crew fail to see and avoid other aircraft

FC_fail_IFR The flight crewt operating an aircraft shall maintain vigilance so as to see and avoid other aircraft. Pilots should also keep in mind their responsibility for continuously maintaining a vigilant lookout considering that most midair collision accidents and reported near-MAC incidents occurred during good weather conditions and during daylight hours.

PinS DEPARTURE


PinS APPROACH



No_BlindCall_trans An IFR pilot flying in the vicinity of PinS procedure does not transmit regularly their position and flight intent

PinS DEPARTURE


PinS APPROACH






At least one VFR aircraft is in the vicinity of the PinS procedure

To be conservative it is assumed in VMC condition that there is at least one IFR aircraft in the vicinity of the helicopter which deviates from the PinS procedure (Probability = 1)


Generic Safety Case



F/C fail to see and avoid other aircraft FC_fail_VFR The flight crew operating an aircraft shall maintain vigilance so as to see and avoid other aircraft. Pilots should also keep in mind their responsibility for continuously maintaining a vigilant lookout considering that most midair collision accidents and reported near-MAC incidents occurred during good VFR weather conditions and during daylight hours.

PinS DEPARTURE


PinS APPROACH



No_BlindCall_trans A VFR pilot flying in the vicinity of PinS procedure does not transmit regularly their position and flight intent

PinS DEPARTURE


PinS APPROACH



C.2.6 Hazard Hz-APR_75: Helicopter fails to decelerate and/or prepare landing during the visual segment of the PinS approach, in uncontrolled airspace

Section 5.4 describes in more details these hazards which occur during helicopter PinS approach (this hazard is not relevant for PinS departure)

This hazard could lead to an imminent collision classified with a severity SC 2b.

Basic causes for such failures have been captured in Hz_APR_75 Fault Tree below (See Figure C-12).The basic causes are related to air, ground or spatial elements failures and could be human or equipment related.


Generic Safety Case


Frequency of occurrence of helicopter failing to decelerate and/or prepare landing during the visual segment of the PinS approach leading to unstable approach in uncontrolled airspace shall be not greater than 1x10-4 per flight

Hz_APR_75 - RE SC3Note: Criticality level and

propagating criticality rule in accordance with the SRM

Hybrid Fault Tree Method. See Appendix A of this document.

On board system failure (altimeter,

auto-pilot )

Wrong application of operational

procedure by theFlight Crew

A/C_Sys_FailFC_Fail

RNAV Procedure

design error


error

PinS corruption at

design /publication







RNAV_AIS_Pub_Er RNAV_Proc_Design_Er

Medium Criticality M1

Figure C-12: Hz_APR_75 Fault tree


RNAV procedure design error RNAV_Proc_Design_Er The RNAV procedure design is not designed in accordance with the rules PinS APPROACH

See SR_APR_UNCTRL#6

The RNAV design error is not detected during the procedure validation process (ground and/or flight)

PinS APPROACH

See SR_APR_UNCTRL#7

There is an error in the survey for the PinS procedure design PinS APPROACH

See SR_APR_UNCTRL#5

RNAV AIS publication error RNAV_AIS_Pub_Er The AIP (including procedure charts) includes errors on the RNAV procedure (e.g. WPT PinS APPROACH


Generic Safety Case



location, course…) despite a correct procedure design.


On board system failure (altimeter, auto-pilot…)

A/C_Sys_Fail Failure of an on board system (altimeter, auto-pilot, flight control system…) leading to failure to decelerate properly despite a correct procedure design

Already covered by mitigations and requirements identified for previous hazards (QNH_Error, A/C_Alt_Fail)

Wrong application of operational procedure by the flight crew

FC_Fail Wrong application of the operational procedure by the flight crew despite a correct procedure design

PinS APPROACH



Visi_Degra Unexpected degradation of visibility conditions

PinS APPROACH


Heli_light_fail Failure of lighting / marking on the heliport PinS APPROACH


Table C-12: Derivation of Mitigation/Safety Requirements for Hazard Hz_APR_75


Generic Safety Case


Part II —

Safety Case Guidance Material for local deployment of Helicopter Point in Space

departure operations in controlled and uncontrolled

airspace


Generic Safety Case


12 Helicopter PinS departure operations

The Point-in-Space (PinS) concept is a flight operation based on GNSS and designed for helicopters only. It relies on the possibility for the pilot to conduct flight under Instrument Meteorological Conditions (IMC) to/from a Point-in-Space (PinS) and not directly to/from the heliport/landing site. Those procedures enable to implement IFR procedures on non-instrument FATO (Final Approach and Take-Off) located on aerodromes or isolated heliports as well as landing/departure locations.

Two kinds of PinS operations are possible: PinS departure operations and PinS approach operations and the scope of this document is the PinS departure operations.

PinS departure operations can be summarized as follows:

The pilot proceeds using visual references from the FATO to a Point in Space called the IDF (Initial Departure Fix). This part of the operation is the visual flight phase which could be:

o a “proceed visually” procedure or,

o a“proceed VFR” procedure

The instrument flight phase starts once the pilot has passed the IDF at or above a certain altitude (MCA: Minimum Crossing Altitude).

PinS departure procedures are designed in accordance with ICAO Doc 8168 Volume II [RD 31].

More details about PinS departure operations can be found in PinS safety case report [1].


Generic Safety Case


13 Objective of the Safety Case Guidance Material for deployment of PinS departure operations

The main objective of this Safety Case Guidance Material is to help the Project Owner to develop the local safety case for the deployment of helicopter PinS departure operations in the operational environment.

This document will help the Project Owner to provide assurance, with sufficient confidence, that the PinS departure operations will be safe and will remain safe during the PinS departure service life.

The deployment of helicopter PinS departure operations is a multi-actor change and therefore requires coordination between different service providers (air traffic service provider, aeronautical information service provider, navigation service provider…), heliport/departure site operator and helicopter operators affected by the change due to the presence of dependencies between them. This coordination is essential to ensure a safe deployment due to these dependencies. The Project Owner is the actor who should coordinate and prepare the PinS deployment safety case.

Note: The Project Owner could be:

In controlled airspace, the Air Traffic Service Provider

In uncontrolled airspace, the Air Traffic Service Provider, the heliport/departure site operator or the helicopter operator

The interaction with the Competent Authorities for the review of such deployment is not detailed in this Guidance Material and should follow the current regulation and process in place.

This Safety Case Guidance Material for deployment explains how the Project Owner could use the output from the Helicopter PinS generic safety case report as detailed in Part I of this document to develop the local safety case. More details about the origin of the safety requirements could be found in the Part I [1].

This Guidance Material is structured around a safety argument and includes the following sections:

Section 14 introduces what is a safety argument and presents the PinS departure safety argument.

Section 15 presents guidance for the activity that the Project Owner should perform, based on the output of the generic safety case report (Part I), to provide the safety assurance associated to the safety argument.

ANNEX E – ANNEX F – ANNEX G – present the main output of the generic safety case (i.e. safety requirements, safety recommendations and assumptions), that should be used by the Project Owner when developing the local safety case.

Note: This document is a guidance describing the activities to be conducted, it is not a template of local safety case for PinS departure. The Project Owner should conduct the safety activities listed in this document based on the guidance listed in section 15 and should develop the local safety case presenting the results of these activities.


Generic Safety Case


14 Safety Argument

14.1 Introduction to safety argument

A safety argument is a statement (or a set of statements) that is used to assert that the service/system/operation is safe. It is a way to present a structured argumentation and to demonstrate the exhaustiveness of this argumentation. More details can be found in [RD 42].

A safety argument is composed of the following elements:

- A Claim, i.e. what we want to demonstrate through the safety argument. The claim is presented at the top of the safety argument. It is generally formulated as a sentence like “Deployment of operations/system is acceptably safe”.

- A Safety Criteria. The safety criteria is the criteria that will be used to demonstrate that the claim is satisfied, it defines what means acceptably safe for a given operation / system.

- Sub argument. The claim is decomposed in sub-argument. The objective of this break down is to provide an exhaustive argumentation that the claim is satisfied. The break down in sub-argument can be performed per domain, per phase of the lifecycle (i.e. specification, development, implementation…)…

- Safety Assurance / Safety Evidence. Safety Assurance are evidence (i.e. specification document, design document, test document…) that a sub-argument has been correctly implemented. It should be provided in front of each sub-argument.

The following figure presents an illustration of a typical safety argument presented using Goal-Structuring Notation (GSN) :

Safety CriteriaE.g. Acceptably safe is defined as a

reduction of the number of mid-air collision with introduction of system XX

Sub-argument Arg 1E.g. System XX is specified to ensure that operation will be

acceptably safe

Sub-argument Arg 2E.g. System XX is implemented to

ensure safe operation

Sub-argument Arg 3E.g. Transition between current

system and system XX is acceptably safe

Arg 0 (Claim)E.g. Deployment of system XX is

acceptably safe

EvidenceE.g. Safety

Case section AA

Sub-argument Arg 4E.g. On going operation with system XX remain acceptably

safe during the service life

EvidenceE.g. Safety

Case section BB

EvidenceE.g. Safety

Case section CC

EvidenceE.g. Safety

Case section DD

Figure 14-1: Exemple of typical safety Argument

The PinS generic safety case and the present document are structured around a safety argument. Section 14.2 presents the proposed safety argument for deployment of PinS departure operations. Section 15 provides guidance on activities to be conducted by the different actors to develop safety evidence associated to each sub-argument.


Generic Safety Case


14.2 Safety argument for deployment of PinS departure operations

The following figure presents the safety argument for the demonstration that the deployment of PinS departure operations are safe.

The claim of this safety argument is that “Local deployment of helicopter PinS operations will be acceptably safe”.

The break down in sub-argument is performed around two apects:

- First break down is per lifecycle phase (specification/design, implementation…) in order to cover all the PinS departure service life.

- Second break down is per actor involved in the deployment of the PinS departure operations (ATSP, GNSS service provider…)

This safety argument does not only address the possible failure that could occur when operating PinS procedures (i.e. failure case) but also the PinS departure operations when performing as intended (i.e. the success case). Many of the activities recommended in this guidance material have the objective to demonstrate that the PinS departure operations will be safe in normal operations and that they will provide the expected benefits in comparison to current departure operations in VFR.


Generic Safety Case


Safety Criteria Acceptably safe is defined by No negative impact on the current level of safety in

the airspace class where PinS is implemented Safer than or at least as safe as current departure

helicopter operations conducted in VFR

Sub-argument for specificationHelicopter PinS departure operation have been specified and designed locally to be acceptably

safe

Overall argument (i.e. Claim)Deployment of PinS departure operation will

be acceptably safe

Sub-argument for implementationHelicopter PinS departure operation are implemented

locally to be acceptably safe

Sub-argument for transition to operationTransition from current VFR operation to PinS departure

operations are acceptably safe

See Guidance in section 15.5

Sub-argument for operationHelicopter PinS departure operation will be acceptably

safe through its service life

Sub-argument for specification of GNSSGNSS is specified and designed to support local

safe PinS departure operation

See Guidance in section 15.3.1

Sub-argument for specification of FPDInstrument Flight Procedure is specified and

designed to support local safe PinS departure operation


Sub-argument for specification of AISAeronautical Information Service is specified and

designed to support local safe Pins departure operation


Sub-argument for specification of METMET service is specified and designed to support

local safe Pins departure operation


Sub-argument for specification of ATSAir Traffic Service is specified and designed to

support local safe Pins departure operation


Sub-argument for specification of helicopterHelicopter operations are specified and designed

to support local safe Pins departure operation


Sub-argument for implementation of GNSSGNSS is implemented to support local safe PinS

departure operation


Sub-argument for implementation of FPDInstrument Flight Procedure is implemented to

support local safe PinS departure operation


Sub-argument for implementation of AISAeronautical Information Service is implemented

to support local safe Pins departure operation


Sub-argument for implementation of METMET service is implemented to support local safe

Pins departure operation


Sub-argument for implementation of ATSAir Traffic Service is implemented to support local

safe Pins departure operation


Sub-argument for implementation of helicopterHelicopter operations are implemented to support



Sub-argument for operation of GNSSGNSS performances continues to be suitable to

support local safe PinS departure operation


Sub-argument for maintenance of FPDModification of Instrument Flight Procedure are

safely managed during PinS service life


Sub-argument for operation of AISAeronautical Information Service continues to



Sub-argument for operation of METMET service continues to support local safe Pins

departure operation


Sub-argument for operation of ATSAir Traffic Service continues to support local safe



Sub-argument for operation of helicopterHelicopter operations continues to support local

safe Pins departure operation


Sub-argument for specification of heliportHeliport operations are specified and designed to



Sub-argument for implementation of heliportHeliport operations are implemented to support



Sub-argument for operation of heliportHeliport operations continue to support local safe



Figure 14-2: Safety argument for PinS departure operations


Generic Safety Case


As illustrated on the figure above, and in accordance with the generic safety case report (Part I), the following safety criteria are considered in this safety argument:

No negative impact on the current level of safety in the airspace class where PinS is implemented which is associated to the risk of Mid-air Collision (MAC).

Safer (or at least as safe) than current helicopter operations conducted in VFR only which is associated to the risk of Controlled Flight Into Terrain (CFIT) and Loss of Control Inflight (LOC-I).

As this document is a guidance material, the Figure 14-2 above does not present the safety assurance associated to each sub-argument but Section 15 provides guidance on the activities that the Project Owner should perform to develop the safety assurance associated to the different sub-arguments, more particularly:

Section 15.3 details the activities to be conducted to develop the safety assurance demonstrating the safe specification of PinS departure operations.

Section 15.4 details the activities to be conducted to develop the safety assurance demonstrating the safe implementation of PinS departure operations.

Section 15.5 details the activities to be conducted to develop the safety assurance demonstrating the safe transition to service of PinS departure operations.

Section 15.6 details the activities to be conducted to develop the safety assurance demonstrating the safe operations of PinS departure operations.

The Project Owner should perform or verify all these activities in order to develop a complete local safety case.

Note: This does not mean that the Project Owner is responsible for all domains but that the Project Owner has at least the guarantee that when Helicopter PinS departure will be deployed all of these domains have been addressed from a safety point of view.


Generic Safety Case


15 Guidance material for development of local safety case for deployment of helicopter PinS departure operations

15.1 Guidance for verification of operational environment to implement the PinS departure operations

The Project Owner shall verify that the operational environment (OE) described in the table below is relevant for its local implementation. This will permit to verify whether this Safety Case Guidance Material is applicable.

Ref Description

OE#1 PinS departure is an RNP1 or RNP0.3 flight procedure

OE#2 PinS departure is within controlled (airspace class C or D) and/or uncontrolled airspace (airspace class G)14

OE#3 PinS departure is a PinS “proceed VFR” or a PinS “proceed visually”

OE#4 Visual segment of the PinS departure is a direct segment (not a manoeuvring segment) for a PinS proceed visually

OE#5 PinS departure is composed of straight segment (TF legs) and does not include in this current version of the generic safety case the RF leg

In case of a different operational environment, the guidance provided in this generic document might not be fully applicable and the Project Owner should assess the possible differences of the local environment based on the generic safety case report (Part I).

15.2 Guidance for verification of the applicability of the generic Safety Argument for helicopter PinS departure operations

The Project Owner shall verify that the Safety argument illustrated in paragraph 14.2 is applicable and acceptable for the local deployment of the helicopter PinS departure. This safety argument should be presented and accepted by the Competent Authority in accordance with the current regulation.

The Project Owner shall also verify that the local sharing of responsibility is consistent with the table below or shall adapt the safety argument accordingly:

Domains/actors addressed by the Safety Argument

Domain Actor

CNS / Navigation (GNSS) EGNOS service provider (if SBAS is required)

14 A PinS departure completely inside an airspace class E has not been considered. However, it is important to note that helicopter landing

sites located in airspace class G may be served by PinS procedures ending or passing through airspace class E. In this case, the assumption made in this safety case is that the most demanding requirements (those derived from airspace class G) apply throughout the procedure because these mitigations should anyway be put in place for the segment within airspace class G.


Generic Safety Case



Pan European

Airspace / Procedure design Flight Procedure Design (FPD) service provider

Aeronautical Information Service Aeronautical Information Service (AIS) provider

MET provision MET service provider

Air Traffic Service

(including Flight Information Service)

Air Traffic Service Provider (ATSP)

Heliport operations Heliport Operator

Helicopter operations &

certification

Helicopter Operator

Note: In the above table, the “Data provision” domain and the “Provider of data services” are not listed. It is assumed that aircraft certification (for the design of airborne navigation system) and aircraft operations will consider the use of approved aeronautical navigation databases. (EU) 2017/373 (Common Requirements for ATM/ANS service providers) mandates certification of DAT providers from 1st January 2019, the same date from which the aircraft operators shall use only certified DAT providers. The OPS regulation (EU) 965/2012 had been already updated consistently.

15.3 Guidance for development of safety assurance relating to local specification and design of PinS departure operations

15.3.1 Guidance for specification of GNSS service

The Project Owner shall perform, in collaboration with the GNSS Service Provider, the following activities in order to define the local specification relating to GNSS for PinS departure operations:

Ref Activity Guidance information

SPEC_GNSS_01 Identification of the applicable Safety Requirements and Recommendations relating to GNSS, from the generic safety case.

Generic safety requirements and recommendations applicable to PinS departure operations have been identified through a generic PinS safety case (Part I).

Section E.1 lists the requirements from the generic safety case relating to GNSS and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

No recommendation applicable to the GNSS has been identified in the generic PinS safety case.


Generic Safety Case



SPEC_GNSS_02 Identification of the applicable assumptions relating to GNSS, from the generic safety case.

No assumption applicable to the GNSS has been identified in the generic PinS safety case.

15.3.2 Guidance for specification of Flight Procedure Design

The Project Owner shall perform, in collaboration with the Flight Procedure Design Service Provider, the following activities in order to define the local specifications relating to Flight Procedure Design for PinS departure operations:


SPEC_FPD_01 Identification of the applicable Safety Requirements and Recommendations relating to Flight Procedure Design, from the generic safety case.


Section E.2 lists the requirements from the generic safety case relating to Flight Procedure Design service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

No recommendation applicable to the Flight Procedure Design service has been identified in the generic PinS safety case.

SPEC_FPD_02 Identification of the applicable assumptions relating to Flight Procedure Design, from the generic safety case.

No assumption applicable to the Flight Procedure Design service has been identified in the generic PinS safety case.

15.3.3 Guidance for specification of Aeronautical Information Service

The Project Owner shall perform, in collaboration with the Aeronautical Information Service Provider, the following activities in order to define the local specification relating to Aeronautical Information Service for PinS departure operations:


SPEC_AIS_01 Identification of the applicable Safety Requirements and Recommendations relating to Aeronautical Information Service, from the generic safety case.



Generic Safety Case



Section E.3 lists the requirements from the generic safety case relating to Aeronautical Information Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

No recommendation applicable to the Aeronautical Information Service has been identified in the generic PinS safety case.

SPEC_AIS_02 Identification of the applicable assumptions relating to Aeronautical Information Service, from the generic safety case.

The generic PinS safety case (Part I) is based on a set of assumptions.

Section G.3 lists the assumptions from the generic safety case relating to Aeronautical Information Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable assumptions, depending on the local environment.

15.3.4 Guidance for specification of MET service

The Project Owner shall perform, in collaboration with the Meteorological Service Provider, the following activities in order to define the local specifications relating to Meteorological Service for PinS departure operations:


SPEC_MET_01 Identification of the applicable Safety Requirements and Recommendations relating to Meteorological Service, from the generic safety case.


Section E.4 lists the requirements from the generic safety case relating to Meteorological Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

No recommendation applicable to the Meteorological Service has been identified in the generic PinS safety case.


Generic Safety Case



SPEC_MET_02 Identification of the applicable assumptions relating to Meteorological Service, from the generic safety case.

No assumption applicable to the Meteorological Service has been identified in the generic PinS safety case.

15.3.5 Guidance for specification of Air Traffic Service

The Project Owner shall perform, in collaboration with the Air Traffic Service Provider, the following activities in order to define the local specification relating to Air Traffic Services for PinS departure operations:


SPEC_ATSP_01 Identification of the applicable Safety Requirements and Recommendations relating to Air Traffic Service, from the generic safety case.


Section E.5 lists the requirements from the generic safety case relating to Air Traffic Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operations (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

Section F.5 lists the recommendation from the generic safety case relating to Air Traffic Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operations (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety recommendations, depending on the local environment.

The Project Owner should then evaluate the relevance of each recommendation based on the local operations and environment. Guidance are provided in section F.5 to perform this evaluation.

SPEC_ATSP_02 Identification of the applicable assumptions relating to Air Traffic Service, from the generic safety case.



Generic Safety Case



Section G.5 lists the assumptions from the generic safety case relating to Air Traffic Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operations (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable assumptions, depending on the local environment.

15.3.6 Guidance for specification of heliport/departure site operations

The Project Owner shall perform, in collaboration with the heliport operator, the following activities in order to define the local specifications relating to heliport/departure site operations for PinS departure operations:


SPEC_HPT_01 Identification of the applicable Safety Requirements and Recommendations relating to heliport operations, from the generic safety case.


Section E.6 lists the requirements from the generic safety case relating to heliport operations and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operations (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

No recommendation applicable to the heliport operations has been identified in the generic PinS safety case.

SPEC_HPT_02 Identification of the applicable assumptions relating to heliport operations, from the generic safety case.

No assumption applicable to the heliport operations has been identified in the generic PinS safety case.

15.3.7 Guidance for specification of helicopter operations and certification

The Project Owner is not responsible for the verification of the specification of the helicopter operations. The Project Owner considers that the helicopter operations are approved by the local competent authority.


Generic Safety Case


The following table highlights the safety requirements, recommendations and assumptions considered on the helicopter operations and equipment in the generic safety case (Part I). The Project Owner considers that these requirements, recommendations and assumptions are taken into account for helicopter operator approval.

Ref Information for helicopter operations approval

SPEC_HO_01 Generic safety requirements applicable to PinS departure operations have been identified through a generic PinS safety case (Part I)

Section E.7 lists the requirements from the generic safety case relating to helicopter systems and operations and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR).

SPEC_HO_02 Safety recommendations applicable to PinS departure operations have been identified through a generic PinS safety case (Part I).

Section F.7 lists the recommendations from the generic safety case relating to helicopter systems and operators and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operations (PinS proceed visually or PinS proceed VFR).

SPEC_HO_03 The generic PinS safety case (Part I) is based on a set of assumptions.

No specific assumption applicable to helicopter systems and operations has been identified in the generic PinS safety case.

15.3.8 Guidance for specification completeness and correctness

The Project Owner with all actors shall perform the following activities in order to verify the completeness and correctness of the local specifications relating to all domains for PinS departure operations:


SPEC_C&C_01 Verify completeness and correctness of the Safety requirements, recommendations and assumptions considering the local operational environment and local constraints where the PinS departure should be implemented.

A generic safety assessment was conducted for PinS departure (Part I).

The Project Owner with the support of the other actors should check the applicability of Safety Criteria, Pre-existing Hazards and Operational Hazards of the generic environment to the local environment.

If needed, the Project Owner with the other actors shall identify new hazards, new requirements, new recommendations and new assumptions specific to the local environment.

The Project Owner should contact and inform EUROCONTROL (See contact person in the document characteristics section) in order to update the generic safety case material accordingly.


Generic Safety Case


15.4 Guidance for development of safety assurance relating to local implementation of PinS departure operations

15.4.1 Guidance for implementation of GNSS service

The Project Owner, in collaboration with the GNSS service provider, shall perform the following activities in order to ensure a safe implementation of GNSS for PinS departure operations:


IMP_GNSS_01 Verification that all applicable safety requirements relating to GNSS are correctly implemented in the local environment.

Applicable safety requirements and recommendations relating to GNSS have been identified through activities listed in section 15.3.1 and 15.3.8.

The Project Owner, in collaboration with GNSS service provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.

Section E.1 provides guidance for the implementation of some of these requirements.

IMP_GNSS_02 Verification that all applicable assumptions relating to GNSS are satisfied in the local environment.

Applicable assumptions relating to GNSS have been identified through activities listed in section 15.3.1 and 15.3.8.

The Project Owner, in collaboration with GNSS service provider, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.

In case of non-compliance with one of the assumptions, the Project Owner should assess the impact of this non-compliance on the ability to satisfy the safety target and should possibly define alternate safety requirements.

15.4.2 Guidance for implementation of Flight Procedure Design

The Project Owner, in collaboration with the Flight Procedure Design service provider, shall perform the following activities in order to ensure a safe implementation of Flight Procedure Design for PinS departure operations:


IMP_FPD_01 Verification that all applicable safety requirements relating to Flight Procedure Design service are correctly implemented in the local environment.

Applicable safety requirements and recommendations relating to Flight Procedure Design service have been identified through activities listed in section 15.3.2. and 15.3.8


Generic Safety Case



The Project Owner, in collaboration with Flight Procedure Design service provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.


IMP_FPD_02 Verification that all applicable assumptions relating to Flight Procedure Design service are satisfied in the local environment.

Applicable assumptions relating to Flight Procedure Design service have been identified through activities listed in section 15.3.2 and 15.3.8.

The Project Owner, in collaboration with Flight Procedure Design service provider, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.


15.4.3 Guidance for implementation of Aeronautical Information service

The Project Owner, in collaboration with the Aeronautical Information Service provider, shall perform the following activities in order to ensure a safe implementation of Aeronautical Information Service for PinS departure operations:


IMP_AIS_01 Verification that all applicable safety requirements relating to Aeronautical Information Service are correctly implemented in the local environment.

Applicable safety requirements and recommendations relating to Aeronautical Information Service have been identified through activities listed in section 15.3.3 and 15.3.8.

The Project Owner, in collaboration with Aeronautical Information Service provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.



Generic Safety Case



IMP_AIS_02 Verification that all applicable assumptions relating to Aeronautical Information Service are satisfied in the local environment.

Applicable assumptions relating to Aeronautical Information Service have been identified through activities listed in section 15.3.3 and 15.3.8.

The Project Owner, in collaboration with Aeronautical Information Service provider, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.


15.4.4 Guidance for implementation of MET service

The Project Owner, in collaboration with the meteorological service provider, shall perform the following activities in order to ensure a safe implementation of meteorological service for PinS departure operations:


IMP_MET_01 Verification that all applicable safety requirements relating to meteorological service are correctly implemented in the local environment.

Applicable safety requirements and recommendations relating to meteorological service have been identified through activities listed in section 15.3.4 and 15.3.8.

The Project Owner, in collaboration with meteorological service provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.


IMP_MET_02 Verification that all applicable assumptions relating to meteorological service are satisfied in the local environment.

Applicable assumptions relating to meteorological service have been identified through activities listed in section 15.3.4 and 15.3.8.

The Project Owner, in collaboration with meteorological service provider, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.


Generic Safety Case




15.4.5 Guidance for implementation of Air Traffic Services

The Project Owner, in collaboration with the Air Traffic Service Provider, shall perform the following activities in order to ensure a safe implementation of Air Traffic Services for PinS departure operations:


IMP_ATSP_01 Verification that all applicable safety requirements relating to Air Traffic Service are correctly implemented in the local environment.

Applicable safety requirements and recommendations relating to GNSS service have been identified through activities listed in section 15.3.5 and 15.3.8.

The Project Owner, in collaboration with the Air Traffic Service Provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.


IMP_ ATSP _02 Verification that all applicable assumptions relating to Air Traffic Service are satisfied in the local environment.

Applicable assumptions relating to GNSS service have been identified through activities listed in section 15.3.5 and 15.3.8.

The Project Owner, in collaboration with the Air Traffic Service Provider, should verify that these safety assumptions are correctly implemented and should collect the evidence of their implementation.


15.4.6 Guidance for implementation of heliport/departure site operations

The Project Owner, in collaboration with the heliport operator, shall perform the following activities in order to ensure a safe implementation of heliport operations for PinS departure operations:


Generic Safety Case



IMP_HPT_01 Verification that all applicable safety requirements relating to heliport operations are correctly implemented in the local environment.

Applicable safety requirements and recommendations relating to heliport operations have been identified through activities listed in section 15.3.6 and 15.3.8.

The Project Owner, in collaboration with heliport operator provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.


IMP_HPT_02 Verification that all applicable assumptions relating to meteorological service are satisfied in the local environment.

Applicable assumptions relating to heliport operations have been identified through activities listed in section 15.3.6 and 15.3.8.

The Project Owner, in collaboration with heliport operator, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.


15.4.7 Guidance for implementation of helicopter operations and certification

The Project Owner is not responsible for the verification of the implementation of the helicopter operations. The Project Owner considers that the helicopter operations are approved by the local competent authority. The Project Owner considers that the requirements, recommendations and assumptions listed in section 15.3.7 and 15.3.8 are taken into account by the local competent authority for helicopter operator approval.

15.5 Guidance for development of safety assurance relating to the transition from current VFR departure to PinS departure operations

This safety argument is relative to the transfer into operation of helicopter PinS departure operations, based on the implementation phase addressed in previous section 15.4.

The Project Owner shall perform the following activities to ensure a safe transfer into operation:


Generic Safety Case



TRANS_ 01 Determine the transition step between the current situation and PinS departure operations.

Determine the transition step for:

Air Navigation Services (ANS).

heliport/departure site

helicopter operators

considering all impacted elements (human, procedure and equipment)

Impact on procedures should be minimal if PBN operations are already used in the operational environment

TRANS_ 02 Identification and mitigation of possible ATM/ANS risks during transition from current state to PinS departure operations.

Local safety assessment for the transfer into operation phase is conducted in order to identify risks and derive mitigations when necessary (ATCO/AFISO training including simulator sessions, dedicated information in the AIP, direct communication towards airspace users, …). Some additional steps may be required, depending on the operational environment (obstacles constraints, high density area, …), by e.g :

An implementation program in successive steps with a first temporary phase in VMC conditions.

An initial implementation with a limited number of airspace users to gain experience and identify any problem.

…

TRANS_ 03 Identification and mitigation of possible heliport/departure site risks during transition from current state to PinS departure operations.

Local safety assessment for the transfer into operation phase is conducted in order to identify risks and derive mitigations when necessary. Some additional steps may be required depending on the departure site specificity.

TRANS_ 04 Identification and mitigation of possible helicopter operations risks during transition from current state to PinS departure operations.

This activity is not under Project Owner responsibility. However, it is necessary to ensure that the helicopter operations risks during transition are sufficiently mitigated, similarly to what is done in activity TRANS_02 for ATM/ANS risks.

Project Owner considers that the mitigation of helicopter operations risks is verified by the local competent authority for helicopter operator approval.


Generic Safety Case


15.6 Guidance for development of safety assurance relating to the PinS departure operations through its service life

15.6.1 Guidance for safe GNSS service through PinS service life

The Project Owner shall verify, in collaboration with the GNSS service provider, that the following activities are satisfied during the PinS departure service life:


OPE_GNSS_01 Verification of acceptability of local GNSS performance.

If EGNOS is required, verification based on SoL SDD updates and EGNOS Service Notices.

Safety oversight of the EGNOS service provider by EASA.

OPE_GNSS_02 Identification of “Events” or specific cases necessitating a new ground and/or flight validation.

Dedicated Flight Inspection should be conducted for the eligible “events” (e.g. interference encountered during operations, GNSS loss of integrity, flyability problem encountered by some airspace users,…).

15.6.2 Guidance for safe Flight Procedure Design through PinS service life

The Project Owner in collaboration with the Flight Procedure Designer, shall verify that the following objectives are satisfied during the PinS departure service life:


OPE_FPD_01 Safe management of PinS departure procedure design modification during service life through regular meetings with stakeholders.

PinS departure procedure modifications affecting the trajectory of the procedure (track, distance, altitude, new waypoint,…) shall lead to a new implementation process.

OPE_FPD_02 Periodic review of PinS departure procedure.

Periodic reviews are necessary to ensure that published procedure continues to comply with changing criteria, to confirm continued adequate obstacle clearance and that it meets user requirements (ATSP and aircraft operators).

Compliance with ICAO Doc 8168 [RD 31] or any Alternate MOC to PANS OPS approved by the Competent Authority.

The maximum interval for this review is five years.

Note: This periodic review is not specific to PinS procedure.


Generic Safety Case


15.6.3 Guidance for safe Aeronautical Information Service through PinS service life

The Project Owner shall verify, in collaboration with the AIS Provider, that the following activities are performed during the PinS service life:


OPE_AIS_01 Information for airspace users about the status of the PinS departure procedure with regard to navigation aids.

See (EU) No 2017/373 [RD 28](ATM/ANS CR- Part AIS) and ICAO Annex 15 [RD 35]

NOTAM are published if safety of helicopter operations on the PinS departure procedure is affected or is planned to be affected.

AIC is published to describe the operational concept and any relevant information to inform stakeholders and any users of the airspace concerned by PinS departure.

15.6.4 Guidance for safe MET Service through PinS service life

The Project Owner shall verify, in collaboration with the MET Service provider, that the following activities are performed during the PinS service life:


OPE_MET_01 Continuous provision of appropriate meteorological service for helicopter operations on the PinS departure procedure.

See requirements in section E.4 for meteorological information to be provided.

15.6.5 Guidance for safe Air Traffic Service through PinS service life

The Project Owner shall verify, in collaboration with the Air Traffic Service Provider, that the following activities are performed during the PinS service life:


OPE_ATSP_01 Maintenance of skills of ATCO, AFISO and ATSEP/ technical personnel to satisfy ATS procedures and phraseology defined during the “Implementation” and “Transition” phases.

Local training program or briefing for personnel to be developed to maintain skill and competency for the different ATS procedures /Phraseology.

ATS procedures / phraseology to be respected are those defined during the Implementation phase (see section 15.4.5).

Additional and temporary ATS procedures/restrictions/ limitations might be necessary as defined during the Transition phase (see section 15.5).


Generic Safety Case



OPE_ATSP_02 Monitoring of Safety performance indicators for helicopter PinS departure operations in a collaborative way with airspace users.

Safety performance indicators should be first set to identify loss of RNP capability events on the PinS procedure.

Additional safety performance indicators should be defined and monitored locally (e.g. number of U-turn, Interference events, Coding/navigation data base problem,…).

Note: Flight crew reports should be the main source for occurrence reporting.

OPE_ATSP_03 Management of safety events affecting helicopter PinS departure operations.

For the occurrence reporting see (EU) No 376/2014 [RD 46]

Safety events are addressed and when needed corrective actions are determined and implemented.

15.6.6 Guidance for safe heliport/departure site operations through PinS service life

The Project Owner shall verify, in collaboration with the heliport operator, that the following activities are performed during the PinS service life:


OPE_HPT_01 Continuous provision of appropriate service for helicopter operations on the PinS departure procedure.

See requirements in section E.6 for service to be provided by heliport operator for PinS departure operations.

15.6.7 Guidance for safe helicopter operations and certification through PinS service life

The Project Owner should consider that all flight crew conducting PinS departure operations are respecting the approved procedures, in particular they will:

fly the route in accordance with the published procedure in the AIP,

respect the AFM relative to RNP 1 or RNP 0.3 route,

respect the operational procedures relative to RNP 1 or RNP 0.3 route,

report any incident in accordance with the applicable regulation.


Generic Safety Case


ANNEX D – Reference material


[RD 24] SESAR Safety Reference Material, Edition 00.04.00, 24th of March 2016

[RD 25] Guidance to Apply the SESAR Safety Reference Material, Edition 00.03.00, 9th of May 2016



[RD 28] (EU) No 2017/373 common requirements for providers of ATM/ANS






[RD 34] ICAO Annex 10 Aeronautical Telecommunications Vol I, Sixth Edition 2006








[RD 42] EUROCONTROL - Safety Case Development Manual – V2.2 – 13/11/2006




[RD 46] (EU) No 376/2014 on the reporting, analysis and follow-up of occurrences in civil aviation


Generic Safety Case


ANNEX E – Safety Requirements from the generic safety case

The following sections present the safety requirements for PinS Departure identified within the generic PinS safety case (Part I). These requirements are sorted per domain:

Section E.1 identifies the requirements applicable to GNSS domain (i.e. requirements identified as applicable to GNSS/SBAS service provider) in the generic PinS safety case (Part I)

Section E.2 identifies the requirements applicable to Flight Procedure Design domain (i.e. requirements identified as applicable to FPD provider) in the generic PinS safety case (Part I)

Section E.3 identifies the requirements applicable to AIS domain (i.e. requirements identified as applicable to AID provider) in the generic PinS safety case (Part I)

Section E.4 identifies the requirements applicable to MET domain (i.e. requirements identified as applicable to MET provider) in the generic PinS safety case (Part I)

Section E.5 identifies the requirements applicable to ATS domain (i.e. requirements identified as applicable to the ATSP, AFISO or NM in the generic PinS safety case (Part I)

Section E.6 identifies the requirements applicable to heliport/departure site domain (i.e. requirements identified as applicable to heliport operator) in the generic PinS safety case (Part I)

Section E.7 identifies the requirements applicable to helicopter domain (i.e. requirements identified as applicable to helicopter, helicopter operators and other traffic) in the generic PinS safety case (Part I)


Generic Safety Case


E.1 Safety Requirements applicable to GNSS domain

SAFETY REQUIREMENT APPLICABILITY

GUIDANCE FOR IMPLEMENTATION Domain

VFR or Visually

Airspace

SR_DEP_CTRL#24 & SR_DEP_UNCTRL#19: The GNSS signal in space (GPS and SBAS if required)

shall be compliant with ICAO Annex 10 SARPS on the PinS departure procedure.

GNSS/SBAS service

provider VFR & Visually

Controlled & uncontrolled

The Project Owner should consider that GPS constellation alone could deliver appropriate

performance for RNP 1 and RNP 0.3 PinS departure.

If SBAS is required, the Project Owner should consider acceptance of the SDD maps by EASA as sufficient

evidence when published in the SoL SDD.

The Project Owner should determine that GNSS (GPS or GPS and EGNOS) positioning is available (accuracy,

integrity and continuity) on the PinS departure and that no interference is present.

Table E-1: Safety Requirements applicable to GNSS domain

E.2 Safety Requirements applicable to Flight Procedure Design domain



VFR or Visually

Airspace

SR_DEP_CTRL#1 & SR_DEP_UNCTRL#1: The flight procedure design shall, as far as practicable, ensure

strategic separation between PinS departure procedures and between PinS departure and other

procedures considering navigation performance and airspace constraints (sector size, other

trajectories in the vicinity, restricted areas…)…

FPD VFR & Visually Controlled & uncontrolled

Strategic separation with other routes and procedures will reduce the risk of collision with other

IFR traffic, particularly in uncontrolled airspace.


Generic Safety Case




VFR or Visually

Airspace

SR_DEP_CTRL#2: The flight procedure design shall take into account ATC constraints such as

separation minima, traffic density, sector size and controller procedures / HMI

FPD VFR & Visually Controlled No specific guidance

SR_DEP_CTRL#6 & SR_DEP_UNCTRL#4: The aeronautical, terrain and obstacle data used in the design of the helicopter PinS departure procedure

shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality

of aeronautical data/information.


To proceed visually departure, compliance with ICAO Annex 14 vol II implies that there are enough up-to-

date obstacle data available within the area of interest (Obstacle Limitation Surfaces). At least

information on every obstacle penetrating the OLS should be collected and made available to the procedure designer and AIS provider. This may require additional obstacle surveys at periodic

intervals, especially at those heliports in Area 1, as defined in Annex 15 (State area), where only

obstacles higher than 100 m above ground level are considered hazardous for air operations and

therefore collected. From ICAO Annex 14 Vol II: “It should be noted that identifying obstacle limitation surfaces, in itself does not protect the surfaces; in most cases a state would need to enact some form of regulation restricting the

limits of heights of objects, whether it be natural growth or buildings and/or structures”.

SR_DEP_CTRL#7 & SR_DEP_UNCTRL#5: The PinS departure procedure (i.e. visual segment when

applicable, instrument segment) shall be designed in accordance with ICAO PANS OPS criteria relative

to PinS procedure.


No specific guidance

SR_DEP_CTRL#8 & SR_DEP_UNCTRL#6: The verification and validation of the PinS departure procedure shall be made in accordance with the

quality process specified in ICAO Doc 9906.




Generic Safety Case




VFR or Visually

Airspace

SR_DEP_CTRL#14 & SR_DEP_UNCTRL#12: The procedure designer shall depict the relevant

obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart.




SR_DEP_CTRL#15 & SR_DEP_UNCTRL#13: The procedure designer shall depict, on the PinS

“proceed VFR” chart, the relevant obstacles in the vicinity of the heliport or departure location.

FPD Proceed VFR Controlled & uncontrolled

The obstacle depiction on the PinS “proceed VFR” chart could not be exhaustive as no obstacle identification is mandatory for proceed VFR.

SR_DEP_CTRL#29 & SR_DEP_UNCTRL#24: The PinS departure chart shall specify the QNH source (local

or remote). FPD VFR & Visually


The QNH source could be provided either by: an

aeronautical meteorological service compliant with ICAO Annex 3 at destination or, an equivalent

meteorological service with approval from local Competent Authority or, an aeronautical

meteorological service compliant with ICAO Annex 3 at neighboring airport with approval from local

Competent Authority. See requirements relating to MET service provision

(E.4)

SR_DEP_CTRL#30 & SR_DEP_UNCTRL#25: The flight procedure designer shall take into account

appropriate margins when using remote QNH, as defined in PANS OPS.



SR_DEP_CTRL#34 & SR_DEP_UNCTRL#26: The flight procedure design shall take into account the

transition between PinS departure and the low level route or other existing routes/SID/STAR (RNP

values, altitudes, speed constraints, waypoints).



SR_DEP_CTRL#38 & SR_DEP_UNCTRL#32: The procedure designer shall be provided with data relating to prohibited and restricted areas in the

vicinity of the heliport / departure location.




Generic Safety Case




VFR or Visually

Airspace

SR_DEP_CTRL#39 & SR_DEP_UNCTRL#33: The procedure designer shall, as far as practicable, ensure strategic separation between the PinS

departure andprohibited and restricted areas in the vicinity of the heliport / departure location.


Strategic separation with restricted/prohibited areas is not always possible. In this case, coordination procedures are implemented between ATSP and

operator regarding the activation/de-activation of prohibited/restricted airspace (see ASS_DEP_CTRL#26

in section G.5).

SR_DEP_CTRL#40 & SR_DEP_UNCTRL#34: The PinS departure chart shall clearly indicate the

prohibited/restricted areas in the vicinity of the route.



Table E-2: Safety Requirements applicable to Flight Procedure Design domain

E.3 Safety Requirements applicable to AIS domain



VFR or Visually

Airspace

SR_DEP_CTRL#9 & SR_DEP_UNCTRL#7: The PinS departure procedure shall be published in the state

AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate the required aircraft navigation capability to fly the procedure (e.g. RNP1 or

RNP0.3).

AIS VFR & Visually Controlled & uncontrolled


SR_DEP_CTRL#10 & SR_DEP_UNCTRL#8: The AIS provider shall define the naming and phraseology associated with the PinS departure in accordance

with ICAO rule to ensure consistency between operator (FMS, phraseology) and ATS

(Phraseology).


The definition of clear naming and phraseology to be used between ATS and helicopters should

significantly reduce the risk of misunderstanding between air and ground but also between

helicopters.


Generic Safety Case




VFR or Visually

Airspace

SR_DEP_CTRL#11 & SR_DEP_UNCTRL#9: The AIS provider shall inform airspace users (e.g. through

AIC) about the implementation of a PinS departure and the possible increase of IFR traffic in the the



This information should be performed through an Aeronautical Information Circular, in addition to the publication of the new procedures and charts in the

AIP.

SR_DEP_CTRL#12 & SR_DEP_UNCTRL#10: The promulgation of PinS departure procedure shall

comply with the appropriate data quality requirements of ICAO Annex 15 and respect the

European Regulation N°73/2010 on the quality of aeronautical data/information.



SR_DEP_CTRL#38 & SR_DEP_UNCTRL#32: The procedure designer shall be provided with data relating to prohibited and restricted areas in the




SR_DEP_CTRL#40 & SR_DEP_UNCTRL#34: The PinS departure chart shall clearly indicate the

prohibited/restricted areas in the vicinity of the route.



SR_DEP_CTRL#48 & SR_DEP_UNCTRL#41: The AIS provider shall verify the consistency between the

PinS procedure validated by procedure design and the proposal to be published.



SR_DEP_CTRL#54 & SR_DEP_UNCTRL#44: The PinS departure shall be clearly depicted on VFR charts to

inform pilots of helicopter traffic in this area. AIS VFR & Visually



SR_DEP_UNCTRL#3: The AIS shall publish in the AIP the operational PinS usage restrictions if any.

AIS VFR & Visually Uncontrolled

Specific PinS usage restrictions (e.g. use of the new procedures limited to certain operators or limited to

certain periods of time) could be defined in uncontrolled airspace to limit the risk of collision

between traffic. If such restrictions are defined they need to be

published in the AIP.


Generic Safety Case


Table E-3: Safety Requirements applicable to AIS domain

E.4 Safety Requirements applicable to MET domain



VFR or Visually

Airspace

SR_DEP_CTRL#41 & SR_DEP_UNCTRL#35: Local MET information at the departure

heliport/departure location shall be provided to the ATCO/AFISO and helicopter operator. This local MET information can be provided either by: an

aeronautical meteorological service compliant with ICAO Annex 3 at destination or, an equivalent

meteorological service with approval from local Competent Authority or, an aeronautical

meteorological service compliant with ICAO Annex 3 at neighboring airport with approval from local

Competent Authority.

MET provider

VFR & Visually Controlled & uncontrolled

Meteorological Information provided by equivalent meteorological service need to be validated/tested in

order to show an acceptable level of MET data integrity, accuracy and reliability for the type of

operation conducted.

SR_DEP_CTRL#42 & SR_DEP_UNCTRL#36: Local MET information shall include at the minimum the following information: visibility, ceiling and QNH.

MET provider



Table E-4: Safety Requirements applicable to MET domain


Generic Safety Case


E.5 Safety Requirements applicable to ATS domain



VFR or Visually

Airspace

SR_DEP_CTRL#5: The ATC controller shall give a PinS take-off and departure clearance to the flight crew, prior to departure, when flying a “proceed

visually” departure procedure.


Controlled

The Air Traffic Controller’s procedures and phraseology should remain unchanged if PinS

departure are already implemented in the operational environment.

The ATS provider should update ATC procedure and phraseology to provide the IFR departure clearance

prior to departure for PinS “proceed visually” departure, as required in ICAO 8168 Vol I.

ATCO should be informed through ATSP briefing that

aircraft are flying under Instrument Flight Rules during the visual segment of a PinS “proceed visually”

departure.

SR_DEP_CTRL#16 : The ATC controller shall give appropriate speed and altitude instructions to the flight crews if needed to facilicate the transition

between the visual flight phase and the instrument flight phase (i.e. to facilitate the compliance with

published altitude or speed constraints).

ATSP VFR & Visually Controlled

The ATSP should be briefed on the level and speed constraints associated to the PinS departure

procedure in order to be able to provide appropriate instructions to the flight crew.

SR_DEP_CTRL#21:The ATC controller shall give a PinS departure clearance to the flight crew at or

prior to the IDF, when flying a “Proceed VFR” departure procedure.

ATSP Proceed VFR Controlled


departure are already implemented in the operational environment.

The ATS provider should update ATC procedure and

phraseology to provide the IFR departure clearance at or prior to the IDF for PinS “proceed VFR” departure,

as required in ICAO 8168 Vol I. The ATCO should be informed that aircraft are flying


Generic Safety Case




VFR or Visually

Airspace

under Visual Flight Rules during the visual segment of a PinS “proceed VFR” departure.

SR_DEP_CTRL#28: The ATC controller shall provide the QNH information to the Flight Crew for the

helicopter PinS departure. ATSP VFR & Visually Controlled

The QNH can be either a local QNH provided by a local MET service or appropriate equipement

approved by competent local authority or a remote QNH provided by a remote MET service.

SR_DEP_CTRL#31: The State / ANSP shall define a departure site indicator/identifier allocation

scheme for any departure site without an ICAO code.

ATSP VFR & Visually Controlled The indicator or identifier should be a 4 digit code to be defined and approved locally.

SR_DEP_CTRL#33: The local ATS or Network Manager shall be able to validate the helicopter flight plan including PinS departure procedure.

ATSP/NM VFR & Visually Controlled

The ATSP or Network Manager should confirm the ability to validate the flight plan including PinS

departure procedure, particularly if the departure location has a “local” code (departure site

indicator/identifier).

SR_DEP_CTRL#35: The ATC controller shall give appropriate clearance (speed and altitude) if

needed to facilitate the transition between the PinS departure and the low level route or other existing routes/SID/STAR (i.e. to facilitate the compliance

with published altitude or speed constraints).

ATSP VFR & Visually Controlled No specific guidance


Generic Safety Case




VFR or Visually

Airspace

SR_DEP_CTRL#51: The ATC controllers shall be briefed on the RNAV navigation and on helicopter

PinS departure procedure. ATSP VFR & Visually Controlled

Briefing of the ATCO should include a generic presentation of the PinS departure procedure. In

particular it should highlight the transition between VFR and IFR for PinS proceed VFR procedure. In addition, this briefing should highlight the

specificites of the local PinS procedure (strategic separation or not with adjacent routes and

procedures, strategic separation or not with prohibited/restricted areas, altitude constraints

published on the procedure…).

SR_DEP_CTRL#52: In radar environment, the PinS departure procedure shall be displayed, on

demand, on the controller working position to facilitate the detection of deviation from the expected trajectory and the recognition of a

potential conflict.


The ATSP should perform adaptation/modification of the ATC supporting tool to be able to display the

trajectory of the new PinS procedure. No additional radar coverage should be required. It

should be assumed that no unknown conflicting traffic is flying below the radar. VFR departures and PinS departures will be known to ATC in controlled

airspace: they are required to receive a clearance and PINs departures are to provide an ETD before take-

off.

SR_DEP_CTRL#53: In radar environment, the radar display shall provide an adequate traffic picture to depict IFR aircraft and VFR aircraft equipped with

transponder on the PinS departure and in the vicinity of the PinS procedure.





airspace: they are required to receive a clearance and PINs departures are to provide an ETD before take-

off.


Generic Safety Case




VFR or Visually

Airspace

SR_DEP_UNCTRL#2: ATSPs shall ensure coordination between entities (e.g. FIS, ATCO, AFIS, heliport/departure site…) for the operational use of

the PinS departure.

ATSP VFR & Visually Uncontrolled

In uncontrolled airspace, even if no control service is provided by the ATSP, ATSP should be in charge to coordinate and inform the different stakeholders

about the implementation of the new Pins departure.

SR_DEP_UNCTRL#23: Wherever applicable, AFISO or departure site operator shall provide the local

QNH information to the Flight Crew for the helicopter PinS departure.

AFISO VFR & Visually Uncontrolled In uncontrolled airspace with AFIS, AFISO should

provide this information to the flight crew.

SR_DEP_UNCTRL#31: A Radio Mandatory Zone (RMZ) shall be defined around the PinS departure in order to maintain continuous air-ground voice

communication watch and establish two-way communication, as necessary, on the appropriate communication channel, unless it is shown that

mitigating the risk of conflict between IFR and VFR is not required considering the airspace structure, traffic density, traffic complexity and the current level of safety associated to aircraft operations in

this airspace.


-It is considered in uncontrolled airspace that RMZ is required from a safety point of view considering a

generic operational environment (medium complexity of the airspace, different airspace users sharing this

airspace and medium traffic density). -The RMZ will allow each helicopter pilots to inform any other aircraft flying in the vicinity of the route

about their position and intent in a more efficient and systematic way.

-Communication is an essential element to enhance the see and avoid in uncontrolled airspace

-The ATSP and the different airspace users could demonstrate to their Competent Authority that RMZ is not needed for their local environment (risk-based approach associated to IFR/VFR conflict). The safety target could be set as the same level of safety than current air operations in this class G airspace where

PinS procedures will be implemented.

Table E-5: Safety Requirements applicable to ATS domain


Generic Safety Case


E.6 Safety Requirements applicable to heliport/departure site domain



VFR or Visually

Airspace

SR_DEP_UNCTRL#23: Wherever available, AFISO or landing site operator shall provide the local QNH information to the Flight Crew for the helicopter

PinS departure.

Heliport operator

VFR & Visually Uncontrolled

This requirement is applicable to the heliport/departure site operator, only in the absence

of AFISO. Otherwise, the local QNH information is provided by the AFISO.

SR_DEP_CTRL#55 & SR_DEP_UNCTRL#46: The heliport or landing location where PinS departure

“proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14

Vol II applicable to non-instrument heliport (physical characteristics, obstacle environment,

visual aids,..)..

Heliport operator

Proceed Visually


PinS “proceed visually” departures are developed for non-instrument heliport compliant with ICAO Annex

14 Volume II (physical characteristics, obstacle environment, visual aids,..). This means that

compliance with appendix 2 of ICAO Annex 14 relating to instrument heliport is not requested.

SR_DEP_CTRL#56 & SR_DEP_UNCTRL#47: The heliport or landing location where PinS departure

“proceed VFR” are performed shall not require any additional requirements compared to VFR

departure conducted on this heliport/landing location (physical characteristics, obstacle

environment, visual aids,..).

Heliport operator

Proceed VFR Controlled & uncontrolled

PinS “proceed VFR” departures are developed for non-instrument heliport/landing location which are

compliant or not with ICAO Annex 14 Volume II. Implementation of a PinS “proceed VFR” departure within an existing heliport/landing location already

used for VFR departure does not lead to new requirements (physical characteristics, obstacle

environment, visual aids,..)

Table E-6: Safety Requirements applicable to heliport domain

E.7 Safety Requirements applicable to helicopter domain



VFR or Visually

Airspace

SR_DEP_CTRL#3: The flight crew shall request to the controller the PinS take-off and departure clearance, prior to departure, when flying a

“proceed visually” departure procedure. Helicopter

Proceed visually

Controlled No specific guidance


Generic Safety Case




VFR or Visually

Airspace

SR_DEP_CTRL#4: The flight crew shall coordinate with ATC, before take off, about the Estimated Time of Departure (ETD) when flying a “proceed

VFR” departure procedure. Helicopter Proceed VFR Controlled No specific guidance

SR_DEP_CTRL#13 & SR_DEP_UNCTRL#11: The flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS

“proceed visually” departure chart. For proceed visually with direct segment, lateral and vertical path are indicated on the chart.




SR_DEP_CTRL#17 & SR_DEP_UNCTRL#14: The helicopter operator shall determine the operating minima applicable for the PinS departure

operations in accordance with AIR OPS.

Helicopter operator



SR_DEP_CTRL#18 & SR_DEP_UNCTRL#15: The flight crew shall monitor if the visual references are maintained during visual flight phase until

reaching the IDF at or above IDF MCA. Helicopter VFR & Visually



SR_DEP_CTRL#19 & SR_DEP_UNCTRL#16: The flight crew shall perform transition to instrument segment when reaching the IDF at or above the

IDF MCA. Helicopter VFR & Visually



SR_DEP_CTRL#20: The flight crew shall request to Controller the PinS departure clearance at or prior the IDF, when flying a “proceed VFR”

departure procedure. Helicopter Proceed VFR Controlled No specific guidance

SR_DEP_CTRL#22 & SR_DEP_UNCTRL#17: The helicopter’s operator shall define a contingency procedure for the case of degradation of visibility conditions leading to a loss of the required visual reference, during the

visual segment of a PinS departure.

Helicopter operator

Visually Controlled & uncontrolled



Generic Safety Case




VFR or Visually

Airspace

SR_DEP_CTRL#23 & SR_DEP_UNCTRL#18: In case of loss of the required visual reference before reaching the IDF, the flight crew shall respect the

helicopter operator’s contingency procedures and inform the controller as soon as possible.

Helicopter VFR & Visually Controlled & uncontrolled


SR_DEP_CTRL#25 & SR_DEP_UNCTRL#20: The flight crew shall not modify the PinS procedure stored in the navigation database as defined in AIR

OPS. Helicopter VFR & Visually



SR_DEP_CTRL#26 & SR_DEP_UNCTRL#21: The flight crew shall select the PinS departure procedure in the RNAV system’s flight plan.



SR_DEP_CTRL#27 & SR_DEP_UNCTRL#22: The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument

segment of the PinS departure procedure. Helicopter VFR & Visually



SR_DEP_CTRL#32: If not exempted, the Helicopter Operator shall submit the flight plan to the Network Manager including the PinS departure.

Helicopter VFR & Visually Controlled No specific guidance

SR_DEP_CTRL#36: The flight crew shall comply with constraints published on the flight procedure and with the ATCO clearance relating to the

transition between the Pins departure and the low level route (or other existing routes/SID/STAR).


SR_DEP_CTRL#37 & SR_DEP_UNCTRL#27: The Flight Control and Display sub-system shall display an appropriate full scale deflection during the

transition between the PinS departure and the low level route (or other existing routes/SID/STAR/approach) to avoid disturbance of the flight

crew.



SR_DEP_CTRL#43 & SR_DEP_UNCTRL#37: The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on

the PinS departure and considering the local environment.

Helicopter operator




Generic Safety Case




VFR or Visually

Airspace

SR_DEP_CTRL#44 & SR_DEP_UNCTRL#38: In case of loss of RNP capability on the PinS departure procedure, the flight crew shall respect the helicopter operator’s contingency procedures (e.g. conventional

navigation or dead reckoning).



SR_DEP_CTRL#45: The flight crew shall inform controller about the loss of RNP capability on the PinS departure procedure and about the

contingency procedure. Helicopter VFR & Visually Controlled No specific guidance

SR_DEP_CTRL#46 & SR_DEP_UNCTRL#39: The helicopter operator shall define a contingency procedure adapted to the operational environment

in case of icing conditions encountered on the PinS departure.

Helicopter operator



SR_DEP_CTRL#47 & SR_DEP_UNCTRL#40: In case of icing conditions on the PinS departure procedure, flight crews shall respect the helicopter

operator’s contingency procedures. Helicopter VFR & Visually



SR_DEP_CTRL#49 & SR_DEP_UNCTRL#42: The flight crew shall verify the consistency between the PinS departure procedure on the chart and the

aircraft display (FPLN, ND…). Helicopter VFR & Visually



SR_DEP_CTRL#50 & SR_DEP_UNCTRL#43: The flight crew shall be trained on RNAV navigation, PinS departure procedure and associated contingency

procedures. Helicopter VFR & Visually



SR_DEP_UNCTRL#28: The flight crew shall comply with constraints published on the flight procedure relating to transition between the Pins

departure and the low level route (or other existing routes/SID/STAR). Helicopter VFR & Visually Uncontrolled No specific guidance


Generic Safety Case




VFR or Visually

Airspace

SR_DEP_UNCTRL#29: The flight crew established on the PinS departure shall transmit regularly their position and flight intent to inform other

helicopters operating on the PinS departure and other aircraft flying in the vicinity of the PinS departure.

Helicopter VFR & Visually Uncontrolled No specific guidance

SR_DEP_UNCTRL#30: VFR or IFR pilots flying in the vicinity of the PinS departure shall transmit regularly their position and flight intent to inform

helicopters established on the PinS departure.

Other traffic

VFR & Visually Uncontrolled No specific guidance

SR_DEP_UNCTRL#45: IFR helicopter flying the PinS departure in uncontrolled airspace shall be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this route

(i.e. a traffic advisory system), unless it is shown that mitigating the risk of conflict with VFR and IFR is not required considering the airspace structure

and the traffic density and complexity.

Helicopter VFR & Visually Uncontrolled

It is considered in uncontrolled airspace that Traffic Advisory System or similar/equivalent system is required from a safety point of view considering a generic operational environment (medium complexity of the airspace, different

airspace users sharing this airspace and medium traffic density).

This system should allow to mitigate the risk of IFR/IFR collision in IMC conditions (reduced

effectiveness of see and avoid in IMC conditions).

The Traffic Advisory System or similar/equivalent system will support the situational awareness of the traffic in the

vicinity of the PinS. The ATSP and the different airspace users

could demonstrate to their Competent Authority that the system enhancing the see

and avoid is not needed for the local environment (risk-based approach regarding

IFR/VFR collision risk).

Table E-7: Safety Requirements applicable to helicopter domain


Generic Safety Case


ANNEX F – Recommendations from the generic safety case

The following sections present the recommendations identified within the generic PinS safety case (Part I) when performing the generic safety assessment. The recommendations identified in the generic safety case only relate to helicopter domain (section F.7) and ATSP domain (section F.5).

F.1 Safety Recommendations applicable to GNSS domain

No safety recommendation applicable to the GNSS domain is identified in the generic PinS safety case (Part I).

F.2 Safety Recommendations applicable to Flight Procedure Design domain

No safety recommendation applicable to the Flight Procedure Design domain is identified in the generic PinS safety case (Part I).

F.3 Safety Recommendations applicable to AIS domain

No safety recommendation applicable to the AIS domain is identified in the generic PinS safety case (Part I).

F.4 Safety Recommendations applicable to MET domain

No safety recommendation applicable to the MET domain is identified in the generic PinS safety case (Part I).

F.5 Safety Recommendations applicable to ATS domain

SAFETY RECOMMENDATION APPLICABILITY

GUIDANCE FOR IMPLEMENTATION Domain VFR or Visually Airspace

REC_DEP_CTRL#5: The State / ANSP should ensure consistency between States regarding the local

heliport / landing site indicator/identifier allocation scheme (e.g. standardization at ICAO level).


Table F-1: Safety Recommendations applicable to ATS domain

F.6 Safety Recommendations applicable to heliport domain

No safety recommendation applicable to the AID domain is identified in the generic PinS safety case (Part I).


Generic Safety Case


F.7 Safety Recommendations applicable to helicopter domain



REC_DEP_CTRL#1 & REC_DEP_UNCTRL#1: Helicopters conducting PinS departure procedures in controlled or uncontrolled airspace should be operated with means

to provide relevant weather updates.


Helicopters should be equipped with airborne weather radar or on-board Electronic Flight Bag (EFB)

weather information application or equivalent system.The use of Electronic Flight Bags for the

provision of real time weather information should reduce the risk in bad weather conditions.

REC_DEP_CTRL#2 & REC_DEP_UNCTRL#2: All aircraft operating in the vicinity of the PinS departure should

be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) device.

Other traffic


The SSR transponder or Electronic Conspicuity device would allow the detection of the aircraft by a Traffic

Advisory System or similar/equivalent system. The need of such system should be assessed locally

depending on local traffic density and airspace complexity.

REC_DEP_CTRL#3: IFR helicopter flying the PinS departure should be equipped with a system

enhancing the see and avoid by providing situational awareness of the traffic on this route (i.e. a traffic

advisory system).

Helicopter VFR & Visually Controlled

It is considered that Traffic Advisory System or similar/equivalent system is recommended from a

safety point of view considering a generic operational environment (medium complexity of the airspace, different airspace users sharing this airspace and

medium traffic density) to mitigate the risk of mid-air collision.

The Traffic Advisory System or similar/equivalent system will support the situational awareness of the

traffic in the vicinity of the PinS. The need of such a system should be assessed locally


REC_DEP_CTRL#4 & REC_DEP_UNCTRL#3: Helicopters flying the PinS departure should be equipped with

HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacles database should be kept up to date .

Other traffic


HTAWS system will mitigate the risk of collision with terrain and obstacles. The need of such a system

should be assessed depending on local environment and procedure design.

Table F-2: Safety Recommendations applicable to helicopter domain


Generic Safety Case


ANNEX G – Assumptions from the generic safety case

The complete list of assumptions considered during the generic safety case is presented in section 10of generic PinS safety case (Part I). The following sections present the assumptions identified as needing local verification within the generic PinS safety case (Part I). These assumptions are identified per domain. The assumptions identified in the generic safety case only relate to AIS domain (section G.3) and ATS domain (section G.5).

G.1 Assumptions applicable to GNSS domain

No specific assumption to be verified locally and applicable to the GNSS domain is identified in the generic PinS safety case (Part I).

G.2 Assumptions applicable to Flight Procedure Design domain

No specific assumption to be verified locally and applicable to the Flight Procedure Design domain is identified in the generic PinS safety case (Part I).

G.3 Assumptions applicable to AIS domain

ASSUMPTION APPLICABILITY

GUIDANCE FOR VERIFICATION Domain VFR or Visually Airspace

ASS_DEP_CTRL#27 & ASS_DEP_UNCTRL#16: The AIP defines local contingency procedure to be applied by

flight crew in case of radio communication failure. AIS VFR & Visually



Table G-1: Assumption applicable to AIS domain

G.4 Assumptions applicable to MET domain

No specific assumption to be verified locally and applicable to the MET domain is identified in the generic PinS safety case (Part I).


Generic Safety Case


G.5 Assumptions applicable to ATS domain



ASS_DEP_CTRL#26: Coordination procedures are implemented between the ATSP and operator

regarding the activation/de-activation of prohibited/restricted airspace.


Table G-2: Assumption applicable to ATS domain

G.6 Assumptions applicable to heliport domain

No specific assumption to be verified locally and applicable to the heliport domain is identified in the generic PinS safety case (Part I).

G.7 Assumptions applicable to helicopter domain

No specific assumption to be verified locally and applicable to the helicopter domain is identified in the generic PinS safety case (Part I).


Generic Safety Case


Part III —

Safety Case Guidance Material for local deployment of Helicopter Point in Space

approach operations in controlled and uncontrolled

airspace


Generic Safety Case


16 Helicopter PinS approach operations

The Point-in-Space (PinS) concept is a flight operation based on GNSS and designed for helicopters only. It relies on the possibility for the pilot to conduct flight under Instrument Meteorological Conditions (IMC) to/from a Point-in-Space (PinS) and not directly to/from the heliport. Those procedures enable to implement IFR procedures on non-instrument FATO (Final Approach and Take-Off) located on aerodromes or isolated heliports as well as landing locations.

Two kinds of PinS operations are possible: PinS departure operations and PinS approach operations and the scope of this document is the PinS approach operations.

PinS approach operations can be summarized as follows:

The pilot conducts flight under Instrument Flight Rules (IFR) from the Initial Approach Fix (IAF) to a Point-in-Space (PinS), which is considered as a missed approach point (MAPt). This part of the operation is the instrument flight phase.

Then, o if appropriate visual references are obtained, the pilot proceeds using visual

references from the PinS to the FATO. This part of the operation is the visual flight phase;

o if appropriate visual references are not obtained, the pilot performs an instrument missed approach procedure. This operation is part the instrument flight phase.

Two types of visual flight phase are possible for the PinS approach:

PinS “proceed visually” approach

PinS “proceed VFR” approach

More details about PinS approach operations can be found in PinS safety case report (Part I).


Generic Safety Case


17 Objective of the Safety Case Guidance Material for deployment of PinS approach operations

The main objective of this safety Case Guidance Material is to help the Project Owners to develop their own local safety case for the deployment of helicopter PinS approach operations in their operational environment.

This document will help the Project Owner to provide assurance, with sufficient confidence, that the PinS approach operations will be safe and will remain safe during the PinS approach service life.

The deployment of helicopter PinS approach operations is a multi-actor change and therefore requires coordination between different service providers (air traffic service provider, aeronautical information service provider, navigation service provider…), heliport/landing site operator and helicopter operators affected by the change due to the presence of dependencies between them. This coordination is essential to ensure a safe deployment due to these dependencies. The Project Owner is the actor who should coordinate and prepare the PinS deployment safety case.

Note: The Project Owner could be:

In controlled airspace, the Air Traffic Service Provider

In uncontrolled airspace, the Air Traffic Service Provider, the heliport/landing site operator or the helicopter operator

The interaction with the Competent Authorities for the review of such deployment is not detailed in this Guidance Material and should follow the current regulation and process in place.

This Safety Case Guidance Material for deployment explains how the Project Owners could use the output from the EUROCONTROL Helicopter PinS generic safety case report (Part I) to develop their local safety case. More details about the origin of the safety requirements could be found in the PinS generic safety case report (Part I).

This Guidance Material is structured around a safety argument and includes the following sections:

Section 18 introduces what is a safety argument and present the PinS approach safety argument

Section 19 presents guidance for the activity that the Project Owner should perform, based on the output of the generic safety case report, to provide the safety assurance associated to the safety argument

ANNEX I – , ANNEX J – ANNEX K – present the main output of the generic safety case (i.e. safety requirements, safety recommendations and assumptions), that should be used by the Project Owner when developing the local safety case.

Note: This document is a guidance describing the activities to be conducted, it is not a template of local safety case for PinS approach. The Project Owner should conduct the safety activities listed in this document based on the guidance listed in section 19 and should develop the local safety case presenting the results of these activities.


Generic Safety Case


18 Safety Argument

18.1 Introduction to safety argument

A safety argument is a statement (or a set of statements) that is used to assert that the service/system/operation is safe. It is a way to present a structured argumentation and to demonstrate the exhaustiveness of this argumentation. More details can be found in [RD 42].

A safety argument is composed of the following elements:

- A Claim, i.e. what we want to demonstrate through the safety argument. The claim is presented at the top of the safety argument. It is generally formulated as a sentence like “Deployment of operation/system is acceptably safe”

- A Safety Criteria. The safety criteria is the criteria that will be used to demonstrate that the claim is satisfied, it defines what mean acceptably safe for a given operation / system.

- Sub arguments. The claim is decomposed in sub-arguments. The objective of this break down is to provide an exhaustive argumentation that the claim is satisfied. The break down in sub-arguments can be performed per domain, per phase of the lifecycle (i.e. specification, development, implementation…)…

- Safety Assurance / Safety Evidence. Safety Assurance are evidence (i.e. specification document, design document, test document…) that a sub-argument has been correctly implemented. It should be provided in front of each sub-argument.

The following figure presents an illustration of a typical safety argument presented using Goal-Structuring Notation (GSN) :

Safety CriteriaE.g. Acceptably safe is defined as a

reduction of the number of mid-air collision with introduction of system XX

Sub-argument Arg 1E.g. System XX is specified to ensure that operation will be

acceptably safe

Sub-argument Arg 2E.g. System XX is implemented to

ensure safe operation

Sub-argument Arg 3E.g. Transition between current

system and system XX is acceptably safe

Arg 0 (Claim)E.g. Deployment of system XX is

acceptably safe

EvidenceE.g. Safety

Case section AA

Sub-argument Arg 4E.g. On going operation with system XX remain acceptably

safe during the service life

EvidenceE.g. Safety

Case section BB

EvidenceE.g. Safety

Case section CC

EvidenceE.g. Safety

Case section DD

Figure18-1: Exemple of a typical safety Argument

The PinS generic safety case and the present document are structured around a safety argument. Section 18.2 presents the proposed safety argument for deployment of PinS approach operations. Section 19 provides guidance on activities to be conducted by the different actors to develop safety evidence associated to each sub-argument.


Generic Safety Case


18.2 Safety argument for deployment of PinS approach operations

The following figure presents the safety argument for the demonstration that the deployment of PinS approach operations are safe.

The claim of this safety argument is that “Local deployment of helicopter PinS operations will be acceptably safe”

The break down in sub-arguments is performed around two aspects:

- First break down is per lifecycle phase (specification/design, implementation…) in order to cover all the Pins approach service life

- Second break down is per actor involved in the deployment of the PinS approach operations (ATSP, GNSS service provider…)

This safety argument does not only address the possible failure that could occur when operating PinS procedures (i.e. failure case) but also the PinS approach operations when performing as intended (i.e. the success case). Many of the activities recommended in this guidance material have the objective to demonstrate that the PinS approach operations will be safe in normal operations and that they will provide the expected benefits in comparison to current approach operations in VFR.


Generic Safety Case


Safety Criteria Acceptably safe is defined by No negative impact on the current level of safety in

the airspace class where PinS is implemented Safer than or at least as safe as current approach

helicopter operations conducted in VFR

Sub-argument for specificationHelicopter PinS approach operation have been specified and designed locally to be acceptably

safe

Overall argument (i.e. Claim)Deployment of PinS approach operation will

be acceptably safe

Sub-argument for implementationHelicopter PinS approach operation are implemented

locally to be acceptably safe

Sub-argument for transition to operationTransition from current VFR operation to PinS approach

operations are acceptably safe

See Guidance in section 19.5

Sub-argument for operationHelicopter PinS approach operation will be acceptably

safe through its service life

Sub-argument for specification of GNSSGNSS is specified and designed to support local

safe PinS approach operation


Sub-argument for specification of FPDInstrument Flight Procedure is specified and designed to support local safe PinS approach

operation


Sub-argument for specification of AISAeronautical Information Service is specified and

designed to support local safe Pins approach operation


Sub-argument for specification of METMET service is specified and designed to support

local safe Pins approach operation


Sub-argument for specification of ATSAir Traffic Service is specified and designed to

support local safe Pins approach operation


Sub-argument for specification of helicopterHelicopter operations are specified and designed

to support local safe Pins approach operation


Sub-argument for implementation of GNSSGNSS is implemented to support local safe PinS

approach operation


Sub-argument for implementation of FPDInstrument Flight Procedure is implemented to

support local safe PinS approach operation


Sub-argument for implementation of AISAeronautical Information Service is implemented

to support local safe Pins approach operation


Sub-argument for implementation of METMET service is implemented to support local safe

Pins approach operation


Sub-argument for implementation of ATSAir Traffic Service is implemented to support local

safe Pins approach operation


Sub-argument for implementation of helicopterHelicopter operations are implemented to support



Sub-argument for operation of GNSSGNSS performances continues to be suitable to

support local safe PinS approach operation


Sub-argument for maintenance of FPDModification of Instrument Flight Procedure are

safely managed during PinS service life


Sub-argument for operation of AISAeronautical Information Service continues to



Sub-argument for operation of METMET service continues to support local safe Pins

approach operation


Sub-argument for operation of ATSAir Traffic Service continues to support local safe



Sub-argument for operation of helicopterHelicopter operations continue to support local

safe Pins approach operation


Sub-argument for specification of heliportHeliport operations are specified and designed to



Sub-argument for implementation of heliportHeliport operations are implemented to support



Sub-argument for operation of heliportHeliport operations continue to support local safe



Sub-argument for completeness and correctness of specification

Specification is complete and correct to support local safe Pins approach operation


Figure18-2: Safety argument for PinS approach operations


Generic Safety Case


As illustrated on the figure above, and in accordance with the generic PinS safety case (Part I), the following safety criteria are considered in this safety argument:

No negative impact on the current level of safety in the airspace class where PinS is implemented which is associated to the risk of Mid-air Collision (MAC)

Safer (or at least as safe) than current helicopter operations conducted in VFR only which is associated to the risk of Controlled Flight Into Terrain (CFIT) and Loss of Control Inflight (LOC-I)

As this document is a guidance material, the Figure18-2 above does not presents the safety assurance associated to each sub-argument but Section 19 provides guidance on the activities that the Project Owner should perform to develop the safety assurance associated to the different sub-arguments, more particularly:

Section 19.3 details the activities to be conducted to develop the safety assurance demonstrating the safe specification of PinS approach operations

Section 19.4 details the activities to be conducted to develop the safety assurance demonstrating the safe implementation of PinS approach operations

Section 19.5 details the activities to be conducted to develop the safety assurance demonstrating the safe transition to service of PinS approach operations

Section 19.6 details the activities to be conducted to develop the safety assurance demonstrating the safe operation of PinS approach operations

The Project Owner should perform or verify all these activities in order to develop a complete local safety case.

Note: This does not mean that the Project Owner is responsible for all domains but that the Project Owner has at least the guarantee that when Helicopter PinS approach will be deployed all of these domains have been addressed from a safety point of view.


Generic Safety Case


19 Guidance material for development of local safety case for deployment of helicopter PinS approach operations

19.1 Guidance for verification of operational environment to implement the PinS approach operations

The Project Owner shall verify that the operational environment (OE) described in the table below is relevant for its local implementation. This will permit to verify whether this Safety Case Guidance Material is applicable.

Ref Description

OE#1 PinS approach is an RNP APCH (LPV or LNAV) flight procedure

OE#2 PinS approach is within controlled (airspace class C or D) and/or uncontrolled airspace (airspace class G)15

OE#3 PinS approach is a PinS “proceed VFR” or a PinS “proceed visually”

OE#4 Visual segment of the PinS approach is a direct segment (not a manoeuvring segment) for a PinS proceed visually

OE#5 PinS approach is only for one heliport/landing site (not multi-destination)

OE#6 PinS approach are composed of straight segments (TF legs) and does not include in this current version of the generic safety case the RF leg

In case of a different operational environment, the guidance provided in this generic document might not be fully applicable and the Project Owner should assess the possible differences of the local environment based on the generic PinS safety case (Part I).

19.2 Guidance for verification of the applicability of the generic Safety Argument for helicopter PinS approach operations

The Project Owner shall verify that the Safety argument illustrated in paragraph 18.2 is applicable and acceptable for the local deployment of the helicopter PinS approach. This safety argument should be presented and accepted by the Competent Authority in accordance with the current regulation in place.

The Project Owner shall also verify that the local sharing of responsibility is consistent with the table below or shall adapt the safety argument accordingly:

15 A PinS approach completely inside airspace class E has not been considered. However, it is important to note that helicopter landing

sites located in airspace class G may be served by PinS approach starting or passing through airspace class E. In this case, the assumption made in this safety case is that the most demanding requirements (those derived from the airspace class G) apply throughout the procedure because these mitigations should anyway be put in place for the segment within airspace class G.


Generic Safety Case



Domain Actor

CNS / Navigation (GNSS) Pan European

EGNOS service provider.

SBAS is required for PinS approach with LPV minima (RNP APCH down to LPV minima)

Airspace / Procedure design Flight Procedure Design (FPD) service provider

Aeronautical Information Service

Aeronautical Information Service (AIS) provider

MET provision MET service provider

Air Traffic Service

(including Flight Information Service)

Air Traffic Service Provider (ATSP)

Heliport operations Heliport Operator

Helicopter operations &

certification

Helicopter Operator

Note: In the above table, the “Data provision” domain and the “Provider of data services” are not listed. It is assumed that aircraft certification (for the design of airborne navigation system) and aircraft operation will consider the use of approved aeronautical navigation databases. (EU) 2017/373 (Common Requirements for ATM/ANS service providers) mandates certification of DAT providers from 1st January 2019, the same date from which the aircraft operators shall use only certified DAT providers. The OPS regulation (EU) 965/2012 had been already updated consistently.

19.3 Guidance for development of safety assurance relating to local specifications and design of PinS approach operations

19.3.1 Guidance for specification of GNSS service

The Project Owner shall perform, in collaboration with the GNSS Service Provider, the following activities in order to define the local specification relating to GNSS for PinS approach operations:


SPEC_GNSS_01 Identification of the applicable Safety Requirements and Recommendations relating to GNSS, from the generic safety case

Generic safety requirements and recommendations applicable to PinS approach operations have been identified through a generic PinS safety case (Part I).


Generic Safety Case



Section ANNEX I – I.1 lists the requirements from the generic safety case relating to GNSS and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

No recommendation applicable to the GNSS has been identified in the generic PinS safety case.

SPEC_GNSS_02 Identification of the applicable assumptions relating to GNSS, from the generic safety case

No assumption applicable to the GNSS has been identified in the generic PinS safety case.

19.3.2 Guidance for specification of Flight Procedure Design

The Project Owner shall perform , in collaboration with the Flight Procedure Design Service Provider, the following activities in order to define the local specification relating to Flight Procedure Design for PinS approach operations:


SPEC_FPD_01 Identification of the applicable Safety Requirements and Recommendations relating to Flight Procedure Design, from the generic safety case


Section I.2 lists the requirements from the generic safety case relating to Flight Procedure Design service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

Section J.2 lists the recommendations relating to the Flight Procedure Design service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety recommendations, depending on the local environment.


Generic Safety Case



The Project Owner should then evaluate the relevance of each recommendation based on the local operations and environment. Guidance are provided in section J.2 to perform this evaluation.

SPEC_FPD_02 Identification of the applicable assumptions relating to Flight Procedure Design, from the generic safety case

No assumption applicable to the Flight Procedure Design service has been identified in the generic PinS safety case.

19.3.3 Guidance for specification of Aeronautical Information Service

The Project Owner shall perform , in collaboration with the Aeronautical Information Service Provider, the following activities in order to define the local specification relating to Aeronautical Information Service for PinS approach operations:


SPEC_AIS_01 Identification of the applicable Safety Requirements and Recommendations relating to Aeronautical Information Service, from the generic safety case


Section I.3 lists the requirements from the generic safety case relating to Aeronautical Information Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

No recommendation applicable to the Aeronautical Information Service has been identified in the generic PinS safety case.

SPEC_AIS_02 Identification of the applicable assumptions relating to Aeronautical Information Service, from the generic safety case


Section K.3 lists the assumptions from the generic safety case relating to Aeronautical Information Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable assumptions, depending on the local environment.


Generic Safety Case


19.3.4 Guidance for specification of MET service

The Project Owner shall perform , in collaboration with the Meteorological Service Provider, the following activities in order to define the local specification relating to Meteorological Service for PinS approach operations:


SPEC_MET_01 Identification of the applicable Safety Requirements and Recommendations relating to Meteorological Service, from the generic safety case

Generic safety requirements and recommendations applicable to PinS Approach operations have been identified through a generic PinS safety case (Part I).

Section I.4 lists the requirements from the generic safety case relating to Meteorological Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

No recommendation applicable to the Meteorological Service has been identified in the generic PinS safety case.

SPEC_MET_02 Identification of the applicable assumptions relating to Meteorological Service, from the generic safety case


Section K.4 lists the assumptions from the generic safety case relating to Meteorological Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable assumptions, depending on the local environment.

19.3.5 Guidance for specification of Air Traffic Service

The Project Owner shall perform , in collaboration with the Air Traffic Service Provider, the following activities in order to define the local specification relating to Air Traffic Services for PinS approach operations:


SPEC_ATSP_01 Identification of the applicable Safety Requirements and Recommendations relating to Air Traffic Service, from the generic safety case

Generic safety requirements and recommendations applicable to PinS Approach operations have been identified through a generic PinS safety case (Part I).


Generic Safety Case



Section I.5 lists the requirements from the generic safety case relating to Air Traffic Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

Section J.5 lists the recommendation from the generic safety case relating to Air Traffic Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety recommendations, depending on the local environment.

The Project Owner should then evaluate the relevance of each recommendation based on the local operations and environment. Guidance are provided in section J.5 to perform this evaluation.

SPEC_ATSP_02 Identification of the applicable assumptions relating to Air Traffic Service, from the generic safety case


Section K.5 lists the assumptions from the generic safety case relating to Air Traffic Service and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable assumptions, depending on the local environment.

19.3.6 Guidance for specification of heliport/landing site operations

The Project Owner shall perform , in collaboration with the Heliport operator, the following activities in order to define the local specification relating to heliport/landing site operations for PinS approach operations:


SPEC_HPT_01 Identification of the applicable Safety Requirements and Recommendations relating to heliport operations, from the generic safety case



Generic Safety Case



Section I.6 lists the requirements from the generic safety case relating to heliport operations and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR). The Project Owner should extract the applicable safety requirements, depending on the local environment.

No recommendation applicable to the heliport operations has been identified in the generic PinS safety case.

SPEC_HPT_02 Identification of the applicable assumptions relating to heliport operations, from the generic safety case

No assumption applicable to the heliport operations has been identified in the generic PinS safety case.

19.3.7 Guidance for specification of helicopter operations and certification

The Project Owner is not responsible for the verification of the specification of the helicopter operations. The Project Owner considers that the helicopter operations are approved by the local competent authority.

The following table highlights the safety requirements, recommendation and assumptions considered on the helicopter operations and equipment in the generic safety case (Part I). The Project Owner considers that these requirements, recommendations and assumptions are taken into account for helicopter operator approval.

Ref Information for helicopter operations approval

SPEC_HO_01 Generic safety requirements applicable to PinS approach operations have been identified through a generic PinS safety case (Part I)

Section I.7 lists the requirements from the generic safety case relating to helicopter systems and operations and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR).

SPEC_HO_02 Safety recommendation applicable to PinS approach operations have been identified through a generic PinS safety case (Part I).

Section J.7 lists the recommendation from the generic safety case relating to helicopter systems and operators and presents their applicability depending on the airspace (controlled or uncontrolled) and the type of operation (PinS proceed visually or PinS proceed VFR).

SPEC_HO_03 The generic PinS safety case (Part I) is based on a set of assumptions.

No specific assumption applicable to helicopter systems and operations has been identified in the generic PinS safety case.


Generic Safety Case


19.3.8 Guidance for specification completeness and correctness

The Project Owner with all actors shall perform the following activities in order to verify the completeness and correctness of the local specification relating to all domains for PinS approach operations:


SPEC_C&C_01 Verify completeness and correctness of the Safety requirements, recommendations and assumptions considering the local operational environment and local constraints where the PinS approach should be implemented

A generic safety assessment was conducted for PinS approach (Part I).

The Project Owner with the support of the other actors should check the applicability of Safety Criteria, Pre-existing Hazards and Operational Hazards of the generic environment to the local environment.

If needed, the project owner with the other actors shall identify new hazards, new requirements, new recommendations and new assumptions specific to the local environment.

The project owner should contact and inform EUROCONTROL (See contact person in the document characteristics section) in order to update the generic safety case material accordingly.

19.4 Guidance for development of safety assurance relating to local implementation of PinS approach operations

19.4.1 Guidance for implementation of GNSS service

The Project Owner, in collaboration with the GNSS service provider, shall perform the following activities in order to ensure a safe implementation of GNSS for PinS approach operations:


IMP_GNSS_01 Verification that all applicable safety requirements relating to GNSS are correctly implemented in the local environment

Applicable safety requirements and recommendations relating to GNSS have been identified through activities listed in section 19.3.1 and 19.3.8.

The Project Owner, in collaboration with GNSS service provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.

Section I.1 provides guidance for the implementation of some of these requirements.

IMP_GNSS_02 Verification that all applicable assumptions relating to GNSS are satisfied in the local environment.

Applicable assumptions relating to GNSS have been identified through activities listed in section 19.3.1 and 19.3.8.


Generic Safety Case



The Project Owner, in collaboration with GNSS service provider, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.


19.4.2 Guidance for implementation of Flight Procedure Design

The Project Owner, in collaboration with the Flight Procedure Design service provider, shall perform the following activities in order to ensure a safe implementation of Flight Procedure Design for PinS approach operations:


IMP_FPD_01 Verification that all applicable safety requirements relating to Flight Procedure Design service are correctly implemented in the local environment

Applicable safety requirements and recommendations relating to Flight Procedure Design service have been identified through activities listed in section 19.3.2 and 19.3.8.

The Project Owner, in collaboration with Flight Procedure Design service provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.


IMP_FPD_02 Verification that all applicable assumptions relating to Flight Procedure Design service are satisfied in the local environment.

Applicable assumptions relating to Flight Procedure Design service have been identified through activities listed in section 19.3.2 and 19.3.8.

The Project Owner, in collaboration with Flight Procedure Design service provider, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.



Generic Safety Case


19.4.3 Guidance for implementation of Aeronautical Information service

The Project Owner, in collaboration with the Aeronautical Information Service provider, shall perform the following activities in order to ensure a safe implementation of Aeronautical Information Service for PinS approach operations:


IMP_AIS_01 Verification that all applicable safety requirements relating to Aeronautical Information Service are correctly implemented in the local environment

Applicable safety requirements and recommendations relating to Aeronautical Information Service have been identified through activities listed in section 19.3.3 and 19.3.8.

The Project Owner, in collaboration with Aeronautical Information Service provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.


IMP_AIS_02 Verification that all applicable assumptions relating to Aeronautical Information Service are satisfied in the local environment.

Applicable assumptions relating to Aeronautical Information Service have been identified through activities listed in section 19.3.3 and 19.3.8.

The Project Owner, in collaboration with Aeronautical Information Service provider, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.


19.4.4 Guidance for implementation of MET service

The Project Owner, in collaboration with the meteorological service provider, shall perform the following activities in order to ensure a safe implementation of meteorological service for PinS approach operations:


IMP_MET_01 Verification that all applicable safety requirements relating to meteorological service are correctly implemented in the local environment

Applicable safety requirements and recommendations relating to meteorological service have been identified through activities listed in section 19.3.4 and 19.3.8.


Generic Safety Case



The Project Owner, in collaboration with meteorological service provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.


IMP_MET_02 Verification that all applicable assumptions relating to meteorological service are satisfied in the local environment.

Applicable assumptions relating to meteorological service have been identified through activities listed in section 19.3.4 and 19.3.8.

The Project Owner, in collaboration with meteorological service provider, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.


19.4.5 Guidance for implementation of Air Traffic Service

The Project Owner, in collaboration with the Air Traffic Service Provider, shall perform the following activities in order to ensure a safe implementation of Air Traffic Services for PinS approach operations:


IMP_ATSP_01 Verification that all applicable safety requirements relating to Air Traffic Service are correctly implemented in the local environment

Applicable safety requirements and recommendations relating to GNSS service have been identified through activities listed in section 19.3.5 and 19.3.8.

The Project Owner, in collaboration with the the Air Traffic Service Provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.


IMP_ ATSP _02 Verification that all applicable assumptions relating to Air Traffic Service are satisfied in the local environment.

Applicable assumptions relating to GNSS service have been identified through activities listed in section 19.3.5 and 19.3.8.


Generic Safety Case



The Project Owner, in collaboration with the Air Traffic Service Provider, should verify that these safety assumptions are correctly implemented and should collect the evidence of their implementation.


19.4.6 Guidance for implementation of heliport operations

The Project Owner, in collaboration with the heliport operator, shall perform the following activities in order to ensure a safe implementation of heliport operations for PinS approach operations:


IMP_HPT_01 Verification that all applicable safety requirements relating to heliport operations are correctly implemented in the local environment

Applicable safety requirements and recommendations relating to heliport operations have been identified through activities listed in section 19.3.6 and 19.3.8.

The Project Owner, in collaboration with heliport operator provider, should verify that these safety requirements and/or recommendations are correctly implemented and should collect the evidence of their implementation.


IMP_HPT_02 Verification that all applicable assumptions relating to meteorological service are satisfied in the local environment.

Applicable assumptions relating to heliport operations have been identified through activities listed in section 19.3.6 and 19.3.8.

The Project Owner, in collaboration with heliport operator, should verify that these assumptions are correctly implemented and should collect the evidence of their implementation.



Generic Safety Case


19.4.7 Guidance for implementation of helicopter operations and certification

The Project Owner is not responsible for the verification of the implementation of the helicopter operations. The Project Owner considers that the helicopter operations are approved by the local competent authority. The Project Owner considers that the requirements, recommendations and assumptions listed in section 19.3.7 and 19.3.8 are taken into account by the local competent authority for helicopter operator approval.

19.5 Guidance for development of safety assurance relating to the transition from current VFR approach to PinS approach operations

This safety argument is relative to the transfer into operation of helicopter PinS approach operations, based on the implementation phase addressed in previous section 19.4.

The Project Owner shall perform the following activities to ensure a safe transfer into operation:


TRANS_ 01 Determine the transition step between the current situation and PinS approach operations

Determine the transition step for:

Air Navigation Services (ANS).

heliport/landing site

helicopter operators

considering all impacted elements (human, procedure and equipment)

Impact on procedures should be minimal if PBN operations are already used in the operational environment

TRANS_ 02 Identification and mitigation of possible ATM/ANS risks during transition from current state to PinS approach operations

Local safety assessment for the transfer into operation phase is conducted in order to identify risks and derive mitigations when necessary (ATCO/AFISO training including simulator sessions, dedicated information in the AIP, direct communication towards airspace users, …). Some additional steps may be required, depending on the operational environment (obstacles constraints, high density area, …), by e.g :

An implementation program in successive steps with a first temporary phase in VMC conditions.

An initial implementation with a limited number of airspace users to gain experience and identify any problem

…


Generic Safety Case



TRANS_ 03 Identification and mitigation of possible heliport/landing site risks during transition from current state to PinS approach operations

Local safety assessment for the transfer into operation phase is conducted in order to identify risks and derive mitigations when necessary. Some additional steps may be required depending on the landing site specificity.

TRANS_ 04 Identification and mitigation of possible helicopter operations risks during transition from current state to PinS approach operations

This activity is not under Project Owner responsibility. However, it is necessary to ensure that the helicopter operations risks during transition are sufficiently mitigated, similarly to what is done in activity TRANS_02 for ATM/ANS risks.

The Project Owner considers that the mitigation of helicopter operations risks is verified by the local competent authority for helicopter operator approval.

19.6 Guidance for development of safety assurance relating to the PinS approach operations through its service life

19.6.1 Guidance for safe GNSS service through PinS service life

The Project Owner shall verify, in collaboration with the GNSS service provider, that the following activities are satisfied during the PinS approach service life:


OPE_GNSS_01 Verification of acceptability of local GNSS performance

If EGNOS is required, verification based on SoL SDD updates and EGNOS Service Notices.

Safety oversight of the EGNOS service provider by EASA.

OPE_GNSS_02 Identification of “Events” or specific cases necessitating a new ground and/or flight validation

Dedicated Flight Inspection should be conducted for the eligible “events” (e.g. interference encountered during operations, GNSS loss of integrity, flyability problem encountered by some airspace users,…).

19.6.2 Guidance for safe Flight Procedure Design through PinS service life

The Project Owner in collaboration with the Flight Procedure Designer, shall verify that the following objectives are satisfied during the PinS approach service life:


Generic Safety Case



OPE_FPD_01 Safe management of PinS approach procedure design modification during service life through regular meetings with stakeholders.

PinS approach procedure modifications affecting the trajectory of the procedure (track, distance, altitude, new waypoint,…) shall lead to a new implementation process.

OPE_FPD_02 Periodic reviews of PinS approach procedure

Periodic reviews are necessary to ensure that published procedure continues to comply with changing criteria, to confirm continued adequate obstacle clearance and that it meets user requirements (ATSP and aircraft operators).

Compliance with ICAO Doc 8168 [RD 55] or any Alternate MOC to PANS OPS approved by the Competent Authority.

The maximum interval for this review is five years.

Note: This periodic review is not specific to PinS procedure

19.6.3 Guidance for safe Aeronautical Information Service through PinS service life

The Project Owner shall verify, in collaboration with the AIS Provider, that the following activities are performed satisfied during the PinS service life:


OPE_AIS_01 Information of airspace users about the status of the PinS approach procedure with regard to navigation aids

See (EU) No 2017/373 [RD 52] (ATM/ANS CR- Part AIS) and ICAO Annex 15 [RD 59]

NOTAM are published if safety of helicopter operations on the PinS approach procedure is affected or is planned to be affected

AIC is published to describe the operational concept and any relevant information to inform stakeholders and any users of the airspace concerned by PinS approach.

19.6.4 Guidance for safe MET Service through PinS service life

The Project Owner shall verify, in collaboration with the MET Service provider, that the following activities are performed during the PinS service life :


Generic Safety Case



OPE_MET_01 Continuous provision of appropriate meteorological service for helicopter operations on the PinS approach procedure

See requirements in section I.4 for meteorological information to be provided.

19.6.5 Guidance for safe Air Traffic Service through PinS service life

The Project Owner shall verify, in collaboration with the Air Traffic Service Provider, that the following activities are performed during the PinS service life:


OPE_ATSP_01 Maintenance of skills of ATCO, AFISO and ATSEP/ technical personnel to satisfy ATS procedures and phraseology defined during the “Implementation” and “Transition” phases

Local training program or briefing for personnel to be developed to maintain skill and competency for the different ATS procedures /Phraseology.

ATS procedures / phraseology to be respected are those defined during the Implementation phase (see section 19.4.5).

Additional and temporary ATS procedures/restrictions/ limitations might be necessary as defined during the Transition phase (see section 19.5).

OPE_ATSP_02 Monitoring of safety performance indicators for helicopter PinS approach operations in a collaborative way with airspace users

Safety performance indicators should be first set to identify loss of RNP-APCH (LNAV or LPV) capability events on the PinS procedure

Additional safety performance indicators should be defined and monitored locally (e.g. number of missed approaches, Interference events, Coding/navigation data base problem,…).

Note: Flight crew reports should be the main source for occurrence reporting.

OPE_ATSP_03 Management of safety events affecting helicopter PinS approach operations

For the occurrence reporting see (EU) No 376/2014 [RD 70])

Safety events are addressed and when needed corrective actions are determined and implemented.

19.6.6 Guidance for safe heliport operations through PinS service life

The Project Owner shall verify, in collaboration with the heliport operator, that the following activities are performed during the PinS service life:


Generic Safety Case



OPE_HPT_01 Continuous provision of appropriate service for helicopter operations on the PinS approach procedure

See requirements in section I.6 for service to be provided by heliport operator for PinS approach operations.

19.6.7 Guidance for safe helicopter operations and certification through PinS service life

The Project Owner should consider that all flight crew conducting PinS approach operations are respecting the approved procedures in particular they will:

fly the route in accordance with the published procedure in the AIP

respect the AFM relative to PinS approach associated to RNP APCH (down to LNAV or LPV minima),

respect the operational procedures relative to PinS approach associated to RNP APCH (down to LNAV or LPV minima),

Report any incident in accordance with the applicable regulation


Generic Safety Case


ANNEX H – Reference material


[RD 48] SESAR P16.06.01, Task T16.06.01-006, SESAR Safety Reference Material, Edition 00.04.00, 24th of March 2016

[RD 49] SESAR P16.06.01, Task T16.06.01-006, Guidance to Apply the SESAR Safety Reference Material, Edition 00.03.00, 9th of May 2016



[RD 52] (EU) No2017/373 common requirements for providers of ATM/ANS






[RD 58] ICAO Annex 10 Aeronautical Telecommunications Vol I, Sixth Edition 2006








[RD 66] EUROCONTROL - Safety Case Development Manual – V2.2 – 13/11/2006




[RD 70] (EU) No 376/2014 on the reporting, analysis and follow-up of occurrences in civil aviation

[RD 71] EASA Notice of Proposed Amendment 2018-06 All-weather operations RMT.0379


Generic Safety Case


ANNEX I – Safety Requirements from the generic safety case

The following sections presents the safety requirements for PinS Approach identified within the generic PinS safety case (Part I). These requirements are sorted per domain:

Section I.1 identifies the requirements applicable to GNSS domain (i.e. requirements identified as applicable to GNSS/SBAS service provider) in the generic PinS safety case (Part I)

Section I.2 identifies the requirements applicable to Flight Procedure Design domain (i.e. requirements identified as applicable to FPD provider) in the generic PinS safety case (Part I)

Section I.3 identifies the requirements applicable to AIS domain (i.e. requirements identified as applicable to AIS provider) in the generic PinS safety case (Part I)

Section I.4 identifies the requirements applicable to MET domain (i.e. requirements identified as applicable to MET provider) in the generic PinS safety case (Part I)

Section I.5 identifies the requirements applicable to ATS domain (i.e. requirements identified as applicable to the ATSP or NM in the generic PinS safety case (Part I)

Section I.6 identifies the requirements applicable to heliport/landing site domain (i.e. requirements identified as applicable to heliport operator) in the generic PinS safety case (Part I)

Section I.7 identifies the requirements applicable to helicopter domain (i.e. requirements identified as applicable to helicopter, helicopter operator and other traffic) in the generic PinS safety case (Part I)


Generic Safety Case


I.1 Safety Requirements applicable to GNSS domain



VFR or Visually Airspace

SR_APR_CTRL#14 & SR_APR_UNCTRL#12: The GNSS signal in space (GPS and SBAS if required)

shall be compliant with ICAO Annex 10 SARPS on the PinS approach procedure

GNSS/SBAS service

provider VFR & Visually


The Project Owner should consider that GPS constellation alone could deliver appropriate

performance for RNP APCH down to LNAV minima.

The Project Owner should consider that GPS constellation and EGNOS deliver appropriate

performance for RNP APCH down to LPV minima. Project Owner should consider acceptance of the SDD maps by EASA as sufficient evidence when published

in the SoL SDD.

The Project Owner should determine that GNSS (GPS or GPS and EGNOS) positioning is available (accuracy,

integrity and continuity) on the PinS approach and that no interference is present.

Table I-1: Safety Requirements applicable to GNSS domain

I.2 Safety Requirements applicable to Flight Procedure Design domain




SR_APR_CTRL#1 & SR_APR_UNCTRL#1: The flight procedure design shall, as far as practicable, ensure

strategic separation between PinS approaches procedures and between PinS approach and other

procedures considering navigation performance and airspace constraints (sector size, other

trajectories in the vicinity, restricted areas…)…


Strategic separation with other routes and procedures will reduce the risk of collision with other

IFR traffic, particularly in uncontrolled airspace.


Generic Safety Case





SR_APR_CTRL#2: The flight procedure design shall take into account ATC constraints such as

separation minima, traffic density, sector size, and controller procedures / HMI.

FPD VFR & Visually Controlled No specific guidance

SR_APR_CTRL#3 & SR_APR_UNCTRL#2: When applicable, the flight procedure design shall take into account the transition between the low level route (or other existing routes/SID/STAR) and the

PinS approach (RNP values, altitudes, speed constraints, waypoints)

FPD VFR & Visually Controlled & Uncontrolled


SR_APR_CTRL#7 & SR_APR_UNCTRL#5: The aeronautical, terrain and obstacle data used in the design of the helicopter PinS approach procedure

shall comply with the appropriate data quality requirements of ICAO Annex 14 and 15 and respect the European Regulation N°73/2010 on the quality

of aeronautical data/information.

FPD VFR & Visually Controlled & Uncontrolled

For proceed visually approach, compliance with ICAO Annex 14 vol II implies that there are enough up-to-

date obstacle data available within the area of interest (Obstacle Limitation Surfaces). At least

information on every obstacle penetrating the OLS should be collected and made available to the procedure designer and AIS provider. This may require additional obstacle surveys at periodic

intervals, especially at those heliports in Area 1, as defined in Annex 15 (State area), where only

obstacles higher than 100 m above ground level are considered hazardous for air operations and

therefore collected. From ICAO Annex 14 Vol II: “It should be noted that identifying obstacle limitation surfaces, in itself does not protect the surfaces; in most cases a state would need to enact some form of regulation restricting the

limits of heights of objects, whether it be natural growth or buildings and/or structures

SR_APR_CTRL#8 & SR_APR_UNCTRL#6: The PinS approach procedure (i.e. initial approach segment,

intermediate approach segment, final approach segment, missed approach and, if applicable visual

segment) shall be designed in accordance with ICAO PANS OPS criteria relative to PinS procedure




Generic Safety Case





SR_APR_CTRL#9 & SR_APR_UNCTRL#7: The verification and validation of the PinS approach procedure shall be made in accordance with the

quality process specified in ICAO Doc 9906



SR_APR_CTRL#19 & SR_APR_UNCTRL#17: PinS approach chart shall specify the QNH source (local

or remote) to be used FPD VFR & Visually


The QNH source could be provided either by: an aeronautical meteorological service compliant with

ICAO Annex 3 at destination or, an equivalent meteorological service with approval from local

Competent Authority or, an aeronautical meteorological service compliant with ICAO Annex 3

at neighboring airport with approval from local Competent Authority.

See requirements relating to MET service provision (I.4)

SR_APR_CTRL#20 & SR_APR_UNCTRL#18: The flight procedure designer shall take into account

appropriate margins when using remote QNH, as defined in PANS OPS.



SR_APR_CTRL#33 & SR_APR_UNCTRL#25: The flight procedure design shall take into account the flight validation’s feedback during the flight validation, in

particular for the definition of the appropriate visual references associated with the heliport or

landing location


Controlled & Uncontrolled


SR_APR_CTRL#34 & SR_APR_UNCTRL#26: The procedure designer shall depict, on the PinS “proceed visually” chart, visual references

associated with the heliport or landing location




SR_APR_CTRL#41 & SR_APR_UNCTRL#32: The procedure designer shall depict the relevant

obstacles (i.e. the obstacles penetrating the OIS), on the PinS “proceed visually” chart





Generic Safety Case





SR_APR_CTRL#42 & SR_APR_UNCTRL#33: The procedure designer shall present the HAS (Height Above Surface), on the PinS “proceed VFR” chart

FPD Proceed VFR Controlled & Uncontrolled

HAS should be detailed and presented on a separate page for clarity purpose. In addition, the presentation of the obstacles in the vicinity of the visual segment

would have an added value.

SR_APR_CTRL#43 & SR_APR_UNCTRL#34: the procedure designer shall depict, on the PinS

“proceed VFR” chart, the relevant obstacles in the vicinity of the visual segment


The obstacle depiction on the PinS “proceed VFR” chart could not be exhaustive as no obstacle identification is mandatory for proceed VFR.

SR_APR_CTRL#44 & SR_APR_UNCTRL#40: The procedure designer shall be provided with data relating to prohibited and restricted areas in the

vicinity of the heliport / landing location



SR_APR_CTRL#45 & SR_APR_UNCTRL#41: The procedure designer shall, as far as practicable, ensure strategic separation between the PinS

approach and the prohibited and restricted areas in the vicinity of the heliport / landing location.


Strategic separation with restricted/prohibited areas is not always possible . In this case, coordination procedures are implemented between ATSP and

operator regarding the activation/de-activation of prohibited/restricted airspace (see ASS_APR_CTRL#26

in section K.5)

SR_APR_CTRL#46 & SR_APR_UNCTRL#42: The PinS approach chart shall clearly indicate the

prohibited/restricted areas in the vicinity of the route



Table I-2: Safety Requirements applicable to Flight Procedure Design domain


Generic Safety Case


I.3 Safety Requirements applicable to AIS domain




SR_APR_CTRL#10 & SR_APR_UNCTRL#8: The PinS approach procedure shall be published in the state

AIP in accordance with ICAO Annex 4, ICAO Doc 8697 and ICAO Doc 8168 Vol II. The publication shall indicate in particular the OCA/H and the

required aircraft navigation capability to fly the procedure (e.g. RNP APCH)



SR_APR_CTRL#11 & SR_APR_UNCTRL#9: The AIS provider shall define the naming and phraseology associated with the PinS approach in accordance

with ICAO rule to ensure consistency between operator (FMS, phraseology) and ATS (Phraseology)


The definition of clear naming and phraseology to be used between ATS and helicopter should significantly reduce the risk of misunderstanding between air and

ground but also between helicopters.

SR_APR_CTRL#12 & SR_APR_UNCTRL#10: The AIS provider shall inform airspace users (e.g. through

AIC) about the implementation of a PinS approach and the possible increase of IFR traffic in the the



This information should be performed through an Aeronautical Information Circular, in addition to the publication of the new procedures and charts in the

AIP.

SR_APR_CTRL#13 &SR_APR_UNCTRL#11: The promulgation of a PinS approach procedure shall

comply with the appropriate data quality requirements of ICAO Annex 15 and respect the

European Regulation N°73/2010 on the quality of aeronautical data/information.



SR_APR_CTRL#19 &SR_APR_UNCTRL#17:The PinS approach chart shall specify the QNH source (local

or remote) to be used AIS VFR & Visually


The QNH source could be provided either by: an aeronautical meteorological service compliant with

ICAO Annex 3 at destination or, an equivalent meteorological service with approval from local

Competent Authority or, an aeronautical meteorological service compliant with ICAO Annex 3

at neighboring airport with approval from local Competent Authority.


Generic Safety Case





See requirements relating to MET service provision (I.4)

SR_APR_UNCTRL#36: The AIS shall publish in the AIP the operational PinS usage restrictions if any

AIS VFR & Visually Uncontrolled

Specific PinS usage restrictions (e.g. use of the new procedures limited to certain operators or limited to

certain periods of time) could be defined in uncontrolled airspace to limit the risk of collision

between traffic. If such restrictions are defined they need to be

published in the AIP.

SR_APR_CTRL#44 & SR_APR_UNCTRL#40: The procedure designer shall be provided with data relating to prohibited and restricted areas in the




SR_APR_CTRL#46 & SR_APR_UNCTRL#42: The PinS approach chart shall clearly indicate the

prohibited/restricted areas in the vicinity of the route



SR_APR_CTRL#58 & SR_APR_UNCTRL#53: The AIS provider shall implement a quality assurance

process to verify and validate the PinS approach procedure with the procedure designer, before

publication



SR_APR_CTRL#64 & SR_APR_UNCTRL#56: The PinS approach shall be clearly depicted on VFR charts to

inform pilots of IFR traffic in this area AIS VFR & Visually



TableI-3 : Safety Requirements applicable to AIS domain


Generic Safety Case


I.4 Safety Requirements applicable to MET domain




SR_APR_CTRL#47 & SR_APR_UNCTRL#43: Local MET information at the destination

heliport/landing location shall be provided to the ATCO/AFISO and helicopter operator. These local

MET information can be provided either by: an aeronautical meteorological service compliant with

ICAO Annex 3 at destination or, an equivalent meteorological service (e.g. based on Webcam or other dedicated tools) with approval from local

Competent Authority or, an aeronautical meteorological service compliant with ICAO Annex 3 at neighboring airport with approval from local

Competent Authority.

MET provider


Some operators might use webcams, non ICAO Annex 3 compliant weather stations, trained observers or other means to assess the weather conditions at

destination from the ground. They may use various means to communicate the weather data to the pilot,

including portable electronic devices. These innovative solutions are considered in proposed

amendment to the Air Ops regulation, these solutions need to be approved locally by the competent

authority and they are not fully standardized. They need to be validated/tested in order to show an

acceptable level of MET data integrity, accuracy and reliability for the type of operation conducted.

SR_APR_CTRL#48 & SR_APR_UNCTRL#44: Local MET information shall include at the minimum the following information: visibility, ceiling and QNH.

MET provider


- Local ceiling and visibility forecasts are useful for the preparation phase, but not required. Without them, AIR OPS CAT regulations may require two alternates.

A proposed amendment to the Air Ops regulation widens the definition of ‘local’ for flight preparation. -During the approach phase, ceiling and visibility are

useful but not required (see new GM CAT.OP.MPA.305 “commencement and continuation

of approach” from NPA 2018-06 [RD 71]).

Table I-4: Safety Requirements applicable to MET domain


Generic Safety Case


I.5 Safety Requirements applicable to ATS domain




SR_APR_CTRL#4: The ATC controller shall give appropriate clearance when needed to facilitate

the transition between the low level route (or other existing routes/SID/STAR) and the PinS approach (i.e. to facilitate the compliance with published

altitude or speed constraints)


SR_APR_UNCTRL#16: Wherever applicable, the AFISO or landing site operator shall provide thel

QNH information to the flight crew for the helicopter PinS approach.

AFISO VFR & Visually Uncontrolled In uncontrolled airspace with AFIS, AFISO should

provide this information to the flight crew

SR_APR_CTRL#18: The ATC controller shall provide the QNH information to the flight rrew for the

helicopter PinS approach. ATSP VFR & Visually Controlled

The QNH can be either a local QNH provided by a local MET service or appropriate equipement

approved by competent local authority or a remote QNH provided by a remote MET service.

SR_APR_CTRL#22: The State / ANSP shall define a landing site indicator/identifier allocation scheme

for any landing site without an ICAO code ATSP VFR & Visually Controlled

The indicator or identifier should be a 4 digit code to be defined and approved locally. See REC_APR_CTRL#2 in section J.5

SR_APR_CTRL#24: The local ATS or Network Manager shall be able to validate the helicopter

flight plan including the PinS approach procedure. NM VFR & Visually Controlled

The ATSP Network Manager should confirm the ability to validate the flight plan including PinS approach procedure, particularly if the landing

location has a “local” code (landing site indicator/identifier)


Generic Safety Case





SR_APR_CTRL#26: The ATC controller shall give a clearance to the flight crew to initiate the PinS

approach ATSP VFR & Visually Controlled


approch are already implemented in the operational environment

The ATCO should be informed through ATSP briefing that aircraft will fly under Visual Flight Rule during the visual segment of a Pins “proceed VFR” approach and

under Instrument Flight Rule during the visual segment of a PinS “proceed visually” approach.

SR_APR_CTRL#27: The ATC controller shall give appropriate speed and altitude instructions to the

flight crew if needed to facilitate the transition between the instrument flight phase and the visual

flight phase (i.e. to facilitate the compliance with published altitude or speed constraints)


The ATSP should be briefed on the level and speed constraints associated to the PinS approach

procedure in order to be able to provide appropriate instructions to the flight crew.

SR_APR_UNCTRL#35: ATSPs shall ensure coordination between entities (e.g. FIS, ATCO, AFIS,

heliport/landing site…) for the operational use of the PinS approach)


In uncontrolled airspace, even if no control service is provided by the ATSP, ATSP should be in charge to coordinate and inform the different stakeholders

about the implementation of the new PinS procedure.


Generic Safety Case





SR_APR_UNCTRL#39: A Radio Mandatory Zone (RMZ) shall be defined around the PinS approach in

order to maintain continuous air-ground voice communication watch and establish two-way

communication, as necessary, on the appropriate communication channel, unless it is shown that

mitigating the risk of conflict between IFR and VFR is not required considering the airspace structure, traffic density, traffic complexity and the current level of safety associated to aircraft operations in

this airspace.


-It is considered in uncontrolled airspace that RMZ is required from a safety point of view considering a

generic operational environment (medium complexity of the airspace, different airspace users sharing this

airspace and medium traffic density). -The RMZ will allow each helicopter pilots to inform any other aircraft flying in the vicinity of the route

about their position and intent in a more efficient and systematic way.

-Communication is an essential element to enhance the see and avoid in uncontrolled airspace

-The ATSP and the different airspace users could demonstrate to their Competent Authority that RMZ is not needed for their local environment (risk-based approach associated to IFR/VFR conflict). The safety target could be set as the same level of safety than current air operations in this class G airspace where

PinS procedures will be implemented.

SR_APR_UNCTRL#45: The AFISO, when available, shall inform the flight crew about change of MET

conditions at destination heliport or landing location.

AFISO VFR & Visually Uncontrolled No specific guidance

SR_APR_CTRL#49: The ATC controller shall inform the flight crew about change of MET conditions at

the destination heliport or landing location. ATSP VFR & Visually Controlled

The MET update during flight should not be needed for flight of:

less than 30mn (METAR validity is 30 min)

even for flight less than 45mn, if good weather conditions are forecasted.

For longer flight the MET update should be provided to the pilot.


Generic Safety Case





SR_APR_CTRL#57: ATC shall provide appropriate air traffic services, in accordance with airspace class and helicopter flight rules, in situation of peak of traffic, taking benefit of the published holdings if

any


SR_APR_CTRL#61: The ATC controllers shall be briefed on the RNAV navigation and on helicopter

PinS approach procedure ATSP VFR & Visually Controlled

Briefing of the ATCO should include a generic presentation of the PinS approach procedure. In

particular it should highlight the transition between VFR and IFR for PinS proceed VFR procedure. In addition, this briefing should highlight the

specificities of the local PinS procedure (strategic separation or not with adjacent routes and

procedures, strategic separation or not with prohibited/restricted areas, altitude constraints

published on the procedure…)

SR_APR_CTRL#62: In radar environment, the PinS approach procedure shall be displayed, on demand, on the controller working position to facilitate the

detection of deviation from the expected trajectory and the recognition of potential conflict





airspace: they are required to receive a clearance and PinS departures are to provide an ETD before take-

off.


Generic Safety Case





SR_APR_CTRL#63: In radar environment, the radar display shall provide an adequate traffic picture to depict IFR aircraft and VFR aircraft equipped with

transponder on the PinS approach and in the vicinity of the PinS procedure





airspace: they are required to receive a clearance and PinS departures are to provide an ETD before take-

off.

TableI-5 : Safety Requirements applicable to ATS domain

I.6 Safety Requirements applicable to heliport/landing Site domain




SR_APR_CTRL#31 & SR_APR_UNCTRL#23: The heliport or landing location where PinS approach

“proceed visually” are performed shall be compliant with the requirements of ICAO Annex 14

Vol II applicable to non-instrument heliport (physical characteristics, obstacle environment,

visual aids,..)..

Heliport operator

Proceed visually


PinS “proceed visually” approach operations are developed for non-instrument heliport compliant

with ICAO Annex 14 Volume II (physical characteristics, obstacle environment, visual aids,..). This means that compliance with appendix 2 of ICAO

Annex 14 relating to instrument heliport is not requested.

SR_APR_CTRL#32 & SR_APR_UNCTRL#24: The heliport or landing location where PinS approach “proceed VFR” are performed shall not require

additional requirements compared to VFR approach conducted on this heliport/landing

location (physical characteristics, obstacle environment, visual aids,..).

Heliport operator

Proceed VFR Controlled & Uncontrolled

PinS “proceed VFR” approach operations are developed for non-instrument heliport/landing

location which are compliant or not with ICAO Annex 14 Volume II.

Implementation of a PinS “proceed VFR” approach within an existing heliport/landing location already

used for VFR approach does not lead to new requirements (physical characteristics, obstacle

environment, visual aids,..)


Generic Safety Case


SR_APR_UNCTRL#16: Wherever available, the AFISO or landing site operator shall provide the local QNH information to the flight crew for the

helicopter PinS approach

Heliport operator

VFR & Visually Uncontrolled This requirement is applicable to the landing site

operator, only in the absence of AFISO. Otherwise, the local QNH information is provided by the AFISO.

TableI-6 : Safety Requirements applicable to heliport domain

I.7 Safety Requirements applicable to helicopter domain




SR_APR_CTRL#5 & SR_APR_UNCTRL#3: The flight crew shall comply with constraints published on the flight procedure and with the ATCO clearance

relating to transition between the low level route (or other existing routes/SID/STAR) and the PinS approach

Helicopter VFR & Visually Controlled & Uncontrolled


SR_APR_CTRL#6 & SR_APR_UNCTRL#4: The Flight Control and Display sub-system shall display an appropriate full scale deflection during transition between the low level route (or other existing routes/SID/STAR) and the

PinS approach to avoid disturbance of the flight crew



SR_APR_CTRL#15 & SR_APR_UNCTRL#13: The flight crew shall not modify the PinS procedure stored in the navigation database as defined in AIR

OPS. Helicopter VFR & Visually



SR_APR_CTRL#16 & SR_APR_UNCTRL#14: The flight crew shall select the PinS approach procedure in the RNAV system’s flight plan



SR_APR_CTRL#17 & SR_APR_UNCTRL#15: The RNAV subsystem shall display appropriate navigation data to navigate laterally on the instrument

segment of the PinS approach procedure Helicopter VFR & Visually




Generic Safety Case





SR_APR_CTRL#21 & SR_APR_UNCTRL#19: The flight crew shall set the appropriate QNH (local QNH or remote QNH) for the PinS approach



SR_APR_CTRL#23: If not exempted, the helicopter operator shall submit the flight plan to the Network Manager including the PinS approach.

Helicopter operator

VFR & Visually Controlled No specific guidance

SR_APR_CTRL#25: The flight crew shall request to the controller for the clearance to initiate the PinS approach


SR_APR_CTRL#28 & SR_APR_UNCTRL#20: The helicopter operator shall determine the operating minima applicable for the PinS approach

operations in accordance with AIR OPS

Helicopter operator

VFR & Visually Controlled & Uncontrolled


SR_APR_CTRL#29 & SR_APR_UNCTRL#21: The flight crew shall check, during flight, before starting the PinS approach (i.e. before IAF), if the

latest visibility conditions at destination – and, if different, in the vicinity of the approach - are compliant with operating minima


The crew should decide, based on the available weather information, whether to fly

the approach or to divert.

SR_APR_CTRL#30 & SR_APR_UNCTRL#22: The flight crew shall abort the PinS approach and plan another approach if the predicted visibility conditions at destination are not compliant with operating minima


This is a temporary requirement from the current AIR OPS regulation (to be amended

under NPA2018-06)

SR_APR_CTRL#35 & SR_APR_UNCTRL#27: The flight crew shall perform the transition to the visual segment “proceed visually” if the heliport (or landing location) or direct visual references associated with it can be

acquired at or prior the MAPt



For a direct visual segment and at, MApt, the pilot must see the FATO or the direct visual references associated with it, e.g. lighting of the landing site

SR_APR_CTRL#36 & SR_APR_UNCTRL#28: The flight crew shall perform the transition to the visual segment “proceed VFR” if the applicable operating

minima are obtained at or prior the MAPt Helicopter Proceed VFR




Generic Safety Case





SR_APR_CTRL#37: The flight crew shall cancel the IFR flight when transitioning to the “proceed VFR” visual segment or after landed in

accordance with local agreement Helicopter Proceed VFR Controlled

The cancellation of the IFR flight during the approach impacts pilots workload and might be an issue for the pilots at that stage of the

flight.

In accordance with PANS-ATM the IFR flight must be cancelled at the MApt. According to

SERA, the IFR flight can be cancelled as soon as possible after landing.

SR_APR_CTRL#38 & SR_APR_UNCTRL#29: The flight crew shall perform a missed approach if the heliport (or landing location) or visual references associated with it cannot be acquired at or prior the MAPt of a “proceed

visually” approach




SR_APR_CTRL#39 & SR_APR_UNCTRL#30: The flight crew shall perform a missed approach if the applicable operating minima are not obtained at or

prior the MAPt of a “proceed VFR” approach Helicopter Proceed VFR



SR_APR_CTRL#40 & SR_APR_UNCTRL#31: The flight crew shall respect the lateral and vertical constraints of the visual segment depicted on the PinS

“proceed visually” approach chart. For proceed visually with direct segment, lateral and vertical path are indicated on the chart.




SR_APR_CTRL#50 & SR_APR_UNCTRL#47: The helicopter operator shall define a contingency procedure for the case of loss of RNP navigation on

the PinS approach and considering the local environment

Helicopter operator



SR_APR_CTRL#51 & SR_APR_UNCTRL#48: In case of loss of RNP capability on the PinS approach procedure, flight crews shall respect the helicopter operator’s contingency procedures (e.g. conventional navigation or dead

reckoning)




Generic Safety Case





SR_APR_CTRL#52: The flight crew shall inform the controller about the loss of RNP capability on the PinS approach procedure and about the

contingency procedure Helicopter VFR & Visually Controlled No specific guidance

SR_APR_CTRL#53 & SR_APR_UNCTRL#49: The helicopter operator shall define a contingency procedure adapted to the operational environment

for the case of icing conditions encountered on the PinS approach

Helicopter operator



SR_APR_CTRL#54 & SR_APR_UNCTRL#50: In case of icing conditions on the PinS approach procedure, flight crews shall respect the helicopter

operator’s contingency procedures Helicopter VFR & Visually



SR_APR_CTRL#55 & SR_APR_UNCTRL#51: The helicopter operator shall define a contingency procedure for the case of degradation of visibility conditions, leading to a loss of the required visual reference, during the

visual segment of a PinS “proceed visually” approach

Helicopter operator

Proceed visually



SR_APR_CTRL#56 & SR_APR_UNCTRL#52: In case of degradation of visibility conditions, leading to a loss of the required visual reference, during the visual segment of a PinS “proceed visually” approach, flight

crews shall respect the helicopter operator’s contingency procedures and inform as soon as possible the controller




SR_APR_CTRL#59 & SR_APR_UNCTRL#54: The flight crew shall verify the consistency between the PinS approach procedure on the chart and the

aircraft display (FPLN, ND…) Helicopter VFR & Visually



SR_APR_CTRL#60 & SR_APR_UNCTRL#55: The flight crew shall be trained on RNAV navigation, PinS approach procedure and associated contingency

procedures Helicopter VFR & Visually




Generic Safety Case





SR_APR_UNCTRL#37: The flight crew established on the PinS approach shall transmit regularly their position and flight intent to inform other

helicopters operating on the PinS aproach and other aircraft flying in the vicinity of the PinS approach


SR_APR_UNCTRL#38: VFR or IFR pilots flying in the vicinity of the PinS approach shall transmit regularly their position and flight intent to inform

helicopters established on the PinS approach

Other traffic

VFR & Visually Uncontrolled No specific guidance

SR_APR_UNCTRL#46: When no AFISO is available, the flight crew shall obtain up-to-date MET information, when necessary, based on

appropriate air/ground mean defined by the operator and approved by local authority


SR_APR_UNCTRL#57: IFR helicopters flying the PinS approach in uncontrolled airspace shall be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this route

(i.e. a traffic advisory system), unless it is shown that mitigating the risk of conflict with VFR and IFR is not required considering the airspace structure

and the traffic density and complexity

Helicopter VFR & Visually Uncontrolled

It is considered in uncontrolled airspace that Traffic Advisory System or similar/equivalent system is required from a safety point of view considering a generic operational environment (medium complexity of the airspace, different

airspace users sharing this airspace and medium traffic density).

This system should allow to mitigate :

the risk of IFR/IFR collision in IMC conditions (reduced effectiveness of

see and avoid in IMC conditions).

The risk of collision with IFR and VFR when reaching the PinS if helicopter is

still in IMC at this point

The Traffic Advisory System System or similar/equivalent system will support the situational awareness of the traffic in the


Generic Safety Case





vicinity of the PinS. The ATSP and the different airspace users

could demonstrate to their Competent Authority that the system enhancing the see

and avoid is not needed for the local environment (risk-based approach regarding

IFR/VFR collision risk).

Table I-7: Safety Requirements applicable to helicopter domain


Generic Safety Case


ANNEX J – Recommendations from the generic safety case

The following sections present the recommendations identified within the generic PinS safety case (Part I) when performing the generic safety assessment. The recommendations identified in the generic safety case only relate to Flight Procedure Design domain (section J.2), helicopter domain (section J.7) and ATSP domain (section J.5).

J.1 Safety Recommendations applicable to GNSS domain

No safety recommendation applicable to the GNSS domain is identified in the generic PinS safety case (Part I).

J.2 Safety Recommendations applicable to Flight Procedure Design domain



REC_APR_CTRL#3 & REC_APR_UNCTRL#2: The procedure designer should depict on the PinS

“proceed VFR” chart, elements allowing to identify if VMC minima are satisfied


As the VMC minima is a dynamic information (difference between day and night, between

operations(HEMS or not),… ), it may be difficult to publish relevant and understable information

REC_APR_CTRL#7 & REC_APR_UNCTRL#4: The design of the PinS approach procedure should include

holdings designed in accordance with ICAO PANS OPS criteria, depending on local environment and

constraints

FPD VFR & Visually Controlled Holdings might be needed in medium/high density

traffic areas

J.3 Safety Recommendations applicable to AIS domain

No safety recommendation applicable to the AIS domain is identified in the generic PinS safety case (Part I).

J.4 Safety Recommendations applicable to MET domain

No safety recommendation applicable to the MET domain is identified in the generic PinS safety case (Part I).


Generic Safety Case


J.5 Safety Recommendations applicable to ATS domain



REC_APR_CTRL#2: The State / ANSP should ensure consistency between States regarding the local

heliport / landing site indicator/identifier allocation scheme (e.g. standardization at ICAO level)


See SR_APR_CTRL#22

TableJ-1 : Safety Recommendations applicable to ATS domain

J.6 Safety Recommendations applicable to heliport domain

No safety recommendation applicable to the AID domain is identified in the generic PinS safety case (Part I).

J.7 Safety Recommendations applicable to helicopter domain



REC_APR_CTRL#1 & REC_APR_UNCTRL#1: Helicopters conducting PinS approach procedure in controlled or

uncontrolled airspace should be operated with means to provide relevant weather updates.


The use of Electronic Flight Bagss for the provision of updated weather information relevant to the

approach and destination should reduce the risk in bad weather conditions. Receiving updates via VHF

from ground personnel or ATC can also be considered.

Airborne weather radar provides different weather information.

REC_APR_CTRL#4 & REC_APR_UNCTRL#3: Helicopters flying the PinS approach should be equipped with

HTAWS or a device providing a moving map display, own-ship position, and obstacles. The map and obstacle database should be kept up to date.


HTAWS system will mitigate the risk of collision with terrain and obstacles. The need of such a system

should be assessed depending on local environment and procedure design.

REC_APR_CTRL#5 & REC_APR_UNCTRL#5: All aircraft operating in the vicinity of the PinS approach should

be equipped with secondary surveillance radar transponders or Electronic Conspicuity (EC) device


The SSR transponder or Electronic Conspicuity device would allow the detection of the aircraft by a Traffic

Advisory System or similar/equivalent system.


Generic Safety Case




The need of such a system should be assessed locally depending on local traffic density and airspace

complexity.

REC_APR_CTRL#6: IFR helicopters flying the PinS approach should be equipped with a system enhancing the see and avoid by providing situational awareness of the traffic on this procedure (i.e. a traffic advisory

system)

Helicopter VFR & Visually Controlled

It is considered that Traffic Advisory System or similar/equivalent system is recommended from a

safety point of view considering a generic operational environment (medium complexity of the airspace, different airspace users sharing this airspace and

medium traffic density) to mitigate the risk of mid-air collision.

The Traffic Advisory System will support the situational awareness of the traffic in the vicinity of

the PinS. The need of such a system should be assessed locally


TableJ-2: Safety Recommendations applicable to helicopter domain


Generic Safety Case


ANNEX K – Assumptions from the generic safety case

The complete list of assumptions considered during the generic safety case is presented in PinS generic safety case part I, section 10. The following sections present the assumptions identified as needing local verification within the generic PinS safety case (Part I). These assumptions are identified per domain. The assumptions identified in the generic safety case only relate to AIS domain (section K.3), MET domain (section K.4) and ATS domain (section K.5).

K.1 Assumptions applicable to GNSS domain

No specific assumption to be verified locally and applicable to the GNSS domain is identified in the generic PinS safety case (Part I).

K.2 Assumptions applicable to Flight Procedure Design domain

No specific assumption to be verified locally and applicable to the Flight Procedure Design domain is identified in the generic PinS safety case (Part I).

K.3 Assumptions applicable to AIS domain



ASS_APR_CTRL#28 & ASS_APR_UNCTRL#17: The AIP defines local contingency procedure to be applied by

flight crews in case of radio communication failure AIS VFR & Visually



Table K-1: Assumption applicable to AIS domain

K.4 Assumptions applicable to MET domain



ASS_APR_CTRL#27 & ASS_APR_UNCTRL#16: Local MET information at the alternate destination is provided to

the helicopter operator.

MET provider




Generic Safety Case


K.5 Assumptions applicable to ATS domain



ASS_APR_CTRL#26: Coordination procedures are implemented between ATSP and operator regarding

the activation of prohibited/restricted airspace ATSP VFR & Visually Controlled No specific guidance

Table K-2: Assumption applicable to ATS domain

K.6 Assumptions applicable to heliport domain

No specific assumption to be verified locally and applicable to the heliport domain is identified in the generic PinS safety case (Part I).

K.7 Assumptions applicable to helicopter domain

No specific assumption to be verified locally and applicable to the helicopter domain is identified in the generic PinS safety case (Part I).


Generic Safety Case


— End of document —

© EUROCONTROL - November 2019

This document is published by EUROCONTROL for information purposes. It may be copied in whole or in part, provided that EUROCONTROL

is mentioned as the source and it is not used for commercial purposes (i.e. for financial gains). The information in this document may not

be modified without prior written permission from EUROCONTROL.

wwww.eurocontrol.int

Documents

Helicopter Point in Space Operations in controlled and … · 2019. 12. 18. · Helicopter Point in Space operations in controlled and uncontrolled airspace Generic Safety Case DOCUMENT