Consolidated List of Safety Requirements and Recommendations This appendix presents the list of safety requirements and recommendations for Multiple Remote Tower obtained from the safety assessment presented in this report. As mentioned before, this is not the complete list of requirements but only the ones specific to Multiple Remote Tower. They need to be added to the list of requirements for Single Remote Tower in order to obtain the complete list of requirements specifying Multiple Remote Tower. Some additional explanation on each requirement as well as evidence (or reference to detailed evidence) on their validity obtained from the validation exercises and other project activities are also provided. In addition and based on those evidence, the corresponding maturity level is defined and some activities are recommended to be done (for the corresponding next phase). The reference to the corresponding OSED requirements is also included in the table. Safety Requirements (Functionality and Performance) REQ Description Additional Explanation Validation Activity / Evidence Next activities / recommendations Satisfies G-G SR-06M1 Ground-ground communication with relevant adjacent units (i.e. for each airport within the cluster allocated to the same RTM position) shall be available to the controller in a MRVT position Note: as per the aeronautical fixed service in accordance with ICAO Annex 11, Chapter 6.2 This information is required, as in current operations, to provide ATC services to the several aerodromes. Trials 1, 2 and 3, mainly based on debriefings with controllers. Define in detail the technical support and the way to provide this information to the controller SO-001 SO-046 SO-047 SR-06M2 ATCO shall be aware about which adjacent unit a communication (in and out) is related to. Note: in low density aerodromes no additional technical feature may be requested but for more busy aerodromes an indication on the corresponding adjacent unit should Controller needs to know how to communicate with a specific adjacent unit and to identify from which adjacent unit a communication comes from This information is Trials 1, 2 and 3, mainly based on debriefings with controllers. Define in detail the technical support and the way to provide this information to the controller SO-001 SO-046 SO-047
SR-07M02 Controller shall be aware about which airport a communication (in and out) with traffic under his/her responsibility is related to This service is required, to provide ATC services to the appropriate vehicles / traffic. In case of similar call signs, Call sign similarity solution from EUROCONTROL call sign similarity service should be applied as per MRT_REC_PR3 in [16]. A potential way of doing so is considering MRT_REC_PR10 in the HP assessment [16] proposing to include the airport call-sign for each pilot transmission. Trials 1, 2, 3 and 4 and in particular from the COMM survey. REC: For the type of aerodrome addressed in this safety report (i.e. low density aerodromes) the controller seems to be able to do that without any technical support. For aerodromes with a different operational environment this capability needs to be reassessed and potentially a technical support should be provided to the controller. Assess the impact of RT on communication load. SO-002 SO-003 SO-004 SO-005 SO-009 SO-010 SO-011 SO-012 SO-013 SO-014 SO-017 SO-019 SO-020 SO-021 SO-024 SO-025 SO-026 SO-027 SO-029 SO-030 SO-031 SO-035 SO-046 SO-050 SO-052 SR-07M03 Air-ground communication function in the MRTV position shall allow: - to receive communication from all traffic in all the aerodromes at the same time - to transmit to traffic independently This service is required, to provide ATC services to the appropriate vehicles / traffic. Trials 1, 2, 3 and 4 and in particular from the COMM survey. Define in detail the technical support and the way to make this service available. SO-002 SO-003 SO-004 SO-005 SO-009 SO-010 SO-011
for each aerodrome Assess the impact of RT on communication load This is also recommended by MRT_REC_TS9 and MRT_REC_TS10 in the HP assessment [16]. SO-012 SO-013 SO-014 SO-017 SO-019 SO-020 SO-021 SO-024 SO-025 SO-026 SO-027 SO-029 SO-030 SO-031 SO-035 SO-046 Surf-G (airport personnel/vehicles inside manoeuvring area) SR-08M01 Communications for the control of relevant vehicles, other than aircraft, on manoeuvring areas (i.e. at each aerodrome under control of the same ATCO) shall be available to the controller in a MRTV position. Note: as per the Surface movement control service in accordance with ICAO Annex 11, Chapter 6.3 This service is required, to provide ATC services to the relevant vehicles in the appropriate aerodrome. Trials 1, 2 3 and 4, mainly based on debriefings with controllers and also from the COMM survey. Define in detail the technical support and the way to make this service available. SO-015 SO-017 SO-021 SO-023 SO-026 SO-027 SO-035 SR-08M02 ATCO shall be aware about which This service is required, Trials 1, 2, 3 and 4 REC: For the type SO-015
airport a communication (in and out) with vehicles under his/her responsibility is related to to provide ATC services to the appropriate vehicles / traffic. A potential way of doing so is considering MRT_REC_PR11 in the HP assessment [16] proposing to include the airport call-sign for each vehicle transmission. and in particular from the COMM survey. of aerodrome addressed in this safety report (i.e. low density aerodromes) the controller seems to be able to do this task without any technical support. But for aerodromes with a different operational environment this capability needs to be reassessed and potentially a technical support should be provided to the controller. Assess the impact of RT on communication load SO-017 SO-021 SO-023 SO-026 SO-027 SO-035 SR-08M03 Communication function in the MRTV position shall allow to transmit communication to vehicles independently for each aerodrome. This service is required, to provide ATC services to the appropriate vehicles / traffic. Trials 1, 2, 3 and in particular from the COMM survey. Define in detail the technical support and the way to make this service available. Assess the impact of RT on communication load SO-015 SO-017 SO-021 SO-023 SO-026 SO-027 SO-035 Surf-G (airport personnel/vehicles
outside manoeuvring area) SR-10M1 Communication with airport personnel in charge of runway inspections shall be available to controller in the MRVT position for the coordination of runway inspections in order to determine runway conditions and detect potential FODs/animals This service is required, to provide ATC services to the relevant vehicles in the appropriate aerodrome. Trials 1, 2 3 and 4, mainly based on debriefings with controllers and also from the COMM survey. Define in detail the technical support and the way to make this service available. SO-032 SR-10M2 ATCO shall be aware about which airport a communication (in and out) with airport personnel in charge of runway inspections is related to. This service is required, to provide ATC services to the appropriate vehicles / traffic. A potential way of doing so is considering MRT_REC_PR11 in the HP assessment [16] proposing to include the airport call-sign for each transmission. Trials 1, 2, 3 and 4 and in particular from the COMM survey. REC: For the type of aerodrome addressed in this safety report (i.e. low density aerodromes) the controller seems to be able to do this task without any technical support. But for aerodromes with a different operational environment this capability needs to be reassessed and potentially a technical support should be provided to the controller. Assess the impact of RT on communication load SO-041 SO-043
Visualisation system SR-14M01 Visual presentation of the traffic in the vicinity of each aerodrome under the responsibility of the same controller shall be provided to the controller in the MRVT position. Note: this includes final approach and initial climb areas, and it has to take into account specific traffic evolution for landing and take-off as it is the case for helicopters. This service is required, as in current operations, to provide ATC services. This requirement is also an output from the HP assessment. Trials 1, 2, 3 and 4 Some evidence has been collected on the capability of the visualisation system to provide information to be used for the provision of ATC services. Some items are still to be further assessed as it is explained for SR-26 (in particular for supporting the controller to judge distances and separation between traffic and to identify aircraft on the vicinity of the aerodrome). REC: for busiest aerodromes the need of advanced features supporting / improving the information provided in the visualisation system should be evaluated in more detail in order to ensure that tasks as per requirement can be performed properly, in particular to ensure detection of relevant objects and continuously monitoring them. Specify the technical characteristics of the Visualisation System in terms of accuracy, resolution, refreshment rate, etc. based on the characteristics of the RVT platform used during the validation exercises. SO-002 SO-003 SO-004 SO-005 SO-006 SO-007 SO-008 SO-009 SO-010 SO-028 SO-029 SO-030 SO-044 SO-045 SO-046 SO-047
responsibility from a same MRVT position. Note: the same examples as per Single RT apply. PANS ATM as it is done in current operations when providing Tower controller services. This is to be applied for the several aerodromes in the same MRVT. Any additional procedures related to the fact that the ATC service is provided to several aerodromes from a Remote location have been captured in separated requirements (see below). MRTV position except for reduced visual separation. AS for the Single Remote Tower, validation exercises where done in passive shadow mode for the ATC services, so none additional evidence have been collected with respect to this requirement. Evidence collected for the moment show that the capability of performing the following tasks from a Multiple Remote Tower is lower than in current operations (the same as for Single Remote Tower): * aircraft identification * ensuring appropriate separation between traffic (in particular concerning the application of considering busiest or more aerodromes: - Further evaluate the different enhanced visual features for improving the capability of identifying aircraft. - Further assess the capability of evaluation distances / judge separation for the provision of reduced separation (and the potential need for enhanced visual features or for changing procedures). - Evaluate the capability of the ATCO to perform ATC related tasks in a timely manner (active mode validation exercise). - Assess capability of ATC provision under abnormal and degraded modes of operations. SO-006 SO-007 SO-008 SO-009 SO-010 SO-011 SO-012 SO-013 SO-014 SO-015 SO-016 SO-017 SO-018 SO-019 SO-020 SO-021 SO-022 SO-023 SO-024 SO-025 SO-026 SO-027 SO-028 SO-029 SO-030 SO-031 SO-032 SO-033 SO-034 SO-035 SO-036 SO-037 SO-044
reduced separation). * Detection of potential flights towards terrain * Appropriately assess weather conditions impacting traffic For some other ATC tasks any evidence was collected as they were not addressed during the trials (for example ensuring appropriate separation with restricted areas or managing emergency situations). See more detail on the validation results in Appendix E of Trial 2. Nevertheless, due to the restricted scope of the Operational Improved addressed in this SAR, it is concluded that, on the basis of the collected evidences, remote tower To specifically test all the corresponding procedures in an active way. This is also recommended by MRT_REC_TS1 from the HP assessment [16]. Initial results on these items as well as some other items are included in the validation results report in Appendix E, trial 2. Some additional items related to further validation activities for this safety requirement have also been identified in the HP assessment report [16]: MRT_REC_TS2, MRT_REC_TS3, MRT_REC_TS4 MRT_REC_TS5 SO-045 SO-046 SO-047
SR-34M01 If a RTC Supervisor role is implemented - Supervisor in a shall access functions for the planning, coordination and monitoring of the upcoming and present traffic flow, in the purpose of tactical opening and closure of MRVTs and allocation of airports to them taking into account the capacity associated to each cluster of aerodromes. Capacity of the aerodrome is done in current operations taking into account the capability to provide ATC services. This capacity needs also to take into account the fact that the services are remotely provided and to several aerodromes. In case this role is implemented, the supervisor has to ensure the appropriate allocation of staff and aerodromes to the several RMT in order to ensure a safe provision of the service. The staff allocation and the definition of shifts patterns should be done as per MRT_REC_PR7 in the HP assessment [16]. Not addressed during the trials but during internal discussions and a dedicated workshop with operational experts. To define the specific procedures and information needed for the supervisor to manage the allocation of clusters, RTM and staff within the RTC. SR-34M02 If a RTC Supervisor role is implemented - Supervisor in a RTC shall provide relevant support to controllers in a MRVT position in order to ensure the safe provision of remote ATC services to multiple aerodromes in terms of (as One of the roles of the supervisor is to support controllers in their tasks as necessary. Not addressed during the trials but during internal discussions and a dedicated workshop with operational experts. To define in which situations, and which are the tasks (and the information needed) the supervisor would be able to perform in
Note: as per L006, no assessment on the proposed advanced feature has been performed in the frame of this Safety Assessment. This need to be done for a specific implementation in case an advanced feature is to be used in the RTM. Note: This recommendation may be significantly relevant for certain physical implementation of the visualisation system. It also needs to be considered as a support to SR-68M01. This is supported by MRT_REC_DS1, MRT_REC_DS2 and MRT_REC_DS3 from the HP assessment [16]. SO-045 SO-046 SO-047 SRec-14M03 Visual indication supporting the estimation of the position of the aircraft with respect to the terrain in the vicinity of the aerodrome may be provided to the controller Note: from all the advanced visual features tested in this project radar tracking feature would be the best option in this case, noting that the tracking could be done based on other surveillance means than radar, as ADS-B, WAM, etc. Note: as per L006, no assessment on the proposed advanced feature has been performed in the frame of this Safety Assessment. This need to be done for a specific implementation in case an advanced feature is to be used in the RTM Note: This recommendation may be significantly relevant for certain physical implementation of the visualisation system. It also needs to be considered as a support to SR-68M01. This is supported by MRT_REC_DS1, MRT_REC_DS2 and MRT_REC_DS3 from SO-28
the HP assessment [16]. SRec-16M02 Visual indication supporting aircraft/vehicles identification in the manoeuvring of each aerodrome allocated to the same MRVT position should be provided to the controller Note: from all the advanced visual features tested in this project visual tracking feature would be the best option in this case Note: this is a recommendation in the operational environment addressed in this assessment. For airports with a higher traffic density and complexity this recommendation is to be considered to be a shall requirement. Note: as per L006, no assessment on the proposed advanced feature has been performed in the frame of this Safety Assessment. This need to be done for a specific implementation in case an advanced feature is to be used in the RTM. Note: This recommendation may be significantly relevant for certain physical implementation of the visualisation system. It also needs to be considered as a support to SR-68M01. This is supported by MRT_REC_DS1, MRT_REC_DS2 and MRT_REC_DS3 from the HP assessment [16]. SO-014 SO-015 SO-016 SO-017 SO-045 SO-046 SO-047 SRec-16M03 Visual indication supporting the identification of aircraft/vehicles/obstacles/people entering into or being close to a runway should be provided to the controller Note: from all the advanced features tested in this project visual tracking feature would be the best option in this case Note: this is a recommendation in the operational environment addressed in this assessment. For airports with a higher traffic and movement density and complexity, this recommendation is to be considered to be a shall requirement (this functionality becoming Same SO-035
Visualisation System SR-52M01 For a local implementation, corresponding assurance level for the software development process of the relevant components of the Visualisation System as well as its availability shall be defined based on applicable regulation. Note: as per the results from this safety assessment a SWAL 3 for the critical aerodrome view (including the sensors in the airport premises, the link between them and the RTM and the displays on which the visual presentation is provided to the ATCO) is proposed. Note: as per the results from this safety assessment the likelihood of loss of a critical aerodrome view on the visualisation system is to be no more than 7e-4 per operational hour. Note: critical view refers to parts of the visual representation of the runway, and the initial climb out and final approach areas Specific software assurance level (SWAL) is to be defined for the new Visualisation System based on the potential associated risk in case of failure of this equipment. The same for the availability of this system. Analytical assessment based on expert judgement and project reviews as well as during discussions related to Trial 4. To define the assurance level and the availability and to apply the corresponding assurance activities in order to satisfy them. SO-102 SO-103 SO-104 SO-105 SO-106 SO-107 SO-108 SO-109 SO-110 SO-111 SO-114 SO-115 SO-116 SO-117 SO-119 SO-120 SO-121 SO-123 SO-124 SO-125 SO-126 SO-127 SO-128 SO-129 SO-130 SO-131 SO-132 SO-134
ATCO SR-61M01 In case of loss or degradation of communication with one or several adjacent ATSU units in a MRVT position relevant fall-back procedures shall be applied. Note: supervisor in the RTC may support the controller to apply these procedures Mitigation mean identified from the hazard assessment. Assessment based on expert judgement and project reviews as well as during discussions related to Trial 4. Not tested during simulations. To define the procedure to be applied, the potential several actors involved in in such situation (ATCO, Supervisor, etc.), and to test its efficiency. SO-101 SR-62M01 In case of failure or degradation of communication with vehicles/personnel operating on the manoeuvring area for one or several airports allocated to a MRVT position relevant fall-back procedures shall be applied (e.g. use of flash gun lights). Note: supervisor in the RTC may support the controller to apply these procedures Mitigation mean identified from the hazard assessment. Assessment based on expert judgement and project reviews as well as during discussions related to Trial 4. Not tested during simulations. To define the procedure to be applied, the potential several actors involved in in such situation (ATCO, Supervisor, etc.), and to test its efficiency. SO-113 SO-115 SO-117 SO-120 SO-121 SO-123 SO-127 SO-132 SO-134 SR-64M01 In case of loss of information or detected inappropriate information on a critical view of the visualisation(due to a technical failure) a specific Mitigation mean identified from the hazard assessment. Assessment based on expert judgement and project reviews as well as during discussions related to Trial 4. To define the procedure to be applied, the potential several actors involved in in such situation (ATCO, Supervisor, etc.), and to SO-102 SO-103 SO-104 SO-105 SO-106
procedure shall be applied taking into account the timeframe of the failure mode (e.g. provision of ATC services limiting the simultaneous operations in the area of responsibility, using PTZ camera to get the corresponding lost image, stopping the service for all the concerned aerodromes, transferring some or all of them to another module in the RTC, etc.). Note: critical view is defined in SR52 Note: Supervisor in the RTC my support the controller to apply these procedures. Not tested during simulations. test its efficiency. SO-107 SO-108 SO-109 SO-110 SO-111 SO-114 SO-115 SO-116 SO-117 SO-119 SO-120 SO-121 SO-123 SO-124 SO-125 SO-126 SO-127 SO-128 SO-129 SO-130 SO-131 SO-132 SO-134 SR-66M01 In case of failure or degradation of air-ground communication with traffic in a MRVT position, relevant procedures from PANS ATM [9] shall be applied (e.g. issuing clearances though the relevant APP controller) Note: supervisor in the RTC may support the controller to apply these procedures. Mitigation mean identified from the hazard assessment. Assessment based on expert judgement and project reviews as well as during discussions related to Trial 4. Not tested during simulations. To define the procedure to be applied, the potential several actors involved in in such situation (ATCO, Supervisor, etc.), and to test its efficiency. SO-102 SO-103 SO-104 SO-105 SO-106 SO-107 SO-108 SO-109 SO-110 SO-111 SO-114 SO-115