GM5 to AMC4 ATS.OR.205(a)(2) Safety assessment and assurance of changes to the functional system

• ED Decision 2019/022/R found in: ATM/ANS Provision of Services (2017/373) (Mar 2025)

GM5 to AMC4 ATS.OR.205(a)(2) Safety assessment and assurance of changes to the functional system ED Decision 2019/022/R ASSURANCE — SWAL COORDINATION (a) Within the scope of this Regulation, only the ATS provider can identify hazards, assess the associated risks and mitigate or propose mitigating measures where necessary. This requirement is also applicable to software assurance evidence which may include information on the mitigation measures established to address software failures or unintended behaviours. (b) ATS and non-ATS providers may rely on different sets of software assurance processes and, if applicable, different sets of SWALs. (c) For a particular change to the functional system, the safety assessment performed by the ATS provider, and documented in the safety case, may rely on evidence associated with the services provided by a non-ATS provider, as documented in its corresponding safety support case. It should as a minimum demonstrate that the rigour of the assurances produced by the non-ATS provider within the safety support case provides the adequate level of confidence for the purpose of the ATS safety demonstration in the safety case. (d) If SWALs are used, the ATS provider should evaluate the adequacy of the SWALs defined in the software assurance processes of the non-ATS providers and the consistency of the allocated SWALs for the parts of the functional system affected by the change at the non-ATS provider. GM5 to AMC4 ATS.OR.205(a)(2) Safety assessment and assurance of changes to the functional system ED Decision 2019/022/R ASSURANCE — SWAL COORDINATION (a)       Within the scope of this Regulation, only the ATS provider can identify hazards, assess the associated risks and mitigate or propose mitigating measures where necessary. This requirement is also applicable to software assurance evidence which may include information on the mitigation measures established to address software failures or unintended behaviours. (b)       ATS and non-ATS providers may rely on different sets of software assurance processes and, if applicable, different sets of SWALs. (c)        For a particular change to the functional system, the safety assessment performed by the ATS provider, and documented in the safety case, may rely on evidence associated with the services provided by a non-ATS provider, as documented in its corresponding safety support case. It should as a minimum demonstrate that the rigour of the assurances produced by the non-ATS provider within the safety support case provides the adequate level of confidence for the purpose of the ATS safety demonstration in the safety case. (d)       If SWALs are used, the ATS provider should evaluate the adequacy of the SWALs defined in the software assurance processes of the non-ATS providers and the consistency of the allocated SWALs for the parts of the functional system affected by the change at the non-ATS provider.