oSIST prEN 16154:2010

SLOVENSKI STANDARD
oSIST prEN 16154:2010
01-december-2010
8SUDYOMDQMH]UDþQHJDSURPHWD6WRSQMHYDURYDQMDSURJUDPVNHRSUHPH
Air Traffic Management - Software assurance levels
Flugverkehrsmanagement - Software-Sicherheitsanforderungsstufen
Gestion du trafic aérien - Niveaux d'assurance logicielle
Ta slovenski standard je istoveten z: prEN 16154
ICS:
03.220.50 =UDþQLWUDQVSRUW Air transport
35.240.60 Uporabniške rešitve IT v IT applications in transport
transportu in trgovini and trade
oSIST prEN 16154:2010 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
oSIST prEN 16154:2010

---------------------- Page: 2 ----------------------
oSIST prEN 16154:2010


EUROPEAN STANDARD
DRAFT
prEN 16154
NORME EUROPÉENNE

EUROPÄISCHE NORM

September 2010
ICS
English Version
Air Traffic Management - Software assurance levels
Gestion du trafic aérien - Niveaux d'assurance logicielle Flugverkehrsmanagement - Software-
Sicherheitsanforderungsstufen
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee CEN/TC 377.

If this draft becomes a European Standard, CEN members are bound to comply with the CEN/CENELEC Internal Regulations which
stipulate the conditions for giving this European Standard the status of a national standard without any alteration.

This draft European Standard was established by CEN in three official versions (English, French, German). A version in any other language
made by translation under the responsibility of a CEN member into its own language and notified to the CEN Management Centre has the
same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland,
Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom.

Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are aware and to
provide supporting documentation.

Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without notice and
shall not be referred to as a European Standard.


EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2010 CEN All rights of exploitation in any form and by any means reserved Ref. No. prEN 16154:2010: E
worldwide for CEN national Members.

---------------------- Page: 3 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
Contents Page
Foreword . 4
Introduction . 5
1 Scope . 6
2 References. 6
3 Terms and definitions . 7
4 Software Assurance Levels (SWAL) . 7
4.1 Allocation . 8
4.2 Likelihood assessment . 8
4.3 Likelihood justification . 8
5 SWAL Objectives per Process . 9
5.1 General . 9
5.2 Primary Life Cycle Processes . 9
5.2.1 The Acquisition Process . 9
5.2.2 The Supply Process . 9
5.2.3 The Development Process . 9
5.2.4 The Operation Process . 9
5.2.5 The Maintenance Process . 9
5.3 Supporting Life Cycle Processes . 9
5.3.1 The Documentation Process . 9
5.3.2 The Configuration Management Process . 10
5.3.3 The Quality Assurance Process . 10
5.3.4 The Verification Process . 10
5.3.5 The Joint Review Process . 10
5.3.6 The Audit Process . 10
5.3.7 The Problem/Change Resolution Process . 10
5.4 Organisational Life Cycle Processes . 10
5.5 COTS processes . 10
5.5.1 COTS planning process . 10
5.5.2 COTS acquisition process . 11
5.5.3 COTS verification process . 11
5.5.4 COTS configuration management process . 11
Annex SA (normative) . 12
Annex A (normative) Checklist . 17
A.1 Interoperability Regulation Annex II Essential Requirements Part A: General requirements . 17
A.2 Interoperability Regulation Annex II Essential Requirements Part B: Specific requirements . 24
A.2.1 Systems and procedures for airspace management . 24
A.2.2 Systems and procedures for air traffic flow management . 25
A.2.3 Systems and procedures for air traffic services . 26
A.2.4 Communication systems and procedures for ground-to-ground, air-to-ground and air-to-air
communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
A.2.5 Navigation systems and procedures . 31
A.2.6 Surveillance systems and procedures . 31
A.2.7 Systems and procedures for aeronautical information services . 32
2

---------------------- Page: 4 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
A.2.8 Systems and procedures for the use of meteorological information . 33
Annex B (informative) Title of this document in the official languages . 34
Bibliography . 35

3

---------------------- Page: 5 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
Foreword
This document (prEN 16154:2010) has been prepared by Technical Committee CEN/TC 377 “Air Traffic
Management”, the secretariat of which is held by DIN.
This document is currently submitted to the CEN Enquiry.
This document has been prepared under a mandate given to the CEN by the European Commission and
developed in cooperation with EUROCAE to support Essential Requirements of the Single European Sky
Interoperability Regulation.
Under this regulation, the use of a Community Specification (CS) is a means of compliance to the Essential
Requirements of the Regulation and/or the relevant implementing rules for interoperability.
For the relationship with the Single European Sky Interoperability Regulation see Annex SA, the Standards
Annex, of this document.
4

---------------------- Page: 6 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
Introduction
The European Union launched the "Single European Sky" (SES) Legislation in 2002 which was adopted in 2004.
The SES legislation is based on a framework of 4 regulations, which includes the Interoperability Regulation
(EC 552/2004). The objective of the Interoperability Regulation is to ensure interoperability of the European Air
Traffic Management Network (EATMN) consistent with air navigation services.
An increasing proportion of functions of the EATMN are implemented by software and these functions are
becoming more safety-critical. It is therefore necessary to define guidance on how to standardise the assurances
that may be provided for software.

5

---------------------- Page: 7 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
1 Scope
The present document is for the production of assurance evidence for software used in ground-based systems
and their constituents.
This Community Specification on Software Assurance Levels (SWAL) is intended to apply to software that is part
of the EATMN, focusing only on it’s “ground” segment and providing a reference against which stakeholders can
assess their own practices for software specification, design, development, operation, maintenance, evolution and
decommissioning.
This Community Specification defines the Technical, Operational and Maintenance requirements for Software
Assurance Levels to demonstrate compliance with the applicable (see Annex A) Essential Requirements of the
Regulation (EC) N° 552/2004 of the European Parliament and of the Council on the interoperability of the
European Air Traffic network (“the Interoperability regulation”).
Requirements in the present document which refer to “should” statements or recommendations in the normatively
referenced material (2.1) are to be interpreted as fully normative (“shall”) for the purpose of compliance with the
present document.

2 References
The following referenced documents are indispensable for the application of the present document. For dated
references, only the edition cited applies. For non-specific references, the latest edition of the referenced
document (including any amendments) applies.
2.1 Normative references
1)
EUROCAE ED-153 (august 2009), Guidelines for ANS software safety assurance .
2.2 Informative references
ED-109 Guidelines for the Communication Navigation Surveillance and Air Traffic Management (CNS/ATM)
systems software integrity assurance
IEC 61508 Functional Safety of electrical/electronic/programmable electronic safety-related systems
Regulation (EC) No 552/2004 (as amended) of the Regulation of the European Parliament and of the Council of
10 March 2004 on the interoperability of the European Air Traffic Management network (interoperability
Regulation), OJ L 96, 31.03.2004 as amended by Regulation (EC) No 1070/2009 of the European Parliament and
of the Council of 21 October 2009 amending Regulations (EC) No 549/2004, (EC) No 550/2004, (EC) No
551/2004, (EC) No 552/2004 in order to improve the performance and sustainability of the European aviation
system

1) ED 153 has been made available to the responsible CEN technical body, CEN/TC 377 ‘Air Traffic Management’, as
document TC377 N 112.
6

---------------------- Page: 8 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
3.1
ANS
Air Navigation Service
3.2
COTS
Commercial off the shelf software, means a commercial available application sold by vendors through public
catalogue listings and not intended to be customised or enhanced;

3.3
CS
Community Specification
3.4
EATMN
European Air Traffic Management Network
3.5
EC
European Commission
3.6
EUROCAE
European Organisation for Civil Aviation Equipment
3.7
SES
Single European Sky
3.8
Software
means computer programmes and corresponding configuration data, including non-developmental software, but
excluding electronic items, namely application specific integrated circuits, programmable gate arrays or solid-state
logic controllers.

NOTE Non-developmental software includes proprietary software, COTS software, re-used software

3.9
SWAL
Software Assurance Level
4 Software Assurance Levels (SWAL)
The processes detailed below are those that are required in order to be able to provide assurance evidence for
software in EATMN in compliance with the present document.
7

---------------------- Page: 9 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
4.1 Allocation
The allocation of a Software assurance level shall comply with the requirements defined in ED-153, 3.6.2.0 while
replacing the table with the following table 1:
Table 1
Effect Severity
12 3 4
Class
Likelihood of
generating such
an effect (Pe x Ph)
SWAL1 SWAL2 SWAL3 SWAL4
Very Possible
SWAL2 SWAL3 SWAL4 SWAL4
Possible
SWAL3 SWAL4 SWAL4 SWAL4
Very Unlikely
Extremely Unlikely SWAL4 SWAL4 SWAL4 SWAL4

The Grading Policy, i.e. the aim of a SWAL including what kind of overall objective is intended shall comply with the
requirements in ED-153, 3.6.4.0 and 3.6.4.1. “Independence in performing the prevention” in table 11 (column 4) of
3.6.4.1 shall be understood as “Independence in checking the prevention”.
NOTE Examples of the use of the SWAL allocation process are described in ED-153, 3.6.3 and 3.6.1.0.
4.2 Likelihood assessment
Within the SWAL allocation process, for the assessment of the likelihood of an effect, ED-153, 3.6.2.1 shall apply.
4.3 Likelihood justification
The factors detailed in ED-153, 3.6.2.2. shall be considered when justifying the likelihood of an effect during the
SWAL allocation process.
8

---------------------- Page: 10 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
5 SWAL Objectives per Process
5.1 General
The identification of objectives applicable to each SWAL is addressed in ED-153, i.e. Chapters 4, 5 and 7 in terms
of Primary Life Cycle Processes, Supporting Life Cycle Processes and COTS-related processes.
NOTE 1 If different assurance levels from other reference documents such as ED-109, IEC 61508 are used, annex A of
ED-153 provides a method for gap analysis.
NOTE 2 Description and scenarios for roles and responsibilities are detailed in ED-153 Annex B.
5.2 Primary Life Cycle Processes
5.2.1 The Acquisition Process
The Acquisition Process that details the objectives and tasks that shall be complied with by the acquirer is defined
in ED-153, 4.1. For objectives 4.1.2 and 4.1.3 of ED-153 independence is only required for SWAL 1 and 2.
5.2.2 The Supply Process
The Supply Process that details the objectives and tasks that shall be complied with by the supplier is defined in
ED-153, 4.2.
5.2.3 The Development Process
The Development Process detailing the objectives and tasks that shall be complied with by the developer is
defined in ED-153, 4.3. For objectives 4.3.1 and 4.3.2 of ED-153 independence is only required for SWAL 1 and
2.
5.2.4 The Operation Process
The Operation Process that details the objectives and tasks that shall be complied with by the operator is defined
in ED-153, 4.4. For objectives 4.4.5 of ED-153 independence is only required for SWAL 1 and 2.
5.2.5 The Maintenance Process
The Maintenance Process that details the objectives and tasks that shall be complied with by the maintainer is
defined in ED-153, 4.5. For objectives 4.5.2 and 4.5.5 of ED-153 independence is only required for SWAL 1 and
2.
5.3 Supporting Life Cycle Processes
5.3.1 The Documentation Process
The Documentation Process that details the objectives and tasks that shall be complied with by all concerned
parties is defined in ED-153, 5.1.
9

---------------------- Page: 11 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
5.3.2 The Configuration Management Process
The Configuration Management Process that details the objectives and tasks that shall be complied with by all
concerned parties is defined in ED-153, 5.2. The software configuration management shall be performed at the
Software executable level (for SWAL 1 Software, only).
5.3.3 The Quality Assurance Process
The Quality Assurance Process that details the objectives and tasks that shall be complied with by all concerned
parties is defined in ED-153, 5.3.
5.3.4 The Verification Process
The Verification Process that details the objectives and tasks that shall be complied with by all concerned parties
is defined in ED-153, 5.4.
5.3.5 The Joint Review Process
The Joint Review Process that details the objectives and tasks that shall be complied with by all concerned
parties is defined in ED-153, 5.6.
5.3.6 The Audit Process
The Audit Process that details the objectives and tasks that shall be complied with by all concerned parties is
defined in ED-153, 5.7. Process implementation is not required for SWAL 4.
5.3.7 The Problem/Change Resolution Process
The Problem/Change Resolution Process that details the objectives and tasks that shall be complied with by all
concerned parties is defined in ED-153, 5.8. For objectives 5.8.1, 5.8.3 and 5.8.4 of [1] independence is only
required for SWAL 1 and 2.
5.4 Organisational Life Cycle Processes
Organisational Life Cycle objectives shall be met per SWAL.
NOTE 1 The Management Process that details the objectives and tasks of all concerned parties is defined in ED-153, 6.1.
NOTE 2 The Infrastructure Process that details the objectives and tasks of all concerned parties is defined in ED-153, 6.2.
NOTE 3 The Improvement Process that details the objectives and tasks of all concerned parties is defined in ED-153, 6.3.
NOTE 4 The Training Process that details the objectives and tasks of all concerned parties is defined in ED-153, 6.4.
5.5 COTS processes
5.5.1 COTS planning process
The planning process that details the objectives and tasks that shall be complied with is defined in ED-153, 7.2.2.
10

---------------------- Page: 12 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
5.5.2 COTS acquisition process
The acquisition process that details the objectives and tasks that shall be complied with is defined in ED-153,
7.2.3.
5.5.3 COTS verification process
The verification process detailing the objectives and tasks that shall be complied with is defined in ED-153, 7.2.4.
NOTE Some alternative methods are described in ED-153, 7.2.4.2 and 7.2.4.3.
5.5.4 COTS configuration management process
The configuration management process that details the objectives and tasks that shall be complied with is defined
in ED-153, 7.2.5.
11

---------------------- Page: 13 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
Annex SA
(normative)
The present Annex provides a relationship between the present document and the Essential Requirements of the
Single European Sky Interoperability Regulation (as amended).
All Software of systems of the EATMN and their constituents shall comply with the Essential Requirements of the
Interoperability Regulation (as amended) as defined and described in the traceability matrixes of the present
Annex (table SA1 and table SA2 below).
Table SA.1 — Traceability from (EC) 552/2004 as amended by (EC) 1070/2009 to clauses of the present
document
Essential) Requirements (ERs) Clause(s) of the present Qualifying remarks/Notes
of (EC) 552/2004 (as amended document
by (EC) 1070/2009) Annex II,
Part A
ER1 Seamless operation Not applicable
ER2 Support for New Concepts of
Not applicable
Operation
4.1
4.2
4.3 ER3 considers safety
5.1 management as an essential
5.2.1 factor to achieve the high level
5.2.2 of safety agreed for systems
5.2.3 and procedures of the EATMN.
5.2.4 Software elements developed
5.2.5 on the basis of a safety
5.3.1 management system that
ER3 Safety 5.3.2 complies with the requirements
5.3.3 of the present document may
5.3.4 claim presumption of conformity
5.3.5 concerning the level of software
5.3.6 assurance.
5.3.7 The present document does not
5.4 give presumption of conformity
5.5.1 related to anything else if not
5.5.2 stated otherwise in table SA1.
5.5.3
5.5.4
ER4 Civil-military coordination Not applicable
ER5 Environmental Constraints Not applicable
ER6 Principles governing the
Not applicable
logical architecture of systems
"to be continued"
12

---------------------- Page: 14 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
Table SA.1 (continued)
Essential) Requirements (ERs) Clause(s) of the present Qualifying remarks/Notes
of (EC) 552/2004 (as amended document
by (EC) 1070/2009) Annex II,
Part A
4.1
4.2
4.3 ER7 requires that systems shall
5.1 be designed, built and
5.2.1 maintained on the grounds of
5.2.2 sound engineering principles.
5.2.3 Software elements for which the
5.2.4 SWAL has been allocated
5.2.5 according the requirements of
5.3.1 the present document may
ER7 Principles governing the
5.3.2 claim presumption of conformity
construction of systems
5.3.3 concerning the level of software
5.3.4 assurance.
5.3.5 The present document does not
5.3.6 give presumption of conformity
5.3.7 related to other engineering
5.4 principles or anything else if not
5.5.1 stated otherwise in table SA1.
5.5.2
5.5.3
5.5.4

The present document does not give presumption of conformity related to any of the Essential Requirements of
(EC) 552/2004 (as amended by (EC) 1070/2009) Annex II, Part B.
Table SA.2 — Traceability from clauses of the present document to (EC) 552/2004 as amended by (EC)
1070/2009
Clause(s) of the present Essential) Requirements (ERs) Qualifying remarks/Notes
document of(EC) 552/2004 as amended by
(EC) 1070/2009 Annex II, Part A
and B
4.1 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL allocation as one
construction of systems. element of the required safety
requirement (ER3) and as one
principle of the required sound
engineering principles (ER7)
4.2 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL allocation as one
construction of systems. element of the required safety
requirement (ER3) and as one
principle of the required sound
engineering principles (ER7)
"to be continued"
13

---------------------- Page: 15 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
Table SA.2 (continued)
Clause(s) of the present Essential) Requirements (ERs) Qualifying remarks/Notes
document of(EC) 552/2004 as amended by
(EC) 1070/2009 Annex II, Part A
and B
4.3 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL allocation as one
construction of systems. element of the required safety
requirement (ER3) and as one
principle of the required sound
engineering principles (ER7)
5.1 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.2.1 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.2.2 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.2.3 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.2.4 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.2.5 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
"to be continued"
14

---------------------- Page: 16 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
Table SA.2 (continued)
Clause(s) of the present Essential) Requirements (ERs) Qualifying remarks/Notes
document of(EC) 552/2004 as amended by
(EC) 1070/2009 Annex II, Part A
and B
5.3.1 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.3.2 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.3.3 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.3.4 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.3.5 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.3.6 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
5.3.7 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one element of
the required safety requirements
(ER3) and as one principle of the
required sound engineering
principles (ER7)
"to be continued"
15

---------------------- Page: 17 ----------------------
oSIST prEN 16154:2010
prEN 16154:2010 (E)
Table SA.2 (continued)
Clause(s) of the present Essential) Requirements (ERs) Qualifying remarks/Notes
document of(EC) 552/2004 as amended by
(EC) 1070/2009 Annex II, Part A
and B
5.4 ER 3 Safety. Presumption of conformity is
ER 7 Principles governing the limited to SWAL-dependent life
construction of systems. cycle processes as one
...