Whole Airspace ATM System Safety Case - Preliminary Study Steve Kinnersly

Preliminary Study Participants AEA Technology NLR University of York

Topics Use and value Changes Safety case structure Developing a Safety Case Ownership Conclusions

Use and Value of Safety Cases A tool for managing safety A means to obtain regulatory approval to operate This is the intended use for a Whole Airspace ATM System Safety Case NOT relevant to a Whole Airspace ATM System Safety Case

Value to Safety Management Consistency Completeness Identifying safety impacts of change Managing the impact of change Setting safety targets Confidence in meeting safety targets

A Lesson From UK Railways A mature, regulated, safe transport network But why was it safe? - No whole-system safety case Institutional + technical change  accidents Regulator now requires comprehensive safety cases as a matter of urgency Produce a safety case before you find that you needed it!

Institutional Change Institutional change affects safety Single European Sky (European Commission) Airspace management Regulation Service Providers Change of status - Corporatisation Loss of expertise? Commercial pressures? Harmonisation of safety ESARRs EATMP Safety Assessment Methodology (etc.)

Technical Matters Big technical changes ATM 2000+, Single European Sky Changes have safety implications JAA Future Aviation Safety Team (FAST) study 145 areas of change, 23 are ANS (13%) 9 top priorities for safety, 3 are ANS (33%) Top 2 areas for detailed study soon, 1 is ANS Emergence of New Concepts for Airspace Management FAST study and safety case development should interact

Integration To From Whole-airspace services Area-based services, tightly coupled Area-based services, loosely coupled

Safety Case Structure and Content A Safety Case is structure as well as content Logical Stepping Stones Structure

Representing Structure - GSN GSN - Goal Structuring Notation Linked by logical connections into an argument structure

GSN Being Developed For ... Re-usable modules within/among safety cases Horizontal modules, one argument provides context for another Vertical modules, claims of one argument are the objectives of another Interfaces between safety cases ‘System of systems’ safety cases Safety case architecture All are directly relevant to a Whole Airspace ATM System Safety Case

Alternative Structures - Example 1

Alternative Structures - Example 2

Whole-airspace Services How should safety goals be expressed? Relationship with safety goals for whole airspace and individual areas? What should the safety goals be? How to show that they will be/are achieved? Evidence

Coupling Across Airspace What happens in one area affects another Coupling will increase (planning, ATC systems) ‘Cross-border’ safety implications Example - Resilience with respect to unplanned events Evidence requirements What evidence is needed? How can it be provided? What will be adequate? Argument from simulation?

Developing a Safety Case Purpose High-level safety management tool for developing, integrating and demonstrating the safety of changes in ATM on 10 - 20 year timescale Repository / directory for safety information, including arguments, assumptions, justifications and evidence, that demonstrate the safety of the whole airspace

Tasks Develop Whole Airspace ATM System Safety Case structure and evidence Implement using an appropriate computer tool Identify and document links to existing safety cases / evidence / documentation Total 2 years Omit landing and ground movement Interfaces to existing and planned safety cases Interfacing ‘hooks’ for future developments

Ownership - Why EUROCONTROL? Ownership based on end use Whole-airspace safety remit Safety management development Safety management promotion Important institutional links European Commission JAA National ATM organisations National regulators No other organisation could do this

Conclusions Safety case BEFORE change to MANAGE change A whole-airspace ATM system safety case is desirable Methods, tools and experience exist Focused development over 2 years is feasible Owned by EUROCONTROL