1. Whole Airspace ATM System Safety Case - Preliminary Study
Steve Kinnersly

2. Preliminary Study Participants
AEA Technology
NLR
University of York

3. Topics Use and value Changes Safety case structure
Developing a Safety Case
Ownership
Conclusions

4. Use and Value of Safety Cases
A tool for managing safety
A means to obtain regulatory approval to operate
This is the intended use for a
Whole Airspace ATM System Safety Case
NOT relevant to a
Whole Airspace ATM System Safety Case

5. Value to Safety Management
Consistency
Completeness
Identifying safety impacts of change
Managing the impact of change
Setting safety targets
Confidence in meeting safety targets

6. A Lesson From UK Railways
A mature, regulated, safe transport network
But why was it safe? - No whole-system safety case
Institutional + technical change  accidents
Regulator now requires comprehensive safety cases as a matter of urgency
Produce a safety case before you find that you needed it!

7. Institutional Change Institutional change affects safety
Single European Sky (European Commission)
Airspace management
Regulation
Service Providers
Change of status - Corporatisation
Loss of expertise?
Commercial pressures?
Harmonisation of safety
ESARRs
EATMP Safety Assessment Methodology (etc.)

8. Technical Matters Big technical changes ATM 2000+, Single European Sky
Changes have safety implications
JAA Future Aviation Safety Team (FAST) study
145 areas of change, 23 are ANS (13%)
9 top priorities for safety, 3 are ANS (33%)
Top 2 areas for detailed study soon, 1 is ANS
Emergence of New Concepts for Airspace Management
FAST study and safety case development should interact

9. Integration To From Whole-airspace services
Area-based services, tightly coupled
Area-based services, loosely coupled

10. Safety Case Structure and Content
A Safety Case is structure as well as content
Logical Stepping Stones
Structure

11. Representing Structure - GSN
GSN - Goal Structuring Notation
Linked by logical connections into an argument structure

12. GSN Being Developed For ...
Re-usable modules within/among safety cases
Horizontal modules, one argument provides context for another
Vertical modules, claims of one argument are the objectives of another
Interfaces between safety cases
‘System of systems’ safety cases
Safety case architecture
All are directly relevant to a Whole Airspace ATM System Safety Case

13. Alternative Structures - Example 1

14. Alternative Structures - Example 2

15. Whole-airspace Services
How should safety goals be expressed?
Relationship with safety goals for whole airspace and individual areas?
What should the safety goals be?
How to show that they will be/are achieved?
Evidence

16. Coupling Across Airspace
What happens in one area affects another
Coupling will increase (planning, ATC systems)
‘Cross-border’ safety implications
Example - Resilience with respect to unplanned events
Evidence requirements
What evidence is needed?
How can it be provided?
What will be adequate?
Argument from simulation?

17. Developing a Safety Case
Purpose
High-level safety management tool for developing, integrating and demonstrating the safety of changes in ATM on year timescale
Repository / directory for safety information, including arguments, assumptions, justifications and evidence, that demonstrate the safety of the whole airspace

18. Tasks
Develop Whole Airspace ATM System Safety Case structure and evidence
Implement using an appropriate computer tool
Identify and document links to existing safety cases / evidence / documentation
Total 2 years
Omit landing and ground movement
Interfaces to existing and planned safety cases
Interfacing ‘hooks’ for future developments

19. Ownership - Why EUROCONTROL?
Ownership based on end use
Whole-airspace safety remit
Safety management development
Safety management promotion
Important institutional links
European Commission
JAA
National ATM organisations
National regulators
No other organisation could do this

20. Conclusions Safety case BEFORE change to MANAGE change
A whole-airspace ATM system safety case is desirable
Methods, tools and experience exist
Focused development over 2 years is feasible
Owned by EUROCONTROL