SESAR safety decision-making: Lessons from environmental, nuclear and defense modeling

SESAR, the ‘Single European Sky Air traffic Research’ program, envisages radical changes for European Air Traffic Management (ATM). It integrates and implements new technologies and information processing. This paper examines the safety decision-making in the implementation of SESAR projects. SESAR poses new safety problems because it adopts new paradigms for ATM safety – what lessons are there from environmental, nuclear and defense modeling? These disciplines have also had to confront the limitations of modeling the rates of rare and damaging – even catastrophic – events. A major conceptual change in SESAR is that of automated separation assurance systems. Some existing responsibilities transfer from the controller – either to the pilot or to computer systems – in a progressively phased approach. The major problem for SESAR safety validation is that mixed equipage/operations within a common airspace potentially generate new and different safety issues regarding the validation of safety predictions. A potential way forward uses high-fidelity Human In The Loop Simulations (HITLS) to generate confidence in the resilience of the ATM system. The focus changes from proving safety, i.e. through traditional kinds of validation processes, to extensive resiliencetesting using these simulations. The aim would be to test how resilient the system is to seeded errors, penetration testing, and crash/stress testing. This would be a high cost process because of the large investments required and the need for long sequences of testing. However, these demanding processes can provide ‘justified belief’ to the decision-maker that the changed ATM system is acceptably safe.