NextGen and SESAR have now been under development for several years, but have increasingly complex engineering and operational specifications. A variant Air Traffic Management (ATM) concept is sketched for generating fuel-efficient, very accurate and air-ground synchronized 4D-trajectories by using flight segment groundspeed profiles and linking Global Navigation Satellite Systems (GNSS) data to the aircraft Flight Management Systems (FMS) with feedback control. Is this a flawed concept or a feasible and operationally practical proposition?

Civil and military unmanned aircraft systems (UAS) operations are currently subject to restrictions that put major limits on their use of airspace. There is considerable debate about how to develop the safe, secure and efficient integration of UAS into non-segregated airspace and aerodromes. This paper examines a necessary safety aspect. Airlines and their passengers would obviously ask, “Is it still safe with all these unmanned aircraft around?” The spotlight must be on Air Traffic Control Systems as High Reliability Organizations (HRO). That status comes from industry characteristics: focus on safety, effective use of technological improvements, learning from feedback from accidents/incidents, and an underpinning safety culture. The safety of ATC Systems has improved dramatically: accidents are now the product of rare and complex ‘messes’ of multiple failures. It is therefore a major challenge to preserve the HRO status by ensuring at least current safety performance. The analysis sketches feasible processes of policy decision-making and safety analyses. Key factors are policies on UAS equipage and airspace usage, implementation of a Traffic Alert and Collision Avoidance System (TCAS)-variant appropriate for UAS, use of an ‘Equivalent Level of Safety’ philosophy, small datalink latencies, proven HRO safety and learning cultures, and stress testing of system resilience by real-time simulations.

European Air Traffic Management is extremely safe. The drawback to this safety record is that it is very difficult to estimate what the ‘underlying’ accident rate for mid-air collisions is now, or to detect any changes over time. The aim is to see if it possible to construct simple ATM safety indicators that correlate with this underlying accident rate. A perfect indicator would be simple to comprehend and capable of being calculated by a checklist process. This problem has been examined using a combination of analogies with simple ‘defensive’ systems with Markov process properties. An important concept is that of ‘system control’: the ability to determine the outcome against reasonably foreseen changes and variations of system parameters. The statistical distribution of future incidents has been analysed by focusing on an index – the Close Proximity Index (CPI) – of separation at the Closest Point of Approach. A promising indicator is ‘Incident Not Resolved by ATC’ (INRA) incidents in which the ground ATC defences have been ‘used up’. ATM Incidents can also be categorised in other ways. Two examples are reviewed: the risk-bearing category for Airproxes and ‘risk of collision/severity’ scores. The second is more promising conceptually, but the existing scoring system has not been demonstrated to have the properties necessary to derive risk estimates. The key question is: if someone says they know how to make a good estimate of the underlying accident rate, then how could this claim be tested? If it correlates very well with INRA, then what would be the argument for saying that it is a better indicator?

The aviation-shipping analogy cannot be used as an argument for a decrease in the need for maritime pilotage. The increasing complexity and upsizing of modern ships, in combination with a vast variety in ship types, economic maximisation, crewing and technical standards, lead to marginal ship operations that require specialist knowledge and skill. On the other hand, modern commercial aircraft have very standardised equipment and operating procedures and they approach and land at airports which also use standard radio-navigation aids and procedures.

This paper presents a collision risk model and operational concepts for longitudinal separated aircraft in the North Atlantic Region air traffic control track system, and indicates how it might be used to reduce separation minima safely, and hence deliver cost savings. It is an event-based model: it is easy to see what is being assumed, to understand the role of the main parameters, and to incorporate collision detection and hazard analysis. A potential future operation, with a 7-minute separation and a strategic lateral offset system, is sketched using the model.

The focus here is on the performance of and interaction between the Traffic Alert and Collision Avoidance System (TCAS) and the controller's short-term conflict alert (STCA) system. The data source used is UK Airprox Board Reports of close encounters between aircraft, and the focus is on commercial air transport aircraft using UK controlled airspace with a radar service. Do the systems work well together? Are controllers surprised when they find out that a pilot has received a TCAS resolution advisory? What do TCAS and STCA events say about collision risk? Generally, the systems seem to work together well. On most occasions, controllers are not surprised by TCAS advisories: either they have detected the problem themselves or STCA has alerted them to it. The statistically expected rate of future mid-air collisions is estimated by extrapolation of Airprox closest encounter distances.

A new ICAO Policy on Airborne Collision Avoidance Systems is needed, which recognizes it to be an integrated part of the air traffic management system's safety defences; and that should be fully included in hazard analyses for the total system's design safety targets.

Current Eurocontrol Safety Regulation Commission (SRC) policy says that the Air Traffic Management (ATM) system (including safety minima) must be demonstrated through risk assessments to meet the Target Level of Safety (TLS) without needing to take safety nets (such as Short Term Conflict Alert) into account. This policy is wrong. The policy is invalid because it does not build rationally and consistently from ATM's firm foundations of TLS and hazard analysis. The policy is bad because it would tend to retard safety improvements. Safety net policy must rest on a clear and rational treatment of integrated ATM system safety defences. A new safety net policy, appropriate to safe ATM system improvements, is needed, which recognizes that safety nets are an integrated part of ATM system defences. The effects of safety nets in reducing deaths from mid-air collisions should be fully included in hazard analysis and safety audits in the context of the TLS for total system design.

A model is developed for lateral collision risk in air traffic track systems, which resolves the problems of the Reich Model. It is a direct and concrete approach focusing on events, in contrast to Reich's synthetic methodology, in which (e.g.) three types of collision have to be modelled and the focus is on flying hours spent away from the planned flight path. This model makes it straightforward to see what is being assumed, and easy to understand the roles of the main parameters. It is a good starting point for the incorporation of collision detection and the use of hazard analysis.