Abstract

Maîtres de thèse : Eric RIGAUD et Denis BESNARD; This thesis demonstrates the need to develop systemic safety assessment methods to account for the effect of performance variability on air traffic management safety. Like most modern socio-technical systems, air traffic management is so complex that it is impossible for it to be completely described. As consequence, performance cannot be completely specified because it must vary to meet performance demands. Performance variability is an inevitable asset to ensure the functioning of an organisation and at the same time can be harmful for system safety when it combines in an unexpected manner. This argument clearly indicates the need for safety assessment methods that can deal with performance variability. The Functional Resonance Analysis Method (FRAM) has the ability to model performance variability. However parts of the FRAM can be improved to expand its capabilities to evaluate performance variability. This thesis addresses this weakness and develops a methodology for the evaluation of performance variability. The methodology has been applied on a safety assessment case study for the German air traffic management domain. The results have been compared with the official results of a traditional safety assessment. The comparison shows the added valued of the proposed methodology. In particular it illustrates the possibility to identify emergent risks and human contribution to system safety.; Cette thèse montre la nécessité de développer des méthodes systémiques d'estimation de la sécurité permettant de tenir compte de l'effet de la variabilité de la performance sur la sécurité de la gestion du trafic aérien. Comme la plupart des systèmes socio-techniques modernes, la gestion du trafic aérien est tellement complexe que il lui est impossible d'être complètement décrite. Comme conséquence directe, sa performance ne peut être complètement explicitée, car elle doit varier afin de correspondre aux conditions réelles. La variabilité de la performance est un inévitable atout pour assurer le fonctionnement d'une organisation. Mais en même temps elle peut représenter une atteinte à la sécurité du système lorsqu'elle se déroule de manière indésirable ou inattendue. Cet argument indique la nécessité de méthodes d'estimation de la sécurité qui puissent traiter la variabilité de la performance. La Functional Resonance Analysis Method (FRAM) a la capacité de modéliser la variabilité de la performance. Cependant, certains points de la FRAM pourraient être améliorés dans le but de développer ses capacités a évaluer la variabilité de la performance. Cette thèse aborde ce point faible et développe une méthodologie pour l'évaluation de la variabilité de la performance. Cette méthodologie a été appliquée dans une étude de cas dans le domaine de la Gestion du Trafic Aérien Allemand. Ses résultats ont été comparés aux résultats officiels obtenus en utilisant l'estimation de la sécurité traditionnelle. La comparaison montre la valeur ajoutée de la méthodologie proposée. En particulier elle illustre la possibilité d'identifier des risques émergents et la contribution humaine a la sécurité d'un système.

Abstract

Identifying and evaluating the safety performance of road vehicle automation is one of the major challenges still to solve before market introduction of these functions. The assessment of these functions is highly challenging due to the increasing complexity of algorithms for environment perception and decision-making. In addition, the achievable level of safety is still an open question. To evaluate the achievable level of safety, this thesis introduces a new data-driven framework for safety impact assessment of road vehicle automation. The presented framework features human driver performance as a reference for assessment. The developed framework comprises a three-step approach: First, the effectiveness fields, the accidents and situations potentially addressed by the automated driving functions, are identified and clustered in the input data into driving scenarios. The considered driving scenarios are derived from the accident type catalogue built on decades of experience in accident research and thus covering all physically possible accident constellations. It is assumed that these accident constellations do not change with road vehicle automation, while their frequency of occurrence and their severity may change. Second, the change of frequency of occurrence of driving scenarios can be determined for mixed traffic conditions using traffic simulations with novel driver behaviour models representing human errors in the traffic simulations. In a third step, the change in severity within driving scenarios is assessed using human driver performance models as a reference. Simulator studies showed that human driver performance is based on feedforward control in incident situations while reaction time and reaction intensity are gamma-distributed in the selected driver population. The distinction of the human driving behaviour in these two models is particularly sensible as driver behaviour models influence the number, hence the frequency of incident driving scenarios, while driver performance models reflect the behaviour within an incident, thus the severity of a driving scenario. In consequence, this partitioning reflects the structure of the overall assessment approach. Finally, the resulting assessment of changed frequency and severity within the classified scenarios can be scaled-up by using accident statistics. The novel framework is exemplarily applied to investigate the level of safety of two different automated driving functions operating in motorway- and urban domain. This proves that the developed approach is applicable to automated driving functions of all automation levels (SAE 1- 5) and operation domains.