Exploring Safety Culture in Urban Air Mobility: System of Systems Perspectives Using Enterprise Architecture

Abstract

Urban Air Mobility (UAM) is an emerging industry marked by technological advancements, new operational contexts, and regulatory frameworks. This article examines how to improve safety management in UAM operations by adopting a just culture approach from a system of systems perspective. Acknowledging the critical role of front-line workers, especially in the early stage with piloted vehicles, the ecosystem-level approach comprehends multiple providers, operators, and services. Employing an enterprise architecture methodology, we address the challenge of fostering a learning-oriented environment amidst diverse organizational perspectives and stakeholders’ interests. This study identifies key capabilities, functions, and resource exchanges within and across organizations by strategically leveraging architectural views and systemic visualizations. A unified safety committee is discussed and recommended to facilitate consensus among stakeholders, including regulatory bodies, thus paving the way for industry-wide improvements. Findings contribute to evolving safety protocols in UAM operations and serve as a blueprint for integrating cutting-edge methodologies to drive systemic enhancements.

1. Introduction

The International Civil Aviation Organisation (ICAO) defines safety in aviation as the “state in which risks associated with aviation activities, related to, or in direct support of the operation of aircraft, are reduced and controlled to an acceptable level”. Managing risks and maintaining safety at an acceptable level in a complex and dynamic context requires a proactive and ongoing process. A safety management system (SMS) is a systematic approach to managing safety within aviation organizations. It encompasses the organizational structure, policies, procedures, and practices that enable an organization to effectively identify, assess, and mitigate risks to ensure the highest level of safety [1].

Safety culture refers to the shared values, attitudes, beliefs, and behaviors within an organization or industry that influence safety-related decisions and actions. It is the product of individual and collective attitudes toward safety and the organization’s commitment to fostering a safe environment [2,3,4]. Safety management and safety culture are closely intertwined and complementary. An effective safety management system provides the framework and tools for identifying, assessing, and mitigating risks. Its success depends on the flow of information between different levels and how the organization responds to accidents and incidents [5].

Urban Air Mobility (UAM) envisions a flight operation in and around urban areas motivated by the challenges of congested urban scenarios. By utilizing vertical takeoff and landing (VTOL) aircraft, UAM expects to provide efficient and time-saving transportation options for commuters. Some UAM concepts of operations have been defined as reuniting stakeholders’ needs and evolving the discussion around implementing UAM operations [6,7,8]. The challenges of implementing a complex and safety-critical operation like UAM transportation are significant. Effective solutions for safe transportation will affect the public acceptance and the sustainability of UAM operations [9,10,11].

Given the complexity and potential risks associated with operating aerial vehicles in densely populated urban environments, cultivating a just culture is crucial for encouraging open communication and reporting safety concerns [5]. It allows stakeholders, including pilots, operators, regulators, and the public, to collaborate effectively in identifying hazards, analyzing incidents, and implementing corrective actions to enhance safety standards [12]. Additionally, UAM operations are conceptual and planned to occur in the near future [6]. Unlike traditional aviation systems that have matured over decades, UAM represents a paradigm shift with no prior operational experience to draw upon. As a result, the emerging industry needs to be prepared for real-world operations, learning from mistakes to refine operational procedures, establish best practices, and ensure the highest safety standards [9,11,13,14].

A strong safety culture, with appropriate safety regulations for the UAM context, can integrate safety considerations into all aspects of UAM operations, from design and development to implementation and ongoing management. It instills confidence among passengers and stakeholders, promotes regulatory compliance, and ultimately contributes to the long-term sustainability and success of UAM as a safe and reliable mode of transportation in urban settings [14]. Consequently, cultivating a robust safety culture becomes paramount for successfully implementing UAM [15,16]. Establishing a just culture within the UAM ecosystem can promote collective responsibility for safety, fostering a mindset that continually prioritizes learning from incidents and near-misses to improve operational practices.

This study aims to understand the structure and perspectives of the safety management that would enable a just culture in the UAM operations. To this end, this study proposes organizational views for enabling a just culture in the UAM ecosystem using enterprise modeling. First, the safety management problem space was analyzed, and boundaries and drivers were identified according to the stakeholders’ interests. Then, the envisioned solutions were represented in organizational views using enterprise modeling. The research questions intended to be answered in this article are the following:

• RQ1: How does the organization balance stakeholders with different interests to achieve trust and share risk information? Refer to the results in Section 4.2.2.
• RQ2: What processes and relationships support values like trust, ownership, and accountability to the front-line worker as a potential reporter? Refer to the results in Section 4.2.3.
• RQ3: How can we achieve a consensus on acceptable and unacceptable behavior among organizations of the UAM ecosystem? Refer to Section 5.

This research contributes to the UAM field by offering enterprise architecture views and insights into fostering a just culture, ultimately enhancing operational learning and overall safety performance. This study was conducted with a multidisciplinary team comprising experienced systems engineers with a background in aviation and safety, a senior systems engineering researcher, and a safety researcher and practitioner. Safety researchers provided theoretical foundations, while experts in modeling techniques discussed and refined the architectural views presented in this article. This collaborative effort involved a series of iterations and discussions to enhance the clarity and effectiveness of the proposed solutions. Subsequently, the work was presented to systems engineers at different hierarchical levels to gather valuable feedback and insights. Additionally, validation exercises were carried out with commercial pilots and safety practitioners to ensure the practical applicability and relevance of the proposed solutions.

The process of understanding the problem and proposing solutions was recursive and iterative in nature. Modeling, particularly in complex domains like aviation safety and system engineering, often involves implicit knowledge that may not be readily apparent. Therefore, verifying the clarity and usefulness of ideas through peer review and feedback from industry experts is critical to ensure that the proposed solutions meet the expected standards and effectively address real-world challenges. This iterative approach not only refines the conceptual models but also enhances the overall quality and applicability of the solutions proposed in this study.

The structure of this article is outlined in Figure 1. The rest of this article is organized as follows. Section 2 describes the theoretical foundations of this study for safety culture, just culture, and modeling. Then, contextual information about safety management in aviation and UAM operations is presented. Section 3 introduces the study method by explaining the need for a systemic approach, describing the enterprise architecture (EA) methodology and the modeling framework used to elaborate the architecture views. Section 4 presents the results of the study. First is the conceptualization process, which includes problem space definition and solution envisioning. Next, architectural views with safety management perspectives and definitions are presented. Section 5 debates the results, reflecting on the literature and proposing a cooperation framework for just culture at the ecosystem level. Limitations and research guidance for future contributions complete the discussion section. Finally, Section 6 contains conclusions.

2. Background

The systemic approach to address safety culture in the upcoming UAM operation requires an interdisciplinary study. The background section is composed of theoretical foundations and contextual operational data. First, we present the rationale for the systemic approach to address the problem. Then, theoretical foundations of safety (resilience, culture, and organizational aspects) and modeling (for UAM ecosystem representation) are introduced. Next, data about the aviation domain are presented in two topics: safety management regarding industry standards and regulation and the UAM Concept of Operations. The contextual operational data are built from existing practices of the commercial aviation field and information published by authorities, the eVTOL industry, and academia. These background topics are essential for defining the problem space and proposing the solution presented in the results (Section 4).

2.1. Need for Systemic Approach

Managing risks in critical safety operations, like air passenger transportation, combines different perspectives, roles, behaviors, and processes. Similarly, SMS should encompass the entire organization comprehensively, considering elements from top to bottom, including communication channels, personnel, and more. Additionally, it should account for the ‘environment’, encompassing all external circumstances that impact the system and necessitate a response, such as political and economic influences [17]. A systemic approach is essential, defined as the effort to perceive things holistically, viewing events, even failures, as outcomes of a system’s operation. ICAO well defines the need to apply a systemic safety management approach with the aviation industry’s SMS framework [1].

A just culture depends on a healthy safety culture and a supportive safety management system. Both include human operators (with their behaviors, beliefs, subjectivity, and personal aspects), organizational structures, management styles and rules, policies, technical processes, and human-made systems. Systematic evaluations demonstrated value in understanding the relationship between employee learning and organizational supportive conditions [18,19]. Moreover, a systemic approach is suggested for managing the paradoxical states and balancing organizational dynamics [20].

2.2. Safety Culture and Just Culture: Theoretical Background

ICAO defines Safety culture as “the enduring value, priority, and commitment placed on safety by every individual and every group at every level of the organization. Safety culture reflects the individual, group, and organizational attitudes, norms, and behaviors related to the safe provision of air navigation services.” [21]. According to Reason [2], safety culture comprises five elements: informed culture, flexible culture, reporting culture, just culture, and learning culture. These elements are interconnected and interdependent. For instance, the presence of an informed culture relies on a robust reporting culture, which, in turn, depends on implementing a just culture.

In the aviation industry, there has traditionally been a prevailing belief that a greater likelihood of assigning blame accompanies higher levels of professional responsibility. In many countries, pilots receive significantly higher wages for holding their licenses, so they are expected to shoulder the blame when necessary [22]. Such a blame culture does not consider systemic issues or latent failures, discouraging open communication and honest disclosure [5]. Recognizing this reality, numerous entities in commercial aviation, including international organizations like ICAO and regulatory bodies like the FAA, are actively working towards fostering a just culture [21,23,24].

Just culture is “…an atmosphere of trust, where people are encouraged, even rewarded, for providing essential safety-related information—but in which they are also clear about where the line must be drawn between acceptable and unacceptable behavior” [2]. In other terms, just culture means a culture in which front-line operators or others are not punished for actions, omissions, or decisions taken by them that are commensurate with their experience and training but where gross negligence, willful violations, and destructive acts are not tolerated [25]. Another perspective provided by Reason [2] pointed out that just culture refers to “a way of safety thinking that promotes a questioning attitude, is resistant to complacency, is committed to excellence, and fosters both personal accountability and corporate self-regulation in safety matters”.

Transitioning from a blame culture to a just culture requires establishing a robust and functional reporting system. Such a system enables individual employees to report their errors or identify systemic hazards without fear of retaliation [5]. The level of trust between employees and management within an organization is the most crucial factor in determining and predicting the success of such a system. A safety culture that is characterized as just encompasses both individual and organizational aspects, extending to attitudes and structures. Personal attitudes and the culture within an organization can either enable or hinder the emergence of trade-offs and operational variabilities [12].

A just culture does not imply unconditional forgiveness for the responsible party in the event of an error [3]. It is founded on the understanding that professionals such as pilots, aircraft mechanics/engineers, and air traffic controllers must adhere to certain fundamental professional and ethical standards. If they operate within these standards and make errors, disciplinary or punitive measures may not be imposed. However, if their performance violates these standards, the error is deemed unacceptable and may result in disciplinary action. The EUROCONTROL, a civil-military organization dedicated to supporting European aviation, has a Just Culture Task Force composed of legal and safety experts of the Member States, the European Commission, air traffic management (ATM), and air transport associations. This group has developed a model for a policy regarding criminal investigation and prosecution of aviation and railway incidents and accidents [26]. This model contributes to achieving a balance between the administration of justice and safety requirements in accident investigations. It shows European aviation’s interest in promoting a just culture and maintaining public confidence.

The balance between the administration of justice inside organizations and reporting culture includes a moral issue that Dekker and Breakley [27] addressed by analyzing retributive justice and restorative justice. They argue that accountability considerations must be set alongside deeper concerns with safety and justice. Retributive justice focuses on establishing the appropriate course of action for individuals who have violated specific standards of behavior. Restorative just culture focuses on learning why it made sense to the operator to do what they did, looking ahead at promoting trust to repair the relationship between people whose safety depend on one another. This approach facilitates healing and drives more learning than a retributive approach.

Learning from events is the primary objective of just culture. However, promoting a reporting culture and assessing events effectively is a complex process and brings challenges. Different approaches address the challenges of implementing a just culture [28,29]. In terms of fostering a just culture, it was found that a hierarchical structure that values and promotes a retributive response adds complexity to cultivating a restorative culture. Senior management must effectively address these challenges to foster an environment that prioritizes restorative justice principles [30].

When it comes to modeling safety or just culture, previous findings suggest that several factors, including employees learning from behavioral outcomes, the presence of supportive conditions, and the maintenance of consistency over time, could influence the development of safety culture [18]. Systematic evaluation of safety culture in socio-technical organizations also highlighted the impact of the formal structure of organizations and the values and beliefs that drive individual behavior within organizations [19].

2.3. Modeling: Theoretical Background

Modeling plays a crucial role in the relationship between systems and knowledge. The real world provides actual experiences translated into simple, complicated, or complex phenomena [31]. Models can be used to represent the real world for analysis purposes and support the construction of wholes (synthesis world). The aspect knowledge world is the foundational knowledge that can model phenomena (science) and express abstractions [32]. In the information systems discipline, conceptual modeling is a foundational process for capturing, organizing, and representing the essential elements of a system or domain [33]. At its core, modeling revolves around creating abstract and simplified representations, known as conceptual models, that encapsulate the key concepts, entities, attributes, and relationships relevant to the system under development. Therefore, modeling refers to constructing these conceptual models using various modeling languages, notations, and techniques. This modeling process involves translating real-world complexities into structured and understandable forms, enabling stakeholders to gain insights into the system’s structure, behavior, and requirements [33].

Theoretical foundations for conceptual modeling include ontological, epistemological, linguistic, and pragmatic principles [34]. These foundations allow for the creation of conceptual models capable of representing a domain and supporting the solution given a concern [32]. The model’s ability to capture knowledge about the relevant domain depends on ontology, semantics, language, and communicative acts [34]. In summary, the conceptual aspects inherent to modeling consist of developing a clear understanding of the domain to be modeled, abstraction, knowledge, and visualization. Visual representations, such as diagrams to depict the conceptual model, ease the communication and understanding of the modeled system. Technical aspects focus on using modeling languages, tools, and techniques to represent, analyze, and simulate the conceptual model [35].

Enterprise architecture modeling employs conceptual modeling techniques to capture and depict the fundamental elements and relationships within an organization’s complex system, aiming to provide a holistic view that supports strategic planning, governance, and transformation initiatives. Enterprise architecture modeling is a systematic process of creating abstract representations of an organization’s structure, processes, systems, and interactions to facilitate decision-making, alignment, and optimization of its enterprise-wide resources and capabilities [36]. The holism and the synthesis construction of enterprise architectures serve the enterprise (business, systems, and organizations) domain and its inherent concerns. A framework, language, and methodology can define the abstraction level of a conceptual enterprise architecture [37]. More information about EA as a methodology is presented in the next section.

2.4. Safety Management in Aviation

The primary objective of a Safety Management System (SMS) is to establish a structured and comprehensive approach to managing risks and ensuring the effectiveness of safety controls [1]. In a highly regulated industry like aviation, SMS serves as a means for organizations to comply with safety requirements and assess their management capabilities. Besides compliance aspects, SMS enables the integration of safety principles into all aspects of an organization’s operations. This integration includes organizational processes, strategic planning, resource allocation, leadership, performance monitoring, and staff recruitment [38].

In order to limit the scope of SMS for this article, we will focus on the components used by the modern aviation industry. In 2006, ICAO proposed a framework for SMS in aviation with four components: safety policy and objectives, safety risk management, safety assurance, and safety promotion [20]. By implementing the principles and requirements outlined in Annex 19, ICAO aims to improve safety performance across the aviation industry. The goal is to enhance safety performance, reduce accidents and incidents, and foster a proactive and systematic approach to managing safety risks. Regulation authorities also rely on the four SMS components. The Federal Aviation Administration (FAA), the European Aviation Safety Agency (EASA), and other regional authorities adopt ICAO standards and develop their regulatory frameworks and guidelines based on Annex 19. They ensure that aviation providers, including airlines, air taxi operators, corporate flight departments, and pilot schools, comply with SMS requirements and integrate safety management into their operations.

Hollnagel [39] explored safety management by applying resilience principles, in which effective safety management requires learning from the past and anticipating the future. Accident investigation (learning from the past) and risk assessment (projecting the future) depend critically on the organizations’ models and methods. In his work, the variability of human actions is not a threat but a crucial resource. Therefore, four abilities characterize resilient organizations and are applicable to SMS: (1) the ability to respond to current challenges; (2) the ability to monitor incoming critical situations; (3) the ability to anticipate the occurrence of future events; and (4) the ability to learn from the past [40]. Further, a systematic review evaluated resilience engineering among other theoretical perspectives in the aviation safety context [41]. Although resilience engineering was the dominant approach, the analysis shows that past studies mainly looked at the primary operational aviation subsystems (air traffic control and flight operations). Secondary operational subsystems, such as ground operations and aircraft maintenance, were considerably less used, suggesting a gap in ecosystem perspectives.

Aviation providers have applied and learned from the SMS framework in recent decades. Technological advances in aviation have increased the complexity of operations, and the limitations on SMS have been identified and discussed. A pragmatic approach in [42] analyzed the SMS limitations based on the four components and provided a comprehensive perspective. Another study evaluated the complexities of safety management through a systems thinking lens [20]. It suggests a systemic approach to managing the paradoxical states of the SMS and balancing dynamics within the organization.

2.5. Urban Air Mobility Concept of Operations

Urban Air Mobility (UAM) considers using small aircraft such as drones, air taxis, and other aerial vehicles for transportation in urban and suburban areas. UAM seeks to provide a fast and efficient mode of transport, circumventing ground congestion and, thus, reducing passenger travel times [13]. Stakeholders, including authorities, service providers, communities, and vehicle designers, are actively developing strategies for UAM operations. However, the inherent complexity of multiple entities operating within urban spaces presents significant challenges. These challenges include technical constraints, infrastructure requirements, regulatory considerations, public acceptance issues, and operational hurdles such as safety, security, noise pollution, and environmental impact, all of which pose barriers to successfully implementing UAM operations [43].

The technology nuances and emergent behavior of a complex ecosystem like UAM are an abundant source of analysis, approaches, and exploration toward safe operations. The expansion of UAM into cities introduces a multitude of stakeholders, including multiple operators and service providers, and the establishment of numerous vertiports across the urban landscape. While this distributed operational network brings about various advantages, such as improved accessibility and flexibility, it also presents significant challenges in terms of managing safety [9,15,44]. Ground transportation services are expected to be part of the UAM mobility scenario. Integrating air and ground transportation for passengers adds more providers and organizations to the UAM landscape. Each operator and service provider may have unique operating procedures, aircraft models, and safety protocols, leading to a diverse operating environment that requires careful coordination and harmonization [45].

Macro-level aspects such as urban settings and external factors like regulatory frameworks, public policies, societal attitudes, and economic factors all play crucial roles in shaping the environment in which UAM operates and the culture of safety that prevails. The industry’s novelty, urban environment, distributed operational network, and integrated mobility services are macro-level aspects that affect the safety performance and, consequently, the internal aspect and the micro-level behavior of organizations participating in a just culture. The successful integration of UAM into urban environments necessitates a comprehensive understanding of the challenges at the macro- and micro-levels.

By leveraging real data, learning from mistakes, and promoting a culture of safety and accountability, the UAM industry can pave the way for a sustainable operation. Furthermore, the concept of just culture plays a crucial role in generating the necessary information for learning within the UAM industry. It also encourages open communication, transparency, and accountability by creating an environment where individuals can report safety incidents and near-misses without fear of retribution. This enables the collection of valuable data that can be analyzed to identify system weaknesses, develop targeted interventions, and continuously enhance safety practices within the UAM ecosystem.

The UAM Concept of Operations released by the FAA [6,7] delineates the planned operational setting across phases to accommodate the growth of flight operations and airspace traffic. Similarly, the EmbraerX Concept of Operations [8] addresses this issue through a comparable approach, outlining various scenarios involving a growing number of vehicles sharing airspace and an increased utilization of UAM transportation by passengers. UAM phases were then defined according to the horizons projected. Despite the expected evolution towards autonomous flight in UAM operations, this article focuses on the initial stage where pilots maintain control of the vehicle, aiming to provide insights into this critical phase of UAM operations.

While other studies have addressed operational barriers for UAM operations [13] and challenges to UAM safety management [9,15,44], no work has been conducted to address organizational perspectives to foster a just culture in UAM. The results in Section 4 consider the UAM ecosystem perspectives, including operators, service providers, physical infrastructure, authority, and the public. This research elaborates on architectural views addressing the safety management values and perspectives necessary to enable a just culture. The holistic and strategic proposition using enterprise architecture views represents a unique approach to the questions raised in the introduction.

3. Methods

3.1. Enterprise Architecture Methodology

Modeling methodologies play a significant role in representing a System-of-Systems like the Urban Air Mobility (UAM) ecosystem, providing a comprehensive understanding of its elements and interactions. The challenges of dealing with complex systems can be alleviated by employing modeling techniques, and tools can be utilized to analyze behaviors and relationships. In this context, Enterprise architecture (EA) emerges as a holistic discipline that tackles the intricacies of an enterprise while ensuring its responses align with desired business objectives and outcomes [46]. The objective of adopting enterprise architecture views is to understand its entities and their interactions thoroughly.

An enterprise is a system in which the components are the enterprise’s resources. Thus, EA is anchored on system sciences, the discipline that provides the necessary foundations to model and design systems. The contribution of EA regarding the systemic philosophy and paradigm was explored in [47]. Regarding heuristics, enterprise-level models are related to System-of-Systems principles [48]. Furthermore, the core elements of System-of-Systems engineering [49] have been linked to EA processes [50].

EA facilitates enterprise analysis, planning, governance, and evaluation as a well-defined practice. It employs holistic approaches for the successful development and implementation of strategies. Architects can leverage EA to apply architectural principles and practices, guiding organizations through changes in business, information, processes, and technology required to execute their strategies [51]. These practices utilize various aspects of an enterprise to identify, motivate, and implement these changes.

This research employed the enterprise architecture methodology described in the international standard ISO/IEC/IEEE 42020 “Software, systems, and enterprise—Architecture processes” [46]. The standard defines six architecture processes listed below with their intended purpose.

• Architecture Governance: Establish and maintain alignment of architectures (goals, policies, and strategies and with related architectures);
• Architecture Management: Implement architecture governance directives;
• Architecture Conceptualization: Characterize the problem space and determine suitable solutions that address stakeholder concerns, achieve architecture objectives, and meet relevant requirements;
• Architecture Evaluation: Determine the extent to which architectures meet their objectives, address stakeholder concerns, and meet relevant requirements;
• Architecture Elaboration: Describe an architecture in a sufficiently complete and correct manner for the intended uses of the architecture;
• Architecture Enablement: Develop, maintain, and improve the enabling capabilities, services, and resources needed to perform the other processes.

To answer the research questions and meet the intended use of the architecture effort, this article focused on two processes: architecture conceptualization and architecture elaboration. In the first part of the results, we tailored the architecture conceptualization process to characterize the problem space and determine the solution space (workflow described in [46] (pp. 30–34), items 8.4.3 and 8.4.6).

The problem characterization activity was also tailored to address the specific problem of the research. It combines context examination, element harmonization, negative and positive influences and interactions between proposed solutions, and established desired functional and non-functional characteristics that correspond to the stakeholders’ concerns. More specifically, the problem space (presented in Section 4.1.1) evaluates and synthesizes information to make reasoned judgments for the potential solution envisioned by the solution space (presented in Section 4.1.2).

The second process applied in this study is the architecture elaboration process. Architectural views and models are captured to address the just culture at UAM and answer the research questions. The level of architectural detail was adjusted to express the architecture’s fundamental concepts and properties to the extent necessary for their intended use. In addition, the views are aligned with relevant requirements and design characteristics. The organizational views presented below were chosen to address the critical aspects raised by the problem. The objective is to plan and define the enterprise architecture, ensuring cohesive strategy among organizations and entities of the UAM ecosystem while addressing the goals to overcome the safety culture problem.

3.2. Modeling Framework

The analysis, design, planning, and implementation of EA involve the development of EA models for visualization. The modeling enhances the abstraction degree of information system design, allowing for early-stage verification in system development. EA visualization provides information system designers with a comprehensive view of business and organizational aspects. In large-scale projects, EA visualization facilitates the management of resources, strategies, risks, and business processes [51]. To this end, the EA modeling framework utilized in this article is the Unified Architecture Framework (UAF). Thus, the views generated during the architecture elaboration process were modeled according to the UAF standard. Notably, both enterprise architecture (EA) and the Unified Architecture Framework (UAF) have demonstrated their value in constructing diverse and complementary perspectives of the UAM ecosystem [50,52,53].

The modeling framework incorporates into the EA using the guide [54], the UAF Modeling Language (UAFML) [55], and the UAF Metamodel [56] specifications. UAF adheres to the principles of EA modeling while allowing for flexibility and customization. The viewpoints in the Unified Architecture Framework offer a comprehensive platform for defining various aspects of enterprise operations, encompassing processes, requirements, capabilities, human interactions, personnel organization, and roles and responsibilities. However, it is important to note that this methodology carries a potential drawback as it permits the creation of inconsistent or incoherent architectural elements. To address this concern, validation is strongly advised, especially when collaborating with multidisciplinary teams and stakeholders. Furthermore, tailoring the modeling process is recommended as it can enhance the overall quality of the work.

3.3. Architecture Validation

The validation process was performed internally, using the methodology validation processes and modeling verification, and externally, evaluating the solution proposed by this study in accordance with operational context and safety principles. External validation included professionals in the safety, flight operations, and systems engineering field, as described in Section 1. These two validation efforts (internally and externally) occurred iteratively, recursively, and sometimes concurrently.

The methodology offers guidance for validating architecture as described in [46,57]. The standard ISO/IEC/IEEE 21840:2019(E) [56] defines on page 53 the purpose of the validation process as “to provide objective evidence that the system, when in use, fulfills its business or mission objectives and stakeholder requirements, achieving its intended use in its intended operational environment.” Validating the architecture involves modeling verification and validation, as well as the architecture evaluation process defined in [46].

With respect to the modeling effort, the authors performed a consistency check and semantic analysis considering the elaboration process and modeling framework [54]. Although not all views, model aspects, and elements are presented in this work due to space limitations, the enterprise motivation and strategy were defined according to UAM just culture goals. From the defined goals (mission and values), the strategic capabilities are then defined and associated with goals. The strategic capabilities are the base for defining functional architecture, resource architecture, and personnel structure. More explanations of the elements and the development of the architecture are described in the following section. Thus, verification and validation were conducted through a set of analysis activities including element associations, tracing, and coverage after multiple iterations and corrections. Language verification was also performed to check the semantics.

The stakeholder’s validation (external) is essential in evaluating the effectiveness of the proposed architecture. It validates that the architecture aligns with stakeholder requirements and expectations. Validators can verify that the architecture adequately addresses business needs, technical specifications, regulatory compliance, and other key requirements, enhancing overall alignment and stakeholder satisfaction [58]. Experienced practitioners in systems engineering, safety, and pilots were invited to understand the research and the different architectural views. The discussion carried out by the multiple perspective groups has the purpose of challenging the architecture elaboration, the ideas represented by diagrams according to the safety theories, and practicality in the UAM’s future operations. Different feedback were received, which included improving the diagram presentation, correcting resource exchange naming and flows, including new elements, and modifying responsibilities. The discussions with multidisciplinary teams help the process of conceptual modeling and, most importantly, the qualitative assessment of the solutions proposed [46].

The diagrams presented in the following sections used UAF version 1.2 [55]. The authors created all the diagrams in this article based on the safety management and just culture theoretical foundations presented in Section 2.2. High-level operational concepts were extracted from existing UAM ConOps [8].

4. Results

4.1. Safety Management Conceptualization

The architecture conceptualization process defined by [46] (p. 27) is “to characterize the problem space and determine suitable solutions that address stakeholder concerns, achieve architecture objectives and meet relevant requirements. (…) Conceptualization is where there is a special focus on identifying solutions, but with also an emphasis on fully understanding the complete problem. This also entails defining and establishing architecture objectives, as well as negotiating with key stakeholders on prioritization of their concerns”. The conceptualization process involves many activities and tasks. This section presents the architecture conceptualization process tailored to

• understanding the problem from the stakeholders’ perspectives and interests;
• synthesizing the solution to address just culture in the UAM enterprise.

4.1.1. Problem Space

Defining the problem of safety management enabling just culture in the future UAM operations requires a systems thinking approach. Our first step is looking into different perspectives and understanding the forces that drive the environment. Opposite interests within an organization and with external entities are dynamic and must be understood. The relationship among these entities is part of the problem, and acknowledging the boundaries behind each interest is crucial for achieving a balance. To explore the systems dynamics of safety management in UAM, we organized the analysis into administrative, economic, and operational axes.

The administrative axis represents the first aspect (see first column of Figure 2). It concerns the rules and regulations governing licensing, operational procedures, and regulatory compliance. At one end, the regulation authority pushes the organization with rules, inspections, and audits. The objective is to protect the public, ensuring the highest level of safety in aviation operations. It means establishing and enforcing aviation safety regulations, guidelines, and standards. Our study focuses on the utilization phase, where the service will be provided to passengers. The enforcement then relates to air traffic management, maintenance practices, and operational procedures. The undesired state of this gradient is a reckless and negligent operation. In the opposite direction, there is the perspective of just culture. It is about the movement towards reporting events without fear of blaming. The goal is to learn about events and avoid operational silence, in which the organization is unaware of risks and near misses because operators are not reporting them. The enforcement of the regulation is associated with fear of blaming, which in turn makes operators less willing to report issues [5]. Hence, it is not possible to establish a just culture if the regulatory force is adjusted for punishment purposes only.

In the economic axis (second column), a business interest protects the profit and viability of the operation. Most of the time, the top-level management represents this interest, constantly looking for productivity and avoiding a state of low profitability (or nonprofit). Efficiency is pursued, and a strategy to increase profit is usually implemented. In the opposite direction, there is the perspective of a safety campaign that aims to promote safety awareness among workers. In this case, the interest is aligned with the SMS component safety promotion and, in practical terms, aims to educate workers to make decisions that would not jeopardize the operation’s safety. The slogan “safety first” can directly impact productivity when the operation is delayed, interrupted, or canceled. The balance problem about the operational axis is also called the “dilemma of the two Ps” in which there exist conflicting goals: production (delivery of services) or protection (safety) [21].

The last axis represents the operational aspect (third column of Figure 2). The operational processes should be defined to achieve an acceptable workload. If work processes are poorly designed or lack optimization, it can contribute to an excessive workload. Inefficient workflows, unclear task assignments, or redundant steps can all contribute to increased workload demands on workers. Moreover, unrealistic time constraints or tight deadlines can create a high-pressure environment and increase the perceived workload. An unacceptable workload can compromise operational safety and is the undesired state of this force. The other side of this axis is the resource management. Its purpose is to provide sufficient human, system, and training resources. Those gradients can be opposites if a process is defined with unrealistic resources or if the best resource is provided, but the operational process is unacceptable.

The gradients were organized in three axes to ease the identification of dynamic forces that coexist in safety management. However, the gradients are not independent, straightforward, or disconnected. Each one of the forces is influenced by and wields influence over other forces. For instance, safety campaign has a direct relationship with the just culture gradient. The reporting culture results from many other processes and values that the safety campaign promotes. Another example is when the business force manages the budget and controls the expenses, constraining resource availability. Figure 2 introduces opposite forces that compose the problem of managing safety to enable a just culture. It will be used to discuss the perspectives and viewpoints of Section 4.2.

4.1.2. Solution Space

The front-line worker is any operator in direct contact with the operation. The worker can be a maintenance staff member, a traffic controller, a pilot, or any other role performing operational processes. They are also the centerpiece of our proposal. Their presence in daily operations and knowledge about field operations are the primary source for generating valuable information in improving safety. Near misses and even mistakes are symptoms (not causes) that can be investigated and assessed if the front-line worker feels safe to report them [3]. Reporting an event is an act of trust and ownership [5]. There is an individual and collective behavior behind reporting culture. Figure 3 represents the high-level concept of just culture from the front-line worker’s perspective.

The operator must have direct access to a reporting system, and his/her direct manager has no other power influence than to build trust and support the habit of reporting. The fear of being scolded by a superior can discourage reporting. Power relationships must be carefully established to avoid influencing the front-line worker’s decision, who is usually vulnerable. High-level management must sponsor safety practices and behavior. Values, especially trust, in the organization depend on the alignment among power, discourse, and actions from top to bottom. Similarly, the team or group that will receive, analyze, and sometimes investigate the event needs direct access to the front-line worker. It is also important that this group is from a separate division and has no relationship with the operator in terms of hierarchy. The engagement of the front-line worker in the assessment of events (and other safety-related processes) is also crucial for building ownership.

Trust is the principal value of this concept. The front-line worker not only trusts that a fair assessment will be based on holistic perspectives rather than blaming individuals, but also trusts that the process of reporting for the purpose of learning is effective. The front-line worker must realize that the information provided in the report is useful and will turn into a learning experience. If the operator is not involved in this process or is not able to see changes and improvements, the reporting becomes only bureaucracy, which is the spending of time without purpose.

The authority is an external entity but has a significant role in the just culture context. Establishing an agreement for disclosure and cooperation between the authority and the safety committee is vital to developing trust as a value among all workers. The goal is to learn, and bringing everyone to the table means broadening perspectives and having the means to perform investigations comprehensively and provide a fair assessment.

4.2. Safety Management Perspectives

The architecture elaboration process defined by [46] (p. 47) aims to “describe an architecture in a sufficiently complete and correct manner for the intended uses of the architecture”. The views presented below intend to provide visualizations and support the analysis needed to answer the research questions. In other words, the diagrams presented below include different organizational levels perspectives and provide means to understand the individual and collective contribution to the just culture in the UAM ecosystem.

4.2.1. Drivers

The first step in the model development is to define the drivers. Drivers in UAF are factors that have significant impact on the activities and goals of the enterprise. Drivers also relate to the purpose of an enterprise. From the forces (as presented in Figure 2) or stakeholders’ interests defined in the problem space, we have identified six drivers:

Regulation Gradient: In the Administrative axis, the regulation must not allow reckless operation;

Just Culture Gradient: In the Administrative axis, the safety culture must avoid reporting trust issues;

Business Gradient: In the Economic axis, the business gradient must protect the viability of the operation;

Safety Campaign Gradient: In the Economic axis, the safety campaign must offer protection from unsafe operation;

Workload Management Gradient: In the Operational axis, the operational processes must keep the workload within acceptable levels;

Resource Management Gradient: In the Operational axis, Resource Management must keep the resources within sufficient levels.

4.2.2. Safety Management Functions and Capabilities

The personnel process view in UAF concerns functions that have to be carried out by organizational resources. The following figures represent how the drivers are implemented in terms of functions, who performs those functions, and how organizational capabilities are achieved.

Figure 4 represents the relationships in the administrative axis. The Regulation Gradient (<<Driver>> element on the top left) is realized when the function Oversee Airworthiness (<<Function>> on top center) is implemented. A set of subfunctions is defined as composition elements to provide more information about the regulatory act. For instance, Issue Certification, Provide Policies, Monitor Compliance, and Enforce Legislation (<<Function>> elements at the top) are parts of Oversee Airworthiness. Consequently, the Regulation Authority (<<Organization>> element below Oversee Airworthiness) is the resource capable of performing the functions. Inside the organization level, there are some primary resources represented as parts that are also performers: Airworthiness Specialist, Accident Investigator, and Certification Specialist (<<Post>> elements linked to Regulation Authority).

The same applies to the opposite force: Just Culture Gradient (<<Driver>> in the left bottom of Figure 4). The <<Function>> Empower Event Reporting realizes the Just Culture gradient. In this case, although the UAM Operator (<<Organization>> element on the right side) is the operational performer of UAM services and the organization behind the function Empower Event Reporting, the elements linked with the <<IsCapableToPerform>> dotted line are its parts. It means that different levels within the UAM Operator represented as <<Post>> elements are directly engaged with the reporting function and the subfunctions listed at the bottom of the diagram. The model aims to explore the individual contribution, and every post is capable of performing the reporting function. Safety awareness can be promoted with directive activities for which the safety team is responsible. Yet, promoting trust, accountability, and ownership is also an individual act, and each post should perform it.

The balance between regulation and just culture forces requires the involvement of the authority and the UAM operator to achieve the capability of Accountability and Fairness (<<Capability>> in the middle of the diagram). It means that enabling an environment without fear of reporting is only possible if the regulation enforcement is fair. Moreover, achieving a responsible operation requires accountability and safety awareness. Balancing stakeholders’ interests is possible if the enterprise develops capabilities according to the boundaries of each gradient. The <<Capability>> elements on the left side of Figure 5 represent the healthy combination of opposite interests in terms of capabilities. Accountability and Fairness capability is a combination of Responsible Operation and Trust and Ownership capabilities. Both capabilities realize opposite drivers: Regulation and Just Culture.

The economic axis balance is represented in Figure 5. In this case, only one organization is responsible for performing functions that realize both drivers: UAM Operator (<<Organization>> element in the middle). However, different organizational levels within the UAM Operator can perform the functions that will implement Business Gradient and Safety Campaign Gradient (<<Driver>> elements on the left side). Top-Level Management (<<Post>> above the UAM Operator) looks after operational viability and is responsible for maintaining profitability. The authority for safety matters, called in this diagram Chief Safety Officer (<<Post>> below the UAM Operator), is capable of performing the Promote Safety Awareness function. Top-level management plans for global strategies, while the safety team defines safety strategy. A relationship between those organizational levels and functions must be coordinated to achieve Sustainable Operation (<<Capability>> in the left middle). The capabilities on the left side of the diagram are also harmonized to balance opposite concerns: Profitability realizes the business interest, while Safety Awareness realizes the Safety Campaign interest. In the next section, we explore the resource exchange elements between organizational levels that can address complementary functions to achieve a balanced capability.

The last diagram in Figure 6 is for the operational aspect. It represents the balance between defining operational processes considering an acceptable workload and, complementarily, providing enough resources according to the same operational processes. Managing resources and workloads is a highly coupled activity, although different capabilities are being delivered. Defining enough resources depends on process definition. Managing workload also depends on the resource’s definition. From the operational perspective, the organization wants to avoid defining processes with a workload that is too high or too low. In both cases, unappropriated workloads can affect the safety performance of a process. At the same time, resources must be provided per the process’s workload. Lack of resources (personnel, systems, or training) can increase the workload or even prevent the activity from occurring, compromising its performance. This balance is represented by the capabilities Acceptable workload and Sufficient Resources (on the left side of Figure 6). The enterprise must realize both capabilities to achieve Safe Operation (<<Capability>> in the center).

Achieving complementary capabilities means realizing opposite drivers from the operational axis. The high-level functions that realize those drivers are Ensure Acceptable Workload When Performing Operational Processes and Provide Sufficient Resources (<<Function>> linked with a dotted arrow to <<Driver>> elements). The list of subfunctions that composes the high-level function provides more details on how the different perspectives can support each other. Matching the functions specified for realizing both drivers is essential and strategic. For instance, functions like Define Operational Processes According to Resources (fifth <<Function>> on the right side’s list) and Define Resources According to Operational Processes (first <<Function>> on the left side’s list) can raise the necessary alignment between different interests. The resource capable of performing functions on the operational axis is the Safety Team <<Organization>>, which is part of the UAM Operator <<Organization>> and has a different hierarchical structure than that of the front-line workers.

The structure within Safety Team (<<Post>> elements at its right side) and UAM Operator (<<Post>> elements above it) are represented in the diagram as essential parts involved in both functions: Ensure Acceptable Workload When Performing Operational Process and Provide Sufficient Resources (<<Function>> elements above and below Safety Team). The operational axis depends on actual field data to plan, adapt, and improve operations. Moreover, the front-line workforce is a critical resource providing inputs for adjusting workload levels and resource gaps.

To reiterate, the above personnel processes diagrams show the implementation of drivers in terms of functions and capabilities and the individuals or entities responsible for performing those functions. From the operational viewpoint, it is possible to specify which activities will implement each function, including methods, parameters, and measurements. Different posts will perform the same function in different ways. The perspective of each organizational level at contributing with a high-level function and, therefore, a capability is valuable to disseminate ownership and awareness. Knowing how each agent in the ecosystem acts towards a common capability is meaningful for developing a holistic perspective.

Capability is defined in UAF as an enterprise’s ability to achieve a desired effect realized through a combination of ways and means (activities and resources). The personnel process views above show how stakeholders with different interests can achieve balanced capabilities that meet the UAM’s interest as an enterprise.

4.2.3. Safety Management Structure and Interactions

The personnel structure view concerns the organizational structure used to support capabilities. It shows organizational structures and possible interactions between organizational resources. Once we have defined the capabilities that will balance the drivers and how (functions) will be achieved, we can look into the organization-level perspectives. The following diagrams represent the three main organizational level’s responsibilities and resource exchange for exhibiting the capabilities.

The first is the Top-Level Management perspective. In our model, the top-level management can be represented as Executives, Body of Directors (BoD), or Owner (all <<Post>> elements in the top left of Figure 7). The diagram below shows a set of responsibilities that the highest level in the organization must have. Ensuring operational viability, allocating funds for safety promotion, developing strategic safety plans, making safety-committed decisions, and facilitating cooperation and collaboration for safety are duties allocated to the highest level (represented as <<Responsibility>> elements). Moreover, workforce perspectives around the organization’s governance should not be disregarded. Fostering just culture and being accountable is also a responsibility that the power and discourse of the top-level management must be aligned with.

The exchanges between the top and other organizational levels are on the diagram’s right-top side (represented as dotted lines with <<ResourceExchange>> RE notations). Safety Committee <<Post>> shall provide safety data and strategy (RE7); Safety Specialist <<Post>> feeds technical and specialized safety data (RE19); Front-Line level (managers and staff <<Post>> elements) provide their valuable perspective (RE9 and RE10). Without these resource inputs, the top-level management cannot meet its responsibility and contribute the necessary capabilities. The resource exchanges proposed by the model are not desirable interactions but a condition (requirement) to develop the strategic capabilities defined earlier.

The next level explored in Figure 8 is the safety division’s perspective. Safety core duties such as defining operational safety guidelines, safety promotion and communication, and resource and workload management are defined according to the capabilities driven by the safety campaign and operational gradients. Regarding the just culture gradient, a focus on managing the reporting system and performing a fair investigation is defined to promote trust and accountability. According to the model language, responsibility exhibits capability. Nevertheless, this relationship is not straightforward in real operations. Operational processes can include more than one responsibility; likewise, responsibility can be shared in different processes. Responsibilities like Ensure Front Staff is Engaged in Safety Decisions (fourth <<Responsibility>> in the left side of the diagram) can be performed in multiple activities from safety division posts. They will impact all the capabilities, not only Sustainable Operation. The representation in the diagrams does not show all <<exhibit>> relationships to keep the visualization clean.

There is an external and important connection with the Regulation Authority (<<Organization>> in the top left) regarding resource exchange. Without cooperation (RE14) between authority and operator, the consensus of acceptable and unacceptable behavior will hardly exist. Cooperation also includes an agreement for disclosure, discussing new practices, and adapting the existing standards. Top-level management offers extensive support (RE8), and Front-Line Managers provide their perspective (RE11). The Front-Line Staff provides a key resource exchange for the safety division. Feedback, performance data, and work-as-done information (RE12) are essential for all the other activities and responsibilities of the safety division.

The last view represents the front-line perspective in Figure 9. The Front-Line Staff (<<Post>> element in the middle) must Develop Operational Ownership (third <<Responsibility>> in the left side). Validate Safety Guidelines (first <<Responsibility>> on the left side) and Support Event Assessment (last <<Responsibility>> in the middle) places the staff inside the safety process and brings them knowledge, voice, and accountability. Reporting inadequacies in workload and resources (<<Responsibility>> elements in the middle) will feed the safety division team with valuable information. The daily operational information from the front-line staff is the safety currency that will drive safety management and provide material for learning. Reporting events and encouraging reporting (<<Responsibility>> elements on the right side) is the responsibility of every person involved in the operation. However, it appears in the front-line perspective because firstly, they are the ones seeing and handling the operation, and secondly, they are also vulnerable in terms of hierarchy and power.

The front-line manager has a power over the front-line staff expressed by the relationship <<Command>> (dotted line below <<Post>> Front Line Managers). The hierarchy and power can discourage the reporting of events and mistakes. The front-line staff must feel comfortable reporting and discussing events with an external entity like the safety division (as in the Support Event Assessment <<Responsibility>>). Moreover, the resource exchange RE17 (at the top right) represents this connection between front-line workers (staff and managers) and the safety team. Safety Practice Guidance and Partnership (RE17) is crucial to building ownership, accountability, and trust.

5. Discussion

5.1. Debates and Novelties of UAM Safety Management Perspectives

The architectural views presented in the previous section depicted stakeholders’ interest under two schemes: at the enterprise level and the group engagement level. The first type of diagram, personnel processes (Figure 4, Figure 5 and Figure 6), defines enterprise functions that map to desired enterprise capabilities. Meanwhile, the second type of diagram, personnel structure (Figure 7, Figure 8 and Figure 9), defines group responsibilities towards all strategic capabilities. The synthesis of operational structure, enterprise drivers and capabilities, and roles and responsibilities provided different perspectives of safety management. Although the enterprise approach of this study is unique, the results and insights can be reflected in other literature. This section will highlight some insights and how they relate to research findings on just culture in aviation.

The first point is the construction of values like accountability and ownership. Accountability is present in all the organization-level perspectives of Section 4. Noticeably, the value of accountability does not have a mistake-owner connotation. Pointing fingers and blaming are barriers to a just culture. Instead, accountability brought by a deep sense of ownership of processes, decisions, and operations is the value a safe operation and just culture seeks [5]. Being accountable in the sense of knowing how safety is a collective commitment and a systemic behavior that depends on each one of the ecosystem pieces. Encouraging and establishing a deep sense of ownership and accountability is crucial for fostering a culture where pilots and front-line staff feel empowered to report safety incidents without fear of blame or reprisal.

The second point concerns trust as a result of establishing accountability and ownership. Having different engagement levels aware of the whole safety effort allows individuals to take their share and behave collectively towards a common goal: safety. The responsibility behind the process for each organizational level was defined, considering drivers and individual perspectives. Front-line staff reporting events depends on values like trust, built from ownership and accountability. This aligns with the survey performed with a group of pilots [58], revealing that fear of reprisal from the employer (airline) emerged as the leading reason for failing to report or under-reporting safety information. The lack of confidence in just culture among airlines highlighted the importance of addressing reprisal concerns and fostering a culture of trust and transparency within aviation organizations to encourage voluntary reporting and enhance safety outcomes. Another piece of literature [59] exposed trust issues among pilots. The perception of reprisals for voluntary reporting and the fear of punitive actions can create barriers to reporting and hinder the development of a just culture.

Another point is the power relationship between front-line workers and their direct management. The reporting system and event investigation and assessments were intentionally proposed in a different hierarchical structure, highlighting the need for direct access to reporting systems without fear of reprisal. The evidence touches upon power dynamics and hierarchies within organizations, which can influence the mentality of reporting and the willingness of front-line workers to report safety events. This resonates with another research finding [60] regarding differences in perceptions of disciplinary measures and accountability among pilots and managers. In a just culture, understanding why procedures were violated should be investigated regardless of the outcome, emphasizing the need for a systemic approach that values accountability and transparency at all levels of the organization. Additionally, the safety division’s responsibilities were emphasized in effectively addressing events because they directly impact how front-line workers trust the process. This strategy echoes pilots’ concerns about timely feedback and the perception that appropriate actions are not always taken upon reporting safety concerns as revealed in previous surveys [60].

The next consideration is regarding organizational attitude towards fostering a just culture. In the enterprise architecture views presented, engagement groups can be applied to any organization directly interacting with the operation. Front-line workers, top-level management, and safety divisions are common categories of personnel, and their roles and responsibilities are suitable for achieving the enterprise’s strategic capabilities. The organization can build those values by planning resource exchange while considering front-line-worker voice, power, discourse alignment, and regulatory cooperation. Similarly, recommendations from previous surveys [60] suggest that airlines should develop clear frameworks for acceptable performance and remedial actions following safety events. When airlines embrace the principles of a just culture and pilots understand the significance of their incident reports, it creates fertile ground for preventing future incidents more effectively [61].

The last point to discuss is adopting enterprise architecture (EA) as a method of elaborating and providing visualizations for the results. Considering that UAM has operational and safety challenges that are being discussed and planned to operate in the future, preparing for safety management is a recommended strategy. Enterprise architecture can facilitate communicating with different stakeholders and converge to shared goals, facilitate architectural analysis and decision-making processes, and support large and complex enterprise transformation changes [62]. The findings of [63], which focused on the strategic value of EA in government agencies, support the EA’s role in preparing for safety management in UAM operations. By leveraging EA principles, organizations could effectively communicate with various stakeholders and align efforts toward common goals in different domains. EA is already practiced (and sometimes mandated) among federal organizations and government acquisition processes, providing a communication pattern for better understanding and collaboration [64]. Moreover, EA can facilitate large-scale enterprise transformation changes necessary to successfully implement UAM stages aligned with governmental UAM initiatives [7,10]. Finally, in the safety culture concern, the communication factor has been investigated, and evidence shows the positive impact of safety communication on employees’ safety performance and safety culture, particularly in high-risk industries [65]. The findings also underscored the need for businesses to focus on safety culture variables, especially in stressful working environments, to improve safety performance. Thus, using EA in safety management strategies can enhance coordination, collaboration, and effectiveness in systematically addressing safety concerns.

5.2. Unified Safety Committee Proposal

Unlike civil aviation, which is usually centralized in big airports, the UAM ground infrastructure will be granulated in various vertiports over urban and suburban areas. The envisioned vertiport network will also have different units in terms of space, topology (on the ground or over buildings), and services (only takeoff and landing pods or with a complete service station for battery charging, maintenance, and parking areas). The distribution will also be significant for providers and operators: different vertiport owners or operators, with diversified staff or third-party workers and different operational processes. This is in addition to multiple UAM operators and different vehicle technologies demanding specific ground services.

Another relevant aspect of the distribution and operational landscape of UAM is the convergence of air and ground transportation sectors. Air travel in dense urban areas would require integrated mobility solutions, including accessibility and connectivity to ground transportation. The air industry is dominant in terms of safety protocols and standards. Many front-line workers, managers, and staff in UAM operations will likely come from aviation backgrounds, where a strong safety culture is typically ingrained. On the other hand, individuals working in ground transportation, such as vertiport operators, ground staff, and service providers in Mobility as a Service (MaaS), may have different levels of recognition or familiarity with aviation safety practices. This difference in safety awareness and training could potentially lead to a mismatch in safety expectations and practices within the UAM ecosystem.

Education and the environment need to be considered to address this issue. First, the UAM industry must establish comprehensive training programs and safety protocols that bridge the gap between the air and ground transportation sectors. This includes educating ground transportation workers and service providers about aviation safety standards, emergency procedures, and risk mitigation strategies. Collaborative training initiatives and cross-industry knowledge sharing can help align safety practices across all aspects of UAM operations, ensuring a harmonized approach to safety management and enhancing overall safety outcomes in this innovative transportation sector. Secondly, safety management must provide an environment for learning and improving safety performance among all front-line workers.

There is an enormous potential for learning in the new UAM ecosystem. New situations will occur in a systematic and distributed manner. New systems and workers adjusting their performance add another layer of uncertainty to the UAM operations. How can the UAM ecosystem, with all its entities and relationships, learn effectively and efficiently? How can a just culture and all the encouragement for reporting support this learning? The discussion in this section aims to address both questions and propose an environment to enable learning in the UAM ecosystem.

The diagram in Figure 10 shows the main <<Organizations>> involved in the UAM ecosystem: UAM Operator, Vertiport Operator, UATM Operator, Regulation Authority, Service Providers—Third Party, and Professional Association. Enabling a just culture at the ecosystem level involves multiple organizations. Thus, there is a cultural factor that needs to transcend the boundaries of the organization. The primary base for enabling a just culture is the behavior consensus of what is acceptable and unacceptable. In the model’s representation, it means that the Behavior Consensus is a competence that operators (organization-level) and the regulation authority must have. The dotted lines with the notation <<RequiresCompetence>> pointing to the <<Competence>> Behavior Consensus at the center of Figure 10 illustrate this need. We propose the UAM Safety Committee as a unified organization capable of developing and implementing such competence. The realization arrow pointing to the UAM Safety Committee (<<Organization>> at the bottom right) synthesizes the purpose of the strategy discussed in this section.

This committee would have representatives (see <<ResourceRole>> inside the UAM Safety Committee box) from all organizations at different levels, including front-line workers, to ensure their voice and ownership value. The event disclosure (RE56) from the UAM Safety Committee to the Regulation Authority is part of their cooperation agreement. The internal events that fall under a minor level (upon agreement) should stay in each organization and be handled according to its internal policies. Cases requiring a higher attention level are the ones that are brought to the unified committee. When involved, the Regulation Authority should participate in relevant discussions (RE57) towards learning and improving operations.

All regulatory processes like surveillance, inspection, audits, compliance demonstration, and law enforcement (RE36, RE37, RE38, and RE39 in the bottom left) are kept between the Regulation Authority and each Operator. Boundaries for accountability are essential for the regulation and can coexist with a fair assessment discussed between the authority and safety committee. The operators provide safety events and actively participate in operational discussions (RE58, RE59, and RE60 above the UAM Safety Committee). The purpose is to create a systemic view with different perspectives of the problem and contribute to better solutions and improved safety. Participation builds ownership that should occur at every level, from front-line daily discussions to a unified safety committee board.

Third-party workers are usually a challenge for organizations in terms of culture and values. This becomes even more critical with the expected diversity of organizations entering the UAM arena, including small organizations without an aviation background. It is essential to include all providers in safety awareness and accountability (RE44, RE45, and RE47 pointing at the Service Providers—Third party box). Likewise, the Passenger (<<Person>> in the top) is another part of the operation and should be instructed on safety awareness (RE62 below Passenger). Everyone should know they are part of a whole new operation, and its safety is an individual and collective commitment. Lastly, the Professional Association (<<Organization>> in the center) is relevant for creating a professional code and supporting front-line workers (RE43, RE53, and RE54 outputs of Professional Association). This support is significant in encouraging the front-line worker to report events and can increase their trust level in regard to fair assessment.

The ultimate goal of a just culture is learning from events. Information about actual operations, including successful practices, near misses, and hazard events, is the asset for UAM safety. Having a shared space for discussing events in such a distributed and diversified operation provides an opportunity for assessing this information. Nonetheless, the proposal is for an ecosystem-level solution, and there are also significant challenges. Achieving a consensus with so many players, including authorities debating how to define safety standards, is arduous. Giving space and a voice to front-line workers is also challenging and requires excellent organization, management, and efficiency. In every environment that expects horizontal and collaborative work, some practices flow smoothly, and others do not fit. The recommendation is to start the consensus discussion early on and evolve with the maturation of the UAM. Avoiding building a just culture could compromise the necessary learning and bring even more challenges for public acceptance in case of accidents.

The unified safety committee proposal was discussed and presented for the UAM ecosystem, which comprehends different organizations and governance systems. The holistic approach is novel and reflects on empirical studies with pilots and managers about the line between acceptable and unacceptable behavior [59]. Differences in perceptions of what is considered acceptable or not were found. Gray areas regarding interpretations, technical and non-technical assessments, and decision-making were highlighted. Finally, insights about the uncertainty among pilots and managers regarding disciplinary measures and accountability underscore the need for a unified approach, as the UAM Safety Committee proposed.

5.3. Limitations

A prominent limitation is the reliance on modeling, which inherently simplifies the complex UAM ecosystem. Models are abstractions that may not fully represent the reality of UAM operations. Therefore, the findings should be interpreted as insights and approximations rather than absolute truths. Like any modeling framework, the results are subject to the assumptions and simplifications inherent in the chosen resource. Moreover, the UAF has a metamodel [56] with a defined ontology and semantics. Although the architect has some freedom to create elements, views, and relationships, most of the modeling effort follows the established rules in the language specification and guides [54,55]. The architect is a limitation as a resource that conceptualizes the architecture. Even skilled architects may lack specific knowledge or present bias that brings limitations to the architecture as a product of human cognitive work.

Moreover, the process of conceptualizing and elaborating architecture is deeply influenced by the architect’s subjectivity, a unique and valuable perspective in collaborative efforts. Different individuals or groups of architects can propose different solutions for the same problem, each bringing their own distinct viewpoint. This process involves multidisciplinary teams, discussions, validations, iterations, and recursions, all of which are different parts of the methodology that aim to converge to an elegant solution. Notably, the outcome of the architectural elaboration is typically not rigid and final. Modifications, improvements, and situational tailoring are expected and can occur in a manner that supports the enterprise’s goal.

Complexity is another aspect that brings limitations. UAM is a complex and evolving System-of-System. Despite efforts to explore it holistically, the dynamic nature of UAM may result in some aspects being beyond the scope of this article. On top of a complex ecosystem, UAM is a conceptual operation. Data availability relies on conceptual studies and proposals for an imagined future. There are no actual data; only extrapolations and reasonable assumptions. The quality and availability of data related to UAM are also limitations. Lastly, there are interdisciplinary challenges. Integrating multiple disciplines, methods, and subjects, as this work does, is challenging. The interdisciplinary approach introduces complexities that require trade-offs in depth and breadth. Since the ecosystem perspective proposes a whole visualization, there are more perspectives than those developed by this research. Likewise, experts invited to discuss and validate the views do not represent all possible contributors. Consequently, the validation and discussion are limited to the expert’s experience and knowledge.

5.4. Next Steps and Recommendations

The following steps in the architecture model include detailing operational processes and performers to address the responsibilities identified in the personnel structure. Resource exchanges can also be detailed and decomposed into processes and data. Future contributions to the research can address the challenges discussed with the unified committee proposal. Moreover, a case study can frame an actual location with known transportation providers, local and regulatory authorities, and known vertiport operators. Exploring the challenges with actual players can mature the discussion and promote benchmark knowledge.

Recommendations for regulators include transparent and standardized reporting and investigation procedures for incidents or near-misses in UAM and advocating for increased collaboration and communication among regulatory bodies, UAM operators, vehicle manufacturers, and Original Equipment Manufacturers (OEM). Furthermore, small organizations, subcontractors, or organizations without aviation backgrounds pose an additional challenge to the ecosystem safety culture. Regulators, authorities, and established organizations in the aviation domain shall collaborate and carefully include these small players in discussing event-reporting standards. Utilizing architectural views, such as the unified safety committee structure, can help communicate the overarching safety culture and operational framework to these smaller entities. While regulators and larger organizations may lead in defining event assessment and investigation protocols, EA can serve as a guide for training, fostering accountability, and promoting engagement across all types of organizations. It provides a holistic view that helps smaller entities understand their role, responsibility, and connections within the broader safety landscape, including aspects like reporting procedures and engagement with unions/professional associations. Although EA implementation may vary based on organizational size and complexity, its strategic use as a guiding framework can facilitate the integration and alignment of diverse players, including new entrants, in the UAM ecosystem.

Lastly, future implementations of the proposed structure and behavior in the UAM architecture can be performed using the design definition process in ISO/IEC/IEEE 15288 [55]. Additional considerations for the design of System-of-Systems (SoS) processes are defined in ISO/IEC/IEEE 21840 [56]. The organizational structure and processes of the architecture represent requirements for the UAM safety management implementation.

6. Conclusions

In conclusion, this article has examined the foundation for establishing a just culture within Urban Air Mobility (UAM) operations. This study has underscored the importance of a learning-oriented environment where incidents and accidents are analyzed to drive improvements and enhance safety performance. The analysis has delved into the boundaries and challenges of implementing a safety management structure that fosters a just culture throughout the UAM ecosystem. Adopting UAF, organizational viewpoints combining drivers, capabilities, responsibilities, and resource exchange established the approaches and methods for enabling a just culture.

The personnel processes and structure presented in Section 4 addressed the enterprise capabilities and relationships able to manage stakeholders with different interests in UAM safety management. The organizational views also contributed to recognizing the front-line worker’s central role in ensuring safe and efficient UAM operations. Building trust with these workers is essential for cultivating a just culture that upholds ownership, accountability, and continuous learning. This study has explored factors influencing trust-building efforts, including active participation in safety discussions, reporting mechanisms and safety event assessments not attached to hierarchical relationships, fair enforcement of safety policies, and a supportive organizational environment. Furthermore, this research has shed light on the individual and collaborative nature of achieving a just culture within the UAM system.

This study highlights the significance of incorporating a just culture mindset and practices in the emerging UAM ecosystem. New technologies and uncertainties bring unintended consequences. Building expertise with transparency can enable learning and collaborative safety management. Section 5 discussed the results and reflections with other literature. The ecosystem-level consensus and cooperation among organizations and regulatory authorities were highlighted. A unified safety committee was proposed as a space for discussion, learning, and improved communication within the UAM community.

In summary, the research contribution includes views combining different levels in the operational hierarchy, functions, responsibilities, and capabilities. Furthermore, we analyzed the challenges of UAM Just Culture and discussed a cooperation proposal to foster learning in the UAM ecosystem. This is a novel contribution to the UAM field, providing a comprehensive visualization balancing different stakeholders’ interests and promoting a holistic understanding of the safety culture in UAM operations.