European Air Traffic Management is extremely safe. The drawback to this safety record is that it is very difficult to estimate what the ‘underlying’ accident rate for mid-air collisions is now, or to detect any changes over time. The aim is to see if it possible to construct simple ATM safety indicators that correlate with this underlying accident rate. A perfect indicator would be simple to comprehend and capable of being calculated by a checklist process. This problem has been examined using a combination of analogies with simple ‘defensive’ systems with Markov process properties. An important concept is that of ‘system control’: the ability to determine the outcome against reasonably foreseen changes and variations of system parameters. The statistical distribution of future incidents has been analysed by focusing on an index – the Close Proximity Index (CPI) – of separation at the Closest Point of Approach. A promising indicator is ‘Incident Not Resolved by ATC’ (INRA) incidents in which the ground ATC defences have been ‘used up’. ATM Incidents can also be categorised in other ways. Two examples are reviewed: the risk-bearing category for Airproxes and ‘risk of collision/severity’ scores. The second is more promising conceptually, but the existing scoring system has not been demonstrated to have the properties necessary to derive risk estimates. The key question is: if someone says they know how to make a good estimate of the underlying accident rate, then how could this claim be tested? If it correlates very well with INRA, then what would be the argument for saying that it is a better indicator?