AF447 Analysis I: Automatic For The People?

Following the publication of the final report into the Air France AF447 air crash, Aimée Turner asks what issues does the high degree of automation within future air traffic management systems pose?

Nassim Nicholas Taleb is a Lebanese American essayist whose 2007 book The Black Swan on randomness and probability has been cited as one of the twelve most influential books since World War II.
In it he proposes that rather than attempt to predict high-impact, hard-to-predict, and rare events that are beyond the realm of normal expectations, we should instead develop a certain robustness to counter their effects.
Taleb’s theories represent the essential objectives of resilience which seeks to develop the capacity to withstand unforeseen adverse events and deal with them.
As both Europe and the US steadily transition from an air traffic control system based on radar technology to more precise GPS navigation requiring controllers and pilots to cede ever more control to automation, the potential of ‘black swan’ events is concentrating the minds of those charged with developing tomorrow’s automated systems.
Within perhaps 20 years, the controller will effectively become a supervisor of a highly automated system and yet one who also fulfils the role of intelligent agent, one that can make tactical decisions in off-normal situations.
While the pressure is certainly on to eke out the biggest capacity bang from the airspace buck, is resilience really being built into this rapidly evolving automated model for the air traffic management industry?
Air traffic controllers have to make the right decision the first time and not after repeated attempts. Today – and most likely in the future too – there remains a requirement for exceptional performance of routine tasks by controllers. The human, automation and the combination of human and automation must all deliver exceptional performance of routine, and non-routine, tasks.
Humans in the loop
Curtis Graeber is an aviation safety and human performance consultant who recently retired from Boeing Commercial Airplanes as a senior technical fellow and chief engineer for human factors.
He says the risk of introducing more automation in order to fly precision approaches is no different to someone driving down the highway and putting their car in cruise control.
“The more we take away the variety of physical cognisant acts that someone has to perform the more you reduce the stimulation to the brain which is going to result potentially in attention loss,” he says.
“Often, automation is more reliable than the human but the main challenge is that when something goes wrong, you want the human to step in and that’s asking a lot of the human. And that’s why the human has to be integrated into the design of these future systems.”
“Computers are dumb but dutiful. They simply do what they are told to do so whatever data they get in, they process it and feed out. When I was at Boeing we built a lot of systems with cross checks of incoming data but, you know, there is always the exceptional case,” Graeber says.
Namely, a black swan event.
That really is the dilemma of modern society: when so many safety critical systems depend on infallible engineering, it is still the fallible human that has to validate the assumptions that automation has arrived at.
Andrew Beadle, the then executive vice president of controller organisation IFATCA  made this point at last year’s Next Generation of Aviation Professionals Symposium in Montreal. “With such automation it can be asked if we still need the human. The answer for the next 20 years at least is yes because the ATM system is not a closed system where every event can be predicted and every event controlled.
“The selection of a runway to land on or take-off from still depends on which way the wind blows. The exact nature and severity of severe weather that is incompatible to flight operations is still something that we must react to and that we are not able to control. The human is there for their ability to rationally handle unforeseen or uncontrollable events.”
Passive approach
Speaking at last year’s ATC Global webinar, Andrew Kilner, an expert in human performance and safety research with Eurocontrol and who leads human factors work within the European ATM modernisation programme SESAR, explains that the industry is driving controllers from being active participants in the control process to being passive.
“This is a very different skills set and a very different role. What we are asking controllers to do is problem solve. The future for SESAR quite literally is for controllers to jump in and solve conflicts and then to go back to monitoring.”
Pilots, meanwhile, will be asked to assume active ATM roles, supervising their own airborne separation and acting on traffic collision avoidance system alerts when they may not necessarily expect them.
“We also have to think where accountability and responsibility lies within the man/machine interaction. We have to remember that if you take a task away from a person and you give it to a machine, that when the person is asked to make a judgement about the suitability of the information that has been provided, they are highly likely to accept it on face value.”
Kilner also questions whether automation can ever really achieve machine-mediated negotiation in high tempo operations which improve on the efficacy of swift derivation of solutions provided by today’s voice-to-voice system.
Kilner believes that as an industry, air traffic management needs to ask itself how and what is to be automated and what does automation represent in the context of ATM. Does it want systems that detect and suggest strategies, systems that offer a huge depth of information that requires interpretation or radical change that simply changes the job of the controller.
“These are not easy discussions and not one will be adopted as a universal panacea,” Kilner says, adding: “All automation needs to be wrapped up in this understanding of how to manage and protect safe behaviour because one thing you can guarantee about automation is that the result of using it will not be those we intended or predicted.”
Inclusive process
Alexis Brathwaite, president and CEO of IFATCA, believes air traffic controllers will, for the foreseeable future, remain a core part of the ATM system and that in any system that is developed the role of the human should be by design rather than left as a residual task.
“We know that with automation we will have a high degree of predictability which has often been touted as a weakness in the current system. But what the human brings is a level of flexibility that allows us to gain the most from automation,” Braithwaite says. “
He insists that in IFATCA’s experience, implementation has worked best when controllers are involved through the design, the simulation, the implementation and the review of automation.
“Controllers actually look forward to change and improvement. What tends to happen when you throw a whole level of change in there is that the air traffic controller still needs to ensure the same levels of safety and efficiency are achieved. If we raise questions it is because there are legitimate questions,” says Braithwaite.
Gregg Leone is executive director of system transformation and integration at MITRE which has for years worked on the challenge of pitching humans against automation both within NextGen and the many ATM modernisation initiative which have preceded it in the US.
Because MITRE is so heavily involved in the early development of concepts before they are pushed out into industry for commercialisation, Leone supports Braithwaite’s view of the need for consensus-building at that initial stage.
As part of that effort, MITRE expects to have to define what the concept is in a human-in-the loop demonstration. Not only will that but the research organisation is required to show value, not only the associated cost benefit but also risk including a safety analysis.
Lastly, MITRE will also demonstrate empirical data to support its concept including field trials to show the claimed increase in efficiency and safety.
“The greatest challenge is changing the role of pilots and controllers. We have worked on it for years to assess what exactly humans can and cannot do,” he says.
Degraded operations
For Leone, however, the critical issue surrounding future automation in air traffic management resides in protecting safety critical systems against technological infrastructure compromise: degraded operations where subtle changes steadily increase workload and impair necessary safety nets.
“There continues to be challenges about how to deal with degraded operations,” says Leone. “Can you fall back safely in degrade mode operations?” he asks. “It is often hard to pull the pilot or controller back in quickly so the fall-back option has to be some sort of automation too.”
Eurocontrol’s Kilner agrees on the dilemma that degraded operations poses and believes that attention tends wrongly to be focussed on the en route arena. “Very little attention is paid to airport operations while some attention is paid to terminal operations but in all these we have to think about root causes. Where do incidents occur and where are the incidents that controllers have to deal with injected into the systems they are using?”
Kilner says the focus of degraded operations should also extend to the recruitment, training, and resourcing of air traffic engineering staff: “Does an engineer going to operate on live equipment have the same extent of training and simulation as the controller handling live traffic as an engineer forgetting to return a radar to operational status is going to have a significant impact on the efficacy of the controller.”
This is important because both Sesar and NextGen are shifting their focus to engineering-based support systems – software, hardware, and networks providing information and data to the controller in a way that has never been done before. “If we continue to focus on the pilot and the controller we are not going to see the major engineering component that will continue to lead to major issues such as Linate and Überlingen,” says Kilner.