Air traffic control has long depended on automated platforms to put key information at the fingertips of controllers, but now new schemes for managing hordes of delivery drones and urban air taxis are pushing the envelope on airspace management innovation. If the wizards of Silicon Valley have their way the innovation will come at a pace that will challenge civil aviation’s capability to accommodate change.
It is against this backdrop that David Woods, one of the leading human factors researchers in the world and an expert on flight deck automation, is serving as an advisor to several air navigation service providers. Woods has been involved in cockpit automation research and analysis for decades at Ohio University. Automated cockpit studies by Woods and other researchers in the 1990s with Boeing and Airbus pilots showed how automation that is strong, silent and difficult to control can cause accidents.
And yet, to Woods’s dismay, a new piece of software that is strong, silent and difficult to direct is implicated in the recent Boeing 737 Max crashes. Woods believes the aerospace industry has not been paying attention to the findings of human factors research on automated cockpits.
He sees the two 737 Max crashes as cases of “automation surprise”, when the crew’s interpretation of what is happening on the flight deck conflicts with what the automation is doing, resulting in confusion. And in the case of the 737 Max crashes, confusion resulted in the crew fighting with the automation for the control of the horizontal stabilizer trim.
Woods sees the Boeing mishaps as a warning for the civil aviation industry, including air traffic control. “We have achieved safety and are taking it for granted. We think that safety is built in and we can just pursue efficiency,” Woods says. The hard-won success in air safety worldwide doesn’t ensure future success if the industry doesn’t stick to systems engineering discipline and is overcome by time and financial pressures.
Civil aviation’s remarkable aviation achievements in reducing accidents and incidents has set the bar high and may be held against the industry in the future, believes Peter Hancock, a noted human factors researcher at the University of Central Florida. “The world we live in is unfair in some ways,” he says.
With drones and air taxis in the wings, the aviation industry is planning to move beyond just automation which is “linear and deterministic”. Hancock believes this may lead to the situation where there will be “Autonomy surprise” and raises the question of whether humans should interfere or “does the computer know best”.
Remote operations and AI
In air traffic management, Woods sees the rising tide of air traffic, the impact of extreme weather events and the advent of fundamentally new technology creating an unstable environment. At its heart, ATC continues to rely primarily on human cognitive skill and it is not clear how the fundamental instability created by these trends is going to affect human performance.
New technology trends in ATC include remote towers with cameras and software applications that present images for use in controlling traffic from a site that can be a hundred kilometers or more from the airport. Software applications that rely on artificial intelligence can process imagery to provide key information to controllers at the remote site.
As operational uncertainty rises, the humans in charge want to be able to anticipate what is going to happen with, for example, an unexpected amount of air traffic or a workload bottleneck. “I’m worried about sudden spikes in workload,” Woods says. “We need a mechanism to manage uncertainty and a mechanism to allow us to anticipate changing loads and the complexity of air traffic.”
In a recent discussion with a major air navigation service provider Woods explored how controllers adapt to make the system work when unexpected things happen. “We have to find a way to mitigate that uncertainty and manage it,” he says. “When we evaluate the design of new technology and implement it we have to understand how it may create uncertainty.”
It is also necessary to understand the safety implications of how controllers are adapting to cope with unexpected situations. Even if new technology reduces workload and increases traffic capacity so controllers can handle a higher load smoothly there will still be disruptions at times that create spikes in workload.
Major software outages sometimes occur in air traffic control. Woods cites an ATM system malfunction at Dublin Airport, Ireland in July 2008 that originated in the flight data processing system. Controllers stopped using the emergency backup mode when the system was found to be unstable. As a result, aircraft movements at Dublin were severely curtailed with diversions to Belfast and Shannon. Aircraft flight plan data decoupled from the corresponding radar track on the screen and controllers lost confidence in the system as workload increased. Investigators found a faulty network interface computer card was to blame for flooding the network with spurious messages. No aircraft were put at risk, according to a report issued by the Irish Aviation Authority.
Woods believes that no system is perfect, so the challenge turns to how well is it designed to help the humans deal with disruption when it occurs.
A recent study by Woods funded by NASA examined how drones with on-board selfcontrol capacity and automated decision making can offset unreliable command and control links to permit operations to continue during a lost link. The study found that controllers did not rely on a drone providing self-separation with onboard detect and avoid capability when satellite communications were lost. Instead controllers diverted other traffic away from the drone. The study only focused on four air vehicles at one time and did not ask what might happen during lost links when bad weather is added to the mix. The report concludes that more work is needed to analyze the effects of deployment of autonomous capabilities on integrated air traffic systems.
Woods was surprised when some industry executives consulted him about the findings and said they wanted the drones to rely exclusively on satellite communications for the link being studied rather than using diverse channels. According to Woods, they said it would be easier and cheaper to manage and operate a sole source system. “That was the conversation and it indicates the pressures the industry is under,” he says.
Woods adds that even when it comes to the careful study of innovative technologies such as detect and avoid for drones there is not enough money for a broad examination of the critical issues involved.
Dealing with disruption
Considering a wide range of disruptive conditions and how different pieces of automation can act as cooperative agents in a shared activity space will be key to handling disruption when it occurs. “You can guarantee uncertainty is going to have to be resolved and that you will need anticipatory information to develop decisive responses to things that need to be avoided, such as workload bottlenecks on critical roles,” says Woods.
System designers also have to consider underloads, when traffic is so light that all of the tighter aircraft spacing is not needed and the system can be relaxed so aircraft are not is such close proximity as they are when loads are high. Woods says, “The key point is as we increase automation and as we increase technology insertion we increase our dependence on software intensive systems that are not pristine.
“These are not mechanical systems whose reliability is fixed, they are changing systems that are highly interdependent.”
The Boeing 737 MAX design assumed that if things went wrong with MCAS the pilots could step in to correct it using a long established electrical trim system emergency procedure. In a similar fashion, an ATC architecture that assumes that machines will handle things until they are no longer able to and then people will step in to deal with an unusual situation, is “bad architecture” in Woods’s view. This approach will only work when the rate of surprises and anomalies is low, not when they can combine and cascade because of system complexity.
A further challenge is that controllers may not even get practice in handling smaller non-normal situations when they are expected to step into the breach “and handle the big thing that goes wrong when the machines can’t really deal with it,” Woods said. The irony is that they may be blamed for not saving the day if the 737 MAX accidents are a guide.
A growing challenge
The drone industry plans to manage its own air traffic below 400ft using highly automated private Unmanned Traffic Management (UTM) systems tested by NASA on an experimental level. Drone flight plans and intentions will be filed with a private company that will monitor the flight to make sure it conforms to plan. Any anomalies during a flight will be reported to drone operators in the area. Just exactly how such a system will interact with traditional air traffic control to keep drones clear of manned aircraft in the area remains to be seen. Drone flight demonstrations (see box, Testing drone traffic integration) are exploring how a UTM system and traditional air traffic control should interact.
Then autonomy is another leap forward from high levels of automation. “We have not worked out the coordinated, responsive, flexible, adaptive architecture needed for air navigation in a world with increasingly automated parts,” he says.
Whether the industry recognizes it or not it is dealing with new territory, a new kind of complex system that requires innovation and research. “I find that nobody is funding that kind of work,” Woods says.
“We have been trying to take a leap forward in air traffic as long as I have worked in aviation,” he says. But it is difficult to make incremental changes in the system alongside new technology designed to enable the system to handle greater loads. “People are pushing forward a bunch of changes that are significant. The question is how do we make that work coherently, given there will be brittle points where it needs to be adaptive and responsive to disruptions.”
TESTING DRONE TRAFFIC INTEGRATIONAn unmanned aircraft system test site in upstate New York is demonstrating the capabilities needed for a drone to operate airport-to-airport in part to explore the overlap between low altitude drone airspace and manned airspace above it.This preliminary test of how Unmanned Traffic Management (UTM) airspace will relate to traditional Air Traffic Management (ATM) is important because communications and visibility between these two is needed for progress to be made in commercial drone activity. While UTM is intended for airspace below 400ft in uncontrolled airspace, this will not support all drone activity in the future, according to organizers of the test program.The flight operations of a 500 lb maximum takeoff weight TigerShark will be conducted by Navmar Applied Sciences Corporation in the FAA-designated UAS Test Site under the leadership of the Northeast UAS Airspace Integration Research (NUAIR), a New York-based nonprofit. The drone operators will be in contact with Syracuse Radar Approach Control. There will be up to three flights from three upstate New York airports: Griffiss International Airport, Syracuse Hancock Airport and Oswego County Airport. This allows NUAIR to exercise the full length of the New York UTM corridor.Researchers are to investigate the interfaces between UTM and ATM in terms of what and how drone-related information should be communicated, to ATC and pilots.