IN THE FIELD OF TECHNOLOGY DEGREE PROJECT
VEHICLE ENGINEERING
AND THE MAIN FIELD OF STUDY INDUSTRIAL MANAGEMENT, SECOND CYCLE, 30 CREDITS STOCKHOLM SWEDEN 2018,
Managing Validation in a Safety Critical System Regarding
Automation of Air Traffic Control
ANDRÉS DE FREITAS MARTINEZ NURDIN MOHAMED
KTH ROYAL INSTITUTE OF TECHNOLOGY
SCHOOL OF INDUSTRIAL ENGINEERING AND MANAGEMENT
This page is intentionally left blank.
Managing Validation in a Safety Critical System Regarding Automation of Air Traffic Control
Nurdin Mohamed Andrés De Freitas Martinez
Master of Science Thesis TRITA-ITM-EX 2018:632
KTH Industrial Engineering and Management Industrial Management
SE-100 44 STOCKHOLM
Master of Science Thesis TRITA-ITM-EX 2018:632
Managing Validation in a Safety Critical System Regarding Automation of Air Traffic Control
Andrés De Freitas Martinez Nurdin Mohamed
Approved Examiner
Pernilla Ulfvengren
Supervisor
Matthew Stogsdill
Commissioner
European Performance Management Systems Committee
Contact person
Peter Griffiths
Abstract
The aviation industry is under increasing pressure to reduce cost and manage the increased number of passengers. One area under pressure is the Air Traffic Control. The Air Traffic Control will in a foreseeable future manage the introduction of drones also known as Unmanned Aerial Vehicles by integrating them into civil airspace with manned aircraft. Drones are lacking consensus from authorities with regards to standards due to their rapid expansion. Given their size, shape and speed, they can also pose threats to manned aircrafts and there is a need to address them in an Air Traffic Management system interoperating with manned aircrafts. The purpose in this study is to identify what considerations to make when automating complex system elements with respect to safety.
Safety involves all the different stakeholders in the air transportation system, which is a Safety critical System. Furthermore, the aim is also to identify areas in which European Operational Concept Validation Methodology (E-OCVM) can be complemented with. Standard E-OCVM is missing specific assessment criteria with regards to safety and how it can interact with other standards. The approach is thereby to use various standards with focus on Systems Engineering to complement E-OCVM since it is lacking with regards to how it is used to validate Air Traffic Control systems. To capture the complexity of automating elements of an industry involving many stakeholders, a qualitative analysis was conducted in this project, using a System Engineering
approach with four standards A-SLP, A-RLP, A-DAS and A-SAS. A-SLP and A-RLP are two general standards while A-DAS and A-SAS are focusing on the contexts of aircrafts and software development. Empirical data was gathered by semi-structured interviews of seven experts within the relevant areas in the field. From the review of the four standards, it was found that they can for instance complement E-OCVM in how software errors can lead to a failure condition among other ways. The main identified considerations faced with an integration of drones into civil airspace, is to manage the human interaction with the introduced Air Traffic Management systems. More specifically, the human element must be involved from the training phase in the development of systems in a Safety Critical System to minimize risk. Furthermore, redundancies that are built into the system has to, not only be able to put the system into a safe state, but also be carefully analyzed in how they interact with other systems to avoid misjudgement for the Air Traffic Controllers.
Lastly, to obtain specific details on how interoperability could occur using standards, the standards used in this study refer to usage of other documents and standards. Standards specifically tailored for the operational context of drones would facilitate further testing and implementation of their integration into civil airspace. Given that different standards were used to complement the E- OCVM standard, a set of unified standards are required that are proportional with the type of drones, the type of operations and in the environment that they are operating in. This will be needed to fulfill the European vision of safe integration of drones and needs thereby to be carried out in a global manner, thus also share experience with other actors to advance the new technology adaptation.
Keywords: Air Traffic Control (ATC), Air Traffic Controller (ATCo), Unmanned Aerial Vehicles (UAV), Drones, Safety, Validation, System integration, Quality Assurance, Mixed operation, Interoperability, Training, Standards, System Engineering.
Acknowledgements
We would like to express our appreciation to our supervisor Matthew Stogsdill for the inspirational feedback and cheerfulness to help us stay motivated throughout the project. Furthermore, we would also like to thank Pernilla Ulfvengren for helping us in the initial phase and for introducing us to our company supervisor Peter Griffiths, and additionally for providing us with helpful feedback.
We would further like to express our gratitude to our supervisor at the European Performance Management Systems Committee, Peter Griffiths. He pointed us in a favorable direction with regards to important stakeholders and highly intelligent people in the aviation industry. Lastly, we would like to thank several stakeholders that were our interview candidates, namely Fredrik Asplund, Paul Kennedy, Bengt-Göran Sundqvist, Marc Baumgartner, Eric Kroese and Marek Bekier.
Thank you!
Abbreviations 8
List of Figures 9
1.1 Problematization 16
1.3 Delimitations 17
1.4 Expected Contribution 18
2 Literature Review 20
2.1 Systems Thinking 20
2.2.1 Validation 22
2.3 Safety Critical System 24
2.4 Automation, UAV and ATM 25
2.4.1 UAV 26
2.4.2 ATM, ATC and ATCo 27
2.5 Standards 32
2.5.1 E-OCVM - European Operational Concept Validation Methodology: E-OCVM Version
3.0 Volume I 33
2.5.2 A-SLP - Systems and Software Engineering - System Life-cycle Processes:
ISO/IEC/IEEE 15288 33
2.5.3 A-RLP - Systems and Software engineering - Life-Cycle Processes - Risk Management:
ISO/IEC 16085 33
2.5.4 A-DAS - Aerospace Recommended Practice: SAE Aerospace ARP4754A 34 2.5.5 A-SAS - Software Considerations in Airborne System and Equipment Certification:
RTCA DO-178C 34
3 Method 36
3.1.1 Choice of Research Design & Pre Study 36
3.1.2 Literature Study 38
3.1.3 Interviews 39
3.1.4 Standards Review 44
3.1.5 Method Process 46
3.1.6 Theory on Method Criticism 49
4 Results & Analysis 51
4.1 Standard Review using Key Terms 51
4.1.1 Safety 51
4.1.2 Validation 52
4.1.3 System integration 53
4.1.4 Quality Assurance 55
4.2 Interviews 58
4.2.1 Safety 58
4.2.2 Training Phase 60
4.2.3 Future of System element Design 63
5 Discussion and conclusions 67
5.1 Discussion on Sustainability 70
5.2 Scrutiny of Method 70
5.2.1 Validity 71
5.2.2 Generalizability and Reliability 71
5.3 Conclusion 72
5.4 Further Research 73
7 Appendix 74
7.1 Appendix A 74
7.2 Appendix B 75
7.3 Appendix C 76
8 References 79
This page is intentionally left blank.
Abbreviations
ANSP Air Navigation Service Provider
ATM Air Traffic Management
ATC Air Traffic Control
ATCo Air Traffic Controller
IAA Irish Aviation Authority
ACR Aviation Capacity Resources
UAV Unmanned Aerial Vehicles
SOI System Of Interest
SoS System of System
ScS Safety critical System
CPS Cyber Physical System
E-OCVM Standard: European Operational Concept
Validation Methodology
A-SLP Standard ISO 15288: System Life-cycle
Processes
A-RLP Standard ISO 16085: Risk Management for
Life-cycle Processes
A-DAS Standard ARP4754A: Guidelines for
Development of Civil Aircrafts and Systems
A-SAS Standard DO-178C: Software Considerations
in Airborne Systems
List of Figures
Figure 1. Illustration of how SoS, SOI and system elements can be viewed in the context of ATC (Systems Engineering Handbook, 2006).
Figure 2. A figure on the V-model (Asplund, 2014).
Figure 3. An illustration of controlled and uncontrolled airspace where the grey shaded area is controlled airspace and the white is uncontrolled airspace in proximity to an airport (Eurocontrol, 2013).
Figure A. Illustration of how standard E-OCVM’s table of contents was analyzed (E-OCVM, 2010).
Figure B. Illustration of how standard A-SLP’s table of contents were analyzed separately by the two authors (Systems and software engineering - System life cycle processes, 2015).
Figure C. An illustration of how intelligence is divided with regards to AI in different categories (Russell & Norvig, 2010).
List of Tables
Table 1. A table on the nomenclature used to ease referencing to standards.
Table 2. A table demonstrating segregated airspace & non-segregated airspace.
Table 3. An illustration of different approaches to automation adapted from HALA! ( 2010).
Table 4. An illustration of the levels of automation adapted from HALA! (2010).
Table 5. Illustration of which methods were used to answer each research question.
Table 6. A chart on the procedure of analyzing the literature review.
Table 7a. A table on the interviewees and their respective roles.
Table 7b. Continuation of Table 7a
Table 8a. A table on the interview questions after pre-study.
Table 8b. Continuation of Table 8a.
Table 9. A table on the specific key terms used in the project to facilitate review of standards.
Table 10a. A chart on the procedure of analyzing the standards.
Table 10b. Continuation of Table 10a.
Table 11a. Illustration of how standard E-OCVM’s table of contents were analyzed (this is only an extract from the original picture, for more detailed information see Appendix A) adapted from E-OCVM (2010).
Table 11b. Continuation of Table 11a.
Table 12a. Illustration of how standard A-SLP’s table of contents was analyzed separately by the two authors on each side of the table (this is only an extract from the original picture, for more detailed information see Appendix B) adapted from Systems and software engineering - System life cycle processes (2015).
Table 12b. Continuation of Table 12a.
1 Introduction
The aviation industry is one of the most important transportation modes for a country’s accessibility in the global market and has similarly as in other industries kept a high pace to meet sustainability requirements (Wittmer and Bieger, 2018). The aviation industry consists of various elements in a value chain such as airport operations, yield management for airlines and aircraft maintenance. Moreover, there is also an important element which manages the intermediary connection between an airport and an aircraft, namely Air Traffic Management (ATM). More specifically, ATM refers to the overall management of air traffic while Air Traffic Control (ATC) is a part which controls the movement of aircrafts in the airspace or at airports. The tower can be staffed by one or more Air Traffic Controllers (ATCo), which are the ones providing the service to the aircrafts. The increased pressure from technology transformation and the entrance to the digitization and automation era is forcing the aviation industry to change (Baumgartner, 2017).
With the exception of ATM, almost all previously mentioned elements such as airport operations and aircraft maintenance have been optimized while ATM soon is reaching their limits in terms of capacity and costs (IATA, 2016).
Unmanned Aerial Vehicles (UAV) or drones are rapidly entering the markets (Finger et al., 2016) which is a vehicle with the responsible pilot on the ground. Given the drones current size, shape and speed, they pose threats to commercial aircrafts and are currently flying below height of commercial aircrafts where both parts lack sophisticated detect and avoid systems for each other (Cohn et al., 2017). Currently, tests are being conducted to integrate UAVs to the current system of managing manned aircrafts. One of these tests, a European cooperation, managed by Saab under the framework of the European Defense Agency, is the “MIDCAS Projects”. Their objective is to integrate Remote Piloted Aircraft System (RPAS) or drones into the civil airspace and to function alongside the manned aviation (Saab Corporate, 2015). Besides drones, there are also current advancements in providing a platform for integrating information from actors in the proximity of an airport called SWIM. SWIM has the aim to provide real time information sharing between actors such as airline operations center, airport, ANSP (Air Navigation Service Provider) and vehicles at the airport (SESAR SWIM Factsheet, 2016). Previously, the information received from similar actors were less organised and inflexible which with the increase in capacity demand, attention to environmental pressure and overall economic impact puts pressure on seamless information exchange and access (SESAR SWIM Factsheet, 2016).
Interoperability is a notion to mirror the considerations to be made when drones are to be integrated into the current civil airspace. Given the drone’s capabilities, they can pose threats to aircrafts and there is a need to address them in an ATM system. Interoperability will also be required since ATM is built upon a radar-based system which primarily is beholden to a World War II era system (Oster and Emeritus, 2015), which assumes that similar procedures as today will be used in the future (Griffiths, 2018). The first steps in providing automation in the aircraft industry is to incrementally introduce incremental automation tools, this will continue until the entire system is (or could be) automated (Tay and Becker, 2018). Until this level of full automation is achieved, cooperation
between the human and machine will be even more important as the human operator is still vital to ensure safety and performance (Pacaux M. P. et. al, 2011).
One of the ATCo’s main priorities is to provide safe separation between aircraft which with regards to future implementation of automation at least needs to be as safe as today. A Safety critical System (ScS) such as ATC is a system that is sensitive with regards to safety and whose failure could cause severe damage such as loss of lives (Knight, 2002; Sommerville, 2011). Along with this, there is a fast pace of technological change and the time to market new products has significantly decreased which entails a lag of engineering techniques coping with the new technology (Leveson, 2004). Thereby, introducing new technology leads to an uncertainty within the system to understand all potential risks and behaviors before commercial use. Additionally, automation is starting to make higher level of decisions, making the integration between the automated system and the human more important than ever. Accordingly, this creates new types of system risk which has to be addressed in the different contexts they occur in to avoid accidents.
By conducting a validation and verification on technology advancements one can reassure both for the stakeholders and for the public that the conceptual ScSs are safe (Asplund, 2014). The system developments often also consider easing adaption to stakeholders to facilitate an extensive product introduction. More specifically, validation is defined as “the process by which the fitness-for- purpose of a new system element or operational concept being developed is established” (MAEVA, 2004). Verification is defined as the approach of adjusting system elements and other details if faults or defects are detected to make sure that the individual system is built correctly. Moreover, the terms validation and verification are tools which allow areas such as safety and reliability among others to be structured and transparent (E-OCVM, 2010).
The ATC is viewed as the System Of Interest (SOI) in this study. The SOI is currently facing the challenge of combining drones into the civil airspace, an addition that will further complicate an already complex system (as depicted in Figure 1). A SOI is defined as “a system whose life-cycle is under construction” (Systems Engineering Handbook, 2006). An implementation of an enhancement further requires assurance with regards to quality of the services and products provided in the SOI. The ATC needs to adapt as the drones are introduced, in order for the benefits of drones to be fully utilized safely (Jiang et al., 2016). A paper published by The European Aviation Safety Agency (EASA) specifies that introducing drones into existing airspace has to occur safely and in a proportional manner, which includes congestion management, route planning, weather and wind avoidance (Jiang et al., 2016). Moreover, quality assurance does further need to be considered as several system elements operate in a system of systems. System of Systems (SoS) is defined as an interoperating collection of systems elements that are producing results not achievable by the individual systems alone. Each SoS involves several system elements with different life-cycle phases, which results in a variety of technology maturity levels within SoS. A system element or sub-system is defined as a member of several elements that establishes a system.
(Systems Engineering Handbook, 2006).
Interoperability which is viewed as a SoS creates several challenges as a consequence that each system element functions individually and has its own life-cycle. One system element might be being designed while another system element is being deployed. An interoperating SoS are complex, since more system elements can be continuously added in a non-linearly way.
Incompatible additions could therefore create challenges in the gathering of data from the system elements. The borders between one system element and another is often unclear if not properly defined. Figure 1 below demonstrates an example of an airport transport system with its corresponding system elements; in this depiction the cross system criticality of Global Positioning System (GPS) to air, land and sea navigation is shown. Thus, while GPS is integral for many aviation operations it cannot be changed to fit only the needs of the air transport system but must
also consider many other actors and their requirements.
Figure 1. Illustration of how SoS, SOI and system elements can be viewed in the context of ATC (Systems Engineering Handbook, 2006).
The introduction of UAVs will change the training context for ATCo as it is important to address changes in the form of increasing objects in the terminal/approach airspace. A complemented simulation platform would be required in order for ATCo to maintain the required skill levels.
Barzanty (2018) argues that the role of the ATCo will have to be adjusted to monitor the operations of an automated system regarding failures. Additionally, the current training is mainly based on performance indicators and could focus more on how attention should be allocated in case of a malfunction (Barzanty, 2018). Furthermore, automated tools already exists, such as 4D trajectory management, which coordinates the optimal paths for flights which permits less dependence on ATCo, in order to use optimal flight paths to the destination (ICAO, 2012).
To capture the complexity of automating elements of an industry involving many stakeholders, a qualitative analysis was conducted in this project. Based on a conducted pre-study involving interviewing experts within development of drones and Cyber Physical System (CPS), it was decided that four standards are of relevance to study the standard E-OCVM, namely ISO 15288 which describes system life-cycle processes, ISO 16085 deals with risk management for life cycle processes, ARP4754A is a recommended practice with guidelines for development of civil aircraft and systems and lastly DO-178C which manages software considerations in airborne systems and equipment certification. They are illustrated in Table 1 below with their abbreviations used from now on in this report where the A-standards are aimed to complement E-OCVM. E-OCVM is chosen as a foundation for analysis in the thesis since it is a standard used for managing developments in ATM contexts and further provides structure and transparency when conducting validation processes. However, standard E-OCVM is missing specific assessment criteria with regards to safety and how it can interact with other standards (Scholte et al., 2009). Additionally, Peter Griffiths (2018) argued that the E-OCVM is lacking in regards to conceptual prototypes, for example the model needs updating to take consideration of software techniques. Therefore, four contemporary standards used within system’s engineering contexts have been examined in order to complement standard E-OCVM to enhance it as a validation tool.
There are various stakeholders involved in developing systems regarding ATC with a variety of objectives (Schaar and Sherry, 2010). For instance, there are airlines and airports which have a profound impact on ATC operations as the ATCo manages the communication with the airlines or aircrafts in a given airspace and is often situated at an airport. Therefore, one has to be conscious with regards to safety when conducting changes to systems such as providing an extensive automated system. This thesis will focus on ATC rather than airlines and airports but describe them whenever distinction between these actors are valuable for the comprehensiveness of the report.
Air Navigation Service Providers (ANSP) which can be viewed as private or public entities providing air navigation services in a region or country, will also be considered as they are responsible for the procedures and policies used by the ATCo’s. The relationship between ATCo and ANSP is that ATM is a service provided by ANSPs in which ATC is a part. ANSPs exist in a variety of ownership forms, ranging from governmental departments and state-owned companies, to privately held organizations. This thesis includes interviews with two ANSPs who helped to frame the problem.
Table 1. A table on the nomenclature used to ease referencing to standards.
Standard Abbreviation in this
report
Description of standard
E-OCVM E-OCVM European Operational Concept
Validation Methodology
ISO 15288 A-SLP System Life-cycle Processes
ISO 16085 A-RLP Risk Management for Life-cycle
Processes
ARP4754A A-DAS Guidelines for Development of Civil
Aircrafts and Systems
DO-178C A-SAS Software Considerations in Airborne
Systems
Commissioner
This master thesis was performed in collaboration with European Performance Management Systems Committee (EPMSC) based in the UK. EPMSC is a company overseeing interactive techniques for various types of changes where the aim is to manage risk and assess performance tools based on the challenges of a changing world. EPMSC was originally contracted for 6 years to do the European Performance System for Air traffic Management. The company supervisor was Peter Griffiths who was the chairman of the Performance Review Body of the European Union from 2010 to 2016 and the former Director of General Civil Aviation UK. EPMSC’s mission is to automate the aviation industry in areas such as ATC by taking incrementally small steps such as automating small drones into civil airspace and subsequently larger UAVs into the same airspace.
The final stage of which is to automate large passenger UAVs into ATC. In addition, EPMSC works closely with different aviation authorities in an iterative process, by sending them prototypes and receiving feedback. The industry problem also lies in the soft managerial and public factors, ensuring to the public and stakeholders that the technology is safe for large-scale implementation (Griffiths, 2018).
1.1 Problematization
Beyond integrating UAVs into civil airspace, there is a complexity involving customer interaction posing a challenge of introducing new developments into a ScS (Finger et al., 2016). Additionally, given that the previous SoS is regarded as safe, an issue faced by the new system element combined into the previous SoS is to preserve the safety levels to allow further operations in a larger scale.
Given that many of the system elements are in a development phase, standards will be of importance to ensure that the developing system elements are achieving specific safety assessment and certification requirements. The problem lies in using the right standards that are intended to give rise to the development of an automated complex system element that is not currently existing.
Additionally, drones can be represented by a wide range of aircraft that vary in size and complexity, it will thereby also be important that the standards developed are proportional with the type of environment they will operate in (Sesarju, 2018).
One way to validate systems is to use various standards when it comes to conceptual systems. An attempt to supplement the validation of conceptual systems can be made by using the standard E- OCVM, but this standard is lacking as argued by Scholte (2009). Scholte discusses that E-OCVM restricts validation and the overall interaction with other documents is not covered, specifically it is mentioned that E-OCVM can not validate diverse and contradicting requirements with various validation views. Scholte’s approach of improving E-OCVM is by making sure effective communication is established between developers and validation teams, where important aspects are operational concept versions of maturity. However, a different approach is to include a combination of relevant standards that can complement E-OCVM. Therefore, a comparison between various standards has to be made in order to complete and supplement the standard E- OCVM. The use of several standards are necessary because according to Maeva (2004) (an earlier version of standard E-OCVM), no real defined standardized framework for conducting validation exercise has been made, secondly, the identification of gaps and avoidance of overlaps in the validation activities conducted by several European projects need improvements, and thirdly, it lacks promotion of synergy between validation activities conducted at national levels (MAEVA, 2004). Ultimately, a comparison between technology and standard levels is necessary in this ScS.
To summarize, one has to ease adaptation of new products to stakeholders which can be managed if new systems are validated extensively. Furthermore, validation of systems can be conducted by using standards and in this case supplement E-OCVM to enhance it as a validation tool. It has further been mandatory to apply the standard E-OCVM in collaborative ATM R&D projects of the European Commission and Eurocontrol since 2005 (E-OCVM, 2010). Standard E-OCVM is a commonly used standard in ATC contexts but is lacking with regards to safety and deployability with other frameworks (Scholte et al., 2009). Therefore, a comparison between various standards are to be made in order to complement and enhance E-OCVM as a validation method.
1.2 Purpose & Research Questions
The purpose in this study is to identify what considerations to make when automating complex system elements involving different stakeholders in a ScS. Furthermore, the aim is also to identify areas in which E-OCVM can be complemented by using standards since standard E-OCVM is lacking with regards to how it is used to validate ATC systems.
Given our problem formulation, we have formulated the following research questions (RQ):
Main RQ: How can a conceptualized system be evaluated to ensure that it meets or exceeds the current system safety performance?
RQ1: What are the primary concerns of stakeholders’ in this specific ScS (ATC) in terms of merging automated new systems into the existing system?
RQ2: What are the predictions for future system element design according to stakeholders in regards to a ScS (ATC)?
RQ3: How can a currently mandated standard E-OCVM be supplemented by already available knowledge about other complex systems?
1.3 Delimitations
The supplement of E-OCVM is not meant to include every detail of the chosen standards but rather focus on analyzing key terms. A pre-study gave the crucial information to what these key terms were. The reason for using key terms were to facilitate the analysis of standards with regards to the limited time frame of the project.
To facilitate the analysis of the standards, four key terms are used namely safety, validation, system integration and quality assurance. These terms were chosen as they were thought to cover the most areas of the standards which were chosen based on a conducted pre-study (which will be described in the method section).
One of the aims with the study is to analyze how standard E-OCVM can be complemented to enhance its validation of ATC using validation as a foundation. However, the paper is excluding the verification aspects because of the complexity of verification in terms of involving detailed system functionalities and therefore considerations are made primarily to the validation requirements. The project is not focusing on implementing a physical solution to the problem, but rather focusing on the opportunities and threats an implementation of the new system can create considering safety.
Finally, the study will focus on terminal/approach areas which more specifically involves areas around airports since they are considered to be the most congested areas.
The thesis will primarily focus on non-segregated airspace which today consists of controlled airspace where airliners fly and uncontrolled airspace where UAVs fly which is described in the following Table 2. However, segregated airspace has been touched upon in certain areas in this study to add value to the understanding of non-segregated airspace. In addition, the notion of interoperability used in this thesis refers to UAVs being integrated into controlled airspace.
Table 2. A table demonstrating segregated airspace & non-segregated airspace.
Segregated airspace Non-segregated airspace
Controlled airspace Controlled airspace Uncontrolled airspace
Manned Aircraft & UAV (Military)
Manned Aircraft UAV
1.4 Expected Contribution
With this research, we aim to contribute to the academic literature by analyzing several concerns stakeholders have within ATC to obtain a more extensively automated system for ATC. An automated system for ATC is needed to reduce cost and manage the increased amount of passengers. Another area of concern is the multiple commercial opportunities provided by UAVs which go beyond photography and surveillance to possibly operate similarly to a large passenger aircraft. However, given the drones current size, shape and speed, they pose threats to commercial aircrafts and are currently flying below the height of commercial aircrafts where both parts lack sophisticated detect and avoid systems for each other (Cohn et al., 2017). In addition, there is currently no interoperability where ATC can communicate and track drones which requires enforcement of rules by aviation authorities (Sesarju, 2018). However, there is a lack of notion on how these challenges can be faced in both theory and industry, nor how they can be used to create an opportunity. Moreover, since UAVs is an emerging technology, there is also a lack of standards which would facilitate obstacle removal in areas such as safety and reliability but also how it can interoperate with other products and services. Therefore considerations with regards to future system element design related to the stakeholders opinions are conducted along with their implications.
1.5 Layout of Thesis
Chapter 2 will present the theories and literature review, including information about the standards used based on the purpose and research questions of the study. Chapter 3 will describe how the study has been executed with the choice and purpose of the research design as well as methods for data gathering. The results of which will subsequently be described in Chapter 4, provides the information retained from each interviewee, in addition to the information collected from the standards that will be based on a chosen set of key terms. In the same chapter, the findings from empirical material is also compared among each other and to the literature review and argued for with regards to the research questions. Chapter 5 includes the scrutiny of method, discussion and conclusions by presenting the most important aspects that acknowledge the purpose and research questions along with interesting topics that potentially could be further research material.
2 Literature Review
To fulfill the purpose of the study, existing theories and literature relating to the context of the study are addressed and explained in this section.
2.1 Systems Thinking
System thinking, can be defined as the method to which problems are solved through a System Engineering approach or operational research. For example, deconstructing problems and issues into simple understandable pieces and then reconstructing the pieces to understand the holistic problem (Adams et al., 2014). When all aspects of system thinking are specifically assembled based on a scientific foundation, this is what is known as System Theory. Furthermore, what Systems Theory implies is that it describes real-world systems. System theory is a collection of propositions that all have the one common goal, to provide consensus within the systems (Adams et al., 2014). Systems Engineering is a proper choice to examine the problem of this study since it gives a framework which allows for the integration of many different actors’ perspectives. For the ATM to function, each of the actors must be able to work and communicate effectively even though they each have different perspectives.
Interoperability is a specific term used to provide consensus within systems. More specifically, it depends on the compatibility of both larger and smaller systems involving different ranges of complexity to function as a single entity (Systems Engineering Handbook, 2006). Given that many systems that are existing were built based on a historical preference, components of a technical system can be rather difficult to replace due to existing barriers such as high transaction costs to pass on or to create an enhancement of a system (Driscoll, 2014). Therefore, it is often preferred to complement older system elements with newer which makes interoperability among the complex system elements important to achieve (Systems Engineering Handbook, 2006). Similarly, System of Systems (SoS) is defined as an interoperating collection of systems elements that are producing results not achievable by the individual systems alone. The challenges SoS can create during development are that the systems have capabilities of being operational without the other systems, because these can have different life cycles, creating boundaries such as older systems limiting the overall performance of the SoS (Systems Engineering Handbook, 2006). To put this in a context, the implementation of including UAVs into the existing operation of manned aircraft, even further adds to the complexity of the SoS. By adding system elements, the complexity can increase because of conflicting or missing interface and can further worsen data exchanges across the SoS. The UAVs giving rise to complexity can be alleviated by providing proof that the system will operate safely under normal conditions and by using specific validation procedures.
2.2 System Engineering Approach
System Engineering is a combination of several disciplines and it enables the understanding of successful systems. It takes into consideration both technical and business needs from the client and stakeholder. The life spans from the concept to the retirement of the system. The System Engineering disciplines also assist with the collaboration among all parties involved to manage a modern system (Systems and software engineering - System life cycle processes, 2015).
To shed light upon a detailed strategy in which safety is one of the main priorities, a life cycle model consisting of different stages is applied to capture the complexity of system development.
More specifically, the life cycle model is comprised of different stages such as presentation of a concept, development, production, utilization, support and retirement (Systems Engineering Handbook, 2006). Each step has a certain purpose to fulfill which initially is to identify stakeholders and their requirements. Then the system is developed while verifying components and refining system requirements. To further facilitate the development phase, one often prioritizes the most important stakeholder requirements to obtain a simple prototype and subsequently consider other requirements when enhancing the product. Depending on how well the development is carried out, the production of the system is subsequently initiated in which a test and redesign similarly as in the development phase are conducted. Subsequently, the product is operated in the utilization stage where there often are product modifications throughout the introduction to enhance system capabilities. Lastly, there are support and retirement stages with the purpose of providing maintenance, logistics and other support services to facilitate operation of the product.
Whereas, the retirement stage is focusing on how to provide capabilities of system removal during the end of the life cycle.
In Figure 2, the V-model is described which aims to holistically illustrate the activities in the lifecycle stages from a system’s engineering perspective and further highlights the importance of continuous verification and validation during the different life cycle stages (Systems Engineering Handbook, 2006). More specifically, it is necessary to act on verifying the system requirements during the initial stages and simultaneously validating the quality with stakeholders to assess risks and opportunities. The V-model can be further viewed from a horizontal and a vertical perspective.
Iterations made along the horizontal axis describes how far in time and the maturity of the project while upward iterations involve stakeholders to validate the ongoing activities. On the contrary, downward vertical iterations activities comprises risk management investigations along with measures taken to ensure an acceptable finished product. Based on Figure 2 below, the verification is part of the iterative processes in the system design and implementation while validation comprises primarily the initial and final stage of the V-model. As described in the delimitation in section 1.5, the study is primarily excluding the verification aspects and focusing on the validation requirements.
Figure 2. A figure on the V-model (Asplund, 2014)
2.2.1 Validation
Validation aims to control whether an item or a product has been built to fulfill its purpose which in the previous figure involves the initial requirement collection and the final checks of whether the system fulfills the initial requirements (Honour, 2018). The development of a product has in general many inputs such as suppliers’, stakeholders’ and acquirers’ requirements while simultaneously balancing with the capabilities of the designers in terms of their preconditions.
Furthermore, this creates a situation where the expected output of the product can show to not fulfill its intended purpose (Honour, 2018). In addition, to overcome this situation, the products often have to be redesigned during the product development along with the review of standards towards the fulfillment of the validation aspects (Systems Engineering Handbook, 2006). The translation of the stakeholders desires into system requirements is also complex which makes the process more difficult. Upon the final completion of the product, the product is tested to ensure the final system performs as the stakeholders desire.
Challenges in validation testing
Beyond managing complex requirements from stakeholders in the process of validating, other challenges exist such as conducting a complete testing when deploying safe autonomous vehicles into existing traffic. This challenge is important to address given that interoperability among UAVs and manned aircraft will be conducted in a similar way. The infeasibility of testing an operation with a large number of vehicles to ensure safety is due to safety concerns towards the public but also due to the repetition of the tests to achieve statistical significance (Koopman and Wagner, 2016). Moreover, in the context of conducting validations on aircraft, the environment of simulation is important to consider to imitate aircraft performance since there is an infeasibility with regards to costs of conducting an aircraft validation (Aerospace Recommended Practice: SAE
Aerospace ARP4754A, 2010). Beglerovic et al. (2018) argue that testing and proving on public ground can be very expensive, time consuming and hard to reproduce. On the contrary, simulations offer high reproducibility with regards to effort but the challenge lies in selecting proper scenarios along with parameter variations which will cover a set of variations sufficient to properly model the system in question (to a reasonable degree). In addition, the difficulties further lies in not being able to perform a full factorial testing comprising 10x tests which contributes to a lack of certainty about the assumptions one can make in a real scenario. Koopman and Wagner (2016) argue that based on the impracticality of deploying vehicles managing all scenarios, a change to the current developer practices has to be made. A suggestion according to the same source is to use a phased development which entails using a method whereas few scenarios as possible are tested in a simulation before combining various scenarios more extensively.
Other existing challenges in the context of autonomous vehicles testing is the shift of human intervention such as lack of control input. These situations where an ability to take corrective measures is limited requires a more advanced back-up in the autonomous system. In addition, this adds significant complexity to deal with all of the possible scenarios. Koopman and Wagner (2016) argue that regardless of these challenges in an autonomous vehicle, a common denominator is to detect when functions are not working properly and accordingly, this is viewed as an important first step to bring the system to a safe state.
Validating Existing and Conceptual ATC Systems
According to MAEVA (2004), validation within ATM context, is defined as “the process through which an ATM concept goes during its life cycle in order to ensure that it addresses the ATM problem for which it was designed and that it achieves its stated aims” (MAEVA, 2004). Validating from the existing to conceptual ATC as SOI, apart from fulfilling its initial aim, the system requires to meet what the standard requires and thereby complete the validation exercises that exist within this standard. Validation of conceptual tools can follow similar approach as conducted by the two the examples below:
1) In the paper Validation of the OPTAIN-SA tool for Continuous Descent Operations by Lorenzo et al. (2018), they perform a validation exercise on a new ATM tool called OPTAIN-SA, the tool assists ATCo with their everyday work spreading the usage of an operation of descending, which helps aircraft descend in a particular fashion for fuel saving.
The validation exercises they performed was firstly, a fast and real time simulation, using only the OPTAIN-SA tool. Secondly, it was conducted in a real time flight demonstration, through Barcelona area control center (ACC) to Palma terminal control area (TMA).
Thirdly, comparing data from vertical and longitudinal separation based on both surveillance data collection (old way) and using OPTAIN-SA data analysis (new way).
(Lorenzo et al., 2018).
2) According to Manfredi (2018), they validate their Collision Avoidance System (CAS) by dividing it into three categories, safety, operational and acceptability metrics. In this case the safety metrics (e.g risk ratio comparing safety with and without the tool) measure the capacity of CAS to prevent near midair collision. The operation metrics measure the disturbance of the avoidance of aircraft movement in an airspace filled with different actors including ATC. Acceptability metrics is a measurement that demonstrates how the fidelity is rated of the remote pilot to the system. The three different metrics represent how much a remote pilot can trust the system element to represent a real pilot. (Manfredi et al., 2018) Beyond validation and its usage in conceptual systems, verification aims to confirm system requirements in detail with regards to system elements which shows that the system has been built right (Systems Engineering Handbook, 2006). In contrast, validation aims to answer if the system is fulfilling its intended purpose after the product has been built. Verification is similarly as validation further used as a process in the V-model where the process confirms whether all the elements in a SOI perform their intended functions and meet their performance requirements.
Given that both validation and verification are a necessity in system development, they give rise to different issues in terms of perceived risks, safety and criticality of the element under consideration. Accordingly, verification has been excluded from the scope but is however described whenever distinction between the two terms is valuable for the comprehensiveness of the report.
2.3 Safety Critical System
Safety and risks are terms used in several different contexts but the definition also varies in relation to the context they are used in. For example in economics, risks can have positive aspects whereas in the context of aviation risk is often connected to unwanted outcomes from hazardous events.
Furthermore, one general definition of risk is “the probability for an unwanted event to potentially cause harm” (Westergård, 2016). Raussand (2011) argues that safety is “a state where the risk has been reduced to a level that is as low as reasonably practicable and where the remaining risk is generally accepted”. Furthermore, within the context of aviation, ICAO has a similar definition which is “the state in which the possibility of harm to persons or of property damage is reduced to, and maintained at or below, an acceptable level through a continuing process of hazard identification and safety risk management” (Safety Management Manual, 2018). The relation between safety and risks is further used in systems engineering through identification of risks inherent in a design in which risk mitigation measures are suggested as the design progresses.
During the design process, hazards are usually tracked and identified so a decision can be taken with decision makers to continue the process if the hazards are below a specified level (System Safety Engineering, 2018).
Leveson (2004) argues that many of the flaws with regards to safety in systems are due to dysfunctional interactions among system components rather than failure of an individual component. An example is the loss of the spacecraft Mars Polar Lander and the rocket Ariane 5
which fully satisfied their individual system requirements but lacked the understanding of the components behaviors on the system as a whole (Leveson, 2004). The same source also argues that the intention of including a redundancy to protect against individual component errors should involve careful consideration as how these affect the whole system with regards to system risk since it can even exacerbate the situation by adding complexity. Rasmussen (1997) argues that the role of humans in accidents will depend on the contexts in which human action takes place, and that the context will dictate what is the most effective approach to maintain safety.
2.3.1 Maintain a Safety Critical System Safe
The simplest way when introducing safety in regards to aviation, is to maintain the system element as it is, or better to not even lift the plane from the ground. This way of reaching the safety goal is not feasible because then no aircraft would ever be utilized. Regulations or standards seeks to change behaviors of being too safe which can hinder deployment in order to produce a desired outcome which in this case is to fly the aircraft as safely as possible (Coglianese, 2012). However, with the usage of safety standards it is important to emphasize the contexts that they are used in since a consideration used in one specific standard can violate the attempts of another (Asplund, 2014). Furthermore it can also be complex to measure the effects due to the involvement of a complex chain of interactions, interventions and impacts. Asplund (2014) further argues that standards should be viewed as best practices to provide high level and infrequent feedback rather than precise measures with specific assessments.
2.4 Automation, UAV and ATM
Automation is defined in relation to a technology where a process is executed without human interaction (Grover M.P., 2010). Asplund (2014) defines automation as “the automatically controlled operation of an apparatus, a process, or a system by mechanical or electronic devices that take the place of human organs of observation, decision, and effort”. More specifically, automation is using control systems in a variety of applications, removing human labouring (in this context, activities that are either standardized or demanding for the body) by the use of previous collected data (Rifkin J., 1995). Automation is used for repetitive tasks and exist in a variety of different sectors such as product realization and manufacturing. It has been a way for the industry to meet the competition with the low income countries in the repetitive tasks like in China and India (Frohm et al., 2008). The term has grown to involve high degree of cognitive level which has led to a change when designing automation products like how the machine will cooperate with the human. (Frohm et al., 2008)
One can identify a “mental model” described in Asplunds doctoral thesis (2014) in which the fidelity is endured by the constraints during the development process. Regarding the context of automation, trust from stakeholders can occur in a similar fashion, treating the integration of the process by each level of automation. This bottom-up approach puts the standards constraints from the initial levels of automation, which will help create trust from stakeholder from initiation.
Furthermore one way to view automation is through Cyber Physical Systems (CPS) according to Asplund (2014), in which he defines it as “an integration of computational and physical processes, distinguished from traditional embedded systems by the new emphasis on networking computational entities”. In other words, CPS is the combination of physical and computational processes. One has to bare in mind that lack of support during automation could lead to software defects through too much reliance on automation in the context of unfinished or wrongly used automation tool (Asplund, 2014). An example of a system element that is heavily linked to automation is UAVs.
UAVs and ATM are two extensive fields and are therefore divided into the following two subsections to facilitate the understanding of these areas.
2.4.1 UAV
UAVs have been increasing in numbers and are rapidly entering the markets across many nations and continents. The drones’ commercial success is based on advancements in several different areas such as infrastructure maintenance, aerial photography and agriculture management (Futurism, n.d.). A common denominator for these areas is the capabilities of drones to aid people in quickly assessing information when for instance monitoring or inspecting an infrastructure without physical presence (Rao et al., 2016). More specifically, they have the capabilities to carry transmitters, multiple sensors and imaging equipment. Furthermore, drones can rely on several sophisticated technologies many of which are still under development such as detect-avoid systems, increased battery performance to fly longer distances and identification of their location where GPS signals are limited (Cohn et al., 2017). Within the area of logistics and distribution, a drone’s application is being explored as it has the potential to more efficiently deliver packages to people with less direct (and expensive) human input. However, beyond the benefits of the drones, given their size, shape and speed, they can pose threats to aircrafts and there is a need to address the security aspects of the drones before integrating them into airspace. Although, UAVs are new with regards to integration into civil airspace, it has been successfully used in the military in a separate airspace for many years due to its capabilities. For instance, they have been used since 1930’s for target practice during military operations as well as subsequently functioning as surveillance during the Vietnam war (DeGarmo, 2004). But during these times the drones were limited to relatively basic maneuvers and only operated in designated airspaces at predetermined times; thus communication and ATM integration was not needed.
A major advantage and interest of using UAVs over large regular aircrafts is that it could save the air transportation industry 35 billion dollars each year, and additionally cut passenger ticket price by 10% without the human pilots onboard (Josephs, 2017; Collison, 2017). According to Jiang et al. (2016), all flights are scheduled to avoid violation proximity in the airspace to avoid collisions en route, which helps to reduce the workload of the ATC. Jiang et al. (2016) argue that the main key driver for increasing the capacity of airspace is to reduce the workload of ATC. An Unmanned
aircraft Traffic Management (UTM) system element will help with reducing workload of the ATC.
The basic and paramount ideas from regular large-scale ATC will be the same, with differences needed for UAVs, such as the method in control, the function and the operational constraint (Jiang et al., 2016). The interoperability of UAVs with normal aircrafts would require that the terminal airspace also is considered, by implementing a similar UTM system element.
2.4.2 ATM, ATC and ATCo
ATM comprises several areas such as Air Traffic control (ATC), Air Traffic Flow Management (ATFM) and Aeronautical Information Services (AIS) (Eurocontrol, n.d.). ATC is a functioning element which manages the intermediary connection between an airport and pilots. Specifically, they provide active support to pilots to ensure aircrafts are safely separated in the sky as well as on the ground. ATFM manages the activity conducted before a flight takes place which comprises sending a flight plan to a central repository where it is analyzed. The notion is to not allow too many flights at once within certain parts of airspace and to reduce the Air Traffic Controllers (ATCo) workload (Eurocontrol, n.d.). Given the flight plan, the ATFM can compute where an aircraft will be at any given moment so controllers safely can cope with the flight. However, this is based on a plan and changes are often made during the flight by ATC due to for instance weather conditions, separation requirements, and other delays (Deener, 2017).
AIS is responsible for the collection and dissemination of aeronautical information that is crucial for users of the airspace. Information such as safety, navigation, technical and administration such as legal questions (Eurocontrol, n.d). According to the same source the primary task of an ATCo is to make sure that the airborne aircraft avoid collision and manage the flow of traffic in their sector. Each physical ATC tower consist of one or several ATCo (Granberg, 2016). The airspace is further divided into a grid, that consist of several small sectors, and each ATCo is responsible for their own sector with an arbitrary (and changing) number of aircraft. The ATCo gives instructions to the existing aircraft that are flying in the controllers airspace, and their instructions are based on the feedback provided by the flight plan, surveillance sensors and by the feedback that is received by the pilot of the aircrafts (Granberg, 2016).
There are two types of unsegregated airspaces, the controlled and uncontrolled airspace (see Figure 3). Figure 3 emphasizes protection of Instrument Flight Rules (IFR) which addresses that flights outside the designated boundaries is not safe, therefore flying near the margins is not permitted (US Department of Aviation, 2012). The same figure also shows controlled airspace in grey and uncontrolled airspace in white. The two above quadrants demonstrates a side view of aircraft landing (red arrow) and taking-off (purple arrow). The top left quadrant shows the correct way, and top right the incorrect way. The top right quadrant is not permitted, shown in two dotted circles, because the aircraft flies marginally close to uncontrolled airspace which is prohibited according to IFR. The bottom left quadrant demonstrates the permitted path and the bottom right quadrant
shows the unpermitted path, in both cases the aircraft is on the ground. The dotted circles in the bottom right quadrant demonstrates an IFR violation.
Figure 3. An illustration of controlled and uncontrolled airspace where the grey shaded area is controlled airspace and the white is uncontrolled airspace in proximity to an airport (Eurocontrol,
nd).
ATC and ATFM have been the solution for solving the congestion problems, but skies are getting more crowded (Honeywell, 2018). Vaaben et al. (2015) states that in 2010 24% of all flights in Europe and 18% of all flights in the US were delayed more than 15 minutes and thus experienced a disruption, this aggravates the congestion in major airports (EUROCONTROL Performance Review Commission & FAA Air Traffic Organization System Operations Services, 2010). This was due to technical issues, weather, crew absence and congestion problems. With the introduction of innovative vehicles such as UAVs, an increase in demand for the controlled airspace will be created and the integration of UAVs will be further compounded due to the need for traditional ATC and infrastructure (Mueller E., Kopardekar P., 2017). More demand of airspace puts an extra burden on the ATCo, assuming that the current (and older) navigation and communication systems are still being used.
Some proposed solutions are that ANSPs can take extra charge for infrastructure use at rush hours, when congestion occurs. A differentiation in cost for different volumes, meaning that for rush hours, airliners would pay more than when it is not rush hour (Granberg et al., 2016). By simply adding more ATC towers one would dramatically increase the cost which in general is aimed to be decreased. Another proposed solution is introducing remote piloted towers, or so called Remote Operated Towers (ROT) concept where each center contains several remote tower modules, and is controlled by one ATCo. The Remote Tower Centre is a favorable implementation with current
systems elements used within ATC, as it is cost effective and is cheaper to maintain, according to Granberg et al. (2016). Granberg et al. (2016) argue that the ROT concept will lower the cost of ATCo on duty, by splitting the time on duty between airports. One problem with Granbergs study is that simulations have not yet been conducted. Granberg’s model might be useful as an assistant tool between smaller airports. At a larger airport, where the ATCo is working full time providing service and managing aircraft, the ATCo will presumably not have time to remotely direct other external aircraft at another airport.
The implementation of UAVs will pose a challenge when it comes to the training of ATCo, due to the increase of objects in the terminal airspace.Today basic training of ATCo comprises of a basic theoretical training that is fundamental in order to work as an ATCo. This is followed by a simulation training to assist and mimic the work of ATCo and to develop the necessary skills in the basic training of ATCo which takes up to 16 weeks (Skyguide Solutions, 2017).
Given that the current airspace is getting more congested as passenger numbers are rising, the emergence of commercial UAV market further poses challenges to the aviation system. De Garmo (2004) argues that to integrate UAVs into civil airspace, they will have to interact with various systems of systems (SoS) such as having transponders and positioning reporting devices to address the safety issues towards manned aircraft. More specifically, beyond having positioning reporting devices etc. to work effectively in conformance with ATC, it is needed to have modifications in the current existing manned ATC and aircrafts due to the capabilities of the drones.
In the military, drones are not normally allowed to enter civil airspace, in order to do so a special authorization is required according to ICAO (article 3, 1944). This is further repeated in article 8 ICAO (1944) which implies that pilotless military aircraft need special authorisation in the operation on civil airspace as well. In relation to the articles in ICAO, Bernauw (2015) argues that a pilot less aircraft would qualify as an aircraft since many of the capabilities in a drone are not fundamentally different from those in manned aviation.
Eurocontrol is currently testing integration of drones into controlled airspace in which several challenges have been highlighted such as a delay in radio message transmissions between the remote pilot and the UAVs (Domecq and Guillermet, 2018). The time lags further affect the transmission between remote pilot simulator and the ATCo. According to the same source, given the size and speed of the drones, they are significantly more impacted than civil aircrafts with regards to strong winds which sometimes can lead them to a complete stop (relative to the ground).
Another Eurocontrol project is the SWIM concept (System Wide Information Management) which aims to provide real time information sharing between actors such as airline operations center, airport, ANSP and vehicles at the airport (SESAR SWIM Factsheet, 2016). Previously, the information received from similar stakeholders were less organized and inflexible which with the increase in capacity demand, attention to environmental pressure and overall economic impact puts pressure on seamless information exchange and access. DeGarmo (2004) argues that UAVs will need reliant and accurate information for navigational guidance, thrust control and flight path optimization which ideally is to be aligned with the data being processed, distributed and
communicated by ATC for manned flight. Furthermore, DeGarmo evaluates the possibility of drones being sufficiently integrated with manned aircraft through SWIM since the attribute of SWIM is to enable common data standards and a dynamic data exchange. Similarly, Peña et al.
(2008) argue that an implementation of SWIM would facilitate for the integration of UAVs in ATM, which is the network centric concept provided by SWIM which potentially could facilitate accurate drone data acquirement. Furthermore, Peña et al. (2008) further argue the possibilities of drones acquiring information from areas with a higher uncertainty with regards to weather conditions which can eventually in areas close to an airport help to enhance weather information during for instance bad weather.
Air Traffic Management Reaction to Outside Forces, 4D Trajectory.
The 4D trajectory is according to the International Civil Aviation Organization (ICAO) (2012), a four-dimensional or business trajectory that is being created by Single European Sky ATM Research (SESAR). ANSPs and ATCo are coordinating with airspace users the optimum trajectory for the flight taking place, in four dimensions, meaning space (3D) and time, from the day the planning of the flight commences to the day the flights takes place. The 4D-trajectory takes into account airport capacity and possible airspace constraints (ICAO, 2012). 4D trajectory reduces delays on ground and in the air (Iovanella et al., 2011). Predicting key performances areas will depend on 4D trajectory, such as minimization of departure variability, arrival punctuality and flight duration. Critics against 4D trajectory are that 4D-trajectory needs to be implemented all over Europe, otherwise variation of aircraft utilizing and not using 4D-trajectory will emerge.
Thus, an interoperating environment will prompt interruptions and delay all other aircrafts, as a result of the difficulties of 4D trajectory in an interoperational context because of the volatile delay times of worst equipped aircrafts (or non-4D trajectory users) (Iovanella et al., 2011).
As more technologies are successfully challenging this standardized industry, more disruptive technology will be developed such as automated passenger UAVs. The belief of the ‘International Federation of Air Traffic Controllers’ Associations’ (IFATCA) (Baumgartner, 2017) is that the second technology revolution is emerging and a push for restructuring of ATM. Outside forces, from Google, Amazon, Facebook, Apple (GAFA), Microsoft, NASA and other major players in the telecommunication industry are in the process with experimentation of autonomous solutions for UAVs. The standardized solution and the operational processes have the possibility to transform the ATM, and even replace the current ATM entirely (Baumgartner, 2017). According to Baumgartner’s article (2017), he argues that it is difficult to predict what the future changes will look like. As some European controllers have grasped the concepts of virtualization and cloud- based services, some core activities are estimated to be outsourced like flight data processing.
Future challenges will be imagining future problems, and our own scoped thinking will limit the thinking processes according to Baumgartner. A few existing examples of disruptive technology in ATM are ROTs and cloud-based services. Cloud-based services are methods for providing air traffic control services through regular and standardized platforms from a virtual independent
location environment, using principles of shared allocation of computing processing power, storage and services (Baumgartner, 2017).
In the paper by HALA! (2010), they highlight one key element that the goal of automation in ATM is not to replace humans but to improve the overall system performance. It should not be human versus machines, see Table 3, but automation should be seen as human-machine coordination as a team. The expected benefits of an incremental level of automation are an increase in efficiency regarding ATM functions, to handle growing traffic demand. The continued advancement of information and communication technology has forced the development of automation in control system and ATM. A continuing issue regarding automation is the function allocation, such as whether the machine or the human is better at performing a task in a safe and efficient manner.
(HALA!, 2010)
Table 3. An illustration of different approaches to automation adapted from HALA! ( 2010).
Automation is About...
Human vs Machine (Replacement)
Human-Machine Coordination (Team)
The existing airspace is separated into sectors and a ATCo is responsible for its own airspace sector, with a certain dimension. In each sector, the ATCo has a limit of the number of aircraft for which can be managed. When traffic escalates, then current methods of handling high density traffic (by increasing the amount of ATC sectors, thus decreasing the sector dimension) becomes infeasible to cope with the increased air traffic. Additionally, there is an inability for the airports to expand due to new requirements in regards to economical, environmental and safety issues.
Considering the European ATM system, the airports are regarded as the biggest bottlenecks in relation to capacity and flow of traffic. Despite the bottleneck problem in European airspace, it is one of the busiest in the world with over 33 000 flights on busy days. (HALA!, 2010) A way to solve this is to increase the automation within SoS. “An advanced level of automation for different ATM functions is required for a more efficient system to cope with a growing traffic demand”
(HALA!, 2010). An incremental approach of automation in the SOI is required for implementing an automation process and Table 4 below demonstrates how different automations levels could be portrayed. Table 4 below demonstrates a model in a 10-point scale, originally created by Parasuraman (2000), where higher levels represents higher automation of computer over human action. For example, level 2 provides several options for the human to make a decision and the computer is not allowed to execute anything. At level 4, the computer provides one alternative that the human can decide to execute or not. At level 6, the computer provides the human a limited time for a veto before continuing its decision. (Parasuraman et al., 2000); (HALA!, 2010)
