Liability Assessment and Mitigation Strategies in Air Traffic Control

Legal Case application to ARGOS Support to EUROCONTROL MUAC Legal Case Report Meeting 20thJuly 2021 1

Take away evidences before starting Liability allocation depends on the operational concept as well as on processes, procedures and working methods. A proper liability assessment requires a multi-faced approach taking into account the perspective of all the actors involved: it would be pointless to look just at ATCOs liability and not at the organizational liability of the ANSP (and vice versa), as the two are closely interconnected and interdependent. Knowing the liability risks and how they originate may spur the organization in introducing actions at technical and organizational level, to mitigate the risk and at the same time increase safety. Using the Legal Case shows the benefits of a proactive approach to liability, based on the idea of anticipating the analysis and management of possible liability issues, without waiting for an accident to question about liability allocation, thus implying a completely new view of liability as a property that can be designed. 2

Overview of the Legal Case report Feb 2020, Legal Case Course at MUAC Dec 2020 Feb 2021, Workshops March - June 2021, Analysis and consolidation 3

Mitigations: Actor based - ATCO The main concern is the need to clearly defined procedures and training Procedures should be clarified and documented, concerning both the tasks and obligations of the ATCO Training and guidelines enshrined in official documentation The procedures and functioning of ARGOS need to be detailed, without introducing unwanted rigidity, or additional workload for the human actors that need to interact with the automated system The documentation and manual must provide Procedural rules on the management of the complex interaction Technical details on the reasoning of the ARGOS system (in all levels) to assist in the possibility of human interaction when needed. 4

Mitigations: Actor based - Supervisor Clearly defined management procedures, to assist the supervisor in the tasks related to the activation of ARGOS or transition between automation levels Training requirement for the new duties resulting from the use of ARGOS Clear duties and responsibilities in the new tasks Management of sectors assigned to ATCOs and ARGOS, transition between the two agents, and between automation levels Guidelines, manuals and documentation providing the following Procedural documentation mainly for the division in sectors an the transitions Technical details, namely the precise requirements for activation and issue management of ARGOS 5

Mitigations: Actor based - MUAC MUAC as the manufacturer of ARGOS To strengthen the State of the Art defence the producer must at least meet common industry standards, to avoid claims of design defect To mitigate the risk of Warning defects the producer must alerts/warnings, easily understandable by the actors tasked with controlling the system The documentation should also be designed taking into account the requirements of case law in aviation The system should also be certified by a certification authority design adequate 6

Mitigations: Actor based - MUAC Since MUAC is also the user of ARGOS, the concept should be designed so as to encourage continuous reporting (according to just culture ) by the different actors involved There should also be a requirement for insurance for the human actors involved (ATCO, SUP), to be properly defined in relation to their tasks The system should have a complete documentation of the working parameters to be used in the interface/transition with humans 7

Conclusions L3 mode of operations In L3 the changes in liability attribution for the different actors are limited, compared to the current situation (without ARGOS) No main differences in liability allocation between ARGOS and other Decision Support Tools (e.g. VERA tool, the long probe, the CFL Menu shading, LORD and the DCT TOP 10) Slight expansion of risk of civil liability for the ATCO, mainly grounded on negligence, given the possibility of a lack of prompt and adequate response to the suggestion of ARGOS (next slide) 8

Conclusions L3 mode of operations In L3, two possible accident scenarios emerged: ARGOS suggests the correct action, and the ATCO does not follow the suggestion, leading to an accident, or ARGOS suggests the wrong action, and the ATCO does follow the suggestion, leading to an accident. The first one has a higher liability risk for the ATCO. It is fundamental to provide the controller with clear information about the functioning of the system, how choices are taken and which are the mechanisms beyond such choices. This would contribute to lower the risk of complacency and excess of trust in the system by the controller, as a defence mechanism against the liability risk of contradicting ARGOS. 9

Conclusions L8 mode of operations The legal analysis shows high liability risk for the (C)ARGOS manufacturer (product liability for design defects and warning defects) The choice to let ARGOS operate with no direct (active) human oversight may lead to an increased liability risk, if the system fails to timely request a human intervention (in case of an accident) The choice to adopt a procedure (ATCO substituted by technology where no active human oversight is foreseen) also exposes the ANSP to a high organisational liability risk Recommendations: focus on the operational concept; considerations about the role of the ATCO as a supervisor of the automation; possibility of foreseeing a more active supervision of ARGOS by the ATCO 10

Conclusions L5 mode of operations L5 is a special case in-between L3 and L8. L5 thus inherits legal risks and liability attribution from both L3 and L8. The outcome of the legal analysis shows a high liability risk for the ANSP in L5, linked to the complexity of designing precise, efficient and safe procedures The ATCO incurs in a medium-high increase of liability risk for the duties to supervise and ensure the multi-layered interactions with ARGOS The manufacturer of ARGOS incurs in an increased liability risk for product defect and warning/informational defects, in particular for the duties to ensure the functioning of multi-layered interactions with the user 11

Conclusions L5 mode of operations It is recommended that the boundary between basic and complex traffic is clearly defined so that anyone (ARGOS and the ATCOs) knows at any moment whether and why certain traffic falls in one category or the other The desirable outcome is a situation where the human-automation handover of the flights is made with a full awareness and consensus between the involved parties. Focus on the interaction between basic and complex traffic within the sector (and across different sectors). This is meant to avoid cascading effects made of complex mutual interferences 12

General recommendations General decisions about the operational concept may have an impact on how the liability risks are shared among the involved actors: how transitions among modes are designed and to what extent they are supported by the system (e.g. how the HMI of the RSup/TactSup supports the user in the transitions) how preconditions for different levels are specified and how the actors involved are made aware of them (transitions L8 -> L5 and L3 -> L5 are different enough to produce different duties for the involved actors, in particular for the ATCO) how responsibilities for the decision of making a transition (and its acceptance) are designed in the procedures, and assigned to the different actors; how to properly develop training plans (ab initio and recurrent), manuals and guidelines 13