Autunno 2000

Questo articolo di Renzo Dentesano è la trascrizione di un suo intervento ad un Convegno sulla Sicurezza dei Trasporti tenutosi il 23 e il 24 ottobre 2000 presso il Consiglio Nazionale delle Ricerche

 

TRANSPORTATION SAFETY

&

AUTOMATION

 

Human Factors and Policy Factors: Some thoughts about the operator’s liability issue in aviation operations

 

(A study by S. Capt. Renzo Dentesano (r.), certified Air Accident Investigator by NTSB– USA)

 

 

In the recent years, we have seen an increasing number of criminal prosecutions of flight crew members and even aviation managers, after aircraft accidents and even incidents in which those people were alleged at least to have been negligent in the performance of their specific duties.

In nations that govern under the Napoleonic code (and even in some common-law jurisdictions), violation of Air Navigation Orders or its equivalent is potentially a criminal offence.

This trend has begun to appear in the United States as well, after the successful prosecution of three pilots for having detectable levels of blood alcohol in their bodies while in charge of flight duties. That happened notwithstanding the fact that in the States the Federal Aviation Regulations are not criminal law (with the only exception regarding the interference with a flight member in the performance of duty) and so their violation is almost always a civil rather than a criminal matter. The pilots mentioned were tried (although correctly) under a law prohibiting operation of a commercial motor vehicle under the influence of the alcohol.

In addition, two Korean pilots were jailed in Libya in 1990 after landing short at Tripoli airport and in 1993 a Swissair flight crew was convicted and fined in Greece after skidding off the end of wet runway at Athens airport. In both cases there were some casualties.

In a outstanding case in the U.K. (London, 1989), the pilot-in-command of a B-747 engaged in commercial air transportation was convicted of negligent endangerment of his passengers after an unstable approach at London’s Heathrow airport during which the aircraft came within 20 m. of the ground before the airport boundary. The flight then landed safely from a second approach and notwithstanding the fact that nobody was hurt, the Civil Aviation Authority brought criminal charges against the Pilot In Commend [PIC].

After revoking his [PIC] license, this pilot was fined and his appeal was rejected. He subsequently committed suicide!

More recently, the two pilots involved in a A.300 accident in Korea are under criminal charges.

Obviously, this kind of issues are a matter of serious concern to pilots and can affect their behaviour and decision-making process as well as their willingness to contribute to any compulsory or anonymous reporting system, whenever in use. 

Taking into consideration that automation has become a standard with direct implications on the operator behaviour and that automation on board of the aircraft has demonstrated to be always more complex, autonomous and opaque (as many international studies have shown), holding pilots liable of negligence when mishaps occur under the automation’s utilisation, at least is likely to seriously inhibit  the ability of the aviation system to investigate air accidents and incidents.

The point of concern is that today’s legal climate insists that blame be apportioned, but the only way the aviation system is likely to be able to learn lessons from accidents as well as incidents is to insure that the operators involved in such mishaps can talk freely about what happened and why!

So, the main point of concern is that holding pilots or air traffic controllers liable of negligence is likely to inhibit seriously our ability to investigate flight transportation accidents and incidents.

Regardless of what may be said about the duty of a professional person to disclose information that may compromise him, but may save others, the fact is that many otherwise honest and upright people find it difficult or even impossible to act conformably.

So, when aviation professionals know that their statement following a mishap may cause them lasting harm, then they are unlikely in many cases to be forthright with the investigators!

 

The real issue is:- How do you punish a computer?

 

Who is liable for the behaviour of a highly automated system?

If automation continue to become more pervasive and authoritative, WHO will be responsible for its actions?

At this time, we can simply say that the pilot (and in the ATC environment the controller) remains responsible, but if automation is in use and more autonomous air traffic control system is put in place, can this long lasting assignment of responsibility continue?

It is worth to examine how the characteristics of  the present automation can cause problems for at least some of its operators, the types of problems that are associated with the relative attributes and about the possible means of mitigating some of those problems without compromising the effectiveness of automated tools. In particular, the problems posed by clumsy, brittle or uninformative automation still need to be solved.

This kind of problems will not go away by its sole; they will become more pervasive and vexing as technology continue its inexorable advance.

In the 1994 accident in Charlotte (N. C. – U.S.A.) the airborne wind-shear advisory system failed to warn the pilots of microburst after they had already begun a missed approach, because the airplane’s flaps were in-transit when the wind-shear was detected.

The NTSB accident report stated that the probable cause of the resulting accident was a human (pilot) error, despite the Board’s knowledge of previous recommendations concerning the Wind-Shear Alert System (WSAS) software inhibition during flap movement, of which pilots were unaware!

We all agree in that the pilot responsibility is absolute, but who was responsible for not notifying the pilots of the automation inability to warn them under those circumstances?

The NTSB clearly thought so in the Charlotte case, but automation failure to warn played a major, if not crucial, role, as well it has in other accident and even incidents!

The prevailing present concepts of responsibility and authority are silent on the implication of such consequences of automation but it is hard to image how an operator (pilot or ATC controller) could be entirely responsible of mishaps due to unannounced automation warning fault.

Nonetheless, it is unlikely that those inclined toward the assignment of blame will take much pleasure in suspending or fining a computer after an aviation incident.

But, given that a certain national tort systems require the apportionment of liability, HOW will this be done?

Will the judicial system or the regulatory body continue to maintain a narrow focus on the operator of the front desk of the system, or will the aviation community try to make a broader perspective to encompass the larger system in which the incident occurred, recognizing that nearly all such incidents involve many manifest and latent factors, perhaps born at the designer’s desks or at management’s headquarters?

 

Conclusions

 

It is believed that the central technical, and even legal and juridical problems for the human operators who work with today’s aviation automation are the complexity and opacity of present tools.

Put in terms of the principles to be observed by a real human-centered automation, the human operator must be able to understand the given tools, including automated devices, and must be informed about their activities, to remain involved in the process.

This compelling necessity for understanding by human operators of the capability and limitation of their tools is the conceptual need that must be attacked by the whole industry if humans and machines are to be able to work more co-operatively as a team, in pursuit of aviation system goals.

Although aviation has become a remarkably safe way to move people and goods, many preventable accidents and incidents continue to occur.

To an increasing extent, these mishaps involve both human operators and their machines, because humans and machines have become completely interdependent.

Such mishaps represent system failures, and they will only be prevented by a systematic approach to all components of the aviation system.

And automation is now a central element in that system!

It has been in part very successful in improving the reliability and productivity of the system. But, like all technology devised by humans, its success have brought  with them also new problems to solve!

Solution of the technical as well the legal human-machine integration is critical to the future success of the aviation system on which so many people rely for safe and reliable transportation. Those people deserve the highest attainable level of safety!

Aviation industry now know enough about cognitive engineering to co-operating in the accomplishment of the goal of rendering automation more user friendly. It is a real must to apply what has been learned about the management and operation of the system that we have now and especially to the design of every new automated system that aviation industry intend to put in place in future!

 

Rome, October 2000