The Viability of Digital Flight, Part 1: Establishing Accountability for Automated Self-Separation

With automation increasingly permeating nearly all aspects of aircraft design and operation, the need is growing to also automate their safe passage through airspace populated with traffic and other hazards. Today’s operating modes of Visual Flight Rules (VFR) and Instrument Flight Rules (IFR) are human-centric in their methods of conflict management. Their ability to accommodate increasingly autonomous operations is quite limited and may significantly restrain growth and future operational utility. Creating an additional, digitally enabled operating mode is a paradigm shift that could unlock a new era of aviation in which highly automated aircraft operate cooperatively throughout the airspace alongside conventional (i.e., today’s legacy) operations.

NASA’s Digital Flight concept envisions an additional operating mode that employs automated self-separation, and which may be a more appropriate match than VFR or IFR for aircraft capable of increasingly autonomous flight. However, as a significant paradigm shift in conflict management, its viability hinges on the regulator’s ability to authorize its use. The application of accountability, an accepted construct in aviation used as part of safety assurance, helps in addressing this viability question. Accountability is the obligation to answer for an action taken (or not taken) by a responsible entity. Understanding the answers to the following critical accountability questions is necessary for effective oversight by the regulator: who will be accountable for separation; to whom will they be accountable; and for what will they be accountable. This paper (Part 1) is the first of two that directly investigate these questions. It introduces these basic questions of accountability and discusses the first two accountability questions (who and to whom) in detail by analyzing an operator-centric scheme similar to VFR, but for automated conflict management (i.e., automated self-separation). A companion paper (Part 2) discusses the third accountability question (for what) in detail by introducing a new aviation performance construct: Required Conflict Management Performance (RCMP).

Accountability for an outcome is different than the authority and responsibility to act, and thus the accountable party may be different than the agent which performs a given function. While authority and responsibility may be delegated to a fully automated system, accountability must ultimately reside with humans either individually or collectively (e.g., an organization). With an operator-centric, automated conflict management capability, accountability will likely shift from pilots and/or controllers to operators (i.e., organizational entity responsibility for maintaining operational control) and potentially Third-Party Service Providers (3PSPs). Accountability will be explicitly identified in regulations or other documented means. There may be dual lines of explicit accountability, especially for 3PSPs that may be accountable to both the regulator and the operator. Developers of systems and components associated with automated self-separation will have a degree of implicit accountability to the operators for the performance of these capabilities.

The aviation community accepts ambiguity associated with implicit accountability because there is confidence that post-incident processes are in place for human-centric decisions that can appropriately determine what went wrong and ensure corrective actions are taken to avoid similar incidents in the future. These processes are built around Safety Management Systems and a Just Culture.

The Digital Flight framework summarized in this paper, coupled with quantifiable required performance capabilities as described in our companion paper, can provide the clarity necessary for operational approval by regulators of automated self-separation (i.e., an operator-centric, automated conflict management).