3.3.1. Actions in a perspective of authority, responsibility and accountability

To allow adequate analysis of the impacts on human performance, a concise understanding of authority, responsibility and accountability is necessary in order to characterize the various components of interactions between humans and systems. We will call on the concept of action to allow us to distinguish between these three notions because the concept of action focuses on general human behavior directed by goals and targets. By means of this concept, individual and motivational factors determine concrete actions. However, we do not just use concepts of tasks and activity [LEP 83]. Indeed, by definition, these concepts associate the objectives of the tasks with the means assigned to accomplish these tasks; however, they do not provide a framework for analysis of overall behavior that is able to capture the dynamic and individual motivations behind the actions that are effectively carried out by humans. For more details about the aspects that impact human actions, interested readers may refer to more specialized literature such as Gollwitzer and Bargh [GOL 96]. The actions take place in a certain context and are determined by the characteristics of the agents and of their environment [GOL 96]. In a temporal dimension, the actions can be considered to be the perspective of planned actions, the process envisaged for execution of actions and objective completion of them. In a similar manner, time organization can also be transferred to notions of authority, responsibility and accountability. An action can be planned with an objective in mind, an action can be carried out in order to achieve an objective, and the result of the action is verified with respect to the initial objective. Actions can be described on a very detailed level or also in a combined manner and they have been introduced into the design of automation by different authors [HAR 03]. The action model proposed by SESAR guides for automatization provides a standardized work framework for analysis of actions in this way by describing the information acquisition [I-AC], information analysis [I_AN], action selection and decision [AS_D], and action implementation [A_I]. For purposes of simplification, we refer hereafter only to a “cycle of action” without dividing it up further.

In the framework for analysis and design that we propose, the concepts of responsibility, accountability and authority are clearly linked to the concept of action. With this in mind, the description of concepts hereafter should be understood as a prerequisite to the use of the analysis and design framework. The objective of these descriptions is to allow common understanding and to establish a clear distinction between these various concepts in the context of air traffic management.

Responsibility is generally understood as an “obligation for an operator to carry out a task that has been explicitly assigned to them in order to guarantee security of operations” [SKY 13]. Consequently, responsibility refers to aspects where actions have been planned a priori. When the actions are planned for a specific agent, this is generally formalized in the form of tasks expected in the description of a role or of a job. These definitions may come from regulatory bodies and/or airline companies. For example, an agent could be responsible for the overall security of a flight (ordinarily this responsibility falls to the onboard commander, as described in the “rules of the air”), another agent of the tactical prediction of conflicts in the air (this responsibility generally falls to the traffic alert and collision avoidance systems (TCAS) from the onboard standpoint, and to the short-term conflict alert system (STCA) from the point of view of air traffic control), or another of making reliable weather data available (from the onboard point of view, this responsibility falls to the airplane’s weather radar). In the aeronautical context, the emergence of complex systems requires a clear allocation of the responsibilities between the various agents that are involved. We can consider that not all the planned actions are formalized, but that the knowledge of planned actions can be shared implicitly. Even though the responsibility is often defined from a regulatory standpoint, organizations can in addition specify the responsibilities concerning specific organizational objectives.

“Supervision control” refers to the responsibility of monitoring the results of a complex process that implicates one or several agents [SHE 92]. Supervision control is closely linked to the concept of “user control” that we encounter in the field of HCI [BIL 97]. This responsibility should be accompanied with means of controlling or short-circuiting/stopping a system under supervision in the event of its failure. For example, supervision control of an air traffic controller can refer to their responsibility to avoid a traffic conflict; whereas the supervision control of a pilot can refer to their responsibility to make their airplane leave on time or to prevent any delays postponing the departure time.

Accountability evokes instead the action that is effectively carried out and its results, such as the obligation to demonstrate accomplishment of a task to another agent (a federal administration, public authorities, employees or even clients) in response to an action; this is expressed as justification for an action or a decision that is made. Accountability is therefore characterized as a situation a posteriori to actions that are already carried out. Accountability is located on a level where an agent calls itself into question in order to justify the elements that have led them to carry out actions and decisions in a specific manner. Justifications of this kind can be related to a system of reporting. Accountability can also be envisaged in the framework of a system of rights, which will not be developed further in the framework of this chapter.

Responsibility and accountability should be considered to be conditions a priori and a posteriori. Authority is mostly related to the power to act and is thus associated with the conditions for completion of the actions permitted by design and determined by their dynamics and their contexts. At the same time, the actions that are really carried out are impacted by the specifications of technical systems that can lead them to a certain level of autonomy. As has already been identified by Boy and Grote [BOY 12], authority is related to the notion of control. Management of an action based on authority often requires decision-making. For example, a pilot knows his or her responsibility (the tasks supposed to be accomplished), as well as at what time they have control and therefore responsibility and the possibility of taking back control over automation in order to carry out actions in acceptable conditions of security and performance. The power to act also depends on the skills of the agent, their effectiveness, their expertise and their knowledge; however, it may also be directed by the legitimacy of an agent to carry out an action. The dynamics of situations can also lead an agent to take power to carry out an action for which no responsibility has been previously defined. These situations can lead to a notion of “emerging authority”.

In summary, while responsibility is a formalization of the actions expected by the agents or the organizations a priori to the execution of actions, accountability for its part can be seen as a formalization of the impacts of actions concretely brought to the attention of other agents or organizations. Authority must be included as a process of execution of the actions themselves, but the way in which the actions are carried out will be determined by responsibility a priori and accountability a posteriori, and the coherence between these concepts, related to the action, must be guaranteed during design of new solutions of air traffic management. Research into the coherence between the responsibility, authority and accountability must be looked at in particular detail if new automation is envisaged in future concepts. Indeed, in this case, execution of the actions could have an impact on the patterns that define the allocation of authority, responsibility and accountability. Figure 3.1 shows the relations between these concepts from the point of view of the agent. These relations can be characterized by anticipation loops and retroactions.

3.3.2. Levels of authority and responsibility

Since agents in complex systems carry out actions in collaboration and cooperation with other entities, it is therefore important to describe the organization of these entities in more detail in order to understand the overall impact of their actions. Actions within a complex system can be carried out by human or technical agents when it is a case of intervening on equivalent spatial, temporal and social levels. These can be characterized on a scale of four levels ranging from the nano level, the most detailed, to the macro level, which is the highest. This differentiation of complex systems into levels is quite common in different disciplines such as economy, sociology or ecology.

In line with the ecological model of human development that was introduced by Bronfenbrenner [BRO 79], the micro level covers types of activities and roles in a specific context that can be considered only at the individual scale. The meso level relates to actions in which an individual is engaged for a certain time duration (e.g. the duration of a commercial airplane flight). The macro level involves a set of cultural and social values that are going to exert a strong influence on individual behaviors. An agent can therefore be connected to these various levels at the same time. As a function of the level involved, it will have different effects and consequently the description of authority, responsibility and accountability will be carried out via characteristics that correspond to the level considered. The important thing to know, when we create new concepts, is at what level the responsibility is defined and to whom the agent will be accountable. The following sections propose instantiations of the different properties of the four levels that we consider in the field of aeronautics.

The macro level corresponds to social groups of large amplitude such as nations, international institutions, cultures or societies (e.g. Eastern and Western societies). The macro level typically prescribes the responsibilities of socio-technical components of aviation as a whole. The aeronautical authorities (e.g. military authorities, civil authorities, the FAA, EASA) generally finalize the aeronautical rules and major actors in aeronautics such as the aeronautical industry, accident investigation offices, standardization groups or even the International Civil Aviation Organization (ICAO) that define the principles of high level operation such as the separations between airplanes, the organization of airspace or even free-route spaces. The rules defined at this level are going to have an impact on the actions of agents in a direct manner (by application of the rules or regulations) or indirectly (by application of the rules defined on a meso level). On a macro level, it is possible to identify problems of definition and allocation of actions to be carried out between agents at this level, which are entities in themselves. The action time at the macro level is long and is going to involve many contributors whose decisions and actions could have an indirect impact on human activities, technical systems, organizations and the environment (e.g. the reduction in emissions of carbon dioxide, the air traffic capacity).

The meso level refers to social organizations of intermediate size that can be structured in organizations of groups of agents that execute high level rules defined on a macro level or that share common activities. These organizations (e.g. airlines, industrial collaborations, pilots’ associations or air traffic controllers) define global missions that structure activity. The meso level mainly refers to management of the phases of planning and execution of assignments and commercial flights. Responsibilities at this level involve an entire sector, a flight, an assignment or many other types of work. The assignments defined at this level are going to have a direct impact on the actions of agents in charge of the execution of the activity. Problems related to both the allocation and completion of tasks can be identified at this level. The time scale at this level follows the same logic and is based on the time for an assignment or for a flight. Environmental considerations are also based on the scale of an assignment and are mainly supported by forecasts (e.g. the density of air traffic, weather conditions).

The micro level refers to unitary agents that can be human or technical. The events produced at this level only relate to the execution phase and not the planning phase. An example of an agent at this level could be a system of alerts that can provide information and specific guidance suitable for a local context. This level concerns the allocation of authority between humans and machines, as is the case for example with the TCAS. At the micro level, we can consider the properties of agents such as their skills, their strengths and weaknesses and their authorities and responsibilities to carry out actions. At this level, the timescale is tactical (e.g. less than 10 minutes of anticipation) and the environmental considerations are based on detection by sensors.

Lastly, the nano level refers to specific properties (e.g. concrete decisions, elementary actions such as the fact of pressing a button) or specific components (such as a system function) that are going to produce actions. At a nano level, the allocation of tasks between agents can also be envisaged. At this level, the roles correspond to sets of actions that are linked to each other and that can be executed by one and the same agent that has several roles. Effectively, an agent can play different roles that depend on the societal context in which they are involved. The time scale at this level is immediate, as it is for the environment. Figure 3.1 shows how the various levels are related to the actions based on an example of distribution of authority and which can be instantiated case by case by means of these levels. These various distributions of authority can evolve over time.

The example of the Uberlingen accident (2002) reflects how organization of the responsibility in relation to the TCAS (Traffic Alert and Collision Avoidance System) was carried out. This technical agent triggers the appearance of instructions to the pilot who has the authority to execute a tactical avoidance maneuver. Before the Uberlingen accident, there was no harmonization between the Russian and German procedures at a macro level. One procedure gave the authority to make a decision to the TCAS agent; the other giving authority to the air traffic controller. This lack of harmonization led the pilots and the controller, at a nano level, to follow different and non-coordinated instructions during the execution of the action that led to the collision of two airplanes mid-flight. This means that an event at a nano level can lead to modification at a macro level, which will have a positive retroaction at a nano level. Figure 3.2 shows the dynamic interaction between the levels by basing itself on the case of the evolution of shared authority related to the TCAS following the Uberlingen accident.

Another example is related to the events of September 11, 2001, which have drastically changed the cockpit access procedures during the execution phase of a commercial flight. After these events, at a macro level, the regulatory bodies (the FAA and the EASA) asked the airlines to install an access to the cockpit that is capable of resisting intrusions for a period of 20 minutes (meaning the average time required to reach an airport). Nevertheless, these regulatory bodies have delegated authority to airlines, at a meso level, for implementation of suitable technical measures, without specifying any solutions to adhere to. This has allowed airline companies to manage this new constraint with respect to their operational contexts. Companies have then delegated responsibility to pilots at a micro level to manage access to the cockpit on a case by case basis. At a nano level, technical solutions put in place can vary depending on the company (e.g. control of commands or of entry codes), this has an impact on the allocation of authority to agents (e.g. depending on the position of a command control in the cockpit, the cabin personnel will or will not be able to access the cockpit). In this case, management of the risk of intrusion in the cockpit was carried out in a systematic manner with a view to delegating vertical authority. Even though we may believe that this approach is very effective, it however does not adapt itself very easily to the diversity of operational situations. Taking account of the variety of agents and situations, alternative solutions could be imagined that have a different impact on the allocations of authority and of responsibility at micro and nano levels.

3.3.3. Patterns of actions in relation to authority and responsibility

Based on the attributed authority/responsibility, the execution of actions between agents can be described by different patterns, as has already been proposed by Boy and Grote [BOY 12] and more widely detailed in the following sections. In most cases, we could consider that an agent is accountable if they are responsible. However, this basic hypothesis may be called into question during design of a new allocation of authority and, in this case, incoherencies may emerge when the pattern of allocation of responsibility is not compatible with the pattern of allocation of authority and accountability. To simplify explanation of the principle of allocation patterns, we will develop these by highlighting authority, because this allows improved illustration of the dynamic of patterns via concrete examples and connections to responsibility and accountability. However, we can postulate that equivalent patterns, based on the same principles, can be established concerning responsibility and accountability and serve as a basis for analysis of the coherence between these concepts during design. Nevertheless, to date this has not been detailed.

3.3.3.3. Authority delegation

This pattern of authority evokes a situation in which an agent transfers its authority to another agent to carry out an action. This supposes that this other agent possesses the appropriate skills, expertise and knowledge to execute the action that is demanded of them.

It is also important, in this case, that the action that is delegated is defined clearly and that the two agents have a shared representation of the prerequisites for carrying out the action and its consequences, and in certain cases of the process involved by carrying out the action. Moreover, the agent initiating the delegation of authority may or may not maintain responsibility for execution of the delegated action. Delegation implies the notion of contract that must be managed by the delegating agent. We consider that if the delegated agent executes the terms of the contract for the delegator of the action, the latter must verify that the contract is executed correctly by the delegated agent. In the end, the delegating agent will always remain accountable for performance of the delegated agent. In the case where the delegated agent does not respect execution of the contract, the delegating agent will nevertheless remain responsible and accountable for the non-execution of the action. In this latter case, only authority is delegated.

When an action is more complicated to carry out or it surpasses human capabilities of a first agent who carries out the action, part of this action/task can be delegated to a second agent in order to better carry out the action as a whole.

Each time an agent delegates an action/task, they lose direct control over the execution of this action, they lose authority over it. Nevertheless, they remain responsible for delegated actions, and for maintaining a form of super-control, the delegating agent will have to go through the process of a delegated task management activity. Thus, the agent who delegates will imperatively need to manage the coordination between what the delegated agents do and their own activity, in such a way as to ensure an overall performance.

To date, air traffic controllers have full authority to send orders to airplanes in order to provide tactical instructions and clearances. An exception to this authority was introduced when TCAS were installed on-board airplanes, delegating the authority to the TCAS agent to provide tactical instructions to pilots. This delegation took place in order to avoid confusions during decision-making processes. When two airplanes enter into conflict, each of the TCAS of the two airplanes provides information on the surrounding traffic and advice about resolution of the conflict. For example, a TCAS is going to ask the pilot to gain altitude and the other TCAS will ask the pilot to descend. These orders are coordinated. When a TCAS gives an order to the pilot, the latter must carry it out to avoid a collision with the other airplane by losing or gaining altitude. In this case, the action regarding decision-making, to resolve the conflict, has been delegated to the TCAS who must indicate to the pilot the procedure to follow. However, the pilot maintains the authority over execution of the avoidance maneuver. Responsibility has also been modified with integration of the TCAS. The TCAS is now responsible for providing an “acquisition of information” and a correct “analysis of information”, as well as a suitable and coordinated “decision and action selection”. Pilots remain responsible for correctly carrying out the action based on a decision made by the TCAS agent. Figure 3.3 presents an example about the way in which this delegation of authority can be presented.

3.3.4. Dynamic relations between the dimensions of the analysis framework

This section describes the dynamic relations between the dimensions of the framework for analysis and design. The first dimension of the analysis framework characterizes the way in which the responsibility, authority and accountability are related to the way in which the action is carried out.

The second dimension illustrates how these three components are spread out across four levels that designate the social environment of agents. The macro level distributes the prescriptions of responsibility and authority and defines the roles of agents, their profile (their capabilities, the level of reliability, the level of training, etc.) and the agents that must interact with each other. The meso level concerns the entire management of a mission in which the pilots, air traffic controllers, flight supervision centers (OCC) and automation is involved. The meso level allows authority to emerge, as a function of the context and under supervised control. At this level, responsibility and authority can become an adjustment variable or an adaptive factor to take into account the variability of contexts and operational environments more correctly. The micro level relates to the responsibility and the authority allocated to an agent who will be able to give direct orders to an airplane. The nano level makes reference only to the selected actions.

The last dimension of an analysis framework considers that responsibility and authority follow various interaction templates between the various agents involved in the overall and completed actions.

The essential aspects to consider in a systemic approach to authority are the dynamic relations between the different elements of each of the dimensions, described below, due to the temporal and situational evolution of active agents and environments. Similar actions will be able to be associated with different characteristics of responsibility/authority/accountability, at different macro/meso/micro/nano levels, or follow different templates for interaction as a function of the context and of the operational environment. Nevertheless, the dynamics involved, although they are adaptable, present completed characteristics that may be the subject of an analysis and guided design.

The definitions of responsibility and accountability must be relative to the action carried out. For this reason, the variability in this action must be well understood. The methods in the field of ergonomics and human factors, such as the methods of cognitive modeling, modeling of tasks/activities and organizational modeling, allow us to understand and better master the variability of actions in organizations. However, it is also important to understand to what level a certain authority and responsibility refer (macro or micro). Lastly, the most efficient interaction template between sharing/distribution/delegation/trading has to be identified and formalized in order for the performance expectation to be achieved. Moreover, communication and cooperation between the various agents should be maintained, supported by interfaces (logical or even HCI) and means between and within the various levels.

In order to avoid the appearance of problems related to human factors during operations, synchronization between these various elements should be ensured when new operational concepts are introduced. This would allow incoherencies or differences to be avoided between these various elements in relation to the final action of agents.

The main challenge for design resides in the articulation of the understanding of actions currently carried out and linked to the action cycle with their allocated authority and the definition of their responsibility and accountability.

3.4.1. At the nano level

At the nano level, the detailed actions are analyzed during the execution phase, since one or several agents can be required to lead actions towards the same objective. As a result, the most suitable item on this level is not the responsibility, because it is allocated to an agent defined within other levels. However, it is above all the authority that will be the most suitable at this level. Indeed, the authority to decide on the most suitable distance to be maintained with respect to the target airplane is given to the pilot.

At this level, it is possible to identify a potential negative impact on human performance in carrying out this action, because today there are no tools supporting this task. It is possible to raise the question of the interest that a human and/or a machine would have in analyzing or deciding on the distance and the adjustment speed to maintain as a function of the behavior of the target airplane. A situation of this kind would imply a delegation of authority by the pilot to an onboard system. Figure 3.4 shows the ADS-B as a potential means that could be used in design of a tool of this kind.

3.4.2. At the micro level

In controlled air spaces, the responsibility for separations between airplanes is allocated to air traffic controllers. However, once a visual separation is accepted by a crew, the pilot becomes responsible for this separation.

The pilot has the authority to accept or not accept the task of visual separation. The separation is not under their responsibility because they are not obliged to accept, if we trust operational descriptions. They become responsible only from the moment when they have explicitly accepted the visual separation. As a result, the actions at the nano level where the pilot analyzes the distance to the previous airplane must be considered in relation to the authority at the micro level.

From the point of view of the authority pattern, the situation can be characterized as a delegation of the responsibility of the separation from the controller to the pilot. Indeed, the delegation pattern must be accompanied by a communication that allows explicit delegation of responsibility. In order to reinforce this transfer, an evolution of the phraseology and/or recourse to dedicated HCI could take place at the meso level. Indeed, in the analysis framework that we use, we can consider that formalization of the delegation pattern must be decided at the meso level and that the effective delegation will take place during execution of the maneuver directly between the controller and the pilot at the micro level.

In case a tool that helps in carrying out this task is introduced, the question of authority between humans and the system should be re-studied as a function of the local and organizational context in which the operation will be carried out.

Nevertheless, even though the pilot is responsible for the separation and the controller is no longer responsible for this separation, the latter will maintain an interest in this separation in the context of a supervision task (the controller keeps an eye out for this). Because if it so happens that something goes wrong with the airplane under visual separation, even though it is no longer under their direct responsibility, there can be an impact on the actions related to the area under the responsibility of the controller and consequently, their accountability comes into play.

3.4.3. At the meso level

At a meso level, the responsibility between the actors and the social entities can, for example, be related to the way in which airlines define their directives for pilots as a function of the globality of their mission. Directives of this kind could be related to management of assignments and to recommendations to maintain a larger separation than that judged acceptable by the pilot, or the airlines could even give advice about visual separations. Indeed, at this level, airlines can have the authority to take action to install additional safety measures, because airlines are responsible for putting in place a suitable system for management of the safety of their fleet in the air.

3.4.4. At the macro level

Lastly, at a macro level, institutions define laws, for example regarding the fact of maintaining a certain separation from the preceding airplane as a function of their weight categories. Thus, institutions have a considerable impact on the accountability of actors. International institutions, such as the ICAO, have the authority to introduce new regulations, but it is down to national authorities to transform them into concrete actions. In addition, different rules depending on the European or North American context can be applied. For example, pilots in the United States and in Europe will apply different procedures with regard to the fact that they must manage a potential go-around during visual separation. Along the same lines, the industrial sector, within the framework of researching aids to visual separation, is responsible for proposing technical solutions and also has the authority to carry out evaluations of the global efficiency of the solutions that they propose.