Supporting Resilence in Air Traffic Management A Tedeschi

Supporting Resilence in Air Traffic Management A. Tedeschi, M. Felici, V. Meduri, C. Riccucci SERENE 2008 November 17 -19, 2008, Newcastle upon Tyne, UK

Overview n The SERENITY project n n n Tailoring S&D Patterns to the Air Traffic Management (ATM) domain n n Design Patterns Evaluation Scenarios SERENITY S&D Patterns The SERENITY Process An ATM Scenario Unfolding Emergent Resilience Conclusions 2

The SERENITY Project n n n The primary goal of SERENITY IP project is to enhance security and dependability for Am. I ecosystems by capturing security expertise and making it available for automated processing through Patterns are expression of a fundamental structural organization schema for a socio-technical system, which consists of subsystems, their responsibilities and interrelations. SERENITY provides a framework supporting the automated integration, configuration, monitoring and adaptation of security and dependability mechanisms for such ecosystems. 3

The SERENITY Scenarios n n n Industry Scenarios n cover a broad spectrum of domains, n adhere to real-world situations, and n address outstanding industrial problems Assess the methods, techniques, and tools developed by the other project activities (e. g. organisational patterns) Apply the SERENITY framework to provide S&D solutions for the selected application scenarios 4

SERENITY S&D Patterns n n n The SERENITY pattern description identifies information (i. e. , Trust Mechanisms, Provided Property, Pre-conditions, etc. ) concerning S&D aspects The description associates the specified pattern with specific S&D properties, implementation aspects (e. g. , components, parameters, etc. ) and environmental constraints (e. g. , pre-conditions) Three Pattern Categories n Organizational n Workflow n Infrastructure 5

The SERENITY Process 1. 2. 3. 4. Capturing and formalizing relevant knowledge by S&D Patterns Defining reaction plans along with mappings between the plan’s structures and those of S&D Patterns The SERENITY Runtime Framework (SRF) monitors the system, manages the matching between the reaction plan, its execution and relevant S&D Patterns Exploiting the knowledge formalized by S&D Patterns It enables reaction mechanisms by deploying S&D Patterns 6

The SERENITY Runtime Framework (SRF) makes the knowledge captured by S&D Patterns available to the actors participating in the response by means of functionalities to: n n Alter plans during response and execution Share plans Inspect plans Monitor plans execution 7

Air Traffic Management (ATM) n n Air Traffic Management (ATM) is the dynamic and integrated management of air traffic flow to minimize delays while guaranteeing safety of operation in the airspace. The airspace managed by each Area Control Center (ACC) is organised into adjacent volumes, so-called Sectors. Each sector is operated by a team of two Air Traffic Controllers, consisting of a Planning Controller and an Executive Controller. The Planning Controller and the Executive work together and share the responsibility for the safe operation of the sector they control. Groups of neighbouring Sectors are coordinated by a Supervisor, who is in charge of managing the traffic forecast in the next period and modify the sectors configuration accordingly. The Supervisor is also responsible for the formation of the Sector Teams. 8

ATM Peculiarities n Organizational and management aspects of S&D n n n Stresses on organizational reaction to threats and hazards Stresses on safety, dependability and resilience, more than security Deals not only with digital systems, but with complex socio-technical systems n systems involve people, artifacts, organizations, physical spaces and digital devices 9

ATM Scenario Overview n n Italian airspace, summer time: an unexpected increase of air traffic risks exceeding Sector SU capacity. In order to safely manage all the incoming traffic, standard re-sectorization is decided: sector SU gets split into SU 1 and SU 2. The re-sectorization is not sufficient: partial delegation of airspace is negotiated and issued. After the traffic peak has been safely managed, previous configuration of airspace is restored. 10

Supporting Work Practices n Coordination n Decision Support n Contextualization n Evolution 11

Organizational Patterns n n n Critical roles and responsibilities of the Air Traffic Controllers (ATCOs) Complex organizations Source of S&D patterns Examples of Organizational Patterns Public Artefact. This pattern concerns any situation in which shared resources are used to share information among several agents that carry on similar or related tasks. Reinforcing Overlapping Responsibilities. This pattern is concerned with critical tasks that must be accomplished by several agents with high level of safety. Therefore, those agents share responsibility for achieving these tasks. It is, therefore, necessary to set up work groups in which more than one worker can perform the same activity. 12

Examples of Organizational Patterns n n Public Artefact Two Supervisors Assessment of the Partial Delegation’s feasibility Timing, Decision Support, Situation Awareness Any controller involved in the decision-making process shares the same information artefacts Reinforcing Overlapping Responsibilities n Assistance for critical situations n Matching required capabilities with available resources n For instance, an Executive controller can act as Planner Controller 13

System Functionalities n Reminder n Communicator n Recorder n Advisor 14

S&D Pattern Elicitation and Validation n Requirement Collection n n Light Evaluations n n ATM experts, together with evaluation responsible, walk through scenario workflows and first prototype ‘slideware’ to collect feedback for developers the Player is shown to ATM experts in an informal setting and played on shorter sequences of the scenario. Feedback is collected for developers Complete Evaluations n simulations performed with ATM experts on a full, multi-path version of the scenario. Feedback on the effectiveness and usefulness of Serenity is collected through feedback collection 15

ATM Scenario Evaluation - Overview n n n “Wizard of Oz” Evaluation Scenario simulations with ATM experts through reproduction of “pivot points” Re-enactments with introduction of a prototype Feedback on comparison collected through individual questionnaires, interviews and focus groups 16

The “Wizard of Oz” n n A “Wizard” simulates the system’s intelligence and interacts with the users/actors through a real or mock computer interface Users/actors will be ATM experts, and feedback on usefulness of the tool will be collected through feedbacks activities 17

ATM Scenario Evaluation Tools n The “scenario player”: n n n Scenario (i. e. radar) screenshots Prototype SRF + ATM Cooperation Tool (ACT) Additional data to increase realism ACC Position Application 18

Scenario Unfolding 1. 2. 3. Safety Hazard Subsequent Strategy Decisions Emerging Resilience 19

Safety Hazard Traffic exceeding sector's capacity 20

Subsequent Strategy Decisions 21

Emergent Resilience Resulting capacity containing traffic peaks 22

Emergent Resilience n n n n Is socio-technical Involves work practices Requires systems to support work practices A lack of understanding of these fundamental aspects may cause undependabilities or result in system failures 23

Conclusions n n n A socio-technical characterization of Resilience combining S&D Patterns, system functionalities and work practices Identification of suitable software functionalities implemented in an instance of the SERENITY Runtime Framework (SRF) tailored to the ATM domain Initial validation activities n n S&D Patterns as models to orient actions of actors involved in reaction processes to threats or attacks n n S&D requirements for tailoring pattern technology to the ATM domain S&D Patterns capture organizational, procedural and infrastructural aspects The SERENITY framework provides a means for delivering S&D 24 patterns (and their features) into industry domains