Célia Martinie
email: martinie@irit.fr

Philippe Palanque
email: palanque@irit.fr

Alberto Pasquini
email: alberto.pasquini@dblue.it

Martina Ragosta
email: ragosta@irit.fr

Eric Rigaud
email: eric.rigaud@mines-paristech.fr

Sara Silvagni
email: sara.silvagni@dblue.it

Using Complementary Models-Based Approaches for Representing and Analysing ATM Systems' Variability

Keywords: D.2.2 [Software] Design Tools and Techniques -Computeraided software engineering (CASE), H.5.2 [Information Interfaces and Presentation]: User Interfaces -Interaction styles ATM, Automation, Variability, Federation of Models

published or not. The documents may come

L'archive ouverte

INTRODUCTION

Use of models has been very successful in recent years to describe, investigate and predict the behaviour the systems operating all around us and understand the interactions between the elements that compose these systems especially in the area of computer-based systems [START_REF] Zeichick | UML adoption making strong progress[END_REF]. Models can be built with different objectives in mind. UML for instance targets at the engineering of computing systems and thus support for code production is of prime importance. When dealing with socio-technical systems objectives for using models are more widespread and cover supporting the understanding of the system, assessing its overall performance … This paper targets at a specific objective consisting in the investigation of possible sources of variability that could affect this system and change its behaviour. The assessment of variability consequences could be particularly challenging in the context of Large-Scale Socio-Technical Systems (LSSTS) such as Air Traffic Management (ATM), where different interconnected systems work on the achievement of a common goal. The LSSTS are characterized by multiple levels of complexity, by the involvement of multiple domains and by tight interleaving of social and technical functions for successful organizational performance [START_REF] Fox | Sociotechnical System Principles and Guidelines: Past and Present[END_REF]. In particular, this interaction is partly linear and partly nonlinear making it a complex and hardly predictable relationship [START_REF] Westbrook | Multimethod evaluation of information and communication technologies in health in the context of wicked problems and sociotechnical theory[END_REF]. Since early studies of sociotechnical systems [START_REF] Accot | Beyond Fitts' Law: Models for Trajectory-Based HCI Tasks[END_REF] it was evident that, in this kind of open systems, the solution to one type of problembeyond a certain point depends upon solving some of the others.

The multiple levels, the overall complexity and the level of uncertainty idiosyncratic to these systems' behaviour and interactions have a strong impact when trying to model them. In particular, efforts to build an overall model to support the analysis of the systems of systems have not been very successful until now. An emerging alternative approach has been to combine modelling techniques offering different perspectives of the system under study. Such approach results in the production of several models making it possible to analyse them at different level of granularity. However, developing a model of such systems means to sweep a huge range of parameters over a vast number of possible scenarios to identify the most salient uncertainties, regions of robustness, and important thresholds of the system [START_REF] Epstein | Why Model[END_REF]. The aim of the paper is to look for a systematic approach to reason about variability of LSSTS. The overall objective is to overcome the limits of a single model by integrating models able to investigate such variability from different perspective. The models provide various perspectives able to cover the characteristics of the different interacting Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Re-publication of material on this page requires permission by the copyright owners. ATACCS'2012, 29-31 May 2012, London, UK.

Copyright 2012 IRIT PRESS, ISBN: 978-2-917490-20-4 complex components concurring to the achievement of the whole system of systems' goals. However, these multiple views on the same system must be consistent and overlapping as little as possible in order to reduce duplication of work. To this end, the approach presented in this paper proposes a federation of several models. To demonstrate the ability of the models integrated in our approach to deal with variability of LSSTS we have applied it on a case study taken from the ATM World. The case study specifically deals with the assessment of the variability induced the introduction of increased level of automation (one of the main driver for SESAR [START_REF][END_REF]) in ATM. Indeed, one of the main challenges in the future of Air Traffic Management (ATM) is the achievement of increased level of operational and staff productivity by means of advanced automation tools. However, increase of automation introduces variability in the system especially when automation failures or malfunction are taken into account. Such high potential of variability calls for methods, techniques and too to assess and to reason in a systematic way about variability of the overall system performance when automation degradations will occur. The paper is structured as follows: section 2 arguments the needs and advantages to involve multiples models (dealing with system aspects, human aspects and organizational aspects) and how complementary ones can better support description and analysis of LSSTS. It also proposes a generic framework integrating those models in order to assess and reason about variability. Section 3 introduces HAMSTERS, ICO and FRAM, three description techniques offering complementary views on LSSTS. Section 4 reifies the process presented in section 2 with the 3 description techniques presented in section 3. Section 5 applies this approach to the case study of the Arrival Manager (AMAN), a computer-based support tool providing air traffic controllers with advisories for sequencing landings. Section 6 concludes the paper and presents research directions for future work.

NEED FOR COMPLEMENTARY MODELS

Modelling approaches in the context of safety management usually focus on failure modes of technical systems and on human errors. Systems performance is generally considered as binary: the system performs as prescribed or fails to do so. In the context of complex system, perturbation can occurs not only because of components failure but also because of the interactions between the various components by affecting their resources, their time to perform, their ability to adjust to their environment, etc. In order to take into account this type of perturbations, models have to be able to address the variability of each of these components as well as the variability related to their interrelations. On the system side, it is thus important to be able to describe the behaviour of each component and subcomponent of the system ad, for each of them to identify the sources of variability that might affect this behaviour. In order to analyse the potential propagation of this variability it is important to connect those components and to represent which facets of the component might be influenced by the upstream components. On the user side, it is important to be able to represent the behaviour of the operators in charge of the exploitation of the system. A model must be able to capture both goals of the operators and the sequences of actions to be performed in order to reach these goals. Beyond that procedural aspects information involved in these activities have also to be represented. Indeed, they are usually involved as precondition or post conditions representing operators' knowledge or information flow from one activity to another one. Variability in terms of performance has been studied in details in particular through NASA-TLX [START_REF] Hart | NASA-Task Load Index (NASA-TLX); 20 Years Later[END_REF] and correlates to fatigue [START_REF] Mollard | Measurement of fatigue and sleepiness in ATC simulation[END_REF], stress [START_REF] David | Measures of stress/strain on air traffic controllers in simulated air traffic control[END_REF] … but also to system failure [START_REF] Metzger | Conflict detection aids for air traffic controllers in free flight: Effects of reliable and failure modes on performance and eye movements[END_REF]. Figure 2 presents a process made up of a set of steps for performing quantitative and qualitative analysis of a given LSSTS. The process starts by defining the scope and the objective of the analysis. Then the socio-technical system (STS) is modelled with a triple focus on human, system and organizational aspects followed by the detailed identification of variability in terms of sources and dimensions. Once the consistency of the three representations has been ensured each function identified in the STS is studied in detail. For each of these functions quantitative and qualitative aspects of variability are studied and recorded. When every function has been studied, the coupling of function (represented in the organizational model) is exploited in order to assess propagation of variability. While many notations and descriptions techniques could be used to implement such process, we use FRAM notation, HAMSTERS task modelling technique and ICO, a Petri net-based formalism for representing respectively organizational, human and computing systems models. Next section presents this three modelling techniques. The method associated to FRAM is used as the design driver throughout the process presented in Figure 2.

THREE COMPLEMENTARY DESCRIPTION TECHINIQUES FOR MODELING LSSTS Functional Resonance Analysis Method (FRAM)

FRAM [START_REF] Hollnagel | Barriers and accident prevention[END_REF] is a safety management method aiming to support both accident investigation and risk assessment processes based on a set of principle related to complex socio-technical systems structure and dynamic. First principle is "Equivalence of Successes and Failures".

In FRAM models, success or failure of the performance of a function are the outcomes of the same underlying process Second principle is "Approximate Adjustments".

Conditions of work never completely match what has been specified or prescribed. Individuals, groups, and organizations normally adjust their performance to meet existing conditions. Because resources always are finite, ATACCS'2012 | RESEARCH PAPERS 148 such adjustments will invariably be approximate rather than exact. Third principle is "Emergence". Variability of multiple functions may combine in unexpected ways, leading to consequences that are disproportionally large, hence produce a non-linear effect. Fourth principle is "Functional Resonance". The variability of a number of functions may every now and then resonate, i.e., reinforce each other and thereby cause the variability of one function to be unusually high. FRAM method is structured in four main phases:  Identify the essential functions that are necessary (and sufficient) for the intended performance to occur (when 'things go right'). The functions can be assigned to either the set of foreground functions or the set of background functions. Characterise using the six basic aspects (Input, Output, Pre-conditions, Resources, Time, and Control). Taken together, the functions are sufficient to describe what should happen (i.e., the everyday or successful performance of a task or an activity).  Characterise the variability, first as the potential of the functions described by the model, and then as the (possible) actual variability for a set of instantiations of the model. Consider whether the actual variability will be what one should expect ('normal') or whether it will be unusually large ('abnormal').  Identify the dynamic couplings (functional resonance) that likely will play a role during an event. These comprise an instantiation of the model which can be used to predict how an event will develop and whether control can be lost. In relation to the traditional risk assessment, this instantiation provides an explanation of what may happen, although it does not necessarily identify unique or specific outcomes. The explanation will be based on the couplings of the variability of everyday performance, rather than failures and malfunctions.  Propose ways to monitor and dampen performance variability (indicators, barriers, design/modification, etc.) In the case of unexpected positive outcome, one should look for ways to amplify, in a controlled manner, the variability rather than for ways to dampen it. Application of FRAM method is based on a functional model where functions are describes with six aspects:  Input (I): that which the function processes or transforms or that which starts the function,  Output (O): that which is the result of the function, either an entity or a state change,  Preconditions (P): conditions that must be exist before a function can be carried out,  Resources (R): needed by the function when it is performed (Execution Condition) or consumed to produce the Output,  Time (T): temporal constraints affecting the function (i.e. starting time, finishing time, or duration), and  Control (C): how the function is monitored or controlled. The definition of functional variability in FRAM is based on the principle that the variability of the output of a function depends of the composition of three sources of variability: endogenous variability, exogenous variability and coupling variability. Variability of output can be described with a set of dimensions such as timing, precision, distance, speed, direction, force, magnitude, object, sequence or quantity. Endogenous source of variability is related to the internal variability of the system (automation, human, group or organisation) that performs the function. Exogenous source of variability is related to the variability of the environment of execution of the function (working conditions, culture, etc.). Coupling source of variability is related to the variability of functions that are coupled with the studied function.

Human-centered Assessment and Modeling to Support Task Engineering for Resilient Systems (HAMSTERS) HAMSTERS1 is a notation designed for representing the decomposition of human goals into activities.

Human activity types when interacting with a system

The notation embeds several types of tasks as presented in Table 1: HAMSTERS notation proposes refined tasks for the cognitive task type:  Perception/working memory modelled with a cognitive analysis task (left-hand side of Figure 2).  Decision making modelled with a cognitive decision task (right-hand side of Figure 2). These task types have been introduced in [START_REF] Martinie | Task-Model Based Assessment of Automation Levels: Application to Space Ground Segments[END_REF] to describe in details the operators' activities while interacting with a (partly-) autonomous system.

Temporal ordering of activities

Temporal relationships between activities are described by operators (listed in Table 2), which help in describing task sequences performed by the user. Execution of T2 interrupts the execution of T1, T1 execution is resumed after T2 has been executed

Order Independent T1|=|T2 T1 is executed then T2 is executed OR T2 is executed then T1 is executed

Tasks can be tagged by temporal properties: iterative, optional or both (as graphically shown in Figure 4). More precisely iterative refers to a task that can be executed one or several times but can be interrupted or suspended by another task. An optional task is a task that does not necessarily needs to be executed in order to reach the goal. The exhaustive list of operators is presented in Table 2, and is similar to the one of CTT.

Quantitative temporal relationships

HAMSTERS provide support to associate minimum and maximum execution time to a task (as shown in Figure 5).

In this way, it enables:  Checking temporal relevance between user's activities and system information processing.

 Validating the developed system w.r.t. users' performances evaluation with usage scenarios. Further description on the HAMSTERS and associated tool, as well as structuring mechanisms to support the effective exploitation of task models for large scale application can be found in [START_REF] Martinie | Structuring and Composition Mechanism to Address Scalability Issues in Task Models[END_REF].

ICO AND PETSHOP

ICO stands for Interactive Cooperative Object and is a formal notation to describe and model system's behavior and user interactions with the system. It is Petri nets based and associated to a supporting tool, Petshop2 . This tool enables to:  Edit application behavioural models and to connect them to the presentation part of the user interface (graphical widgets and frames for example).  Execute the application with the underlying behavioural models. [START_REF] Navarre | ICOs: A model-based user interface description technique dedicated to interactive systems addressing usability, reliability and scalability[END_REF]. This notation and its associated tool supports fine-grain analysis of user's actions on the system, particularly with a logging function which enables performing detailed quantitative analysis [START_REF] Lacaze | Performance Evaluation as a Tool for Quantitative Assessment of Complexity of Interactive Systems. 9th workshop on Design[END_REF] of user's performance with the system [START_REF] Palanque | A model-based approach for supporting engineering usability evaluation of interaction techniques[END_REF].

INTEGRATION OF FRAM, HAMSTERS AND ICO

Objectives of the development of the Federation of Models are to provide a framework allowing the modelling of Large Scale Socio Technical Systems performance variability under different conditions, with different levels of granularity. This Federation of Models consists in integrating FRAM method with HAMSTERS and ICO Figure 7. Federation of Models within a Models-Based process to assess LSSTS performance variability notations and tools. The integration of FRAM, HAMSTERS and ICO leverages the high-level view on complex socio-technical systems provided by FRAM with the fine-grain view on human-system interaction provided by HAMSTERS and ICO. The main contribution is to associate performance variability analysis phase of the FRAM method with quantitative user and system performances evaluation support from HAMSTERS and ICO. Figure 1 details the proposed process putting into practice such federation of models. This process corresponds to the reification of the process presented in Figure 2and is detailed in the next paragraphs.

The first steps of the process (Figure 1) are dedicated to the identification of the main functions of the socio-technical system via task analysis for the FRAM application. The task analysis work is supported by HAMSTERS notation and tool... Next steps are dedicated to the variability analysis, starting by establishing the variability model of each main function according to the objectives of the socio-technical system analysis:  Functions output variability types (temporal, precision, sequence, objects…) and sources of variability (endogenous, exogenous, and coupling) are identified.  Relationships between sources of variability and output variability types are elaborated. Once variability model has been established, two complementary flows can be followed:  Original qualitative variability analysis with FRAM method (Qualitative analysis flow).  Quantitative performance variability analysis with HAMSTERS and PetShop (Quantitative analysis flow). HAMSTERS notation and tool supports quantitative performance variability analysis on human FRAM functions and PetShop tool (with ICO notation) supports quantitative performance variability analysis on technological FRAM functions.

The last steps of the process are the original final steps of the FRAM method, performing downstream coupling analysis with data gathered from the qualitative and quantitative analysis in order to identify resonance or dampening effects. HAMSTERS and ICO have previously been integrated to enable qualitative and quantitative analysis of coherence and consistence between user's activities and interactive system's behaviour [START_REF] Accot | Beyond Fitts' Law: Models for Trajectory-Based HCI Tasks[END_REF]. This integration can also support automation design [START_REF] Martinie | Formal Tasks and Systems Models as a Tool for Specifying and Assessing Automation Designs[END_REF], as it enables analysing and assessing function allocation between the user and the system. At the end of the federation process, the system under analysis will be described from three complementary perspectives:  One based on human goals (HAMSTERS)  One based on organisational functions (FRAM)  One based on system's behaviour (ICO and PetShop)

CASE STUDY: MODELLING MANAGEMENT OF AIRCRAFT ARRIVAL SEQUENCES WITH FRAM AND HAMSTERS

The first effort in integrating the models has been performed on a case study taken from the Air Traffic Management (ATM) world. It aims at demonstrating that the models can work together and, to verify that the models' integration is effective in assessing system's variability.

The future of the European ATM System is characterized by the implementation of new automated tools to solve the increase of traffic demand and new business challenges [START_REF][END_REF]. However, an accurate analysis of the problems related to possible automation degradation is still missing. The application of the federation of models to the ATM case study can provide a means to analyse the variability introduced in the system by the automation degradation, to investigate the consequences of this variability on the local and overall system performances and how these consequences can propagates through the system.

Brief description of the case study

The extract presented in this article focuses on the AMAN tool and the EXC_TMA, Executive Controller in the TMA (Terminal Manoeuvring Area). The TMA is the area where are controlled flights approaches and departures in the airspace close to the airport.

The AMAN (Arrival MANager) tool is a software planning tool suggesting to the air traffic controller an arrival sequence of aircraft and providing support in establishing the optimal aircraft approach routes. Its main aims are to assist the controller to optimize the runway capacity (sequence) and/or to regulate/manage (meter) the flow of aircraft entering the airspace, such as a TMA [START_REF] Eurocontrol | Implementation GUIDELINES and Lessons Learned[END_REF]. It helps to achieve more precisely defined flight profile and to manage traffic flows, in order to minimize the airborne delay, leading to better efficiency in terms of flights management, fuel consumption, time, and runway capacity utilization [START_REF] Martinie | Formal Tasks and Systems Models as a Tool for Specifying and Assessing Automation Designs[END_REF]. The AMAN tool uses the flight plan data, the radar data, an aircraft performance model, known airspace/flight constraints and weather information to provide to the traffic controllers, via electronic display, two kind of information:  A Sequence List (SEQ_LIST), an arrival sequence that optimizes the efficiency of trajectories and runway throughput (see Figure 10);  Delay management Advisories, for each aircraft in the ATCO's airspace of competence. The EXC_TMA is the controller deputed to handle the communications ground/air/ground, communicating to the pilots and releasing clearances to aircrafts. He/she has the tactical responsibility of the operations and he/she execute the AMAN advisories to sequence aircraft according to the sequence list. In the proposed scenario, the pilots assume a passive role, limited to the reception and execution of the clearances.

Identification of functions and FRAM model instantiation

As described in the process presented in Figure 7, the first steps aim at identifying functions and building a FRAM model.

Executive Controller main activities are identified during task analysis and task modelling phases. An extract of output of these phases is depicted in Figure 8, which present HAMSTERS task model of Executive Controller (EXC_TMA) main activities. The main goals of the EXC_TMA are to: "Monitor AMAN advisories", "Provide clearances to pilots", "Ensure distance separation" and "Ensure flights' position". These main goals are then refined into activities. The "Monitor AMAN advisories" goal, on which we focus for this case study, is decomposed in three tasks:  "Display AMAN advisories": an interactive output task describing that the system provides advisories (i.e. the predicted aircraft arrival sequence) to the EXC_TMA.  "Perceive AMAN advisories": a perceptive user task describing that the EXC_TMA detects the advisories provided by AMAN system.  "Analyse AMAN advisories": a cognitive analysis user task describing that the EXC_TMA is cognitively processing the AMAN advisories to determine the possible clearances he/she will have to provide to aircrafts pilots. Only the goals required for the demonstration are detailed in the presented HAMSTERS model ('+' symbol in Figure 8 indicate that tasks are folded, which means that subtasks are not displayed). Furthermore, the main goals are iterative and their subtasks can be performed in parallel.

FRAM method also identify AMAN systems main functions and the output of these steps is a FRAM model of the functions carried out to manage aircraft arrivals, depicted in. From this figure, we can observe that the technological function "Compute AMAN advisories" (top left corner in ) is performed by the AMAN system and outputs an aircraft arrival sequence list, which is an input for the next human function "Monitor AMAN advisories" led by the Executive Controller (EXC_TMA). The human function "Monitor AMAN advisories" outputs clearances to aircrafts pilots.

Performance variability analysis

After having described the AMAN system functions, a variability model is defined for each function, and qualitative and quantitative performance variability analyses are performed. The three next sub-sections detail these steps for the variability analysis between the output of the "Compute AMAN advisories" technological function and the output of the "Monitor AMAN advisories" human function (underlined with dashed circle in Figure 9). For this case study, we provide an example of quantitative performance variability assessment with HAMSTERS only, but the application of the Federation of Models process remains the same when using ICO and PetShop.

Establish output variability dimensions and variability source types for "Monitor AMAN advisories" function

Three dimensions are identified as relevant for the output of the "Monitor AMAN advisories" function (as summed up in Table 3): time (clearance can be performed on time, too late or not at all), precision (clearance can be precise, imprecise or acceptable) and objects (clearance can be correct or wrong). Finally, Table 5 highlights relationships between the output variability types and the different variability sources types, which will be used to analyse qualitatively the impact of these sources on the output variability of the function.

Performance variability qualitative analysis

Based on the identified variability dimensions and source types, a simple qualitative assessment of performance variability can be performed. Each source of variability can impact variability positively (+1), negatively (-1) or be neutral (0). The value of the output dimension is assessed by summing up the variability sources that can affect it. For example, for the precision dimension, if the sum of the source of variability associated is between -9 and -4 value is "Imprecise", if the sum is between -3 and +3 value is "Acceptable" and if the sum is superior to +4, value is "Precise".

Table 6 contains an instance of a qualitative assessment of the output variability of the "Monitor AMAN advisories" function when the input coming from the "Compute AMAN advisories" function is on time but imprecise. According to the impact of variability source types on the variability dimensions, the output of the "Monitor AMAN advisories" function will be a clearance that is arriving too late and imprecise but adequate.

This qualitative assessment of variability is a support for reasoning about relationships between output variability and variability sources, in order to highlight possible coupling between functions' outputs and detect potential resonance effects.

However, this conceptual framework does not provide support to estimate and assess quantitative values of functions' output variability. At proposed by this article, next paragraph presents an example on how this ability can be done integrating the FRAM method with the HAMSTERS notation and tool.

Performance variability quantitative analysis (with HAMSTERS)

This subsection of the case study describes an example on output temporal variability measurement of the "Monitor AMAN advisories" function. It intends to measure the impact of and incomplete sequence list provided by AMAN (some Time To Loose and Time To Gain information are missing). Output temporal variability is assessed quantitatively in order to analyse how delays due to the AMAN malfunctioning will affect the monitoring advisories function output. This function is critical as its output is the input to determine ATC clearance that has to be provided to aircrafts pilots.

The starting point of this quantitative analysis is to ensure that the models built during the application of first phases of the FRAM method can be used to measure the targeted variability output type. In our case, HAMSTERS model issued by the Task analysis phase is incomplete to measure output temporal variability. The "Monitor AMAN advisories" sub-goal of the task model is then refined to Figure 11. Refined HAMSTERS task model for the Monitor AMAN advisories goal in order to evaluate temporal variability take into account additional tasks that will be carried out by the Executive Controller if the AMAN advisories are incomplete. The refined model is presented in Figure 11 and contains two new sub-goals: "Handle nominal advisory for one aircraft" and "Handle incomplete advisory for one aircraft". When monitoring the advisories, depending on the AMAN system status, one sub-goal OR the other will be accomplished ('[]' symbol in the task model). Each of these sub-goals is refined with tasks that have to be performed. For each of these tasks, an estimated minimum and maximum execution time is associated. These associated execution times can be filled in with statistics processed from the observation of controllers, as well as estimated values processed from human cognitive processing models (such as [START_REF] Anderson | The ACT-R theory and visual attention[END_REF]) and Fitts' psychomotor model [START_REF] Accot | Beyond Fitts' Law: Models for Trajectory-Based HCI Tasks[END_REF]. Such performance evaluation techniques are described in [START_REF] Lacaze | Performance Evaluation as a Tool for Quantitative Assessment of Complexity of Interactive Systems. 9th workshop on Design[END_REF].

One each task has been attributed minimum and maximum execution time, total minimum and maximum execution times can be calculated in order to measure output temporal variability. Table 7 summarizes this calculus and provides the resulting variability. As indicated in Table 7, according to task model and time estimations for each task, it takes between 6,5 and 23,5 seconds to monitor an advisory when receiving a complete advisory from AMAN, whereas it takes between 18,5 and 55,5 seconds to monitor an advisory when receiving an incomplete advisory from AMAN. Temporal output variability range is then from 12 to 32 seconds.

Aggregation of variability and downstream coupling

Beyond the relatively simple results exhibited in previous sections the proposed approach aims at assessing variability for large scale socio-technical systems. Such systems are made up of a lot of interconnected functions influencing each other. As depicted in Figure 7, once the output variability assessment has been performed for each function, it is possible to aggregate and combine these results in order to identify potential resonance and dampening effects. Additionally, if quantitative assessments are performed for each function of a downstream flow, it makes it possible to assess precisely if the possible output variability of one function may compromise the achievement of a downstream function, and thus, potentially, the achievement of one goal of the LSSTS.

To come back to the case study presented in previous section, variability on the time constraints for communicating the clearance to the pilots, it then can be assessed whether as the AMAN malfunctioning may compromise the overall traffic management and trigger flight cancellation. Temporal output variability can be assessed and compared to the time constraints imposed to the overall ATC.

CONCLUSION AND FUTURE WORK

This paper has presented a notation-supported process for the analysis of variability of large scale socio-technical systems. This process has been demonstrated on the AMAN (Arrival Manager) case study involving automated behaviour. We have focused on the output temporal variability related to the degradation of AMAN as timing is an easy concept to present. However, many other sources (see Table 4 for a list related to the case study) of variability have to be taken into account in order to assess the performance and the safety level of the overall system.

The application of the process on a subset of real-size case study exhibits directions for future work. One of them is to design and develop tools to support FRAM models edition and simulation as currently offered by PetShop and HAMSTERS. This is one of the objectives of the SPAD project together with the integration of this new tool within PetShop suite. Such an integrated tool suite will not only support the editing of models but also the assessment of their compatibility (no conflicting information is present) as well as their simulation. This is of critical importance if variability has to be assessed in a systematic way as, due to propagation, many functions can be impacted by the evolution of a single source of variability in one function.

The AMAN computer function is rather simple and the sources of variability are rather limited. Accounting for more complex computing systems as defined in SWIM will require more in-depth representation of computing functions in FRAM and more complex ICO models.

Finally, more explicit handling of human error (as in [START_REF] Palanque | Task Patterns for taking into account in an efficient and systematic way both standard and erroneous user behaviour[END_REF]) or barriers identifications and description (as in [START_REF] Basnyat | Formal sociotechnical barrier modelling for safety-critical interactive systems design[END_REF]) will be part of the next steps of the approach. Indeed, within SPAD 157 project and as presented in [START_REF] Hollnagel | System Performances under Automation Degradation (SPAD), The First SESAR Innovation Days[END_REF] the approach will be tested on two different case studies: the AMAN one presented above and one dealing with Unmanned Aerial Vehicles (UAV) in order to assess its applicability if different levels of automations are under consideration.

Figure 1 .

 1 Figure 1. Abstract process to assess LSSTS performance variability

Figure 2 .

 2 Figure 2. Illustration of Cognitive analysis and decision task types

Figure 3 .

 3 Figure 3. HAMSTERS representation of tasks for "Communicate clearance" goal Figure 3 presents a HAMSTERS model corresponding to the decomposition in sub-tasks of the goal of an Air Traffic COntroler (ATCO) for sending a clearance to an aircraft. It is composed of 4 tasks organized in a strict sequence (modelled by the operator >>).

Figure 4 :

 4 Figure 4: Icons of Optional, Iterative and both iterative and optional tasks

Figure 5 .

 5 Figure 5. Excerpt from the property editor opened on one task, with highlighted maximum execution time

Figure 6 .

 6 Figure 6. Extract of Arrival Manager System model with ICO notationFigure6presents an extract from the ICO models describing the behaviour of an interactive application used in Air Traffic Management. This model describes the behaviour of one part of the application with a sequence of operations triggered by internal or user events. A token entering in one place (bottom shape on the figure) is used to trigger a display update on the presentation part of the application (example of such display update is presented in Figure10).

Figure 8 .

 8 Figure 8. Excerpt of the HAMSTERS task model of the Executive controller of the Terminal Manoeuvering Area (EXC_TMA)

Figure 10 .

 10 Figure 10. Screenshot of a subpart of an AMAN GUI (arrival sequence)

Figure 9 .

 9 Figure 9. Excerpt of the FRAM model for the AMAN case study

TABLE 1 .

 1 TASKS TYPES IN HAMSTERS

	Task

type Icons in HAMSTERS task model Abstract Task System Task User Tasks Interactive Tasks

TABLE 2 .

 2 ILLUSTRATION OF THE OPERATOR TYPE WITHIN HAMSTERS

	Operator type	Symbol	Description
	Enable	T1>>T 2	T2 is executed after T1
	Concurrent	T1|||T2 T1 and T2 are executed at the same time
	Choice	T1[]T2 T1 is executed OR T2 is executed
	Disable	T1[>T2	Execution of T2 interrupts the execution of T1
	Suspend-resume	T1|>T2

TABLE 3 .

 3 VARIABILITY TYPES ASSOCIATED TO "MONITORING AMAN

		ADVISORIES" FUNCTION OUTPUTS
	Output	Dimensions	Variability space
	Clearance for	Temporal	On time, Too late, Not at all
	Aircraft	Precision	Precise, Imprecise, Acceptable
	Monitored	Objects	Wrong clearance, Wrong aircraft
	Sources of variability that can affect the output of the "Monitor AMAN advisories" function are gathered in

Table 4 .

 4 Three types of source are taken in account. Variability related to the human agent performing the function: training and experience. Variability related to the work environment of the performance: access to procedure, condition of work, etc. Variability related to the consequences of past actions performed: availability of resources, number of goals and conflict resolution, available time, etc.

TABLE 4 .

 4 SOURCES OF VARIABILITY OF "MONITORING AMAN

		ADVISORIES" FUNCTION OUTPUTS
	Output	Type of source of variability		Source of variability
		Endogenous Training, Experience
			Access to procedure and methods,
	Clearance for Aircraft Monitored	Exogenous	Condition of work, Crew collaboration quality, Quality and support of organization HMI, Availability of resources, Quality
		Coupling	of communication, Number of goals and
			conflict resolution, Available time
	TABLE 5. RELATIONSHIPS BETWEEN VARIABILITY SOURCES AND OUTPUT
		DIMENSIONS
	Variability sources	Output dimensions
			Temporal	Precision	Objects
	Training		X	X	X
	Experience

TABLE 6 .

 6 EXAMPLE OF A QUALITATIVE ASSESSMENT OF THE OUTPUT VARIABILITY FOR THE "MONITOR AMAN ADVISORIES" FUNCTION

		Variability dimensions
	Qualification of the impact	Temporal	Precision	Objects
	of the variability sources
	on variability dimensions
	Training	+	+	+
	Experience	+	+	+
	Access to procedures and	-	-	NA
	methods
	Conditions of work	+	+	+
	Crew collaboration quality	0	0	NA
	Quality and support of	0	0	NA
	organisation
	HMI	-	-	-
	Availability of resources	0	0	0
	Number of goals and	-	-	-
	conflict resolution
	Available time	-	-	-
	Output qualitative	Too late	Imprecise	Adequate
	variability			clearance

TABLE 7 .

 7 MAXIMUM AND MINIMUM EXECUTION TIME OF THE "MONITOR AMAN ADVISORIES" FUNCTION

	Tasks and sub-goals	Min exec.	Max exec.
		time (ms)	time (ms)
	Task "Read nominal advisory"	2000	5000
	Task "Identify corresponding TTL or TTG"	1000	7000
	Total for sub-goal "Handle nominal advisory"	3000	12000
	Task "Read incomplete advisory"	2000	5000
	Task "Identify no corresponding advisory"	3000	8000
	Task "Search for flight level and speed"	3000	15000
	Task "Read flight level and speed"	2000	6000
	Task "Calculate TTL or TTG"	5000	10000

Total for sub-goal "Handle incomplete advisory" 15000 44000

	Task "Display sequence list"	500	1500
	Task "Analyse advisory"	3000	10000
	Total for "Monitor AMAN advisories"	6500	23500
	with nominal advisory
	Total for "Monitor AMAN advisories"	18500	55500
	with incomplete advisory
	Output temporal variability of advisories" function "Monitor AMAN	12000	32000

http://www.irit.fr/recherches/ICS/softwares/hamsters/index.html

http://www.irit.fr/recherches/ICS/softwares/petshop/

X X X Access to procedure and methods X X Condition of work X X X Crew collaboration quality, X X Quality and support of organization X X HMI, X X Availability of resources, X X X Quality of communication Number of goals and conflict resolution X X X Available time X X X

ACKNOWLEDGMENTS

This work has been partly funded by Eurocontrol research network HALA! on Higher Automation Levels in Aviation and WPE project SPAD (System Performance under Automation Degradation).


E Rigaud
email: eric.rigaud@mines-paristech.fr

E Hollnagel
email: erik.hollnagel@mines-paristech.fr

C Martinie
email: martinie@irit.fr

P Palanque
email: palanque@irit.fr

A Pasquini
email: alberto.pasquini@dblue.it

M Ragosta
email: ragosta@irit.fr

S Silvagni
email: sara.silvagni@dblue.it

M Sujan
email: m-a.sujan@warwick.ac.uk

A framework for modeling the consequences of the propagation of automation degradation: application to air traffic control systems

Keywords: Automation degradation propagation, capacity to respond, resilience, network performance, ATC, AMAN I

 we have proposed a synergistic approach integrating these two views for describing the evolution of system performances under automation degradation. In the current paper we propose a more global approach encompassing the previous contribution and being specifically addressing the representation of consequences flowing from the occurrence of automation degradation. In this approach, four modelling levels of consequences are studied: direct consequences of automation propagation, consequences on the capacity to respond, consequences on resilience capacity and consequences on network performance. This stepwise refinement aims at acquiring and modelling additional information needed for being able to assess the consequences of automation degradation. The approach is exemplified on a case study in the domain of Air Traffic Management and more precisely Terminal Manoeuvre Area including an Arrival Manager (AMAN). Due to space constraints only the first level is fully presented.

INTRODUCTION

The aim of this paper is to describe a first prototype of a modelling framework allowing the definition of various consequences of automation degradation propagation in a complex socio-technical network.

Objective of the modelling framework is to extend classical risk assessment modelling methods with the integration of four dimensions: human adaptation capacity, unwanted situations respond capacity, resilience capacity and network. Results of the framework aims to be used during automation development phases or during deployment phases.

Paper is structured in three parts. The first part discusses automation degradation propagation in complex networks. The second part presents the modelling framework. The last part describes first result of the application of the first phases of the framework to the modelling of the Arrival Manager (AMAN) system.

II. AUTOMATION DEGRADATION PROPAGATION IN COMPLEX NETWORKS

The objective of the study is to define and develop a method aiming to support the design of a model of automation propagation in a network-based system. The purpose of this model is to support the identification of a set of consequences due to the occurrence of a failure mode of a specific automation on various conditions. The modelling context is based on a network-based approach. A network is defined as a set of nodes interconnected by flows [START_REF] Mitchell | Complexity a guided tour[END_REF].

Different types of flows are considered. Flow can be physical, informational, logical, etc. In the context of ATC the main flow is aircrafts. Other flows are information exchange between nodes and aircraft responsibility transfer from one supervision entity to another. Two types of nodes are considered. The first type is container nodes which contain the entities that constitute the flows of the network. In the context of ATC, airports and sectors can be considered as container nodes for flight flows. The second type of nodes is defined as supervision nodes. They are associated to one or several container nodes, and control the flows and react to unwanted situations before they affect the performance of the system. In the context of ATC, Tower (TWR), Terminal Manoeuvre Area (TMA) and ACC sectors can be considered as supervision nodes.

Container nodes are characterized by a capacity of flow entities they can contain and some actions that can be performed: entering, exiting, moving, etc. Supervision nodes are characterized by a set of responsibilities and a set of resources to perform them. Responsibilities are related to a set of obligations to respond to a set of situations arising with different frequency and to potential sources of perturbations. In the context of ATC, ACC nodes for example have to respond to events such as the distance between two flights below the minimum; a flight being delayed related to its schedule or a flight being short of fuel. Resources dedicated responses to the different types of situations can be operators such as Executive and Planner, and they can be automation such as radar, AMAN, etc.

The purpose of the modelling method is to represent the consequences of the failure of an automated system, how they propagate in the ATC system, and the different types of consequences on the nodes and the flows in the wider system.

Model is structured with four modelling levels aiming to model different dimensions of Large Scale Socio -Technical systems and associated consequences of automation degradation (cf. figure 1.). The first modelling level is related to automation degradation impacts on operator's performances. Level 1 consequences are the variability of actions performed by operators with the support of automation and the variability of operators human factors.

The second modelling level is related to operator's capacity of respond to unwanted situations under their responsibilities. Level 2 consequences are impacts of level 1consequences variability on operators respond actions, on the consequences of the evolution of the unwanted situation and on operator's human factors.

The third modelling level is related to node resilience capacity, that is to say the capacity of respond to regular, irregular and without precedent unwanted situations under their responsibilities. Level 3 consequences are impacts of level 2 consequences variability on operators respond actions, on the consequences of the evolution of the unwanted situations and on operators human factors.

The fourth modelling level is related to network node resilience capacity. Level 4 consequences are impacts of level 3 consequences variability on resilience performance of network nodes interconnected with the node studied.

In order to structure automation degradation propagation consequences model, a generic propagation model is defined.

The generic propagation model aims to structure the representation of event susceptible to impacts the performance of systems and the propagation of their consequences. This generic model is applied to the four modelling levels in order to produce a generic automation degradation propagation model. This model will be the basement of the definition of SPAD modelling methodology. Next sections are dedicated to the presentation of this model.

A. Propagation of automation deradation on operators performances

The first level aims modelling automation degradation modes and their consequences on operator's behaviour.

In this level, initial events are related to automation degradation modes. It can be partial or total realisation of function usually performed by automation [START_REF] Parasuraman | A model for Types and Levels of Human Interaction with Automation[END_REF] (information acquisition, information analysis, decision and action selection, action implementation, etc.). Targets are related to operator's behaviours, which directly interact with automation in order achieving tasks. Behaviours can be defines with a set of adaptive modes related to operator's reaction to the variability of his context of action. Environment dimensions are related to factors that can affect operator's performances. It can be human related factors (stress, focus of attention, umber of task to be performed, etc.) or be related to context of action (work

B. Propagation of level 1 consequences on capacity to respond

The second level aims modelling automation degradation level 1 consequences impact on associated respond capacity performance.

The capacity to respond can be decomposed into five processes [START_REF] Hollnagel | Resilience Engineering in Practice[END_REF]:

 Detect that something has happened,  Identify the event,

 Recognize that the situation requires a response,  Define the response,  Mobilize resources in order to respond.

The ability to respond can be influenced by several factors. Four factors can be considered related to the balance between elements required by the nature and the state of the event to be controlled and elements available:

 Time available versus time required.

 Resources available versus resources required.

 Competences available versus competences required.

 Information available versus information required.

The balance between elements required and elements available has an influence on different dimensions such as duration or precision of the response or the operator's capacities. The consequences of variability of those dimensions influence the life cycle of events to be controlled and associated consequences. If the correct response is not performed events may trigger unwanted consequences, and require other elements to be controlled.

In this level, initial events are related to Level 1 consequences. Targets are related to respond capacity performance variability factors. It can be time, resources, competences or information. Environment dimensions are related to factors that can affect operator's performances and situations to be responded consequences. Consequences are related to the variability of the performance of respond functions, to the variability of consequences of the situation to be controlled and the variability of operator's human factors. Following table present a summary of the model (cf. TABLE II. ).

C. Propagation of level 2 consequences on node resilience performance

The third level aims modelling automation degradation level 2 consequences impact on node resilience performance.

Node resilience performance can be define as the intrinsic ability "to adjust its functioning prior to, during, or following changes and disturbances, so that it can sustain required operations under both expected and unexpected conditions" [START_REF] Hollnagel | Resilience Engineering in Practice[END_REF].

Four major capabilities determine node resilience performance: ability to respond to both expected and unexpected events; ability to learn for unexpected situations to understand what can go wrong and for expected situation to understand what makes the system go right; ability to monitor the performance of the system in considering both lagging and leading indicators; ability to anticipate threats and opportunities that can be consequence of changes occurring in the system and it's environment [START_REF] Hollnagel | Resilience Engineering in Practice[END_REF].

In order to characterize node resilience, the focus is on the capacity to respond. The node resilience model is structured in three complementary respond capacities related to the different types of situation that can occur [START_REF] Westrum | A typology of resilience situations[END_REF]:

 Capacity to respond to normal events. Normal events are situations related to the normal functioning of the system. Respond functions are based on the application of procedures, on behaviours learned during training sessions and on resources that are regularly checked.  Capacity to respond to regular unexpected events.

Regular unexpected events are unwanted situations that have been anticipated by risk management systems, and for which prevention and protection barriers have been deployed. Respond functions are based on the application of procedures, on behaviours learned during training sessions and on resources that are regularly checked.

 Capacity to respond to irregular unexpected events. Irregular unexpected events are unwanted situations that are known by the system, but where no adequate barriers exist to prevent and protect the system against them. Respond functions are based on the ability of operators to adjust their behaviour according to the requirements of the situation, their knowledge and available resources.

Level 3 is related to the study of impact of respond function that use studied automation variability on respond capacities to other situation that have to be controlled by the node. Initial events are related to Level 2 consequences. Targets are related to the other nodes respond capacities performance variability factors. Environment dimensions are related to factors that can affect operator's performances and situations to be responded consequences. Consequences are related to the variability of the performance of all the respond functions, to the variability of consequences of all situations to be controlled and the variability of operator's human factors. Following table present a summary of the model (cf. TABLE III. ).

D. Propagation of level 3 consequences on nodes resilience performance

The fourth level aims modelling automation degradation level 3 consequences impact on resilience performance of nodes interconnected with the node studied.

The propagation of consequences depends on the nature of the interactions between the different nodes. Related to the modelling context, three types of relations can be considered: Node interdependencies can be defined, among others, along several dimensions [START_REF] Rinaldi | Identifying, Understanding and Analyzing Critical Infrastructure Interdepencies[END_REF]:

 Infrastructure characteristics: spatial, temporal, operational and/or organizational.  Type of interdependencies: physical, cyber, logical, geographic.  Coupling and response behaviour: loose/tight, linear/complex, adaptive, and inflexible.

Initial events are related to Level 3 consequences. Targets are related to the resilience performance of all the nodes interconnected with the studied node. Environment dimensions are related to factors that can affect nodes resilience performance. Consequences are related to the variability of the resilience performance of concerned node, to the variability of consequences of all situations to be controlled and the variability of container nodes (cf. Those four levels will be the basis of the definition of a modelling framework.

III. MODELING FRAMEWORK

Model presented in the previous section aims to be the basement of the definition of a modelling method allowing automation degradation consequences analysis. This objective requires an interdisciplinary approach. The approach followed is based on the idea of federation of models. Different models related to specific dimensions of each level of analysis are interconnected by the means of a generic method. This section aims to describe the modelling framework developed (see Figure 2). This development is based on the Functional Resonance Analysis Method (FRAM) framework [START_REF] Martinie | Using Complementary Models-Based Approaches for Representing and Analysing ATM Systems' Variability[END_REF][7] [START_REF] Hollnagel | FRAM: The Functional Resonance Analysis Method: Modelling Complex Socio-technical Systems[END_REF]. FRAM is a functional-based modelling approach that aims to represent the dynamics of systems taking into account different dimensions of endogenous, exogenous and functional interdependences that may influence the performance of functions.

The method is structured with three generic phases: Following sections are related to the description of the adaptation of those three steps to the four modelling levels considered. Method phases are illustrated with information related to the study of AMAN. Arrival Manager (AMAN) is a ground based planning tool suggesting to the air traffic controller an arrival sequence of aircraft and providing support in establishing the optimal aircraft approach routes.

A. Modeling the direct consequences of automation degradation

The first level aims to support the modelling of the direct consequences of automation degradation on operator's performances.

1) Context definition

The first phase of the method aims defining the modelling context. Level 1 context is related to information about automation, operators and the environment.

Automation is described with its name, functions performed, level of automation and functioning modes including degradation modes. Operator is described with a title, functions performed with the support of studied automation, endogenous variability factors and adaptive modes. Environment is described with a set of dimensions characterized with a label and a scale of variability.

The following table illustrated this context in the case of study of AMAN. Context will be use to define FRAM functions and coupling relationships.

2) Function definition

The second phase of the modelling method is related to the definition of FRAM based functions that constitute the model. The structure of the model depends on the level of automation of the system studied.

If the level of automation is autonomous, the model will be constituted of only one set of functions related to the automation functions. If the level is semi-autonomous, the model will be constituted of both automation and operator functions.

Definition of the function is realised by defining FRAM aspects (input, output, precondition, resources, time and control) for each function performed by automation and operators.

In the context of AMAN study, two functions are considerate: "Compute and display Sequence List" and "Compute and Display advisories". Two human functions are considerate. First is a function of the sequence manager: "Control adequacy between sequence list and current situation ". Second is a function of the executive: "Control adequacy between flight's planned trajectory and flight actual trajectory".

The following table presents information related to a function that has to be defined. Elements are illustrated with one of AMAN case study function. Same work as to be achieved to both automation and operators relevant functions.

3) Propagation model definiton

The third phase consist in defining propagation model by linking each function and characterizing their variability model. A relation between automation degradation modes, operators' variability (if the level of automation is semiautonomous), environment variability and variability of the outputs of the functions is defined.

Automation functions variability model is related to the relation between degradation modes and automation functions outputs. Automation functions state model is related to the different degradation modes identified. For each degradation modes, a value is associated to the different output of the functions. Following table describes this relation for one of AMAN functions.

AMAN functions variability model

Functioning modes Output values

Normal functioning

Information availlability (YES) Information precision (RIGHT) Information computing delay (Optimum)

Malfunctioning

Information availlability (NO) Information precision (-) Information computing delay (-)

Misleading information

Information availlability (YES) Information precision (FALSE) Information computing delay (Optimum)

Operator's functions variability model is related to the relation between performance context, adaptive mode and functions outputs.

Depending of the values of the different dimension of variability related to the operator, the environment and the coupling relation in particular coupling with automation functions an adaptive mode is selected. Following tables describes this relation for AMAN operator's functions. First one is related to the list of dimension of variability taken in account.

TABLE VIII. FRAM BASED DIMENSION OF VARIABILITY LIST OF AMAN OPERATOR'S FUNCTIONS

Dimension of variability

Endogenous dimension of variability

Habit to AMAN

[High [START_REF] Martinie | Structuring and Composition Mechanism to Address Scalability Issues in Task Models[END_REF], Medium(

Exogenous dimension of variability

Working conditions [High [START_REF] Martinie | Structuring and Composition Mechanism to Address Scalability Issues in Task Models[END_REF], Medium [START_REF] Rinaldi | Identifying, Understanding and Analyzing Critical Infrastructure Interdepencies[END_REF], Low] Complexity of traffic [High [START_REF] Martinie | Structuring and Composition Mechanism to Address Scalability Issues in Task Models[END_REF], Medium [START_REF] Rinaldi | Identifying, Understanding and Analyzing Critical Infrastructure Interdepencies[END_REF], Low] Amount of traffic [High [START_REF] Martinie | Structuring and Composition Mechanism to Address Scalability Issues in Task Models[END_REF], Medium [START_REF] Rinaldi | Identifying, Understanding and Analyzing Critical Infrastructure Interdepencies[END_REF], Low]

Coupling dimension of variability

AMAN Information Availlability [Yes, No] AMAN Information precision [Right, False]
The second table is related to the relation between dimensions of variability average value and operator adaptation mode. With the application of the relationships described with those three tables, automation degradation modes and environment are linked to operator's behaviors. This model will be the basement of the level 2 modelling activities.

B. Modeling Automation degradation consequences on the capacity to respond

The second level aims to support modelling of the propagation of the variability of level 1 model to the capacity of respond using the automation studied.

1) Step 1. Description of the capacity to respond context

The first phase is related to the definition of the capacity to respond context. This context is related to unwanted situation to be responded and respond capacity associated. Unwanted situation to be responded is described with its name, a set of states related to its evolution, and for each states a performance profile (time required, resources required, competences required and knowledge required) required to keep the control of the situation.

Respond capacity is described with its name, description of the different functions (detect, identify, recognize, define respond and respond) and a set of respond modes related to the balance between performance profile required and performance profile available.

2) Step 2. Level 2 function definition.

Based on the context description, the level 1 functional model is extended to consider the respond capacity processes and functions related to the events associated with the respond function.

A set of function is associated to the capacity of respond and coupled with Level 1 model. Two situations can occur. The first one, automation studied support partially or totally the respond capacity. The second one, automation studied is related to the situation to be responded. In the first case, respond function is split in order to consider level 1 functions. In the second case, one function related to the capacity of respond is considered and linked to the Level 1 model.

3) Step 3 Propagation model definiton.

Propagation model definition is realized with defining relationships between dimensions of variability (endogenous, exogenous and coupling) of respond function and four respond modes:

 Strategic. Situations where the system as a time horizon and can look ahead at higher-level goals.  Tactical. Situations where performance more or less follows a known procedure or a rule.  Opportunistic. Situations where the salient features of the current context determine the next action  Scrambled. Situations where the choice of next action is basically random This relation is defining by considering relations between available and required dimensions: resources, time, information and competences. The following rules are used to define the relationships:

 In strategic control mode, dimensions required to perform functions is much superior to available dimensions  In tactical control mode, dimensions required to perform functions is just superior to available dimensions  In opportunistic control mode, dimensions required to perform functions is inferior to available dimensions  In scrambled control mode, dimension required to perform functions is much inferior to available dimension.

Then relationships between respond modes and respond functions output a characteristic is defined. This model is used as a starting point for the definition of a model of level 3.

C. Modelling Automation degradation consequences on node resilience capacity

The third level aims to support modelling propagation of the variability of model of level 2 to the node resilience capacity.

1) Step 1. Resilience capacity description.

This first phase is related to the description of the information about the node resilience capacity. Information is related to the different events that the node have to deal with and respond function associated. Events are considering related to the following typology: normal events, regular unexpected events and irregular unexpected events. For each event consequences of an inadequate response (in time or in precision) are defined.

2) Step 2. Level 3 function definition.

Based on the description provided, model of level 2 is extended in considering the respond functions associated to the other events. Attention have to be made in the different coupling relation between the different respond capacity functions in order to model the interdependence between them (share of operators and/or resources, delay, priorities, etc.).

3) Step 3. Level 3 function variability model definition.

A FRAM based variability model of the level 3 functions is defined. Level 2 variability model definition step is applied to the several respond functions that constitute the model. Once this method is applied, a FRAM model at level 3 is produced. This model can be used as a starting point for the definition of a model of level 4.

D. Modelling Automation degradation consequences on network performance

The fourth level aims to support modelling propagation of the variability of model of level 3 to the network performance.

1) Step 1. Network structure performance description.

This first phase is related to the description of network structure and performance. For each node that constitutes the network key performance indicators are defined. For each type of links between nodes (physical, cyber, geographic, etc.) a description is also provided.

2) Step 2. Level 4 function definition.

Based on the description provided, model of level 3 is extended in considering the functions and performance indicators of the nodes and the several links of connection.

3) Step 3. Level 4 function variability model definition.

A FRAM based variability model of the level 4 functions is defined. A relation between variability of node inputs, node performance model, and nodes output and environment variability is defined based on the variability model of level 3.

IV. CONCLUSION

The overall objective of the ongoing work presented in this paper is to define an overall design framework of automation degradation propagation in complex networks, and an associated method supporting the framework in order to study automation and more precisely automation degradation. A four steps process has been presented in the current paper focusing on the modelling of consequences flowing from automation degradation. We have exemplified this process on a case study in the domain of Air Traffic Management showing how the refinement is performed and how additional information gathered is modelled. We also presented how automation degradation propagates and how information related to consequences is gathered and modelled in the context of that case study.

The next phases of the research work is related to the application of the other phases of the method to the AMAN case study in order to consolidate and to improve the method, and to be able to apply it to another case study in the area of RPAS (Remotely Piloted Aircraft Systems). The application of the process on these two case studies will allow us to confront the method and its associated framework to applications featuring different levels of automations according to Sheridan et al. classification [START_REF] Sheridan | Human and computer control of undersea teleoperators[END_REF].

Figure 1 .

 1 Figure 1. Automation degradation consequences analysis modelling level.



  Context definition. The first phase consists in defining the different elements that structure the context of the model: initial events, impacts, environment and consequences.  Functions definition. The second phase consists in describing functions that constitute the model. For each function, global variables (environment and system properties), aspects (Input, Output, Control, Resources, Time and preconditions) and performance modes are described.  Propagation model definition. The third phase is related to the definition of the coupling relations between functions allowing the definition of the propagation mechanisms.

Figure 2 .

 2 Figure 2. A process for modelling automation degradation propagation consequences

Level 1

 1 context definition Automation AMAN automation is decision and action selection type automation. It acquires information about traffic, infers the ideal arrival sequence and generates advisories if the gap between flight ideal and actual position is superior to accepted margin. AMAN functioning modes considerated are : -AMAN normal functioning. AMAN compute and display right information in a reasonable delay. -AMAN malfunction. AMAN stops working. -AMAN provides misleading information. AMAN display wrong information. AMAN is semi-autonomous, two operators interact with it, Sequence Managers who supervise sequence list and eventually correct it and Executive who send clearances to flight according to information provided by AMAN. Operators Executive operators aims managing the flow of traffic in their sectors with respect of sequence list. Sequence Manager aims managing sequence list. Endogeneous dimensions of varibaility considered are training, workload, stress, focus of attention, number of tasks ans habit to AMAN. Adaptive modes considered are: optimum; average and degraded. Environment Working conditions Complexity of traffic Amount of traffic

  [START_REF] Martinie | Structuring and Composition Mechanism to Address Scalability Issues in Task Models[END_REF], Medium[START_REF] Rinaldi | Identifying, Understanding and Analyzing Critical Infrastructure Interdepencies[END_REF], Low] Focus of attention [High[START_REF] Martinie | Structuring and Composition Mechanism to Address Scalability Issues in Task Models[END_REF], Medium(5), Low] Number of tasks [High[START_REF] Martinie | Structuring and Composition Mechanism to Address Scalability Issues in Task Models[END_REF], Medium[START_REF] Rinaldi | Identifying, Understanding and Analyzing Critical Infrastructure Interdepencies[END_REF], Low]

TABLE II

 II

	.	ADAPTATION OF PROPAGATION MODEL TO LEVEL 2
		MODELLING LEVEL
		Respond level propagation model
	Initial event	Precision and duration of the execution of both
		automation and operators functions
		Operators human factors
	Targets	Respond capacity performance variability factors
	Environment	Endogenous and exogenous factors influencing
		operators and situation to be respond variability.
		Area of responsibility of operators
	Consequences	Respond action consequences
		Situation to be respond consequences
		Operators human factors

TABLE III

 III

	.	ADAPTATION OF PROPAGATION MODEL TO LEVEL 3
		MODELLING LEVEL
		Resilience level propagation model
	Initial event	Operator variability
		Respond capacity variability
	Targets	Regular and irregular situations respond capacity
		performance
	Environment	Endogenous and exogenous factors influencing
		operators and regular and irregular situations
		respond situations to be respond variability.
		Area of responsibility of operators
	Consequences	Situations to be respond consequences
		Operators human factors
		Environment state

  TABLE IV. TABLE III. ).

TABLE IV .

 IV ADAPTATION OF PROPAGATION MODEL TO LEVEL 4

		MODELLING LEVEL
		LSSTS level propagation model
	Initial event	Node resilience performance variability
	Targets	Interconnected nodes resilience performance
	Environment	Environment variability
		Nodes responsibilities area zone
	Consequences	Node resilience performance
		Situations to be respond consequences
		Container node variability

TABLE V .

 V

LEVEL 1 CONTEXT DEFINITION OF AMAN CASE STUDY

TABLE VI .

 VI FRAM DESCRIPTION OF " CONTROL ADEQUACY BETWEEN FLIGHT PLANNED TRAJECTORY AND FLIGHT ACTUAL TRAJECTORY "

	Control adequacy between flight planned trajectory and
		flight actual trajectory
		Executive monitor AMAN in order
	Description	to identify if needed manoeuvre to
		be cleared to pilot
	Aspects
	Input(s)	AMAN Advisories displayed
	Output(s)	Difference identified Maneuver to be cleared defined
	Precondition	Traffic in an advanced state
	Resource(s)	AMAN, CWP, EXC_TMA
	Control(s)	Procedures
	Time

TABLE VII .

 VII FRAM BASED VARIABILITY MODEL OF AMAN FUNCTIONS

TABLE IX .

 IX FRAM BASED RELATION BETWEEN DIMENSION OF VARIABILITY VALUES AND ADAPTIVE MODES OF AMAN OPERATOR'S FUNCTION

AMAN functions variability model Adaptive modes Dimension on variability values

		Average (Endogeneous) == 10 AND
		Average (Exogenous) == 10 AND
	Optimum	AMAN information availlability == Yes
		AND
		AMAN information precision == Right
		Average (Endogeneous) >= 5 AND
		Average (Exogenous) >= 5 AND
	Average	AMAN information availlability == Yes
		AND
		AMAN information precision == Right
		AMAN information availlability == No
	Degraded	OR
		AMAN information precision == False
	The third table is related to the relation between adaptive
	modes with values of function outputs.

TABLE X

 X

	.	FRAM BASED RELATION BETWEEN DIMENSION OF
	VARIABILITY VALUES AND ADAPTIVE MODES OF AMAN OPERATOR'S FUNCTION
		AMAN functions variability model
	Adaptive modes	Output values
	Optimum	Precision (Optimum) Delay (Optimum)
	Average		Precision (Average) Delay (Average)
	Degraded	Precision (False) Delay (Late)

ACKNOWLEDGMENT

This work is partly funded by Eurocontrol research network HALA! on Higher Automation Levels in Aviation and SESAR Work Package E, which is addressing long-term and innovative research.