Automation transparency and the design of intelligent aircraft engine interfaces

In this article we report progress on a programme of research to implement intelligent engine systems in civil aircraft. Modern turbofan engines capture data about their performance and health during flight. Until now, this information has remained hidden from the flight deck. Our research will examine how best to communicate these new information sources to the flight deck to deliver intelligent assistance in understanding engine health and offering choices to minimise disruption should an engine develop a fault that affects performance. We have adopted automation transparency as a key design pillar to ensure that flight crew have an appropriate understanding of the reasoning of the intelligent system under different operating conditions. User-centred design will inform the degree to which the different interface elements are transparent, informing the balance between the provision of information necessary to ensure safe and efficient performance. Currently, there is significant uncertainty as to whether automation transparency can confer a performance advantage in all cases. Our research will empirically investigate different levels of automation transparency to validate performance.


INTRODUCTION
Modern turbofan engines capture large amounts of data about their operation during flight. These data can then be used by the engine manufacturer for monitoring and early problem detection. Indeed, Rolls-Royce offer a product * whereby the airline buys thrust rather than the engine itself. Rolls-Royce monitor global engine performance identifying problems early, often before they become visible to the flight deck itself, or affect the operation of the engine. Under this model disruption in the form of failure or diversion (etc.) needs to be minimised without impact on the safety of the operation. In the future, these sources of engine data could provide flight crew with valuable information to support decision making (Asmayawati & Nixon, 2020).
Currently, there is a paradox: the engines know more about themselves than the people on the flight deck controlling them. This demonstrates the reliability and safety of the technology, and begs the question whether this currently hidden * www.rolls-royce.com/media/ourstories/discover/2017/totalcare.aspx information could be of use to the flight deck? Potential application of this knowledge could support environmentally friendly flight profiles or minimise disruption during failure. This new style of operation would require the design of new interaction to embed the intelligent engine system in the flight deck to support flight crew. Currently, flight crew will tend to shut down a misbehaving engine, but this is not always the best course of action (Asmayawati & Nixon, 2020). Stationery engines produce drag during flight, increasing fuel consumption and complete shutdown may not be in the engine's interest. We are aware of cases where maintaining reduced thrust would be better for the engine, maintain system redundancy (for example, air conditioning, power hydraulics) and minimise disruption to passengers and airlines alike. Currently engine displays do not support these fine-grained decisions, and in any case flight crew should not be expected to suddenly become gas-turbine engineers during flight. Carefully designed intelligent engine displays could maximise benefits to the operation and allow a greater range of options to flight crew using artificial intelligence to assist the flight crew to make effective decisions, preserving safety and minimising disruption. In addition, the very real prospect of single-pilot operations means that intelligent engine displays may become more important to manage the limited cognitive resources of a lone, airborne pilot.

THE PRESENT
Present engine indications show visible lineage to past ways of operating. With the introduction of Full Authority Digital Engine Control (FADEC) † in the 1960s, engines have tended to look after themselves. Thrust is demanded by the aircrew or, by the aircraft itself using the autothrust/ autothrottle system. Flight crew monitor engine health and performance during the flight. The removal of the independent flight engineer role and the associated panel ( Figure 1) have meant that automated systems such as FADEC look after most aspects of the engine and related systems during flight. Today the flight deck have access to a set of indicators that reflect the engine's status in response to thrust demands from either the autopilot of the manually from the flight deck ( Figure 2). The presentation style of the information has evolved with the introduction of the glass cockpit, but in essence the parameters shown: temperature, percentage RPM, fluid status (etc.) remain the same to this day.

THE FUTURE?
Designing displays and interaction that can support a wider range of decisions by flight crew is, on the face of it, a sensible evolution of the current operational model. However, we must pause for thought. Automation in aviation has progressed with evolving understanding of the benefits and problems of its implementation (Endsley, 2017;Kaber & Endsley, 2004;Pritchett et al., 2014). Cursory attention to the fatal accident statistics ‡ shows that increased automation has provided significant benefits to flight safety over time, but worrying accidents have occurred when the flight deck is either fighting the automation or does not understand the behaviour of the system. This is particularly the case when the flightdeck is presented with atypical indications at variance with highly trained procedures (Clewley & Nixon, 2019. Intelligent systems have the power to better inform exactly these scenarios so long as the interaction between the people and the system is appropriate and understandable given the task. To guide our development of the design of new intelligent aircraft engine displays that exploit new data we will adopt automation transparency as a key design pillar to guide implementation of increasing intelligence in the system.

AUTOMATION TRANSPARENCY
Automation transparency is a concept in user interface design that is of particular significance when artificial intelligence is used to inform and guide user behaviour. A transparent interface ‡ www.boeing.com/resources/boeingdotcom/compa ny/about_bca/pdf/statsum.pdf would offer insight into system reasoning making an intelligent system more understandable to the operator (Rajabiyazdi & Jamieson, 2020;Skraaning & Jamieson, 2021;van de Merwe et al., 2022). Interface choices need to be made since along this continuum there exists the risk of providing either too little or too much information to support the specific task (Endsley, 2017). Automation transparency may confer performance benefits, and is of interest in this application of evolving engine management into an intelligent system. Along a continuum, system behaviour can range from opaque to transparent. Chen et al.

THE CURRENT RESESARCH PROGRAMME
In our current programme of research with Rolls-Royce, we structure a methodology to design intelligent engine interfaces using the SAT model. For example, two candidate interfaces are shown in Figures 3 and 4. In Figure 3, a status interface is shown. This interface is designed to support monitoring. A synoptic representation of both engines is shown together with key parameters. In the configuration shown here, pilots can see that engine health is normal since no annotations or alerts are offered as part of the display in this example. Pilots can also see key engine parameters such as thrust balance shown as a bar at the bottom of the interface, temperature and the phase of flight indicated at the top as take-off: TO. Problems with one or both engines would be indicated on this screen and their location on the synoptic display would be communicated. In addition, any automated activity, for example engine ignition active, would be displayed on this part of the interface. This interface would correspond to level 1 of the SAT model. No system reasoning is shown to the flight deck, only the current system status that includes key parameters. The second interface shown in Figure  4 represents a potential flight profile. This interface is designed to support planning. This interface shows a flight profile corresponding to a flight from Boston, Logan to London Heathrow. The diamonds indicate waypoints across the flight and the circle indicates the current position of the flight in terms of elapsed time and altitude. This interface would be used for planning purposes in the event of problems with the engine. Aircrew can view different profiles according to different diversion airports that are presented as a product of the system reasoning. This reasoning may take into account availability, weather or the ability of the aircraft to fly the profile given the failure. The target profile is shown together with searchable information for each waypoint and the basic engine indications are shown at the bottom of the display.
To the right, current information about the destination airport (London Heathrow, EGKK) is shown. Alternatives could be selected from the white tabs below and the appropriate flight profile and airport availability would be shown. Birmingham, Gatwick and Manchester are listed. In this case, information corresponds to level 3 of the SAT model since the intelligent system is projecting a likely outcome and giving related information about alternative courses of action. Part of the current project is to establish the extent to which system reasoning is displayed and made known to the flight crew. As with the Endsley model, we do not regard one level of SAT as prerequisite for another (Endsley, 2015). Application of the model is an evolving process and we remain open minded as to the success of its application and the impact on safety and performance.

CONCLUDING REMARKS
There is debate within the scientific community as to whether automation transparency can provide performance benefits or improve trust in such systems (van de Merwe et al., 2022). It is not the case that for all tasks an increased level of automation transparency leads to better performance or trust. User-centred design and testing will allow us to gather data on this aspect of the design. Our programme of research will test hypotheses related to transparency and variables of interest include not only performance and workload measures but also user trust. As the intelligent system takes on a more active role: suggesting courses of action or assisting flight-crew decision making, it is critical to understand how to design interfaces to support these new types of intelligent interaction to improve safety and efficiency in aviation operations.