Ecological Interface Design for Fault Diagnosis of Automated Advice in ATC

emerging Updated: 2026-06-10
air-traffic-control ecological-interface-design supervisory-control automation-transparency fault-diagnosis decision-support solution-space-diagram means-ends human-automation-teaming remote-operations

Ecological Interface Design for Fault Diagnosis of Automated Advice in ATC

Status: emerging
Last updated: 2026-06-10
Sources: S10111 017 0438 Y.Pdf
Tags: [air-traffic-control, ecological-interface-design, supervisory-control, automation-transparency, fault-diagnosis, decision-support, solution-space-diagram, means-ends, human-automation-teaming, remote-operations]

Summary

Future air traffic control will lean on automation that generates conflict-resolution advice from data such as ADS-B, but that data is not always reliable, so a human must judge when machine advice rests on a faulty sensor. Borst et al. (2017) tested whether an ecological interface — the solution space diagram (SSD), augmented with explicit "means-ends" links between the radar display and the functional display — helps controllers diagnose such failures. In a human-in-the-loop simulation, the explicit links significantly improved fault detection and diagnosis under high traffic complexity. The same links, however, also led participants to take control away from the automation regardless of whether a fault was present, exposing a tension between giving operators more insight and securing their compliance with a single machine recommendation. The study is the ecological-interface counterpart to this knowledge base's other work on keeping supervisory operators able to detect and correct automation error.

Body

Context

Borst, Bijsterbosch, van Paassen and Mulder (2017) report a medium-fidelity ATC simulation in which controllers monitored an automated conflict detection and resolution (CD&R) system and intervened when its advice looked wrong. The lens is ecological interface design (EID), the framework introduced by Vicente and Rasmussen (1992) that maps the constraints of a work domain — organised as an abstraction hierarchy of "means-ends" relations — directly onto the interface so operators can reason at skill-, rule- and knowledge-based levels (PDF p. 2, orig. p. 546). The study's specific concern is supervisory control under data ambiguity: the automation mixed reliable radar data with potentially faulty ADS-B data, and the question was whether making the means-ends relations explicit would help operators "see through" a sensor failure hidden in the machine's advice (PDF pp. 1–2, orig. pp. 545–546). Within this knowledge base the article is the ecological-interface anchor for the recurring theme that a supervisory operator must stay able to catch and correct automation error. It complements the ATC monitoring study in Active Control Vs Passive Monitoring Atc, the automation-misuse account in Use Misuse Disuse Abuse Of Automation, and the maritime treatment of out-of-the-loop performance and transparency in Human In The Loop Automation Transparency.

Key Points

The interface and the task. The prototype ecological interface is the solution space diagram (SSD), a display for tactical conflict detection and resolution in the horizontal plane that shows which speed and heading changes are conflict-free given the surrounding traffic. The experimental manipulation added explicit, amplified means-ends links between aircraft on the radar plan-view display (sourced from radar data) and their functional representation in the SSD (sourced from ADS-B data); when the two sources disagreed, an in-trail position offset in the ADS-B report distorted the SSD geometry, which a controller could in principle read as a sensor failure (PDF pp. 2–4, orig. pp. 546–548). The automation ran at a Management-by-Exception level: a scripted advisory was implemented automatically unless the participant vetoed it (PDF p. 9, orig. p. 553).

Design and hypotheses. Sixteen participants (aged 22–47, average 27) took part, split between-subjects into a means-ends "On" group and an "Off" group of eight each, with explicit links as a between-participant variable to prevent the manipulation from confounding within a single person. Each participant ran both a low- and a high-complexity scenario (structured versus unstructured traffic flows), with no-fault and fault conditions and a fixed schedule of correct and incorrect advisories delivered identically to every participant (PDF pp. 7–8, orig. pp. 551–552). The hypothesis was that explicit means-ends links would make fault detection and supervisory control more efficient and effective, with the benefit most pronounced under high complexity (PDF p. 9, orig. p. 553).

What the links helped — and what they did not. Successful sensor-failure diagnosis was scored from think-aloud verbal comments, counted when a participant located the single failing aircraft and could explain the nature of the failure. Kruskal–Wallis tests found a significant main effect of explicit means-ends links only in the high complexity condition (H(1) = 4.01, p = 0.046), confirming the central hypothesis for the hardest scenario (PDF p. 11, orig. p. 555). The benefit did not, however, show up in advisory acceptance or rejection counts: the means-ends group diagnosed more failures yet did not reject correspondingly more faulty advice, which the authors read as evidence that interaction with the advisory system is a poor proxy for fault-detection performance (PDF p. 11, orig. p. 555). Most other measures were inconclusive or ran counter to the hypotheses, partly because of the small sample and large between-participant variability that ecological interfaces are expected to produce, since they prescribe no single course of action (PDF p. 12, orig. p. 556).

The unexpected interaction pattern. The explicit means-ends links changed participants' control strategy rather than just their diagnostic accuracy. Several participants in the means-ends group were more active than anticipated, using the links to elicit more ways of solving a conflict (for example issuing more speed clearances) and working around the automation's limitations — a pattern geared toward taking over control from the automation regardless of whether a fault was present (PDF p. 12, orig. p. 556). The authors attribute this partly to a supervisory context in which decision authority shifts to the computer and is not always well received (citing Bekier et al., 2012), and partly to the SSD itself, which by revealing all feasible actions invites disagreement with advice that pushes one specific solution (PDF p. 12, orig. p. 556).

Conclusion

Borst et al. (2017) conclude that an ecological interface with explicit means-ends relations did improve fault diagnosis of automated advice in the demanding high-complexity scenario, supporting the case for constraint-based displays as a route to automation transparency. The same study exposes a dilemma for highly automated control environments: an interface that reveals every feasible control action helps operators judge the validity of machine advice, but it also raises the chance they will reject advice that asks them to follow one prescribed solution. The authors frame the open problem as finding the right balance between offering more insight through ecological interfaces and striving for compliance with single machine advice. For a remote or supervisory control centre the result cuts both ways: transparency aids error detection, but it can also pull an actively engaged operator into overriding automation that was, in fact, correct.

References

Bekier, M., Molesworth, B.R. and Williamson, A. (2012) 'Tipping point: The narrow path between automation acceptance and rejection in air traffic management', Safety Science, 50(2), pp. 259–265. doi: 10.1016/j.ssci.2011.08.059. To be validated.

Borst, C., Bijsterbosch, V.A., van Paassen, M.M. and Mulder, M. (2017) 'Ecological interface design: supporting fault diagnosis of automated advice in a supervisory air traffic control task', Cognition, Technology & Work, 19(4), pp. 545–560. doi: 10.1007/s10111-017-0438-y. borst2017ecological

Borst, C., Flach, J.M. and Ellerbroek, J. (2015) 'Beyond ecological interface design: lessons from concerns and misconceptions', IEEE Transactions on Human-Machine Systems, 45(2), pp. 164–175. doi: 10.1109/THMS.2014.2364984. To be validated.

Vicente, K.J. and Rasmussen, J. (1992) 'Ecological interface design: theoretical foundations', IEEE Transactions on Systems, Man, and Cybernetics, 22(4), pp. 589–606. To be validated.

Open Questions

  • The fault-diagnosis benefit reached significance only under high complexity and with sixteen participants; whether the effect holds with larger samples and across complexity levels is unresolved.
  • The "fighting against the automation" strategy was confounded with the level of automation (Management-by-Exception) and the specific scripted advisories. How much of the override behaviour is intrinsic to ecological interfaces versus an artefact of this automation design is open.
  • The transparency-versus-compliance balance is posed as a design question but not answered: the study does not establish how to give operators full constraint information while still securing compliance with correct machine advice.
  • Only three of sixteen participants discovered the most efficient strategy for using the means-ends links, and they were not instructed in it to avoid biasing results. Whether training in link-use strategy would amplify the diagnostic benefit is untested.