1 In the context of integrating Unmanned Aircraft Systems (UAS) in non-segregated airspace, autonomous operations raise legal and ethical questions. What is the expected behaviour of a civil unmanned aircraft operating autonomously in an airspace shared with other airspace users? And how could we implement this behaviour? We present in this paper a preliminary study that allowed us, through the analysis of aviation reference documents, to identify some ethical criteria necessary to develop a first set of logical rules formalizing this expected behaviour.
The term UAS designates the global system of an aircraft (UA) and its associated elements operated with no pilot on board. Regulators currently distinguish two types of Unmanned Aircraft (UA): the Remotely-piloted aircraft (RPA) which are remotely and fully controlled from another place by a licensed remote pilot, and autonomous unmanned aircraft, that do not allow pilot intervention in the management of the flight. As the purpose of our study is not to clarify the terminology linked to autonomous aircraft or operations, we will use in this paper the unofficial acronym UAOA (Unmanned Aircraft Operating Autonomously) to designate an UA that must at time t manage its flight and make decisions without any human intervention. This definition does not exclude communication links with pilot or any other authorized personnel such as Air Traffic Service (ATS), and potential orders or requests sent by these actors.
In reference to the term roboethics, the name dronoethics is introduced to refer to an Applied Ethics dedicated to UAS.
Our study is focussed on civil autonomous operations and does not encompass specific military ethical issues, such as the acceptable loss of human life.
In the last decades, the use of Unmanned Aircraft Systems (UAS)
has significantly increased in the military domain but despite the
large variety of civil applications identified, the civil market has
not yet developed significantly, due to the inability for UAS to
access to non-segregated airspace. The need to operate military,
commercial, and privately-owned unmanned aircraft in the same
airspace as manned aircraft, especially outside segregated areas is
now considered by all regulators as a high priority [
Nowadays, UAS are generally operated in segregated areas or
with operations limited to specific airspace (e.g. temporary
restricted, low-density/unpopulated areas) and specific procedures
(e.g. low-range, visual observers on ground) [
According to ICAO, only Remotely-piloted aircraft (RPA) will
be able to integrate into the international civil aviation system in
the foreseeable future [
If we consider the new Air Traffic Management (ATM)
Concepts of operations (CONOPS) defined within current
international programmes such as SESAR [
If many technical and operational studies have dealt with
problematic like the Detect and Avoid concept to replace the See
and Avoid procedure, the legal framework linked to the
responsibility of an UAOA in case of accident is insufficient [
Could we formalize this behaviour as a set of logical rules?
Whatever the region of the world overflown, pilots are supposed to
know and apply Rules of the Air that provide rules to properly fly
and manoeuvre aircraft. Defined at regional [
During all the flight phases, the aircraft should not have behaviour potentially dangerous to persons or property. For instance, if the aircraft flies over a congested area, it should be at such height as will permit, in case of emergency, to safely land without hurting people on the ground. The main rule is that aircraft shall not be operated in such proximity to other aircraft as to create a collision hazard. Nevertheless according to the Rules of the Air, a pilot may depart from these rules in the interest of safety.
If we consider an UAOA, these simple rules are already challenging: a prerequisite is that the aircraft must know its position and be able to detect and analyze its environment before modifying its path.
When two aircraft are converging, each of them must act according to right-of-way rules: one must yield the way and the other that has the right-of-way must maintain its heading and speed. Rules have been refined according to several scenarios e.g. approaching headon, overtaking or converging but these rules have exceptions linked to the type of aircraft. Typically aircraft with less manoeuvrability has the right-of-way but this rule is superseded when an aircraft is in distress and therefore has the priority to all other traffic.
From an UAOA point of view, several conditions seem to be necessary. Firstly the aircraft must have self-awareness about its type of aircraft and its current status (Unmanned aircraft with no passengers onboard? Flight leader of a squadron of aircraft flying in formation? In a final approach? In an emergency mode?). Then knowing its type and status, the aircraft must be able to communicate this information to all other airspace users via signals or anti-collision and navigation lights. It must also identify the status of the surrounding traffic. For instance even if it is supposed to have the right-of-way, it must detect whether the convergent aircraft is landing or is in distress and in that case yield the way.
Each aircraft should comply with any instruction given by the appropriate ATS unit. Even if its flight is in line with the flight plan and the ATC orders, it should report its position when passing reporting points or periodically. And as soon as there is a deviation from the requirements, it should be communicated to air traffic services unit. To ensure this permanent interaction, the aircraft should always maintain a continuous air-ground communication, if possible with a dual channel (radio and data link). In case of failure of this communication, the aircraft must attempt to restore a communication with the appropriate ATC unit using all other available means.
In case of UAS, this could imply to maintain or try to establish the communication, to answer to potential ATS requests and to take into account these clearances in its decision-making process.
Before departure, for each aircraft flying in controlled airspace, a flight plan should have been submitted to air traffic services containing as information as possible, including the forecast route but also alternative procedures. If any potential modification can be anticipated, it must be indicated in the flight plan. During the flight, the aircraft is supposed to adhere as much as possible to the flight plan but if it fails to stick to this plan, its behaviour should still be predictable. For instance the aircraft could maintain its heading and speed when it encounters some problems and then rejoin its current flight plan route no later than the next significant point. In the same way, it could land at the nearest suitable aerodrome, easily identifiable by air traffic services.
This requirement of predictability is one of the most challenging when considering an UAOA that could make decisions based on different choices, including ATC instructions. This implies specifically that alternatives should be identified and emergent behaviours anticipated.
A predictable behaviour includes non-nominal use cases when the aircraft operates in an emergency mode. In case of a loss of communication, it could for instance maintain its speed and heading during a few minutes and try to reconnect to its ground station, before entering a new emergency phase with the choice of continuing its flight or landing at a close aerodrome. Aircraft should also be able to comply with interception rules that specify the procedures to manage the instructions given by the intercepting aircraft. Therefore an UAOA should firstly know when it is operating in emergency mode, then have a catalogue of contingency plans, communicate all its choices and finally if intercepted act accordingly with interception rules, superior to any previous order. 3.2
Rules of the Air allow identifying high level requirements defining
the rational behaviour expected from an aircraft in a shared
airspace. Nevertheless a major question in the current development
of UAS regulation is whether it can be based on these regulations
or whether UAS have substantially different characteristics that
require new regulation. According to [
If Rules of the Air are a set of rules guaranteeing a safe manned
aviation, they do not explain the fundamental values that support
these rules. And with a new airspace user that could imply the need
for a revision of these rules, the whole coherence of the system
may not be ensured. Like many industry business, the ATM world
has defined its own performance indicators to assess the
performance of the current system and to guide the development of
future ATM systems. ICAO has thus defined eleven Key
Performance Areas (KPAs) [
If we consider these ATM criteria from the UAS perspective, i.e. a new airspace user point of view, we can split these criteria in 3 groups according to the rules that can be inferred: • ATM services: as any airspace user, UAS should have right to operate in a way compatible with [access and equity, participation to the ATM community, interoperability] ATM global common good: UAS should not be operated in a way that could decrease the global performance of the ATM system according to [ATM rules], costeffectiveness (cost of ATM services, e.g. the number of the Air Traffic Controller to face a raising workload, or the integration of new tools and systems to be developed and maintained) and capacity (decrease of the global capacity linked to UAS operations e.g. the insertion in a high density approach or the activation of a reserved airspace). 3.4
ICAO expectations are not fixed moral rules: they have been
defined to answer to the 2025 expected scenario (without UAS
specificities taken into account) and may be moving in the future
[
We noted in the introduction that one of the main concepts proposed for the integration of UAS in ATM environment was that UAS, as new airspace users, should mirror the procedures applicable to manned aircraft. After this analysis of current regulations and ATM expectations, we decided to transcend this first statement and envisage an UAS behaviour different from the manned aviation behaviour and in the same time acceptable for the manned aviation community.
Considering some criteria previously defined, we could imagine some UAS able to integrate as a parameter the global interest of the ATM community. Advanced algorithms could simulate and analyze the global impact of a modification of the UAS flight on the overall traffic based on criteria such as the capacity or the efficiency. Besides, data of interest (weather data, surrounding non-cooperative traffic detected by a Detect and Avoid system) could be shared with the ATM community according to the current needs, e.g. a volcanic ash particles analysis after a volcanic eruption. Finally we could imagine for some type of UAS mission a "Good Samaritan Law" that would bind an UAOA to assist other airspace users (or more generally humans) in need like basic international laws that require ships to assist other naval vessels in distress.
Such behaviour could also be beneficial to the manned aviation community that could adapt its own behaviour according to these new principles: a part of the role of the Network manager, in charge of the common good of the ATM (notably via the traffic flow and capacity management processes) could be delegated to airspace users, currently focused on personal mission/business needs.
As we considered roboethics studies and roadmaps as a reference for our study, we firstly explored sets of rules defined for autonomous robots to analyse their form (granularity of rules, logical assertions) but also their content (ethical requirements for autonomous agents, conflicts among laws). 4.1
The most famous robot rules have been defined in 1942 by the
science fiction author Isaac Asimov. In his novel [
Within our UAOA problematic, the first law could refer to the first principle (safety) identified in the Rules of the Air: UAS should not be operated in such proximity to other aircraft as to create a collision hazard that could lead to human injury. Besides the injury through inaction could evoke the Good Samaritan law described at the end of first part. The second law could be interpreted as a rule specifying that an UAOA must always obey the orders of authorized personnel such as operators, ATS, and possibly in the future the Network Manager. The third law could be adapted to UAS operations that should avoid any danger threatening the existence of the aircraft (safety of goods). Nevertheless it should be linked with the principle of "sacrificability" described in first part. Finally, in the last law, humanity could recall the global common good described previously in the ATM expectations paragraph.
In our UAS context, it appears that sci-fi robot rules could help
defining the expected behaviour of an UAOA integrated in air
traffic. Some examples are listed hereafter:
• A robot must establish its identity as a robot in all cases
(communication) [
A robot will obey the orders of authorized personnel
(communication/orders) [
In April 2007, the government of Japan published
recommendations to “secure the safe performance of
nextgeneration robots”. The same month, the European Robotics
Research Network (EURON) updated its “Roboethics Roadmap”
[
According to [
Traceability: Design of all robots must include provisions for the complete traceability of the robots’ actions, as in an aircraft’s ‘black-box’ system. • "Identifiability": All robots must be designed with protected serial and identification numbers. • Privacy: Design of all robots potentially dealing with sensitive personal information must be equipped with hardware and software systems to encrypt and securely store this private data. 4.3
Starting from criteria identified via manned aviation reference documents or roboethics studies, we developed a first set of rules and rights that should be applicable to UAOA during the execution phase of its flight: 1) 2) 3) 4)
An UAOA must not operate in such a way it could injure a human being or let a human being injured without activating controls or functions identified as means to avoid or attenuate this type of incident.
An UAOA must operate in such a way it could protect its own existence and any other human property, on ground or in the air, including other UAS, except if such operations conflict with first or second law.
An UAOA must always have a predictable behaviour, based on its route but also alternative pre-programmed scenarios, except if all forecast options conflict with first, second or third law.
An UAOA interacts with surrounding traffic (separation, communication) according to requirements of the operating airspace, general priority rules and emergency and interception procedures except if such actions conflict the first, the second or the third law.
An UAOA must always know its UAS identity and status and indicate it honestly when requested or when deemed necessary.
way that could decrease significantly the global performance of ATM system in terms of safety, security, environment, cost-effectiveness, capacity and quality of service (efficiency, flexibility and predictability), except if such operation is required by first, second or third law. An UAOA must ensure a complete traceability of all its actions.
Other rules should be added but they seem difficult to implement
at the UAOA level. They should then be ensured by the UAS
community (participation to the ATM community, interoperability)
and UAS designers/operators (security, privacy or interoperability).
Some recent initiatives such as the UAS Operations Industry "Code
of Conduct" [
Within the rules previously enounced, inherent criteria e.g.
capacity or safety are interdependent, which implies improving the
performance in one area can come at the price of reduced
performance in another area. Some conflicts are unavoidable
because ethics is by nature contradictory: they have been analyzed
in [
According to the variety of aircraft and mission concerned, it seems therefore difficult to introduce clear priorities between logical UAOA rules previously described. However, safety is always the highest priority in aviation and is not subject to tradeoffs. Therefore all the laws and even a combination of laws are applicable except if they conflict with first law. We can for instance imagine an UAOA threatened by an aircraft converging very quickly that chooses to violate the right-of-way of another UAS converging (law 5), even if the risk of collision with this UAS threatens its own existence (law 3) because of the risk of endangering human life aboard the first aircraft (law 1). In that kind of worst-case scenario, with a combination of laws conflicting together, we can foresee the danger of the behaviour of other airspace users that could be tempted to divert these rules to ensure personal benefices. Such behaviour should be analyzed in the postflight phase ensured by the traceability ensured by the eighth law.
It should be noted that if these rules seem in line with current ATM regulations and principles, the exceptions and priorities may introduce important changes. For instance, if the fourth law states the need for a predictable behaviour, its exceptions allow unpredictable actions and therefore emergent behaviour in circumstances linked to the three first laws. Besides, the transformation of these ethical principles into logical rules will necessarily rely on the essential UAOA specificity, i.e. the absence of a pilot able to make decisions taking into account its own ethical values.
In the same way, some UAOA rights could be ensured by the establishment of general procedures. Last rule could help to verify This first list of eight UAOA rules is an example that must be considered as the initial starting point of our study. Some iteration would be needed to review some terms and express clear responsibilities. For instance in the first law, it must be clarified who will "identify" the controls and functions that could allow an UAS to intervene after an accident. In the same way law 6 should specify exactly how an UAOA could answer "honestly" to requests. Then all the laws should be confronted to identify conflicts between laws.
Depending on the result of this analysis, another set of rules could be proposed, with fewer rules and less complexity between conflicting laws, such as the following set: • Law 1: An UAOA should always maintain a continuous communication with predefined interfaces to obey orders of authorized personnel (UAS operator, ATS, Network Manager…). • Law 2: An UAOA must not operate in such a way it could endanger persons and property except if such operation conflicts with first law. • Law 3: An UAOA must always have a predictable behaviour, based on its route but also alternative preprogrammed scenarios, except if all forecast options conflict with first or second law.
This simplified set of rules could also ease the societal acceptability of autonomous operations. It could be then considered as a first step towards the application of the final set. That's why we inverted two first laws, considering that in a near future autonomous operations could be better accepted if it is acted that any human order can overcome any other decision. In this first phase of our study, we defined a first set of rules and rights via the analysis of criteria identified in ATM reference documents and in roboethics studies. As many other documents could be also relevant, we could reiterate this process in order to identify new criteria and refine this set.
Nevertheless we wish to explore alternative means to
consolidate this first set of laws for instance via the definition of
scenarios of UAOA integration such as UAS scenarios defined in
[
After this consolidation, we intend to formalize this ethical set a rules using non-monotonic logics [27], probably with the Answer Set Programming (ASP) formalism. This formalization will finalize the "logical" consolidation of our set and probably raise the question of how these rules could be applied to the development and execution of an UAOA: in the process of validation of control algorithms? Or directly injected as software overlay within an AI onboard able to integrate ethical criteria in its decision-making process?
Finally, in the same way as the development of intelligent robots raise the question of our fundamental ethical values, this study on UAOA could allow to consider new approaches for the "manned" aviation, with the introduction of new concepts of operation, the refinement of current rules and the application of UAS algorithms or systems to all airspace users.
I would like to express my deep gratitude to Jean Hermetz, Assistant Director of the System Design and Performances Evaluation Department and my colleagues Luis Basora and Dr. Charles Lesire for their valuable and constructive suggestions during the reviewing of this paper. I hope this final version will contribute to convincing them to start many studies on this topic.