Part I
BASELINE SYSTEM DESCRIPTION



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control Part I BASELINE SYSTEM DESCRIPTION

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control This page in the original is blank.

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control 1 Overview The American airspace system is impressive in both its capacity and its safety. Still, during such events as severe weather and recent power outages at the air traffic control centers around New York City, Chicago, and Pittsburgh, we realize the vulnerability of the system's capacity and its complete dependence for safety on the skilled coordination of air traffic control and flight deck personnel. This sense of vulnerability is heightened by the outdated technology underlying much of the physical equipment that controllers must use (Stix, 1994) and the chronic shortage of personnel at many facilities. Nevertheless, there are severe pressures to stress the system still further by pushing for more capacity and to fly in even more degraded weather conditions, while still maintaining and improving the current standards of safety. In order to meet these demands, many have argued that the level of automation in air traffic control facilities should be increased, to keep pace with the rapid development of automation in the flight deck and with the developing availability of satellite-based navigational technology. But as we have learned from other domains, automation—the replacement of human functioning by that of machines—is a mixed blessing (Wiener, 1995). It can sometimes create more problems than it can solve, and these issues lie very much at the heart of this report. Public safety considerations raise particular concern about the possibility that automation will marginalize the controllers' tasks to a point at which they can no longer effectively monitor the process or intervene when system failures or environmental disturbances occur. As a consequence of these concerns, members of the Subcommittee on Aviation of the Public Works and Transportation Committee of the U.S. House of Representatives suggested that the Federal Aviation

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control Administration (FAA) ask the National Academy of Sciences/National Research Council to undertake an independent assessment of the automation in the current and future air traffic control system from a human factors perspective. In fall 1994, the National Research Council established the Panel on Human Factors in Air Traffic Control Automation. The panel's charge is to conduct a two-phase study to describe the current system and assess future automation alternatives in terms of the human's role in the system and its effects on total system performance. The first phase involves a review and analysis of the development and operation of the current system; the second phase focuses on the system of the future. Each phase includes two distinct tasks: one concerns the operation of the air traffic control system, and the other concerns the integration of the system with the larger national airspace system. Consideration of the organizational issues and institutional adjustments that could strengthen the role of human factors science in the automation of the system is also included in each phase. The panel adopts a specific interpretation of the term automation. As noted above, we define it to mean the replacement by machines (usually computers) of tasks previously done by humans. We explicitly distinguish this term from that of modernization, which includes any and all upgrades of air traffic control technology, including those, such as the installation of new radar systems and computers, that do not substantially alter the controller's job (except perhaps by offering more reliable data). When we use the term human-centered automation, we are referring to a philosophy that guides the design of automated systems in a way that both enhances system safety and efficiency and optimizes the contribution of human operators. A key concept underlying the panel's work, as well as recent events that have occurred within the air traffic control system, is that of system reliability. Formally, this concept can be expressed either as a time measure (mean time between failures) for continuously operating systems or as a probability measure (1 - number of failures/number of opportunities) for systems or components associated with discrete events. In this report, we make the important distinction between reliability and trust. Designers continuously seek ways to make system reliability as high as possible, often by striving to meet specific FAA procurement requirements. Whereas this appears to be an admirable goal, absolute reliance on specified reliability should be treated with some caution, for three reasons. First, like any estimate, a reliability number has both an expected value (mean) and an estimated variance. Yet the variance is often ill defined and hard to estimate. When it is left unstated, it is tempting to read the offered reliability figure (e.g., r = .999) as a firm promise rather than the midpoint of a range. Second, objective data of past system performance reveal ample evidence of systems whose promised level of reliability greatly overestimated the actual reliabilities. For example, a recent outage of the newly installed voice switching

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control and control system (VSCS) used hundreds of years of its specified nonavailability (C. Grundmann, personal communication, 1995). There is little reason to doubt that this projected level of overconfidence will persist, given the inherent human tendencies toward overconfidence in forecast estimation (Fischhoff, 1982). Third, experience also reveals that it is next to impossible to forecast all inevitable circumstances that may lead a well-designed system to ''fail," even given the near boundless creativity of the system engineer. One example of this is the failure of the triply redundant hydraulics system in the United Airlines Sioux City crash in 1989. Another example is the near impossibility of debugging the entire set of software codes underlying functioning of the Airbus A320. In short, we believe that it is impossible to bring the reliability of any system up to infinity, or even to accurately estimate that level (without variability) when it is quite high, and this has profound implications for the introduction of automation. That is, one must introduce automation under the assumption that somewhere, sometime, the system may fail; system design must therefore accommodate the human response to system failure. In contrast to system and human reliability, trust refers to people's belief in the reliability of a system. Hence trust may accurately correspond to reliability or not. Miscalibration can involve either overtrust (complacency) or undertrust. We further distinguish two sorts of trust: the trust of the air traffic control specialist in the components of the system under his or her control and supervision, and the trust of the flying public in the ability of the system to transport safely and efficiently. AIR TRAFFIC CONTROL OPERATIONS The task of air traffic control includes several phases: ground operations from the gate to the taxiway to the runway, takeoff and climb operations to reach a cruising altitude, cross-country flight to the destination, approach and landing operations at the destination, and finally, taxi back to the gate (or other point of unloading). Figure 1.1 is a generic representation of these phases. The traffic to be controlled includes not only commercial flights, but also corporate, military, and general aviation flights (some in the latter class may choose, in good weather, to fly in unrestricted regions of the airspace without the benefit of positive air traffic control). Control is accomplished by three general classes of controllers, each resident in different sorts of control facilities. First, ground and local controllers (both referred to as tower controllers) handle aircraft on the taxiways and runways, through takeoffs and landings. Second, radar controllers handle aircraft from their takeoff to their cruising path at the origin (departure control) and return them through their approach at the destination (approach control), through the busy airspace surrounding airport facilities. This region is referred to as a terminal radar control area or TRACON. Third, en route controllers working at the air

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control FIGURE 1.1 Phases in air traffic control operations. Source: Adapted from Billings (1996a). Reprinted by permission

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control route traffic control center (ARTCC) manage the flow of traffic along the airways between the TRACON areas. Overall flow of aircraft across the entire United States is managed by the Air Traffic Control System Command Center in Herndon, Virginia. Separate elements of the air traffic control system are also represented by oceanic control for overseas flights and by military controllers when military aircraft are flying within special-use airspace. SAFETY AND EFFICIENCY The stated goal of the air traffic control system is to accomplish the safe, efficient flow of traffic from origin to destination. The joint goals of safety and efficiency are accomplished by controllers through an intricate series of procedures, judgments, plans, decisions, communications, and coordinated activities. The communications and coordinations between the pilot and the controller are most familiar to the public. However, every bit as critical are the coordinations that take place within and between the air traffic control facilities themselves. Controllers must hand off aircraft as they pass from one controller's sector of responsibility to another. This handoff communication is sometimes done within a facility and sometimes between them. Also, hierarchical communications flow from the most global, national perspectives to more regional and local ones. That is, the Air Traffic Control System Command Center in Virginia considers national weather patterns and traffic needs each day and establishes national traffic patterns. The constraints established there are passed downward and outward throughout the system. Hour by hour, traffic patterns are monitored in the en route systems and may be used to identify bottlenecks, which in turn may give rise to specific instructions to hold aircraft from proceeding from one sector to the next. The two goals of safety and efficiency are to some extent partially contradictory, and each is subject to tremendous pressures. We describe each in detail below. Safety is ensured, in large part, by guaranteeing minimum separation between aircraft, a separation defined by altitude and lateral dimensions, creating a sort of "hockey puck" of space around each aircraft. These dimensions have different values in different regions of the airspace. The pressures for safety obviously come from the traveling community and are increased by reports of very rare midair collisions (Wiener, 1989) and somewhat less rare near-midair collisions (Office of Technology Assessment, 1988). Of course, to ensure total safety, aircraft would never fly; to ensure a greater safety level than we have today, separations between aircraft would be greater than is currently the practice. However, that would compromise the second goal: efficiency. Two forces put strong pressures on the system for efficient flow: consumers and pilots. The traveling public, whose wishes are generally expressed by airline management, is understandably impatient with overbooked

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control flights, ground holds, and delayed arrivals. Pilots, too, are understandably anxious to make the flight time from gate to gate as short as possible, provided that safety is not compromised. As shown in Figure 1.1, within the national airspace system, this pressure is directly expressed to the air traffic control system via the airline dispatchers who are heavily responsible for adhering to published arrival and departure times. The specific manner in which the goal of efficiency is met, thereby maximizing the capacity of the current airspace, is a more complex and constraining process than meeting the goal of safety (minimum separation). The limiting factor to capacity maximization is usually the rate of arrivals at an airport, particularly at the large hubs. The constraints at the hubs are dictated jointly by the number of gates, the number of runways, and the speed with which aircraft can exit the runways. Arrivals, more than departures, represent the limiting factor. Every airport has a capacity in terms of number of aircraft it can receive per unit of time. The goal of the air traffic control system is to meet that capacity (to optimize flow) by delivering airplanes, at regularly spaced intervals, to line up for the final approach. Several factors conspire to prevent this goal from being achieved, causing the system to underutilize its maximum capacity. Controllers cannot normally "stack" aircraft at the arriving TRACON, to be delivered as soon as a slot is available. So schedule departures and speed changes must be scheduled far upstream in strategic plans, in anticipation that the capacity limits will be realized when the aircraft approach their destination. But weather, head winds, and other uncertain conditions may influence a flight schedule well before the airplane reaches its scheduled point near the final approach. Optimization is limited by the limited ability of all elements within the air traffic control system to predict the future. Wake vortices, particularly following the passage of heavy aircraft, force the controller to maintain greater separation on the final approach for some aircraft. Sudden changes in weather may force changes in the configuration of airports—for example, closing or reversing runways, slowing taxiing. A host of system design efforts at all levels are intended to counteract these bottlenecks to efficiency (Federal Aviation Administration, 1996). On the ground, although it is unlikely that newer, larger-capacity airports will be built in the near future, more realistic possibilities exist for expanding the capacity of existing airports by building added runways. Efforts are also under way to allow the more efficient use of existing runways by expanding the opportunities to use parallel or converging runways for landing. The National Aeronautics and Space Administration has a program of research on terminal area productivity (Eckhardt et al., 1996), to allow more rapid exits from runways after landing and more rapid taxiing to the gates, particularly in bad weather. Increased developments of

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control heads-up displays and automatic landing (autoland) systems are designed to allow more aircraft to land in poor visibility. Perhaps the biggest pressure for efficiency has been exerted on the air traffic control system itself, to increase its efficiency through equipment upgrades, in a manner that may challenge the cognitive capacities of the individual controller to the utmost. This important issue is a key theme in the next three chapters. The typical controller is able to address the sometimes-conflicting pressures for safety and efficiency in two ways: (1) by adhering to a well-developed and extensive set of FAA procedures that have evolved over the years and (2) by being able to augment them with skilled problem solving on the infrequent occasions when following procedures fails to specify the appropriate actions. Understanding how the system came to evolve as it is today and appreciating the current pressures can be facilitated by considering the pilot's perspective, as well as some key historical events that have occurred in the evolution of the national airspace system. THE PILOT'S PERSPECTIVE Because of the somewhat differing perspectives of pilots and controllers, their views on the best tactics to achieve their mutual goals of safety and efficiency are not always the same. Most critically, the air traffic controller has a number of aircraft to deal with, whereas the pilot is concerned with only one. The air traffic control system, of which an individual controller is only one part, is spread over a large area and must be managed so that aircraft cross over or under each other safely. The commercial pilot, generally reflecting the goals of the airline dispatcher, would like to fly the aircraft in the most efficient manner by choosing the most direct route (a straight course or a great circle arc) and at the aircraft's optimal altitude. This ideal course is not always compatible with the constrained routes available. This situation had led the FAA to allow greater flexibility for commercial aircraft to fly preferred routings at high altitudes and to fly great circle routes under its expanded national route plan (NRP) program. Another difference is that the pilot's goal of efficiency is not always in harmony with that of the controller. The controller's goal is to maintain the maximum evenly spaced flow of all aircraft from airport to airport, even if this means that a given aircraft must slow down or do an extra turn. Aircraft automation is also a potential source of conflict. Many newer aircraft employ very sophisticated systems. The flight management system (FMS) is one such system; based on temperature, wind, and the weight of the aircraft, the system can select the best altitude for the aircraft to fly. Although many aircraft may prefer the same altitude, the controller assigns it to the first aircraft departing along that route. If it were permissible, the aircraft's flight management system would constantly change altitudes throughout the flight in order to select the best altitude: following takeoff, the aircraft would commence a slow climb as fuel

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control was burned off, climb until it reached its optimal altitude, cruise while seeking the optimal altitude to minimize head winds and maximize tail winds, and then start a steep descent near its destination. However, the most efficient method for operating one jet aircraft is not necessarily compatible with the controller's need to maintain safe and expeditious flow control across all the aircraft aloft. In addition to the flight management system, other forms of automation can amplify the differences in perspective between pilots and controllers. For example, the traffic alert and collision avoidance system (TCAS), described more fully in Chapter 12, allows pilots to initiate a traffic avoidance maneuver without direction from air traffic control. If not carefully implemented and if prior notification is not given to the controller, such a maneuver can severely disrupt the overall traffic flow plan (Mellone and Frank, 1993). The goals and tactics of pilots and controllers generally coincide as the destination airport is approached, although sometimes a controller's request that the pilot make a steep, last-minute descent or a visual approach can conflict with the pilot's sense of safety, comfort, or both (Monan, 1987). As aircraft near their destination, it becomes necessary for the controller to become more involved in maintaining their precise trajectory. This is usually accomplished by directing the aircraft to follow a set of orders. The controller uses a radar display to adjust the distance between aircraft so that a stream of aircraft flows toward the runway that is being used for landing. Although aircraft automation may provide some sources of tension between pilots and controllers, there is no doubt that, on the whole, both the flight management system and the traffic alert and collision avoidance system have been well received by both communities and can be viewed as safety enhancing. Pilots greatly appreciate automation that provides them with more integrated information, although they are less pleased with some features of the more complex forms of automation that involve extensive programming and reprogramming (Wiener, 1989). Before-flight programming has added significantly more time to the preflight actions required by the flight crew, as much as an additional 15–20 minutes. And in-flight reprogramming of the system can take precious minutes in an already high-workload, dynamic situation. Complex cockpit automation such as the flight management system may also "hide" the logic behind its control of the aircraft's trajectory in ways that pilots do not always understand, leading them to feel that they are "out of the loop" (Sarter and Woods, 1995). Finally, there is the very real danger that automation can be trusted too much, leading to a sense of pilot complacency (and resulting failure to monitor the automated device). Overtrust and overreliance may even result in a potential loss of manual flying skills. In a very different manner, flight deck automation has the capability of further improving national airspace system safety if lessons (both good and bad) that pilots have learned from their automated devices can be transferred effectively

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control to the implementation of air traffic control automation. Examples of these lessons are discussed more fully in Chapter 12. These and other human factors concerns regarding the national airspace have evolved from events and developments that have taken place over the last half century, some of which are described below. KEY HISTORICAL EVENTS Since the introduction of radar in the late 1940s, drastic changes have occurred in the national airspace system. Some changes have resulted from technological developments (e.g., the introduction of radar, sensor technology or global positioning system). Others have been more abrupt, resulting in part from analysis of catastrophic accidents. Had these accidents never happened, the changes might never have taken place. The list below is an approximate chronology of key events, most of them accidents, that have transformed the national airspace system since the 1950s to its current state. Some, but not all, have direct implications for air traffic control. Others have broader implications for air safety in the national airspace system. Many of the advances in air traffic control technology that have led to the evolution of the national airspace system are described in subsequent chapters. Figure 1.2 represents these events on a time line, along with certain key developments or policy changes that have been instigated as a result. On June 30, 1956, a United Airlines DC-7 and a Trans World Airlines (TWA) Constellation collided over the Grand Canyon. The TWA aircraft was operating at 21,000 feet with an "on top" clearance, and the United one was cleared under instrument flight rules at 21,000 feet. Because of this accident, a radar positive control system was implemented with the requirement that all air carriers operate under instrument flight rules. It has been said that this accident stimulated more action to modernize the air traffic control system than any other single occurrence (Luffsey, 1990). During an approach to Miami International Airport, all three members of the flight crew of Eastern Airlines L-1011 were distracted by a landing gear warning light and none recognized that the autopilot had disconnected and the aircraft was descending until only a few seconds before the crash. The accident served as the first prominent example of two critical problems that had great impact on later human factors developments in aviation: the problem of complacency with an automated system and the problem of crew resource management (Wiener, 1977). As we discuss in subsequent chapters, both issues have direct relevance for the evolution of air traffic control. In 1974, a TWA flight on approach to Dulles International Airport crashed into a mountainside, the flight crew unaware of the mountain's presence in the forward flight path. The accident led the FAA to greater concern for problems in communication ambiguity between ground and air. In the air traffic control

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control FIGURE 1.2 Time line of key historical events.

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control facility, it provided a trigger for the introduction of the minimum safe altitude warning, an early form of automation. The accident also provided a major impetus for the introduction of the ground proximity warning system into the cockpits of all transport aircraft, a procedural change that had a profound and positive influence on air safety. In 1977, two Boeing 747s collided on a runway at Tenerife in the Canary Islands, the worst commercial aircraft disaster in history. As with any major accident, several factors were involved, but a critical one was the misunderstanding in voice communications between the controller and the captain of one of the aircraft. As a consequence of this disaster, major efforts were made to standardize communications procedures in international airspace. The San Diego midair collision of a PSA B-727 and a Cessna 172 on September 25, 1978, again illustrated ground-air communications problems and also heightened the need for an airborne collision avoidance system for pilots. (The ground-based conflict alert system for controllers has been introduced in 1976.) The Cessna was climbing under air traffic control and the B-727 was making a visual approach to the San Diego airport. The B-727 crew stated they had the Cessna in sight but had misidentified the target in the busy southern California airspace. The visibility was limited due to hazy conditions. The National Transportation Safety Board found that the PSA pilots did not maintain adequate visual separation, and the controller was cited for allowing an aircraft to use visual separation only. A consequence of this accident in part led to accelerated development, testing, and implementation of the traffic alert and collision avoidance system, now a feature on all commercial aircraft. A United Airlines DC-8 crashed on an approach to the Portland, Oregon, airport on December 28, 1978. The cause of the accident was fuel exhaustion. Because of a malfunction of the landing gear warning system, preparation for an emergency landing preoccupied the captain and, despite warnings by other crew members about the low fuel state, he delayed the landing. The poor use of resources by the captain instigated a reevaluation of the organization of the cockpit. Researchers identified and analyzed other accidents that were mainly related to the chain of command, crew coordination, management style, and team-building elements of airline cockpit (Cooper et al., 1980; Murphy, 1980; Foushee, 1984:Chapter 7). This effort gave rise in the 1980s to a new requirement by the FAA to promulgate optimal cockpit management. It is now generally described as cockpit resource management or crew resource management and has become a training course for pilots. The essence of resource management training has found its way into flight attendant, air traffic controller, and maintenance training as well as operations outside the airline industry. Its positive benefits on air safety have been well documented (Diehl, 1991). During the period around 1980, four nonaccident events took place that have had a profound influence on the national airspace system. (a) In 1978, deregulation of the airline industry created both a decrease in ticket prices (leading to a much greater demand for flying) and a change in flying routes, as airlines formed hubs at some major cities. These factors combined to create much greater traffic congestion in certain regions of the airspace. (b) In 1981, an air traffic controller strike led to the firing of much of the air traffic control workforce, creating a shortage of trained personnel to manage the increased traffic and exacerbating the stresses on the system. This shortage remains today. (c) In 1980, the aviation safety reporting system was developed at NASA Ames and implemented by the FAA, providing valuable insight into the nature of incidents in both the flight deck and the air traffic control facility. This database has provided valuable indicators of airspace hazards. (d) In 1981, the FAA certified the two-person flight deck on a new generation of Boeing and McDonald Douglas aircraft, triggering a modest revolution in aerospace automation and further development of the flight management system (Billings, 1996b).

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control The introduction of higher levels of flight deck automation in the 1980s has produced its own set of accidents that have revealed certain human factors problems, previewed by the 1972 Everglades crash—number 2 above (Wiener and Curry, 1980). Although none of these accidents directly influenced the national airspace system or air traffic control procedures, all have led to the evolution in thinking about the role of humans and automation in flight safety. The downing of Korean Airlines flight 007 demonstrates a major concern with automation. On September 3, 1983, a Soviet fighter shot down this B-747 over Sakhalin Island. The aircraft had transgressed the boundary of the Soviet Union without permission. The Korean flight crew had inadvertently left the inertial navigation system in a heading mode, which allowed the autoflight system to maintain a constant heading rather than a programmed track. Complacent in their belief that the "dumb and dutiful" automation system was correctly doing its job, they apparently failed to monitor their position in the airspace. On February 28, 1984, a Scandinavian Airlines DC-10 skidded off the runway at John F. Kennedy Airport in New York. The autothrottle system, a means of automatically controlling the speed of the aircraft, was in use during the landing approach. Although the system had a history of malfunctioning, the crew did not override the overspeed of the aircraft. This was one of the first cases of automation gone awry. The crew was required by the airline to use the autothrottles for this approach, and they had placed too much trust in the automatic system. A China Airlines B-747 flying at 41,000 feet on February 19, 1985, lost power to its number 4 engine. It was night and the crew was operating with the autoflight engaged. The autoflight system compensated for the power loss by a complicated combination of control inputs. When the captain finally became aware of the problem and disconnected the autoflight system, the airplane entered a spiral that could not be corrected until the aircraft had fallen over 30,000 feet. Again, overreliance on automation was cited as the cause of the incident. A series of accidents involving Airbus Industrie aircraft have been attributed

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control to failures of automation or, more often, to the design of automation systems; that is, the full range of operations and constraints under unusual circumstances were poorly understood by the pilot (Aviation Week and Space Technology, January 31, 1995; February 6, 1995). As one example, during an approach to a runway at Nagoya, Japan, the copilot of a China Airlines A-300 inadvertently selected an automated go-around mode but attempted to continue flying the airplane to a landing. The autoflight system attempted to climb and increased engine power, but the copilot overrode the control in an attempt to land. The aircraft went out of control when the copilot could no longer overpower the autopilot, which had trimmed the aircraft for maximum climb. In 1992, another A-320 crashed on approach to the Strasbourg airport when the pilots inadvertently selected a high-angle descent rather than the standard 3-degree glide path. Redesign of the display was made subsequent to the accident. Collectively, these and other accidents described in greater detail in Aviation Week and Space Technology (January 31, 1995; February 6, 1995) have caused human factors researchers and aircraft designers to take a very hard look at the appropriate levels of flight deck automation and, in particular, important human factors lessons that should be learned in the introduction of any automation system. The relevance of these lessons to air traffic control is discussed in detail in the chapter on automation. On January 25, 1990, an Avianca B-707 crashed during an approach to the John F. Kennedy Airport in New York. The weather had caused delays and holding. The crew had warned the air traffic controllers that they were low on fuel but failed to impress them with the seriousness of their dilemma. This accident, like that at Tenerife years before, demonstrated the weakness of voice communications that take place in other than one's native language. Many factors were present in this accident as in the Tenerife one, but basic was the inability of the crew to communicate effectively with the controller. Standardized, understandable voice phraseology was adopted by the FAA subsequent to this accident. Finally, two accidents have called attention to the vulnerability of the national airspace system in ground operations. In 1990, two Northwest Airlines aircraft, a DC-9 and a B-727, collided on a fog-shrouded runway in Detroit. The crew of the DC-9 was cited for its taxiing onto an active runway without clearance. The airport was cited for the nonconformance of its signs and taxiway lights. The tower was cited for its lack of clear taxi instructions, knowledge of a problem intersection without adequate safeguards, and failing to broadcast a stop takeoff message when it was found that an aircraft had taxied onto the takeoff runway. On February 1, 1991, a USAir B-737 collided with a Skywest Metro at the Los Angeles airport. The accident occurred at night while the Metro was awaiting takeoff clearance on a runway. The Metro had taxied into position at an intersection some distance down the runway. The B-737 had been cleared to land

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control on the same runway. The tower controller could not see the Metro in the lights of the runway and, because a flight strip for the Skywest was not at the controller's position, forgot that it was awaiting takeoff. The National Transportation Safety Board cited the lack of management in the tower facility, from the perspective of both oversight and policy direction, and failure of appropriate coordination in following procedures in the tower. The controller was very busy and did not have adequate backup, nor was the surface radar available for monitoring the aircraft on the airport. Certain procedures of information exchange were violated. Both of these accidents have stimulated major efforts to improve navigation and surveillance on the ground. In 1994, the FAA introduced the expanded national route plan, which enables commercial airlines to have greater flexibility in choosing their desired courses at high altitudes, thus initiating a trend toward greater authority by commercial pilots and airline dispatchers to manage their flight trajectories. This trend may be enhanced by the implementation of free flight, in which operators under instrument flight rules have the freedom to select their path and speed in real time (Planzer and Jenny, 1995). The time line shown in Figure 1.2 constitutes but a partial list of key events and trends that have occurred and influenced the national airspace over the past 40 years. In particular, we have not highlighted many of the specific developments and technological evolution within the air traffic control facility as these pertain to current practices. These developments are thoroughly treated in the chapters that follow. SCOPE AND ORGANIZATION OF THE REPORT The panel's work is being reported in two separate reports. This report describes in some detail the human factors aspects of the baseline air traffic control system as it exists today. Although we consider automation issues to some degree, particularly those that already exist, we also focus on many more traditional human factors issues, such as current training procedures, display design, workload, and team communication and cooperation. This report sets the stage for an in-depth examination of proposed automation levels of the future air traffic control system, to be described in the panel's second report. Both volumes focus of course on air traffic control; however, we also address other complex systems, in which lessons learned from human factors research can be applied to the air traffic control system. This report has 12 chapters. In Part I, we discuss the general system by which air traffic is controlled; the procedures used for selecting, training, and evaluating controllers; and the support provided by airway facilities staff. Chapter 2 considers the specific air traffic control systems and describes the different facilities and controller tasks. Chapter 3 addresses controller attributes and the

OCR for page 15
Flight to the Future: Human Factors in Air Traffic Control tools used for personnel selection, training, and evaluation. Chapter 4 describes the operations and personnel of airway facilities. In Part II we consider specific human factors issues within the current system: the cognitive tasks of the controller (Chapter 5), workload and vigilance considerations (Chapter 6), teamwork and communications (Chapter 7), system management (Chapter 8), and human factors issues in airway facilities (Chapter 9). In Chapters 10 and 11 we consider two important methodological issues in human factors research: how research is tried out on air traffic control issues and how human factors knowledge is actually incorporated into design of the current air traffic control system. In Chapter 12 we set the stage for our Phase 2 report by focusing on two aspects of automation. We first summarize and synthesize automation levels achieved in the current air traffic control system both in North America and in Europe, show how they have worked, and the lessons learned. In the second part of the Chapter, we address several generic issues in the human factors of automation, drawing guidance from other domains such as process control, robotics, and the flight deck, where automation has evolved further than it has in air traffic control.