Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 127
The Future of Air Traffic Control: Human Operators and Automation 5 Immediate Conflict Avoidance In this chapter we present an analysis of human factors issues and considerations in four current and proposed automation efforts associated with performing immediate conflict avoidance tasks: the traffic alert and collision avoidance system, the converging runway display aid, the precision runway monitor, and tools for airport surface conflict avoidance. Some of these efforts involve systems that are large and already implemented, such as the traffic alert and collision avoidance system. Others are small and at the early stages of pilot testing; examples include the precision runway monitor and the converging runway display aid. All of the systems included in the following discussion represent serious efforts to automate functions that have changed or will change the role of the human operator. For each item of automation, our analysis covers the functions to be performed; the historical context for development; the involvement of human factors in the implementation process; generic human factors issues including cognitive task analysis, workload, training and selection, and communication; and the human factors issues specific to automation that were discussed generically in Chapter 1. In describing these subsystems, one important message that we wish to convey is that each subsystem can independently aid the controller in performing the core functions of air traffic control; however, implementation will progress faster and more smoothly if each subsystem is compatible with its neighbors and its predecessors.
OCR for page 128
The Future of Air Traffic Control: Human Operators and Automation TRAFFIC ALERT AND COLLISION AVOIDANCE SYSTEM Functionality The traffic alert and collision avoidance system (TCAS) is an airborne system designed to: (1) advise pilots visually on a horizontal situation display if there is traffic in the nearby vicinity (a range extending beyond that defining an operational error for controllers); (2) alert them both visually and aurally if a possible collision is imminent (assuming both aircraft remain on the same course); and ultimately, if necessary, (3) issue a redundant (visual and auditory) resolution advisory, instructing the pilot on a vertical maneuver to avoid the possible collision. In the current TCAS II (Federal Aviation Administration, 1990b), the advisory is issued by depicting a vertical speed to seek (on the vertical speed indicator of the pilot's instrument panel) and another to avoid and by presenting an aural advisory such as ''climb climb climb" or "reduce descent reduce descent" (Avionics, 1990; Federal Aviation Administration, 1990b). Figure 5.1 presents a sample TCAS display. TCAS II version 7, which is planned for release in 1998, will improve the conflict resolution algorithms and provide some added display functionality (Klass, 1997). TCAS is essentially an automated system that is a redundant monitoring backup for the air traffic controller in instrument meteorological conditions, and for both the controller and pilot in visual meteorological conditions; it is also a control advisor for the pilot in the crisis situation when a potential collision is imminent. FIGURE 5.1 Sample traffic alert and collision avoidance (TCAS) display, showing a target 19 miles ahead. Source: Photo courtesy of the MITRE Corporation.
OCR for page 129
The Future of Air Traffic Control: Human Operators and Automation History The seeds for TCAS were planted both in concern over the rare midair collisions that have occurred (Wiener, 1989) and in the earlier efforts by the National Aeronautics and Space Administration to develop the cockpit display of traffic information (Abbott et al., 1980; Kreifeldt, 1980; Hart and Loomis, 1980). In the early 1980s, there was some concern over the visual workload imposed on pilots by giving them a full picture of all local traffic, as well as possible concerns about inadvertent shifts in authority away from air traffic control to the flight deck. The more restricted TCAS concept was developed following an FAA commitment to the system in 1981 and has been gradually phased into commercial air traffic. A great impetus (and a congressional mandate) were provided by the midair crashes over San Diego (in 1987) and Cerritos, California (in 1986; Wiener, 1989). By 1993, all the U.S. commercial carriers were equipped with TCAS. Human Factors Implementation The process of implementation of TCAS has benefited from some of the lessons learned by the earlier introduction of the ground proximity warning system, which suffered extensively from a high false alarm rate and as a result led pilots to develop a corresponding mistrust (Hanson, 1992). As a consequence, National Aeronautics and Space Administration's Ames Research Center undertook a systematic human factors research program prior to the introduction of TCAS (Chappell, 1990). This program entailed the collection of a considerable amount of laboratory and simulation data and the use of these data in fabricating many of the display parameters. Correspondingly, the implementation of the system on commercial aircraft has followed a gradual and closely monitored course, allowing early experience to guide redesign and refinement. A formal TCAS transition program established by the FAA has provided a vehicle for integrating lessons learned and disseminating them to the national airspace system community via a newsletter. The MITRE Corporation has been continually involved in refining the collision prediction and alerting algorithms on the basis of field problems and to address the still nontrivial false alarm problem (Klass, 1997). Human factors issues related to pilot compliance (or noncompliance) with resolution advisories are being closely monitored (Adam, 1995). An important Aviation Safety Reporting System report (Mellone and Frank, 1993) provided an early warning of some of the unanticipated system-wide human factors consequences of TCAS. Following a set of National Transportation Safety Board safety recommendations (National Transportation Safety Board, 1993), these have led to FAA intervention in issuing regulations on the use of TCAS in the cockpit. Three of these consequences have direct implications for air traffic control and are discussed further below: (1) pilots following a resolution
OCR for page 130
The Future of Air Traffic Control: Human Operators and Automation advisory were changing altitude by nearly twice the amount recommended by the user manual (600 versus 300 feet, with some deviations exceeding 1,000 feet) and hence intruding on a higher or lower flight-level; (2) pilots were not always informing controllers that they were undertaking a resolution maneuver, even after the fact; and (3) pilots were sometimes using the traffic status display to maintain separation from nearby aircraft, hence implicitly shifting separation control from ground to air. More recent, still emerging lessons are continually being applied, as the TCAS transition program remains in effect and the aviation safety reporting system continues to cull through its database to keep track of recurring problems. Although clearly imperfect, it does appear that this implementation program of TCAS has adhered to many of the important procedures to ensure that human factors are considered. Some of the more specific human factors issues, also discussed in the Phase I report, are considered below. Human Factors Issues Cognitive Task Analysis It is clear that TCAS accomplishes two functions designed to assist human performance in areas in which the latter is vulnerable: monitoring for low- probability events and predicting the interactions between complex speed-varying trajectories. Furthermore, its role as a situation awareness support, by providing the pilot with a graphic description of the state of nearby traffic, is a beneficial one. It can also be argued that the effectiveness of a resolution advisory, offered as guidance for action in a stressful, time-critical period, is one that supports human performance, because of the tendency for self-initiated actions to suffer a speed/accuracy trade-off under stress (Hockey, 1986; Wickens, 1996). At the same time, it is evident from task analysis and controller reports (Mellone and Frank, 1993) regarding the current implementation of the system that the sometimes unanticipated corrective actions initiated by aircraft in response to a resolution advisory can drastically disrupt the controller's situation awareness. This disruption is amplified because the direction of the advisory (i.e., a vertical maneuver) is one that is not spatially evident in the display but must be perceived from the digital data tags. Workload TCAS has workload implications both on the ground and in the air. For the controller, the enhanced workload of dealing with an unanticipated and often complex event is evident and has been the subject of explicit complaints (Mellone and Frank, 1993). For the pilot, the workload effects may come in two forms. First, responding to a resolution advisory is obviously a high-workload event, but one that is justified and acceptable if the advisory is "legitimate." If it is a false
OCR for page 131
The Future of Air Traffic Control: Human Operators and Automation alarm, this unnecessary distraction from other aspects of flying will have undesirable consequences. For example, recent reports have noted the frequency of hard and fast landings, resulting from false advisories issued during airport approaches. Second, a more insidious workload effect was anticipated by the earlier research on the cockpit display of traffic information. To the extent that pilots begin to navigate using the system's status display, their workload is likely to increase, both as a function of visual attention allocated to this new channel of input and as a function of added control decisions that may now be based on the system's input. Training and Selection Training issues were anticipated to some extent prior to TCAS implementation, and manuals were printed for both pilots and air traffic controllers. However, in some respects, reports from the field have indicated that initial training was not fully adequate (Hanson, 1992; Vickers, 1992; National Transportation Safety Board, 1993). From the controller's standpoint, many of the training manuals did not actually reach their destinations in the field (Vickers, 1992), and the initial training focused more on how the system should work, rather than how it did work in practice. For example, controllers were not alerted to the possible problems that would arise if pilots exceeded the recommended 300 foot altitude deviation, as many did (Mellone and Frank, 1993). For pilots, the simple instruction manuals were probably inadequate to prepare them for executing the actual maneuvers that might be required at infrequent and unexpected times. There is a need to train them to consistently follow the procedures that the controller would expect. At present, the fact that 30 to 50 percent of resolution alerts are not followed (i.e., ignored or followed incorrectly) (Steenblik, 1996; Adam, 1995) would suggest that there is great variance across pilots and occasions in the manner in which TCAS is used, suggesting a lack of adequate standardized training. Communication and Coordination The role of consistent training is particularly critical in systems like TCAS, with joint ground-air implications, because of the importance of shared situation awareness and a shared mental model between pilot and controller regarding how a pilot is likely to react and how the pilot actually is reacting to a conflict situation. The initial reports of Mellone and Frank indicated the magnitude of the problem. Subsequent reports of the large number of resolution advisories that are not followed (Steenblik, 1996; Ciemer et al., 1993) suggest that controllers cannot easily guess what the pilots will do in a conflict situation. (Only a minority of the cases in which pilots ignored resolution advisories resulted because the pilot
OCR for page 132
The Future of Air Traffic Control: Human Operators and Automation was following explicit controller instructions). We may infer that this issue lies at the heart of potential human factors problems with this system. Two solutions to this problem are implicitly suggested. First, greater and more effective training for pilots must focus on the need for consistent response to TCAS, so that the response will be predictable to the controller. Second, there should be a concerted effort to down-link the representation of resolution advisory responses (and possibly traffic alert information) to controllers (Hoffman et al., 1995; Flavin, 1996), to ensure that pilots and controllers have shared situation awareness of the nature of maneuver advisories. This represents an active program of research in air traffic control human factors that has been undertaken by the FAA. The program has included two pilot tests in a medium-fidelity simulation at the MITRE Corporation (Hoffman et al., 1995), which primarily employed user opinion (10 air traffic control specialists) to evaluate the value of this information, its format, and level of detail. It also includes a field test at Boston's Logan Airport. Organization Intended or not, TCAS has clearly produced a slight shift in authority from ground to air, resulting in ambiguity as to who is responsible for errors and possible accidents that may result. This shift is particularly evident in the use of the TCAS traffic display to navigate and maintain separation (Mellone and Frank, 1993), although this function is specifically acknowledged for oceanic in-trail climbs and, with the introduction of TCAS II version 7, for air traffic control authorized clearances for visual approach (Mundra et al., 1997). Issues involved in developing procedures for dealing with unintended consequences are also nontrivial, and the FAA is addressing this. Another organizational issue that is emerging relates to differences across and within airlines in the manner in which the system's procedures are followed. As noted above, the greater the inconsistency of procedure following, the less controllers will be able to anticipate maneuvers or remotely judge the pilot's assumed responsibility, and hence the greater the workload imposed on the controller. Furthermore, TCAS logic itself makes assumptions that the maneuvers of both aircraft involved in an engagement will proceed as advised. If this advice is unheeded by one aircraft but not the other, a bad situation could become worse. Automation Issues Mode Errors Although originally anticipated as a single mode system, early lessons indicated the need for certain modes to be deactivated at certain times, in order to avoid high false alarm rates. For example, the presence of other TCAS-equipped
OCR for page 133
The Future of Air Traffic Control: Human Operators and Automation aircraft on an adjacent runway (or in a parallel approach) during landing, where known close proximity encounters exist, requires that advisory and aural alert modes be deactivated. Yet such decisions will invite the possibility that other encounters may not be alerted. The existence of this issue is acknowledged, but its magnitude is uncertain. Trust As noted above and as discussed in Chapter 1, the mistrust engendered by false alerts and unnecessary resolution advisories, and also reflected in the frequent failures to comply with the resolution advisories, is the most critical issue. This issues is being addressed in part through continuous refinement of the algorithms by the MITRE Corporation. Issues of overtrust and complacency have not yet surfaced as identifiable concerns (perhaps because the nontrivial false alarm rate currently prevents complacency from occurring). However, greatly improved algorithms could increase the level of sensitivity of the system and significantly reduce the false alarm rate; such design changes should be accompanied by safeguards against complacency (automatically following the resolution advisory without a cross-check). Skill Degradation Skill degradation would not appear to be an issue for pilots, but for controllers the potential issue is very real; if TCAS supersedes controllers in issuing instructions to disentangle aircraft from complex traffic encounters, these skills may be lost by controllers. Similar concerns, of course, arise for controllers if ground-based automation accomplishes the task, as we discuss in the next chapter. Mental Models The issue of mental models can be defined at two levels. The first concerns the extent to which any operator (pilot or controller) has an accurate mental model of the algorithm by which resolution advisories are issued. In the absence of an accurate model, it is easy to envision circumstances in which an appropriate resolution advisory might not be followed. The issue at the second-level concerns the extent to which both pilots and controllers develop the same mental model of the algorithms operating in the system. If the mental models do not coincide, mistrust and hence misuse may result (Parasuraman and Riley, 1997). Since the controller's explicit model of separation violation is based on a purely space-based geometry (e.g., 5 miles, 1,000 feet), whereas the system's resolution advisories are based on a time-based geometry (i.e., predicted time to impact), there is an invitation for misunderstanding.
OCR for page 134
The Future of Air Traffic Control: Human Operators and Automation A recent simulation study by Pritchett and Hansman (1997a, 1997b) attributed the failure of pilots to follow many of the resolution advisories issued on parallel approaches in a flight simulator to the pilots' judgment of separation on the basis of distance, rather than on the time algorithms used in the resolution advisories. Such confusion may be amplified, to the extent that the system evolves to incorporate intent inferencing (see Chapter 2), based on programmed flight management system logic within the two aircraft involved in a potential encounter. Communication and Organization The main issues of communication and organization were discussed earlier. However, the discussion of mental models reiterates the critical factors involved in the information and assumptions shared among the four agents involved in TCAS: the two pilots, the automated system logic, and the controller. Since the dynamics of the situation will jointly emerge from the knowledge and expectancies that each agent has about the likely behavior of the others, as well as from the momentary situation awareness (or knowledge of the dynamic state) that each has of the conflict geometry, the predicted complexity of this system is great. Conclusion Although TCAS was originally intended to be a purely air-based system and designed to be a final backup to breakdowns in ground-based control, it is evident that it has much more profound implications for air traffic control. These implications will grow as the system is extended forward to recapture more elements of the cockpit display of traffic information, in the implementation of certain levels of free flight (e.g., the role of TCAS in approaches, the role of TCAS in oceanic in-trail climbs—Mundra et al., 1997). It is clear that considerable thought was given to human factors issues in the initial implementation and subsequent fielding of the system. However, it may be argued that more early attention could have been given to trying to discover the complex pilot-controller interactions that emerged, and that have subsequently forced revision of procedures, policy, training, and software. It is likely that more extensive reliance on system models (with valid models of human components), as well as complex human-in-the-loop simulation, could have anticipated some of these problems. It is encouraging to see movement in this direction as other future air traffic control technologies are envisioned (e.g., data link).
OCR for page 135
The Future of Air Traffic Control: Human Operators and Automation CONVERGING RUNWAY DISPLAY AID Functionality The converging runway display aid (CRDA) is a computer program that can reside on the ARTS III computer used in the terminal area for air traffic control. Its main function is to aid controllers in sequencing traffic for arrival at converging runways (Mundra, 1989; Mundra and Levin, 1990). At terminals with converging runways, there are two final approach paths. These two paths typically are separated by an angle of up to 90 degrees. When approaching aircraft are under positive radar control, the controller uses range markers on the radar display to determine the relative sequential spacing of aircraft on the two different descent paths. The goal is to maintain separation of at least 2 nautical miles as long as the aircraft are airborne. The critical stage is the point at which the two approach paths come together; arrival at that point must be staggered. The separation task is particularly difficult when the arriving traffic is diverse so that, for example, velocity on final approach varies from aircraft to aircraft. When inclement weather complicates the situation, loss of capacity can run to 50 percent. The converging runway display aid shows each aircraft on both approach paths by means of a "ghost" image. That is, the position of aircraft number 1 on approach path A is also shown on approach path B as a virtual or ghost representation. Thus the in-trail separation of the aircraft on both paths can be directly observed and adjusted through standard air traffic control procedures in a continuous manner. When the converging runway display aid is desired, it may be activated. A single switch brings up the converging runway display aid on the radar display. History Computer-aided metering and spacing were functions considered in system design exercises in the late 1960s when computer processing of radar images was first implemented. The basic response was to provide time-distance vectors for each aircraft under positive control. Thus the processed radar display generated a line that projected the path of future movement for each aircraft for a particular time duration. Since distance scale was constant for the radar display, the controller could assess momentary separation and also infer future separations (or violations), because the vector permitted explicit predictions. In 1988, the concept of providing ghost images as an aid in maintaining separation at the point of path intersection was first articulated and documented (Mundra, 1989). There followed an engineering development effort that was typified by the use of rapid prototyping techniques and the early engagement of
OCR for page 136
The Future of Air Traffic Control: Human Operators and Automation representatives of the user population in the assessment of these prototypes. Continuing domestic evaluation of the resultant computer program package is under way in St. Louis, Missouri; Norfolk, Virginia; El Paso, Texas; Cincinnati, Ohio; Tulsa, Oklahoma; Philadelphia, Pennsylvania; Birmingham, Alabama; Boston, Massachusetts; and Newark, New Jersey. The system is also being evaluated at Schiphol Airport in Amsterdam, the Netherlands, at the National Aerospace Laboratory using the NARSIM air traffic control simulator. These evaluations are complicated by the site-specific procedures employed in the use of the CRDA. There are also problems related to skill maintenance because the system is used only intermittently under conditions of particularly low-visibility. Human Factors Implementation As indicated, the original ARTS III capability for maintaining aircraft separation on converging paths was based on the controller's perceptions aided by range rings on the display. When development of the converging runway display aid was initiated by the systems engineers at the MITRE Corporation, the goal was to improve this limited capability. The developers of the aid could simply assume that the provision of any means for direct determination of the spacing would mean improvement. The central questions during the engineering development were the demonstration of the concept and user acceptance. These questions were addressed by the provision of prototype models that could be exercised first in a simulation setting and later in the setting of operational TRACONs at terminals, such as Lambert Field in St. Louis, that have converging runways. User feedback from such exercises was used to guide each successive stage in the modification of the computer program. Human Factors Issues Cognitive Task Analysis No formal task analyses were performed for the specific purpose of designing the converging runway display aid. However, an obvious cognitive problem in the basic system was the mental representation and visualization of in-trail separations for laterally separated, nonparallel radar images. It was evident to the systems analysts that there was a reduction in arrival capacity at operational TRACONs that had converging runways when instrument flight rules were ordered. It was ascertained informally that the drop in capacity came from controller uncertainty about separation distances. In short, the controllers were generating a larger margin for error and setting spacing above the minimums stipulated by the rules.
OCR for page 137
The Future of Air Traffic Control: Human Operators and Automation Workload The main workload in the predecessor system came from the need for the controllers to shift their attention back and forth between the two approach paths. The advent of the converging runway display aid was intended to eliminate the need to carry out such transfers of attention. The aid thus generates a net reduction in workload. Training and Selection In adopting the converging runway display aid, two learned discriminations are required. The first is simply the determination that the aid should be uploaded. The cue for this action would be the controller's sense that the spacing interval was creeping upward. Sensitivity for such a determination is trainable but could be acquired by ordinary practice in the normal course of air traffic control operations. The second learning situation involves making judgments to adjust the spacing between aircraft with different descent speeds once the converging runway display aid is operating. It would also unfold in actual operations (or in a task simulator). A possibly crucial factor is the achievement of confidence in the system on the part of the controller so that such judgments are acted on with no hesitation. Communication and Coordination It is conceivable that a team of two controllers could be assigned to approach control during heavy traffic periods and that each controller would be responsible for one of the converging approach paths. The base case in this situation is dual operations without the converging runway display aid. The question is: Does the introduction of the aid change the communication and coordination needs and procedures? With the display aid installed, each controller would see the aircraft under the other's control as a ghost target. This circumstance should actually reduce the need for communication and explicit coordination. Organization There is no indication that organizational dynamics change with the introduction of the converging runway display aid. However, it should be noted that field testing has been limited to a select subset of terminals; therefore, strong generalizations about organizational dynamics cannot be made.
OCR for page 145
The Future of Air Traffic Control: Human Operators and Automation Organization If the precision runway monitor/final monitor aid system is brought into play only in severe instrument flight rules conditions, the controller who is assigned as system operator has three entities with whom coordination is essential. The first is the pilot of an aircraft who commits a blunder on final approach and intrudes into the buffer zone between parallel runways. It seems likely that such a blunder will be symptomatic of other serious problems, so the controller might be well advised to minimize the time spent in coordinating efforts with this pilot. A second point of coordination is the pilot of the aircraft immediately adjacent to and affected by the blunder event. The effort made in reaching this person is crucial to the outcome of the episode. The third collaborator should be the arrival controller, who has responsibility for safe separation starting at the boundary of the terminal area up to the point of turn onto final approach. Ideally, a procedural arrangement would take place between the two controllers, so that aircraft would be metered onto the final approach in balanced numbers between the left and the right runways. Also important is the metering into the precision runway monitor/final monitor aid system such that sequence intervals are maintainable during the final approach. To a somewhat lesser extent, coordination will also be needed with the tower controllers, who are responsible for separation and expeditious flow from runway to arrival gates. In effect, the precision runway monitor/final monitor aid system preempts some of the functions of the tower controller. Some review of the clearability of taxiways under instrument flight rules conditions should be done when the flow of landing airplanes is upgraded by the use of the precision runway monitor/final monitor aid. That is, the question arises as to whether surface control might not be overwhelmed in adverse weather conditions if the arrival rate is sustained at the higher level made possible by the precision runway monitor/final monitor aid. Airborne Parallel Approach Monitoring The organizational issues associated with the precision runway monitor are closely linked to an alternative plan for monitoring closely spaced parallel approaches via displays in the cockpit. This system, called airborne information for lateral spacing, has been under development at the National Aeronautics and Space Administration for the past few years and has a similar philosophy to that of the precision runway monitor. On the primary traffic display, the pilot will view his own approach and that of the parallel traffic. In the event of a deviation, or the prediction of penetration of the no-transgression zone, a graded series of alerts are presented in coordinated fashion between the two participating aircraft (the "intruder" and the "evader"). These involve first alerting the intruder, then
OCR for page 146
The Future of Air Traffic Control: Human Operators and Automation alerting the evader, then commanding the intruder to maneuver (climb and turn right or left), and, as a last resort, commanding the evader to maneuver. The implicit assumption here is that the intruder bears initial responsibility for the conflict and hence shall be the first to execute a missed approach, an assumption opposite to the one incorporated in the ground-based precision runway monitor/final monitor aid. Traffic alerts are presented redundantly on the horizontal situation indicator (traffic display) and the primary flight display, while maneuver advisories are presented via voice synthesis. Unlike the radar-based precision runway monitor/final monitor aid, the airborne information for lateral spacing system is based on global positioning system sensing of aircraft position, and ADS-B communications between aircraft. The system thus has many analogies with TCAS, and the role of the controller would be assumed to be secondary (i.e., advised concurrently or following the maneuver, but not assumed to be an active participant in commanding the maneuver). Simulation tests of the airborne information for lateral spacing system at NASA Ames revealed relatively rapid response times (on the order of 1 second) by the pilot to the resolution advisories. However it should be noted that, in this simulation, there were occasional long responses of 10 seconds or more and furthermore that the simulations were conducted under best-case high-expectancy conditions, in which evading pilots knew that deviations by the intruding pilot would sometimes occur. Further work at the Massachusetts Institute of Technology (Pritchett and Hansman, 1997a, 1997b) has examined various traffic display enhancements and established that the redundant presentation of traffic information across the horizontal situation indicator and primary flight display is valuable, and that predictor (or trend) information is also useful. One important issue revealed by the simulation tests at the Massachusetts Institute of Technology pertains to the relatively high rate of noncompliance with resolution advisories, a finding echoing those observed in TCAS alerts. The authors attribute this in part to the fact that the time-to-conflict algorithms used by the system are different from the easy-to-visualize space-based algorithms (the no-transgression zone) that pilots generally use to monitor spatial separation (and that underlie the precision runway monitor/final monitor aid). At the present time, it does not appear that airborne information for lateral spacing and the precision runway monitor have been closely compared with each other or evaluated in head-to-head tests. On one hand, the airborne information for lateral spacing clearly has the advantage of a shorter loop time, because it eliminates the time delays associated with controller detection and voice communications. On the other hand, it may well be that the shortcomings of the precision runway monitor with the longer loop time are more than offset by the greater compliance rate that pilots have in following advisories given by a human controller, than those given by an automated algorithm with a synthetic voice. As
OCR for page 147
The Future of Air Traffic Control: Human Operators and Automation noted, the two systems also rely on very different technologies (high-precision radar for the precision runway monitor, and global positioning system and ADS-B for the airborne information for lateral spacing), as well as different algorithms (space-based versus time-based). These differences in technology dependence have important organizational implications should a redundant system involving both ground- and air-based alerts be considered. If the technologies are different, and they provide conflicting advice (as they may on occasion), which should be followed? Indeed, it could be argued that the possible confusion or blurring of responsibility resulting from the implementation of both systems could be counterproductive, leading to certain ambiguous scenarios in which the pilot of one or the other aircraft is uncertain of whether to maneuver. Conclusion The precision runway monitor/final monitor aid system has good user acceptance, although with some reservations expressed by highly experienced controllers about the passive-monitoring role of the system operator. Even with runway separation distances reduced to 3,000 feet between dual runways (as approved in November 1995), the incident frequency is likely to be too small to allow the controller to sustain a reasonable level of alertness. More investigation of the duty cycle should be done with this concern in mind. For example, a duty cycle of 1 hour or less might be optimum. The main areas of ambiguity about human factors considerations are communications and organization. Specific studies are needed to establish the utility and feasibility of the use of audible warning signals to alert pilots to the urgency of the missed approach message. A delay of 10 or more seconds in activating the pull-out maneuver is too long a period when the aircraft has only a few hundred feet of altitude. Another issue that deserves some further study is the prospect that the flow of arrivals with the precision runway monitor/final monitor aid in operation may saturate the capabilities of the surface controllers, who will also be suffering from restricted visibility, for which the equivalent automated capabilities for surface operations may not be as mature (see the following section). Finally, it will be extremely important for researchers and system designers to consider the trade-offs between the ground-based (precision runway monitor) and the cockpit-based (airborne information for lateral spacing) systems and the human factors implications of their possible joint use. AUTOMATION FOR CONFLICT AVOIDANCE ON THE GROUND Increased automation has been viewed by the FAA as a means of improving airport area safety on the ground. Approximately 200 runway incursions occur each year in the United States (Castaldo et al., 1996). The National Transportation
OCR for page 148
The Future of Air Traffic Control: Human Operators and Automation Safety Board (NTSB) has considered the prevention of runway incursions and of ground collisions of aircraft a high-priority safety issue (National Transportation Safety Board, 1995a, 1995b). In response to ground accidents at Atlanta (1990), Detroit (1990), Los Angeles (1991), and St. Louis (1994), the National Transportation Safety Board issued a series of recommendations for the prevention of ground collisions of aircraft. These recommendations include the reiteration of a 1991 recommendation that the FAA "expedite efforts to fund the development and implementation of an operational system analogous to the airborne conflict alert system to alert controllers to pending runway incursions" on the ground (National Transportation Safety Board, 1995b). To address safety concerns in a manner that may also yield efficiency gains, the FAA is undertaking a broad set of activities that, taken together, are intended to provide controllers and pilots with automated warnings of potential and actual runway incursions and ground traffic conflicts, with automated means of communication, with positive identification of surface targets, and with the capability to maintain situation awareness in low-visibility conditions. These initiatives range from current implementation through near-term enhancement to long-term development programs. The primary goal of the automation systems for the tower described below is to enhance the safety of airport operations. These systems provide to controllers and, in some cases, to pilots information that augments the current direct visual observations and verbal communications. In addition, these systems are based on surveillance technology that provides information under conditions of poor visibility (National Aeronautics and Space Administration, 1995). As with technologies that improve the availability and accuracy of in flight position, trajectory, and identification information, these systems may also permit improved efficiency by reducing delays otherwise dictated by less reliable information. Figure 5.2 presents the interrelationships among surveillance, processing, and tower and cockpit display systems. Airport surface detection equipment (ASDE-3) includes an advanced digital radar that penetrates rain, snow, and fog and provides to controllers a display of superimposed radar images of airplanes and vehicles over a map of the airport surface. It permits controllers in the tower to view a continuous, real-time display of all movements on runways and taxiways in the terminal area. Airport surface detection equipment does not, however, provide identification of targets, so controllers cannot readily identify specific aircraft by looking at the radar display. The controller therefore has to rely on visual contact and voice communication to positively identify aircraft. In addition, the airport surface detection equipment has limitations that include blockage of certain terminal areas and some false returns. The equipment is currently installed in some airports and is targeted for wider implementation. The airport movement area safety system (AMASS) augments the airport surface detection equipment with an automated alerting system. The airport
OCR for page 149
The Future of Air Traffic Control: Human Operators and Automation FIGURE 5.2 Elements of systems for monitoring airport area ground traffic. movement area safety system uses the surface detection equipment data to track ground operations, compare movements of aircraft and ground vehicles, and automatically provide to controllers visual and audio alerts of potential conflicts and of deviation from airport procedures. The airport movement area safety system also provides ''runway in use" alerts to controllers when it determines that targets are moving at high speed along a runway. The FAA is accelerating the implementation of airport movement area safety system displays in busy tower environments. Like the airport surface detection equipment, the airport movement
OCR for page 150
The Future of Air Traffic Control: Human Operators and Automation area safety system does not provide controllers with identification of targets. The aircraft target identification system (ATIDS), under study, would use triangulation and automatic dependent surveillance—rather than airport surface detection equipment radar—to pinpoint the location of aircraft on the ground. The airport target identification system would also use the secondary surveillance radar signal (mode A/C/S) to identify aircraft and to provide to controllers call sign information in association with ASDE-3 and AMASS-like target displays (Castaldo et al., 1996; Smith et al., 1996). An aircraft target identification system prototype has been undergoing tests at the Atlanta airport. Automated aids under consideration include the capability to present displays to pilots that indicate both the situation information provided to controllers and controller instructions. The runway status lights (RWSL) system is a radar-based safety system intended to improve on-airfield situation awareness by providing pilots a visual advisory of runway status. The system consists of a series of "stop/go" lights on the airport surface that indicate to pilots whether it is safe or unsafe to enter or cross a runway or to begin or hold takeoff. The runway status lights system, whose prototype has been undergoing field tests, controls the lights according to target position, status, and logic information derived from the airport movement area safety system. The runway status lights are intended as an independent backup to controllers' assessments and instructions; procedures dictate that, when pilots identify a discrepancy between the lights and controller instructions, pilots must resolve the discrepancy with controllers before proceeding (Architecture Technology Corporation, 1996; Federal Aviation Administration, 1996d). The airport surface traffic automation (ASTA) system would extend the mode S surface surveillance system to provide a two-way data link between the tower and the cockpit. The system may introduce into the cockpit an electronic moving map display that provides to pilots the target position, identification, and movement information presented to controllers, as well as the airport movement area safety system and controller instructions and alerts (Architecture Technology Corporation, 1996; Jones and Young, 1996; National Aeronautics and Space Administration, 1995). The airport surface traffic automation system is currently undergoing in-field prototype testing. Enhancements to cockpit displays, integrated with the airport surface traffic automation system, may also permit improvements in the efficiency of taxiway navigation. The taxi navigation and situation awareness (T-NASA) system, under development for NASA's terminal area productivity (TAP) low-visibility landing and surface operations (LVLAS) program, is intended to support the goals of increased nonvisual ground capacity, runway occupancy time for instrument flight rules equivalent to that for clear weather, and maintenance of safety (National Aeronautics and Space Administration, 1997a). The T-NASA system includes three features intended to provide situation awareness to pilots during
OCR for page 151
The Future of Air Traffic Control: Human Operators and Automation taxi: (1) an electronic moving map display that provides a layout of the airport, own ship position, positions of other traffic, graphical route guidance, and heading and clearance indicators; (2) a head-up display that projects symbology, correlated with a virtual out-the-window scene, displaying scene enhancements (e.g., center line markers) and scene augmentations (e.g., virtual turn signs and taxiway edge cones) as well as commanded taxiway indicators and other data; and (3) a three-dimensional audio ground collision and warning system that provides auditory warnings that include indication of the direction of approaching aircraft (Foyle et al., 1996; McCann et al., 1996, 1997; Bryant, 1993; National Aeronautics and Space Administration, 1997b, 1997c). The T-NASA system is under development; its conceptual designs are being evaluated by simulation studies and field tests at Atlanta's Hartsfield Airport. Human Factors Implementation There has been an encouraging general trend in the arena of airport surface automation toward earlier user and human factors involvement, coupled with a "build a little, test a little" development philosophy that includes earlier evaluations using mixed methodologies (discussed in Chapter 8). The development of the AMASS system, at its inception, was delayed by failure to structure the inputs of users, representing the air traffic requirements office and controllers, and failure to apply human factors analyses in the earliest requirements definition phases, resulting in "requirements creep" that prevented the timeliest implementation of this valuable system (National Transportation Safety Board, 1995a). Now, however, the refinement of the AMASS is supported by a MITRE Corporation laboratory, where AMASS logic and displays are prototyped and concepts are demonstrated and tested (MITRE, 1997a). The runway status lights system also underwent prototype evaluations with user involvement before its ongoing operational assessment at Boston's Logan Airport (Architecture Technology Corporation, 1996). The ASTA and TAP T-NASA programs have both involved controllers, pilots, and human factors professionals during analyses and concept development. Their involvement is also evident in ongoing and planned evaluations that are supported by modeling (e.g., NASA Ames' Air-MIDAS model, Pisanich and Corker, 1997), by simulation (Pisanich et al., 1994; Foyle et al., 1996; McCann et al., 1996, 1997; Bryant, 1993), and by flight demonstrations (Mejdrich, 1995). Human Factors Issues Trust Both the introduction of runway status lights and the addition of new surveillance technologies introduce related considerations of reliability, redundancy,
OCR for page 152
The Future of Air Traffic Control: Human Operators and Automation and trust that can have serious implications for the usability and effectiveness of the system. The runway status lights are planned as a backup safety net—a check against controller error. Similarly, should the lights be in error, the controller is expected to serve as a cross-check. Pilots will be expected to compare the instructions presented by the lights (e.g., taxi hold) against those communicated by the controller. The assumption is that when the instructions from the lights disagree with those from the controller, one of the two sources of instruction represents an error that has been caught by the other. The converse assumption is that when both sources of instruction are in agreement, a double-check is in evidence. These assumptions would tend to increase pilots' trust in the overall system, even if trust in one of the instruction sources (lights or controller) decreases. However, these assumptions are questionable. A double-check by redundant sources requires that the observation by each source is independent. In the present case, however, the runway lights are driven by the sensors and logic of the airport surface detection equipment/airport movement area safety system displays, which includes information presented to the controller. If the controller's instructions are also based on the airport surface detection equipment/airport movement area safety system displays, then the controller and the runway lights do not serve as independent double-checks. Rather, both the controller and the pilot are, in this case, trusting the same system. Even when independent observations occur, dual redundancy cannot always be presumed to yield a trustworthy result. For example, airport area automation plans include the introduction of ADS-B surveillance and communication technology, which may provide observations of aircraft position in addition to those provided by surface radar. If the observations from ADS-B conflict with those of the surface radar, the result is a "two-sensor problem." Which observation is to be trusted? The general solution is to provide a third sensor (e.g., controller direct observation or confirmation with the pilot). At issue in each case is the distinction between trust in the system and trust in its components. Although individual components may vary in their trustworthiness (which may change over time), a thorough understanding of the capabilities of each component as well as how the components work together (e.g., whether they serve as independent sources of information and when the system relies more on one than on the others) is required to permit pilots and controllers to develop an appropriate level of trust in the system. This argues against any temptation to "dumb down" training of automation systems and argues for training that provides a useful and appropriately detailed mental model of how the system works.
OCR for page 153
The Future of Air Traffic Control: Human Operators and Automation Mental Models, Situation Awareness, and Loss of Skill As noted in Chapter 1, one of the greatest causes of mistrust or misapplied trust is the inability of operators to develop mental models appropriate to the system and task at hand in order to maintain situation awareness. Both controllers and pilots will be expected to develop mental models and maintain situation awareness pertinent to the prevention of ground accidents and runway incursions (i.e., awareness of the current and near-term positions and movements of aircraft and vehicles, as well as immediate controller intentions and instructions). Lasswell and Wickens (1995) distinguished between local and global awareness in connection with taxi operations. Local guidance refers to the control task of maneuvering the aircraft along a route; global awareness refers to the task of maintaining position awareness relative to the gate and other airport features. To provide both forms of situation awareness, Lasswell and Wickens recommended displays that provide both an egocentric (pilot eyepoint) forward view, supplying local guidance, and a plan view supplying global awareness information. The designers of the T-NASA system have adopted this recommendation (Foyle et al., 1996; McCann et al., 1997), providing a head-up display that enhances local visual guidance cues, and a head-down display that augments global awareness cues (although the separate head-up/head-down display configuration represents a distinct design decision). As noted in Chapter 1, it is often the case that operators are less aware of the changes of state made by other agents than of changes they make themselves. Particularly when system automation (e.g., improved surveillance accuracy coupled with sophisticated airport movement area safety system logic) permits more complex activities (e.g., the movement of greater numbers of aircraft), the risk of operator complacency—or of simply being unable to keep up with automated actions—and associated loss of situation awareness is introduced. The loss of situation awareness may be accompanied by degradation of skills, if the operator has not maintained proficiency in tasks that are normally performed by the automation. The combination of loss of situation awareness and skill degradation can result in the operator's inability to respond adequately to the failure of the automation. This general theme is central to this report, and it is reemphasized here because airport area automation may become extensive in the future (e.g., enhancements to the airport area movement safety system encouraging more low-visibility operations; runway lights duplicating controller functions; and automated schedulers recommending high-efficiency actions). On that account, each new automation feature should be evaluated for its impact on situation awareness, controllers should be trained to maintain proficiency in automated tasks whenever they are expected to be able to perform those tasks in response to automation failures, and the capability of controllers to manage the complexities permitted by automation should be evaluated.
OCR for page 154
The Future of Air Traffic Control: Human Operators and Automation Teams Airport area automation holds the potential for changing the roles of controllers and pilots. The introduction of runway status lights and of cockpit electronic moving maps (providing to flight crews information similar to that provided to controllers through the airport surface detection equipment/airport movement area safety system display) increases shared responsibility for ground control between controllers and pilots. The implications of shared responsibility and authority, and the importance of clear and effective associated procedures, is discussed in detail in the earlier sections of this chapter and in Chapter 9 in the discussion of free flight. Effects of Combining Systems Chapter 8 discusses in detail the importance of considering the human factors implications of both phased and simultaneous implementation of two or more automated functions. The combination of automation features can potentially introduce effects that are not predicted from studies or tests of each feature independently. Airport surface automation includes contemplated introduction of additions or changes to surveillance technology, addition of features to airport surface detection equipment and airport movement area safety system displays, and simultaneous presentation to pilots of runway status lights and controller instructions (through visual as well as voice communication). The general guidance presented in Chapter 8 applies here: each change introduced should be studied within the operational context, taking into account all other changes introduced, and the evolution of changes should be centrally monitored and coordinated by a human factors research and development oversight organization. Conclusion To address both safety and efficiency concerns, the FAA is undertaking a set of activities that, taken together, is intended to provide controllers and pilots with automated warnings of potential and actual runway incursions and ground traffic conflicts, with automated means of communication, and with the capability to maintain situation awareness in low-visibility conditions. These initiatives range from current implementation through near-term enhancement to long-term development programs. The combination of automation features can potentially introduce effects that are not predicted from studies or tests of each feature independently. This may be particularly true to the extent that pilot and controller are receiving redundant sources of information. Also at issue is the distinction between trust in the system and trust in its components. Individual components may vary in their
OCR for page 155
The Future of Air Traffic Control: Human Operators and Automation trustworthiness (which may change over time). A thorough understanding of the capabilities of each component as well as how the components work together is required to permit pilots and controllers to develop an appropriate level of trust in the system. In addition, since these new systems are specifically intended as safety enhancements and may also be used to increase usage of airport surface capacity, it is particularly important that controllers and pilots are able to respond effectively to system failures, including those that regress the system to lower-levels of automation.
Representative terms from entire chapter: