Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 225
The Future of Air Traffic Control: Human Operators and Automation 9 Airspace System Integration: The Concept of Free Flight The national airspace system involves four key components: (1) air traffic control personnel, (2) dispatchers and management of the airline industry, (3) pilots and their aircraft systems, and (4) ground-based automation. Perceived inefficiencies in the national airspace have spurred serious planning toward a concept in which pilots, airline dispatchers, and managers may be assuming more authority for flight path management (RTCA, 1995a, 1995b). In this chapter, we take a systems perspective in considering the roles of these four components in the concept of free flight (Figure 9.1). Our discussion includes an overview, system-level issues, and related human factors issues, revisiting issues discussed in detail in the panel's Phase I report. We then propose an alternative vision of the evolution of automation in the national airspace system in the next decade. We begin by characterizing differences among the key components in three critical variables: Goals may differ, in terms of the relative emphasis on safety versus efficiency (and productivity) and in terms of local optimization versus global optimization. Information may reside differently within different components, and such information may or may not be shared between them. Authority for different aspects of air traffic management exists in certain places. Furthermore, authority may ''flow" along certain paths, and these paths may change with future changes in air traffic management procedures.
OCR for page 226
The Future of Air Traffic Control: Human Operators and Automation FIGURE 9.1 Components of the free flight concept. Goals, information, and authority (both perceived and actual) may differ among the four major elements. First, air traffic controllers maintain primary responsibility for the goal of overall safety of all aircraft in the system, and their concerns about efficiency are distributed across all occupants of the airspace, including general aviation and military aviation flying in civilian airspace. Airline management, as reflected by the influence of the airline operations center, although concerned with safety, has relatively greater interest in expediency and efficiency, as well as a more local interest in the efficiency of its own fleet of aircraft. Profit is a heavy driver of the expediency goal, given the low profit margin of most airlines and the high cost of delays to company profit. The pilot's interests are still more local, concerned primarily with the safety and expediency of a single aircraft. Automation may be conceived to be relatively goal-neutral with regard to safety and efficiency, in that these goals are defined by the designers of the system. However, many aspects of automation proposed for the national airspace system are specifically intended to increase efficiency, with the explicit requirement that they be safety-neutral.
OCR for page 227
The Future of Air Traffic Control: Human Operators and Automation The fact remains that automation may sometimes be safety-compromising if it is not carefully implemented (Parasuraman and Riley, 1997). Second, each component retains somewhat different information about the airspace. That information can vary in its geographical scope (global to local), its level of detail, and its accuracy or currency. For example, airline dispatchers and management at the airline operations department may currently possess the best information about global weather patterns (of regions containing its flying fleet). Relatively high levels of automation can provide them with accurate projections of ideal flight routes. Air traffic controllers (en route and central flow control) have slightly less precise current weather information (see Chapter 3), but the best information regarding global traffic patterns and global intents. Controllers at TRACON facilities and towers have still more restricted but detailed information, and pilots generally have the most restricted but most detailed information regarding the capabilities and intent of their own aircraft. Thus, across these components, there tends to be a trade-off between information scope and detail. An advantage of automation is that it has the ability to retain, digest, and share information that is at once global and detailed and thus to contribute in a beneficial way to information sharing. Third, the Federal Aviation Administration (FAA) has set up clearly defined lines of actual authority (responsibility) for different aspects of flight path management. For example, controllers have authority to issue clearances and instructions to aircraft only within their sector. Controllers, not pilots, have authority to direct instrument flight rules aircraft to different flight-levels and headings. However, it is not clear that perceived authority necessarily follows procedurally defined authority lines. For example, the possible loss of situation awareness and skill induced by high levels of flight deck automation can create a potential shift in perceived authority for trajectory management away from the pilot (Sarter and Woods, 1995b). If the automation is trusted, reliable, and introduced carefully into the workplace, this shift can be voluntary (i.e., the human can willingly give up some aspects of control to automation). However, if the automation is mistrusted, clumsy, and introduced without consideration of user inputs, the shift may be involuntary, with the user feeling that authority has been taken away. In either case, there are possible concerns: complacency in the former case, loss of job satisfaction or even possible abuse of automation in the latter. From a controller's perspective, the loss of authority and information may have similar implications, no matter which component in the airspace (pilot or automation) is perceived to preempt that authority. Most of this report has addressed a scenario in which authority potentially flows to automation. However, the concept of free flight in which pilots, airline dispatchers, and managers, rather than automation, may be assuming more authority, has many implications for the controller similar to those of high automation levels. In Chapter 5 we note a precursor to this effect when we discuss the issue of maneuver authority in the traffic alert and collision avoidance system (TCAS).
OCR for page 228
The Future of Air Traffic Control: Human Operators and Automation HISTORY Many participants in commercial aviation have become frustrated by what they view as inefficiencies in the national airspace. These inefficiencies translate into flight delays, occasionally missed connections, passenger complaints, excess fuel consumption, excess crew time, and, ultimately, loss of revenue, for companies that already have a very thin profit margin. Such inefficiencies are viewed to result, in part, from three factors: (1) standard linear airways that rarely allow the most direct flight between two points (e.g., a great circle route), (2) strict adherence to air traffic control procedures for route changes, which sometimes imposes delays, inefficiencies, or denial of requests that in fact might be entirely safe, and (3) dependence on radar for separation standards, which are therefore constrained by the resolution of radar in estimating position (see Chapter 3). In response to these concerns, since 1994 an effort triggered by the airline industry has begun to examine the concept of user-preferred routing or free flight, a concept in which pilots are better able to select their preferred routes, unconstrained by air traffic control (RTCA, 1995a, 1995b; Planzer and Jenny, 1995). This system is designed to allow pilots to take better advantage of local information (e.g., weather) that may not be available to air traffic control and, most important, will allow pilots to rely on the global positioning system (GPS) for navigation and separation that is far more precise than the radar-based guidance available from air traffic control (see Chapter 3). The concept has been developed by a working committee on free flight sponsored by the RTCA, who propose the following definition: A safe and efficient flight operating capability under instrument flight rules (IFR) in which the operators have the freedom to select their path and speed in real-time. Air traffic restrictions are only imposed to ensure separation, to preclude exceeding airport capacity, to prevent unauthorized flight through special-use airspace, and to ensure safety of flight. Restrictions are limited in extent and duration to correct the identified problem. Any activity which removes restrictions represents a move toward free flight. More recently, free flight has been the subject of an intense federally sponsored research program on advanced aircraft transport technologies (AATT), sponsored by the National Aeronautics and Space Administration (NASA) and coordinated by a memorandum of agreement between NASA and the FAA. The FAA has recently published a document identifying 46 critical issues for free flight (Federal Aviation Administration, 1996g), and strategists have been working to define a global plan for the national airspace that maximizes flexibility for all users (Runnels, 1996). Reports based on the AATT program can be obtained from NASA Ames Research Center. There are three drivers for free flight. Two are economic and the third is related jointly to comfort and safety:
OCR for page 229
The Future of Air Traffic Control: Human Operators and Automation Horizontal free flight results in fuel saving by allowing the flying of shorter, more direct routes, ideally following great circle paths, avoiding head-winds or capitalizing on tailwinds. Vertical free flight results in fuel saving by allowing flying at altitudes that have the most favorable winds. Flying around bad weather and clear-air turbulence (both horizontally and vertically) results in passenger comfort and safety. It is important to realize that the concept of free flight is not defined by a universally accepted set of procedures. Different players have very different notions of what it should be, how free it will be, and over what domains of the airspace it will apply (e.g., en route versus TRACON, high altitude versus all altitudes, continental versus oceanic). Some of these dimensions are explored below. However, an important distinction contrasts strategic free flight, in which route planning is done in a manner that is unconstrained by air traffic control (i.e., free scheduling and free routing), with tactical free flight, in which executions of flight path changes, including maneuvers to avoid conflicts, are carried out without air traffic control guidance or instructions (i.e., free maneuvering—Runnels, 1996). A continuum of levels exists between strategic and tactical maneuvering. It should also be noted that at least four characteristics of the current airspace take on some aspects of free flight: Standard flying by visual flight rules removes air traffic control from a great deal of responsibility for route planning and separation maintenance, outside the TRACON area. The FAA is in the process of expanding the national route program, in which aircraft are allowed to file flight plans for preferred or direct routes (e.g., great circle routes, or those that take greater advantage of favorable winds or minimize the effect of unfavorable winds). Initially allowed only at highest altitudes, the expanded program has been "stepping down" flight-levels to a current level of 29,000 ft. The resolution advisories generated by the traffic alert and collision avoidance system (TCAS), discussed in Chapter 5, allow pilots to fly emergency conflict avoidance maneuvers in a manner that is not cleared in advance by air traffic control. Problems revealed by the TCAS program may anticipate some of the issues raised by free flight (Mellone and Frank, 1993). Taking advantage of the high navigational accuracy of the TCAS situation display, the FAA has authorized a procedure called oceanic in-trail climb, whereby aircraft on transoceanic flights can adjust their flight-levels and spatial positions to overtake and pass a leading aircraft that may be slower, hence avoiding the very time-consuming processes of mediating communications with oceanic controllers who have no radar coverage of the aircraft involved (Aviation Week and Space Technology, 1994).
OCR for page 230
The Future of Air Traffic Control: Human Operators and Automation SYSTEM ELEMENTS AND FUNCTIONS The numerous versions of proposed free flight architectures have in common a set of key elements. Global Positioning System and Position Broadcasting Any aircraft must have a very accurate estimate of own position and that of its nearest neighbors. The global positioning system (see Chapter 3) appears to provide this facility and, when coupled with automatic dependent surveillance (ADS-B, see Chapter 3), will enable rapid communications of accurate navigational information between aircraft in close (and hence potentially threatening) spatial proximity. Such information can also be broadcast to air traffic control and airline operations centers. Traffic Display In order to plan conflict-free trajectories and to maneuver around possible conflicts in the absence of air traffic control advisories, pilots will need an accurate cockpit display of traffic information, whose precision and format remain to be determined (Johnson et al., 1997; Merwin et al., 1997; Kerns and Small, 1995). These requirements make relevant a large body of research carried out on the cockpit display of traffic information by NASA in the 1970s and 1980s (e.g., Ellis et al., 1987; Kreifeldt, 1980; Abbott et al., 1980). Such displays are to include an important distinction between a conflict or protected zone, the region of space that would formally define a loss of separation or operational error, and an alert zone. The latter is less clearly defined but would be the level of separation at which an advisory to maneuver would be offered to one or both aircraft. It may also define a time at which air traffic control might be alerted to the possibility that active control from the ground might be required, as such control would need to be exerted prior to a formal loss of separation. Since the parameter dictating the degree of urgency to maneuver is the predicted time to contact (rather than spatial separation), many have considered the alert zone to be time-based, rather than space-based, and hence not simply represented in its geometrical form (e.g., Corker et al., 1997). Current thinking also suggests the need to define different levels of urgency within the alert zone (Johnson et al., 1997). Intent Inferencing Any traffic display designed to alert the pilot to potential conflicts will be beneficial to the extent that it can account for reliable predictive information regarding the trajectory of both aircraft involved. Accounting for the current
OCR for page 231
The Future of Air Traffic Control: Human Operators and Automation velocity and acceleration vector provides a good deal of accuracy in this prediction. But considerably more valid estimates of future trajectories can be gained by knowledge of intent of one or both aircraft in a conflict: Does the potential intruder intend to level-off? Will it slow within the next few minutes? (Geddes et al., 1996). Such intent inferencing (discussed in Chapter 2) can be gained from a variety of sources: current velocity vectors, filed flight plans, information resident in the flight management system, even the active queries of the pilots involved. The further into the future that reliable intent inferences can be made, the more flexibility pilots will have in selecting routes to avoid conflict situations. Rules of the Road The kind and precedence of maneuvers undertaken as two aircraft present a potential future conflict situation will need to be formally established. These will need to go beyond standard FAA guidelines to maintain traffic in sight, yield to the aircraft on the right, or to turn to the right to avoid conflict (FAR 34291, Section 91.113). For example, how much will the same rules apply to all aircraft, and to what extent will smaller (and hence more maneuverable) aircraft be expected to bear a greater burden of maneuvering? How should the pilot trade-off the costs and benefits of lateral versus vertical versus speed change maneuvering (Krozell and Peters, 1997)? A substantial part of these rules may be left flexible to be negotiated between aircraft at the encounter, as discussed below. Air Traffic Control All players acknowledge the critical sustaining role of air traffic control in a free flight system. This role is seen in at least two ways: Any free flight system will need to include both unconstrained (free flight) and constrained airspace. In the latter, conditions of high-traffic-density or the need to maintain regular flow militate against user-preferred routing. For example, it is assumed by most planners that TRACON regions will remain under positive air traffic control. There is always a danger that a potential conflict situation may develop for which pilots involved are unable or unwilling to formulate a satisfactory solution. Air traffic control then must be alert to "bail out" the pilots from catastrophe in such a situation. A large number of issues must be addressed and resolved before determining if a free flight system is feasible in an airspace whose regulators and occupants are committed to safety as a primary goal (White House Commission on Aviation Safety and Security, 1997). We discuss these issues below in two categories,
OCR for page 232
The Future of Air Traffic Control: Human Operators and Automation those pertaining to the airspace system as a whole, and those focusing more directly on human factors. SYSTEM-LEVEL ISSUES Air Traffic Control Role The role of air traffic control in a free flight regime will continue to remain a critical and controversial issue. Indeed, one of the thornier issues concerns the appropriate level of authority that should be maintained by air traffic control (Endsley et al., 1997). On one extreme is a system in which aircraft maneuver as they choose, allowing air traffic control to be only a passive monitor of the changing trajectories, until or unless these lead to danger, and then intervening with control. A more conservative system will require pilots to inform air traffic control of their maneuvers but proceed to carry them out unless vetoed by air traffic control; this level captures the procedural rules involved in following TCAS resolution advisories. Still more conservative is a system not unlike that in existence today, in which pilots request deviations and air traffic control approves. However, under a free flight regime, such requests would be far more frequent (as would approvals), given that pilots would have the equipment (GPS, ADS-B, cockpit display of traffic information) and training to carry them out safely. Pilot's and the Airline Operations Center's Roles Our discussion here has implicitly assumed that the pilot is the one calling the shots in a free flight regime. However, from the standpoint of commercial aviation, the pilot is not necessarily the best originator of unconstrained maneuver plans. Instead, the airline operations center, and its agent the aircraft dispatcher, will probably have far better global knowledge of weather patterns, winds, traffic scheduling, and regional traffic density, in order to make more nearly optimal decisions on route and trajectory changes. Hence, although the pilot may become free from air traffic control constraints, these may be replaced by constraints from the dispatcher. System-Wide Efficiency On paper, convincing cases can be made for the cost savings of direct routings and other free flight concepts (Lee et al., 1997). However, in practice, savings that appear in one place may be lost in others. For example, complex simulation runs have revealed that free flight can considerably lessen the cruise flight time en route between TRACONs (Lee et al., 1997). But much of the time saved may then be lost, as a large stack of rapidly arriving aircraft must now wait at the
OCR for page 233
The Future of Air Traffic Control: Human Operators and Automation feeder gate to a TRACON (constrained airspace), in order to be handled in a less efficient, more sequential fashion by air traffic control. Also, losses of efficiency may emerge from group behavior in ways that cannot easily be predicted in advance. One such loss was revealed by an analysis of aircraft behavior in the expanded national route program by Denning et al. (1996) and Smith, Woods, McCoy et al. (1997). The analysis revealed a phenomenon whereby several aircraft, all requesting the same preferred routing, created a bunching on that preferred route that ultimately slowed their flight, and in some cases required redirection back to the earlier nonpreferred route, now with a considerable loss of time. In this case, flight time is not saved, nor is any workload reduced for the controller. It may well be difficult or impossible to predict other such system-wide effects until or unless a full operational test of the system is in place. Safety Versus Efficiency The pressure toward free flight is primarily efficiency driven. Lee et al. (1997) simulated flying on a set of cross-country routes and estimated a 6 percent fuel savings and, with equal fuel burn between preferred and nonpreferred routing, found an average 15-minute time savings. The FAA has rightfully maintained a conservative stance, driven by safety, in responding to pressures to move toward free flight. But given the recent commitment to reduce accident rates by a factor of five over the next decade (White House Commission on Aviation Safety and Security, 1997), it can be argued that any radical change to an already safe system will at least have the possibility of being safety-compromising. And given the complexity of the free flight concept, accurate assessment of its safety benefits may not be achievable for several years after its implementation. In the Phase I report we pointed out the need for sophisticated modeling of both safety and efficiency parameters of new technologies and procedures. Shepherd et al. (1997) confirm this need and are developing a reduced aircraft separation risk assessment model (RASROM), with the goal of assessing the overall level of safety associated with reducing separation standards and with the introduction of new technology and procedures. Developed under the aegis of NASA's terminal area productivity program, the model incorporates both fault trees and event trees (see Chapter 2 for a discussion of the use of these techniques in failure and recovery analysis). The model takes into account events, behaviors, and parameters (e.g., response times) at levels that do not include elaborate, detailed modeling of the internal processes of complex technologies or of human factors (Shepherd et al., 1997). Valid airspace safety models that include contributions of human operator (pilot or controller) processing are greatly needed in order to predict safety implications of free flight, and compare these implications with those supported by higher levels of ground-based automation, discussed below. For example, Corker et al. (1997) have applied MIDAS, a human-machine system model with valid
OCR for page 234
The Future of Air Traffic Control: Human Operators and Automation estimates of human processing times for different cognitive components, to predicting decision time requirements in different conflict situations. Riley et al. (1996) are working to extend MIDAS to account for errors in interaction between pilots and automation. Equipment Free flight demands special technical equipment: accurate global positioning systems, automatic dependent surveillance communications, and high-resolution cockpit displays of traffic information. Using such technology, the position of fully equipped commercial aircraft can be estimated within a standard deviation of 30 m both horizontally and vertically. However, any airspace that contains at least one aircraft without such equipment is placed at risk in a free flight regime. The FAA will need to continue to protect the interests of general, corporate, and military aviation, so that movement toward free flight will not price these players out of the national airspace. HUMAN FACTORS ISSUES Many of the human factors issues to be addressed in free flight pertain to the infrequent situations in which two aircraft have selected routes that will bring them into conflict. The times available to deal with these conflicts may be predicted to vary from as long as 20 to 30 minutes, to as short as a minute or two. Level of Air Traffic Control Authority How easy will it be for air traffic control to veto inappropriate maneuvers and flight plans, or should these indeed be subject to preapproval? If a controller's conflict probe (discussed in Chapter 6) enables him to predict a conflict within 20 minutes, should the controller intervene or offer an advisory to two aircraft in free flight? One issue concerns the extent to which controllers, rather than pilots, may have better skills, and more global displays, to appreciate global traffic patterns and may therefore be better equipped than pilots to judge the long-range implications of maneuvers. At least one simulation that compared different levels of authority in a free flight simulation revealed that more separation losses occurred under conditions in which pilots had the greatest degree of authority (Endsley et al., 1997). This simulation also revealed that the higher levels of pilot authority led to a degradation of the controllers' situation awareness, an issue we consider next. Equally important are issues associated with ambiguity in authority. Almost any envisioned free flight system assumes regions (or times) in which air traffic control has authority and those in which they do not. At issue are the transition periods between such authority assignments (e.g., transferring from unconstrained
OCR for page 235
The Future of Air Traffic Control: Human Operators and Automation to constrained airspace or from pilot-centered strategic maneuvering to controller-centered tactical maneuvering to resolve a conflict.) Such regions invite ambiguity, and such ambiguity in turn will invite noncooperative maneuvering or unnecessary and time-consuming negotiations (discussed below). Situation Awareness As noted, at least one experimental simulation study revealed the loss of controller situation awareness that resulted from progressively higher levels of pilot authority in free flight (Endsley et al., 1997). The controller's awareness of the big picture may be degraded under free flight for one of three reasons. First, as noted above and repeatedly observed in basic and applied psychological research, when people do not actively direct changes but only observe them passively, they are less likely to remember them (Slameca and Graf, 1978; Hopkin, 1991a). Hence, a controller who passively witnesses a pilot changing altitude will be less likely to be aware of and remember the implications of that new altitude for another aircraft, than if the controller had actively selected the change (or even had to consider and approve it). Second, an airspace that functions under free flight rules will, almost by definition, lose the structured order that enables the controller to easily grasp the big picture (Wyndemere, 1996). Aircraft will no longer be flying linearly along predefined routes, and flight-levels may no longer be evenly spaced and predictably occupied. It is quite possible that an airspace under free flight will yield unpredictable shifts in traffic density, and this in turn may require some degree of ''dynamic resectorization." Given the strong dependence of the controller's mental model on the static, enduring characteristics of a sector (see the Phase I report), these dynamic and inconsistent characteristics invite greater difficulty in maintaining situation awareness. Finally, as noted above, free flight separation algorithms, like those of TCAS, are likely to be time-based rather than space-based. Space can be easily visualized by the controller, but time less so. It is unclear the extent to which this shift may also inhibit controller situation awareness. Controller Workload As previously noted, workload and situation awareness are closely and often reciprocally related, and the mediation of these two concepts by a free flight regime leads to several possible implications. First, under routine conditions, controller workload in decision making and communications may be reduced by free flight (Hilburn et al., 1997), but monitoring workload—a nontrivial source of stress—may be increased. Second, the likely decrease in traffic structure and increase in traffic complexity (Wyndemere, 1996) will impose greater cognitive workload in trying to predict traffic behavior to maintain adequate situation awareness. The increase in controller workload with the decreased structure of
OCR for page 236
The Future of Air Traffic Control: Human Operators and Automation the free flight airspace was observed in the simulation experiment carried out by Endsley et al. (1997). Third, controller workload is likely to be substantially increased under the infrequent but safety-critical circumstances in which two or more aircraft cannot negotiate a conflict-free solution and the controller must intervene. Fourth, as has been noted, increased efficiency of free flight in the unconstrained region may produce traffic bottlenecks at the borders of the constrained regions, hence imposing high-workload to deal with the resulting traffic rush, although the center TRACON automation system (CTAS) can provide a valuable aid here. For the pilot, there is a clear assumption that shifting responsibility for traffic avoidance to the cockpit will increase flight deck workload to some extent. Indeed, the decision in the 1980s not to proceed with introduction of the cockpit display of traffic information was based in part on pilot workload concerns. How much added head-down time will be imposed, as pilots attempt to resolve conflicts with a cockpit display, remains poorly understood, as does the level of cognitive load imposed on pilots as they attempt to chose an appropriate maneuver and communicate with other traffic in doing so. Pilot Maneuver Selection In the tactical aspects of maneuver selection required for predicted conflict avoidance, it is unclear how pilots will allow various factors to influence their chosen maneuvers. Different maneuvers (i.e., speed, heading, altitude control), executed at varying times in advance of a potential conflict, have quite different economic consequences (Krozel and Peters, 1997). But it is not at all apparent that these correlate with safety, and it is not clear how well (or how homogeneously) pilots will achieve the appropriate balance between safety and efficiency. We have noted above that automated assistance in recommending maneuvers will benefit from accurate intent inferencing capabilities. But recent lessons learned from TCAS compliance (Pritchett and Hansman, 1997a, 1997b) suggest that automated advice in air traffic avoidance maneuvers will not always be followed, particularly if the algorithms governing that advice are not well understood by the pilots. In a recent study, Patrick (1996) interviewed a group of 747-400 pilots and dispatchers concerning the qualitative criteria they used (e.g., safety, time efficiency, fuel efficiency) and their relative importance in establishing a flight plan. The results suggest that pilots differ from dispatchers in how criteria are weighted. For example, pilots are charged with ride comfort, which they weigh move heavily than dispatchers; pilots also use a nonlinear trade-off function between time and fuel, whereas dispatchers follow a linear trade-off function.
OCR for page 237
The Future of Air Traffic Control: Human Operators and Automation Negotiations A minimum of two players are potentially involved in any conflict resolution scenario. If conflicts are predicted far in advance, then only the two pilots may be involved in negotiations to avoid. If such negotiations are not completed (or not initiated) progressively close to the predicted time of separation loss, air traffic control is more likely to get involved and possibly desire to intervene. It is also easy to imagine circumstances in which a third aircraft can be a party to the negotiations, if a maneuver by one of the first two may turn it toward the third. The organizational psychology of negotiations and group behavior is poorly understood. Any negotiations once air traffic control becomes a concerned party (because, for example, the alert zone has been penetrated) will be complicated by the fact that pilot-pilot communications may be more rapid (and based on better local information) than pilot-controller communications; there may therefore be times when the lines of authority are blurred. The application of negotiation theory to the free flight regime will become simpler to the extent that clearly defined rules of the road are laid out (e.g., always turn right; the lower aircraft always descends, etc.). Indeed, as in TCAS, it is in theory possible to embody these rules in software, providing expert advice on resolution to two cooperating aircraft. But the lessons learned from TCAS are that these algorithms are far from perfect, even in the relatively simple case of two aircraft and one degree of resolution freedom (vertical maneuvering). It is easy to imagine the far greater limitations of automation advice when applied to free flight conflict maneuvering, given two human pilots who may concurrently possess information that is not available to the automated advice giver. RESEARCH APPROACHES To some extent, knowledge of how best to implement technology in free flight can be gained by applying existing research results (Kerns and Small, 1995). However, any free flight concept now under consideration will involve relatively substantial changes in procedures and equipment from today's practices. One of the greatest challenges is to try to predict the implications of changes in free flight to overall system safety. This is particularly important, given hard numbers on target safety levels imposed by the federal government (White House Commission on Aviation Safety and Security, 1997). Three parallel research approaches are essential to estimate safety implications. First, simulation modeling must be continued and refined. Initial simulations, revealing efficiency changes under a free flight regime (Lee et al., 1997), represent a valid starting point. But, as suggested by Odoni et al. (1997), it is essential that simulation models begin to make assumptions about the human operator. NASA's recent AATT initiative appears to be taking promising initial steps in this direction. A good example of such models is provided by MIDAS,
OCR for page 238
The Future of Air Traffic Control: Human Operators and Automation a complex model including estimates of human processing time, developed at NASA Ames (Corker et al., 1997) and being extended to account for errors (Riley et al., 1996). Major efforts should be made to continue development of these modeling efforts and their validation. Second, it is necessary to collect sufficient amounts of human-in-the-loop simulation data, so that the infrequent but catastrophic consequences are revealed and understood—for example, two pilots involved in a nearly unresolvable conflict. Such data appear to be very difficult and time-consuming to collect (Endsley et al., 1997). Third, extensive reliance can be made on scenario walk-throughs and focus group sessions among controllers and pilots who have been provided with clear descriptions of future assumed capabilities (Smith, Woods, McCoy et al., 1997). These can reveal potential bottleneck areas. A final approach involves not research but rather a design change to greatly increase the safety margin between aircraft, even as the procedures are altered to allow more regular flow (i.e., improve efficiency). In conclusion, we note that free flight is only one of two possible trajectories that may be taken toward increasing flight efficiency. The other—increasing air traffic automation rather than the flight deck capabilities underlying free flight—has been the focus of this report. It is not at all clear whether these represent two closely intertwined parallel paths to the future, or whether their implications for authority are so different that they represent very different paths. Nevertheless, the common concern that both impose for controller awareness, workload, skills, and authority requires a close sharing of lessons between them. THE PANEL'S VISION FOR APPLICATIONS OF AUTOMATION In the panel's judgment, pursuing the free flight concept to achieve high and broad levels of pilot authority has a number of risks for the national airspace, given that the stated policy of the FAA is to guarantee that any proposed changes to the national airspace system's architecture will be at least safety-neutral and should be projected to be safety-enhancing. Considering the number of uncertainties associated with free flight, it seems very difficult to project with any high degree of confidence that it will produce an increase in safety, unless extensive research and modeling is continued. An alternative approach, which we believe has lower safety risks, capitalizes on the strengths of advanced technology and human-centered automation and does so in a way that maintains clear authority for separation with air traffic control on the ground. We project what such a system should look like, anchoring it in our assumptions about human-centered automation and our knowledge of human factors, and also spelling out certain expectations about the evolution of the national airspace system in the next decade. These expectations are consistent with Federal Aviation Administration forecasts (Federal Aviation Administration, 1996a). We also reiterate some important human-centered automation
OCR for page 239
The Future of Air Traffic Control: Human Operators and Automation concerns and show how these should be applied, in order to move toward a national airspace system with increased capacity but no compromise of safety. Expectations In the coming decade, we expect the following developments: The FAA's goal will continue to be one of improving safety (decreasing risk of midair collision and collisions on the ground). Current air routes will become obsolete and will be replaced by many more direct routings. Satellite-based navigation and ADS-B communications, coupled with current radar, and integration of sensor data will allow ground-based air traffic control to obtain increasingly precise and timely estimates of three-dimensional aircraft position, thereby enabling reduced separation and greater capacity in some regions of the airspace. The global positioning system, data link, and ADS-B will be available in nearly all instrument flight rules aircraft, allowing rapid sharing of various kinds of textual and graphical information. Weather information will be greatly enhanced and will be shared among all ground facilities and aircraft. Flight strips will be eliminated and replaced by electronic packages of data that may be represented in different ways on the controller's display and can be readily shared among all relevant parties. Automated tools for medium- and long-range conflict probes (10 to 20 minutes) will be available at all air traffic control facilities (perhaps with the exception of level 3 and below TRACONs). These will provide interactive planning tools, enabling controllers to examine what-if scenarios. The center TRACON Automation System (CTAS) will be available at many air traffic control facilities. Human-Centered Automation Concerns Authority for Maintaining Separation We distinguish between actual authority and perceived authority for separation, and our concern is with both kinds of authority. First, the residence of authority should be as unambiguous as possible to minimize opportunity for confusion between perceived and actual authority. Second, both actual and perceived authority should reside consistently and unambiguously on the ground. The justification is that, if authority is on the ground, it is centralized. Authority in the air in a free flight regime is of necessity distributed among multiple aircraft, dispatchers, and controllers, and its residence will vary over time. Such
OCR for page 240
The Future of Air Traffic Control: Human Operators and Automation variation is an invitation for ambiguity, which in turn will jeopardize safety. An additional justification is that, even in advanced visions of free flight that emphasize airborne self-separation with reduced ground-based control, it is recognized (RTCA, 1995a, 1995b) that ground-based controllers will continue to be responsible for separation assurance and overall safety. Controllers should thus be given an authority that is commensurate with this ultimate responsibility. Failure Recovery Although automation can and does assist the controller in separating traffic, the system should be designed to allow for human control and preservation of safe flight should automation fail, or should there be a failure of one or more components of the system on which the automation depends to function properly. In order to meet this criterion, it is necessary that (1) traffic density is never so great that human controllers cannot make decisions in time to ensure separation because of the effects of density on controller workload, and (2) traffic complexity is low enough so that the controller can maintain situation awareness of traffic patterns (Wyndemere, 1996). Neither traffic density nor traffic complexity should be so high as to preclude the safe performance of failure recovery tasks. Both variables need to be addressed in recovery procedures planning that supports the controllers' ability to perform recovery tasks. Airspace Structural Consistency As we noted in the Phase I report, a major component of the controller's mental model of the airspace is associated with the enduring characteristics of a particular sector (i.e., special-use airspace, traffic patterns, hazards, sector shape). Therefore, although air routes can and should be substantially modified from their current structure in order to improve efficiency, these modifications, once in place, should be relatively enduring. Air routes should not be altered on a flight-by-flight basis. Although more alternative direct routes may be in place, thereby allowing far greater flight path efficiency than in the current airspace, there should be a fixed database of what these direct routes are, and an expectation that pilots will adhere to them (subject to controllers' granting of pilots' requests). Automation of Decision and Action Selection For functions in which decisions are made under uncertainty and impose safety risks, automation of decision and action selection should not proceed beyond the level of suggesting a decision/action alternative as discussed in Chapter 1. If, on the other hand, the risk is low, automation of decision/action selection can proceed to higher levels. An example of the latter is the automated handoff, for which automation of both information acquisition and decision/action
OCR for page 241
The Future of Air Traffic Control: Human Operators and Automation selection has been implemented at a high level because risk and uncertainty are low. Anticipated System Features In order to achieve these goals in a manner consistent with our expectations for the national airspace system, we foresee a system in which the air route structures are considerably altered, enabling far more direct routing and far greater efficiency. More alternate routes between airports may be available, which can be selected given winds aloft and weather conditions. However, these options will remain relatively fixed, and all aircraft are expected to fly along one of the (more numerous) routes, in this way preserving some consistency in the airspace. Flight efficiency will be greatly improved by the availability of these alternatives, but it will not necessarily be maximized. Controllers will have the option of granting special-case excursions from the new standard routes (e.g., because of turbulence or unexpected weather), but these should be exceptions rather than standard procedures. Interactive planning tools will enable these alternatives to be rapidly computed, while maintaining the controller active in the loop. Pilot authority for independent maneuvering (maneuver first, inform controller after) will remain restricted to following TCAS advisories, and possibly intruder avoidance during parallel runway approaches. All such maneuvers will be made immediately visible and clearly understandable by salient cues presented to ground controllers on their displays (Hoffman et al., 1995). Maximum effort will be made to capitalize on existing and future computer technology to facilitate information sharing between ground elements (controller facilities and airline operations centers), thereby preserving and even enhancing the high levels of redundancy that now characterize the air traffic control system. The workstation itself will rely heavily on computer-based automation to make digital flight data available rapidly (and in flexible formats) to multiple agents. These data will be available on the plan view display as well as corresponding representations on the workstations of downstream sectors that aircraft will soon enter. This multiple shared information represents a key feature required for preserving shared situation awareness and the redundancy of the current air traffic control system. Controllers will have available longer term strategic graphic displays (including surrounding sectors) that provide a greater lead time to assist in interactive planning and utilization of decision aids. The plan view or situation displays, however, will always include the presentation of unambiguous status information. Depending on specific system designs and associated procedures, the tasks of the R-side and D-side controllers, as these roles have traditionally been defined, may involve a reallocation of strategic and tactical responsibilities. Electronic flight data are likely to be positioned within the workstations by the controllers
OCR for page 242
The Future of Air Traffic Control: Human Operators and Automation themselves in a way that best enhances them to meet these responsibilities. In conclusion, the panel does not project the above description of such a system as a proposal for what the future air traffic control system should be. We recognize the many person years of effort that the Federal Aviation Administration has given to strategic planning of the future national airspace system (Federal Aviation Administration, 1994b, 1995h, 1995i, 1995j, 1996a, 1996b). The description is not intended to represent a superior alternative proposal. Rather, it represents one alternative that capitalizes on the human-centered automation principles described in this book, is geared toward considerable efficiency improvement, maintains authority for separation in the hands of air traffic control and, by doing so, best serves the interests of safety.
Representative terms from entire chapter: