variation is an invitation for ambiguity, which in turn will jeopardize safety. An additional justification is that, even in advanced visions of free flight that emphasize airborne self-separation with reduced ground-based control, it is recognized (RTCA, 1995a, 1995b) that ground-based controllers will continue to be responsible for separation assurance and overall safety. Controllers should thus be given an authority that is commensurate with this ultimate responsibility.
Although automation can and does assist the controller in separating traffic, the system should be designed to allow for human control and preservation of safe flight should automation fail, or should there be a failure of one or more components of the system on which the automation depends to function properly. In order to meet this criterion, it is necessary that (1) traffic density is never so great that human controllers cannot make decisions in time to ensure separation because of the effects of density on controller workload, and (2) traffic complexity is low enough so that the controller can maintain situation awareness of traffic patterns (Wyndemere, 1996). Neither traffic density nor traffic complexity should be so high as to preclude the safe performance of failure recovery tasks. Both variables need to be addressed in recovery procedures planning that supports the controllers' ability to perform recovery tasks.
As we noted in the Phase I report, a major component of the controller's mental model of the airspace is associated with the enduring characteristics of a particular sector (i.e., special-use airspace, traffic patterns, hazards, sector shape). Therefore, although air routes can and should be substantially modified from their current structure in order to improve efficiency, these modifications, once in place, should be relatively enduring. Air routes should not be altered on a flight-by-flight basis. Although more alternative direct routes may be in place, thereby allowing far greater flight path efficiency than in the current airspace, there should be a fixed database of what these direct routes are, and an expectation that pilots will adhere to them (subject to controllers' granting of pilots' requests).
For functions in which decisions are made under uncertainty and impose safety risks, automation of decision and action selection should not proceed beyond the level of suggesting a decision/action alternative as discussed in Chapter 1. If, on the other hand, the risk is low, automation of decision/action selection can proceed to higher levels. An example of the latter is the automated handoff, for which automation of both information acquisition and decision/action