Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 85
The Future of Air Traffic Control: Human Operators and Automation 3 Surveillance and Communication Surveillance and communication technologies are prerequisite for performing air traffic control functions, and they constitute critical components of the national airspace system infrastructure into which automation has been increasingly introduced. In this chapter, we review technologies that are applied to the surveillance of aircraft, ground vehicles, and weather and to the communication of information. In particular we examine the characteristics of three technologies that enable the acquisition of information (radar, the global positioning system, and weather data processing) and two key features of communication technology (bandwidth and data link). SURVEILLANCE TECHNOLOGIES Two critical types of information that must be acquired, processed, and displayed to controllers are aircraft situation data (e.g., position, identification, heading, speed, and altitude) and weather data. Aircraft situation data are acquired primarily through radar systems, although global positioning system/automatic dependent surveillance applications are under consideration by the Federal Aviation Administration (FAA). Weather data are acquired and presented through a variety of systems. We treat the radar processing system and the global positioning system in detail. The radar processing system is currently the fundamental enabling technology for aircraft surveillance. The global positioning system represents new aircraft surveillance technology that is likely to be a critical component of the national airspace system in the future. The global positioning system may also
OCR for page 86
The Future of Air Traffic Control: Human Operators and Automation permit changes to separation standards, thereby playing a significant role with respect to safety and efficiency. Radar Processing Systems Key Elements and Functionality For en route, TRACON, and tower operations, radar is the primary source of surveillance data used to calculate and predict the position, speed, and course of aircraft. Radar surveillance is not provided for oceanic air traffic control. Within the national airspace system, radar is considered a service delivered to controllers by a radar system consisting of the radar equipment itself, radar processing hardware and software, the display devices used to present the resulting data, and the interfaces among the system elements. The key elements of the radar systems for en route, TRACON, and tower air traffic control are summarized below. There are two fundamental types of radar supporting air traffic control. Primary radar relies on reflection technology that provides data sufficient to calculate the range and bearing, but not the altitude, of a detected object. All en route centers and TRACONs are fed by primary radar. En route centers use the long-range air route surveillance radar (ARSR), which scans a wide area (generally a 250-mile radius). TRACONs use a shorter-range airport surveillance radar (ASR), which scans a narrower area (generally a 60-mile radius). In addition, busy towers are supported by a specialized primary radar, called airport surface detection equipment (ASDE), that detects ground objects. Radar is also a key sensor for detection of weather features. Secondary radar, or beacon radar, usually collocated with primary radar, transmits an interrogation pulse; when the interrogation is received by an aircraft equipped with the appropriate transponder, the transponder replies with codes that indicate the aircraft's altitude and identification; the replies are received by the secondary radar. Secondary radars support both en route centers and TRACONs. Each en route facility is serviced by multiple radar sites, whereas most TRACONs are serviced by a single radar sensor. At the en route center, primary and secondary radar data are processed by the HOST computer's radar data processor. The radar data processor software assesses the quality of radar data and blends radar inputs from multiple sites to provide controllers with the best available targets. The HOST radar data processor, together with computer display channel or display channel complex computers—depending on the facility—process the radar data to identify targets, calculate their positions, track their movements, correlate altitude and identification data with targets, transform the data to display coordinates, and display the resulting information (including target pixels, data blocks, and warnings of conflicts and unsafe altitudes) along with maps and other data seen on the controllers' plan view displays. The enhanced direct access radar channel is a backup processing
OCR for page 87
The Future of Air Traffic Control: Human Operators and Automation suite that performs radar processing and supplies the controllers' displays if the HOST processor fails. Controllers can manually select enhanced direct access radar channel data for display if they suspect the integrity of the HOST radar data processing. At the TRACONs, data processing is performed by the ARTS system. The ARTS system displays relatively unprocessed radar returns to controllers and superimposes on their display alphanumeric information indicating the identity of each target, its altitude, ground speed, type, miscellaneous flight plan data, and warnings of conflicts and unsafe altitudes. TRACONs are not serviced by an enhanced direct access radar channel backup; instead, TRACONs can be supplied, if necessary, by radar data from a connected en route HOST. Under such circumstances, the TRACON relies on the less accurate air route surveillance radar, and controllers must adjust their separations accordingly. Radar data from the ARTS is also supplied to some high-volume towers through a digital BRITE display that is similar to that used by the TRACON controllers. Both the HOST (with display channel complex or computer display channel) and the ARTS perform additional processing to compensate for radar limitations. This additional processing is discussed below. Redundancies Redundancies are designed into the radar processing systems at each level. Each en route facility is serviced by multiple radars that provide overlapping coverage, and each radar transmits its data to the facilities over redundant interface lines. This applies as well to those TRACONs that are serviced by more than one radar site. The en route HOST processor is backed up by the enhanced direct access radar channel processor, and the TRACON ARTS is backed up by the en route HOST. Within the en route center, each computer display channel or display channel complex is backed up by redundant processors. The TRACON ARTS system also includes redundant display processors. At both the en route centers and the TRACONs, the displays themselves are redundant with other displays. In addition, the paper flight progress strips provide backup information in the event that the radar processing system fails. Limitations The radar processing systems are subject to two types of limitation: limited reliability (addressed through redundancy, preventive maintenance, and modernization) and limited accuracy (addressed through processing and new technology). Reliability The radars themselves rely on mechanical components that are subject to failure. This limitation is addressed by redundant radars with overlapping
OCR for page 88
The Future of Air Traffic Control: Human Operators and Automation coverage, by frequent preventive maintenance, and by an aggressive modernization program within the FAA for radars that are approaching the end of their service lives. A more serious concern has been the unreliability of the en route display channel complex and the computer display channel hardware, which represent 1960s- and 1970s-vintage computer technology that is difficult to maintain, and which operate on obsolete software languages that have been altered over the years by software patches in response to site-specific requirements. Although these processors include and are backed up by redundant components, in some cases the radar processing systems have been operating on the backup components alone, because of the difficulty of maintaining the components. However, significant improvements in reliability are anticipated in the future. The HOST processor has been recently modernized, and the display system replacement (DSR) program will modernize, in the near future, the display channel complex and computer display channel processors, as well as the controllers' displays and workstations. Although the ARTS system has also experienced unreliability associated with aging computer hardware and software, its anticipated lack of capacity has motivated its modernization. Concerned by the prospect that its limited capacity (e.g., memory and processing speed) will not be able to withstand projected increases in air traffic and will not be able to support functional enhancements aimed at increasing the throughput of the air traffic control system, the FAA has initiated the development of the standard terminal automation replacement system (STARS), which will modernize ARTS hardware and software. Accuracy Presuming improved reliability associated with the modernization of en route and TRACON radars and radar processing systems, the question of accuracy limitations remains. Radar inaccuracies derive from two basic sources, clutter and misregistration. These inaccuracies are addressed primarily through processing. Clutter refers to objects that are undesirable to display but are nevertheless sensed by the radar. Depending on the perspective of the controller's task, clutter may include terrain, buildings, antennae, ground vehicles, and precipitation. Algorithms in the radar data processor can filter and adjust gains to reduce clutter, and airborne processors can suppress transmissions that confuse the radar on the ground. In addition, radar may be physically adjusted to reduce ground clutter. Processing and physical adjustments that reduce clutter, however, can carry associated risk of reducing desirable information, particularly the depiction of VFR aircraft that are not equipped with mode C transponders. Radar systems are also subject to some inherent inaccuracies. Transponder turnaround error alone can be as large as 0.04 miles (200 ft; 61 meters). Due to azimuth variances, position errors grow linearly larger with distance from the radar site. Although terminal area radars are fairly accurate, en route surveillance
OCR for page 89
The Future of Air Traffic Control: Human Operators and Automation and tracking radars have accuracies of 300-500 meters (Galati and Losquadro, 1986). The range of these systems is limited to 350-400 km due to the horizon. Also, at long-ranges, the position error becomes comparable to the movement of the aircraft between scans. This makes aircraft trajectory difficult to determine (Gertz, 1983). Although satellite-based radar systems can provide global coverage, their accuracies are still comparable to long-range ground radars due to their distances from the targets. The high accuracy and global coverage of the global positioning system could overcome these problems, especially in the en route portion of cross-country and oceanic flights. Radars are also subject to miscalibration or misregistration. To maintain and adjust registration, radar are periodically tested and mechanically adjusted if necessary. In addition, it is standard practice for airway facilities radar specialists to enter numerical corrections into specially designed processing routines, to achieve registration through software. Although processing filters and corrections can significantly compensate for clutter and misregistration, the radar data processing systems are ultimately limited by the accuracies achievable by the radar technology—and these limited accuracies affect the separation standards imposed by air traffic controllers. On that account, the FAA is considering surveillance technologies whose accuracies are better than that of radar, and that could, with effective data processing, permit reduction of separation standards. An augmented global positioning system, discussed below, is a candidate as a future surveillance system. Summary The reliability of radar processing systems is maintained by redundancies designed into the systems at each level. These redundancies include: multiple radars that provide overlapping coverage at all en route facilities and some TRACONs, redundant interface lines, backup radar processing, and redundant display devices. In addition to their other functions, the paper flight progress strips provide backup information in the event that the radar processing system fails. Despite redundant system design, elements of the radar processing system have reached or are reaching the end of their service lives. The FAA response has been vigorous modernization programs that are replacing major components of the national airspace system radar systems; improved reliability is therefore anticipated. Accuracy limitations of the radars are addressed, with generally good effect, by processing filters and corrections. The FAA is considering other surveillance technologies that may provide still greater inherent accuracies.
OCR for page 90
The Future of Air Traffic Control: Human Operators and Automation Global Positioning System Potential Applications GPS and other satellite navigation systems are rapidly becoming vital technologies in hundreds of disparate applications. Aviation has been on the forefront of adopting GPS, taking advantage of its inherent accuracy and worldwide availability. There are obvious applications in air traffic control that could benefit from the use of satellite navigation. However, many complex issues must be considered before GPS can be adopted as an air traffic control standard. GPS was developed by the Department of Defense to provide a simple but accurate worldwide navigation system. Conceived in 1973, GPS became fully operational in 1994 when the last of its 24 satellites was launched (Parkinson, 1996). The concept of using satellites to find position comes from the basic idea that distance equals speed times time. Each GPS satellite broadcasts a radio signal that contains a highly accurate time marker. The receiver generates the same code as the satellite and compares the codes to determine how long it takes for each satellite signal to arrive. Since radio waves travel at the speed of light, the distance to the satellite can be computed. This places the receiver's location on a sphere about the satellite with radius equal to the calculated distance. If the distances from four satellites are computed and the precise locations of those satellites at any moment are known, the receiver's three-dimensional position can be computed as the point at which the four spheres of position intersect. GPS satellites are placed in high orbits that are very predictable. They also carry atomic clocks that are extremely accurate and broadcast position corrections with the timing signal. One of the most attractive features of GPS is its simplicity. It provides the most basic information, position, with a high degree of accuracy that is nearly uniform across the globe. The system can also be used to compute attitude (from multiple receivers) and the higher-order quantities of velocity and acceleration with high accuracy as well. Because it provides such fundamental information, it can be used in all phases and aspects of flight, from takeoff to landing, as well as during taxi. The most obvious use is in aircraft automation. Stanford University has demonstrated the automatic control of a model aircraft from takeoff to landing, using only the differential GPS (DGPS, discussed below) and a pilot on the ground (Montgomery et al., 1995). A GPS taxi guidance system superimposed on a digital map can increase pilot situation awareness and airport safety. GPS also provides an accurate time signal that can be used in communications and other timing applications. Automatic landing systems and instrument flight rules (IFR) guidance are of particular interest. GPS can replace current instrument and microwave landing systems with the added benefit of accuracy that does not degrade with distance
OCR for page 91
The Future of Air Traffic Control: Human Operators and Automation from the runway. Also, GPS approaches can be curved, allowing safer parallel runway landings and denser packing of aircraft in a terminal area. It can effectively reduce the required spacing between planes landing on parallel runways without affecting false and late collision alarm rates. Reducing parallel runway separation or staggered landings leads to increased arrival capacity at airports and reduced delays. This can decrease the need to build new airports or expand existing ones (Gazit, 1996). There are many other applications of GPS to the flight environment. Utilizing periodic aircraft state broadcasts, the system can provide a ground surveillance system that is more accurate and expansive than the current network of radars. This could reduce the number of radar sites that need to be maintained or possibly eliminate them completely. The higher resolution of GPS allows for long-range conflict resolution and could possibly allow smaller aircraft separation standards. This in turn leads to greater airspace capacity. Enhanced oceanic traffic management is also possible with the use of GPS. Besides enhancing the ground control aspect of air traffic control, GPS can also shift traffic management into the hands of the pilots, if this is desirable. Knowing the exact three-dimensional position of his or her plane as well as other aircraft in the vicinity can increase the situation awareness of the pilot. Since GPS can provide the velocity and three-dimensional position information of all aircraft, collision avoidance systems can be greatly enhanced. If these systems are shifted onto aircraft, pilots may be able to react faster because the information link from the ground to the aircraft is eliminated. (However, the workload costs of this added monitoring requirement could offset benefits in response time benefits.) Furthermore, GPS can provide low-cost collision avoidance systems, equaling the current TCAS (traffic alert and collision avoidance system), for all types of aircraft, including general aviation. The three-dimensional and velocity aspects of GPS navigation can be used to augment current displays or develop entirely new ones, including advanced situational awareness displays (Gazit, 1996). GPS combined with a terrain database could provide a more effective ground proximity warning and a recommended escape route to the pilot. All of these applications could shift air traffic control responsibility from the ground to the cockpit, an issue we discuss extensively in Chapter 9. They could lead to a more efficient flight environment by increasing the airspace capacity. Air traffic would benefit from flexible routings, reduced flight times, optimum altitudes, and increased fuel savings. These benefits support free flight concepts. Accuracy The biggest advantage GPS offers is its high degree of accuracy, which is fairly uniform worldwide. Its two-dimensional position information is provided with respect to a common grid reference, but can be adapted to any spheroid model. However, a number of errors degrade the ideal system accuracy, including
OCR for page 92
The Future of Air Traffic Control: Human Operators and Automation selective availability (Hurn, 1989) imposed by the Department of Defense. The standard positioning service, broadcast on the L1 frequency (1575.42 mHz), is available to all GPS users. The Department of Defense also maintains a second frequency, L2 (1227.6 mHz), which is encrypted and can only be used by Department of Defense users. The encryption is known as anti-spoofing. This precise positioning service is more accurate than the standard positioning service, but it is not available to civilians. However, the U.S. Department of Transportation announced that it will choose a second civilian frequency for GPS. The nominal accuracy of the standard positioning service without selective availability is 20-30 meters; selective availability degrades this to 100 meters. When this restriction is removed and the second civil frequency is implemented, an accuracy of 5-6 meters could be obtained (Aviation Week and Space Technology, 1997). The differential global positioning system (DGPS) accommodates the selective availability of GPS. It uses a nearby ground reference station whose position is precisely known. It acts as a static reference point and can calculate the errors in the satellite signals. These errors can then be broadcast to a GPS receiver so its position can be corrected. Differential stations can also act as system signal broadcasters. This provides the receiver with ranging signals from above and below, making the three-dimensional calculations more accurate. The use of DGPS greatly reduces the effects of selective availability. The DGPS produces accuracies of 1-10 meters, even with selective availability, and a special form of the DGPS known as carrier phase differential can yield 5-20 cm accuracies (Navtech Seminars, 1995). Carrier phase differential measures the difference in the phase of the receiver and satellite oscillators. This phase difference can be used to resolve GPS measurements to a much finer level. DGPSs with meter accuracies can cover a wide range. Corrections can even be broadcast over AM and FM radio stations. This technique has already been demonstrated and used operationally in Norway (Aviation Week and Space Technology, 1994). The United States is currently developing a wide area and local area augmentation system, networks of differential stations to provide corrections around and between airports. Stanford University has developed lightweight differential beacons that help achieve centimeter-level accuracies during landings by resolving carrier wave cycle ambiguities (Cohen et al., 1994). The Stanford integrity beacon landing system demonstrated the potential of the DGPS for use in the most demanding phases of flight. Other satellite systems, such as the Russian Glonass system, could be used concurrently with GPS to possibly increase accuracies. Glonass is not limited by selective availability, has L1 and L2 frequencies that can be accessed by civilians, and is more accurate than GPS at higher latitudes because of the Russian satellite orbits.
OCR for page 93
The Future of Air Traffic Control: Human Operators and Automation Availability, Reliability, and Integrity Accuracy is not the primary concern in adopting GPS as the principal means of navigation and surveillance. Questions of availability, reliability, and integrity need to be addressed. In order for GPS receivers to navigate in three dimensions, one must lock onto a minimum of four satellites or signal sources. The current system constellation configuration ensures that at least six satellites are in view at any time from any point on the globe (Parkinson, 1996). However, geography and aircraft attitude may obscure satellites. If a satellite is damaged or fails, a hole appears in the constellation, which can move into and out of receiver view and persists until a replacement satellite can be launched. Solar activity, debris collisions, and deliberate attacks are all possibilities that could result in the loss of satellites. A nuclear detonation in space could possibly render several satellites inoperative and create massive gaps in coverage. These problems could be alleviated by using multiple antennas, launching more GPS satellites, or augmenting GPS with other satellite navigation systems like Glonass and the European INMARSAT 3, which could relay differential corrections. Also, the use of integrity beacons that broadcast system-like signals could help solve coverage problems. Another consideration is the fact that GPS satellites are constantly moving across the sky. Therefore, receivers often have to change satellite sets to keep four satellites in view. Sudden steps in system error can occur during these transitions because of the resolution degradation with only three satellites and the highly dynamic nature of aircraft. However, a proper tracking filter can greatly reduce this problem (Gazit, 1996). Other integrity errors can occur from GPS signals being reflected, fooling the receiver into thinking the path to the satellite is longer. This is a large concern around airports, where there are many structures to reflect signals. Most building are extremely good reflectors of system signals. Advanced integrity monitoring, phase smoothing, and filtering can detect and minimize multipath effects (Marsh, 1994). Interference and jamming are also major integrity concerns. ''Wormholes," areas of high GPS signal interference, have been discovered in several areas of the United States and other countries. Some of these wormholes cover hundreds of square miles (Aviation Week and Space Technology , 1995a). Several causes of system interference are suspected, including VHF/UHF TV signals, hand-held and standard very high frequency transmissions from aircraft, mobile satellite system transmitters, and even VHF omnidirectional range stations. There is also concern about the Glonass system, whose L1 frequency is very close to that of GPS (Aviation Week and Space Technology, 1995a) and may cause interference for some receivers. Besides unintentional interference, the threat of jamming and spoofing of GPS signals also exists. Because these signals are very weak, they are relatively easy to jam. The spread spectrum design of the system complicates the matter for
OCR for page 94
The Future of Air Traffic Control: Human Operators and Automation jammers but does not eliminate the threat (Aviation Week and Space Technology, 1995c). In a series of tests in the United Kingdom, a 1-watt jammer completely stopped all GPS receivers in a 20-mile radius (Gerold, 1994). Defense Research Agency tests found similar results; a 1-watt jammer was able to interfere out to 16 nautical miles (Aviation Week and Space Technology, 1995c). The U.S. Coast Guard has shown that jammers can be constructed for as little as $50 and made small enough to be carried in a briefcase; they would also be virtually untraceable (Gerold, 1994). Spoofing, or imitating a GPS transmitter, may be as much of a threat as jamming. Spoofing is more difficult to detect than jamming and could lead unsuspecting pilots into dangerous situations. It has been argued that wide- and local area differential service can prevent spoofing, but it is also easier to spoof differential signals than the constantly changing satellite signals. Possible solutions to interference, jamming, and spoofing include developing better filtering techniques, encrypting differential signals, and developing better integrity monitoring systems (Aviation Week and Space Technology, 1995c). Integrity monitors are key factors in improving the reliability of GPS. Ground-based integrity monitoring systems have been developed extensively, but they cannot detect faults in the aircraft. Aircraft autonomous integrity monitoring combines GPS signals with inertial navigation system signals using a Kalman filter (Marsh, 1994), but at significant cost. GPS can also be coupled with Doppler and synthetic aperture radar, and multimode receivers can use TACAN and instrument and microwave landing systems as backups. Additional Considerations in Adopting GPS Another major benefit GPS provides is cost savings. Receiver and differential transmitter costs are already low and falling rapidly. A Magellan receiver cost $3,000 in 1989, $1,800 in 1992, and $199 in 1995 (Aviation Week and Space Technology, 1995b). Receivers are much cheaper than the $100,000 ring laser gyro systems used for inertial navigation (Gazit, 1996). The Stanford integrity beacons are small and lightweight, and their price is on the order of low-powered runway lights (Cohen et al., 1994). Also, the production of receivers has increased dramatically, with over 60,000 sets being manufactured per month (Parkinson, 1996). Many other considerations are involved in adopting GPS as a navigation and control system. GPS is currently controlled by the Department of Defense, which will not guarantee that the system will never be denied or degraded (Gerold, 1994). Implementing the system puts the navigation and control capabilities of other nations in the hands of the Department of Defense. What would happen if the United States were to adopt GPS, but other nations did not? All international flights would have to be equipped to handle GPS as well as radio navigation, and a mismatch in procedures would exist. Furthermore, if a foreign country did
OCR for page 95
The Future of Air Traffic Control: Human Operators and Automation implement GPS navigation and control and an accident occurred due to the failure of the system, would the United States be liable? One answer would be to guarantee uninterrupted GPS service and to share control with other nations. Countries could contribute to the costs of satellites and differential stations and to the development of application technologies. However, any kind of payment or contribution implies a say in the management of the system. Also, hostile nations would have access to the same accuracies as the United States. Except for the precise positioning service, this would eliminate any kind of force multiplier advantage the United States gains by employing GPS-based technologies (Gerold, 1994). Special consideration must be taken in addressing the issue of using GPS in air traffic control and air traffic management applications. Utilizing the system necessitates the design concept of automatic dependent surveillance (ADS). In such a system, instead of actively looking for aircraft with radar, each aircraft reports its position and other information (such as velocity, identification, and intentions) to a ground station or other aircraft via a satellite or radio link. This is an entirely new philosophy for the FAA, which now requires that the national airspace system supply independent surveillance for air traffic control functions (Bartkiewicz and Berkowitz, 1993). GPS offers clear benefits over radar, particularly in terms of greater universal accuracy, but the automatic dependent surveillance concept using GPS has some problems as well. Radar systems have update rates between 5 and 12 seconds. Theoretically, the automatic dependent surveillance messages could be broadcast at much faster rates, but air traffic control systems in busy control areas could quickly become overwhelmed and unable to sort a large flow of state messages. Some kind of timing system must be used to ensure automatic dependent surveillance messages can be properly received and processed. Also, in terminal areas, the FAA requires that aircraft data be less than 2.2 seconds old. Of this time, 1.4 seconds have already been budgeted for delays that would fall outside the automatic dependent surveillance link. The propagation time in using a geostationary communication link alone would account for 240 ms of the remaining 0.8 seconds in an automatic dependent surveillance system (Bartkiewicz and Berkowitz, 1993). Minimizing hardware and protocol time delays is a major concern. It would be desirable if the changes to current air traffic control software necessary to incorporate automatic dependent surveillance were minimized. This leads to the idea of automatic dependent surveillance state messages emulating radar returns (Bartkiewicz and Berkowitz, 1993). Although this would smooth the integration of such a system, it does not take full advantage of its capabilities. Though it would be possible for a GPS-based automatic dependent surveillance system to replace the current radar-based system, there are many reasons why this might not be desirable. First, if there is an error in the azimuth of a radar system, this error will be the same for all the aircraft that radar is tracking.
OCR for page 100
The Future of Air Traffic Control: Human Operators and Automation Weather Data for Pilots Pilots currently receive weather data through voice communication with flight service specialists, automated flight service stations, controllers, other pilots, and airline dispatchers; broadcast services and reports from commercial vendors; direct user access terminal systems (DUATs) that transmit reports through personal computers; and on-board radar displays. Currently, some weather data that pilots receive from other pilots and from airline dispatchers is often better than that which can be provided through the air traffic control weather data systems. Therefore, through pilot reports, pilots are a critical source of weather information for controllers. As the weather information presented to controllers improves, future plans will include direct data link of the integrated weather data also provided to controllers through the AOAS (for transoceanic flights), and cockpit display of integrated weather information with prediction capabilities, data linked from the terminal weather information for pilots (TWIP) system. The pilots would then also be provided with graphic display and alerts for microbursts, wind shear, significant precipitation, convective activity within 30 nautical miles surrounding the terminal area, and more accurate weather predictions that could affect airport operations. COMMUNICATION TECHNOLOGIES The acquisition of surveillance information is necessary but not sufficient for effective air traffic management, which also depends critically on the accurate and timely exchange of information between ground and air and, increasingly, between aircraft. Communication Bandwidth Communication exchange was initially supported by radiotelephone and primary radar returns, necessary to locate the plane in lateral airspace. Development of secondary radar (mode C and subsequently mode S) allowed the digital packaging of information between ground and air, so that air traffic control could positively confirm an aircraft's identity, altitude, and a small amount of additional information. Secondary radar is supported by an active transponder within each aircraft. Because each message is directed to an individual respondent, it is a serial system, in which the communication links are increasingly delayed as there are more respondents (i.e., as air traffic density increases). In addition to sending traffic information, mode S radar has supported two other functions. It has been incorporated into TCAS (discussed in Chapter 5), allowing a pair of aircraft to know their rate of closure with respect to each other, and it is being used to support a data link between ground and air (see below). The latter functionality is designed to support a far richer (but therefore slower)
OCR for page 101
The Future of Air Traffic Control: Human Operators and Automation exchange of information, regarding such issues as clearances, instructions, and weather. As noted, the limitation of mode S radar and data link for air-ground communications is in the availability of its data to users, which degrades (due to packet collision on a limited bandwidth) as the airspace becomes more crowded. However, considerable advances beyond this level are enabled by a satellite-based broadcast communication system that can broadcast digital data, in parallel, to a broad range of airborne and ground-based users. Because of this parallel broadcast quality, airborne surveillance, referred to as automatic dependence surveillance-broadcast mode (ADS-B), is not as constrained in its availability by the number of users (i.e., aircraft). Furthermore, the information quantity per message is considerably greater than that of mode S radar. Thus, at a frequency of 1 Hz (defined by the 1 second interval of each information packet), an ADS-B message contains each aircraft's position, trend, and, if desired, intent (e.g., flight plans in a flight management system). Because it enables an increase in both frequency and amount of information, ADS-B supports two potential expansions of the national airspace. First, as we noted earlier in this chapter, ADS-B can potentially serve air traffic control with precise position information, thereby eventually replacing the slower, less accurate, and more expensive secondary surveillance radar. This will depend, of course, on all participating aircraft being ADS-B-equipped, a requirement that is potentially less expensive than a mode S transponder and 1090 mHz receiver. At the MITRE Corporation, work is under way to develop a system, called the universal access transceiver, which is a multipurpose broadcast communication system that enables traffic and weather information to be sent to each aircraft and ADS-B data to be provided to air traffic control (Strain et al., 1996). Second, the higher update rate and accuracy provided by ADS-B may enable more complex flight path negotiations between aircraft than does the present TCAS system. ADS-B is the likely enabling technology to support free flight. Data Link Data link is a set of technologies designed to relay communications between ground and air, using digital information rather than conventional radiotelephone communication channels (Kerns, 1991, 1994). As such it depends on relatively high-bandwidth mode S radar systems at both ground and air. The proposed types of information that can be exchanged include items such as standard clearances and instructions, pilot requests, weather information, airport terminal information services (ATIS) broadcasts, and so forth. Because data link is assumed to be a two-way channel, its description distinguishes between down-linked (air to ground) and up-linked (ground to air) messages. Correspondingly, the human factors issues are somewhat different in the two environments. In the cockpit, data link interfaces are alternatively proposed to reside in a separate console,
OCR for page 102
The Future of Air Traffic Control: Human Operators and Automation embedded within the control and display unit of the flight management computer, or embedded in the multifunction display, an option chosen in the Boeing 777 (Bresley, 1995). On the ground, the displays are positioned as close as possible to, or as windows or overlap on, the plan view or radar display. In both cases, keyboard entry and graphic displays have been the standard approach, although alternative media are being considered. A primary impetus for data link has been traffic delays that are themselves the result of communications bottlenecks. When a controller must share a single radio channel with up to 20 or 25 aircraft, there are times when the competition for this channel can lead to substantial delays, as well as frustration by pilots. One analysis suggested that the airlines lost over $300,000,000 annually as a result of communications-induced delays (Federal Aviation Administration, 1995a; Swierenga, 1994). An equally strong rationale for the development of data link is concern over the vulnerability of standard radiotelephone communications to errors in speech perception and working memory (Morrow et al., 1993; Cardosi, 1993). Nagel (1989) concluded that over half of aircraft incidents are a result of breakdowns in communication. Furthermore, work by Billings and Cheaney (1981) identified 80 percent of information transfer problems as occurring on radio channels, and cognitive task analysis reveals the extent to which human perception and working memory are vulnerable to confusion, expectancy, and forgetting (see the panel's Phase I report). (It should be noted that confusion and expectancy errors occur within the visual display modality as well as the auditory.) These factors provide strong justification for seeking computer automation to directly transfer information, ensuring that it is "permanently" (i.e., until erased) visible (and therefore perceptible) on a display in the form in which it was sent. As a consequence of these concerns, the FAA in 1988 initiated a data link research and study program, aggregating research that had been done prior to that time, initiating new research, and developing a program of airborne simulation and testing (Federal Aviation Administration, 1990b). Kerns (1991, 1994) provides an excellent description of the integration of the human factors work that had been done on data link up to this time. At present, aircraft such as the Boeing 777 are manufactured with the potential to host data link (Bresley, 1995), although the system is not yet implemented in operational flight. ACARS is a digital data link system currently in use, but it interfaces between aircraft and airline companies concerning company business, unlike the proposed data link system that interfaces with air traffic controllers and addresses issues of flight control. Human Factors Implementation A substantial effort has been undertaken by both the FAA and the National Aeronautics and Space Administration, as well as the Programme for Harmonised
OCR for page 103
The Future of Air Traffic Control: Human Operators and Automation Air Traffic Management Research in Eurocontrol (PHARE) in Europe, to ensure that data link is implemented in a successful fashion. Several of the earlier efforts in laboratory studies and part-task simulations are well summarized by Kerns (1991, 1994). Recent studies by the FAA (Federal Aviation Administration 1995a, 1996c) have evaluated the ground system in full mission simulations, and corresponding efforts have evaluated the air side (Federal Aviation Administration, 1996c; Lozito et al., 1993; Gent and Van, 1995). In all cases, overall measures of performance efficiency have been collected and conjoined with more specific assessments of operator workload, opinion, pilot response time, etc. In all cases, the evaluation of data link has been generally favorable, although users have expressed qualifications about its appropriateness in some circumstances. In-the-loop simulations have revealed that a combined voice-data link system enables equal levels of flight efficiency with a reduced number of voice communications and a reduced number of total communications (voice and data link), the latter reduction resulting in part because there are fewer requirements to repeat voice messages (Talotta et al., 1992a, 1992b). The operational data have pointed to specific guidelines for design. Many of these guidelines were compiled in a set of human factors recommendations for data link (SAE Aerospace Recommended Practice, 1994). Furthermore, those studies that have directly compared a data link-equipped aircraft with a radiotelephone-only aircraft have revealed improvements in various levels of air traffic management efficiency (e.g., increased traffic flow, reduced delays; Federal Aviation Administration 1995a, 1996c). However, it should be noted that the most detailed analysis of efficiency gains have compared efficiency in a data link simulation environment with the operational efficiency measures of the same traffic scenario taken previously with live traffic in the facility environment. That is, the latter baseline scenario was used to estimate the efficiency of the radiotelephone performance. Hence, in comparing data link conditions with radiotelephone-only conditions, there were differences not only in the interface, but also in traffic (simulated versus live), the identity of the controllers, and operating conditions (on-the-job controllers versus those participating in an experiment). Furthermore, the baseline data did not include corresponding measures such as workload, which could be compared with the data link condition measures. Nevertheless, it is apparent that the FAA is paying a good deal of attention to human factors issues in data link implementation, as discussed below. Human Factors Issues Cognitive Task Analysis As noted, the baseline system is one that relies totally on voice perception and speech. Given the difficulty a pilot may have in responding immediately to all requests, this system also then imposes on working memory, as the pilot must rehearse instructions until they are implemented in
OCR for page 104
The Future of Air Traffic Control: Human Operators and Automation flight control (or written down), and the controller may need to rehearse requests until they are granted or denied. Furthermore, pilot working memory load will be exacerbated when controller instructions are long or complex (Cardosi, 1993; Morrow et al., 1993). As we noted in the Phase I report, both pilots and controllers often tend to hear what they expect to hear, and lengthy sequences of instructions may be partially forgotten before they can be implemented. Even though procedural safeguards are built into the current system by requiring readback of all communications, this will not prevent a controller from hearing what he or she expects to hear, namely that the pilot will read back the message as delivered (Monan, 1986). If the pilot does not, the error may go undetected. In contrast then, the data link capability guarantees that the message sent by one party will be physically available exactly as sent, on a display screen viewed by the other. It then can be read accurately at any time and is not vulnerable to the same sources of forgetting as is the auditory message (although other forms of error may emerge). An analysis undertaken by Shingledecker and Talotta (1993) suggests that such a system can reduce if not eliminate about 45 percent of the existing communications errors that are made between ground and air. Some have questioned whether a message appearing on an electronic display commands the same sense of immediacy as does an oral communication. Hence, most proposed data link implementations are incorporated along with a distinct auditory alert that announces the arrival of a new text message (Gent and Van, 1995). Although the perception of information by the receiver may be facilitated by a data link system, it is not apparent that the composition and initiation of a message by the sender will be equally improved. Indeed, keyboard interactions are notoriously cumbersome and error prone if they are long, in contrast to the naturalness of voice control, an issue we address in the following section. Furthermore, the interface can become cumbersome in retrieving previously received messages, if care is not taken in design. An important issue relates to the time requirements of data link versus radiotelephone communications. On the ground side, Wickens, Miller, and Tham (1996) have observed that the delays in responding to pilot requests are approximately 3 seconds longer when controllers perceive requests presented by visual as compared to voice (radiotelephone) display. On the air side, there appear to be few substantial differences in pilot response to data link versus radiotelephone instructions (Kerns, 1994). However, Gent and Van (1995) have found that pilots respond significantly faster when data link messages are redundantly conveyed by synthetic voice (than by visual display only). Finally, analysis of the total transmission time, which is the time between the initiation of a message by air traffic control and receipt of acknowledgment that the message has been received, suggests that this may be nearly twice as long for a visual-manual data link system (around 20 seconds) as for a radiotelephone system (around 10 seconds) (Kerns, 1994; Waller and Lohr, 1989; Talotta et al., 1990). Measures of
OCR for page 105
The Future of Air Traffic Control: Human Operators and Automation total transmission time taken in more recent simulation (Federal Aviation Administration 1995a, 1996c) suggest that the measures of data link total transmission time may be somewhat less than the values of the earlier studies, being closer to around 15 seconds on average. The total transmission time delays tend to be longer with nonroutine communications and in the final control sector before landing (Lozito et al., 1993). The total transmission time delay issue is quite important, not only because longer delays will reduce data link efficiency, but also because they will lead controllers to abandon the use of data link in preference for more rapid radiotelephone communications (Talotta et al., 1992a, 1992b). Given the differences in response time and total transmission time between the two modes, a consensus is emerging that any effective data link system should provide redundant means of transmitting information along either channel and, furthermore, that data link messages should be primarily associated with routine communications (e.g., standard clearances, airport terminal information services), whereas radiotelephone channels should be used for the more unusual instructions and requests (Kerns, 1991, 1994; Gent and Van, 1995). This distribution has two advantages: (1) the nonroutine requests will be delivered over the more attention-capturing auditory channel and (2) more unfamiliar communications can be initiated over the more natural voice channel, hence minimizing the number of keystrokes. Thus, in summary, it appears that on both the ground side and the air side, data link provides more accurate, but slightly slower communications. Workload The workload issues associated with data link represent some of the greatest human factors concerns, both in the flight deck (Kerns, 1994; Groce and Boucek, 1987; Corwin, 1991) and on the ground (Programme for Harmonised Air Traffic Management Research in Eurocontrol PD1, 1996; Nirhjaus, 1993). In each environment, three issues are raised: What is the workload imposed by the task of initiating and receiving communications with the data link? What are the implications of the demand for the visual-manual channels necessitated by conventional data link on ongoing flight or air traffic control tasks, most of which themselves are visual-manual? How does data link affect strategic workload management? With regard to the workload of the data link task itself, there is considerable consensus that the composition and initiation of lengthy keystroke messages by either ground or air personnel involve considerably higher workload than spoken messages. This appears to be a particularly strong source of complaint for pilots (Gent and Van, 1995). One solution has been to try to predefine ''macros" such that a more complex message can be sent with a single keystroke. In some cases,
OCR for page 106
The Future of Air Traffic Control: Human Operators and Automation this may involve constructing a predefined list, prior to a flight, on which the messages can pertain to the particular geometry of the flight plan. On the air side, Hahn and Hansman (1992) have found that graphic depiction of data link routing information received from the controller and embedded in the electronic map display imposes lower workload than either text or spoken representation of the same spatial information. Another solution, evaluated on the ground side (Programme for Harmonised Air Traffic Management Research in Eurocontrol PD1, 1996) has been to try to maximize the intuitiveness of the command interface, via a mouse windowing menu-type of environment, in which predefined options can be easily selected and then up-linked. Such approaches were documented to reduce various measures of controller workload. With regard to the second workload issue, interference with ongoing tasks, a major concern has been the "head-down time" imposed as pilots read data link information (Gent and Van, 1995; Groce and Boucek, 1987) and, to a lesser extent, the time that the controller must divert gaze away from the plan view display (Programme for Harmonised Air Traffic Management Research in Eurocontrol PD1, 1996). It turns out that this competition for visual resources is not trivial. Even in dual-seat cockpits, when the pilot not flying is responsible for handling the procedures associated with data link, the pilot flying may avert his gaze to cross-check data link information (Gent and Van, 1995). These findings have led to proposals that a primary data link printed message be supplemented with a synthesized voice transmission of the same material, hence offering all the well-known benefits of redundancy gain (Wickens, Miller, and Tham, 1996; Wickens, 1992; Kerns, 1994). Such a procedure was found to reduce the amount of head-down time spent by the pilot flying (Gent and Van, 1995). On the ground side, design efforts have been implemented to try to present down-linked messages visually, but as close as possible to the plan view or radar display, either as windows on the margin of the display (Programme for Harmonised Air Traffic Management Research in Eurocontrol PD1, 1996; Kerns, 1994; see Figure 3.2) or directly incorporated into the flight data blocks or the spatial depiction of flight trajectories (Wickens Miller, and Tham, 1996). Finally, because data link does allow a relatively enduring representation of text (or graphic) information, it should allow pilots more flexibility, for example, in completing high-priority, interruption-vulnerable tasks (i.e., checklist procedures). Supporting this conclusion, Lozito et al. (1993) found that pilots were more likely to carry out other tasks, between receipt and response to communications, over data link than over radiotelephone channels. Communication Communication is at the core of data link, and we have already discussed several issues related to this process. Another issue pertaining to the message delivery itself concerns the sorts of communication errors that might be committed by keystrokes in a data link system and the sorts of error-trapping
OCR for page 107
The Future of Air Traffic Control: Human Operators and Automation FIGURE 3.2 Sample of data link information at the controller's workstation. The sample shows experimental display of resolution advisory data down-linked from the traffic alert and collision avoidance system (TCAS). Source: Photo courtesy of the MITRE Corporation. mechanisms that may prevent these errors from turning into system errors. Currently the data link system is designed so that the pilot, upon reading a message, can respond with a "Wilco" (will comply) message, which implicitly suggests that the message has not only been understood but also can be carried out. However, there is no guarantee that the same problems of top-down processing (seeing what one expects to see) may not be present here as they have been observed with auditory communications (Kerns, 1994). That is, a pilot might "Wilco" a message without fully considering its implications. This issue has not been examined. Furthermore, as yet, no specific examination of keystroke errors in data link usage has been carried out to compare, for example, their frequency relative to the frequency of communication errors with an radiotelephone system (Cardosi, 1993). It is also possible that data link systems may inhibit the tendency for pilots to follow up messages with requests for clarification, as they often do with radiotelephone
OCR for page 108
The Future of Air Traffic Control: Human Operators and Automation systems. Furthermore, data link will not permit the passage of nonlinguistic information, like the sound of urgency in a pilot's or controller's voice. Communications with data link has at least two broader implications. First, considerable concern has been expressed that personalizing the communications channels between each pilot and the controller will deprive other pilots of important party-line information that may help them update or maintain their situation awareness of the status of the surrounding airspace (Midkiff and Hansman, 1992; Gent and Van, 1997; Federal Aviation Administration, 1996c). For example, one pilot can certainly benefit from hearing that a pilot ahead has encountered turbulence, or that several ahead are forced into holding patterns. The desirability of obtaining such party-line information by pilots is well documented (Midkiff and Hansman, 1992), and at least one case has been documented in which the advanced knowledge of an aircraft's presence, gained from party-line information, was partially responsible for preventing a midair collision (Danaher, 1980). Although no negative impacts have been observed as a consequence of party-line deprivation in data link simulations, a fairly strong recommendation can be made that a data link system should retain the capability of sharing certain forms of critical information regarding issues such as weather, particularly in the terminal area. This is consistent with the idea that nonroutine information could be allocated to radiotelephone channels. Hazardous weather conditions would certainly fall into the nonroutine category. The second way in which data link affects communication and teamwork issues is in the sharing of duties between players, both on the flight deck and on the ground. On the flight deck, fairly clear lines of responsibility can be allocated between the pilot flying and the pilot not flying, with the latter maintaining full responsibility for managing the flight trajectory. However, as noted, the pilot flying cannot be expected to ignore data link channels entirely. Furthermore, unless data link messages are redundantly presented via voice synthesis, the pilot flying will be less aware of potentially important up-linked information that would have been shared under a radiotelephone system. On the ground, the FAA simulations have revealed the positive benefits of data link, in terms of load sharing and the flexibility of distribution of responsibilities, when traffic load becomes quite high (Federal Aviation Administration 1996c; Talotta et al., 1992a, 1992b). Unlike the dedicated radiotelephone communicator on the R-side of a workstation with the conventional system, a data link system can allow various operators to assume temporary responsibility for certain aspects of communications (or communications with certain aircraft). In simulations, this flexibility has been found to provide an unexpected benefit to control efficiency. However, it should be noted that the flexibility of loosely defined responsibilities can have its down side, unless careful training of the team in resource management is implemented, so that shifts in responsibilities are clearly and unambiguously annunciated, a recommendation articulated by the
OCR for page 109
The Future of Air Traffic Control: Human Operators and Automation investigators in the FAA simulation (Federal Aviation Administration, 1996c). Parallel findings have been observed in the flight deck and are incorporated into crew resource management training programs (see the panel's Phase I report, Chapter 7). Organization The possible direct link between data link and the flight management system (FMS) allows for the possibility that information could be directly passed from airline dispatchers to the aircraft, hence potentially bypassing the controller (and even the pilot). Automation Issues Data link is itself a form of computer-based automation. But within the data link system, various higher levels of automation have been proposed. Various forms of computer-based automation can assist in message composition, hence reducing workload (Kerns, 1994; Programme for Harmonised Air Traffic Management Research in Eurocontrol PD1, 1996). An even more critical concept is message gating. This involves a system in which an up-linked message can be directly passed into the flight management system with one or two keystrokes, without requiring the pilot to read the message and enter it manually (Gent and Van, 1995; Federal Aviation Administration, 1996c; Waller, 1992; Knox and Scanlon, 1991). This gating process can be carried out at three critical levels of automation. At the lowest level, the pilot may read the display, acknowledge with a Wilco keystroke, and then proceed to load the information manually into the flight management system. At a higher level of automation, activation of the Wilco key will automatically load the information into the flight management system. At a still higher level, such information will automatically be loaded into the system as it is up-linked and will proceed to affect the aircraft trajectory unless the pilot intervenes. There is relatively substantial agreement among pilots that such a gating system is of benefit, both in reducing workload (and head-down time; Gent and Van, 1995) and in reducing the possibilities of keystroke errors that might result if the data were entered manually (Waller, 1992; Knox and Scanlon, 1992; Gent and Van, 1995). However, two concerns with such a system should be noted. First, it is possible that it might lead to complacency and relatively automatic acceptance (and entry into the flight management system) of the message, with less careful evaluation than would be done with manual entry. The lessons learned regarding complacency in response to reliable automated actions are well documented. In this regard, Hahn and Hansman (1992) found that graphic presentation of up-linked routing messages (on the horizontal situation indicator) provided a better means for the pilot to identify inappropriate instructions than did text messages.
OCR for page 110
The Future of Air Traffic Control: Human Operators and Automation Although Gent and Van (1995) did not find that pilots reported a loss of situation awareness with such a gating option, it is important to realize that self-report of awareness will not necessarily be the same as actual awareness. The second concern is the possibility that designers may create a system in which the message is automatically loaded into the flight management system prior to a pilot's decision and the pilot would simply have the authority to activate it. It appears that this further removal of the pilot from the control loop would be a clear invitation to complacency. Given possibilities envisioned by the different levels of gating, it is feasible that a system could be designed that allows alternative gating modes. Such a system will invite confusion: a pilot, for example, may assume that a message was automatically loaded into the flight management system (high automation, low gating), when in fact it was not. In conclusion, the introduction of data link has profound implications for workload, for communications, and indeed for the overall structure of the national airspace system, characterized by the relationship between pilots, controllers, dispatchers, and automation. With modest goals, it is possible to envision a system that is designed primarily to provide a visual record of material transmitted by conventional voice channels. At the other extreme, it is possible to envision a scenario in which both human elements, on the ground and in the air, are substantially removed from the control loop, while control is exercised between computers on the ground and in the air. Although planners do not currently intend such a scenario, the possibility nevertheless exists that levels of automatic control and gating could be implemented that approximate this kind of interaction.
Representative terms from entire chapter: