Appendix A - Single European Skies - Technical Issues

Appendix B - IFATCA policy on Automation / Human Factors

Appendix C - The Role of the Controller in the future ATM system

1. INTRODUCTION

1.1 In 2001 the Guild adopted policy on computer assistance for controllers. This policy augmented existing IFATCA policy for use in the UK. We refrained from discussing policy on automation at that time. The International Federation of Air Traffic Control Officers (IFATCA) only has policy on what IFATCA terms the Human Factors elements of Automation. In fact their policy is much wider in scope than that and it deals with what in the Guild we describe as "Professional" issues relating to the use of automation. This policy is reproduced in full in Appendix B.

1.2 Put simply the impact of automation on controllers will be not only on how controllers work but also on their role and responsibilities. Controllers have lived in an environment of constant, if usually gradual, change ever since the Air Traffic Service was born. It is something controllers expect and controllers are good at dealing with change. Changes to controllers’ roles and core responsibilities have been less frequent. Such change has traditionally been treated with caution, even suspicion, yet is in this area of roles and responsibility that automation will have the greatest impact. This paper will review the likely impact of automation on the roles and responsibilities of controllers and will make recommendations designed to safeguard controllers, especially from the risk of retaining responsibilities that controllers can no longer honour.

1.3 A second equally important issue is what role, if any, we can play in the future in the event of a catastrophic system failure during peak traffic levels.

1.4 IFATCA Policy is very good at looking at the impact of automation in these areas. For almost every aspect of our needs in the UK the policy is practical and relevant. There is however one paragraph, written some time ago, that may promote an appealing principle but it does not seem to align with the issues inherent in future ATC systems that are actually under development. The paragraph states……….

"Automated tools or systems, that support the control function, must enable the controller to retain complete control of the control task in such a way as to enable the controller to support timely interventions when situations occur that are outside the normal compass of the system design, or when abnormal situations occur which require non-compliance or variation to normal procedures".

And in particular the phrase ", must enable the controller to retain complete control of the control task".

1.5 This paper will compare this policy with the likely effect of deploying so called first generation controller tools in UK and will seek to identify any anomalies.

1.6 This paper identifies new policies on automation in ATC to enable the Guild to engage with providers and regulators on the subject of systems proposed for actual deployment in the UK. These same systems are under active consideration for adoption by at least two other major European ATS providers.

2. DISCUSSION

2.1 The need for additional policy

2.1.1 IFATCA’s policy is supportive of a human centred solution to ATC automation, a "hybrid" system in which controllers retain responsibility for their existing tasks with automation working at the periphery of that task to enhance the controller’s personal capacity. It proposes that all solutions proposed by automation would be interpretable by the controller, who can then apply an informed veto to "unacceptable" solutions.

2.1.2 There is however no evidence of any ATS provider, investor or system manufacturer developing such a system. Future ATM systems almost exclusively propose derivatives of a trajectory based ATC system in which the controller becomes a task driven problem solver. They assume a significant shift in role and responsibility for the controller, with many tasks such as conflict detection, presentation and resolution design assistance being all or partly automated.

2.1.3 The systems referred to in 2.1.1 have three difficulties to overcome. Firstly there are NO such systems, yet they will be needed within a decade and they will be expensive. Secondly they would only be ways of transiting to automation when in fact the automation is already developed and can be deployed in the next 10 years. Thirdly they are very easy for non ATCOs to criticise; as systems designed to perpetuate controller status and job satisfaction.

2.1.4 We respect IFATCA’s policy in respect of human centred systems, however with the proposed introduction of iFACTS in the UK within a decade we also need policy now on the alternative concept for future ATC to augment IFATCA policy.

2.2 Features of automated future ATM systems (based on en-route control examples)

2.2.1 A summary of technical issues of future ATM systems written by the Guild for IFATCA is reproduced in Appendix A. Please note that this was written for non controllers.

2.2.2 The Role of the Controller in a future ATM system as described in the Eurocontrol draft Operational Concept Document V2 is reproduced in Appendix C.

2.2.3 The normal airspace model would, as now, be for the airspace of a centre to be divided up into sectors controlled by a planner and tactical controller. Working with trajectories tends to change the role of controller teams, as sectors would frequently inherit partial or even complete solutions to problems in their own airspace from a preceding sector. It is likely that these sectors would be relatively symmetrical in shape and the use of vertical sectorisation would diminish. Theoretically, in the most advanced concepts for use in 20 or more years, the sectors could be purely geometric, administrative divisions of airspace between controller teams.

2.2.4 The control techniques would be based on minimum intervention techniques, more familiar to oceanic controllers than domestic airspace controllers. Whether through ground modelling or networking via datalink, a planning controller would receive a request to accept a proposed trajectory for an aircraft approaching the sector. Trajectory proposals replace existing co-ordination techniques, which seek to fix conditions for an aircraft’s entry into the sector against a known point in space through which the aircraft will pass. In at trajectory based system the aircraft’s position in four dimensions is "known" at every point along its route. Unless there is a known conflict or promulgated procedural constraint the controller’s task is to facilitate the proposed trajectory without imposing any constraint. This is accomplished through a series of tasks that are presented to the controller for action.

2.3 The future roles and responsibility of controllers

2.3.1 Appendix C draws together various paragraphs from the draft version 2 of the Eurocontrol Operational Concept Document. Two significant paragraphs are reproduced below.

2.2.2 "At present the most important cognitive processes of the multiple tasks conducted by the controller are the perception of information, information selection, information integration, planning, and decision-making and the maintenance of a mental picture of the air traffic situation (situational awareness). A major issue in this area will be whether or not it is possible, with a change of roles, to rearrange the situational and cognitive elements which feed awareness so that a controller only has to keep a mental picture of a limited portion of the overall traffic situation". (Eurocontrol Operational Concept Document)

2.3.3 "Tools for conflict detection and conflict resolution are likely to impact on the knowledge and prediction of future events.. The higher the level of automation is, the more difficult is maintaining the situational awareness. Therefore human machine interfaces will have a deep impact on controllers possibilities to handle unusual situations and it is crucial to keep the interface appropriate and intuitive." (Eurocontrol Operational Concept Document)

2.3.4 Trajectory based systems would employ medium term conflict detection, and to all intents the task of conflict detection is automated. When a conflict is identified, its presentation is also displayed using automated tools. These may show the relationship between conflicting aircraft in both vertical and azimuth displays, as well as indications of how soon conflicts will occur, how close aircraft are forecast to come and what type of conflict it is expected to be. The controller’s task is to take the conflict predictions as presented, to prioritise and then to resolve them.

2.4 System failure, the controller’s role.

2.4.1 "Automation needs to be implemented in a way that allow the human to build on his ability to ensure safe recovery of real time events, should system failure occur. Operational concepts, procedures and the design of automated systems have to include such properties if a safe operation should be assured. (Eurocontrol Operational Concept Document)

2.4.2 One purpose of automation is to enhance system capacity by taking the ATC system to a capacity level that cannot be achieved by manual techniques. Should therefore a catastrophic system failure occur the controllers could in the worst case be presented with a traffic situation beyond their ability to interpret or control. The OCD acknowledges in paras 2.2.2 and 2.2.3 the possibility of a degradation of situation awareness and other skills and that a human will need assistance in the event of a failure.

3. CONCLUSIONS

3.1 It is the case that the impact of automation will cause a change of role and that the change will make it unwise for controllers to continue to accept responsibilities that will become increasingly difficult to fulfil.

3.2 The increasing use if controller tools, and the evolution to a task driven role could impair a controllers "picture" and make a controller increasingly dependent on automation.

3.3 System algorithms and logic, designed by scientists and engineers, are often at variance with the mental processes of controllers. Although a machine and a controller may designed the same solution, the process by which a machine develops it conclusions is not necessarily obvious or logical to a controller. This makes it difficult for a controller to validate the output of automation, even if the controller had time to do so.

3.4 Peak traffic levels will be sustainable only with the contribution of automation. In the event of a catastrophic system failure under peak traffic conditions, a controller’s ability to provide an effective manual recover will be so limited that an alternative approach should be considered and implemented.

4. RECOMMENDATIONS

4.1 This Guild is not opposed in principle to the introduction of automation in the form of controller tools, decision support tools, automated tools and assistance. However in order to protect controllers it believes that the introduction of such systems has wider implications than just the technical issues and that a wider debate on the proposed introduction is required.

4.2 The proposed introduction of controller tools, decision support tools, automated tools and assistance requires in each case a formal operational, human factors and regulatory review of the impact on the future role and responsibility of controllers.

4.3 The review should consider in particular:

The potential degradation of the controller’s dynamic traffic model "the picture" and the impact of any such degradation on the ability of a controller to honour existing responsibilities.

The potential for controllers to become reliant on the tools and the consequences of that.

The controller’s ability to safely contribute at all to continuing service provision in the event of a catastrophic system failure at peak periods.

Appendix A

Single European Skies - Technical Issues

Look behind the apparently huge variety of technical solutions proposed to provide more airspace capacity and it is clear that only one solution is on offer. That solution is to manage the trajectories of aircraft and to absorb capacity delays on the ground, so that once an aircraft is airborne only minimum intervention by air traffic control is necessary. There are however many ways proposed to achieve this solution, and each poses as many questions as it answers. There is for example a great debate about the future roles of both pilots and controllers in this new organisation and about the use of automation in the cockpit and the controller’s work station.

Lets start by clarifying briefly how ATC in Europe works now, and then try to identify what changes are to come and what issues they raise.

Air Traffic Control in Europe is currently divided up into six specialist areas:

Aerodrome control, the bit the public sees, where controllers in the visual control room of a control tower separate aircraft on and in the vicinity of an airfield from each other, vehicles and obstructions.

Approach control, which separates arriving, departing and over-flying aircraft at an airfield.

Terminal control, which separates aircraft operating into and out of multiple airfield groupings

Enroute control, known as Area control, which controls aircraft flying between airports or airport groups.

Oceanic control, a self explanatory but highly specialised control task which increasingly used satellite technology to enable aircraft to make automated position reports and to provide a communications link between pilot and controller. The satellites are used to relay those instructions and reports from over the horizon, enabling controllers to separate aircraft over many thousands of kilometres.

Military control, another specialist area, which controls military traffic between military airfields and between military airfields and training areas.

Each control unit also provides a flight information service to pilots and an alerting service in the event that an aircraft suffers an emergency. Each type of air traffic control service is usually provided within some kind of dedicated or "controlled" airspace into or within which flight can only take place with the permission of air traffic control. An airfield might have a control zone, which is linked with other airfields close by through a terminal control area. These terminal control areas are in turn linked by airways, aerial autobahns at least 10 nautical miles wide and hundreds of thousands of feet high.

The airspace allocated to terminal control or area control can be very large. This airspace may be divided up between one or more air traffic control units, and within each unit the airspace is further divided into sectors. Each sector will be controlled by at least one controller, but it is more likely that a team at least two controllers will be responsible for a sector.

People outside aviation often misunderstand the term "separation" as applied between two aircraft. Separation is not just collision avoidance. Collision avoidance is achieved by the use of an extreme manoeuvre by one or both aircraft. Separation is achieving by applying internationally agreed flight times or physical distances between aircraft. Aircraft are usually separated vertically by a distance of 1000 feet. If a controller is using radar to separate two aircraft, the lateral distance required between the two aircraft is usually five nautical miles. Manoeuvres that aircraft fly to ensure that separation is achieved are quite gentle. A passenger may never even notice the change in attitude, heading or height.

Holding is another often misunderstood procedure. Aircraft do not arrive at an airport in a regular controlled sequence, and the rate of arrival may exceed the landing rate. If an airfield can land 30 planes per hour and the airlines and the airport schedule 40 per hour, the surplus of 10 flights must be held in the air. The aircraft usually fly in a regular pattern overhead a radio beacon until such time as they can be accepted by the airfield. Holding is a technique that allows controllers to accept aircraft in large numbers and then regulate the flow of arriving traffic to match the runway's capacity.

In some areas of Europe's airspace, unrestricted air traffic flows would overload airspace, routes and controllers and would risk losses of separation between aircraft. To prevent this a process called air traffic flow management is applied, centred on Eurocontrol's Central Flow Management Unit in Brussels. This unit issues "slots" in the form of permission for an aircraft to use European airspace providing its takeoff within, or entry into, Europe's airspace takes place at a certain time.

Now lets consider how the system might evolve by 2025.

In current air traffic control systems, enabling an aircraft to climb and reach its requested flight level and follow its required route is achieved through the culmination of a series of actions by several controllers at one or more units.

This technique has evolved to control aircraft when, for planning purposes, controllers have a precise estimate of the aircraft’s future position only at certain pre-determined points, but not at every point on its trajectory. Effectively they have only a three dimensional knowledge of an aircraft’s position at each of a number of significant points along its cleared route. Planning separation is therefore limited to identifying and resolving conflicts at these points, with a reliance on radar monitoring and tactical control to resolve other conflicts that may arise between these significant points.

Future technical concepts for Air Traffic Management in Europe intend to escape from the limitations of this three-dimensional straitjacket in order that controllers can have knowledge of the entirety of the trajectory of an aircraft. This allows the controller to approve or design conflict free trajectories based on the user-preferred trajectory of the aircraft. In order for such a system to work, alternative conflict detection and conflict presentation systems are required and these are described as decision support or advanced tools.

To give an example of how an advanced tool might be deployed, take as an example an aircraft departing to the south from Glasgow airport in Scotland. The aircraft is requesting a cruising level of 37,000 feet or Flight Level (FL) 370. Currently the aircraft’s trajectory is achieved only after several height constraints are imposed. These might be at seven thousand feet by Glasgow airport, FL 250 by the Galloway sector, and then a number of options during which further climb may be permitted by a higher Scottish sector and/or one or two London sectors before the final flight level is achieved. In addition certain potential conflicts may be detected and so additional level constraints and lateral deviations may be issued.

In the future, by using computer assistance and automation, the Galloway controller would know before the aircraft even called what, if any, conflicts there were along the next 500 km or more of the aircraft’s route. If there were none, there is no reason why the Galloway controller could not climb the aircraft without any constraints imposed. Currently such a climb requires approval in advance between sectors, a process known as co-ordination. In the future, other sectors along the aircraft's trajectory would inherent the Galloway controller’s solution. As all sectors and centres would work from the same networked data then all other aircraft in the sectors along the route that interacted with the Glasgow departure would be known in one form or another to the Galloway controller.

When sufficient aircraft are fitted with the appropriate equipment, the modelling of aircraft trajectories can be improved by obtaining actual trajectory data from the aircraft via an automated air/ground datalink. The overall aim of these changes is to provide controllers with increasing degrees of separation assurance between aircraft trajectories and also to provide both medium term conflict alerting and safety nets to detect evolving or sudden changes in the traffic scenario.

The most comprehensive demonstration of how Europe's Air Traffic Control could evolve over a quarter of a century was conducted under Eurocontrol's PHARE programme that sought to bring together ideas for the control of aircraft in all phases of flight. PHARE demonstrated an air traffic control system in which early conflict detection, and the early presentation of those conflicts to controllers, was automated. The controller's responsibility was to resolve the conflicts by manipulating the trajectories of conflicting aircraft. As four dimensional trajectories can be difficult for a controller to interpret manually, computer assistance is required to help the controller interpret any conflicts and then to design solutions that require minimum intervention with the aircraft's preferred trajectory. The use of air ground datalink  is an essential component in requesting trajectories from aircraft, offering pilots conflict free trajectories and allowing some negotiation between pilot and controller.

In order to eliminate holding under normal circumstances, delay would be absorbed on the ground before departure. Networked traffic management systems would determine the takeoff time and arrival time, and would calculate any speed or route changes required enabling the aircraft to arrive at its destination without having to hold.

So what are the technical issues to be resolved between now and 2025 in order for air traffic control to meet the required capacity?

Ensure that controllers in Europe receive all the necessary information on every flight that will enter their airspace. That information needs to be presented to controllers at a time and in a way that allows the controller to detect and resolve conflicts through the application of standard separations, even if the method by which they are applied relies on automation.

Ensure that controllers in Europe receive all the necessary information on what airspace and routes are available to them in order to provide aircraft with conflict free routings that match as closely as possible to the aircraft's preferred trajectories.

Even a relatively conventional new air traffic control system can take up to eight years to introduce. Many of the more ambitious projects world-wide have taken typically between twelve and fifteen years. Over the next 10 years, European air traffic control will need to commission several generations of digital networked systems all arguably more complex than those in operation today.

Many of the planned improvements in air traffic control will require equivalent equipment changes in aircraft too. Many of those aircraft that will be flying in public transport service in 2025 are already on order, under construction, or even already in service. The airlines, or the aircraft lessors, who are buying these new aircraft, have not always specified those essential systems and so they will need to be retro-fitted at additional cost.

If controllers are to control double the number of aircraft that they do now, then they will become reliant on automation in the form of decision support tools designed to augment the personal ability of controller. These tools will enable controllers to discard existing and highly valued skills and require them to adopt new and perhaps less challenging tasks. One skill that controllers will lose through lack of usage is their existing monitoring ability, through which they maintain their "picture" the dynamic mental model that controllers use to interpret all the items of information that influence the way each flight is controlled. This raises two major issues.

How, if at all, can a system failure under peak traffic load be managed using manual fallback procedures?

Will a controller possess or retain the ability to check safety critical information provided by automated systems? It seem unlikely that the controller will be able to do so and so responsibilities that controllers currently hold for detecting conflicts or (if solutions are found using computer assistance) for resolving conflicts cannot be honoured. The controller will have become dependent on software, whose algorithms they cannot validate, to detect and interpret conflicts and to design conflict free trajectories.

Finally, much has been said about the need for parallel investment in airports to prevent a capacity crisis. If that investment is not forthcoming then it may be necessary to question the need for the anticipated high investment in air traffic control, as capacity will become capped by runway and terminal availability.

Appendix B

B1.1 IFATCA POLICY is that :

a) Automation must improve and enhance the data exchange for controllers. Automated systems must be fail-safe and provide accurate and incorruptible data. These systems must be built with an integrity factor to review and crosscheck the information being received.

b) The Human Factors aspects of Automation must be fully considered when developing automated systems.

c) Automation must assist and support ATCOs in the execution of their duties.

d) The controller must remain the key element of the ATC system.

e) Total workload should not be increased without proof that the combined automated/human systems can operate safely at the levels of workload predicted, and to be able to satisfactorily manage normal and abnormal occurrences.

f) Automated tools or systems, that support the control function, must enable the controller to retain complete control of the control task in such a way so as to enable the controller to support timely interventions when situations occur that are outside the normal compass of the system design, or when abnormal situations occur which require non-compliance or variation to normal procedures.

g) Automation should be designed to enhance controller job satisfaction.

h) The legal aspects of a controller's responsibilities must be clearly identified when working with automated systems .

i) A Controller shall not be held liable for incidents that may occur due to the use of inaccurate data if he is unable to check the integrity of the information received.

j) A Controller shall not be held liable for incidents in which a loss of separation occurs due to a resolution advisory issued by an automated system."

Appendix C

C.1 The Role of the Controller in the future ATM system (from the Eurocontrol draft operational concept document)

C1.1 The implementation of the increasing number of automated tools and technologies in Communications, Navigation and Surveillance (CNS) together with the enhancement of harmonised and integrated civil/military co-ordination and airspace management plans and procedures will have a considerable impact on the working practices of civil and military ATM staff.

C1.2 At present the most important cognitive processes of the multiple tasks conducted by the controller are the perception of information, information selection, information integration, planning, and decision-making and the maintenance of a mental picture of the air traffic situation (situational awareness). A major issue in this area will be whether or not it is possible, with a change of roles, to rearrange the situational and cognitive elements which feed awareness so that a controller only has to keep a mental picture of a limited portion of the overall traffic situation.

C1.3 The trend will be towards the evolution of a new working environment in which task sharing aims are focused on enhancing the differing strengths of human and machine and minimising their limitations, rather than using machines to replicate the controller’s current tasks (an analogy can be drawn with the impact of the relatively recent introduction of 2-D radar information within the controller’s work environment when compared to the previous procedural methods of working).

C1.4 The concept incorporates an evolving change to the current ATM environment in respect of roles and responsibilities, both on the ground, and between the air and the ground ATM elements. The greater use of computer support tools, and associated communications systems, to facilitate autonomous operations, and a move to more dynamic airspace structures will lead to the re-allocation of tasks and responsibilities.

C1.5 As a consequence, the operational task of controllers will shift from perception and response oriented involvement towards increase in management and planning tasks with intervention by exception. This shift also implicates new personnel within the ATM environment such as system engineers. Maintenance of the automated systems requires new qualifications. Organisational issues related to system monitoring and maintenance will become a safety issue.

C1.6 In the long term, the traditional clear distinction of tasks between planner and tactical controller is expected to overlap more and more, since automated systems allow both to interact on the planning level. The interaction with the technical system will become less transparent between tactical and planning controller.

C1.7 Human-Human and Human-Machine task sharing will be employed both on the ground (in the control team), and between the air and the ground (between the flight-crew and control team). Only the evaluation of realistic task sharing within new environments can determine the impact on the current human role, and what measures will be needed to allow the human to retain the ultimate responsibility for real-time aircraft separation. The types of ATC organisations best suited to the future ATM system, including flexible and dynamic multi-sectors and planning, will be selected to best suit the traffic patterns and the provision of safe services, while matching the human factor requirements. Several options are possible. These are not necessarily mutually exclusive and are the subject of on-going investigation.

C1.8 Human Factors research in ATM suggests that there are seven main interacting factors that need to be addressed to ensure partnership between automated support and the controller. These are:

Trust - The ultimate use of automated tools will depend on the humans trust in its their reliability. Neither mistrust nor complacency are desirable..

Situational awareness - Tools for conflict detection and conflict resolution are likely to impact on the knowledge and prediction of future events.. The higher the level of automation is, the more difficult is maintaining the situational awareness. Therefore human machine interfaces will have a deep impact on controllers possibilities to handle unusual situations and it is crucial to keep the interface appropriate and intuitive.

Team performance - Automation will affect the interactions and communication patterns of controllers and interactions with supervisors and with pilots. The added value of good team resource management to the safe performance and execution of expeditious air traffic management is high.

Skill changes – When certain aspects of a task are automated, the human operator will no longer experience the daily on–the-line handling of the tasks this may consequently result in a reduced performance of the skill involved. New technology will on the other hand require new skills to be trained and new knowledge to acquire.

Workload - Much of the automation being developed is intended to reduce controller workload, or to smooth the current workload levels Caution needs to be applied as experience from other industries suggests generally that whilst there are reductions, they rarely meet the intended levels.

Recovery from system failure - Automation needs to be implemented in a way that allow the human to build on his ability to ensure safe recovery of real time events, should system failure occur. Operational concepts, procedures and the design of automated systems have to include such properties if a safe operation should be assured.

Error analysis - The introduction of automatic system promises to reduce or remove some forms of human errors presently seen. Changing the characteristics of the system will however alter the human-machine interaction and will therefore introduce other types of human error and many decrease system error detectability and recoverability.

C2 Evolution of Roles and Responsibilities

C2.1 The roles and responsibilities of Controllers have evolved from knowing the last reported position of the aircraft (Procedural) to knowing, with the advent of radar, its current position (Radar Control). This evolution generated new responsibilities for controllers related to directing air traffic and, in some specific cases, moved the responsibility for navigating the aircraft and maintaining separation from the pilot to the controller.

C2.2 At present many controllers handle tasks linearly, i.e. one at a time, and very quickly. This is more skill or rule-based, and accounts for the very high level of service given to air traffic. With automation there is a good chance that some tasks will become more knowledge-based, requiring thinking and interpretation time. This could mean a difference between thinking for up to ten seconds about a particular decision and then making it, and having to think for a minute or so before making the decision.

C2.3 One of the major contributions of automation will be the possibility of accurately anticipating the future position of aircraft. This new possibility is seen as an important issue that will contribute to generating capacity and providing flexibility.

C2.4 Additionally, the use of datalink will also contribute to alter the means and substance of pilot /controller communications. Controllers will also have to adapt the mental models that drive their actions, as airspace restructuring progresses. Technological advancements will enable different hardware and software capabilities in the air and on the ground which all together will have new implications on the roles and responsibilities of the ATM staff. The team performance between Controllers, those supporting the Controllers, Pilots and other personnel like system designers and system operators will become essential for safety, efficiency and capacity.