Introduction

At the 39th IFATCA conference in Marrakech 2000, SC1 presented a working paper on transfer of responsibilities with Airborne Separation Assurance System (ASAS) applications. During the discussion it became clear that development of new policy and application procedures on this item would be very complicated and a detailed task. The presented paper was a very basic start on ASAS procedures development.

A complete investigation is required on all facets of ASAS applications like: establishing the types of ASAS applications, ATC procedures, separation standards, transfer of responsibility and liability, contingency plans and the controller workload to define new policy and application procedures where involvement of the RGCSP, SICASP, OPLINK Panel is mandatory to assess their specific direction on the subject. The ICAO SICASP has determined guidelines on ASAS that consists of airborne surveillance and other state data, equipment, protocols and flight crew and ATC procedures. These guidelines have been published in the RGCSP document: Review of the ASAS material for ICAO documentation, developed by SICASP/7. This document is in the process of being finalised.

The ASAS concept proposes the transfer of responsibility for maintaining aircraft separation from the ground to the airborne side under specific conditions. The investigation on transfer of responsibility might become the most important one. It is always studied closely to ensure that no degradation of safety results and all essential or critical factors are known and safeguarded. Research is still ongoing within several aviation administrations. In most of the test scenarios transfer of responsibility and liability to the cockpit was not tested.

Most of the research-programs have been approached from the flight-deck’s point of view. This is one of the reasons that there is not much information available on the controller’s side. Input from the community of controllers is needed and more and more administrations are getting aware that the controller’s point of view is more important than expected and might even be the most important one. During development of ASAS and related tests it became also clearer that the workload of both pilots and controllers in general could be affected. Research on workload is very immature at this stage, especially where the workload of controllers is involved.

It is necessary to state IFATCA’s point of view on ASAS in relation to the equipment, protocols, airborne surveillance, ATC procedures and especially in relation to controller’s workload to protect controllers from negative affects. Since this is an all-embracing subject, this working paper is mainly addressed to the investigation of possible impact on controller workload.

ASAS applications range from modest increments that supplement present operations with information, to more ambitious ventures that could change ATC functions in significant ways. Within ASAS two classes of applications are made:

a. Traffic Situational Awareness (TSA). The purpose of TSA is to improve the mental picture of traffic situations and enhance the pilot’s ability to visually acquire and avoid traffic. No delegation for separation responsibility from the ground to the airborne side is envisaged.

b. Co-operative Separation (COS). Flight crews will be expected to act upon information provided by ASAS. This to alleviate ATC constraints by involving the flight crew in the separation assurance process. The purpose of COS is the delegation of separation assurance to pilots.

Discussion

The aim of ASAS is to increase airspace capacity through the reduction of the separation standards to permit free flight (reference IFATCA Technical Manual Chapter 2). The question should be raised whether this aim is still in accordance with the latest proposals in the determination of ASAS separation minima. Some of these proposals leave separation standards the same, but propose that the controller could allow more aircraft into the airspace.

The sharing of separation responsibilities between ATC and flight crew needs to be addressed. Approval authorities ascertain that safety and performance requirements are met. Equipment and operational approvals should reflect any limit of use that is requisite to safety goals. Misunderstanding or incorrect implementation of these responsibilities could lead to unsafe situations incompatible with the overall safety objectives. Safety objectives for ASAS should be compatible with the Target Level of Safety (TLS). However this TLS could correspond to an unacceptable number of collisions per year in specific areas, typically in high traffic density areas. For ASAS applications where the flight crew is required to assure some airborne separation, a mid-air collision could result from the combination of an ASAS failure and the inability of the backups to avoid the collision. In case of a complete loss of airborne separation without any possible ATC or flight crew intervention, the collision risk increases with higher traffic density and lower airborne separation minima. The establishment of appropriate separation minima will be an essential product of the overall safety assessment of ASAS operations. The reduction in collision risk expected through ATC backup or intervention of an ACAS tool like ACAS II, would have to be defined and assessed from the initial ASAS development stages, in order to validate that the overall TLS is achieved. Furthermore, the ACAS II safety contribution is mainly based on its independence from the primary means of surveillance. Despite the fact that ACAS and ASAS are independent by nature, they might share some components of the airborne architecture. Nevertheless, the loss of the ASAS functions must not be detrimental to the ACAS function. This is necessary for ACAS to remain the last resort for collision avoidance in case of navigation failure or separation assurance failure.

Despite the use of a rule structure, the human decision-makers in the cockpit and on the ground will form decisions based on their own internal logic. Therefore human performance will likely place constraints on the design of a rule base system used for traffic management. The proper selection of rules will be critical to balance complexity, effectiveness, flexibility, equipment requirements, failure robustness and human acceptance.

If controllers must have the opportunity to take separation control from a self-separating aircraft and return to themselves where there is a imminent separation violation, the liability and responsibility of the controller must be addressed. It might happen that controllers delegate separation responsibilities to several sets or groups of aircraft and then accept more traffic into the airspace. If pilots than would like to return separation to the controller, because of deteriorating conditions (turbulence, weather or increased cockpit workload), the controller might not be able to accept the return of that responsibility. Pilots are clear that they want to be able to return this separation responsibility to the controller immediately if possible. This may not always be possible and clear procedures would have to be worked out to govern these situations.

The IFALPA ATS committee recommends that the pilot community should not support the transfer of separation responsibility to pilots in any of the most regulated conditions. Transfer of responsibility and liability is not supported under the current scope of air traffic rules.

When aircraft are in close proximity, the effect of an error may be more severe since there is little time to achieve separation in an alternate way. This level of severity could be mitigated if the ground system supports contingency procedures as a back-up, for example through ground surveillance. In that case the criticality of airborne separation assurance is highly dependent on the separation minima. In particular, higher criticality could be expected in airspace where procedural control is applied, if the airborne separation minima are made smaller than current procedural separation minima.

The operational hazards and mitigating factors associated with ASAS should also be addressed. There are several situations (ground/air system failures, human errors or lack of proper equipment) that will have negative impact, even during normal ASAS operations. If ASAS is supplementing ATC, the ASAS application is not critical. On the other hand criticality falls mainly on the ASAS application if it replaces ATC. In case of full delegation to the flight crew, the highest criticality needs to be considered for the ASAS application. More precisely, the criticality required for ASAS equipment and procedure depends on the level of delegation of responsibility.

Controllers learn from practice the patterns of traffic. The fixed route structure further reduces controller workload by limiting the number of crossing locations within a sector where aircraft would be most likely to violate separation. Increasing the number and diversity of paths would place additional demands on working memory, posing a further obstacle to maintaining situation awareness. Projecting the future actions of aircraft (the highest level of situational awareness) is critical to the controller’s responsibility to make timely control actions. The current fixed route system constrains the opportunity for conflicts, while providing cognitive support to controllers in detecting them. One of the tasks of controllers will be to look at situation displays and understand the traffic. Where controllers currently have a stable set of routes, ‘free flight’ will greatly increase path diversity and reduce path predictability. The supposition is that the controller workload is associated with constant monitoring of all traffic without knowledge of its future intention. As air traffic management transitions to a more flexible and efficient mode of operation, it will be necessary to maintain some degree of structure and predictability of traffic.

Several test programs with ASAS and in particular CDTI, in which flight crews and controllers were involved, have been completed. In these test programs flight crews reported that the use of these applications improved the efficiency of the visual acquisition task, and they found the workload associated with the use of CDTI acceptable. Controllers reported that there was an enhancement of visual acquisition and increased situational awareness (SA) for both pilots and controllers, for example when traffic was called out. Additionally, no evidence indicated that CDTI reduced the duration or the number of messages that comprised the ATC communication sets, so it was not possible to confirm the controllers’ perceived reduction in workload.

Tests on “free flight” showed that controller workload is also related to the air-to-ground communications. Controllers were able to call traffic earlier than normal, but a statistically significant increase in the number of transmissions was found. This is possibly attributable to the higher throughput for aircraft using ASAS applications, resulting in less time for the communication to occur. The communications rate decreases only slightly with increasing exposure to ASAS applications. Messages were slightly longer and more complex. Increases in communications frequency, complexity and duration have been due to the addition of traffic call signs in pilot messages and due to the flight crews and controllers attempting to maximise ASAS usage. Flight crews are highly attuned to their own call sign and might assume that any transmission including their call sign is for them, probably adding to their workload, to frequency congestion and controller workload as they resolved the confusion. Controllers might not be sure if the call is from the call sign aircraft or from another aircraft about the identified aircraft, again increasing frequency congestion and workload while the confusion was resolved.

Fuel savings by the airlines would be an empty objective if it was negated by a significant increase in the cost of air traffic control or reduction in the level of safety.

Conclusion

Any future air traffic control system clearly must increase and at least maintain the current high level of safety.

It is very difficult to describe all facets that might have negative effects on controller workload when working with ASAS applications. Some safety analyses of ASAS have been initiated, but by using the recognised Operational Safety Assessment (OSA) methodology continuing work is required.

The elements required to achieve the TLS of ASAS operations need to be explicitly identified. These elements include all the equipment and procedural requirements for both the airborne and ground segments of the CNS/ATM system, but also, the required communications (RCP), navigation (RNP) and surveillance (RSP) performances.

Procedures must govern the responsibility and liability for resolving conflicts.

The definition of the operational environment of the selected ASAS application including the air/ground CNS facilities, the ASAS equipage and the airborne and ground separation minima must be refined.

ASAS procedures must be validated through the identification of the hazards and their mitigation, and must constructively contribute to the development process. These procedures should define all the flight crew and ATC actions required to satisfy the safety requirements.

Test results indicate that as the flight deck becomes increasingly involved in self-separation, the controller task loading increases and performance parameters like communication time, frequency, points of closest approach and efficiency, vary systematically with the type of control.

They also indicate increased load levels and significant interactions between air and ground performance.

Some form of information and /or aiding information is needed by the controller in “free flight” operations. Presentation of aircraft intent information for free flying aircraft and “conformance monitoring” information is required. The controller must be able to determine if the intention as specified is being carried out, and if not, that the controller has the opportunity to take separation control from self-separating aircraft and return to themselves where there is a imminent separation violation.

References

Free Flight with Airborne Separation Assurance, Gent R.N.H.W van, Hoekstra J.M., Ruigrok R.C.J., NLR Report.

Safe Flight 21: The 1999 Operational Evaluation of ADS-B Application, James J. Cieplak, Edward Hahn, Baltazar O. Olmos.

Free Flight and the context of Control, Kevin M. Corker, Brian F. Gore, Kenneth Fleming, John Lane.

Simulation Experiments Investigating Controller Workload under Free Flight conditions, Roger Remington, James C. Johnston June 21, 1995.

Air Traffic Controller Performance in Simulated Free Flight, Roger Remington, James Johnston, Eric Ruthruff, NASA Ames Research Center.

Managing Criticality of ASAS Applications, Dr. Andrew D. Zeitlin, Béatrice Bonnmaison.

The Effect of Free Flight on Air Traffic Controller Mental Workload, Monitoring and System Performance, Brian G. Hilburn, Marcel W.P. Bakker, Wouter D. Pekela, NLR Report.

Free flight: definitions, implementation plans, and human factors issues, Tony Masalonis December 13, 1996.

Review of the ASAS material for ICAO documentation, SICASP/7 October 27, 2000.

Controller situation awareness in free flight, Mica R. Endsley, Richard H. Mogford, Earl Stein and William J. Hughes 1997.

Air Traffic Controllers Strategies in Resolving Free Flight Traffic Conflicts: The Effect of Enhanced Controller Displays for Situation Awareness, W.D. Pekela and B. Hilburn 1997, NLR Report.