At IFATCA 93 an information paper was presented on the subject of air ground datalink. During the debate in conference, the need for IFATCA policy on this subject was highlighted. This paper addresses the absence of policy, by presenting draft recommendations for conference debate. The subject of datalink, its application and use in air traffic control, and the aspirations that this particular technology has fostered, has generated considerable debate. This is not surprising given that the application of datalink systems affects the very core of the air traffic control process across the range of air traffic control (ATC) services provided. Equally, the subject matter is complex technically and has implications in human factors as well as technical issues. Controllers are concerned at the effects of ill considered, or inappropriate use of datalink. Thus, in presenting the arguments in this paper, a simplistic approach has been taken : “ returning to the basic principles of the control of air traffic ”.

The Need For A Datalink

The way by which air traffic is controlled today, and has done since 1925 or thereabouts, involves the transfer of information from various sources to and from a human controller. This information is presented and assimilated by a controller and is used in several ways :

1. Determining the intentions of aircraft;
2. Planning for the passage of an aircraft through a control positions area of responsibility;
3. Assessing separation;
4. Issuing instructions to aircraft to meet the plan;
5. Ensuring compliance with the plan;
6. Monitoring of the plan;
7. Environmental data – wind, temperature, restricted area status etc.;
8. Co-ordination: the transfer of the responsibility of an aircraft by transfer of information.

From a large amount of information, a coherent strategy for the handling of a flight to discharge the responsibilities of a particular control position is determined, actioned, monitored and the responsibilities closed by transferring a flight to the next air traffic service unit (ATSU) or phase of the flight plan. The process relies heavily on human judgement. This concept of operation is not able to handle efficiently or effectively the growing demands of airspace users in some areas.

Thus, new concepts of operation are being developed to overcome some of the perceived weakness’ of today. It is worthwhile reviewing these problem areas as a means of understanding the nature and magnitude of the changes to come.

Once an aircraft is near to departure, the only means of communication between aircraft and ground organisation is by the use of radio telephony, and therefore is the sole link between ground and air. The reliance upon this communications link has for sometime been seen to be, in terms of flight safety, a weak link. Research on both sides of the Atlantic has shown that the number of incidents caused where the use of radio telephone (R/T) is implicated is high: callsign confusion, mistaken readbacks, number blindness, the ‘hearback’ problem, all conspire to undermine the safe control of air traffic. R/T is a broadcast medium that relies heavily on correct human auditory response to be successful, and it does fail frequently. Frequency congestion is a significant problem too, adding substantially to the workload of controllers and which impinges directly on the efficiency of the ATC system. Equally there are strengths in the communications medium: the fact that it is an open channel, the so called ‘party line effect’ means that communications are exposed to others to detect errors. It enables situational awareness to be maintained by all participants. R/T has one paramount strength overall, it enables the controller to maintain situational awareness and track the changes of a dynamic domain effectively.

Whilst flight safety is of paramount importance, the capacity of the air traffic control system has been of growing concern in certain parts of the world for some time. When studying controller workload it has been noted that in some cases fifty percent of the peak workload is in communicating via R/T links. Therefore, to some researchers investigating ATC workload, there are significant gains to be made in removing or reducing this part of the controllers workload. Many of the concepts of operation that are being developed today, seek to redistribute the workload of the controller: In simple terms by removing some tasks that add to controllers workload, such as R/T workload, and by using the available workload that this releases for tasks which increase traffic throughput. The quality of the R/T links has a bearing upon separation standards used, particularly in oceanic airspace. This may seem at first sight odd, but the safety of the ATC control process depends upon corrective action being taken when operations go awry. Thus, the speed of response is a critical issue in the separation employed. The problems of high frequency (HF) R/T are well known, thus the separation standard in use in oceanic airspace takes into account the response time to take corrective action.

It is useful to consider the nature of the control task in terms of an information processing system. The efficiency and safety of the control process is dependant upon the quality of the information received, and how it is displayed. This information is then used by humans to make judgements on a range of parameters. Today, in all ATC disciplines around the world, there is a great deal of uncertainty in the quality, fidelity and reliability of the information used by controllers. Once again this limitation is built into the separation standards, but more fundamentally it shapes the perceptions that we have of traffic situations and the way that we as controllers actually devise strategies to separate traffic. Studies in the USA for example, found that whilst the minimum separation allowable may be five nautical miles in a radar environment, in practice the real minima used was fifteen miles. There was such uncertainty in the quality of the information used for planning and executing these plans that controllers set there own usable minima.

In particular, researchers are concerned at the short time horizons of the ATC control process today. Planning tends to be of a short term nature, limited to the acceptable accuracy of the information that is available. In areas of high traffic density, this plan may be the province of only one controller – the goals for that control position may be met without reference to the goals of the air traffic management (ATM) system as a whole, thereby reducing system effectiveness.

No distinction is made here about the definition of ‘information’ and ‘data’, but we have all experienced a display showing us some data which is quite useless to our task, and searching or interpreting that display to make it into a coherent and useful form.

Aircraft navigation systems have evolved into very precise and capable systems with the advent of inertial reference systems, flight management systems and satellite navigation. With an air ground datalink, the means of accessing and using this information in real time by ATC becomes practical. Thus many future concepts seek to exploit the integration of air based and ground based systems co-operatively.

Therefore, the potential is here for radical changes in the way in which controllers will control traffic in some areas of the world that will be fundamentally different from the way that the control process operates today. Whilst in some areas of the world it will remain little changed from today, merely enhanced. Air ground datalink will be the enabling technology that allows, in conjunction with other systems (which range from the aeronautical telecommunications network (ATN), enhanced controller workstations, computer tools and automation and rasterscan displays), these changes to take place, and resolve some of the problems in the safety and capacity of the system that exist presently.

It is important to appreciate that the datalink is the enabling technology that allows the provision of information such that other systems and tools can be provided to enhance the efficiency of the ATC control task. This paper addresses the direct implications of the use of datalink in the ATC task, and not how the information between air and ground is used in computer tools or automating controller tasks. This latter subject needs to be considered in depth by IFATCA, and as it has ramifications in both human factors and technical spheres, it should be the subject of a joint SC1 and SC4 group to produce recommendations for conference debate.

The Nature Of Datalink Services

A datalink is a means of transferring data from one location or system to another. The data has to be transmitted, and handled in some way, by networks to route the information to appropriate users and be displayed in a suitable and useful form. In terms of the ATC control process, datalink services presently are envisaged to be used in two particular areas :

• Communications;
• Surveillance.

Communications

Today, in many ATC domains, the primary communications medium with aircraft for controllers is by the use of a direct verbal link. In some cases this may be by VHF or UHF, in other cases it may be by HF. In some locations already datalink is being used for pre-departure clearance delivery, and for oceanic messages. The use of this direct verbal link has a profound and subtle effect on human information processing. The ‘engine’ of the ATC control process may be considered to be the mental model, or internal representation that the human builds and maintains of their ‘world’. This is not likely to change in the immediate future. It is sometimes referred to as the ‘picture’ or situational awareness. In the simplest of terms it is best described as the understanding and interpretation that the controller has of all the information available in a rationalised form. This includes the static environment that the controller works with e.g. route structure procedures etc., the intentions of individual aircraft, the interactions of the present and future traffic situation, the dynamic elements of the operational environment e.g. weather, airspace restrictions etc. In its more complex form, the model reflects the controllers ‘being in control’ of the situation. When an aircraft calls on frequency this acts as a stimulus, trigger or an update mechanism to this mental model. Equally, when an aircraft is QSY’d from the frequency that particular task is closed in the mental model. Thus careful consideration must be given to the factors that determine what can or cannot be transmitted using datalink mindful of the requirements of the human as well as the task needs. In particular the effects upon the internal representation that the human has, and where necessary, enhancements made to support this. Workload, possibly re-expressed as traffic density, is a significant factor. For example the response time to critical incidents and reduced separations used in terminal airspace are such that an immediate response is required.

By examining the content and the nature of R/T communications it is possible to produce four classes of messages :

This list is by no means exhaustive in terms of the message content, but merely illustrative of the type of communication in each class.

Research teams have approached the use of a datalink for all or some of the message types differently. Broadly, in oceanic areas it is to have all routine message types transmitted by datalink, whilst in other airspace types it is to use datalink for some classes of message. The use of the direct verbal link has two advantages when VHF or UHF is used: It is very fast and it has the ability to communicate more than just the instructions. However this is not the case with HF, where the quality of transmission and its vulnerability is the cause of much concern, or where a third party is involved in transmitting messages.

Presently the keying of a switch and speaking into the microphone is all that it takes to transmit a message. The total time to transmit and receive an acknowledgement of an instruction, the transaction time, can be in the order of seven to twelve seconds. Similar using Mode ‘S’ datalink take of the order of twenty seconds as a mean with a standard deviation of thirteen seconds. Taking the difference between the two means (nine and a half seconds and twenty seconds respectively), this may at first not be significant, however it is the equivalent to the time taken to transmit another message by voice communications.

By listening to the intonation or tone of pilots, controllers are able to understand whether or not instructions are understood, or urgency can be placed in instructions given in critical situations. These reactions are not just as a response to using R/T, but are part of the natural human condition, intuitive from a young age.

The use of datalink as a communications medium potentially removes these utilities. This may be acceptable provided that other components are in place to support the controller, or provided that traffic densities are such that the use of this communications medium enables the controller to continue as an active and cognisant part of the control process and in a timely manner. But there is a point at which traffic densities are such that the total use of a datalink in our present day method of operating will alter the speed of response such that the reaction to critical situations will be degraded, and/or the human is not able to function with a satisfactory mental model. This is also a problem on the flight deck too. It is commonly held that voice R/T will be available as a backup channel of communication to datalink in the case of an emergency or for non routine messages. However, this poses another cognitive problem, arousal rates of the human operator. Imagine operating on a flight deck that operates for sixty five percent of its flight regime not using R/T, aircraft sitting in the cruise, and suddenly the R/T shrieks out a warning to climb, descend or turn. Will the human be able to react fast enough from a low arousal rate in one sensory mode? Are other alerting mechanisms required in this instance?

The preceding sections have identified some of the weaknesses of using datalink as a communications medium. There are numerous strengths to using such technologies. R/T is a weak link as has been highlighted earlier. Datalink communications removes many of the vagaries of voice communication by R/T. Trials have shown a significant reduction in error rates over R/T communications in simulations of normal operations. The Pacific engineering trial has shown that datalink communication is feasible in oceanic airspace. Thus the reliance upon VHF line of sight technology for a high quality communications link means that a more reliable and effective ATC service can be provided in remote areas of the globe without extensive infrastructure.

Communicating to aircraft via a datalink requires a number of components. It first requires an input device to construct a message and then secondly a network by which the message can be sent to a transmitter for passage to the aircraft. On board the aircraft there must be a suitable antenna to receive the message and a means for displaying it to the crew, as well as an input device upon the flight deck.

The use of an input device to construct and transmit messages means that a significantly more complex interface is used, introducing different types of error and different sensory processing by the operator. How common is it that we read something and misread it? And how common are typing errors? Thus the introduction of this type of interface must be carefully designed such as to minimise the effects of such errors. In terms of workload, significant reductions by the use of datalink solely may not be achievable unless the interface design is intuitive. The use of such an input device does mean that the ‘system knows what a controller intends – the system can become more than a ‘dumb’ servant, and can intelligently support the control team. The Aeronautical Telecommunication Network will provide the necessary infrastructure to route messages through the network to an aircraft for ATC and will provide access for other aeronautical users. This significantly enhances the quality of the information available for air traffic flow management (ATFM) and airspace management (ASM) purposes. Indeed the introduction of the ATN into service will alone provide the opportunity to radically change the nature of ATC operations. Where available it will enable data to be made available free from the limitations of geography, the transfer of radar data for example to provide redundancy in areas with degradation of service etc. Aircraft operators already gain from using VHF datalinks such as AIRCOM and ACARS in every day operation. The introduction of the ATN makes access to the aircraft available to many more stakeholders. Clearly unconstrained multi-user access could interfere with the ATC control process and safeguards must be made so that ATC messages have the highest priority, and that within the ATC categorisation the controller who has jurisdiction for a particular flight has the highest, unassailable priority with the exception of emergency messages.

By utilising large networks to transmit data, it exposes ATC communications to a risk of failure by component malfunction, corruption of data and also makes the system vulnerable to unlawful interruptions. However, the structure of such architecture’s also enables different paths to route messages in the case of node or highway failure. There is a risk of delay to time critical messages. This should be minimised and the controller made aware of the status of such networks. Satisfactory measures should be taken to ensure that message error checking provides the appropriate level of fidelity for controller needs.

Air ground datalinks are also included in other aviation systems as a means of communicating information. The most prominent to date is the inclusion of a datalink in the Microwave Landing System (MLS), and DGPS.

The workload of controllers is a subtle, and as yet not fully understood, balance and interaction of multiple tasks. Controllers devise and plan strategies that take into account their present and future workload, they account for shortcomings in the equipment or procedural environment that they operate in. Merely changing one sub-activity can have an effect upon the efficiency of the whole in a negative way. In order that the reduction of workload, that is often cited as the major reason for changing to communications between air and ground by datalink, can be made attention must be paid to ensure that the workload balance is enhanced positively, and that the interactions are fully considered. To use a datalink as a communications medium entails the use of a visual display unit and an input device. This therefore is a change in sensory perception from auditory to purely visual. This can potentially overload the controller and add to their workload. Additionally message transaction times must be such as to ensure that controllers do not have to compromise the way that they operate for the sake of transaction time delays.

Surveillance

ATC surveillance systems have to date relied solely on primary and secondary radar systems, with the attendant limitations upon line of sight range. By utilising modern radar and satellite technology, in conjunction with a datalink, it is possible to extend the capabilities of surveillance systems in terms of both range and the services provided, but in a fundamentally different concept than radar systems.

The use of datalink technology in the surveillance role can be divided into two classes:

• Independent;
• Dependent.

An independent system is one that does not rely upon aircraft based sensors for surveillance data. A dependant surveillance sensor means that the data used comes from the other sensors or sources and is therefore not the subject of independent corroboration, and then communicated to the ground station. Primary radar systems are examples of a truly independent system, whist Automatic Dependent Surveillance (ADS) is an example of a dependent system. Secondary radar systems employ elements of both, however for the purposes of this paper are considered to be independent. The reasons for this is that although a transponder is required for SSR surveillance, and thus is dependant upon the aircraft to participate, the position of the aircraft is determined from the ground based sensor and not derived from an onboard system and then transmitted to the ground.

In terms of independent surveillance, datalink enables the controller to monitor an aircraft’s performance or clearance in a level of detail that is not presently achievable. For example, a controller instructs an aircraft to climb to FL 350. This is acknowledged by the pilot, and the level set and armed in the autopilot or appropriate system. The level selected can then be downlinked to the controller and monitored against the cleared level issued by the controller. This type of operation can be performed passively i.e. without the intervention of the human as was demonstrated in the EUROCONTROL Mode ‘S’ trial at Bedford, UK., October 1991.

There are a number of similar functions that can be provided passively that offer promise in effectively enhancing the safety and efficiency of the system, such as using the discrete address capability of Mode ‘S’, or utilising the downlinked trajectory data from aircraft to enhance radar tracking. These should receive controllers limited encouragement for introduction into service, for whilst there are potentially significant safety gains to be made, the use of oversensitive margins can have a perverse effect. There is a risk too that the sheer volume of data that can be downlinked will swamp the controller unless sensible and meaningful use is made of the information in context.

The risk of error is present, in that an aircraft system may be faulty. However, this is no different from using Mode ‘C’ and the effect can be minimised by the use of procedural validation checks.

Dependent surveillance systems receive information that emanates from another system and processes and displays this data to the controller. The most operationally advanced of these systems is Automatic Dependent Surveillance or ADS. The ICAO FANS committee has nominated Automatic Dependent Surveillance (ADS) as the surveillance system in certain classes of airspace. ADS will use information transmitted from an aircraft in the form of automatic position reports, and other ATC related data. Thus the position that the aircraft transmits is obtained from on board navigation sensors, be they inertial navigation systems (INS), inertial reference systems (IRS) systems, INS/IRS with global navigation satellite system (GNSS) or positions obtained from GNSS solely. The datalink provides the means by which the aircraft can communicate with the ATC service. Whilst it is the case that all communications can be effected using the datalink, it also the case that as the data is communicated by a satellite data communications channel, so this channel can be used for voice communications as well. It is a dual channel systems.

As was highlighted previously, the datalink is the enabling technology that permits higher fidelity and constant information to be made available to the ATM service.

There are many advantages to be gained by using this type of surveillance tool. It can potentially extend the efficiency of positive control of aircraft in where only procedural control is available. Equally such a system can be provided with a modicum of infrastructure provision. Such systems add considerably to the safety of air navigation, a significant improvement over today’s operations. Additionally, as many pilots will welcome, the removal at last of HF voice communications as the primary communications link in some oceanic and remote areas. Therefore IFATCA should welcome the introduction of dependent surveillance systems, particularly ADS, as a major enhancement to the ATC service.

Clearly a major driving force to the early implementation of ADS is to add capacity in some oceanic and remote areas where there are severe limitations today, most notably the North Atlantic, and the Pacific. The operational use of surveillance systems such as these are however only one part of a complete package that enables controllers to provide a control service- ADS alone cannot provide the capacity enhancements. They need a procedural environment in which to work as well as other systems to process and display the information and to support the controller in the control process. Therefore the issues that arise are those of separation standards and the philosophy of operation utilising dependent surveillance systems.

There are two (and there may be other) approaches to the derivation of separation standards. One considers an analysis of the containment of aircraft positions in the event of errors. The other derived separation standards, for the North Atlantic and then applied these to the Northern Pacific as the result of an analysis and quantification of all of the sources of error which could contribute to the risk of collision and for a given target level of safety a value for the minimum separation produced. The sources of error may be divided into two areas:

Technical factors: the accuracy and performance of surveillance and other ATC support systems, and aircraft navigation accuracy’s;

Operational factors: ATC procedures and human performance issues, both in the air and on the ground.

It should be evident from the foregoing that the use of dependent surveillance makes any such quantification sensitive to navigational errors – be they derived from the avionics, human error in interpreting or inputting data, or from transmission errors. Because of the nature of the airspace and sectors likely to be flown in areas where dependent surveillance is of most benefit, aircraft will tend to operate for extended periods without access to updating ground based navigation aids. Thus unless aircraft are using long distance aids such as GNSS, these errors are likely to grow as a function of time. Additionally, for the ground system to detect errors, it must rely upon the use of support systems, themselves potentially the source of errors. When separation standards are determined for airspace in which dependant surveillance is to be the primary means of surveillance therefore, thorough consideration and examination of the potential effects and sources of errors must be carried out. It should be recognised by those responsible for such studies that dependent surveillance is fundamentally different to independent surveillance and as such caution should be exercised in making comparisons with radar separation standards.

However it is quite evident that in order for aircraft to operate in airspace that is designated as that suitable for use with dependant surveillance systems, and the appropriate separation standards, it will be necessary to verify the ADS position prior to entry into the airspace. In some areas of the world it will be possible to do this by use of radar systems. However in other parts of the globe it will not be possible to do this. Therefore it is envisaged that this verification process will become a flight deck task.

Differing navigational fits carried by aircraft, and the variation in navigational accuracy’s due to this and also inherent in satellite navigation, means that it is necessary for a measure of navigational accuracy to be provided to the ground. This will carried out by the use of a ‘Figure Of Merit’. It is conceivable therefore that two aircraft operating in trail with the appropriate longitudinal separation for that level of navigational accuracy may require controller intervention to restore ‘standard’ separation in the event of equipment failure or degradation. More important is the issue of operating in mixed mode, i.e. within a defined airspace having aircraft suitably equipped to use ADS and other aircraft that are not operating in the same airspace – ‘mixed mode’ operation. To the controller this can present several problems, particularly in the interface between ATS environments. The cognitive issue of dealing for most of the time with datalink only communications and the occasional use of voice communications, the increase in workload that is attendant in such operating regimes, and the issue of working with complicated and varied separation rules that must apply over long sector lengths and that cover all combination of traffic mixes. Once again it is an issue of the workload upon the controller and therefore related to traffic densities. The greater the traffic densities, and the more complex the problems are to resolve the less resilient the system becomes to errors of judgement by the controller, and the more difficult the controllers task of fully understanding the interactions of particular traffic situations.

Finally, in order that dependant surveillance systems can operate they need to be used in conjunction with other systems to be workable. The use of a visual display of traffic poses a difficult problem. For many such displays will be considered to be a radar display. For the reasons stated earlier the philosophy behind dependant surveillance is fundamentally different from independent surveillance, hence such displays are categorically not radar displays and should be considered as a new tool requiring new procedural rules and operating methods. As such, controllers who will be using this type of equipment must undergo the appropriate training for the new tool.

The Operational Context of Datalink

It is not possible for IFATCA to consider and make recommendations on the use of datalink generically, i.e. one recommendation for the global use of datalink. The ICAO FANS committee structured its deliberations by considering Air Traffic Management in four domains. This approach is considered to be the most suitable for IFATCA’s purposes as well.

Another problem in considering the future use of datalink and making suitable recommendations is precisely that – it is the future. The use of datalink can be expected to be incremental, and its uses are limited only by the imagination and understanding that the human has. This paper therefore attempts to address this in part by recognising that the bounds on the use of this enabling technology are difficult to fully appreciate and assumes that the developments are made all things being equal i.e. that where its use fundamentally changes a philosophy of control process operation today that the use of datalink will only be so provided after this philosophy is satisfactorily accounted for.

ICAO categorises airspace into four domains. The table below shows these and also contrasts the appropriate communications and surveillance aids in each domain:

Oceanic/Continental En-Route Airspace with Low Density Traffic

Continental Airspace with High Density Traffic

Oceanic Airspace with High Density Traffic

Terminal Airspace with High Density Traffic

For the purpose of defining suitable airspace types by which IFATCA may recommend the suitability of datalink services, mindful of the factors that will affect there use, these four domains are the most appropriate segregation of airspace types.

Considerations in using Datalink in the Control Process

There are a number of matters that arise as a result of the nature of datalink technology.

First and foremost relates to the notion that ATC is an information processing system. However there is information and there is data. The volume of data that can be downlinked from aircraft systems is immense, not just in the quantity but its repetition. In providing information therefore care should be taken so as to not overload the controller, this relates to not just overloading the visual mode of perception, but also to be aware that to do so may compromise the functioning of human memory resources. Information must be provided that is timely and in context, and that supports the human in their task effectively.

Secondly is the issue of using a mixture of datalink and voice communications as the primary communications channel. Such a mode of operation can lead to heavy controller workload in some operating domains. For example, the safety enhancements that datalink services can bring by monitoring and using the information transmitted in datalink messages. In order for this to work it is necessary that certain control instructions be known to the system, for all the traffic. Therefore it will be necessary for the controller to update the system by inputting information into it. In all operating regimes it will be simple for the human to issue an instruction by datalink and receive a reply by voice communications, thus potentially missing updating the system. It is easy to see how simple it will be to get confused in such circumstances. Therefore where a datalink message is transmitted, in principle it should always be responded to with a datalink acknowledgement. Where an instruction is transmitted by voice, in principle there should always be an acknowledgement by voice. Direct voice communications, using VHF, have been proven to be faster than datalink transaction times. Therefore, in the event of an emergency, communications by voice is the preferred medium. This does not preclude the use of datalink communications where deemed suitable. Indeed the use of datalink communications, even when voice communications – satcoms included are being used, can offer a powerful resource to aid flight crews in such circumstances and support the controller in handling aircraft in emergency. Datalink communications systems should ensure that in any convention of message priorities that emergency messages receive the highest classification possible.

Thirdly, datalink systems rely upon the processing of information at several links in the cycle. Ultimately there is a risk, albeit small, that the information that is presented to the controller may be erroneous. For the purposes of investigation of such incidents, and all incidents or failure of the system it is essential that there are recordings of both the information that was transmitted and what was actually displayed to the controller or pilot.

Fourth, the integrity of datalink mediums, and associated software groups are in some airspace domains safety critical systems. Therefore all such systems should be perform and be reliable to the appropriate standards for safety critical systems as defined by the appropriate authorities. This is particularly the case with transponders, whose serviceability has caused concern over the years. Additionally consideration needs to be given to the case of failure of aircraft systems. For example, in the event of an onboard emergency that saw the aircraft rely upon standby power, in operations where datalink is being used, it will be critical for the effective handling of that aircraft to still be able to use the datalink services. Therefore it is essential that datalink systems are run off of standby power systems on board aircraft.

Finally, the use of datalink in the ATC control process and the other ATM activities, is in many ways limited by the imagination of the designers and users. It holds the potential to overcome or change some of the constraints that exist presently in our operating philosophies. It is clear that there are two generations of the development of the ATM system utilising datalink services and in conjunction with computer tools and automation of controller tasks. In the first generation, that which is being designed and planned now, the role of the human and the need to support the human is recognised. It will be the case that the use of these developments will be enhancing the control system using and retaining many of the philosophies and principles of today’s operation. The second generation will seek, rightly so, to challenge these philosophies and principles. Despite this there is one constraint that will still persist – that the human must remain in control, and for the foreseeable future this will be the case. Therefore in order for that principle to be observed, the needs of the human must be supported, in particular the need for the human to maintain an adequate internal representation of their domain.

To conclude

The use of datalink systems has a significant part to play in the evolution of ATM, particularly in terms of communications and surveillance. Datalink systems are a means only of transmitting data. There sole use cannot lead to changes in the philosophy or principles of operation. It is necessary to have in place, for system wide applications, a telecommunications network to transfer data. It also is necessary to recognise that these networks are part of a safety critical system and must have the resilience to failure, and be secure to meet the appropriate standards for safety critical systems.

The transfer of voice communications to datalink communications is dependant upon the nature and intensity of the airspace domain. In domains which are highly tactical, the message transaction time is presently too slow to facilitate a change to datalink communications. Research has shown that message transaction times by datalink are slower than voice R/T. Of the four message types identified in paragraph 4.4, the nature of the service being provided, and the airspace domain, dictates their operational suitability for datalink message transmission.

Voice communications have a use in the control process beyond that of communication, and play a significant part in maintaining the mental model that controllers create. The workload of a controller is a subtle balance and interaction of a number of activities. Merely reducing one component of that workload balance may not reduce the workload sufficiently to replace it with more of another workload element.

In order for datalink services to be used for communications, it is necessary to use an input device. Data link is, with the notable exception of HF voice communications, slower than voice communications for this reason. These devices must be designed so as to be an intuitive device and not to add the workload of the controller. Where a datalink message is sent it should receive a datalink acknowledgement, in order that confusion is minimised. In areas where datalink communications are the norm, and there is a need to use voice R/T communications it may be necessary to provide an alarm to overcome poor response due to low human arousal rates.

It is recognised that the use of datalink communications can substantially reduce some of the errors that exist using R/T. It is unlikely to eliminate all of these. However, new errors will be created by using datalink systems, such as keyboard errors, misreading of messages, corruption of data etc. Therefore datalink services should strive to be as error tolerant as possible.

Surveillance sensors using datalinks as an integral part can contribute significantly to the safety and effectiveness of the ATM system. Some surveillance systems move away form the traditional independent nature of ATC surveillance systems and rely upon aircraft derived data for position information that is subsequently used by ATC for separation purposes. Present day independent surveillance sensors can be enhanced by the use of datalink. The use of dependent surveillance systems, in conjunction with the supporting infrastructure, can potentially be used to reduce separation standards below that of procedural separation minima. However, such systems are inherently not radar systems, and are a completely new generation of surveillance systems which are susceptible to errors and failures beyond the control of the ATC service . Such reductions must take this into account fully, and be the subject of an assessment proving that they are safe using the appropriate collision risk model and evidence from operational experience.

ADS and non ADS equipped aircraft operating in mixed mode operations pose particularly complex problems for the human to resolve. The suitability for such an environment will need to be determined after consideration of all the appropriate factors. However, in some areas it may be that segregated airspace will be required.

The use of datalink services makes available a large quantity of data to the ATM system. In providing this to the controller, care must be exercised so as to not overload the human sensory system. Any information provided must be of use, timely and in context. The temptation to provide data just because it is there must be avoided. There are several human factors implications in the use of datalink as a replacement for voice communications, or in their use to supplement the control process. Today voice communications affords the controller the facility to be alert to uncertainty or doubt on the part of aircrew. Because voice communications are a broadcast medium i.e. open for inspection to all, it is able to give to those listening indications of how busy a controller is, neither does it hide errors on the part of ground or air users. In a datalink environment, it is conceivable for it to be a silent environment, which means that intentions and plans are limited to only the controller, the appropriate aircraft crew and the system. For other members of the control team the ability to monitor the workload of others by listening to someone will be reduced. Finally, the mental model that the human builds, and maintains, of their working domain uses voice comms as a cue, trigger or update mechanism. The change to datalink will potentially alter this drastically in some domains, whilst in others it could potentially be enhanced. In integrating datalink services into the ATC task full and careful consideration must be made of the human factors implications.

There shall be a joint SC1 and SC4 group to develop recommendations on the use of computer tools and automation that uses datalink information.

It is recommended that :

Voice communications be retained as a communications channel in all circumstances.

The table below indicates the suitability of voice communications and datalink communications as the primary communications medium, and where the use of voice and datalink communications together, is acceptable for particular airspace domains:

In the event that an area experiences growth such as to place it into a different domain, then the appropriate communications medium shall be provided.

Where datalink communications are in use, that access to the aircraft is subject to a system of priorities. The controller who has control jurisdiction for that flight shall have the highest unassailable priority subject to emergency messages.

The necessary ground networks are in place, with satisfactory resilience to system failure and secure to resist unlawful interruption, prior to the introduction of datalink communications. The ground systems should satisfy the appropriate performance criteria for safety critical systems.

Interface devices required for the use of datalink communications are designed such as to not add to controller workload.

Voice communications should be the preferred communications medium to be used in the event of an emergency. This shall not preclude the use of datalink communications if deemed appropriate by those involved.

An alerting device is provided to assist human operators to respond to voice communications when they are not the primary communications medium.

Future developments of datalink services in the provision of ATM services must support the cognitive needs, and be compatible with, the capabilities of the human.

The performance of aircraft on board datalink systems will be such as to provide the required level of performance for a safety critical system inter alia, and to operate from uninterruptible by power sources.