Summary

During the International Federation of Air Traffic Controllers’ Association (IFATCA) Annual Conference in Montego Bay, Jamaica (2023), there was a discussion on Paper 6.5 in Committee C entitled “Information Overload in ATC”. Members discussed the possible need for an additional policy regarding the deactivation of ‘safety tools’. This paper proposes to accurately define terms of reference and explores a change to the policy regarding the use of controller tools and safety nets.

Introduction

1.1. Controller tools and safety nets are necessary functions that are imperative to the safety of the Air Traffic Control (ATC) system. The ATC environment can have different layers of defence. These can include ATC procedures, flow control regulations, and conflict detection tools such as Medium Term Conflict Detection (MTCD) systems and Short Term Conflict Alert (STCA) systems^[1]. When alarms and alerts from safety nets are deactivated, a layer of protection against incidents is removed, and thus controller vulnerability is increased.

1.2. Contained in the IFATCA Technical and Professional Manual (TPM) definitions section, there are definitions for the following terms relating to alerts: controller tools, conflict detection tools, short-term conflict alert, and safety nets.

1.3. It is easy to say that all these things including their specific alerts and warnings are used as controller tools; however, the term “safety tools” as discussed in Montego Bay, Jamaica (2023) is not a term defined in the TPM. The term safety nets as defined in the TPM more accurately represents the topic of discussion.

1.4. The discussion on WP 158 Information Overload in ATC, Montego Bay, Jamaica (2023) focused on ATCOs having to process too much information at one time which can lead to an ATCO ignoring or disabling an alarm or alert. When these alarms or alerts become false alerts or nuisance alerts, they could perhaps be deactivated or ignored by the ATCO without assessing the risk. Safety nets are designed to create a warning when immediate recognition and corrective or compensatory action is required. The purpose of this working paper is to better define the terms associated with controller tools and safety nets and assess the need for a more defined policy regarding any deactivation of safety nets.

Discussion

2.1. The following definitions^[2] as written in the TPM Version 66.0 (2023) are important to consider in the discussion of this paper:

2.1.1. Controller Tools – Functions of an ATM system that enhance a controller’s ability to meet the objectives of ATS. They provide information that assists controllers in the planning and execution of their duties, rather than dictating a course of action.

2.1.2. Conflict Detection Tools (CDTs) – Computer based controller tools that identify conflicts and then provide system generated conflict advice to controllers. They can provide conformance monitoring to ensure that aircraft comply with instructions issued to resolve a detected conflict.

2.1.3. Short Term Conflict Alert (STCA) – An automated system that predicts reduction of aircraft spacing to below specified parameters. An STCA function can be used as either a controller tool (STCA-T) or a safety net (STCA-N) depending upon system parameters.

2.1.4. Minimum Safe Altitude Warning (MSAW) No definition exists in the TPM; however, IFATCA does have a policy in effect: TPM Version 66.0 (2023) ATS 3.19, Minimum Safe Altitude Warning Systems, pg 101.

2.1.5. Area Proximity Warning (APW)- An alert provided to a controller of the imminent incursion of a flight into “special-use” airspace. Note: The response to such a warning will be dictated by the nature of the airspace in question and its specific requirements.

2.1.6. Approach Path Monitor (APM)- This is not yet defined in the TPM; however, should be considered to be added as a safety net.

2.1.7. Safety Net – Airborne and / or ground based function, the sole purpose of which is to alert the pilot or controller of the imminence of collision of aircraft, aircraft and terrain / obstacles, as well as penetration of dangerous airspace.

2.1.8. Alert – An alert is an annunciation of an operating parameter of a navigation system being out of tolerance. Alerts include warnings, cautions, advisories, and integrity alarms.

2.1.9. Warning – An annunciation that is generated when immediate recognition and corrective or compensatory action is required; the associated colour is red.

2.2. Study on nuisance alerts- Nuisance alerts can cause many problems in operational settings and have caused some ANSPs to deactivate their safety systems completely. In an effort to provide a guide for air traffic system designers and controller user teams, the FAA and the Engility Corporation conducted a study^[3] on nuisance alerts. In the study, the authors found that nuisance alerts are distracting and can lead to desensitisation and poorer overall performance. Just like with information overload, there has been much anecdotal evidence regarding the high rate of nuisance alerts in facilities, but there have been few studies to evaluate the problem.

2.2.1. Alerts are intended to cause people to stop what they are doing and attend to a potential hazard. However, some alerts fail to provide useful information and can create their own human factors problems. When an alert is identified as false, or does not result in action, it can cause an interruption unnecessarily reducing performance. These are known as nuisance alerts. When a controller encounters too many nuisance alerts, they may start to ignore the alert and become desensitised to it. They may also develop decreased trust in the automation system.

2.2.2. Desensitisation can lead to slower responses to real high urgency alerts. When there is a high incidence of nuisance alerts, people may suppress the alert before determining its actual status or may no longer treat the alert as a mandatory action.

2.2.3. Audible alerts can be effective at drawing attention; however, they have been the source of many complaints from ATCOs. Frequent and irrelevant auditory interruptions can disrupt visual task performance, which could be a problem in a profession like Air Traffic Control.

2.2.4. In the study, two main alerts were examined: Conflict Alert (CA) which projects that two aircraft are closer than separation minima allow, and Minimum Safe Altitude Warning (MSAW) which projects that one aircraft soon will be closer to a physical obstruction (terrain, buildings) than is considered safe. The presentation methods for CAs and MSAWs vary among ATC systems and incorporate combinations of flashing, colour, text, and sound.

2.2.5. It was determined that at least twenty seconds are necessary for a controller to recognise an alert, formulate a response, communicate it to the pilot, and for the pilot and aircraft to respond. Also, alerts lasting less than 20 seconds that did not result in an error were deemed nuisances, because they deactivated before a controller response could have taken effect.

2.2.6. When analysing controller actions after a particular alert was activated, it was found that responses took longer than a minute. It was also observed that in 67% of situations, controllers took action before activation of the alert. Taking action before the alert is strong evidence that most CAs and MSAWs notify controllers about situations for which they are already aware. For control instructions, where a controller asks a pilot to change altitude, heading, etc., the median response time was approximately 88 seconds. For traffic advisories, where controllers warn aircraft that they may violate separation standards, the median response time was 78 seconds. These long gaps suggest that controllers wait to see how a situation develops before taking action. This does not mean that the alerts are unnecessary, because they do lead to action. MSAW alerts tend to take less time for action (38 seconds on average) before beginning to issue control instructions. This suggests that controllers regard most MSAW situations to be more urgent than most CAs.

2.2.7. If a controller does not respond to an alert and the event does not develop into a loss of separation, it can be concluded that the situation resolved itself and that the alert may have been some form of nuisance alert. The number of nuisance alerts is the most serious human factors issue facing ATC alerting systems.  Nuisance alerts create workload and distractions can lead to poor performance.  Determining whether an alert is truly a nuisance alert is a difficult task with limited data.  When a situation occurs, to know if an alert was truly a nuisance, we would need to know what the controller knew, what they didn’t know, and what they were thinking at the time of the alert. Additionally, individual performance may differ between controllers. Therefore, an alert that might be a nuisance for one controller might be a necessary warning to another.

2.3. Examples of why safety nets might get deactivated.

2.3.1. Unexpected/Unplanned outage- ANSPs should have contingency plans in effect in case of a system failure wherein safety nets are unavailable, disengaged or deactivated.

2.3.2. Planned outages- for instance: Controller tools and safety nets can be disabled for reasons such as system maintenance, software updates, or testing. It is vital in this case that the ATCO’s are aware of such an outage and are briefed on the impact the outage will have on the system. Using a visual aid or a checklist can be useful.

2.3.3. In some ANSPs, at an ATCOs request with supervisor approval, an engineer can disable safety nets that are considered nuisance alerts for one particular aircraft (i.e. paradrop, military, or photo missions) to prevent continuous activation during that particular flight. This action should not disable the entire system.

2.3.4. The safety net alert function may have been deemed a nuisance alert and disabled by the engineers or technicians at the request of the facility leadership.

2.4. Current IFATCA Policy regarding controller tools and safety nets:

2.4.1. ATS 3.16 The Use of Safety Nets in ATM policy is very limited and does not address the concerns of the Member Associations when the topic came up in discussion at conference in Committee C in Montego Bay, Jamaica (2023). The policy currently states:

2.4.2. ATS 3.17 Conflict Detection Tools policy is relative and effective. This policy states:

2.4.3. ATS 3.18 Short Term Conflict Alert policy is relative and effective. This policy states:

2.4.4. ATS 3.19 Minimum Safe Altitude Warning Systems policy is effective and we should consider a slight amendment based on the study provided. This policy states:

2.4.5. WC 10.2.5 Automation/Human Factors policy was amended during the IFATCA Conference in Montego Bay, Jamaica (2023). During this discussion in Committee C, the members discussed the possible need for additional policy regarding deactivation of safety tools. The policy states:

2.4.6. WC 10.2.10 Short Term Conflict Alert (STCA): Human Factors/Legal Aspects policy should consider an amendment relative to the study provided. This policy states:

2.5. Examples by ANSPs, 2023 observations:

2.5.1. Several European member states have different operating parameters for their safety net systems.

2.5.1.1. In one European example, the Air Traffic Control Officers (ATCOs) cannot switch off any safety nets but they can suppress the medium term conflict alert, which does not turn off the entire system. The engineers can switch the system off when needed.  If they turn off the STCA, ATCOs will slow down the rate of flights to reduce risk.

2.5.1.2. In another, the parameters set on STCA activate 2 minutes before the projected loss of separation would occur and the alert cannot be suppressed.

2.5.1.3. In a third example, ATCOs cannot turn off any alerts that are safety nets; however, they are able to suppress the MSAW in some areas as long as the aircraft is on final approach or on a Standard Instrument Departure (SID) or Standard Terminal Arrival (STAR) to prevent false alerts. Only technical staff or system developers can turn the system off.

2.5.1.4. In an approach control facility, all controller tools and safety nets are switched off. At the Area Control Centre (ACC), there is STCA available but the approach control unit turns it off because it has been a nuisance alert since technicians cannot adjust the system to allow for different separation minima.

2.5.1.5. In a fifth example, the Supervisor can, at the request of the ATCO, turn off all alerts for a particular callsign, as in a photo mission or paradrop. This does mitigate the nuisance alert; however, all alerts are then turned off for that particular callsign.

2.5.1.6. In another, several safety nets are in use like a runway incursion and alerting system, and a go-around detections system, as well as safety nets in the electronic flightstrip system. These tools can only be turned off by engineers after approval of the supervisor.  For the approach control, there is no STCA, but a PSL (Pilot selected Level) warning is available based on the input from the pilot. This is a different type of safety net. ATCOs then get an alert if they assign an altitude/flight level (FL) and the pilot enters a different altitude/FL.

2.5.1.7. While in another, access to the functions of safety nets are limited to managers and technicians only. ATCOs can suppress some alerts; however, they cannot suppress STCA. ATCOs can only acknowledge and disable the audible portion. They can only suppress conflict alerts for specific flights operating in a flight or a group such as military aircraft in designated training areas.

2.5.2. In two member states in the Americas Region, ATCOs have Medium Term Conflict Alert which gives an initial advisory about the conflict, then will alert again as Short Term Conflict Alert (STCA) when a separation loss is imminent. ATCOs are able to suppress the first advisory acknowledging the alert and confirming that action is being taken to correct the situation. If that corrective action is not sufficient when separation loss is imminent, the alert will activate again and cannot be suppressed until separation is achieved. MSAW alerts are also in use which can be suppressed for a specific flight on approach to its destination.

2.5.3. An ANSP in South America has a generic alarm which was generated by any safety alert such as Secondary Surveillance Radar (SSR), duplicity, route deviation, etc. It was the sound of a telephone ring.  It was deactivated because it was considered a nuisance alarm. Safety alerts are on all the time but the audible alarm had to be turned off because it would alarm all day long. Some safety alerts do change colours, though.  For instance, red for an emergency.

2.5.4. In some member states, where the Thales Topsky system is in use, the ATCOs have the ability to suppress alerts when the situation dictates for example: a route diversion alert, when there is a thunderstorm and aircraft are deviating, they might turn off the diversion alert to prevent further distraction. They also have a visual alert which puts a coloured block (depending on the type of alert) around the aircraft label. ATCOs are unable to adjust the alerts and certain suppression areas around the aerodrome are defined because VFR aircraft would cause nuisance alerts often.

2.5.5. In the Middle East, ATCOs cannot turn off any alerts in approach and tower environments. The only way to turn off a low altitude alert is to define the label as a VFR aircraft. All other alerts will have an audible alert until the conflict is resolved.

2.5.6. In the Asia Pacific Region, ATCOs can turn off the alarms for individual aircraft but have a requirement to write it in the aircraft label on the display.

Conclusions

3.1. In evaluating the current definitions dealing with alerts in the ATC system contained in the IFATCA TPM, version 66.0 (2023) and understanding the discussion and reasoning for policy change in WP 158, Information Overload in ATC, Montego Bay, Jamaica (2023), it can be deduced that definitions should be updated and policies affected within the TPM may need to be reviewed and amended appropriately. A wording change to the policy WC 10.2.5 Automation/ Human Factors is needed to comply with current terminology. This paper and its purpose is solid and should remain in effect with only a minor amendment proposal.

3.2. The FAA’s study on nuisance alerts highlights the importance of eliminating those alerts that qualify as nuisance alerts and ensuring safety nets are tailored to be effective for each particular sector within every facility. An interesting point was made in the conclusion of this study when the authors noted that they could not tell what the controller was thinking at the time of an alert or what effect such a large number of nuisance alerts may have on controller performance without doing a “human in the loop” study or stopping the simulation and asking those particular questions.

3.3. Reviewing the 2023 examples provided by Member Associations shows that systems’ use and effectiveness vary. One constant seems to be that most ANSPs that have the ability to turn off the safety net system completely only do so in the event of an outage or when it has been identified as a nuisance alert. Otherwise, most ATCOs may only suppress the system for a single aircraft during that particular flight, or one conflict as an acknowledgement that sufficient action is being taken.  Based on these findings, it can be agreed that efforts should be made to eliminate nuisance alerts and that safety nets shall not be disengaged. In cases such as a system outage or system maintenance, contingency plans should be in place and ATCOs and supervisors should be advised of the impact on the operation.

3.4. It is vitally important that ATCOs be involved in the process of determining what qualifies as a nuisance alert and what alerts are important to an ATCO in the operation. It also may be important to explore visual alerts over audible alarms to ensure distractions to other controllers are kept to a minimum. Automation systems should also reactivate when a CA or MSAW lasts longer or becomes more urgent than a set of predetermined criteria. With ATCOs involvement, MAs and ANSPs should collaboratively conduct further analysis so as to build and improve suppression zones, MSAW grids, and determine controller response times to alerts to develop more precise parameters for use in safety alert algorithms.

3.5. In reviewing the current policies regarding ATC System alerts and warnings, it can be determined that concerns of the Member Associations could be addressed by amending some of these policies. It is necessary to include the ATCOs in the process of developing policies and procedures and ensuring nuisance alerts are omitted. The most important controller tools are effective safety nets that are properly developed and do not get deactivated.

Recommendations

4.1. IFATCA TPM (2023), Definitions, Safety Net, pg. 46

4.2. Add to the IFATCA TPM (2023), Definitions, Minimum Safe Altitude Warning (MSAW)

4.3. Add to the IFATCA TPM (2023), Definitions, Approach Path Monitor (APM)

4.4. As this paper developed and began to take shape beyond simply defining terms associated with the topic, we found that it was necessary to be consistent throughout our Technical and Professional Manual in definitions and policies. Therefore, we propose that the following policies and any other existing policies that are affected by these proposed definitions be reviewed for necessary changes jointly by the Technical Operations Committee and the Professional and Legal Committee. We propose the necessary changes be presented at our next IFATCA conference in 2025.

4.4.1. IFATCA TPM (2023), WC 10.2.5 – Automation/Human Factors

4.42. IFATCA TPM (2023) WC 10.2.10 – Short Term Conflict Alert (STCA): Human Factors/ Legal Aspects

4.43. IFATCA TPM (2023) ATS 3.16 – The Use of Safety Nets in ATM

4.44. IFATCA TPM (2023) ATS 3.19 – Minimum Safe Altitude Warning Systems

References

IFATCA Technical and Professional Manual Version 66.0- October 2023

Friedman-Berg, F., & Allendoerfer, K. (2008). Nuisance Alerts in Operational ATC Environments: Classification and Frequencies. Egg Harbor Township; Shantanu Pai.

Rice, S., & Ruskin, A. C. (2022). (rep.). ATC Signaling: The Role of Alarms, Alerts, and Warnings (Ser. Journal of Clinical Monitoring and Computing). Washington, DC: Submitted for Publication.

EUROCONTROL. (n.d.). Safety nets. SKYbrary Aviation Safety. https://skybrary.aero/articles/safety-nets

SKYbrary. (n.d.-a). Minimum safe altitude warning (MSAW). SKYbrary Aviation Safety. https://skybrary.aero/articles/minimum-safe-altitude-warning-msaw

SKYbrary. (n.d.). Approach Path Monitor (APM). SKYbrary Aviation Safety. https://skybrary.aero/articles/approach-path-monitor

EUROCONTROL. (2007, November 22). Eurocontrol Specification for Short Term Conflict Alert. Brussels; EUROCONTROL.

Montego Bay, Jamaica 2023- WP 158- Information Overload in ATC

Melbourne, Australia 2005- WP 87- Definition of Short Term Conflict Alert

Toulouse 1998- WP 98- Short Term Conflict Alert

^[1] IFATCA WP 98, Toulouse, 1998

^[2] IFATCA. (2023, October 2). Technical and Professional Manual. Montreal; International Federation of Air Traffic Controller Associations.

^[3] Friedman-Berg, F., & Allendoerfer, K. (2008). Nuisance Alerts in Operational ATC Environments: Classification and Frequencies. Egg Harbor Township; Shantanu Pai.