Envisaging the Future Air Traffic Management System

This art icle was downloaded by: [ John M. Flach] On: 12 Novem ber 2012, At : 13: 47 Publisher: Taylor & Francis I nform a Lt d Regist ered in England and Wales Regist ered Num ber: 1072954 Regist ered office: Mort im er House, 37- 41 Mort im er St reet , London W1T 3JH, UK The International Journal of Aviation Psychology Publicat ion det ails, including inst ruct ions f or aut hors and subscript ion inf ormat ion: ht t p: / / www. t andf online. com/ loi/ hiap20 Envisaging the Future Air Traffic Management System Andrew Neal a c St ef an Lehmann Hasenbosch a , John Flach a b , Mart ij n Mooij , St ephanie St ankovic a c a , & Samuel a Nat ional ICT Aust ralia, Brisbane, Aust ralia b Depart ment of Psychology, Wright St at e Universit y, Dayt on, Ohio, USA c School of Psychology, Universit y of Queensland, Brisbane, Aust ralia Version of record f irst published: 13 Jan 2011. To cite this article: Andrew Neal, John Flach, Mart ij n Mooij , St ef an Lehmann, St ephanie St ankovic & Samuel Hasenbosch (2011): Envisaging t he Fut ure Air Traf f ic Management Syst em, The Int ernat ional Journal of Aviat ion Psychology, 21: 1, 16-34 To link to this article: ht t p: / / dx. doi. org/ 10. 1080/ 10508414. 2011. 537557 PLEASE SCROLL DOWN FOR ARTI CLE Full t erm s and condit ions of use: ht t p: / / www.t andfonline.com / page/ t erm sand- condit ions This art icle m ay be used for research, t eaching, and privat e st udy purposes. Any subst ant ial or syst em at ic reproduct ion, redist ribut ion, reselling, loan, sub- licensing, syst em at ic supply, or dist ribut ion in any form t o anyone is expressly forbidden. The publisher does not give any warrant y express or im plied or m ake any represent at ion t hat t he cont ent s will be com plet e or accurat e or up t o dat e. The accuracy of any inst ruct ions, form ulae, and drug doses should be Downloaded by [John M. Flach] at 13:47 12 November 2012 independent ly verified wit h prim ary sources. The publisher shall not be liable for any loss, act ions, claim s, proceedings, dem and, or cost s or dam ages what soever or howsoever caused arising direct ly or indirect ly in connect ion wit h or arising out of t he use of t his m at erial. THE INTERNATIONAL JOURNAL OF AVIATION PSYCHOLOGY, 21(1), 16–34 Copyright © 2011 Taylor & Francis Group, LLC ISSN: 1050-8414 print / 1532-7108 online DOI: 10.1080/10508414.2011.537557 Downloaded by [John M. Flach] at 13:47 12 November 2012 Envisaging the Future Air Traffic Management System Andrew Neal,1 John Flach,2 Martijn Mooij,3 Stefan Lehmann,3 Stephanie Stankovic,1 and Samuel Hasenbosch3 1National ICT Australia, Brisbane, Australia, and School of Psychology, University of Queensland, Brisbane, Australia 2Department of Psychology, Wright State University, Dayton, Ohio, USA 3National ICT Australia, Brisbane, Australia The International Civil Aviation Organization (2005) Global Operational Concept proposes significant changes to the organization and delivery of air traffic management (ATM) services in the next 15 years. The aim of this article is to envisage the potential impact that these changes could have on the organization of work, the allocation of roles and responsibilities, and the demands that are placed on the people in those roles. The analysis is carried out using an abstraction hierarchy, analyzing the changes in the purpose and priorities of the future ATM system, the functions that it performs, the way that these functions might be allocated, and the types of displays and decision support tools that people will require to carry out these functions. The technology and procedures used for managing air traffic have evolved gradually over 60 years to deal with increased traffic load and complexity. However, incremental changes to technology and procedures are no longer sufficient to keep up with the growth in traffic. Traffic levels are growing at a rate of 4% to 6% per annum in most Western economies and demand is project to exceed capacity within a decade (International Civil Aviation Organization [ICAO], 2004). In its 2006 annual report, the U.S. Federal Aviation Administration Air Traffic Organization noted that “using our current approach, air traffic controllers will not be able to handle traffic at 25 percent above today’s levels. Traffic may increase this much by 2016” (p. 32). Correspondence should be sent to Andrew Neal, School of Psychology and NICTA QRL, The University of Queensland, Brisbane QLD 4072, Australia. E-mail: andrew@psy.uq.edu.au Downloaded by [John M. Flach] at 13:47 12 November 2012 ENVISAGING THE FUTURE 17 The ICAO has developed the Global Air Navigation Operational Concept in response to this problem. This represents a fundamental change in the operating paradigm for air navigation services (ICAO, 2005). Elements of the future operational concept include changes to the organization and management of the airspace designed to improve access and utilization, dynamic management of capacity to meet demand and respond to uncontrollable events (e.g., weather and emergencies), dynamic and flexible management of trajectories, synchronization of traffic flows to improve safety and efficiency, implementation of risk-based conflict management, and the seamless management of services across all phases of flight and all service providers. Major systems development programs are underway around the world to implement concepts within the Global Air Navigation Operational Concept. Examples include the Next Generation Air Transportation System (NextGen) program in the United States (Joint Planning and Development Office, 2007), and the Single European Sky ATM Research (SESAR) program in Europe (SESAR, 2007). Kirk (1970) began his text introducing optimal control theory with the axiom that “a problem well put is a problem half solved” (p. 3). The goal of this article is to begin to formulate the problem of future air traffic management (ATM) in a way that can guide a deliberate, iterative design process, with the specific goal of addressing some of the human–system integration challenges associated with the future ATM system. In posing this problem, a framework is needed that considers the operational demands and objectives for the envisioned system, the challenges and opportunities created by emerging technologies, and the changing responsibilities and demands on the human operators (e.g., pilots and air traffic controllers). One of the challenges that analysts face in developing such a framework is the complexity of the ATM system. ICAO (2005) argued that although the ATM system “is a holistic entity, … [it] … needs to be disaggregated to understand the sometimes complex interrelationship between its components” (pp. 2–3). ICAO (2005) decomposed the system on a mix of organizational and functional grounds, identifying eight components of the system at a single level of analysis. Although the Global Air Navigation Operational Concept represents a good starting point for analysis, further elaboration is needed, because it does not show the functional relationships among the components of the system, and the components themselves are not independent entities. To more effectively guide design efforts, a framework is needed that describes the ATM system at multiple levels of abstraction. This framework needs to explain how the objectives of a system at one level of analysis constrain the way that the components of that system are designed and organized at the next level down, and in turn, how these components interact to achieve the objectives of the system at the higher level. The framework that we have chosen for posing the problem is the abstraction hierarchy (Rasmussen, 1986; Vicente, 1999). Originally developed based on analysis of safety in nuclear power control systems, the abstraction hierarchy has been Downloaded by [John M. Flach] at 13:47 12 November 2012 18 NEAL ET AL. an important component of work analysis for complex human–machine systems. It organizes information about a system in terms of a nested hierarchy of means– ends relations or constraints. Beginning with the functional purposes of the system, each layer within this nested hierarchy sets the constraints for evaluating possibilities in the layers below. Thus, progressing down the levels, one can begin to elaborate from general purposes to specific details about design of the work systems to answer questions about how to satisfy these purposes. In a complementary fashion, working from the details up the abstraction hierarchy provides a logical justification for detailed design choices to answer questions about why a specific choice was made. It is important to emphasize that we are using the abstraction hierarchy as a vehicle for guiding an iterative search of a complex problem space and for integrating observations and hypotheses that emerge during the search of this space. Thus, this article is seen as a first step toward a more comprehensive formulation of the problem, not as the ultimate statement of the problem. As the first step in this iterative search, the focus is on comparing and contrasting the current ATM system with the envisioned system. The emphasis is on identifying significant changes in the work domain and the implication for function allocation (i.e., the roles of pilots and controllers) and the design of the associated information and decision support systems. Figure 1 provides an illustration of an initial abstraction hierarchy. At the top level, the fundamental question is what will constitute a satisfactory solution to the function of air traffic control. We suggest that this will at least involve balancing the demands for safety, efficiency, and economic costs. Ideally, the goal for the envisioned system will be to improve safety and efficiency while reducing costs relative to the existing system. At the second level, the general goals need to be operationalized in terms of priority measures. For example, one component of operationalizing safety will likely involve consideration of minimum separations among aircraft. At this level of abstraction, the goal is to formulate specific criterion measures that can be used to assess the control solutions specified at lower levels of the hierarchy. For optimal control theory, this would involve specification of the cost functional (Kirk, 1970). Although it becomes unrealistic to provide a closed-form cost functional for a system as complex as ATM, it is essential that the criterion for empirically evaluating and comparing alternative control solutions be explicitly considered. At the general function level, the system is described as a functional control process. Typically, functional flow diagrams are a good way to visualize the system at this level. In Figure 1 we show a rather generic control structure that could be appropriate to either the legacy or the envisioned ATM system. Later in the article, more detailed representations of the specific functions are considered that illustrate important differences between the legacy and envisioned ATM systems. The key thing at this level is to consider the forward loop processes Downloaded by [John M. Flach] at 13:47 12 November 2012 ENVISAGING THE FUTURE FIGURE 1 19 Analysis of air traffic management system using an abstraction hierarchy. for accomplishing specific goals (i.e., the action system for directing air traffic) and the feedback processes for (a) guiding action with regard to specific goals (i.e., perceptual processes for assessing the responses to specific commands), and (b) evaluating overall progress with regard to satisfying the functional purposes of the system (i.e., metacognitive processes for achieving global situation awareness). As more detail is added to the control process diagram, the details of how each function is allocated among the system components becomes more precisely defined. Thus, at the physical function level, the central question is one of function allocation; that is, who or what will be responsible for carrying out specific functions. This involves consideration of allocation of function among humans (e.g., shifting responsibilities between controllers and pilots), as well as allocation of function between humans and automation (e.g., will humans be active controllers or monitors of automated control systems). At this level, it can be important to also consider the potential cognitive strategies and activities that will be adopted by the specific humans (e.g., see Naikar, Moylan, & Pearce, 2006). Downloaded by [John M. Flach] at 13:47 12 November 2012 20 NEAL ET AL. Finally, at the physical form level, specific questions about how the system will be implemented can be considered. Of most interest in terms of the cognitive aspects of work will be the details of the communication and interface systems. That is, it will be important to know how information will be presented to decision makers on displays and devices, the way that they will communicate with each other, and the types of decision support tools that they will need. The information and communication configurations should be considered in the context of the strategies and activities considered at the functional form level. Thus, the goal of this article is to flesh out a problem statement for the envisioned ATM system using the abstraction hierarchy. A section is devoted to each of the five levels in Rasmussen’s abstraction hierarchy. Within each section we compare and contrast the legacy system with the envisioned system with the primary goal of anticipating changes that will impact the nature of cognitive work involved and generating hypotheses to guide the design of the work organization and the associated information and decision support systems. FUNCTIONAL PURPOSE According to ICAO (2005), the purpose of the future ATM system is to enable “the dynamic, integrated management of air traffic and airspace—safely, economically and efficiently—through the provision of facilities and seamless services in collaboration with all parties” (p. 1). Implicit within this statement of purpose is an intent to address the limitations of the current ATM system. These limitations include the inefficient and inflexible use of resources, such as airspace and aerodromes; limited exchange of information and coordination among decision makers at both strategic and tactical levels; and limited use of strategic planning as a means of optimizing the allocation and deployment of resources (ICAO, 2005). The result is that aircraft users are required to fly inefficient trajectories, and are subject to excessive delay. These problems will become more acute as traffic levels continue to grow. The purpose of the future ATM system, as developed in the ICAO Global Operational Concept, is to enable it to deal effectively with the projected increase in traffic levels over the next 15 years by making the system more efficient and cost effective. PRIORITY MEASURES In this section, we consider some of the metrics by which safety, efficiency, and cost-effectiveness might be evaluated in the future system. We start with safety, because it is the highest priority for all stakeholders in the ATM system, including both airspace users and ATM service providers. ICAO (2006) defined safety as Downloaded by [John M. Flach] at 13:47 12 November 2012 ENVISAGING THE FUTURE 21 “the state in which the risk of harm to persons or of property damage is reduced to, and maintained at or below, an acceptable level through a continuing process of hazard identification and risk management” (p. 1). From an operational perspective, the primary means by which the risk of harm is maintained within acceptable levels is by ensuring that aircraft are separated from hazards. The definition of hazards presented in the ICAO Global Operational Concept is broader than that used for current operations. In the current system, the ATM service provider is responsible for assuring separation between aircraft. Separation is considered to be “assured” if all aircraft have clearances that guarantee that no aircraft can violate the applicable separation standards, provided it conforms to those clearances. The standards that are applied depend on the surveillance medium being used and the navigational capabilities of the aircraft, and are expressed in terms of distance or time. For example, a commonly used standard for aircraft flying below 29,000 ft in enroute airspace requires aircraft to be separated by at least 5 nm laterally and 1,000 ft vertically, if radar coverage is present. Under the new concept, all potential hazards to flight are to be considered, including terrain, weather, and obstructions on the ground. Furthermore, the concept allows for the development of new standards that allow the risk of collision to be managed dynamically. Thus the separation minima can change, depending on the spatial and temporal properties of the trajectories that are involved. As with the current system, however, the frequency and severity of breakdowns of separation is likely to remain one of the primary indicators of safety for the system (ICAO, 2006). Although breakdowns of separation are a necessary indicator of safety, other sets of metrics are possible. Load is a particularly important consideration in the design and operation of the current and future ATM systems. An ATM system is in a vulnerable state when the demand for ATM services exceeds the capacity of the system to deliver those services safely. There are a number of capacity limits within the current system, including the information processing capacity limits of the controllers providing ATM services, operational constraints (e.g., airspace and procedures), and the physical capacity limits of the communications systems (e.g., due to radio channel congestion) and infrastructure (e.g., runway arrival rates). Ensuring that the capacity is available to meet the growing demand for ATM services is one of the major priorities for the future system. As with safety, efficiency can be operationalized in many different ways. Important aspects of efficiency include the efficient use of airspace and resources, the efficient flow of traffic, and the efficient delivery of services and flow of work. The efficient use of airspace and resources (e.g., runways) is important for airspace owners and ATM service providers. These stakeholders wish to ensure that the available capacity is used, and that periods of excess capacity are minimized. The efficient flow of traffic is also important for ATM service providers, who wish to ensure that aircraft fly in orderly streams to minimize the requirement for tactical intervention and control. The efficient delivery of services is important for both 22 NEAL ET AL. Downloaded by [John M. Flach] at 13:47 12 November 2012 ATM service providers and airspace users, who wish to ensure that services are delivered in a way that minimizes requirements for coordination and ongoing monitoring. Cost-effectiveness is a priority for airspace users. ATM-related costs include the direct cost of ATM service provision (e.g., airspace usage charges) and indirect costs stemming from the actions of the ATM service provider that cause disruptions to planned trajectories. These indirect costs include additional fuel consumption caused by flying suboptimal trajectories and costs of delays and disruption to schedules. GENERAL FUNCTIONS The ICAO Global Operational Concept envisages that the primary means by which the priorities already described are to be achieved is via trajectory management. In the current system, trajectories are managed in a rudimentary way, by controllers issuing clearances to aircraft to fly along specific routes at specific levels. In the future system, it is intended that this take the form of an agreement between an airspace user and the ATM service provider regarding the trajectory that will be flown from departure to destination, and the distribution of responsibilities for the provision of ATM services. This agreement is to describe the position that the aircraft is to be at each time point, and is to include a tolerance band to accommodate the anticipated variability in aircraft performance. Trajectory management can be conceptualized as a control process, which delivers a range of services over different time scales. The three major services incorporated within trajectory management are conflict management, demand and capacity balancing, and traffic synchronization. The ICAO Global Operational Concept envisages that these services will be integrated seamlessly, and will be carried out strategically, pretactically, and tactically. We use the term dynamic traffic flow management when referring to tactical control (ASTRA, 2007). One of the major changes envisaged within the Operational Concept is an increased emphasis on strategic and pretactical planning to minimize the requirement for tactical adjustments to aircraft trajectories. Services Conflict management is the means by which the risk of collision between aircraft and hazards is maintained at an acceptable level (ICAO, 2005). In the current system, the ATM service provider is responsible for assuring separation between aircraft. This is currently a tactical service. In the future system, it is envisioned that the agent responsible for the provision of separation services could be either the ATM service provider or the airspace user, and that the allocation of responsibility Downloaded by [John M. Flach] at 13:47 12 November 2012 ENVISAGING THE FUTURE 23 for separation provision might vary depending on the airspace and hazard. Furthermore, it is planned that conflicts will be managed strategically to reduce the need for tactical intervention. Demand and capacity balancing is the means by which the demand for ATM services, and the capacity of the ATM system to provide those services, is optimized. In the current system, there is limited scope for adjusting capacity to meet demand. As a result, the major emphasis is on the regulation of demand to ensure that it stays within capacity limits. The ICAO Global Operational Concept places greater emphasis on ensuring the capacity is available to meet anticipated demand, and dynamically adjusting capacity in response to unforeseen events, such as disruptive weather or delays. Traffic synchronization is the means by which an orderly and efficient flow of traffic is established. In the current system, attempts to control flow focus on arrival streams at major airports. Flow control is used to establish an arrivals sequence that maximizes the use of runway facilities. This is achieved by ensuring that aircraft arrive at designated feeder fixes at nominated times, or are placed in a designated sequence with minimum spacing requirements. Because flow tends to be managed during the final phases of flight, the effect of flow control is to cause delays for aircraft while they are airborne. The ICAO Operational Concept envisions that flow will be managed more strategically through all phases of flight, thereby minimizing the requirement for tactical interventions that delay airborne aircraft. Timescales At the strategic level, the goal is to ensure capacity is available to meet the projected demand for ATM services. Strategic planning can occur up to a year in advance, and is expected to involve collaborative decision making. The intent is that ATM service providers evaluate the likely demand for ATM services, as airspace users develop their schedules and nominate the trajectories that they would like to fly. During these early stages of planning, the ATM service provider is responsible for organizing the structure of the airspace to accommodate the anticipated needs of the users, and ensuring sufficient resources are available to provide the required services. The purpose of pretactical planning is to ensure that planned trajectories are free of conflicts, an orderly flow can be established, and sufficient capacity is available to ensure that the ATM services that are required during all phases of flight can be provided. The intent is to ensure that choke points are eliminated, and that all aircraft can fly their agreed trajectories without disruption. Where necessary, airspace can be reorganized to ensure that sufficient capacity is available. Pretactical planning can be carried out once there is reasonable certainty regarding the trajectories that airspace users wish to fly, and is likely to occur between 1 and Downloaded by [John M. Flach] at 13:47 12 November 2012 24 NEAL ET AL. 7 days prior to departure. The outcome of the pretactical planning process is a 4D trajectory contract. Dynamic traffic flow management occurs in real time, from when the aircraft commences its trajectory to when it arrives at its destination. The purpose of dynamic traffic flow management is to ensure that aircraft users fly their agreed trajectories, and to adjust those trajectories, when required, for the purposes of conflict management, traffic synchronization, or demand and capacity balancing. These adjustments might be made in response to adverse weather, traffic conditions, changes in the availability of airspace, equipment outages, or other unplanned events. Where possible, adjustments to trajectories are to be made before the aircraft departs to minimize delays while the aircraft is airborne. When aircraft are airborne, early adjustments to trajectories might be made to improve the flow of traffic and reduce congestion at choke points, thereby minimizing the need for more disruptive interventions at the choke point. PHYSICAL FUNCTIONS In this section, we examine the control process in the current and future systems in more detail. To keep the analysis tractable, we focus on dynamic traffic flow management, although the approach can be generalized to deal with the strategic and tactical planning functions as well. An illustration of the control process is shown in the physical functions layer in Figure 1. This illustration shows a standard closed loop system, with adaptive control. Regardless of who is responsible for dynamic trajectory management, we assume that a perceptual rocess must monitor the trajectories that aircraft fly. We assume that a goal process generates a representation of the trajectory that the aircraft should fly. Discrepancies between the perceived and desired trajectories produce error, which is fed into a decision process. The decision process generates control actions that influence user operations, which are subject to ongoing monitoring by the perceptual process. We assume that decision makers have a model of the system that they are controlling, enabling them to anticipate the effects of their actions. The model generates metacognitive states, such as perceived workload, which influences the goal process and the decision process via adaptive logic. Thus, the system has two ways that it can adapt to changes in perceived workload: by changing the criteria for evaluating decision alternatives, and by modifying the set point that it is trying to achieve (e.g., the level of separation among aircraft). In the following sections, we use this model as a framework for analysis. Specifically, we examine the allocation of responsibilities among air traffic controllers and pilots, the way that they carry out these responsibilities, the information that is required, and the way that they can adapt to changes in demands. ENVISAGING THE FUTURE 25 Downloaded by [John M. Flach] at 13:47 12 November 2012 Who Controls What? In the current system, ATM service providers are responsible for the provision of ATM services within controlled airspace. The ICAO Global Operational Concept, by contrast, proposes that airspace users should retain primary responsibility for the provision of ATM services, and that ATM services will only be provided by an ATM service provider when requested by airspace users. However, the Operational Concept also states that the allocation of responsibilities is subject to the design of the ATM system, and the capacity of relevant parties to provide those services. Therefore, for the system to satisfy safety criteria, airspace users might be required to delegate responsibility for the provision of some or all ATM services to an ATM service provider in certain types of airspace. One likely scenario is that airspace users will be required to delegate responsibility for the provision of ATM services to the ATM service provider in high-density airspace and at major airports. However, in low-density airspace, or at minor airports, airspace users might have the option of retaining responsibility for some or all ATM services. This could occur over the oceans or areas of continental airspace with sparse traffic. Airspace users are likely to vary in their capacity to provide ATM services for themselves, so there might be a mixture of service provision arrangements in these types of airspace. It is likely that airspace will continue to be divided into sectors within flight information regions, although sectors might be designed so that they can be reconfigured dynamically in response to changes in demand. Sectors might be staffed by teams of air traffic controllers, or by a single controller. Air traffic controllers will be responsible for the provision of ATM services to aircraft within their sector that have delegated the responsibility for those services to the ATM service provider. Pilots will be responsible for the provision of ATM services for their own aircraft in all other cases. How Is Control Established and Maintained? The ATM services that we are concerned with in this analysis are conflict management, traffic synchronization, and demand and capacity balancing. If we assume that air traffic controllers are responsible for the provision of these services in high-density airspace, then in general terms, the control process is likely to be similar to that in the current system. We expect that controllers will evaluate the planned trajectories of aircraft before they come under their jurisdiction to confirm that there are no conflicts, and to identify any potential problems involving flow or capacity. Problems with planned trajectories can be caused by a range of unforeseen events, including weather, changes in airspace availability, and changes in the ability of aircraft to conform to their planned trajectory (e.g., due to in-flight emergencies). If problems are detected before the aircraft enters the sector, the controller can coordinate with the upstream controller to resolve them. If the problem is Downloaded by [John M. Flach] at 13:47 12 November 2012 26 NEAL ET AL. not resolved by the upstream controller, the downstream controller can start developing a plan to resolve the problem, or wait until the situation has evolved further before starting planning. The decision to defer planning depends on the level of uncertainty surrounding the problem. Once the aircraft is under jurisdiction, the controller can reevaluate the trajectory, revise existing plans or develop a new plan, and execute control actions when required. The trajectory of the aircraft will then be monitored to ensure that the intervention is effective. Controllers currently use relatively simple strategies for solving problems (Eyferth, Niessen, & Spaeth, 2003; Fothergill & Neal, 2008; Kirwin & Flynn, 2002). For example, when resolving conflicts, controllers use strategies such as vectoring one aircraft behind another (point behind); parallel tracking; direct tracking; and assigning the nearest available level above or below the conflict zone, or the level that is closest to the aircraft’s desired level. These strategies take into account the controllers’ uncertainty regarding aircraft trajectories and the safety margin that they apply over and above the legally required separation minima (Loft, Bolland, Humphreys, & Neal, 2009). Strategies for managing flow include adjusting the speed of aircraft, applying vectors, and putting aircraft in holding patterns. Strategies for maintaining demand within capacity limits include calling for a spotter to assist the controller and coordinating with adjacent controllers to hold traffic upstream. The major difference between the current and future system lies in the way that trajectories are evaluated, and the way the problems are resolved. In the future system, the controller is to be given an agreed trajectory that is planned to be free of conflicts. The goal is to ensure that aircraft can proceed along that trajectory without delay, and arrive at its destination at the agreed time. If potential delays are detected before the aircraft is airborne, then it is expected that the aircraft will be allowed to hold on the ground until it can be given a trajectory that is free of delay. Once aircraft are airborne, it is expected that problems will be detected and resolved as early as possible to minimize disruption. This requires a longer lookahead window, and any intervention that is proposed has to consider the impact on the entire trajectory of the aircraft, as well as any other aircraft that are affected by that decision. Currently, the look-ahead window is much shorter, and the focus of tactical control is on the immediate problem, without much consideration of the downstream consequences. Furthermore, the trajectory evaluation process will be more complex, because there might be a greater mix of separation standards, and these standards could be dynamic. For example, standards might change, depending on the spatial and temporal relationships among trajectories, to keep collision risk within a particular range. In addition, the controller needs to be able to evaluate the overall flow of traffic through the sector more effectively to carry out traffic synchronization. Finally, in the future system, it is expected that any modification to the trajectory is done in collaboration with the airspace user. This imposes a greater requirement for coordination on the system, as these changes might need to Downloaded by [John M. Flach] at 13:47 12 November 2012 ENVISAGING THE FUTURE 27 be negotiated, not only with the airspace user, but also with downstream controllers and other airspace users that could be affected. In low-density airspace, the control process can be distributed among pilots and air traffic controllers. Regardless of who the agents are that are responsible for trajectory management (pilot or controller), these agents will need to evaluate the trajectories for which they are responsible, coordinate with other stakeholders, develop and revise plans, execute plans, and monitor. Coordination among decision makers will become a critical issue in this airspace, because the actions of any one party can have implications for others. For example, if a stream of aircraft is flying toward weather, the agents responsible for provision of separation services and the maintenance of flow need to collaborate to develop an effective solution that does not unnecessarily disadvantage any one party. The coordination requirements are further increased if the proposed changes to trajectories affect the point in space and time where aircraft reenter high-density airspace, because these changes could disrupt planned arrival sequences within high-density airspace. Thus, a collaborative decision-making process might involve multiple pilots and air traffic controllers. It is currently an open question as to how a distributed decision-making process can be structured so as to achieve an optimal outcome for the group of airspace users as a whole (e.g., see Dwyer & Landry, 2009; Metzger & Parasuraman, 2005; Wickens & Colcombe, 2007). One option is that the ATM service provider can act as an independent arbiter in situations where agreement cannot be reached, or where the number of affected parties makes collaborative decision making infeasible. What Information Goes to Whom? In general terms, whoever has responsibility for providing ATM services needs information regarding hazards, flow, and load. To perform the conflict management function, a decision maker requires information regarding the trajectories of aircraft that are (or will be) under their jurisdiction in relation to any hazards that they will encounter, including other aircraft trajectories, weather, terrain, and restricted airspace. To perform the traffic synchronization function, a decision maker requires information regarding the current and projected flow of aircraft within different streams. To perform the demand and capacity-balancing function, a decision maker requires information regarding the demand for ATM services at different points in space and time, and the capacity of the person and system to provide those services. How Does the Process Adapt to Changes in Demand and Unforseen Events? The control process used for dynamic trajectory management needs to be adaptive, as it must respond to changes in anticipated demand and unforseen events, such as Downloaded by [John M. Flach] at 13:47 12 November 2012 28 NEAL ET AL. weather, delays, and emergencies. One way to adapt is by adjusting decision criteria. Psychological theories of decision making assume that value of decision options can change over time, depending on goal importance (Roe, Busemeyer, & Townsend, 2001). In an ATM context, we assume that a decision maker can evaluate decision options with respect to three criteria: safety, efficiency, and cost-effectiveness. Furthermore, we assume that the importance of these criteria can change over time, in response to the situation. In the current system, the subjective importance of efficiency and cost-effectiveness to the air traffic controller will decrease as the anticipated level of workload increases, potentially producing a shift in strategy (Leroux, 2000). For example, Fothergill and Neal (2008) found that controllers used conflict resolution strategies that minimized disruption to aircraft when under low workload, but used strategies that imposed heavier penalties on aircraft when under high workload, to keep their workload within safe bounds. We expect that a similar process will operate in the future ATM system, although the way that decision makers trade-off among decision criteria will vary, depending on who has responsibility for the decision. Whereas air traffic controllers might trade-off cost-effectiveness for safety and efficiency, pilots might trade-off efficiency for safety and cost-effectiveness. A second way in which a control process can adapt is by adjusting its reference signal. In the case of conflict management, the decision maker might adjust the level of separation that they aim to achieve (i.e., their safety margins). For example, Loft et al. (2009) reported that as workload increases, air traffic controllers become more conservative, applying larger safety margins to assure separation. The effect of this mechanism is that controllers might intervene more frequently as traffic volumes increase, thereby disrupting the flow of traffic and adding to delay. We expect that a similar effect could be observed in the future system, although it is harder to predict the effects when responsibility for conflict management is distributed among multiple agents, each of whom might be adapting to load in different ways. PHYSICAL OBJECTS In this section, we consider the information displays, communications technologies, and decision support tools that will be required to enable air traffic controllers and pilots to manage trajectories effectively. We start by considering the displays and devices that are currently used and evaluate the ways that they might need to change. Current System Displays. The information displays that are currently used by air traffic controllers vary across jurisdictions and across the different types of air traffic control Downloaded by [John M. Flach] at 13:47 12 November 2012 ENVISAGING THE FUTURE 29 (e.g., aerodrome control vs. en-route control). In general terms, however, most air traffic control systems include air situation and weather displays, an electronic flight data record, and flight strips. The air situation display shows the current position of aircraft using track symbols. Information regarding the aircraft is shown on a data block attached to the track symbol. The most important information in the data block is the current level at which the aircraft is flying, the level at which the aircraft has been cleared to fly, and the call sign of the aircraft. Information regarding the position and level of the aircraft can potentially be obtained from different sources, which vary in the level of precision that they provide. These include radar, on-board navigation systems (e.g., Automatic Dependent Surveillance–Broadcast), flight plans, and position reports provided by pilots. In cases where mixed surveillance modes are possible, the air situation display will represent the surveillance mode using different track symbols. Additional information that can be displayed in the data block includes wake turbulence category, aircraft type, and destination. History trails and velocity vectors can also be displayed to provide a visual representation of velocity and immediate future position. The display of additional information in the data block and the use of history trails and velocity vectors could be at the discretion of the air traffic controller, or could be mandated by local procedures. Weather information is typically shown on a separate display. Information regarding the aircraft’s intended route is represented in the form of an electronic flight data record. The pilot is required to lodge a flight plan prior to takeoff, which forms the basis of this data record. The flight data record typically represents the route that the aircraft plans to fly in the form of a series of waypoints, with requested levels and estimated times over those waypoints. This data record is accessible to all controllers who will have jurisdiction over that aircraft, and is updated as the aircraft progresses along its flight. Some of the information in the flight data record might be updated automatically, but much of it has to be entered manually by the air traffic controller. For example, if an aircraft is given a new route, the controller has to enter the new route into the flight data record. The manual entry of data into the system is a significant source of controller workload in the current system, and is a source of potential error. Flight strips provide a compact representation of information held in the flight data record for aircraft that are under jurisdiction or will enter the sector at some point in the future. In the past, flight strips were printed on paper. In many jurisdictions, paper flight progress strips have been replaced by electronic strips. The electronic strip is useful, because it provides a compact way of viewing upcoming flights, and provides an easy way to enter flight data. Communications. In the current system, the primary mode of communication between pilots and controllers and among controllers is by voice. Voice communications with pilots are conducted by radio, whereas voice communications Downloaded by [John M. Flach] at 13:47 12 November 2012 30 NEAL ET AL. among controllers are conducted by intercom or telephone, or are done face to face, if at adjacent consoles. Radio communications represent a major bottleneck in the system, because only one person can feasibly transmit on a radio frequency at a time. As traffic levels increase, communications takes up an increasing proportion of the controllers’ time, leaving less time available for other activities such as scanning, problem solving, and data entry. Data-link technology is being deployed to address the problem of radio communications congestion. Controller pilot data link communication (CPDLC) has been developed to address saturation and redundancy in radio communications between pilots and controllers (Kerns, 1991). Data-link technology is used to transmit text-based messages. The format of the messages is typically preformed, and the user selects or enters information in a limited set of fields. CPDLC enables air traffic controllers to issue level assignments, crossing constraints, lateral deviations, route changes and clearances, speed assignments, radio frequency assignments, and various requests for information. Pilots on the other hand can use CPDLC to request conditional clearances (downstream) and information from a downstream air traffic service. As voice communications are costly in time and cognitive resources, a text-based communication system should improve the quality and decrease the quantity of verbal communications between pilots and air traffic controllers. Decision support tools. A range of decision support tools have been developed by ATM systems providers to enable controllers to do their job more effectively. Examples of decision support tools that enable the controller to obtain information regarding the trajectories of individual aircraft include bearing and range lines and route probes, and functions to calculate time of crossing. A bearing and range line can provide information regarding the distance between aircraft, distance to waypoint, and time to waypoints. A route probe provides a visual representation of the route that an aircraft plans to fly and the estimated times at waypoints. Decision support tools have also been developed to help en route controllers detect and resolve conflicts, and set up arrivals sequences. Conflict detection tools, such as the User Request Evaluation Tool in the United States and Medium Term Conflict Detection in Europe, detect conflicts between aircraft based on flight plan and radar track data. These tools provide midterm conflict detection and evaluation for route requests to air traffic controllers with a look-ahead time of 20 min. Both tools were developed and began to be implemented a decade ago to assist the planning controller and reduce controllers’ workload. However, studies have shown that these tools do not necessarily produce a decrease in workload or improvement in situation awareness (e.g., Kauppinen, Brain, & Moore, 2002; Sollenberger, Willems, Della Rocco, Koros, & Truitt, 2005). Moreover, studies have reported problems relating to a lack of trust in these tools, due to the relatively high ENVISAGING THE FUTURE 31 incidence of false alarms (Corker & Mooij, 2005; Kauppinen et al., 2002). Flow advisory tools have also been developed that provide a visual representation of the current arrivals sequence, and the required arrivals sequence, both in terms of order and relative time. These tools make it easier for controllers to identify aircraft that are out of sequence, and those that require delay, thereby enabling the controller to ensure that aircraft are handed off at metering fixes at the required time. Downloaded by [John M. Flach] at 13:47 12 November 2012 Future System The introduction of 4D trajectory management will require the development of new types of displays, decision support tools, and communication technologies. For an air traffic controller or pilot to perform the conflict management function effectively, the display will need to be able to represent the 4D trajectory that one or more aircraft have agreed to fly, the tolerance bounds around those trajectories, and the progress of the aircraft along those trajectories with reference to the tolerance bounds. If the performance of an aircraft is such that it is unlikely to be able to conform to its agreed trajectory (e.g., due to adverse wind), the display needs to be able to represent the point at which the predicted trajectory is expected to deviate from the agreed trajectory. An example of a display that is currently under development that might have some of the properties required to support conflict management in the future system is the Multi Conflict Display (MCD; Gaukrodger et al., 2009). The MCD represents the relationship between the trajectories of two aircraft in the form of a point symbol. The location and movement of the point symbol provides an indication of conflict risk, with symbols moving toward the center of the display representing trajectories with a greater conflict risk. The display, therefore, provides a visual representation of the relationships among trajectories, enabling conflicts to be directly perceived. Modifications might also be required to enable controllers, and possibly pilots, to perform traffic synchronization. Currently, there is no direct representation of flow to a controller, apart from flow advisory tools that show the time at which individual aircraft are required to be at feeder fixes. These tools do not provide a good representation of the stream as a whole, as they are focused on the individual elements (i.e., the aircraft). More direct representations are possible, such as heat maps that display the orderliness of the traffic (Puechmorel & Delahaye, 2009). Finally, we predict that design innovations will also be required to enable controllers to perform demand and capacity balancing. Displays and decision support tools might be designed to provide a representation of demand in relation to capacity. For example, displays could be designed to represent the predicted demand on, and capacity of, physical resources (e.g., runways) and human resources (pilots and air traffic controllers). The latter type of display requires a model capable of predicting cognitive load from planned trajectories. Progress has been made to- 32 NEAL ET AL. ward the development of such a model over the past decade, although challenges remain in developing a model that provides robust predictions across different sector types and traffic configurations (Kopardekar & Magyarits, 2003; Loft, Sanderson, Neal, & Mooij, 2007; Neal et al., 2007). Downloaded by [John M. Flach] at 13:47 12 November 2012 SUMMARY The ICAO Global Operational Concept proposes significant changes to the way that ATM services are to be delivered in the future. These include an increased emphasis on strategic and pretactical planning, greater integration among ATM services, and collaborative decision making. The new system is likely to produce changes in the roles and responsibilities of different stakeholders, as well as the demands that are placed on them. The abstraction hierarchy is a useful tool for designers and analysts to envision the potential effects that these changes might have at different levels of abstraction, and for informing the design process. This reflects a widely held view (Marr, 1982) that cognitive systems require decomposition across levels of abstraction (e.g., computational, algorithmic, implementation) for complete understanding. Each level of abstraction reveals constraints that are difficult or impossible to “see” from alternative levels. No matter how elaborate or detailed the analysis, an analysis of a cognitive system at a single level of abstraction will miss constraints that shape the performance of that system. It is the loose coupling of constraints across the levels of abstraction (e.g., how goals and values guide choices and activities) that determines the ultimate stability of the cognitive system. Thus, systems engineers interested in modeling or designing stable cognitive systems must incorporate multilevel descriptions, as reflected in the abstraction hierarchy, in their models. Analytic tools of the type developed in this article are needed, because there is a long history of systems development and modernization programs that have failed. One of the major causes of these failures has been the difficulty of identifying and mitigating human–system integration risks sufficiently early during the systems development process (Pew & Mavor, 2007). The next-generation ATM systems development programs that are currently underway in the United States, Europe, and other jurisdictions are ambitious and carry significant risk of failure. An extensive research and development effort is underway around the world to ensure that these programs do not fail. The analytic framework presented in this article can contribute to this research effort. ACKNOWLEDGMENTS This project was funded by National ICT Australia (NICTA). NICTA is funded by the Australian Government as represented by the Department of Broadband, ENVISAGING THE FUTURE 33 Communications and the Digital Economy and the Australian Research Council through the ICT Centre of Excellence program. Downloaded by [John M. Flach] at 13:47 12 November 2012 REFERENCES ASTRA. (2007). Air Traffic Management 07: A strategic vision for Australia. Part B: Operational evolution document. Canberra: Australian Strategic Air Traffic Management Group. Corker, H., & Mooij, M. (2005). Adaptation and adoption of technologies: Examination of the User Request Evaluation Tool (URET) 1. San Jose, CA: HAIL. Dwyer, J. P., & Landry, S. (2009). Separation assurance and collision avoidance concepts for the next generation air transportation system. Lecture Notes in Computer Science, 5618, 748–757. Eyferth, N., Niessen, C., & Spaeth, O. (2003). A model of air traffic controllers’ conflict detection and conflict resolution. Aerospace Science and Technology, 7, 409–416. Fothergill, S., & Neal, A. (2008). The effect of workload on conflict decision-making strategies in air traffic control. Proceedings of the Human Factors and Ergonomics Society, 52, 39–43. Gaukrodger, S., Wong, W., Fields, B., Loomes, M., Han, F., Aracón, M. M., et al. (2009, December). The Multi-Conflict Display. Paper presented at the Eurocontrol 8th Innovative Research Workshop & Exhibition, Bretigny, France. International Civil Aviation Organization. (2004). Outlook for air transport to the year 2015 (No. 304). Montreal, Canada: Author. International Civil Aviation Organization. (2005). Global air traffic management operational concept (No. 9854). Montreal, Canada: Author. International Civil Aviation Organization. (2006). Safety management manual (SMM) (No. 9859). Montreal, Canada: Author. Joint Planning and Development Office. (2007). Concept of operations for the next generation air transportation system. Washington, DC: Author. Kauppinen, S., Brain, C., & Moore, M. (2002, October). European medium-term conflict detection field trials. Paper presented at the IEEE 21st Digital Avionics Systems Conference, Irvine, CA. Kerns, K. (1991). Data-link communication between controllers and pilots: A review and synthesis of the simulation literature. International Journal of Aviation Psychology, 1, 181–204. Kirk, D. E. (1970). Optimal control theory. Englewood Cliffs, NJ: Prentice-Hall. Kirwin, B., & Flynn, M. (2002). Investigating air traffic controller conflict resolution strategies (Pub. No. ASA.01.CORA.2.DEL04-B.RS). Brussels, Belgium: EUROCONTROL. Kopardekar, P., & Magyarits, S. (2003, June). Measurement and prediction of dynamic density. Paper presented at the 5th USA/Europe ATM 2003 R & D Seminar, Budapest, Hungary. Leroux, M. (2000). Cognitive aspects and automation. In N. B. Sarter & R. Amalberti (Eds.), Cognitive engineering in the aviation domain (pp. 99–133). Mahwah, NJ: Lawrence Erlbaum Associates, Inc. Loft, S., Bolland, S., Humphreys, M. S., & Neal, A. (2009). A theory and model of conflict detection in air traffic control: Incorporating environmental constraints. Journal of Experimental Psychology: Applied, 15, 106–124. Loft, S., Sanderson, P., Neal, A., & Mooij, M. (2007). Modeling and predicting mental workload in en route air traffic control: Critical review and broader implications. Human Factors, 49(3), 376–399. Marr, D. (1982). Vision: A computational investigation into the human representation and processing of visual information. New York, NY: Freeman. Metzger, U., & Parasuraman, R. (2005). The role of the air traffic controller in future air traffic management: An empirical study of active control versus passive monitoring. Human Factors, 43(4), 519–528. Downloaded by [John M. Flach] at 13:47 12 November 2012 34 NEAL ET AL. Naikar, N., Moylan, A., & Pearce, B. (2006). Analyzing activity in complex systems with cognitive work analysis: Concepts, guidelines, and case study for control task analysis. Theoretical Issues in Ergonomics Science, 7(4), 371–394. Neal, A., Mooij, M., Bolland, S., Xiao, T., Lindsay, P., & Boag, C. (2007). Using multi-level analysis to model the sources of variability in workload within and between sectors. In Proceedings of the 14th International Symposium on Aviation Psychology (pp. 423–468). Santa Monica, CA: Human Factors and Ergonomics Society. Pew, R., & Mavor, A. (2007). Human–system integration in the system development process: A new look. Washington, DC: National Academies Press. Puechmorel, S., & Delahaye, D. (2009, March). New trends in airspace complexity. Paper presented at the ENRI International Workshop on ATM/CNS, Tokyo, Japan. Rasmussen, J. (1986). Information processing and human–machine interaction: An approach to cognitive engineering. New York, NY: North Holland. Roe, R. M., Busemeyer, J. R., & Townsend, J. T. (2001). Multialternative decision field theory: A dynamic connectionist model of decision making. Psychological Review, 108(2), 370–392. Single European Sky ATM Research. (2007). The ATM target concept (Pub. No. DLM-0612-00102-00a). Brussels, Belgium: Author. Sollenberger, R. L., Willems, B., Della Rocco, P. S., Koros, A., & Truitt, T. R. (2005). Human in loop simulation evaluating the collocation of the User Request Evaluation Tool, Traffic Management Advisor, and Controller-Pisot Data Link Communication: Experiment 1—Tool combination. Springfield, VA: Federal Aviation Administration. U.S. Federal Aviation Administration Air Traffic Organization. (2006). 2006 Annual Performance Report. Washington, DC: U.S. Department of Transportation. Vicente, K. J. (1999). Cognitive work analysis. Mahwah, NJ: Lawrence Erlbaum Associates, Inc. Wickens, C. D., & Colcombe, A. (2007). Dual-task performance consequences of imperfect alerting associated with a cockpit display of traffic information. Human Factors, 49(5), 839–850. Manuscript first received: September 2010