In this chapter we present an analysis of human factors issues and considerations in four current and proposed automation efforts associated with performing immediate conflict avoidance tasks: the traffic alert and collision avoidance system, the converging runway display aid, the precision runway monitor, and tools for airport surface conflict avoidance. Some of these efforts involve systems that are large and already implemented, such as the traffic alert and collision avoidance system. Others are small and at the early stages of pilot testing; examples include the precision runway monitor and the converging runway display aid. All of the systems included in the following discussion represent serious efforts to automate functions that have changed or will change the role of the human operator.

For each item of automation, our analysis covers the functions to be performed; the historical context for development; the involvement of human factors in the implementation process; generic human factors issues including cognitive task analysis, workload, training and selection, and communication; and the human factors issues specific to automation that were discussed generically in Chapter 1. In describing these subsystems, one important message that we wish to convey is that each subsystem can independently aid the controller in performing the core functions of air traffic control; however, implementation will progress faster and more smoothly if each subsystem is compatible with its neighbors and its predecessors.

The traffic alert and collision avoidance system (TCAS) is an airborne system designed to: (1) advise pilots visually on a horizontal situation display if there is traffic in the nearby vicinity (a range extending beyond that defining an operational error for controllers); (2) alert them both visually and aurally if a possible collision is imminent (assuming both aircraft remain on the same course); and ultimately, if necessary, (3) issue a redundant (visual and auditory) resolution advisory, instructing the pilot on a vertical maneuver to avoid the possible collision. In the current TCAS II (Federal Aviation Administration, 1990b), the advisory is issued by depicting a vertical speed to seek (on the vertical speed indicator of the pilot's instrument panel) and another to avoid and by presenting an aural advisory such as ''climb climb climb" or "reduce descent reduce descent" (Avionics, 1990; Federal Aviation Administration, 1990b). Figure 5.1 presents a sample TCAS display. TCAS II version 7, which is planned for release in 1998, will improve the conflict resolution algorithms and provide some added display functionality (Klass, 1997).

TCAS is essentially an automated system that is a redundant monitoring backup for the air traffic controller in instrument meteorological conditions, and for both the controller and pilot in visual meteorological conditions; it is also a control advisor for the pilot in the crisis situation when a potential collision is imminent.

FIGURE 5.1 Sample traffic alert and collision avoidance (TCAS) display, showing a target 19 miles ahead. Source: Photo courtesy of the MITRE Corporation.

The seeds for TCAS were planted both in concern over the rare midair collisions that have occurred (Wiener, 1989) and in the earlier efforts by the National Aeronautics and Space Administration to develop the cockpit display of traffic information (Abbott et al., 1980; Kreifeldt, 1980; Hart and Loomis, 1980). In the early 1980s, there was some concern over the visual workload imposed on pilots by giving them a full picture of all local traffic, as well as possible concerns about inadvertent shifts in authority away from air traffic control to the flight deck. The more restricted TCAS concept was developed following an FAA commitment to the system in 1981 and has been gradually phased into commercial air traffic. A great impetus (and a congressional mandate) were provided by the midair crashes over San Diego (in 1987) and Cerritos, California (in 1986; Wiener, 1989). By 1993, all the U.S. commercial carriers were equipped with TCAS.

The process of implementation of TCAS has benefited from some of the lessons learned by the earlier introduction of the ground proximity warning system, which suffered extensively from a high false alarm rate and as a result led pilots to develop a corresponding mistrust (Hanson, 1992). As a consequence, National Aeronautics and Space Administration's Ames Research Center undertook a systematic human factors research program prior to the introduction of TCAS (Chappell, 1990). This program entailed the collection of a considerable amount of laboratory and simulation data and the use of these data in fabricating many of the display parameters. Correspondingly, the implementation of the system on commercial aircraft has followed a gradual and closely monitored course, allowing early experience to guide redesign and refinement. A formal TCAS transition program established by the FAA has provided a vehicle for integrating lessons learned and disseminating them to the national airspace system community via a newsletter. The MITRE Corporation has been continually involved in refining the collision prediction and alerting algorithms on the basis of field problems and to address the still nontrivial false alarm problem (Klass, 1997). Human factors issues related to pilot compliance (or noncompliance) with resolution advisories are being closely monitored (Adam, 1995).

An important Aviation Safety Reporting System report (Mellone and Frank, 1993) provided an early warning of some of the unanticipated system-wide human factors consequences of TCAS. Following a set of National Transportation Safety Board safety recommendations (National Transportation Safety Board, 1993), these have led to FAA intervention in issuing regulations on the use of TCAS in the cockpit. Three of these consequences have direct implications for air traffic control and are discussed further below: (1) pilots following a resolution

advisory were changing altitude by nearly twice the amount recommended by the user manual (600 versus 300 feet, with some deviations exceeding 1,000 feet) and hence intruding on a higher or lower flight-level; (2) pilots were not always informing controllers that they were undertaking a resolution maneuver, even after the fact; and (3) pilots were sometimes using the traffic status display to maintain separation from nearby aircraft, hence implicitly shifting separation control from ground to air. More recent, still emerging lessons are continually being applied, as the TCAS transition program remains in effect and the aviation safety reporting system continues to cull through its database to keep track of recurring problems. Although clearly imperfect, it does appear that this implementation program of TCAS has adhered to many of the important procedures to ensure that human factors are considered. Some of the more specific human factors issues, also discussed in the Phase I report, are considered below.

It is clear that TCAS accomplishes two functions designed to assist human performance in areas in which the latter is vulnerable: monitoring for low- probability events and predicting the interactions between complex speed-varying trajectories. Furthermore, its role as a situation awareness support, by providing the pilot with a graphic description of the state of nearby traffic, is a beneficial one. It can also be argued that the effectiveness of a resolution advisory, offered as guidance for action in a stressful, time-critical period, is one that supports human performance, because of the tendency for self-initiated actions to suffer a speed/accuracy trade-off under stress (Hockey, 1986; Wickens, 1996). At the same time, it is evident from task analysis and controller reports (Mellone and Frank, 1993) regarding the current implementation of the system that the sometimes unanticipated corrective actions initiated by aircraft in response to a resolution advisory can drastically disrupt the controller's situation awareness. This disruption is amplified because the direction of the advisory (i.e., a vertical maneuver) is one that is not spatially evident in the display but must be perceived from the digital data tags.

TCAS has workload implications both on the ground and in the air. For the controller, the enhanced workload of dealing with an unanticipated and often complex event is evident and has been the subject of explicit complaints (Mellone and Frank, 1993). For the pilot, the workload effects may come in two forms. First, responding to a resolution advisory is obviously a high-workload event, but one that is justified and acceptable if the advisory is "legitimate." If it is a false

alarm, this unnecessary distraction from other aspects of flying will have undesirable consequences. For example, recent reports have noted the frequency of hard and fast landings, resulting from false advisories issued during airport approaches. Second, a more insidious workload effect was anticipated by the earlier research on the cockpit display of traffic information. To the extent that pilots begin to navigate using the system's status display, their workload is likely to increase, both as a function of visual attention allocated to this new channel of input and as a function of added control decisions that may now be based on the system's input.

Training issues were anticipated to some extent prior to TCAS implementation, and manuals were printed for both pilots and air traffic controllers. However, in some respects, reports from the field have indicated that initial training was not fully adequate (Hanson, 1992; Vickers, 1992; National Transportation Safety Board, 1993). From the controller's standpoint, many of the training manuals did not actually reach their destinations in the field (Vickers, 1992), and the initial training focused more on how the system should work, rather than how it did work in practice. For example, controllers were not alerted to the possible problems that would arise if pilots exceeded the recommended 300 foot altitude deviation, as many did (Mellone and Frank, 1993). For pilots, the simple instruction manuals were probably inadequate to prepare them for executing the actual maneuvers that might be required at infrequent and unexpected times. There is a need to train them to consistently follow the procedures that the controller would expect. At present, the fact that 30 to 50 percent of resolution alerts are not followed (i.e., ignored or followed incorrectly) (Steenblik, 1996; Adam, 1995) would suggest that there is great variance across pilots and occasions in the manner in which TCAS is used, suggesting a lack of adequate standardized training.

The role of consistent training is particularly critical in systems like TCAS, with joint ground-air implications, because of the importance of shared situation awareness and a shared mental model between pilot and controller regarding how a pilot is likely to react and how the pilot actually is reacting to a conflict situation. The initial reports of Mellone and Frank indicated the magnitude of the problem. Subsequent reports of the large number of resolution advisories that are not followed (Steenblik, 1996; Ciemer et al., 1993) suggest that controllers cannot easily guess what the pilots will do in a conflict situation. (Only a minority of the cases in which pilots ignored resolution advisories resulted because the pilot

was following explicit controller instructions). We may infer that this issue lies at the heart of potential human factors problems with this system.

Two solutions to this problem are implicitly suggested. First, greater and more effective training for pilots must focus on the need for consistent response to TCAS, so that the response will be predictable to the controller. Second, there should be a concerted effort to down-link the representation of resolution advisory responses (and possibly traffic alert information) to controllers (Hoffman et al., 1995; Flavin, 1996), to ensure that pilots and controllers have shared situation awareness of the nature of maneuver advisories. This represents an active program of research in air traffic control human factors that has been undertaken by the FAA. The program has included two pilot tests in a medium-fidelity simulation at the MITRE Corporation (Hoffman et al., 1995), which primarily employed user opinion (10 air traffic control specialists) to evaluate the value of this information, its format, and level of detail. It also includes a field test at Boston's Logan Airport.

Intended or not, TCAS has clearly produced a slight shift in authority from ground to air, resulting in ambiguity as to who is responsible for errors and possible accidents that may result. This shift is particularly evident in the use of the TCAS traffic display to navigate and maintain separation (Mellone and Frank, 1993), although this function is specifically acknowledged for oceanic in-trail climbs and, with the introduction of TCAS II version 7, for air traffic control authorized clearances for visual approach (Mundra et al., 1997). Issues involved in developing procedures for dealing with unintended consequences are also nontrivial, and the FAA is addressing this. Another organizational issue that is emerging relates to differences across and within airlines in the manner in which the system's procedures are followed. As noted above, the greater the inconsistency of procedure following, the less controllers will be able to anticipate maneuvers or remotely judge the pilot's assumed responsibility, and hence the greater the workload imposed on the controller. Furthermore, TCAS logic itself makes assumptions that the maneuvers of both aircraft involved in an engagement will proceed as advised. If this advice is unheeded by one aircraft but not the other, a bad situation could become worse.

Although originally anticipated as a single mode system, early lessons indicated the need for certain modes to be deactivated at certain times, in order to avoid high false alarm rates. For example, the presence of other TCAS-equipped

aircraft on an adjacent runway (or in a parallel approach) during landing, where known close proximity encounters exist, requires that advisory and aural alert modes be deactivated. Yet such decisions will invite the possibility that other encounters may not be alerted. The existence of this issue is acknowledged, but its magnitude is uncertain.

As noted above and as discussed in Chapter 1, the mistrust engendered by false alerts and unnecessary resolution advisories, and also reflected in the frequent failures to comply with the resolution advisories, is the most critical issue. This issues is being addressed in part through continuous refinement of the algorithms by the MITRE Corporation. Issues of overtrust and complacency have not yet surfaced as identifiable concerns (perhaps because the nontrivial false alarm rate currently prevents complacency from occurring). However, greatly improved algorithms could increase the level of sensitivity of the system and significantly reduce the false alarm rate; such design changes should be accompanied by safeguards against complacency (automatically following the resolution advisory without a cross-check).

Skill degradation would not appear to be an issue for pilots, but for controllers the potential issue is very real; if TCAS supersedes controllers in issuing instructions to disentangle aircraft from complex traffic encounters, these skills may be lost by controllers. Similar concerns, of course, arise for controllers if ground-based automation accomplishes the task, as we discuss in the next chapter.

The issue of mental models can be defined at two levels. The first concerns the extent to which any operator (pilot or controller) has an accurate mental model of the algorithm by which resolution advisories are issued. In the absence of an accurate model, it is easy to envision circumstances in which an appropriate resolution advisory might not be followed.

The issue at the second-level concerns the extent to which both pilots and controllers develop the same mental model of the algorithms operating in the system. If the mental models do not coincide, mistrust and hence misuse may result (Parasuraman and Riley, 1997). Since the controller's explicit model of separation violation is based on a purely space-based geometry (e.g., 5 miles, 1,000 feet), whereas the system's resolution advisories are based on a time-based geometry (i.e., predicted time to impact), there is an invitation for misunderstanding.

A recent simulation study by Pritchett and Hansman (1997a, 1997b) attributed the failure of pilots to follow many of the resolution advisories issued on parallel approaches in a flight simulator to the pilots' judgment of separation on the basis of distance, rather than on the time algorithms used in the resolution advisories. Such confusion may be amplified, to the extent that the system evolves to incorporate intent inferencing (see Chapter 2), based on programmed flight management system logic within the two aircraft involved in a potential encounter.

The main issues of communication and organization were discussed earlier. However, the discussion of mental models reiterates the critical factors involved in the information and assumptions shared among the four agents involved in TCAS: the two pilots, the automated system logic, and the controller. Since the dynamics of the situation will jointly emerge from the knowledge and expectancies that each agent has about the likely behavior of the others, as well as from the momentary situation awareness (or knowledge of the dynamic state) that each has of the conflict geometry, the predicted complexity of this system is great.

Although TCAS was originally intended to be a purely air-based system and designed to be a final backup to breakdowns in ground-based control, it is evident that it has much more profound implications for air traffic control. These implications will grow as the system is extended forward to recapture more elements of the cockpit display of traffic information, in the implementation of certain levels of free flight (e.g., the role of TCAS in approaches, the role of TCAS in oceanic in-trail climbs—Mundra et al., 1997). It is clear that considerable thought was given to human factors issues in the initial implementation and subsequent fielding of the system. However, it may be argued that more early attention could have been given to trying to discover the complex pilot-controller interactions that emerged, and that have subsequently forced revision of procedures, policy, training, and software. It is likely that more extensive reliance on system models (with valid models of human components), as well as complex human-in-the-loop simulation, could have anticipated some of these problems. It is encouraging to see movement in this direction as other future air traffic control technologies are envisioned (e.g., data link).

The converging runway display aid (CRDA) is a computer program that can reside on the ARTS III computer used in the terminal area for air traffic control. Its main function is to aid controllers in sequencing traffic for arrival at converging runways (Mundra, 1989; Mundra and Levin, 1990).

At terminals with converging runways, there are two final approach paths. These two paths typically are separated by an angle of up to 90 degrees. When approaching aircraft are under positive radar control, the controller uses range markers on the radar display to determine the relative sequential spacing of aircraft on the two different descent paths. The goal is to maintain separation of at least 2 nautical miles as long as the aircraft are airborne. The critical stage is the point at which the two approach paths come together; arrival at that point must be staggered.

The separation task is particularly difficult when the arriving traffic is diverse so that, for example, velocity on final approach varies from aircraft to aircraft. When inclement weather complicates the situation, loss of capacity can run to 50 percent.

The converging runway display aid shows each aircraft on both approach paths by means of a "ghost" image. That is, the position of aircraft number 1 on approach path A is also shown on approach path B as a virtual or ghost representation. Thus the in-trail separation of the aircraft on both paths can be directly observed and adjusted through standard air traffic control procedures in a continuous manner. When the converging runway display aid is desired, it may be activated. A single switch brings up the converging runway display aid on the radar display.

Computer-aided metering and spacing were functions considered in system design exercises in the late 1960s when computer processing of radar images was first implemented. The basic response was to provide time-distance vectors for each aircraft under positive control. Thus the processed radar display generated a line that projected the path of future movement for each aircraft for a particular time duration. Since distance scale was constant for the radar display, the controller could assess momentary separation and also infer future separations (or violations), because the vector permitted explicit predictions.

In 1988, the concept of providing ghost images as an aid in maintaining separation at the point of path intersection was first articulated and documented (Mundra, 1989). There followed an engineering development effort that was typified by the use of rapid prototyping techniques and the early engagement of

representatives of the user population in the assessment of these prototypes. Continuing domestic evaluation of the resultant computer program package is under way in St. Louis, Missouri; Norfolk, Virginia; El Paso, Texas; Cincinnati, Ohio; Tulsa, Oklahoma; Philadelphia, Pennsylvania; Birmingham, Alabama; Boston, Massachusetts; and Newark, New Jersey. The system is also being evaluated at Schiphol Airport in Amsterdam, the Netherlands, at the National Aerospace Laboratory using the NARSIM air traffic control simulator. These evaluations are complicated by the site-specific procedures employed in the use of the CRDA. There are also problems related to skill maintenance because the system is used only intermittently under conditions of particularly low-visibility.

As indicated, the original ARTS III capability for maintaining aircraft separation on converging paths was based on the controller's perceptions aided by range rings on the display. When development of the converging runway display aid was initiated by the systems engineers at the MITRE Corporation, the goal was to improve this limited capability. The developers of the aid could simply assume that the provision of any means for direct determination of the spacing would mean improvement.

The central questions during the engineering development were the demonstration of the concept and user acceptance. These questions were addressed by the provision of prototype models that could be exercised first in a simulation setting and later in the setting of operational TRACONs at terminals, such as Lambert Field in St. Louis, that have converging runways. User feedback from such exercises was used to guide each successive stage in the modification of the computer program.

No formal task analyses were performed for the specific purpose of designing the converging runway display aid. However, an obvious cognitive problem in the basic system was the mental representation and visualization of in-trail separations for laterally separated, nonparallel radar images.

It was evident to the systems analysts that there was a reduction in arrival capacity at operational TRACONs that had converging runways when instrument flight rules were ordered. It was ascertained informally that the drop in capacity came from controller uncertainty about separation distances. In short, the controllers were generating a larger margin for error and setting spacing above the minimums stipulated by the rules.

The main workload in the predecessor system came from the need for the controllers to shift their attention back and forth between the two approach paths. The advent of the converging runway display aid was intended to eliminate the need to carry out such transfers of attention. The aid thus generates a net reduction in workload.

In adopting the converging runway display aid, two learned discriminations are required. The first is simply the determination that the aid should be uploaded. The cue for this action would be the controller's sense that the spacing interval was creeping upward. Sensitivity for such a determination is trainable but could be acquired by ordinary practice in the normal course of air traffic control operations.

The second learning situation involves making judgments to adjust the spacing between aircraft with different descent speeds once the converging runway display aid is operating. It would also unfold in actual operations (or in a task simulator). A possibly crucial factor is the achievement of confidence in the system on the part of the controller so that such judgments are acted on with no hesitation.

It is conceivable that a team of two controllers could be assigned to approach control during heavy traffic periods and that each controller would be responsible for one of the converging approach paths. The base case in this situation is dual operations without the converging runway display aid. The question is: Does the introduction of the aid change the communication and coordination needs and procedures?

With the display aid installed, each controller would see the aircraft under the other's control as a ghost target. This circumstance should actually reduce the need for communication and explicit coordination.

There is no indication that organizational dynamics change with the introduction of the converging runway display aid. However, it should be noted that field testing has been limited to a select subset of terminals; therefore, strong generalizations about organizational dynamics cannot be made.

The main opportunity for mode errors is in the decision to upload the system. However, the consequences of being either premature or late are not severe. Specifically, premature uploading has no apparent negative consequences. Late uploading would lead to the prolongation of some partial decline in acceptance rates—but no discernible degradation of the safety factor.

The latitude available to the controller in the decision to upload the program suggests that, if there is a lack of trust, use of the system can be delayed or avoided. The program of prototype exposure and the elicitation of feedback from the controllers suggests that the developers were sensitive to the problem of trust and undertook to provide a means to ensure that trust and confidence in the system would be established prior to its installation. Trust may, of course, be modified on the basis of controllers' operational experience with the converging runway display aid.

Since the converging runway display aid will be running only a relatively small proportion of the time, there is little likelihood that the skills required for the less automated conditions will decline.

The initial impetus for the converging runway display aid came from a recognition of human limitation in conceptualizing rapid changes in three-dimensional space. Another way of looking at the converging runway display aid is that it instantiates one of the mental models used by some controllers. Even if this assumption applies to only some controllers and not to others, the system provides an analogic representation of the traffic environment that reduces the need for the controller to formulate such a mental model or to employ some other cognitive means for ensuring proper separation.

The converging runway display aid is a modest, incremental step toward advanced air traffic control automation of information presentation and integration. It appears to work well as a sequencing tool in those relatively few situations

for which it was designed—namely, low-visibility conditions at a relatively high-traffic-density terminal with converging runways.

By extrapolation, the converging runway display aid technology may also be applicable to all terminal operations for arrival spacing. In the single runway situation, there is a final path that can begin as far as 10 miles or more from the runway threshold. All arrivals converge to this path. Preliminary studies of the use of ''slot markers"—that are equivalent to virtual images or ghosts—have been conducted at the MITRE Corporation (Mundra, 1989; Mundra and Levin, 1990).

Other approaches to computer-aiding of approach spacing are under development, for example, the final approach spacing tool at NASA Ames (Lee and Davis, 1995; see Chapter 6) and the final monitor aid (FMA) at Lincoln Laboratories (Lind, 1993), discussed later in this chapter. There is no obvious reason that the concepts underlying the converging runway display aid, the final approach spacing tool, and the final monitor aid could not be integrated. In any case, the human factors issues and concerns raised with respect to the converging runway display aid would be the same if a virtual image generation capability were introduced in all situations in which convergence may be a problem.

Like the converging runway display aid described in the previous section, the objective of the combined precision runway monitor/final monitor aid system is to increase the capacity for the acceptance of flight arrivals at terminals (Federal Aviation Administration, 1991c). However, this system is designed to function at terminals that have two or more parallel runways rather than converging runways. The system permits two aircraft to occupy their respective parallel approach paths under low-visibility conditions in a side-by-side rather than in a staggered arrangement. The system is particularly suited to high-density-traffic situations at major hubs, where demand for arrival slots has reached the upper limit of the terminal capabilities. Such saturation or near saturation contains the prospect of a double disturbance in air traffic flow. Whenever poor visibility or bad weather enters the picture, local traffic is delayed in the air. Moreover, the delay effect tends to radiate outward from the affected terminal—leading to delays on the ground for flights destined for the affected terminal or even flights that are scheduled to pass through the regional airspace.

The essential ingredients of the precision runway monitor/final monitor aid system are a high speed/high-precision radar, a computer program that processes the radar signals, and a display subsystem that portrays the runways and their parallel approach paths. The high speed/high-precision radar is needed to reduce the uncertainty about the position of radar targets. With reduced uncertainty, it becomes permissible to reduce the separation minimums to the distance between

the parallel runways. The computer program actually does more than process the radar signals. It also generates the context in the form of color-coded images of the runways, the approach paths, and the area between the two runways that is designated as the no-transgression zone. It attaches predictive vector lines to each radar image and triggers a shift in color coding of the aircraft icon from green to yellow when one of the aircraft veers off its proper flight path. If the aircraft enters the no-transgression zone, the program initiates a second color change for the aircraft icon, from yellow to red, and initiates an auditory alarm.

When it became apparent in the late 1970s that building additional runways was not a complete or a cost-effective solution to the airport delay problem, steps were taken to minimize the problems associated with weather and visibility at major hubs that already had multiple runways. The initial approach to the problem began in 1975 and extended in 1981 through a study conducted by the MITRE Corporation (Haines and Swedish, 1981). The strategy focused on the development and installation of more precise radars. Development was undertaken at two contractor sites: Massachusetts Institute of Technology's Lincoln Laboratory and MSI Services, Inc./Bendix. Prototype models of the mode S sensor (Lincoln Laboratory) and the e-scan sensor (MSI/Bendix) were installed in 1989 at the Memphis International and Raleigh-Durham International airports, respectively.

The first tests in the field were focused on the actual precision of the radar. However, it was soon apparent that there might be some nonelectronic problems. Specifically, there were questions about pilots' ability and willingness to perform a missed approach maneuver at the last minute of the approach. That is, if one of the aircraft on the final approach to one of the parallel runways was to blunder across the lateral separation and infringe on the path of an adjacent aircraft, would there be time—even with the greater location precision and more rapid update cycle—to implement a conflict avoidance maneuver? In particular, the prospect was raised that the aircraft perpetrating the blunder might not be responsive to controller instructions and so resolution of the crisis would depend on the responsiveness of the pilot flying the nonintrusive aircraft. As a consequence of this concern, simulation studies were initiated to make sure that pilots could and would respond in a timely manner to an incursion that could take place at very low altitudes.

The results of the early simulation tests were somewhat equivocal—particularly for those cases in which the runways were relatively close. Consequently, attention was shifted to the possibility that the air traffic controller might be able to act sooner on potential conflicts if given an improved display. In 1990, work was initiated to introduce a new, high-resolution display to complement the new,

high-precision and rapid-update characteristics of the radar. The result was the display design characterized as the final monitor aid.

Two studies that included human factors evaluations were carried out at the Memphis installation site by MITRE Corporation staff scientists in 1990-1991 and reported in 1993 (Lind, 1993). In these studies, experienced controllers and experienced pilots served as test subjects. The operational precision runway monitor/final monitor aid equipment was used in conjunction with high-performance cockpit simulators.

The performance data indicated a modest advantage for the rapid update feature of the radar. Other data taken from the test installation at Memphis were mainly in the form of subjective responses during debriefing sessions for controllers and pilots. Controllers generally judged the system to be acceptable. Concurrently, evaluation studies were also being carried out by FAA staff at the Technical Center near Atlantic City, New Jersey (Ozmore and Morrow, 1996). Between 1988 and 1995, 18 experiments were conducted in the simulation laboratory. Most of these studies were focused on the effectiveness of high-precision radar and the physical configuration of runways and ground-based navigational aids. Only one study was exclusively dedicated to human factors (see Ozmore and Morrow, 1996). In this study, for example, there was a "surprise" aspect on the part of pilots when instructed to execute an avoidance maneuver while on the final approach. The unexpectedness of the request led to some major delays in the actual execution of the act. A second informal observation was the relatively high frequency of false positive reactions, whereby avoidance maneuvers were called for when no incursion of the safety zone had actually taken place. The main engineering response to this effect was to emphasize the need to have a position update rate at least as rapid as once every 2.4 seconds.

The overall consequence of this series of experiments was the approval of the FMA to be used on parallel approaches for triple runways a mile or more apart and for dual runways as close together as 3,000 feet, if e-scan radar is installed.

The cognitive aspects of the task confronting the air traffic controller when using the precision runway monitor/final monitor aid system are not particularly challenging. For example, the status of every aircraft within the final approach area is color-coded: aircraft on proper course are designated by green, those that deviate from their prescribed course are yellow, and those that have entered the

no-transgression zone are red. Furthermore, an aircraft that loses its transponder is coded red regardless of its flight path. In addition, the runway is imaged as a bright, white rectangle and the extension of the center line beyond the runway threshold is shown as a dotted white line. Range markers for the distance between the multiple runways take the form of blue lines and the no-transgression zone itself is solid red. Finally, there are future course projections for each aircraft. In short, the major indicators of the actual situation are color-coded to minimize the requirement for spatial judgments by the controller. Since the aircraft are already on their final leg, the controller's task becomes one of vigilant monitoring, with the need to rapidly intervene if the no-transgression zone is violated or is about to be.

Tasks that require infrequent responses can lead to inattention. When such a loss of vigilance takes place, it is attributed to a condition of underload (Hancock and Warm, 1989; Wiener and Nagel, 1988). However, there are safeguards, such as the auditory alarm built into this system and the procedures recommended for its use. The procedural feature is the provision for relatively short duty tours. Controllers are detailed to the precision runway monitor/final monitor aid for two hours at a time without rest breaks. However, system operators can lose vigilance after only 15 minutes of passive monitoring (Parasuraman, 1986), so this safeguard may not be effective.

A full-performance-level controller should be able to use the system flawlessly within minutes. However, it should be noted that, in the evaluation studies, the controllers were given a full eight hours of practice before being employed as test subjects.

A developmental controller may require more practice under supervision. However, being assigned to the precision runway monitor/final monitor aid may be an ideal way to introduce a developmental controller to live traffic.

The effective functioning of the system is extremely time dependent. That is, the controller must react very promptly to an incursion blunder because of the low altitude and descent inertia of the aircraft. Indeed, airlines often have rules that prohibit the initiation of a missed approach maneuver below a specified altitude. This can be as high as 1,000 feet—well above the location of some of the incursions. At best, this means that the controller has less than 10 seconds to request a missed approach if an incursion is detected near the outer marker. As

the landing proceeds, the time shrinks. Likewise, some leeway must be held for the pilot to implement the turn. Pilots may hesitate for any number of reasons—such as an aversion to violating company rules and a desire to avoid upsetting passengers with violent maneuvers near the ground. Another source of delay in pilot's compliance with controller instructions revealed in the simulation studies was the low expectation on the part of the pilots for receiving a landing abort message so late in the approach sequence. Under the instrument flight rules conditions prescribed for the activation of the final monitor aid, pilots will not see intruders that are the ultimate cause of the imposed missed approach. There is no opportunity for the pilots to start to tune their sensorium for the receipt of an emergency message. These observations are congruent with long-standing research on the relationship of expectancy to response time (Fitts and Posner, 1967).

A related issue is the failure of the pilots to react to the term "immediately" when it was used as a preface to an instruction. Although this term is used to convey urgency, it is used so infrequently that pilots may forget what it means to their own safety. In the simulation experiments, delays of over 10 seconds were recorded even when the controller was evincing concern by tone of voice as well as use of the supposedly alerting phrase (Ozmore and Morrow, 1996).

This may represent an opportunity for one form of automation to be used to compensate for the design limits of another automated system. Specifically, it may be ideal for a special application of data link technology. It is particularly apt since the controller is given an alert message by an mechanical annunciator. To activate an aural alarm in the cockpit of the aircraft that must make the avoidance maneuver should be a relatively simple step. Such options are discussed in more detail in the data link section in Chapter 3.

A possible organizational issue is that controllers with seniority may prefer to avoid assignment to operate the system—even for short duty cycles. The reason given by the senior controllers in the demonstration for this preference was boredom. For all its attractive attributes, such as the color-coded display, senior controllers apparently perceived that their talents would be wasted in operating this particular system.

The system, as presently configured, is either off or on. There is no intermediate state, and there is no justification for providing any. If the system fails while in action, the response of the controller would be to immediately revert to

the manual mode—invoking separation standards that were otherwise obviated by the precision monitor aid capabilities.

In the prototype operations, standard ARTS computers were used to mediate between the high speed radar and the display. It is not clear whether the controllers were aware of this particular configuration, but there was no indication in the open response sessions that the controllers were either particularly trusting or nontrusting of the system. It seems likely that, except for the issue of the false alarm rate of the final monitor aid, they would express levels of trust quite similar to the responses to the whole of the current TRACON ARTS system.

With respect to the actual properties of the system, there are few data on the possibility of a system false alarm (e.g., advice to maneuver when it was not required). It can be inferred from other studies that false alarms quickly and strongly undermine trust on the part of operators of automated systems (Parasuraman et al., 1997). The logic of operation is, however, very straightforward and is based on actual separation distance rather than closing rates. This approach is easily grasped by operators and can be tuned to select shorter or longer separations if issues of trust arise during operational experience.

The mode of operation with the final monitor aid does not appear to be substantially different from the controller's functions while monitoring a conventional instrument landing system approach. In fact, the controller should be seeing more targets with the final monitor aid—up to the limits of the flow rates under visual flight rules conditions. It is even conceivable that controllers will want to leave the final monitor aid display active under visual flight rules conditions for use as a supplementary tool. The radar with its faster update cycle, combined with the colorful display, could serve as a backup tool for ensuring proper spacing.

The conventionally two-dimensional display provides support for the maintenance of situation awareness by providing a color-coded, physical model of the controller's task environment. The results of the user survey suggest close congruence between the display configuration and the typical controller's mental model.

If the precision runway monitor/final monitor aid system is brought into play only in severe instrument flight rules conditions, the controller who is assigned as system operator has three entities with whom coordination is essential. The first is the pilot of an aircraft who commits a blunder on final approach and intrudes into the buffer zone between parallel runways. It seems likely that such a blunder will be symptomatic of other serious problems, so the controller might be well advised to minimize the time spent in coordinating efforts with this pilot. A second point of coordination is the pilot of the aircraft immediately adjacent to and affected by the blunder event. The effort made in reaching this person is crucial to the outcome of the episode. The third collaborator should be the arrival controller, who has responsibility for safe separation starting at the boundary of the terminal area up to the point of turn onto final approach. Ideally, a procedural arrangement would take place between the two controllers, so that aircraft would be metered onto the final approach in balanced numbers between the left and the right runways. Also important is the metering into the precision runway monitor/final monitor aid system such that sequence intervals are maintainable during the final approach.

To a somewhat lesser extent, coordination will also be needed with the tower controllers, who are responsible for separation and expeditious flow from runway to arrival gates. In effect, the precision runway monitor/final monitor aid system preempts some of the functions of the tower controller. Some review of the clearability of taxiways under instrument flight rules conditions should be done when the flow of landing airplanes is upgraded by the use of the precision runway monitor/final monitor aid. That is, the question arises as to whether surface control might not be overwhelmed in adverse weather conditions if the arrival rate is sustained at the higher level made possible by the precision runway monitor/final monitor aid.

The organizational issues associated with the precision runway monitor are closely linked to an alternative plan for monitoring closely spaced parallel approaches via displays in the cockpit. This system, called airborne information for lateral spacing, has been under development at the National Aeronautics and Space Administration for the past few years and has a similar philosophy to that of the precision runway monitor. On the primary traffic display, the pilot will view his own approach and that of the parallel traffic. In the event of a deviation, or the prediction of penetration of the no-transgression zone, a graded series of alerts are presented in coordinated fashion between the two participating aircraft (the "intruder" and the "evader"). These involve first alerting the intruder, then

alerting the evader, then commanding the intruder to maneuver (climb and turn right or left), and, as a last resort, commanding the evader to maneuver. The implicit assumption here is that the intruder bears initial responsibility for the conflict and hence shall be the first to execute a missed approach, an assumption opposite to the one incorporated in the ground-based precision runway monitor/final monitor aid. Traffic alerts are presented redundantly on the horizontal situation indicator (traffic display) and the primary flight display, while maneuver advisories are presented via voice synthesis.

Unlike the radar-based precision runway monitor/final monitor aid, the airborne information for lateral spacing system is based on global positioning system sensing of aircraft position, and ADS-B communications between aircraft. The system thus has many analogies with TCAS, and the role of the controller would be assumed to be secondary (i.e., advised concurrently or following the maneuver, but not assumed to be an active participant in commanding the maneuver).

Simulation tests of the airborne information for lateral spacing system at NASA Ames revealed relatively rapid response times (on the order of 1 second) by the pilot to the resolution advisories. However it should be noted that, in this simulation, there were occasional long responses of 10 seconds or more and furthermore that the simulations were conducted under best-case high-expectancy conditions, in which evading pilots knew that deviations by the intruding pilot would sometimes occur.

Further work at the Massachusetts Institute of Technology (Pritchett and Hansman, 1997a, 1997b) has examined various traffic display enhancements and established that the redundant presentation of traffic information across the horizontal situation indicator and primary flight display is valuable, and that predictor (or trend) information is also useful. One important issue revealed by the simulation tests at the Massachusetts Institute of Technology pertains to the relatively high rate of noncompliance with resolution advisories, a finding echoing those observed in TCAS alerts. The authors attribute this in part to the fact that the time-to-conflict algorithms used by the system are different from the easy-to-visualize space-based algorithms (the no-transgression zone) that pilots generally use to monitor spatial separation (and that underlie the precision runway monitor/final monitor aid).

At the present time, it does not appear that airborne information for lateral spacing and the precision runway monitor have been closely compared with each other or evaluated in head-to-head tests. On one hand, the airborne information for lateral spacing clearly has the advantage of a shorter loop time, because it eliminates the time delays associated with controller detection and voice communications. On the other hand, it may well be that the shortcomings of the precision runway monitor with the longer loop time are more than offset by the greater compliance rate that pilots have in following advisories given by a human controller, than those given by an automated algorithm with a synthetic voice. As

noted, the two systems also rely on very different technologies (high-precision radar for the precision runway monitor, and global positioning system and ADS-B for the airborne information for lateral spacing), as well as different algorithms (space-based versus time-based). These differences in technology dependence have important organizational implications should a redundant system involving both ground- and air-based alerts be considered. If the technologies are different, and they provide conflicting advice (as they may on occasion), which should be followed? Indeed, it could be argued that the possible confusion or blurring of responsibility resulting from the implementation of both systems could be counterproductive, leading to certain ambiguous scenarios in which the pilot of one or the other aircraft is uncertain of whether to maneuver.

The precision runway monitor/final monitor aid system has good user acceptance, although with some reservations expressed by highly experienced controllers about the passive-monitoring role of the system operator. Even with runway separation distances reduced to 3,000 feet between dual runways (as approved in November 1995), the incident frequency is likely to be too small to allow the controller to sustain a reasonable level of alertness. More investigation of the duty cycle should be done with this concern in mind. For example, a duty cycle of 1 hour or less might be optimum.

The main areas of ambiguity about human factors considerations are communications and organization. Specific studies are needed to establish the utility and feasibility of the use of audible warning signals to alert pilots to the urgency of the missed approach message. A delay of 10 or more seconds in activating the pull-out maneuver is too long a period when the aircraft has only a few hundred feet of altitude.

Another issue that deserves some further study is the prospect that the flow of arrivals with the precision runway monitor/final monitor aid in operation may saturate the capabilities of the surface controllers, who will also be suffering from restricted visibility, for which the equivalent automated capabilities for surface operations may not be as mature (see the following section).

Finally, it will be extremely important for researchers and system designers to consider the trade-offs between the ground-based (precision runway monitor) and the cockpit-based (airborne information for lateral spacing) systems and the human factors implications of their possible joint use.

Increased automation has been viewed by the FAA as a means of improving airport area safety on the ground. Approximately 200 runway incursions occur each year in the United States (Castaldo et al., 1996). The National Transportation

Safety Board (NTSB) has considered the prevention of runway incursions and of ground collisions of aircraft a high-priority safety issue (National Transportation Safety Board, 1995a, 1995b). In response to ground accidents at Atlanta (1990), Detroit (1990), Los Angeles (1991), and St. Louis (1994), the National Transportation Safety Board issued a series of recommendations for the prevention of ground collisions of aircraft. These recommendations include the reiteration of a 1991 recommendation that the FAA "expedite efforts to fund the development and implementation of an operational system analogous to the airborne conflict alert system to alert controllers to pending runway incursions" on the ground (National Transportation Safety Board, 1995b).

To address safety concerns in a manner that may also yield efficiency gains, the FAA is undertaking a broad set of activities that, taken together, are intended to provide controllers and pilots with automated warnings of potential and actual runway incursions and ground traffic conflicts, with automated means of communication, with positive identification of surface targets, and with the capability to maintain situation awareness in low-visibility conditions. These initiatives range from current implementation through near-term enhancement to long-term development programs.

The primary goal of the automation systems for the tower described below is to enhance the safety of airport operations. These systems provide to controllers and, in some cases, to pilots information that augments the current direct visual observations and verbal communications. In addition, these systems are based on surveillance technology that provides information under conditions of poor visibility (National Aeronautics and Space Administration, 1995). As with technologies that improve the availability and accuracy of in flight position, trajectory, and identification information, these systems may also permit improved efficiency by reducing delays otherwise dictated by less reliable information. Figure 5.2 presents the interrelationships among surveillance, processing, and tower and cockpit display systems.

Airport surface detection equipment (ASDE-3) includes an advanced digital radar that penetrates rain, snow, and fog and provides to controllers a display of superimposed radar images of airplanes and vehicles over a map of the airport surface. It permits controllers in the tower to view a continuous, real-time display of all movements on runways and taxiways in the terminal area. Airport surface detection equipment does not, however, provide identification of targets, so controllers cannot readily identify specific aircraft by looking at the radar display. The controller therefore has to rely on visual contact and voice communication to positively identify aircraft. In addition, the airport surface detection equipment has limitations that include blockage of certain terminal areas and some false returns. The equipment is currently installed in some airports and is targeted for wider implementation.

The airport movement area safety system (AMASS) augments the airport surface detection equipment with an automated alerting system. The airport

FIGURE 5.2 Elements of systems for monitoring airport area ground traffic.

movement area safety system uses the surface detection equipment data to track ground operations, compare movements of aircraft and ground vehicles, and automatically provide to controllers visual and audio alerts of potential conflicts and of deviation from airport procedures. The airport movement area safety system also provides ''runway in use" alerts to controllers when it determines that targets are moving at high speed along a runway. The FAA is accelerating the implementation of airport movement area safety system displays in busy tower environments. Like the airport surface detection equipment, the airport movement

area safety system does not provide controllers with identification of targets.

The aircraft target identification system (ATIDS), under study, would use triangulation and automatic dependent surveillance—rather than airport surface detection equipment radar—to pinpoint the location of aircraft on the ground. The airport target identification system would also use the secondary surveillance radar signal (mode A/C/S) to identify aircraft and to provide to controllers call sign information in association with ASDE-3 and AMASS-like target displays (Castaldo et al., 1996; Smith et al., 1996). An aircraft target identification system prototype has been undergoing tests at the Atlanta airport.

Automated aids under consideration include the capability to present displays to pilots that indicate both the situation information provided to controllers and controller instructions. The runway status lights (RWSL) system is a radar-based safety system intended to improve on-airfield situation awareness by providing pilots a visual advisory of runway status. The system consists of a series of "stop/go" lights on the airport surface that indicate to pilots whether it is safe or unsafe to enter or cross a runway or to begin or hold takeoff. The runway status lights system, whose prototype has been undergoing field tests, controls the lights according to target position, status, and logic information derived from the airport movement area safety system. The runway status lights are intended as an independent backup to controllers' assessments and instructions; procedures dictate that, when pilots identify a discrepancy between the lights and controller instructions, pilots must resolve the discrepancy with controllers before proceeding (Architecture Technology Corporation, 1996; Federal Aviation Administration, 1996d).

The airport surface traffic automation (ASTA) system would extend the mode S surface surveillance system to provide a two-way data link between the tower and the cockpit. The system may introduce into the cockpit an electronic moving map display that provides to pilots the target position, identification, and movement information presented to controllers, as well as the airport movement area safety system and controller instructions and alerts (Architecture Technology Corporation, 1996; Jones and Young, 1996; National Aeronautics and Space Administration, 1995). The airport surface traffic automation system is currently undergoing in-field prototype testing.

Enhancements to cockpit displays, integrated with the airport surface traffic automation system, may also permit improvements in the efficiency of taxiway navigation. The taxi navigation and situation awareness (T-NASA) system, under development for NASA's terminal area productivity (TAP) low-visibility landing and surface operations (LVLAS) program, is intended to support the goals of increased nonvisual ground capacity, runway occupancy time for instrument flight rules equivalent to that for clear weather, and maintenance of safety (National Aeronautics and Space Administration, 1997a). The T-NASA system includes three features intended to provide situation awareness to pilots during

taxi: (1) an electronic moving map display that provides a layout of the airport, own ship position, positions of other traffic, graphical route guidance, and heading and clearance indicators; (2) a head-up display that projects symbology, correlated with a virtual out-the-window scene, displaying scene enhancements (e.g., center line markers) and scene augmentations (e.g., virtual turn signs and taxiway edge cones) as well as commanded taxiway indicators and other data; and (3) a three-dimensional audio ground collision and warning system that provides auditory warnings that include indication of the direction of approaching aircraft (Foyle et al., 1996; McCann et al., 1996, 1997; Bryant, 1993; National Aeronautics and Space Administration, 1997b, 1997c). The T-NASA system is under development; its conceptual designs are being evaluated by simulation studies and field tests at Atlanta's Hartsfield Airport.

There has been an encouraging general trend in the arena of airport surface automation toward earlier user and human factors involvement, coupled with a "build a little, test a little" development philosophy that includes earlier evaluations using mixed methodologies (discussed in Chapter 8). The development of the AMASS system, at its inception, was delayed by failure to structure the inputs of users, representing the air traffic requirements office and controllers, and failure to apply human factors analyses in the earliest requirements definition phases, resulting in "requirements creep" that prevented the timeliest implementation of this valuable system (National Transportation Safety Board, 1995a). Now, however, the refinement of the AMASS is supported by a MITRE Corporation laboratory, where AMASS logic and displays are prototyped and concepts are demonstrated and tested (MITRE, 1997a). The runway status lights system also underwent prototype evaluations with user involvement before its ongoing operational assessment at Boston's Logan Airport (Architecture Technology Corporation, 1996).

The ASTA and TAP T-NASA programs have both involved controllers, pilots, and human factors professionals during analyses and concept development. Their involvement is also evident in ongoing and planned evaluations that are supported by modeling (e.g., NASA Ames' Air-MIDAS model, Pisanich and Corker, 1997), by simulation (Pisanich et al., 1994; Foyle et al., 1996; McCann et al., 1996, 1997; Bryant, 1993), and by flight demonstrations (Mejdrich, 1995).

Both the introduction of runway status lights and the addition of new surveillance technologies introduce related considerations of reliability, redundancy,

and trust that can have serious implications for the usability and effectiveness of the system. The runway status lights are planned as a backup safety net—a check against controller error. Similarly, should the lights be in error, the controller is expected to serve as a cross-check. Pilots will be expected to compare the instructions presented by the lights (e.g., taxi hold) against those communicated by the controller. The assumption is that when the instructions from the lights disagree with those from the controller, one of the two sources of instruction represents an error that has been caught by the other. The converse assumption is that when both sources of instruction are in agreement, a double-check is in evidence. These assumptions would tend to increase pilots' trust in the overall system, even if trust in one of the instruction sources (lights or controller) decreases.

However, these assumptions are questionable. A double-check by redundant sources requires that the observation by each source is independent. In the present case, however, the runway lights are driven by the sensors and logic of the airport surface detection equipment/airport movement area safety system displays, which includes information presented to the controller. If the controller's instructions are also based on the airport surface detection equipment/airport movement area safety system displays, then the controller and the runway lights do not serve as independent double-checks. Rather, both the controller and the pilot are, in this case, trusting the same system.

Even when independent observations occur, dual redundancy cannot always be presumed to yield a trustworthy result. For example, airport area automation plans include the introduction of ADS-B surveillance and communication technology, which may provide observations of aircraft position in addition to those provided by surface radar. If the observations from ADS-B conflict with those of the surface radar, the result is a "two-sensor problem." Which observation is to be trusted? The general solution is to provide a third sensor (e.g., controller direct observation or confirmation with the pilot).

At issue in each case is the distinction between trust in the system and trust in its components. Although individual components may vary in their trustworthiness (which may change over time), a thorough understanding of the capabilities of each component as well as how the components work together (e.g., whether they serve as independent sources of information and when the system relies more on one than on the others) is required to permit pilots and controllers to develop an appropriate level of trust in the system. This argues against any temptation to "dumb down" training of automation systems and argues for training that provides a useful and appropriately detailed mental model of how the system works.

As noted in Chapter 1, one of the greatest causes of mistrust or misapplied trust is the inability of operators to develop mental models appropriate to the system and task at hand in order to maintain situation awareness. Both controllers and pilots will be expected to develop mental models and maintain situation awareness pertinent to the prevention of ground accidents and runway incursions (i.e., awareness of the current and near-term positions and movements of aircraft and vehicles, as well as immediate controller intentions and instructions).

Lasswell and Wickens (1995) distinguished between local and global awareness in connection with taxi operations. Local guidance refers to the control task of maneuvering the aircraft along a route; global awareness refers to the task of maintaining position awareness relative to the gate and other airport features. To provide both forms of situation awareness, Lasswell and Wickens recommended displays that provide both an egocentric (pilot eyepoint) forward view, supplying local guidance, and a plan view supplying global awareness information. The designers of the T-NASA system have adopted this recommendation (Foyle et al., 1996; McCann et al., 1997), providing a head-up display that enhances local visual guidance cues, and a head-down display that augments global awareness cues (although the separate head-up/head-down display configuration represents a distinct design decision).

As noted in Chapter 1, it is often the case that operators are less aware of the changes of state made by other agents than of changes they make themselves. Particularly when system automation (e.g., improved surveillance accuracy coupled with sophisticated airport movement area safety system logic) permits more complex activities (e.g., the movement of greater numbers of aircraft), the risk of operator complacency—or of simply being unable to keep up with automated actions—and associated loss of situation awareness is introduced. The loss of situation awareness may be accompanied by degradation of skills, if the operator has not maintained proficiency in tasks that are normally performed by the automation. The combination of loss of situation awareness and skill degradation can result in the operator's inability to respond adequately to the failure of the automation. This general theme is central to this report, and it is reemphasized here because airport area automation may become extensive in the future (e.g., enhancements to the airport area movement safety system encouraging more low-visibility operations; runway lights duplicating controller functions; and automated schedulers recommending high-efficiency actions). On that account, each new automation feature should be evaluated for its impact on situation awareness, controllers should be trained to maintain proficiency in automated tasks whenever they are expected to be able to perform those tasks in response to automation failures, and the capability of controllers to manage the complexities permitted by automation should be evaluated.

Airport area automation holds the potential for changing the roles of controllers and pilots. The introduction of runway status lights and of cockpit electronic moving maps (providing to flight crews information similar to that provided to controllers through the airport surface detection equipment/airport movement area safety system display) increases shared responsibility for ground control between controllers and pilots. The implications of shared responsibility and authority, and the importance of clear and effective associated procedures, is discussed in detail in the earlier sections of this chapter and in Chapter 9 in the discussion of free flight.

Chapter 8 discusses in detail the importance of considering the human factors implications of both phased and simultaneous implementation of two or more automated functions. The combination of automation features can potentially introduce effects that are not predicted from studies or tests of each feature independently. Airport surface automation includes contemplated introduction of additions or changes to surveillance technology, addition of features to airport surface detection equipment and airport movement area safety system displays, and simultaneous presentation to pilots of runway status lights and controller instructions (through visual as well as voice communication). The general guidance presented in Chapter 8 applies here: each change introduced should be studied within the operational context, taking into account all other changes introduced, and the evolution of changes should be centrally monitored and coordinated by a human factors research and development oversight organization.

To address both safety and efficiency concerns, the FAA is undertaking a set of activities that, taken together, is intended to provide controllers and pilots with automated warnings of potential and actual runway incursions and ground traffic conflicts, with automated means of communication, and with the capability to maintain situation awareness in low-visibility conditions. These initiatives range from current implementation through near-term enhancement to long-term development programs.

The combination of automation features can potentially introduce effects that are not predicted from studies or tests of each feature independently. This may be particularly true to the extent that pilot and controller are receiving redundant sources of information. Also at issue is the distinction between trust in the system and trust in its components. Individual components may vary in their

trustworthiness (which may change over time). A thorough understanding of the capabilities of each component as well as how the components work together is required to permit pilots and controllers to develop an appropriate level of trust in the system. In addition, since these new systems are specifically intended as safety enhancements and may also be used to increase usage of airport surface capacity, it is particularly important that controllers and pilots are able to respond effectively to system failures, including those that regress the system to lower-levels of automation.