Self-Separation from the Air and Ground Perspective

航空

游客，如果您要查看本帖隐藏内容请回复

航空

2nd USA/EUROPE AIR TRAFFIC MANAGEMENT R&D SEMINAR Orlando,1st - 4th December 1998
Self-Separation from the Air and
Ground Perspective

Margaret-Anne Mackintosh, Melisa Dunbar, Sandra Lozito,
Patricia Cashion, Alison McGann, Victoria Dulchinos
NASA Ames Research Center
Mail Stop 262-4, Moffett Field CA 94035-1000
mmackintosh@mail.arc.nasa.gov

Rob Ruigrok, Jacco Hoekstra, Ronald Van Gent
National Aerospace Laboratory, NLR
Anthony Fokkerweg 2, 1059CM Amsterdam
ruigrok@nlr.nl

Abstract
NASA Ames and NLR have both conducted research on free flight and aircraft self-separation. This paper describes the research of both NASA Ames and NLR as it pertains to the task of self-separation. Air-Ground integration issues are presented from the NASA Ames study, and results from an NLR human-in-the-loop study examining the flight deck perspective of self-separation are provided. The variables that were studied within these two investigations were traffic density, convergence angles, maneuvering automation, and nonnominal cases. Data representing conflict detection times, crew maneuvering procedures, separation losses, and eye gaze patterns are discussed. Future research areas are provided.

Introduction
The concept of “free flight” is defined by the RTCA (1995) as:
A safe and efficient flight operating capability under instrument flight rules (IFR) in which the operators have the freedom to select their path and speed in real time. Air traffic restrictions are only imposed to ensure separation, to preclude exceeding airport capacity, to prevent unauthorized flight through special use airspace, and to ensure safety of flight. Restrictions are limited in extent and duration to correct the identified problem. Any activity which removes restrictions represents a move towards free flight.
The goal of the free flight concept is to provide more flexibility for operators by reducing constraints within the airspace system. One means of reducing constraints is to allow for opportunity for aircraft self-separation in certain environments (e.g., enroute airspace). New technologies are required to provide for opportunity for self-separation. These include enhancements to communication, navigation, and surveillance (CNS), as well as improved conflict probe devices.
The self-separation of aircraft also requires the existence of new airspace zones. Similar to the concept of aircraft zones represented in the Traffic Alert and Collision Avoidance System (TCAS) logic, a system designed for collision avoidance currently available on many aircraft, these additional zones define regions around aircraft that serve as a buffer for collision protection. There are two zones discussed in the free flight concept implementation: the protected zone and alert zone (RTCA, 1995). The protected zone is a representation of the current operational separation standards that exist in the domestic enroute airspace. The protected zone, therefore, is expected to remain free of other aircraft.
The alert zone is a more unique conceptual space associated with free flight. It is larger than the protected zone, as it is intended to permit a preview of potential traffic situations, and to allow for worst-case human and system responses (RTCA, 1995).

2
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
The definition of this zone will be influenced by aircraft equipage and performance characteristics as well as reflect human performance activities associated with aircraft self-separation.
Pilots, controllers, and dispatchers will be impacted by the technological and procedural changes that will accompany the transition towards free flight and the increased opportunities for aircraft self-separation. There has been research in the area of human factors issues as they may relate to the free flight self-separation concept. In the investigation of traffic density and free flight, previous work indicates that density may have an effect on controller performance (Hilburn, Jorna, Byrne, & Parasuraman, 1997), while having little or no effect on pilot performance (Cashion, Mackintosh, McGann, & Lozito, 1997; Gent, Hoekstra, & Ruigrok, 1998). In addition, research exploring convergence angles in traffic conflicts indicates longer conflict detection times associated with larger angles (Remington, Johnston, Ruthruff, Romera, & Gold, 1998). The impact of both traffic density and convergence angle need to be examined more fully.
These research findings led to an air-ground integration simulation at NASA Ames Research Center investigating human performance parameters. This study included both controllers and commerical pilots as participants in an investigation of aircraft self-separation.
NLR also performed a free flight experiment in 1997 to investigate the human factors principles of Airborne Separation Assurance. This research consisted of three substudies: Concept Development study, Safety Analysis, and a Human-in-the-loop simulation experiment using NLR’s Research Flight Simulator. The implementation defined by the Concept Development study and the Safety Analysis was tested in the Human-in-the-loop simulation.
This paper will first describe the NASA Ames research on air-ground integration issues followed by the NLR Human-in-the-loop evaluation. The underlying assumptions for both studies included an assumption of Automatic Dependent Surveillance-Broadcast (ADS-B) technology, airborne alerting logic, and CDTI available to all participants. Also, aircraft self-separation was implemented in an enroute airspace environment. However, there were some important differences in the implementations of self-separation and the methodological approaches between these two investigations. In general, the NLR study provided more automation technologies to aid in the task of self-separation than the NASA study. For example, resolution advisories, a vertical traffic display, and an automated means of enacting the maneuvers were all represented in the NLR research. Finally, the NASA study included controllers as participants; these controllers retained the ultimate separation responsibility during the scenarios.
The variables of interest for the NASA study were traffic density and convergence angles for conflicting traffic. The variables for the NLR research were traffic density, levels of automation for maneuvering, and operational conditions (nominal v. nonnominal).

NASA Air/Ground Experiment
METHOD
For a more detailed description of the study methodology please see Cashion et al., 1997.
Participants
Flight crews. Participants were ten flight crews, consisting of both captains and first officers from a major US airline. Each member flew the Boeing 747-400 simulator in his or her normal crew position. All crewmembers were either current on the B747-400, or retired for not more than six months. Flight crew participants had a mean total flight time of 18,400 hours and a mean total flight time on the B747-400 of 1,820 hours.
Controllers. Ten full performance level controllers from the Denver Air Radar Traffic Control Center (ZDIA) participated in this study. All controllers were current on the sector under study. Controller participants had means of 13.3 years experience as controllers and 5.8 years of experience as full performance level controllers at ZDIA.
Design
Each flight crew and controller group participated in a series of eight experimental scenarios, which were varied by traffic density and conflict angle. There were two levels of traffic

3
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
density: low (7 to 8 aircraft) and high (15 to 16 aircraft) in 120 nm laterally and ± 4000 feet vertically. Traffic density levels were equivalent on both the controller’s and flight crew’s traffic displays. Within each traffic density, participants were exposed to four scenario types. In three scenarios, lateral conflicts were created by varying the intercept angle between flight crew’s aircraft (ownship) and an intruder aircraft (acute, right, and obtuse angles). In the fourth scenario, which will not be specifically addressed in this paper, an aircraft passed close to the ownship, but did not violate minimum separation standards.
Airborne Alerting Logic. This study included a prototypic, airborne alerting logic designed to aid in airborne self-separation (see Yang & Kuchar, 1997 for a complete description of the alerting logic). This alerting logic overlaid the simulator’s TCAS logic with the goal of creating a seamless relationship between the airborne alerting logic and TCAS. Currently, the TCAS display depicts surrounding traffic up to 40 nm from the ownship on the navigation display. In contrast, the alerting logic in this study extended traffic depiction out to 120 nm in front of and to each side of the ownship and 30 nm behind the ownship. This surveillance capability was derived from expected ranges for ADS-B.
The airborne alerting logic provided two additional alerting zones beyond that of TCAS. The first level of alert, or “alert zone transgression” (AZT), was triggered for the flight crews when the alerting logic predicted a pending violation of the protected zones of the aircraft at a higher probability level (Yang & Kuchar, 1997). Operationally, AZT was the point at which controller intervention may be required (RTCA, 1995).
There was no ground-based alerting logic represented in this study. Controllers were provided with minimal conflict alerting information derived from the airborne alerting logic. If no evasive maneuvers were taken after AZT, the Authority Transition point was reached. The Authority Transition point represented an increased threat level beyond AZT and was visible only on the controller’s display. At this point, the controller could take whatever action he or she thought was necessary to maintain aircraft separation, including cancelling free flight on one or both conflicting aircraft.
Flight Crew Displays and Tools. Traffic was represented on the flight deck navigation display by the symbol “V” with the apex indicating the aircraft heading. Altitude (relative to ownship or absolute altitude) was displayed next to each traffic symbol. All traffic was initialized as non-threat aircraft. Figure 1 depicts a low density scenario with all aircraft in a non-threat status.

Figure 1. Flight crew’s traffic display depicting non-threat aircraftt in a low density scenario
When the probability of a violation of protected zone increased as determined by the airborne logic, an AZT was indicated to the flight crew by the following display changes: 1) A blue line extending from both the ownship and the intruder aircraft symbols. At the end of each line was a blue circle that represented the current separation standard of 5 nm in diameter. Any overlap of the circles indicated impending loss of lateral operational separation when aircraft are at the same altitude; 2) An aural warning "Alert" sounded twice; 3) The word "ALERT" appeared in blue on the lower right hand corner of the display, along with the intruder’s call sign and the time to closest point of approach. The time to closest point of approach was the time remaining before aircraft were projected to pass in closest proximity to each other on current flight paths. All display features associated with the aircraft involved in an AZT (aircraft symbol, altitude readout, and call signs) as well as the display changes related to an AZT appeared in blue to help identify which aircraft were predicted to conflict. Figure 2 illustrates the display changes associated with an AZT. As crews solved a conflict, the alert level degraded from an AZT to a

4
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
non-threat status as the threat probability was reduced.

Figure 2. Flight crew’s traffic display depicting an Alert Zone Transgression in a high density scenario
Flight crews also could select certain display features designed to aid them in self-separation. A small box mounted above the Mode Control Panel was used to manipulate selectable display features. Crews could reduce clutter by toggling a button to de-select the traffic call signs. Another selectable feature was the temporal predictor. The predictor provided crews with an estimation, based on current aircraft state information, of where other aircraft would be relative to the ownship up to ten minutes into the future. The selection knob for the temporal predictors allowed crews continuous control of the predictor length from zero to ten minutes at one second intervals. With the predictors, crews could determine which aircraft might create a potential conflict prior to an alert level indication. When predictors were selected, they were displayed for all aircraft. Selected predictor time was displayed at the lower right hand corner of the navigation display. The predictors functioned as a display tool only; their use did not incorporate the alerting logic as a conflict detection tool. Finally, crew members could de-clutter the navigation display by changing the horizontal map range. Ranges available were the same as those available on the navigation display of the B747-400 (10, 20, 40, 80, 160, 320, and 640 nm).
Controller Displays and Tools. The display the controllers used during this study had similar features to those available on their current radar display (see Figure 3). Some of these tools are vector lines, five-nautical mile rings around the aircraft (J rings), and graphical route displays. The primary sector of concern for this study was Sector Nine in Denver Center (ZDIA), which consists of overflight aircraft that are transitioning through the facility and aircraft that are arrivals into Denver International Airport.

Figure 3. Controller’s traffic display with vector lines selected at 2 min and a minimum separation ring for DAL152 (high density scenario)
In addition to the display features that the controllers used for traffic monitoring and control, there was also a unique display feature added to facilitate the controller intervention procedure. This was represented by the flashing text Alert Level 4, along with the aircraft call sign. (Due to the nature of the scenarios, the conflict always involved the ownship aircraft.) This alert was depicted in the upper right hand corner of the traffic display. The function of this textual icon was to provide an indication to the controller that the Authority Transition point had been reached. The controller was instructed that if this visual alert was displayed, he/she should query the flight crews about their intentions and cancel free flight if necessary.
Procedure/Task
Each crew flew a total of eight different scenarios, which ranged from 15 to 20 min in duration. Crews flew a low and high density version of four scenario types. The conflicts in the high and low density versions of each scenario type were identical, with the only differences in scenarios being that the aircraft had different call signs and different levels of non-conflicting traffic were represented. The intruders in all of the scenarios intersected the ownship’s flight path laterally. For

5
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
all conflicts the ownship and intruder were initialized 12 min from the closest point of approach if no maneuvers were taken.
For the three lateral conflict scenarios the angle of intercept between the ownship and intruder aircraft was manipulated. In the acute angle scenario type, the intruder intersected the ownship’s flight path at an angle of approximately 22.. In the right angle scenario type, the intruder crossed the ownship’s flight path at an angle of approximately 90.. In the obtuse angle scenario type, the intruder intersected the ownships path at an angle of approximately 165.. In all three of these scenario types, the ownship had the maneuvering responsibility (i.e., the intruder was on the right).
In order to increase the difficulty/workload for the participants, an aircraft blocking the most common avoidance maneuver was included in each scenario (Cashion et al., 1997). Thus for each of the three conflict angle scenarios (acute, right and obtuse), a blocker aircraft flew a course parallel to the ownship approximately 10-12 nm off the right side of the ownship.
Communications/Negotiations. Two confederate pilots represented the intruder and blocker aircraft for communication and were instructed to respond to calls from the flight crew and controller but not to initiate calls. The confederate pilots were instructed to maneuver if requested when the ownship had the right-of-way. When the intruder had the right-of-way, the confederate crew would maneuver if requested only after the second contact from the ownship. In addition, background communication was generated between the two confederate pilots and between one confederate pilot and the controller. There were no air-to-air negotiations available on background communications. The background communication was equal for both traffic density conditions, about one call per minute.

Results and Discussion
The purpose of this study was to examine flight crew and controller human performance issues in a self-separation environment. Results indicate a number of interesting findings regarding how self-separation may impact safety, performance, communication, and workload.

Safety
One measure of safety collected was the maintenance of adequate separation between aircraft. Four of the 80 runs resulted in a loss of vertical separation. Twice, the lost separation occurred because crews who had climbed to avoid the conflict descended back to their original altitude too early. The remaining two losses occurred when crews who had climbed to avoid the conflict did not reach the 2,000 ft vertical separation before incurring the 5 nm lateral separation zone. While a loss of adequate separation occurred in 5% of the simulation runs, these results should be interpreted with caution given the prototypic nature of the alerting logic.
Additionally, data were collected on the number of times the Authority Transition point was reached and the number of times free flight was cancelled. The Authority Transition alert was reached six times during the 80 runs. Based on the alert and the controller’s assessment of the situation, free flight was canceled in two of these six runs. In addition to the cancellations initiated by the Authority Transition alert, two controllers cancelled free flight prior to the Authority Transition point, because they were not comfortable that the crew’s maneuver was sufficient to resolve the conflict. Finally, one flight crew requested that the controller cancel free flight because they believed that the intruder aircraft should be required to maneuver. In the post-experiment questionnaires, controllers were asked if they had not been required to wait for the Authority Transition alert whether they would have cancelled free flight at any time during the scenarios. Interestingly, six of the controllers said that they would have cancelled free flight during the high density scenarios and one stated he/she would have cancelled free flight during the low density scenarios. This may indicate that some environmental factors may affect separation distances desired by the controllers and these may not be represented in an airborne alerting logic. These discrepancies in the desired separation minima may lead to differing expectations for the transfer of control between air and ground.
Performance
Flight Crew. While previous research did not indicate performance differences between high and low traffic density conflict conditions (Lozito,

6
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
McGann, Mackintosh, & Cashion, 1997), this study found several. Additionally, the results indicate performance differences related to the angle of the conflict. First, flight crews took significantly longer to detect conflicts in the high density conditions as compared to low density conditions, F(1,7)=6.25, p<.05 (mean = 48.3 s and SD = 53.4 s for high density scenarios, and mean = 20.5 s and SD = 41.0 s in low density scenarios). It should be noted however, that crews detected the conflict prior to the alert 95% of the time. Second, for the obtuse angle conflict, crews took significantly longer to initiate a maneuver in high density traffic, and they were more likely to maneuver after the alert, t(7)=2.87, p<.05 (mean = 170 s and SD = 40 s for high density obtuse scenarios, and mean = 125 s and SD = 24 s for low density obtuse scenarios). Finally, while no density effect was found relative to maneuvering time, crews were significantly more likely to maneuver using one parameter in the obtuse angle conflict compared to using multiple maneuvers to resolve the acute and right angle conflicts [χ 2(2)=7.05, p=.03]. In the obtuse angle scenarios crews used 16 one parameter and one two parameter maneuvers. While crews made 11 one parameter and 8 two parameter maneuvers in the acute angle scenarios, and 12 one parameter and 8 two parameter maneuvers in the right angle scenarios.
In order to increase the complexity of the conflicts, an aircraft that blocked the most common avoidance maneuver was included in each scenario. The presence of this blocker aircraft may explain the density-related performance differences. Flight crews attended to the blocker either to determine its status as an intruder aircraft, or to assess possible maneuvers for resolution of the conflict situation. With the blocker aircraft diffusing the crews’ attention, as well as impeding the most common escape maneuver, it appears that the blocker may have added the desired complexity. While the flight crews had the same number of opportunities to maneuver and resolve the conflict in the low and high density conditions, the added complexity of the blocker aircraft may have produced potential workload differences between the two conditions.
Another possible explanation for these performance differences may be in the data associated with the use of map range. Replicating findings from the previous simulation (Lozito et al.,
1997), results showed that pilots spent more time viewing a smaller map range (80 nm) in high density conditions compared to the low density conditions. Conversely, more time was spent at the larger 160 nm range in the low density conditions than in the high density conditions. Thus, flight crews appeared to be using the range selection on the navigation display as a filter for the density of traffic depicted on the display. The reduced 80 nm range selection may help manage the clutter on the screen and provide a more detailed view of aircraft in close proximity. However, this smaller range reduces the opportunity to see traffic as early as possible because it no longer includes the 120 nm ADS-B range of traffic. Hence, the smaller map range may lead to later detection and less time to resolve the conflict. This may be of particular concern in some of the convergence angles in which there is less time between surveillance range and the closest point of approach. For example, the intruder aircraft in the obtuse angle did not appear on the ownship display until 4:19 minutes into the scenario. If the flight crew had reduced their navigation display to 80 nm, the time of appearance for the intruder aircraft would have been even later. This results in later detection of the potential conflict and in turn, less time to resolve the conflict. Accordingly, this observation may explain the findings that, in the obtuse angle scenarios, crews tended to maneuver after the alert and to use only a single parameter to maneuver clear of the conflict.
Controllers. Wyndemere (1996) suggests that conflict geometry may impact the complexity of the conflict. Specifically, conflicts with a small convergence angle between the ownship and intruder aircraft are the most complex conflicts to manage. Furthermore, 90. intercept conflicts were found to be the easiest to affect, with the complexity increasing again as the convergence angle increases to a head-on conflict. Analyses of the controller data revealed a significant interaction between traffic density and conflict angle, F(2,12)=3.92, p<.05 (see Figure 4). Controller participants took significantly longer to detect the obtuse angle conflict in the high density condition as compared to the low density condition. Additionally, the controllers detected the acute angle conflict significantly more quickly than either the right or obtuse angle conflict in the high density condition.

7
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
These results correspond to the findings of Remington et al. (1998). They report that wider angle conflicts are associated with longer detection times. Further, this previous research also provides one possible explanation for the density differences in controller conflict detection. Remington et al. (1998) suggest that the number of intervening targets between the two conflicting aircraft may mask the salience of the conflict. Wyndemere (1996) used controller ratings to determine levels of complexity for conflict angles and concluded that shallower angles have the greatest complexity because they result in a longer period of potential conflict and require action to be taken sooner. However, given that larger conflict angles have faster closure rates and appear to be more difficult for controllers to detect in a high density scenario, perhaps a more systematic study of angle complexity is required.

Figure 4. Controller detection time for density and conflict angle
It is interesting to note that while the acute angle conflict was easiest for controllers to detect, it was not as easy for the flight crews to resolve. In their post-experiment questionnaires, the majority of controllers stated that they felt comfortable with a lateral separation requirement of 7 nm. However, resolutions for the acute angle conflict were almost always under 7 nm in lateral separation. Although this separation distance did not violate the required 5nm separation standard, it was clear that this lateral separation was uncomfortable for a number of the controllers as evidenced by the questionnaire data and the two free flight cancellations prior to the Authority Transition point in the acute angle scenarios.
Communication
Air-to-air communication. Similar to the findings from the previous study (Cashion et al., 1997) most crews contacted the intruder aircraft in the three planned conflicts. Specifically, the ownship contacted the intruder aircraft in 81% of the runs. Furthermore, the communication occurred prior to any airborne alert in 38 of 46 of runs in which the intruder was contacted. Previous research (Lozito et al., 1997), which used a multi-stage alerting logic, found that crews who contacted the intruder did so before the first alert in only two of the 37 runs. It was concluded that the alerting logic, and/or display feature changes associated with it, might signal the beginning of the self-separation procedures for the flight crew. However, based on the single alerting system used in this study, the start of separation procedures appears to be related more closely to the conflict timing provided by the different convergence angles represented. These alerting logic differences may need to be examined further. While no density differences for communication were found, crews did contact the blocker aircraft 68% of the time. This finding implies a tendency for the ownship to contact aircraft that may be either in close proximity to the ownship or aircraft limiting escape maneuvers. These indications of a high potential of inter-crew communication in the self-separation environment and the associated impact on frequency congestion will need to be addressed.
Air-to-ground communication. Flight crews contacted the controller at some point in 60% of the runs across the three conflict scenarios. These communications were usually to inform the controller of the maneuver they had already taken to resolve the conflict. Interestingly, in the post-experiment questionnaire, all ten controller participants stated that they would want to be informed of all maneuvers the flight crew was making, and would want to know prior to the crew initiating the maneuver. One controller commented, “A constantly changing picture that I can only analyze by my scan (as opposed to an aural cue) is

8
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
too difficult for extended time periods.” Another stated, “I may possess information that they do not, which might determine a better course of action.” Again, these data may present frequency congestion concerns if the voice channel is used in a self-separation environment.
Workload
In the self-report questionnaires, given after each block of high and low density scenarios, both crews and controllers indicated an increased workload in the high density conditions over low density conditions. Counter to the findings of Gent et al. (1998) flight crews stated that conflicts were more difficult to detect, that they felt more time pressure, and that they had an increased workload in the high traffic density conditions compared to the low density conditions (t(19)=2.65, p<.05; t(19)=3.33, p<.01; t(19)=2.85, p<.01, respectively). Overall, controller participants indicated that the high density scenarios were only of moderate difficulty. However, supporting the results of earlier studies (Hilburn, 1997; Remington et al., 1998), controllers did give a significantly higher rating to traffic complexity, t(9)=6.0, p<.001; subjective workload, t(9)=6.09, p<.001; and task difficulty, t(9)=4.0, p<.01, in the high density versus low density traffic conditions.

 

General Conclusions
This study was an early attempt at an integrated examination of flight crew and controller human performance issues in a self-separation environment. While this simulation resulted in a number of interesting findings, there remain several human factors concerns that were not addressed. First, the traffic conditions represented in this study did not include several elements that could add substantial complexity to the scenarios. These conditions include weather and winds, special use airspace, mixed equipage, and abnormal situations such as aircraft or passenger problems. Several pilots commented that too much time was spent monitoring the navigation display for traffic conflicts and that they would not be able to be as vigilant under abnormal conditions. Second, all aircraft other than the ownship were confederates of the study. Consequently, issues related to air carrier differences and the process of negotiations between carriers could not be addressed. Third, controllers in the study performed a monitoring role and were limited as to the guidance and instruction that they could give crews. It was apparent that this role was difficult and a number of controllers noted how it impaired their scan or picture and increased their workload. Finally, flight crews and controllers have access to different sets of information. For example, in one scenario, the blocker aircraft was on arrival into Denver International Airport. For the controller, this information was available on the traffic display; however, for the flight crew to gain this same information, the crew was required to contact either the blocker aircraft or the controller. In the discussion following the simulation, several controllers commented that, in this situation, they would have started the blocker aircraft down early for its descent, allowing the ownship to make only a minor maneuver off course to resolve the conflict. In this scenario, when the flight crew maneuvered for the intruder, 38% of crews made a lateral maneuver and 63% made an altitude change. These differences in pilot and controller conflict resolutions, given the particular information provided to each, need to be systematically examined. Similarly, other questions to be addressed include procedural issues for moving between constrained and unconstrained flight, and final responsibility for separation.
In conclusion, this research has provided insight into some important air-ground integration issues. Flight crew performance differences between high and low traffic density conditions were found in this study that were not realized in the previous studies (Lozito et al., 1997). The addition of the blocker aircraft to obstruct the most common maneuver and add complexity to the scenarios may be responsible for these density differences. Additionally, several conflict angle differences were uncovered. The acute angle conflicts were easier for controllers to detect, but were not as easy for the crews to resolve. Furthermore, although the obtuse angle conflicts were detected later by controllers, crews were able to adequately self-separate. These
angle  differences  have  implications  for  the 
operational  setting  and  should  be  investigated 
further.  Finally,  both  air-air  and  air-ground 

communication issues were revealed. The high frequency of air-to-air communications and the 9

Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
consequent impact on congestion remains a problem to be addressed. Regarding air-ground communications, timing and content of information relayed between the flight crew and controllers may be of particular concern. In sum, these results have helped define and describe some of the procedural concerns for flight crews and air traffic controllers in a self-separation environment.

NLR Human-in-the-Loop Study
Introduction
The National Aerospace Laboratory (NLR) conducted a Human-in-the-loop simulation experiment in 1997 to determine the human factors issues of operating an aircraft in a future free flight environment with Airborne Separation Assurance.
Before the Human-in-the-loop experiment could be executed on NLR’s Research Flight Simulator (RFS), two separate studies were carried out. The Conceptual Design study was performed to determine a feasible free flight concept. Although the RTCA Task Force 3 document (RTCA, 1995) gives a definition of free flight, this definition is not sufficiently detailed for research purposes. The goal of this first study was to determine a feasible free flight concept and develop it to a level of detail that could be implemented in the simulation environment. The main result from this study, in which several concepts were examined, was the choice and implementation of the Modified Voltage Potential theory (Hoekstra, Gent, and Ruigrok, 1997).
The second study done before the Human-in-the-loop study was a Safety Analysis of the free flight concept developed in the Conceptual Design study. The Safety Analysis showed that the developed free flight concept was at least as safe as the present day Air Traffic Management (ATM) environment. For more details on the Safety Analysis and the safety analysis tool TOPAZ (Traffic Organization and Perturbation AnalyZer), which was used in this study, see Daams, Bakker, and Blom, 1998.
The remainder of this paper will describe the Human-in-the-loop simulation experiment conducted at NLR and discuss both subjective and objective results obtained from this experiment.
METHODS

Participants
Flight crews. Eight flight crews from major European airlines participated in the NLR Human-in-the-loop Free Flight with Airborne Separation Assurance experiments. The crew members were assigned a position for the experiment based on their current rating, position, experience and preference. All crew members were current airline pilots.

Design
Experimental set-up. In the Human-in-the-loop experiment the traffic density, the level of automation (resolution activation) and nominal/non-nominal conditions were varied as the independent variables.
The traffic densities used in the experiment were one, two and three times the current mean Western-European traffic density. More specifically, the densities given in the number of aircraft in a 10000 square kilometer area, above FL190 were:
Single density: ~10 aircraft Double density: ~20 aircraft Triple density: ~30 aircraft
This corresponded to ~10, ~20 and ~30 aircraft respectively on the lateral navigation display when a 120 nm lateral range and +/- 8000 ft vertical range was selected.
Three levels of automation were used for resolution activation via the autopilot:
1.  
Manual, in which case the crew had to enter mode control panel entries themselves.

2.  
Execute combined, in which case the crew could auto enter both the horizontal and vertical resolution simultaneously by pressing a button on the mode control panel.

3.  
Execute separate, in which case the crew could select to auto enter the horizontal, the vertical or both resolutions simultaneously, by pressing one or two buttons on the mode control panel.

Combinations of traffic densities and levels of automation were all tested in nominal and non-nominal conditions. The non-nominal conditions consisted of other aircraft failures, own aircraft

10
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
failures and increased delay times in conflict detection and resolution.
All aircraft in the scenario were assumed to be equipped with ADS-B equipment and Airborne Separation Assurance System (ASAS) equipment consisting of conflict detection and resolution algorithms, Cockpit Displays of Traffic Information (CDTI) and ASAS alerting. Air traffic was monitored by Air Traffic Arbitration (replacing ATC on the ground) to assure co-operative behavior. All aircraft were flying direct routes from origin to destination and only upper airspace was considered.
The experiment lasted two days per crew, in which the first half day was used for training. The following three half days were used for the experimental runs. All aircrews in the experiment flew 18 experimental runs of 20 min duration in the simulated Brussels-West sector.
Concept. The concept used in the Human-in-the-loop experiment was the Modified Voltage Potential. Out of several concepts implemented, the modified voltage potential concept was chosen based on initial route, time and fuel efficiency calculations and the characteristics of the Modified Voltage Potential (Hoekstra, Gent, & Ruigrok, 1998).
A major benefit of the Modified Voltage Potential is its fail safety. If two aircraft are in conflict with each other, both aircraft calculate resolutions for the conflict as if the other aircraft is not maneuvering. However, the concept assumes that both of the aircraft do maneuver, so fail safety is introduced and the conflict is solved in a co-operative and economic way.
In all conflict situations, several options were available for the aircrew to resolve the conflict. Within the concept, two separate resolutions were possible which both resolved the conflict on their own. A horizontal resolution (heading and speed change) and a vertical resolution (vertical speed and altitude) was possible. The crew could choose which resolution fit best to the conflict geometry and current aircraft state. Selecting both horizontal and vertical resolution added another fail safe element to the concept.
The Modified Voltage Potential theory is based on algorithms presented by Massachusetts Institute of Technology Lincoln Laboratory (Eby, 1994). The theory is shown in Figure 5.
Shown in Figure 5 are the ownship aircraft and an intruder aircraft. Each aircraft is protected by a protected zone of 5 nautical mile radius and a height of 2000 feet (+1000 ft, - 1000 ft). The predicted protected zone of the intruder aircraft is shown in Figure 5 at the time both aircraft have approached each other at minimum distance. Every predicted intrusion of a protected zone within five minutes is regarded as a conflict. The conflict detection algorithms are based on current aircraft states and do not use additional intent information. The resolution for the conflict is based on the geometry of the conflict as shown in Figure 5. The vector from the ownship’s position at minimum distance to the edge of the predicted protected zone of the intruder aircraft is the avoidance vector to resolve the conflict. This avoidance vector can be divided in a heading change combined with a speed change as shown. This describes the horizontal resolution. Using the three-dimensional vector, a vertical resolution can be obtained from the conflict geometry in a similar way.

Figure 5. Geometry of modified voltage potential
Flight Crew Display and Tools. The Human-Machine Interface to support this free flight concept consists of a modified navigation display with additional control panel, additional aural alerts, and modified autopilot modes. The modifications to the navigation display are shown in Figure 6.
As can be seen in Figure 6, the conflict and resolution geometry is presented to the aircrew similar to the definition of the modified voltage potential. This gives the aircrew an intuitive and deterministic picture of why and how to resolve a conflict.
Enhanced TCAS like symbology is used to show other traffic. The conflicting intruder aircraft is

11
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
shown in amber (5 to 3 minutes away from intrusion of protected zone) or red (3 to 0 minutes from intrusion). The predicted protected zone of the intruder aircraft is shown together with the magenta avoidance vector to resolve the conflict. The dotted magenta lines represent the division of the avoidance vector to heading, speed and altitude/vertical speed changes. These changes, or resolutions, are presented on the Primary Flight Display as well.

Figure 6.: Navigation display with conflict symbology
Airborne Alerting Logic. Besides the alerting on the navigation display, the detection of a conflict is announced to the crew aurally, with a dedicated blue light in the glareshield and resolution advisory indications on the Primary Flight Display. The displays used both color coding and aural alerts to depict threat level. The aural alerts used varied depending on the alerting level of the conflict (amber/red conflict). Additional information on the navigation display is the distinction of aircraft closing in or moving away from the ownship, indicated by blue and white aircraft respectively. TCAS warnings were suppressed for experimental reasons, although TCAS is supposed to be present in this airborne separation assurance concept as a safety net.
In total five alert zones can be identified in this concept. Aircraft within the ADS-B range of 200 nm, a 5 minutes alert zone (amber), a 3 minutes alert zone (red), the protected zone of the aircraft (5nm radius, 2000 ft height) and finally the TCAS time based Resolution Advisory zone.

Communications/Negotiations
No communication was required with ground based stations, although air-ground communication with Air Traffic Arbitration (ATA) was available. An inter-air frequency was available for air-to-air communication with aircrew of surrounding traffic and conflicting traffic. Simulated communication between ATA and non-nominal behaving aircraft in the scenario was provided.
Experiment Control. The experiment is controlled using the Traffic and Experiment Manager (TEM). The TEM is a traffic generator for aircraft around the subject aircraft, contains all ASAS functions for all aircraft in the scenario and can be controlled using a dedicated graphical user interface. The TEM is capable of simulating up to 400 aircraft simultaneously in real-time.

Results and Discussion
The purpose of the Human-in-the-loop study was to identify human factors issues concerned with an Airborne Separation Assurance concept. For this reason an extreme version of airborne separation assurance was chosen: no Air Traffic Control (ATC) and full responsibility for traffic separation with the aircrew on board of the aircraft.
Subjective and objective measurements, gathered during the experiment, are presented.
Subjective data
The subjective data were collected with questionnaires before, during, and after the experiment. The results are presented related to traffic density. Four main questions were asked to the subjects concerning acceptability, safety, workload, and operations.
The results from the acceptability question are summarized in Figure 7. As can be derived from this figure, acceptability was around 80% and decreased slightly with traffic density.

12
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
subjective rating acceptabilty in percentages
other experiments (Gent, 1995) demonstrates that in today’s ATC environment in cruise conditions, average ratings are found to be around 30.
100 90
Subject workload
80
70
60

 

140
50
40

120
30
100
20

 

80
completelyunacceptable
Undesirable
Acceptable
Favorable
Perfect inevery way
60 40 20
80

3. I exceeded passenger comfort levels.
70
60

 

4. I need more explicit rules of the road to
guarantee the safety.
50
40
5. I need more explicit on board procedures to
30
guarantee the safety.
20
6. I need more training to guarantee safety.
10
0
ATC ATC Same FF FF

As can be seen from Figure 10, pilots
much safer safer much
safer safer

indicated that especially in triple density, Figure 8. Safety results relative to traffic density maneuvering is more than in the current ATC
Figure 7. Acceptability results relative to traffic density
The safety results are shown in Figure 8. The data show that in around 75% of the runs free flight was indicated to be as safe or safer than Air Traffic Control. A slight decrease with increasing traffic density is noted here as well.
100
90
Subjective ratings in percentages
0 single double triple
density
Figure 9. Subjective workload rating (RSME)
The last subjective data concern safety, operations and training. Pilots were given questions on which they could say “True” or “False”. These questions were:
1.  
I think I could safely guarantee the airborne separation with the set-up just flown.

2.

I maneuvered more than normally.
All participants were asked to enter a mark on a Rating Scale of Mental Effort (RSME) after each run. This scale ranged from 0 (“costing no effort”) to 150 (“costing lots and lots of effort”). The overall result of the subjective workload is shown in Figure 9 for nominal and non-nominal conditions, relative to traffic density. The overall average ratings are at or below the 40 mark, indicating that pilots rated this concept as “costing some effort”. Experience from situation. Also 30% of the participants considered training to be an issue.
Objective Data
The objective data collected consist of duration of conflicts, eye-point-of-gaze data, the maneuvers chosen to solve conflicts, and unintended intrusions of protected zones.

13
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998

and the Vertical Navigation Display are around 10% each.
From the resolution maneuvers data in manual mode, see Figure 12, it becomes evident that heading changes to resolve conflicts are favored over speed and altitude changes. This correlates with the fixation times on the Lateral Navigation Display. Aircrews were allowed to overrule the automatic modes and also were allowed to use the manual mode, although the automatic mode was suggested. Therefore, the numbers in the execute combined and execute separate mode differ than what was expected. As seen in Figure 12, speed was often overruled in the automatic mode.
100
80

Figure 11 shows the mean duration of a
conflict or conflict time defined as the time from
conflict detection until clear of conflict, in nominal
and non-nominal conditions. As can be seen, conflict
Percentages of used parameter
70
60
50
40
times increase significantly in non-nominal
conditions.
35
30
25
20

Series1
15
10
5
0

conflict time in seconds
Figure 11. Mean conflict times in nominal and non-
30 20 10
0
heading speed altitude
Finally, all intrusions of the protected zone of the subject aircraft were logged. One of the non-nominal conditions introduced in the scenarios was an aircraft performing an emergency descent through the protected zone of the subject aircraft. Apart from these deliberate intrusions, Table 1 shows the intrusions, which were not prescribed by the
scenario. Table 1 shows the minimum separation
nominal conditions
During the experiments, the pilots were fitted
distance, minimum separation altitude and intrusion duration. As can be seen, the intrusions are mainly grazes of the protected zone, either vertically or
with Eye-Point-Of-Gaze equipment to determine the horizontally.
location of interest. The total fixation duration on
These grazes occurred in cases of sudden
the Lateral Navigation Display of the pilot flying and
maneuvering of aircraft already close to the subject
pilot-not-flying across all sessions averaged around
aircraft, either due to reaching top of descent of the
50%. The numbers for the Primary Flight Display
other aircraft or lateral maneuvering of the other 14

Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
aircraft due to clear-of-conflict situations. Some grazes occurred in non-nominal conditions (NN) where own conflict detection and/or resolution were failed.

Session  min. sep. distance (nm)  min. sep. altitude (ft.)  intrusion duration (s) 
107 E T N  4.29  815  18 
309 M D N  3.42  914  8 
701 M S N  4.55  499  114 
701 M S N  4.77  119  341 
706 M S NN  no data  no data  4 
709 E T N  no data  no data  12 
711 E T NN  4.23  692  38 
713 A T NN  no data  no data  12 
715 A D NN  no data  no data  9 
718 A D N  no data  no data  18 
814 M T N  4.77  9.7  76 
817 M S NN  4.83  618  20 

Table 1: Intrusions of the protected zone.
General Conclusions
The aircrews participating in the experiment were given the new and extra task of traffic separation assurance, in a traffic environment up to three times as dense as today, with new displays and display features, new procedures, new cockpit automation and without extensive training. Therefore, the hypothesis was that the concept would be rated less than acceptable, less safe than today’s ATM environment and that workload would increase a considerable amount.
Subjective data showed an acceptability rating of 80%. Seventy-five percent of the runs were perceived by the pilots to be as safe or safer than Air Traffic Control. Workload was not rated higher in cruise conditions than in today’s ATM environment. These figures included triple density scenarios and non-nominal conditions. The true/false questions indicated that in the majority of the runs, the amount of maneuvering was more than in today’s ATM environment, in the opinion of the pilot participants.
The objective data show a significant increase of conflict times in non-nominal conditions. This can be explained by the fact that during non-nominal conditions other traffic did not always maneuver co-operatively or own aircraft conflict detection and/or resolution was sometimes failed.
The eye-point-of-gaze data show that fixation duration on the Lateral Navigation Display was around 50%. This is higher than in today’s cruise operation and could therefore be of concern. In current operations, the fixation duration times have been measured to be about 20% on the navigation display. However, it is not clear whether these high fixation duration times are required to operate in this concept. As the participants were unfamiliar with the displays and the task of separation assurance, one could argue that the novelty and desire to be in the loop resulted in the high fixation duration times. Further investigation will be needed to clarify this issue. The low fixation duration times on the Vertical Navigation Display are another concern. The question is whether the Vertical Navigation Display is useful for conflict detection and resolution presentation, or that the pilots were not yet trained enough to optimally use all possibilities.
The resolution maneuver data show a clear preference for heading changes, although altitude changes are far more economic and less disrupting to the intended route than horizontal maneuver (Valenti Clari, 1998). The eye-point-of-gaze data confirm this tendency with the low fixation duration times on the Vertical Navigation Display. From these objective data, it seems that more training is required to optimally use all tools on-board.
The intrusions of the protected zone are all grazes, either due to sudden maneuvering by aircraft close by the subject aircraft or the fact that the conflict resolution algorithms aim at the edge of the predicted protected zone of the intruder aircraft, without safety margin.
The overall conclusion of the Human-in-the-loop simulation experiment is that the feasibility of the given Airborne Separation Assurance concept for a future free flight environment could not be refuted. Both objective results and the results from the separate safety analysis (Daams et al., 1998) could not reject this conclusion.
Out of the many issues raised during the experiment, the main issue was that means should be provided to prevent intrusions of protected zones on short term due to sudden maneuvers. Future research should focus on the required fixation duration on all displays to complete the task of self-separation. Passenger comfort in relation to the amount of maneuvers will have to be addressed.

15
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998

General Summary
Both NASA and the NLR conducted research pertaining to aircraft self-separation in the enroute environment, an operational concept within free flight that is fairly advanced. The underlying assumptions for both studies included an assumption of ADS-B technology, airborne alerting logic, and CDTI available to all participants. However, there were some important differences between the implementations of self-separation, as well as the methodological approaches, between these two investigations. In general, the NLR study provided more automation technologies to aid in the task of self-separation. For example, resolution advisories, a vertical navigation display, and an automated means of enacting the maneuvers were all represented in the NLR research. Finally, the NASA study included controllers as participants; these controllers retained the ultimate separation responsibility during the scenarios.
The independent variables examined by the two studies also were different. The variables of interest for the NASA study were traffic density and convergence angles for conflicting traffic. The variables for the NLR research were traffic density, levels of automation for maneuvering, and operational conditions (nominal v. nonnominal).
In summarizing the research findings from the NASA and the NLR studies, there were some things in common. Both studies found some impact of increasing amounts of traffic on human performance. In the NASA study, both controllers and flightcrew participants generally took longer to detect conflicts in higher densities. In addition, self-report responses pertaining to subjective workload also indicated higher ratings for higher traffic density for both controllers and pilots. In the NLR study, the researchers uncovered some trends related to traffic density in their subjective data. Although the changes were typically not dramatic, there was an increase in the subjective workload ratings, and there were decreases in acceptability and safety ratings associated with higher traffic densities. The impact of traffic density may also be exacerbated by other factors. Abnormal situations that may further restrict self-separation operations, for example weather phenomenon and sudden changes in aircraft maneuvering which may cause short-term conflicts and intrusions, should be explored more thoroughly.
In both the NASA and NLR studies, there were cases in which separation was lost between two aircraft (the separation standards were similar to those proposed for future ATM operations). As a strategy, flight crew participants often attempted to minimize the separation between aircraft while still maintaining legal separation. Findings from the NASA study indicate that controllers would feel more comfortable with a larger separation than the flight crews often obtained. The NLR study did not include the use of controllers as participants. Further research needs to address the separation needs for the controllers and the pilots, and should identify potential modifications to the alerting schemes to reflect the operators’ requirements within self-separation.
The NLR study also found interesting results pertaining to eye gaze fixations and CDTI technology. Specifically, pilots appeared to fixate upon the CDTI (both the lateral and vertical components of the navigation display) approximately 60% of the total eye gaze time. By contrast, the time spent fixating on the primary flight display was only about 10% of their total time. The NASA findings suggest that their pilot participants felt that they were spending too much time attending to the CDTI, possibly supporting the results from the NLR study.
There were some different findings for crew maneuvering from the two investigations. Both studies revealed that crews often used more than a single performance parameter (e.g., altitude) to resolve a conflict. In the NLR work, the most common parameter used was heading. This is consistent with previous studies conducted at NASA (Cashion et al., 1997). However, in the current NASA study, altitude was the most common parameter used to solve traffic conflicts. This was likely due to the introduction of an aircraft blocking the most common lateral maneuver (the blocker) that made the use of the altitude solution more desirable.
Finally, two other potential human performance issues were revealed in the NASA study. Conflict angles seemed to impact the controller conflict detection and the timing and type of maneuvering used by the flight crews. In some cases, traffic density may interact with the effects of convergence angle. Additionally, there were many

16
Self-Separation from Air, Ground and Airline Perspective
Air Traffic Management R&D Seminar, Orlando FL, 1998
air-to-air negotiations and communications. This amount of communication could be problematic in a free flight environment in which there may be simultaneous negotiations between several crews. System constraints may restrict the availability of the radio channels, blocking it when a controller may be required to contact and instruct a crew in the event that self-separation become hazardous.
In sum, these research projects have helped define and describe some of the procedural concerns for flight crews and air traffic controllers in a self-separation environment. Future research is needed to further examine the human performance characteristics in a broader spectrum of self-separation environments.

References
Cashion, P., Mackintosh, M., McGann, A., & Lozito, S. (1997). A study of commercial flight 16th
crew self-separation. Proceedings of the AIAA/IEEE Digital Avionics Systems Conference, Vol. 2, (pp. 6.3-19 – 6.3-25). New Jersey: Institute of Electrical and Electronic Engineers.
Daams, J., Bakker, G.J., & Blom, H.A.P. (1998). Safety evaluation of an initial Free Flight scenario with TOPAZ (Traffic Organization and Perturbation AnalyZer). NLR TR-98098. Amsterdam: National Aerospace Laboratory.
Eby, M.S. (1994). A self-organizational approach for resolving air traffic conflicts, The Lincoln Laboratory Journal, 7,(2).
Gent, R.N.W.H. van. (1995). Human factors issues with airborne data link: Towards increased crew acceptance for both en-route and terminal flight operations. NLR TP 95666. Amsterdam: National Aerospace Laboratory.
Gent, R. N. H. W., van, Hoekstra, J. M., & Ruigrok, R. C. J. (1998). Free flight with airborne separation assurance. Proceedings from the International Conference on Human-Computer Interaction in Aeronautics, (pp. 63-69). Montréal, Québec: l’école Polytechique Montréal
Hilburn, B., Jorna, P.G.A.M., Byrne, E. A., & Parasuraman, R. (1997). The effect of adaptive air traffic control (ATC) decision aiding on controller mental workload. In M. Mouloua, & J. M. Konce (Eds.), Human automation interaction: Research and practice, (pps. 84-91). Mahwah, NJ: Erlbaum.
Hoekstra, J.M., Gent, R.N.W.H. van, & Ruigrok, R.C.J. (1997). Offline validation of a conceptual design for free flight in cruise. NLR Contract Report. Amsterdam: National Aerospace Laboratory..
Hoekstra, J.M., Gent, R.N.W.H. van, & Ruigrok, R.C.J. (1998). Conceptual design of free flight with airborne separation assurance. AIAA-98-4239.
Lozito, S., McGann, A., Mackintosh, M., & Cashion, P. (1997). Free flight and self-separation from the flight deck perspective. The First United States/European Air Traffic Management Research and Development Seminar, Sacley, June 17-20, 1997.
Remington, R., Johnston, J., Ruthruff, E., Romera, M., & Gold, M. (in press). The effect of free flight on the detection of traffic conflicts by experienced controllers. NASA Technical Report. Moffett Field, CA: NASA.
RTCA. (January, 1995). Final report of the RTCA board of directors’ select committee on free flight. Washington, DC: RTCA, Incorporated.
Valenti Clari, M.S.V. (1998). Cost benefit analysis of conflict resolution maneouvres in free flight. Delft University of Technology, Graduation Report.
Wyndemere. (1996). An evaluation of air traffic control complexity. NASA Contractor Report NAS2-14284. Moffett Field, CA: NASA Ames Research Center.
Yang, L., & Kuchar, J. (1997). Prototype conflict alerting logic for free flight. (AIAA 97-0220). Reston, VA: American Institute of Aeronautics and Astronautics.