Cognitive process modelling of controllers in en route air traffic control

In recent years, various efforts have been made in air traffic control (ATC) to maintain traffic safety and efficiency in the face of increasing air traffic demands. ATC is a complex process that depends to a large degree on human capabilities, and so understanding how controllers carry out their tasks is an important issue in the design and development of ATC systems. In particular, the human factor is considered to be a serious problem in ATC safety and has been identified as a causal factor in both major and minor incidents. There is, therefore, a need to analyse the mechanisms by which errors occur due to complex factors and to develop systems that can deal with these errors. From the cognitive process perspective, it is essential that system developers have an understanding of the more complex working processes that involve the cooperative work of multiple controllers. Distributed cognition is a methodological framework for analysing cognitive processes that span multiple actors mediated by technology. In this research, we attempt to analyse and model interactions that take place in en route ATC systems based on distributed cognition. We examine the functional problems in an ATC system from a human factors perspective, and conclude by identifying certain measures by which to address these problems. This research focuses on the analysis of air traffic controllers' tasks for en route ATC and modelling controllers' cognitive processes. PRACTITIONER SUMMARY: This research focuses on an experimental study to gain a better understanding of controllers' cognitive processes in air traffic control. We conducted ethnographic observations and then analysed the data to develop a model of controllers' cognitive process. This analysis revealed that strategic routines are applicable to decision making.     

Dependability evaluation of an air traffic control computing system

As air traffic over France is growing rapidly, the existing air traffic control (ATC) system has to evolve to satisfy the increasing demand. The selection of the new automated computing system (denoted CAUTRA) is based, among other things, on dependability evaluation. This paper is devoted to the dependability evaluation of the CAUTRA, however, emphasis is put on a subset: the regional control center (RCC). Starting from the analysis of the impact of CAUTRA failures on air traffic safety, five levels of service degradation are defined for the global system grading the effects of these failures on the service delivered to the controllers to ensure traffic safety. The RCC failure modes leading to these degradation levels are then defined and evaluated using stochastic Petri nets. The modeling approach consists in modeling the system as a set of modules interconnected via coupling mechanisms. The system model is constructed in several steps according to an incremental approach. Each step integrates the failure and recovery assumptions of an additional component and updates the model of the previous step by accounting for the impact of the new component on the behavior of those already included in the model. The application of this approach to the CAUTRA allowed us to analyze several configurations of the CAUTRA architecture and to identify improvement areas to minimize the impact of CAUTRA failures on air traffic safety.     

空管管制设备下沉技术方案研究

There is a large number of civil aviation air traffic control terminal equipment. When the equipment fails to maintain, the space is narrow and easy to cause other faults, which may cause certain interference to the controller's command when handling on- site faults. The above problems can be avoided by sinking the control terminal equipment with optical fiber matrix technology. The new air traffic control room has been used in some areas. This paper mainly discusses how to design and use optical fiber matrix equipment to sink the control terminal equipment and ensure the safety and reliability of the control and operation equipment.     

Modeling and predicting mental workload in en route air traffic control: critical review and broader implications

OBJECTIVE: We perform a critical review of research on mental workload in en route air traffic control (ATC). We present a model of operator strategic behavior and workload management through which workload can be predicted within ATC and other complex work systems. BACKGROUND: Air traffic volume is increasing worldwide. If air traffic management organizations are to meet future demand safely, better models of controller workload are needed. METHOD: We present the theoretical model and then review investigations of how effectively traffic factors, airspace factors, and operational constraints predict controller workload. RESULTS: Although task demand has a strong relationship with workload, evidence suggests that the relationship depends on the capacity of the controllers to select priorities, manage their cognitive resources, and regulate their own performance. We review research on strategies employed by controllers to minimize the control activity and information-processing requirements of control tasks. CONCLUSION: Controller workload will not be effectively modeled until controllers' strategies for regulating the cognitive impact of task demand have been modeled. APPLICATION: Actual and potential applications of our conclusions include a reorientation of workload modeling in complex work systems to capture the dynamic and adaptive nature of the operator's work. Models based around workload regulation may be more useful in helping management organizations adapt to future control regimens in complex work systems.     

Human centered design in the air traffic control system

A review of the current air traffic control system is undertaken from the perspective of human centered design, focusing on the development of today’s system, the problems in today’s system, and the challenges going forward. Today’s system evolved around the operators in the system (mainly air traffic controllers and pilots), rather than being designed based on specific engineering analyses. This human centered focus has helped make air transportation remarkably safe, but has also made the air traffic control system somewhat inscrutable. This opaqueness of how the system operates poses significant problems for current attempts to transform the system into its “next generation” with significantly improved capacity. Research advances in human centered computing research required in order for this transformation work to proceed are discussed, specifically advances in computing the safety of complex human-integrated systems, understanding and measuring situation awareness, and visualizations of complex data.     

The s-ethos system: A methodology for systematic flight analysis centered on human factors

The aeronautics community needs several alternative methods and tools to describe and analyze interactions between human operators and systems, according to some constraints (e.g., human factors, air safety, etc.). Hence, it needs to build models from the observation of real interactions, especially piloting, and to use extant theories from several fields: cognitive ergonomics and artificial intelligence, mainly. S-ETHOS sketches out a knowledge-based system that analyzes human pilot activities and provides feedback to improve air safety by giving measured appraisal of pilot error. The core of S-ETHOS is the ETHOS model that depicts the standard behavior based on the human pilot. S-ETHOS helps any air safety expert to simulate the pilot behavior during his mission and then will compare behavior between the simulation and real situations. It allows the air safety expert to know how the pilot assesses each situation. We implemented the ETHOS model according to an object-oriented approach, relying on a knowledge modeling language called OBJLOG II+. This model provides a first keystone to understanding how the human pilot captures and builds his environment through complex states. We will discuss the identified behaviors and potential deviations and associated situations.     

Strategies for designing distributed systems: case studies in the design of an air traffic management system

The air traffic management system in the USA is an example of a distributed problem-solving system. It has elements of both cooperative and competitive problem-solving. It includes complex organizations such as Flight Operations Centers, the FAA Air Traffic Control Systems Command Center (ATCSCC), and traffic management units at en route centers that focus on daily strategic planning, as well as individuals concerned more with immediate tactical decisions (such as air traffic controllers and pilots). The design of this system has evolved over time to rely heavily on the distribution of tasks and control authority in order to keep cognitive complexity manageable for any one individual operator, and to provide redundancy (both human and technological) to serve as a safety net to catch the slips or mistakes that any one person or entity might make. Within this distributed architecture, a number of different conceptual approaches have been applied to deal with cognitive complexity and to provide redundancy. These approaches can be characterized in terms of the strategy for distributing: (1) control or responsibility, (2) knowledge or expertise, (3) access to data, (4) processing capacity, and (5) goals and priorities. This paper will provide an abstract characterization of these alternative strategies for distributing work in terms of these 5 dimensions, and will illustrate and evaluate their effectiveness in terms of concrete realizations found within the National Airspace System.     

Verified hybrid controllers for automated vehicles

The objective of an automated highway system (AHS) is to increase the safety and throughput of the existing highway infrastructure by introducing traffic automation. AHS is an example of a large scale, multiagent complex dynamical system and is ideally suited for a hierarchical hybrid controller. We discuss the design of safe and efficient hybrid controllers for regulation of vehicles on an AHS. We use game theoretic techniques to deal with the multiagent and multiobjective nature of the problem. The result is a hybrid controller that by design guarantees safety, without the need for further verification. The calculations also provide an upper bound on the performance that can be expected in terms of throughput at various levels of centralization     

Analysing situated interaction hazards: an activity-based awareness approach

This paper presents a case for the usefulness of activity theory (AT) for the analysis of situated interaction hazards in safety-related systems. It is suggested here that situation awareness is a safety critical attribute that is acquired and maintained through situated activity or actions. We introduce an activity-based awareness model based on this fundamental premise and we show how the model is consistent with the principles of AT. We also provide an example of the usefulness of AT as a theoretical and practical foundation for the analysis of situated interaction hazards in complex, safety-related systems. Specifically, we describe how the activity-based awareness model and AT principles were applied to an investigation of situation awareness in a military air traffic control system. We show how this approach can also be used to support analyses of general interactive systems use. We suggest that this general approach can be used to support analyses of interactive system use, to inform system design, and mitigate against the situated interaction hazards inherent in safety-related systems, and that this provides evidence that AT can be a useful way of looking at situational hazards in safety-related systems use.     

基于Spark的电网工控系统流量异常检测平台

针对传统的电力网络流量检测安全预警系统在面对海量高维度数据时，其在精度、实时性、扩展性以及效率上都无法满足需求的问题，建立出一种基于Spark的电网工控系统流量异常检测平台.该平台以Spark为计算框架，主要由数据采集与网络流量深度包检测协议解析模块，实时计算数据分析处理模块，安全预警预测模块和数据存储模块组成，为流量异常检测提出了一套完整的流程.实验结果表明，该平台能够有效地检测出异常流量，做出安全预警，方便工作人员及时做出决策，这充分说明该平台非常适用于电力控制系统，能够应对海量高维复杂数据做出实时分析以及安全预警，极大地提高了电网工控系统的安全性能.     

Safety intelligence: An exploration of senior managers' characteristics

Senior managers can have a strong influence on organisational safety. But little is known about which of their personal attributes support their impact on safety. In this paper, we introduce the concept of ‘safety intelligence’ as related to senior managers' ability to develop and enact safety policies and explore possible characteristics related to it in two studies. Study 1 (N = 76) involved direct reports to chief executive officers (CEOs) of European air traffic management (ATM) organisations, who completed a short questionnaire asking about characteristics and behaviours that are ideal for a CEO's influence on safety. Study 2 involved senior ATM managers (N = 9) in various positions in interviews concerning their day-to-day work on safety. Both studies indicated six attributes of senior managers as relevant for their safety intelligence, particularly, social competence and safety knowledge, followed by motivation, problem-solving, personality and interpersonal leadership skills. These results have recently been applied in guidance for safety management practices in a White Paper published by EUROCONTROL.     

Generalizable safety annotations for specification of failure patterns

Components in programmable systems often exhibit patterns of failure that are independent of function or system context. In this paper, we show that it is possible to capture, and reuse where appropriate, such patterns for the purposes of system safety analysis. We describe a language that enables abstract specification of failure behaviour and define the syntax and semantics of this language. The language extends concepts originally defined in HiP‐HOPS, a technique that enables a largely automated form of compositional system safety analysis. The paper describes how this language can be used to describe component failure patterns and demonstrates how it can be applied using a simple fuel system example. The approach is evaluated on a set of retrospective industrial case studies, where data‐mining and reverse engineering techniques are applied in order to identify hidden patterns in legacy safety analyses. Results show clear potential for practical use of patterns in HiP‐HOPS. We argue that careful specification and reuse of failure patterns in conjunction with a tool that automates Fault Tree and Failure Modes and Effects Analysis can help to simplify complex safety assessments. Copyright © 2010 John Wiley & Sons, Ltd.     

Tradable Credit Scheme for Control of Evolutionary Traffic Flows to System Optimum: Model and its Convergence

We propose a dynamic tradable credit scheme for control of the day-to-day evolution process of traffic flows towards the system optimum (SO) state in a traffic network with elastic demand. In the scheme, the distribution and charge of travel credits are adjusted from period to period. The interacting dynamics among day-to-day traffic flows, period-to-period credit adjustment, and day-to-day credit price is formulated as an evolutionary game model. We mathematically prove two properties of the model, i.e., the consistence of the stationary state with the SO state and the convergence of the evolutionary trajectory. Finally, numerical results on a middle-size network are presented to validate the dynamic tradable credit scheme and to demonstrate the properties and application of the model.

     

Redesigning air traffic control: an exercise in software design

This case study demonstrates how basic software engineering techniques can make a complex system dramatically simpler. The authors describe lessons learned from reverse engineering an air traffic control system with a variety of tools and redesigning it to be smaller, simpler and more flexible     

基于多延时动力系统的交通流量建模

为了改善多车道、路况可变、流量可变的复杂交通环境中关于道路交通流量的问题,采用多时段延时动力系统思想,建立了基于动力系统的道路交通流量新模型．该模型可以描述前后多时间段对道路交通流量的相互影响．仿真数据结果表明,新模型能够模拟真实的交通流量变化,同时对于控制交通流量以及分析交通系统的特点是有效的．     

Classification of air traffic control scenarios using decision trees: insights from a field study in terminal approach radar environment

Air traffic controllers are responsible for the safe, expeditious and orderly flow of the air traffic. Their training relies heavily on the use of simulators that can represent various normal and emergency situations. Accurate classification of air traffic scenarios can provide assistance towards a better understanding of how controllers respond to the complexity of a traffic scenario. To this end, we conducted a field study using qualified air traffic controllers, who participated in simulator sessions of terminal radar approach control in a variety of scenarios. The aim of the study was twofold, firstly to explore how decision trees and classification rules can be used for realistic classification of air traffic scenarios and secondly to explore which factors reflect better operational complexity. We applied machine learning methods to the data and developed decision trees and classification rules for these scenarios. Results indicated that decision trees and classification rules are useful tools in accurately categorizing scenarios and that complexity requires a larger set of predictors beyond simple aircraft counts. The derived decision trees and classification rules performed well in prediction, stability and interpretability. Practical benefits can be derived in the areas of operations and system design in the context of air traffic flow and capacity management systems.     

Flightdeck and air traffic control collaboration evaluation (FACE): evaluating aviation communication in the laboratory and field

The challenge to anticipate the human factors impact of introducing new technologies into a safety critical environment can be addressed in a number of ways. This paper presents a research programme that utilised both laboratory- and field-based assessments to examine the way in which datalink and freeflight may affect the communication and collaboration between pilots, air traffic controllers, and other actors and artefacts in the flightdeck-air traffic control (ATC) joint cognitive system. An overview of the results from these studies is presented, and guidance is provided as to the likely situations in which this new technology is most likely to be successfully applied. In addition, the methodological approach of combining results from field and laboratory data is discussed.     

基于CPN的列控系统等级转换建模与分析

在高速列车运行过程中,列控系统等级转换过程所用的时长和转换成功概率,直接影响列车运行安全和行车效率。利用有色Petri网对CTCS-3级列控系统和CTCS-2级列控系统之间等级转换以及典型设备故障导致降级场景分别建模,模拟等级转换过程中RBC（Radio Block Center,无线闭塞中心）,车载设备,有源应答器之间的信息交互过程。分析了列车速度对等级转换实时性的要求和对转换成功概率的影响,以及突发降级的可能性,结果表明建模方法满足CTCS-3级列控系统的安全性和兼容性要求。     

基于卡尔曼滤波和AHP的航空管制航空器应急指挥效能评估

近年来,航空安全问题引人关注。传统航空应急指挥系统模型建立存在线性信号分析失常、应急指挥模型时效性滞后、空中管制系统信号算法穿透力差等问题,无法满足现代航空安全应急指挥的要求。针对传统航空应急指挥系统存在的问题,提出基于卡尔曼滤波和AHP的航空管制航空器应急指挥系统设计。利用卡尔曼滤波良好的线性分析能力与抗干扰性,结合AHP航空数据分析式,设计出针对性强的航空管制航空器应急指挥系统,并对设计系统进行指挥应用模型的效能评估。评估数据表明,提出的基于卡尔曼滤波和AHP的航空管制航空器应急指挥系统设计满足航空管制应急的使用要求。