F ACTORS A FFECTING 2
2.7 Aspects of Uncertainty in Making Sense of Information
5 8 COGNITIVE ENGINEERING AND SAFETY ORGANIZATION
FACTORS AFFECTING ATM PERFORMANCE 5 9
4. Information noise that is part of an “avalanche” of data that increases efforts at identifying critical cues
5. Hard to interpret information that makes it difficult to construct a coherent story of events, or an explanation of the situation.
Situations where controllers encounter more than one form of uncertainty are considered the most demanding and challenging. In the following sections, the five types of uncertainty are illustrated in the ATM context.
2.7.1 Missing Information
To perform their assigned tasks, controllers need information that is relevant to the context of work and their roles. For example, approach controllers may rely on different information than tower controllers to perform their tasks. When information is incomplete or missing, controllers have to find ways to recover such information or tolerate this event a little longer and rely on tentative assumptions. The dif-ficulties in handling incomplete information also relate to the sources of information and the tasks at hand. There are four main information sources for controllers, namely:
• Flight plans (FP): They provide basic information for most flights and originate from the departure airport; in some cases, it is very difficult to obtain missing FP information from this source.
• Flight crew: In the onset of an emergency, flight crews are very selective in the amount and sort of information to com-municate to ATC units. As discussed earlier in this chapter, communication becomes a main priority. Controllers have to trade-off several options, such as pressing on for information, which increases crew workload, tolerating some uncertainty by utilizing other information resources, or waiting until the situation is stabilized.
• Other controllers units or agencies: Critical information about flights may be available from other controllers in the same unit or another agency. Asking for more information, how-ever, comes at the cost of task interruption, attention diver-sion, and more delays. Since there is no guarantee that extra
6 0 COGNITIVE ENGINEERING AND SAFETY ORGANIZATION
information will reduce uncertainty, knowing when to inter-rupt others and what information to inquire for becomes an important skill in teamwork.
• CNS systems: Radar is the fundamental surveillance system that provides a set of useful information for aircraft identity, track, speed, and altitude. Missing parts of this information can increase the handling requirements of the situation.
2.7.2 Unreliable Information
Sometimes the information is accessible but its reliability may be low, as controllers may suspect that it is erroneous or outdated. Unreliable flight plan information is rather common in general aviation (GA) and the military. GA crews may fly on a weekend basis and may not fully comprehend the intricacies of the ATM system. In many cases, they may not know how to accurately complete a FP or conform to the required data conventions. In addition, military flights cannot be fully revealed in an FP, hence creating misleading information.
Private flight crews flying in their spare time may be a source of unreliable information due to their incomplete knowledge of their onboard systems or the ATC system in general. Very early in their professional careers, controllers learn not to fully trust reports of pri-vate flight crews.
Other units or agencies can also produce unreliable informa-tion for several reasons such as rivalries, incompetence, or human errors. For instance, an inaccurate time estimate over an entry point between two neighboring sectors might be attributable to lack of competence or malfunction of the flight data processing system (FDPS). It is also likely that a controller may communicate an unre-liable routing to a military flight due to operational planning limita-tions in the dissemination of information. Controllers may be able to recognize unreliable data from the CNS system by utilizing their training and experience. Unreliable information may take the form of false targets, omissions in presentation of targets, and distortion of weather reports. In most cases, controllers can identify unreliable data from CNS systems but this may become difficult when systems operate in degraded modes, or when maintenance work has disabled some equipment.
FACTORS AFFECTING ATM PERFORMANCE 61
2.7.3 Inconsistent Information
When all necessary information has been obtained, and its reliability has been verified, controllers may find out more conflicts with other exter-nal information or their own expectations. An illustrative story concerns a private pilot who received an instruction by a controller to proceed to point ALPHA in a busy terminal maneuvering area (TMA) sector. As the radar screen showed that the aircraft was actually proceeding to another point BRAVO, the controller requested the pilot to report his course. It came as a surprise that the pilot replied that he was proceeding to point ALPHA. The experienced controller compared the reported position with other radar data and thought of possible errors made by general aviation pilots (e.g., forgetting to change the route or activat-ing the wrong point in the cockpit GPS). Usactivat-ing other reliable sources and his own expectations about general aviation pilots, the controller became confident in his assessment that the pilot had not fully complied with the earlier instruction and was actually in the wrong place.
2.7.4 Information Noise
Although the increased use of automation created an information-rich ATC environment, this was done at the cost of producing more noise or unrelated data that should be filtered out by controllers. Displays are usually designed in a linear fashion assuming that roughly the same set of information is always needed, although with some minor variations. This is not entirely true because controllers may wish to filter out some information to improve observability and make data easier to interpret. The following story shows that the system may not allow controllers to reduce noise and select what information to hide or what information to display in cases of emergencies.
In an Approach sector, the executive controller (EC) set his radar display to depict aircrafts tracks from mean sea level (MSL) to FL200 (20,000 ft). Suddenly, urgent information was received from the area sector, showing an aircraft cruising at FL410 (41,000 ft) that expe-rienced an explosive decompression; the aircraft was descending rap-idly to the airport below for an emergency landing. As the controller removed the altitude filter from the radar to identify the aircraft of concern, the radar screen was cluttered with dozens of flight tracks that were difficult to identify. Altitude filters are useful tools but
6 2 COGNITIVE ENGINEERING AND SAFETY ORGANIZATION
they do not allow controllers to tailor them to their search patterns and choose what to hide and what to display on the radar screen.
Therefore, automated assistance tools may produce noise and clutter the display with unrelated data to such an extent that searching for a target may become impossible.
2.7.5 Hard to Interpret Information
Even when all critical information has been collected and verified, in some cases, controllers may find it hard to interpret the information and make sense of the situation, or they may be confronted with many stories that are all equally plausible. Many difficulties in making sense of the problem have been illustrated in the Helios flight HCY-522 crash near Athens (AAIASB 2006).
Departing from Larnaka, flight HCY-522 contacted the company operations center at 16,000 ft. and reported a takeoff “configura-tion” warning and “equipment cooling system” problem (AAIASB 2006). Communications between the captain and the operations cen-ter ended when the aircraft was climbing through 28,900 ft. From that moment, no further communications were established with the aircraft climbing and leveling off at 34,000 ft. The aircraft cruised at 34,000 ft and followed its course to its destination (i.e., International Airport of Athens) since the crew had programmed the FMS to fol-low this route. Repeated attempts to establish communication with the aircraft failed and two Greek F-16s fighters were ordered to pro-vide close inspection of the aircraft. One of the F-16 flight crews reported that the captain’s seat was vacant and the first officer’s seat was occupied by someone who was slumped over the controls. After a few minutes, the F-16 pilot reported that a person, not wearing an oxygen mask, entered the cockpit and occupied the captain’s seat.
Later on, the left engine flamed out and the aircraft started to descend into the holding pattern until fuel was exhausted, and the aircraft crashed killing 121 passengers and the flight crew onboard.
The aircraft never deviated from its FP route and there was indica-tion that something abnormal was happening. Initially, the Athens ACC declared an alert phase to the joint rescues coordination center (JRCC) and 40 minutes later declared a distress phase. The ini-tiation of holding procedures over Athens left the ACC controllers
FACTORS AFFECTING ATM PERFORMANCE 6 3
and the Hellenic government puzzled as to what exactly they were encountering. Controllers and government officials could not pro-vide a solid interpretation of the unfolding situation; the F-16 pilot’s reports exacerbated the puzzle and further increased uncertainty. In the end, the aircraft was classified as “rogue” and the F-16 flight crews were instructed to shoot it down if there were clear indications that the aircraft was heading for populated areas. However, the fuel was exhausted and the aircraft crashed without any casualties to the popu-lation on the ground. This incident illustrates one of the worst forms of uncertainty that the ATC system may encounter in an emergency with regard to team collaboration with several external agencies.