**Flight crew support for automated negotiation**

**of descent and arrival clearances**

Thomas Prevot^1^[^1] , Everett Palmer^2^ and Barry Crane^3^

^1^National Research Council, ^2^NASA Ames Research Center, ^3^San Jose
State University

NASA Ames Research Center

Moffett Field, California

ABSTRACT

This paper focuses on the application of data link for communication
between air traffic management and FMS-equipped aircraft. Based on
requirements and guidelines for data link usage, a general philosophy
for automated data exchange and the distribution of tasks between the
human operators and the automation is presented. Many different areas
are affected by the introduction of data link, including the role of the
flight crew and the controllers as well as procedures and training
requirements. In particular, the design of a flight crew interface
providing for the necessary flight crew support is a crucial factor for
data link efficiency. This paper introduces a concept addressing these
areas and concludes with an outlook to upcoming experiments at NASA's
research facilities that are aimed at validating the proposed concept.
Ultimately, safety and cost-effectiveness of the air transport system
should be significantly improved by exploiting the capabilities of
automation tools like CTAS on the ground and the FMS in the aircraft
through the utilization of digital data connections.

Background

It is generally recognized that new kinds of automated systems like
flight management systems and autoflight control systems tend to suffer
from serious design and utilization problems with regard to human
factors aspects. One problem is that often a philosophy is missing that
could provide a general guideline for designing and using the
automation. This lack of automation philosophy is accompanied by
insufficient feedback to the operator about the state of the automation
leading to strong and silent machines that cause significant situation
awareness problems on flight decks (e.g. Sarter &Woods, 1993). There are
clear indications that many of the aircraft accidents attributed to
'pilot error' are strongly related to this kind of human-automation
interaction problem.

While these problems still exist with regard to 'conventional glass
cockpits', the next revolution within aviation is on its way. Like an
'internet in the sky' data link will connect different air traffic
control facilities, airline operational control centers, and modern
aircraft. Studies indicate that this may lead to more cost-effective
operations during all phases of flight (FAA, 1996, den Braven, 1992). On
the other hand experiences, e.g. gained with the FANS data link
connection for oceanic flights show that this application is far from
being operationally acceptable as a general data link solution. Some of
the reported problems became apparent in the study described
subsequently.

In a full-mission experiment conducted in the NASA Ames Boeing 747-400
simulator, descent and arrival constraints were datalinked from the
ground into the aircraft using FANS 1 data link. In this environment,
handling an ATC message that can be loaded into the FMC requires that
the flight crew press several buttons on the CDU, thereby executing the
following actions:

-   printing the message on the cockpit printer

-   loading the data into the FMC

-   responding to ATC and

-   executing the flight plan.

![](media/image1.wmf){width="6.435416666666667in"
height="2.970833333333333in"}

**Figure 1: FANS 1 experiments with NASA's B747-400 simulator**

Figure 1 shows the elapsed time for flight crews to perform each action
after accessing the ATC-Uplink message. It took between 40 and 140
seconds from accessing the ATC page to responding to ATC. Since the
air/ground transmission time and the time to access the ATC page must
still be added, total transaction times for a ground initiated
communication cycle of one to three minutes were typical for this
application. Additionally, loading the route into the FMS usually led to
route discontinuities and it took between one and seven more minutes to
'repair' the flight plan stored in the FMS. Therefore, with route uplink
handling times of up to 10 minutes, this interface is unsuitable for
high workload flight situations.

Another result was that the flight crews performed the required actions
in different orders, because no clear procedures were defined and the
pilots had only very little training in dealing with FANS data link.
This was even true for pilots, who had already used this interface
operationally in the oceanic environment. The results from this study
are similar to other studies suggesting that the FANS1-CDU interface is
cumbersome and research and development efforts are needed in order to
improve or replace it.

It is important to note that all aspects of the
air-ground-human-automation interaction are extremely interdependent. A
redesigned pilot interface will affect the complete communication loop
including the pilot procedures, training requirements, the capabilities
of dealing with ATC-instructions and the controllers task. Thus, it is
insufficient to design and research only certain parts of the overall
system, before the philosophy of the overall system and the roles of the
different agents -human and machine- have been clearly identified. This
philosophy identification process must be based on the requirements for
the system operation and guidelines for human automation interaction.

GUIDELINES AND REQUIREMENTS FOR DATA LINK USAGE

The digital connection between aircraft and air traffic management is
one of the most significant automation steps in aviation. Therefore, the
principles, guidelines and requirements for human-centered automation
must be carefully regarded and applied. Given the premises that the
pilot is responsible for safety of flight and the controller is
responsible for traffic separation and safe traffic flow Billings (1996)
states his first principles of human-centered aviation automation as
follows:

-   Pilots must remain in command of their flights

-   Controllers must remain in command of air traffic

The corollaries to these principles requiring operator involvement and
information as well as monitoring capabilities of human and automation
build a fundamental basis for the data exchange concept proposed in this
paper. In addition to the general principles for human-centered
automation the main requirements concerning data link usage have been
summarized in terms of recommendations in SAE (1996). These
recommendations cover technical details as well as many human factors
aspects regarding procedures, flight deck integration, and the human
computer interface.

The following three requirements deal with the main human factors
concerns underlying the subsequent concept definition:

-   the air/ground communication procedures shall be consistent
    throughout all phases of flight and all kinds of communication
    environments

-   the situation awareness of all operators shall be maintained or
    increased

-   the communication transaction times shall be within acceptable
    limits for the respective flight situation

The requirements stated above must not be confused with the goals of the
data link integration. Meeting these requirements only assures that the
situation does not deteriorate , but it does not improve the air traffic
situation per se. The only clearly defined goals that are associated
with controller/pilot data link so far are to relieve the frequency
congestion and to transmit messages with less transmission errors. A
more recent safety and efficiency oriented goal is to integrate ground
automation with airborne automation. This allows to load constraints
(e.g. generated by CTAS) that are necessary for scheduling purposes
directly from the ground into the aircraft Flight Management System to
exactly follow the most cost-effective trajectory that meets these
constraints.

THE ROLE OF THE AGENTS IN THE AIR-GROUND SYSTEM

The overall air ground system comprises several human and machine
agents. Typically two flight crew members interact with the aircraft
automation via manual input devices and displays. This automation is
used for controlling and monitoring the aircraft behavior according to
tactical or strategic reference values and trajectories. On the ground,
one or more operators are controlling the aircraft that are flying in a
certain area. The controllers use radar displays as well as automated
tools that provide advisories for aircraft sequencing, runway
assignment, and descent, arrival and approach instructions. Figure 2
compares the main agents and their interdependencies in a current
(voice) environment, in a mixed datalink/voice environment, and in a
data link only environment.

![](media/image2.wmf){width="6.05in" height="3.8645833333333335in"}

**Figure 2: Interaction of flight crew, controllers and automation in
different environments**

Currently the flight crew members and air traffic controllers exchange
information directly via voice, and modify their automatic systems
accordingly. The humans talk about the modifications and adjustments
they have to perform in order to meet each others constraints. Hence,
the human operators are the active agents manipulating the air- and
ground-based automation tools.

In a future data link environment, ground-based and airborne automation
can directly exchange large amounts of information. In a mixed data
link/voice environment, two independent channels can be utilized for
data exchange. Depending on the extent to which voice is used, the
machines may become the active agents and the human operators fulfill a
passive monitoring role. Apparently, the transition of human operators
from being an actively controlling agent to becoming a reactive monitor
causes problems if too many automatic functions are hidden from the
operators. The following principles shall contribute to avoiding this
kind of feedback and interaction problem.

DATA EXCHANGE PRINCIPLES

The goal of automating functions in general is to let human operators
perform tasks that would otherwise be more difficult or impossible to
accomplish. Automatic functions should complement human capabilities.
Regarding communication, humans are capable of exchanging reasonable
(i.e. small in most cases) amounts of information in a known
phraseology. If operators make changes immediately after receiving this
kind of information, they are usually aware of what they have done and
maintain the necessary 'short-term situation awareness' on a tactical
level.

Machines are very good at exchanging and storing large amounts of
information and executing given instructions very precisely. They can
perform tasks on a strategic level and complement the human shortcomings
in this area.

The parallel architecture as described in the mixed data link/voice
environment in the center of figure 2 is the configuration which
accounts best for this distribution of tasks. However, the humans do not
have to communicate via voice, as long as only meaningful data is
exchanged between the operators in a common standard phraseology. In
certain instances data link will be the more suitable medium for
communicating modifications depending on the required transaction time
and the information contents (e.g. names vs. numbers).

We propose the following principles for data exchange in a data link
environment:

-   machines exchange descriptions of the situation (i.e. trajectories,
    performance, weather, etc.)

-   humans exchange modifications (i.e. actions to be performed to alter
    the situation)

-   humans are provided with enough independent information to verify
    the machine exchanged information

When the machines exchange information that describe the situation
comprehensively, this information can be presented to the operators so
that they can gain a complete understanding of the surrounding
situation. In this case the operators only need to talk about certain
adjustments in order to meet given constraints. The data exchange
between the machines should not involve additional operator actions, as
long as no modification is implied. However, it is important to provide
the operators with independent information enabling them to evaluate the
reasonableness of the computer-provided information and to detect errors
in the passively exchanged data (Leveson, 1997). Whenever the automatic
exchange of descriptions of the situation leads to a (significant)
modification, the humans have to be made aware of this modification in a
meaningful manner.

Thus, the overall air/ground communication can be described as follows:
The automatic systems passively exchange information and alert the
humans to significant changes in the environment. Independent cues are
provided to the humans to enable a verification of the automatically
exchanged data. Whenever necessary, the humans communicate meaningful
modifications, either by voice or by data link. The medium depends on
the particular kind of information and the required transaction time.
Examples for modifications appropriate for voice would be immediate
heading or speed corrections. Since the voice 'partyline' contributes to
providing independent information to the flight crew, some reports may
also be communicated via voice. Frequency changes or revised clearances
for future phases of flight may be more suitable for data link
communication.

The realization of this concept requires an automatic function on either
side (ground and air) that manages the interaction between the human
operators and the automatic systems in terms of data link activities.
This function is introduced in the next section as the Data Link Manager
(DLM).

MANAGING THE DATA EXCHANGE BETWEEN AIR AND GROUND AUTOMATION

The Data Link Manager (DLM) has access to the complete air/ground
situation comprising aircraft state, active and modified FMS routes,
ATC/CTAS constraints, weather, etc. It compares datalinked constraints
or state data with current states in order to recognize significant
modifications and highlight them to the operators.

A ground-based DLM can be used for assuring that FMS generated routes
are within acceptable margins of scheduling constraints and for
notifying the controllers of specific changes in the aircraft
trajectory. In addition to this task, the DLM is used in the aircraft to
make sure that the flight crew gets the appropriate feedback during the
passive data transfer and that uplinked modifications are presented
appropriately to the crew and directed to the respective system. Thus,
flight plan data that can be loaded are directed to the Flight
Management System. Figure 3 depicts an air/ground architecture including
the Data Link Manager.

![](media/image3.wmf){width="3.175in" height="4.908333333333333in"}

The DLM can be considered a crew assistant system for a restricted
problem space. The basic requirements and design considerations for this
subsystem are similar to those of more comprehensive systems like the
Cockpit Assistant System CASSY (Prevot & Onken, 1996). The DLM could be
extended towards an advisory system, e.g. to give assistance on
accepting or rejecting clearances. An activity tracking system like
GT-CATS (Callantine et al., 1997) could be connected to the DLM for
on-line operator tracking purposes in order to make sure that all
necessary actions for dealing with the air/ground interaction are
performed in a reasonable manner.

The systems which enable the functionality of the DLM are the strategic
planning and navigation devices. Thus, the ground-based DLM needs to be
connected to the scheduling and spacing tools (CTAS in this case), and
the air-based DLM needs to be connected to the Flight Management System.
Additionally, the DLM must be integrated with communication management
units providing for the low level data link communication functions
according to the selected data link type and protocol (ACARS, ADS, ATN,
etc.). Since the Data Link Manager controls the information flow between
the operators and the automated systems, its effectiveness strongly
depends on the number and quality of interface resources it can access.
Further considerations regarding the ATC interface can be taken from den
Braven (1992) and FAA (1996). The following section discusses the flight
crew interface in more detail.

FLIGHT CREW INTERFACE FOR DATA LINK MANAGEMENT

Presently, many different kinds of data link implementation on the
flight deck are being investigated or are already in use by several
research institutions, aircraft and avionics manufacturers, aviation
authorities and airlines. While the flight crew interface for Airline
Operations Control - Pilot Data Link Communication (AOCPDLC) has been
established on the Control and Display Unit CDU of the FMS, the flight
crew interface for Controller Pilot Data Link Communication (CPDLC) is
very unclear. The range of different flight crew interfaces for data
link interaction covers a large variety of cockpit systems: The
alphanumeric Control and Display Unit, interactive multi function
displays, interactive navigation displays and graphical Control and
Display Units are some of them.

Most of the interface implementations are designed for one specific task
and try to keep the data link interaction in one designated cockpit
space. Which cockpit interface is modified at what level of
sophistication basically depends on the time frame at which an
operational use is expected. Therefore, naturally the first operational
data link interface is the Control and Display Unit (CDU). Because of
its non-flight critical status, the CDU is easier to modify and certify
than other systems. Unfortunately operational experiences and empirical
studies show that this interface is hardly useful especially in other
than oceanic environments, because of the complicated interaction
provisions and the long communication transaction times. On the other
hand, the time period to wait for a sufficient development and
certification of highly sophisticated interfaces, like interactive
navigation displays, as well as the cost factor associated with
retrofitting existing aircraft would very probably delay the utilization
of data link far too long. In order to progress with the data link
integration while at the same time regarding the basic human factors
aspects, a trade-off has to be made between what is operationally
feasible and affordable and what is desirable from a human factors
standpoint.

The first step is to investigate how the operators needs for performing
the revised tasks can be met appropriately by exploiting all currently
available cockpit resources. If the basic human factors requirements can
be met with the current cockpit interfaces, reasonable resources can be
added or modified in order to provide the complete range of required
functionality.

The interface design that is being proposed in this paper and prototyped
at NASA's Ames Research Center follows these principles. One general
principle underlying this design is that all provisions for human
automation interaction are located at the most appropriate display or
input device.

![](media/image4.pct){width="356.0in" height="328.0in"}

Figure 4 shows a schematic view of the resulting interface in a typical
(Boeing 777- like) cockpit configuration. The main components of this
interface are:

-   A data link response panel in front of each pilot (already part of B
    777, to be added in other cockpits)

-   A designated datalink message display area on the center display

-   An additional 'LOAD' hardkey on both CDUs

-   An integrated presentation of modifications on the navigation
    displays (a vertical situation display has been added)

-   A page-oriented means for performing data link tasks that are only
    necessary and applicable in low workload situations. They can either
    be part of the CDU or of a multi function display.

In a data link transaction the meaningful message contents are indicated
in a designated area of the center display, which is easily accessible
for both crew members. The pilot not-flying can read the message text
loud. In addition to this the data link manager determines the basic
modifications associated with the new information and highlights them on
the navigation display. Whenever the message contains information that
is directly loadable into the Flight Management Computer, a 'LOAD'
button added to the CDU is illuminated and the pilots can load the
information into the FMC by one button press without leaving the page
they have up for the current phase of flight. This will load the
uplinked data into the modified route and the 'EXECUTE' button will
illuminate. At this point the modified route can be reviewed by the crew
and checked by the data link manager in order to make sure all ATC
constraints are met. If this is the case, the uplink can be accepted and
the flight plan can be executed.

The overall data link concept requires that each major flight plan
modification results in a downlink of the new trajectory to the ground.
Thus, when the flight plan is executed, the trajectory is transferred to
the ground and can be checked again for being within acceptable margins
of the clearance. Additionally the controller can access the active
aircraft trajectory or important parts of it at any time.

EXPERIMENTAL VALIDATION OF THE CONCEPT

Although the proposed concept is based on results of previous
experiments and line operations, there is currently no empirical support
that the proposed data exchange philosophy or the flight deck interface
fulfill the relevant requirements and contribute to the overall goal of
increasing safety and airspace capacity. Several experiments are
scheduled in the pursuit of these objectives. Currently, the flight deck
interface prototype is implemented into a part-task simulator at NASA
Ames. This flight simulator is connected to the Center TRACON Automation
System CTAS, so that the complete air/ground loop can be simulated.
Initial experiments with airline pilots are scheduled for spring this
year. Depending on the results of this study, the next simulation
experiment could involve a full mission simulation at Ames' Advanced
Concepts Flight Simulator. Furthermore, joint experiments with
simulation facilities at NASA Langley are scheduled. The experiments
will concentrate on the arrival and approach phases of flight, where
traffic advisories are generated from the CTAS components Descent
Advisor (DA) and Final Approach Spacing Tool (FAST), which are currently
operationally evaluated at the Denver and Dallas ATC facilities.

CONCLUSION

The wide variety of data link related research, development and
operations indicate that there is a need for defining a general concept
for the digital air/ground integration and a useful flight crew
interface. The concept proposed in this paper can be investigated and
realized with few modifications to the current avionics system. It is
aimed at exploiting the current aircraft automation as much as possible
by integrating the different subsystems and controlling the information
flow in a reasonable manner, thus providing the operators with the
necessary feedback and tools for performing their tasks.

ACKNOWLEDGEMENT

This work was performed while the first author held a National Research
Council-NASA Ames Research Associateship.

REFERENCES

Billings, C.E. (1996) *Human-centered aviation automation: principles
and guidelines* ,NASA TM 110381, Moffett

Field, CA

Callantine, T. J., Mitchell, C. M. and Palmer, E. A. (1997) Tracking
operator activities in complex systems: an experimental evaluation using
Boeing 757 pilots. *Proceedings of the Ninth International Symposium on
Aviation Psychology,* Columbus, OH

den Braven, W. (1992) *Design and Evaluation of an Advanced Air-Ground
Data-Link System for Air Traffic Control*.

NASA TM 103899, Moffett Field, CA

FAA (1996) *Benefits of Controller-Pilot Data Link ATC Communications in
Terminal Airspace*, Final Report DOT/FAA/CT-96/3, Atlantic City, NJ,
distr. by National Technical Information Service, Springfield, VA

Leveson N. G. (1997) Personal communication

Logsdon E. W., Infield, S. E., Lozito, S., McGann, A., Mackintosh,
M.-A., Possolo, A. (1995) Cockpit Data Link Technology and Flight Crew
Communication Procedures. *Proceedings of the Eighth International
Symposium on Aviation Psychology,* Columbus, OH

Lozito, S., McGann, A. and Corker, K. (1994)*Data Link Air Traffic
Control and Flight Deck Environments: Experiment in Flight Crew
Performance*. NASA Ames Research Center

Prevot, T. & Onken, R. (1996) *In-Flight Evaluation of CASSY: A System
Providing Intelligent On-Board Pilot Assistance*. Air Traffic Control
Quarterly, 3(3), 183 - 204

SAE (1996) *Human engineering recommendations for data link systems*,
(Revised Proposed Draft), Warrendale, PA

Sarter, N. B. and Woods, D. D. (1993*) Cognitive Engineering in
Aerospace Application: Pilot Interaction with*

*Cockpit Automation*. NASA Contractor Report 17761

[^1]: ^\*^ This work was performed while the author held a National
    Research Council-NASA Ames Research Associateship