EUROCONTROL Innovative ATM Research Workshop and Exhibition 2008

- 77 -

A Socio-Cognitive Descriptive Modeling Approach to Represent Authority Distribution in ATM S. Straussberger, J.-Y. Lantes, G. Muller, A. Boumaza, F. Charpillet, & F. Salis

Abstract—The development of future ATM requires methods to model functional and organizational principles of experienceand operator-based scenarios in a multi-agent context. A sociocognitive representation is proposed to support preliminary analytical evaluations of system-wide impacts of technological or procedural changes considering authority distribution. The method is illustrated with examples from ASAS Sequencing & Merging procedures. Preceding human-in-the-loop simulations, this approach facilitates the definition of relevant scenariosequences to be subject of detailed experimental investigation. As part of an iterative process, it supports the elicitation of emerging functions and can be used as a communication support in an interdisciplinary R&D team. Index Terms— authority, modeling, socio-cognitive, roles I.

INTRODUCTION

A. ATM moving forward: Specific demands of the domain

A

TM is a fast evolving domain due to ongoing and forecasted air traffic increases [1]. For the regulation of airspace activities, two main objectives can be stated. Preventing collision is expressed in "ensuring adequate separation" between aircraft. To allow as many aircraft as possible achieving their intended journey is expressed in "Allow aircraft to take off at desired time, and to land at desired place and intended time". Additional services to airmen comprise aeronautical or weather data, and assistance in certain circumstances of emergency. Beyond these services, ATM implicitly maintains an essential link between the air and the ground to break the isolation of aircraft from ground. Currently, ATM mostly relies on the following main technological items: - VHF radio supports the exchanges between the Air Traffic COntroller (ATCO) and the pilot; - Telephone allows contacts between ATCOs and neighboring sectors; Manuscript received August, 2008. This work was supported in part by the DGAC under Convention n°: 06.2.93.0583. Sonja Straussberger and Jean-Yves Lantes are with Eurisco International, 23 Edouard Belin, 31400 Toulouse, France (phone: 0033562173825; fax: 0033562173825; e-mail: [email protected]). G. Muller, A. Boumaza & F. Charpillet are with LORIA – MaIA, Campus Scientifique, B.P. 239, F-54506 Vandoeuvre-les-Nancy. France (e-mail: [email protected]). F. Salis is with Dassault Aviation, Direction Générale Technique, 78, quai Marcel Dassault, Cedex 300, F-92552 St-Cloud Cedex. (e-mail: [email protected]).

- The RADAR displays an upside-view of the traffic to the ground. Additional functions allow filtering the relevant echoes for the sector, identifying the aircraft, and displaying its actual flight level and speed for controllers. However, technological support is not limited to these main items. Various tools aim at assisting the ATCO, such as Arrival Managers (AMAN) to support approach control (e.g. MAESTRO in French centers), or Short-Term Conflict Alert (STCA) belonging to a safety net. As part of the ATM, the airspace is divided into local areas and split into layers. Terminal areas ensure regulation to and from airports. This division into sectors supports the distribution of workload among controllers. For most of the sectors, a pair of controllers is in charge of the management: - The executive controller (EC) is in charge of the management of the traffic inside the sector; - The planning controller (PC) represents the interface with the neighboring sectors, in order to ensure the smooth transition of aircraft between sectors. At this stage, the agents who may act upon the environment to change it are only the ATCOs. The controller’s job requires very high and specific skills that are subject of an intense sector-specific training. The requirements for such skills can be found in the way air traffic is structured. Ensuring separation can be done in two ways: - Proactively, where it is decided from the beginning to alter recursively many trajectories, where separation is ensured, according to a pre-defined policy. This is flow management. - Reactively, where the analysis of trajectories of two or more aircraft shows that they may be, at a given point and at a given time, in unacceptable proximity. So ATM decides to alter one or more of these trajectories to prevent this particular occurrence. This is conflict management. Both of them require anticipation, because first the aircraft trajectories are not likely to be altered instantaneously, due to communication time and aircraft performances. Second, because any alteration should be consistent with the current and future layout of the traffic. Hence, it is to be said that the ATCO’s work is based on a complex mental picture. However, managing the trajectories does not do it all: a close monitoring of the execution by the aircraft is necessary. Performances of the aircraft versus the actual distances of separation make it also possible to turn the steady arrangement into a highly hazardous and unstable situation within seconds. From this preliminary description, it is pointed out that ground agents have the authority, which is the power to act [2]

- 78 -

independently and to make and supervise decisions over the aircraft trajectories in controlled airspaces. Further more, this authority is mandated by regulation. Still, aircrew has the ultimate control of this trajectory and the responsibility of the safety of the flight, which includes collision avoidance. This is a first practical instance of dynamic sharing of authority between ATCO and crew. The dramatic accident of Ueberlingen illustrates that authority sharing should be given thorough review [3]. To complete this description, a fundamental difference of perspectives between ground and board shall be noticed that may effect the cooperation [4]: - Ground is committed to manage safety and make arrangements towards overall best individual satisfaction achievable. ATCOs think in terms of the global system within the sector under control. - Board, despite placing a high trust in control, has strong individual goals, and the crew may wish to support against the constraints imposed by the system. The constant increase of traffic would make this organization obsolete. Some of the technical bottlenecks identified in the European SESAR program are [5]: - Human performance; - Radio communication; - Critical sector size, under which efficiency decreases. For these reasons, research and development fosters technologies that may alleviate the ATCO workload as well as communication. Regarding communication, data-link features shall provide clear, necessary and sufficient data to the concerned stakeholders. Nevertheless, the loss of direct human contact would impact the quality of the exchanges [6], e.g. it will possibly induce loss of implicit but essential parts of information. A simplified view would describe the alleviation of the ATCO's workload along three axes: - Delegation of separation management to board. The Airborne Separation Assurance System (ASAS) offers the whole range of possible delegations, from the trajectory elaborated on ground and displayed on board (requiring no more monitoring by ATCO) to autonomous separation (Free flight concept). - Ground assistance tools, to detect conflict and/or to propose de-conflicted solutions. - Secured trajectory knowledge, by contracts on 4dimensionsal (4D) trajectories. This induces the following changes. ATCOs will no longer handle all cognitive functions linked to traffic management and thus no longer be a single point of "cognition" ensuring the stability, flexibility and consistency required for a good regulation of the workload. Aircrew will have to take in charge a completely new task, being a human factors challenge in itself. The number of agents, which can be currently considered [7], will dramatically increase, as will the number of possible modes. This will give a new dimension of the “Who Does What. And When” to ATM. The “When” illustrates the dynamics of authority in this oncoming multi-

EUROCONTROL Innovative ATM Research Workshop and Exhibition 2008

agent system. The issue is both the dynamic variations of distributions, and the dynamic changes in the structure of a given authority, that introduces the notion of authority sharing. To represent authority we need to consider both the organizational and the functional level of representation, as in a legal sense, authority is linked with responsibility assigned to an agent, and in an operational sense, authority is linked with the power to act in a certain context. The impact on ATCOs’ and crews’ cognitive functions will require a certain process of combining analytical pre-study methods with human-in-the-loop (HITL) simulations throughout the development process. New forms of cognitive functions will emerge with changing tasks and authorities. Today, the latter is allocated to ground for separation and to air for collision avoidance. But the subject is quite complex, and the risk is high to spend a lot of time and money only to foster issues, if these simulations are not well targeted. It is necessary to have a method to elicit and validate the most relevant scenarios for these simulations. Hence, it appears valuable to develop a socio-cognitive model of the future ATM, covering both the organizational and functional facets. This model will allow a precise understanding of the system, and especially of the dynamic aspect of authority sharing. It will support initial reviews of the scenario, as prepared by the functional analysis and completed by end users’ experience. These pre-evaluations would validate the scenario, and set the accurate human factors features to be observed with the associated metrics in simulation. The socio-cognitive model will be the corner stone of the iterative process between scenarios and simulations. As part of the feedback, it will provide a deciphering mean to the simulation results, and then foster new issues of scenarios if necessary. B. Socio-cognitive models beyond the tradition of modeling ATM Modeling is a frequently used method in ATM research and development. As a simplified representation of a system or an entity [8], a model is used for various purposes: to describe processes or structures in a systematic and standardized way, to predict the output, to prescribe how processes or structures should be, to represent meaning or significance and explain factors not immediately obvious, or to identify or diagnose certain conditions. Whereas the process of modeling is characterized as the process of implementing a model, simulation manipulates such a model through running it over time [9]. Numerous modeling methods have been used in different contexts of ATM supporting real-time and fasttime simulations with and without human-in-the-loops. In relation to human performance, cognitive representations should be mentioned to describe or predict the interaction with technologies [10]-[11]-[12]. Roles and cognitive functions were specifically addressed in the Operator Function Model [13]-[14]. Distributed cognition between agents was described in the cockpit [15] as well as in air traffic control [16]. On a work system level, Vicente [17] proposed modeling methods covering organizational and functional aspects on various

EUROCONTROL Innovative ATM Research Workshop and Exhibition 2008

levels. Sierhuis et al. [18] integrated individual problemsolving behavior with organizational work practices to analyze emerging system behavior. In addition, understanding the behavior of ATM components including the effect of technologies is applied to test capacities or the effects of operational concepts [19]. Socio-cognitive modeling describes systems in terms of cognitions and social behaviors and thus links organizations, technologies, individuals, and context in terms of structures and functions [20]. Adopting a multi-agent concept, modeling can be performed according to three paradigms: agentoriented, emergent or organizational approaches. Agent oriented approaches concentrate on the individual agents and propose formalisms and specifications of their behaviors using different tools [21]-[22]-[23]. The Belief-Desire-Intention (BDI) architecture is one of the most prominent agent-oriented architectures. Emergent approaches distinguish two levels, a micro-level in which agents interact and a macro-level in which the desired global phenomenon is produced. This global phenomenon could be an organization, the realization of a task, or the solution to a given problem [24]. Finally, organizational approaches address the interaction between agents through the notion of roles as well as relationships between roles and groups in order to specify either statically [25]-[26]-[27] or more dynamically [28] the interaction network. More specifically, functional modeling addresses the description of objects such as actors or tools, objectives, and relevant context to transfer inputs into outputs. The concept of cognitive functions [29] was introduced to describe how functions transform prescribed tasks in observable activities based on underlying resources. To build a socio-cognitive model, the integration of operator experience is essential. As a means of communication, scenarios are required to make emerge processes and structures of technological systems introduced in future ATM. Scenarios are not only submitted to tests in simulations, but can be used to support the definition of recommendations for the design process at an early development stage [30]. Combing air and ground perspectives, such a scenario-based modeling approach enables: - The integration of operational experts’ experience; - The communication between different stakeholders at various stages of the design process (e.g. operators, engineers, HF experts); - The demonstration of the impact of selected design solutions of scenarios; - The representation of scenarios iteratively defined; - The support of the scenario analysis before and after HITL simulations. II. THE MODEL DEVELOPMENT PROCESS To develop such a form of representation, a common database is used for the definition of both the organizational and functional model. Its underlying database is formed throughout the development of scenarios with operational experts from air and ground [31] and contains declarative and

- 79 -

procedural components. Declarative elements comprise human and machine agents, roles, and resources. Procedural elements put these elements in action by adding time and context. These elements are consequently processed to describe the organizational and functional perspective. To demonstrate the principles of the socio-cognitive modeling, a short scenario sequence has been implemented to show which kind of output can be achieved comparing different types of scenario variations. The type of sequence is characterized by the air- and groundside context of an European enroute and approach sector with scenarios illustrating the separation activities today compared to the activities related to the implementation of Sequencing and Merging (S&M) in the Airborne Separation Assistance System (ASAS) [32]. Part of this application is to delegate separation functions from ground to air, where the pilots are assigned to separate themselves from another aircraft using specific support systems. The remainder describes both the organizational and functional perspectives instantiated at the described scenario sequence and illustrates the principles of modeling. From an individual agent perspective the interaction block representation was used to characterize the cognitive functions, the related resources, as well as the interfaces involved at an individual level. The organizational perspective illustrates the implicated structures using the AGIR model [33]. The selected sequence describes the activities undertaken from both air and ground agents to execute the “follow target” procedure after entering a new sector. In this case, the ATCO delegates to the pilot to follow a defined aircraft in a defined distance. This requires air- and groundside representations of information, inputs in the ASAS system, and confirmation procedures. In addition, the air segment considers distinguished needs of business jet pilots and airline pilots. Generally, authority and responsibility are seen as properties on both levels, the roles assigned with authority as well as the functions evoking authority. To facilitate the communication between different potential users of scenarios, a preliminary version of a prototype for a support tool is available and advanced in an iterative cycle. It integrates the organizational and functional perspective and illustrates the assessment of early organizational and individual human factors metrics. III. THE ORGANISATIONAL PERSPECTIVE For the purpose of modeling ATM, we adopt an organizational point of view to specify the structure of the organization. As the target of the organizational approach is to model the relationships between the different agents, the Agent-Group-Role [33] framework is appropriate. Indeed, it focuses on these relationships more than on the internal world of the agents. The AGIR model considers three notions: agents, groups and roles. Agents are reactive, proactive, social and autonomous entities [23] that play roles and interact within groups. Groups constitute an interaction context, which gathers a set of agents sharing the same characteristics. Roles

- 80 -

EUROCONTROL Innovative ATM Research Workshop and Exhibition 2008

are an abstract representation of a service or a function of an agent. For instance, a human agent can play the role of “executive controller” within the “controllers” group. In order to link the abstract notion of role to the concrete tasks of the ATM, we describe these tasks in terms of goal, subgoal, service, and operation. A goal is a high-level objective of the domain. A sub-goal is a low-level objective whose resolution participates in the resolution of a more general goal. A service is a high-level and non-atomic action independent of any entity. Finally, an operation is a low-level and atomic action that can be executed by a specific entity. For instance, one goal of ATM is “safety” and a sub-goal of this one is “collision avoidance”. Furthermore the transfer of an aircraft between sectors is a service and monitoring the execution of this service is an operation. A. Organizational representation in ASAS S&M scenario

Fig. 1. Goals and sub-goals of the ATM.

Figure 1 presents the goals (plain shadow boxes) and subgoals (dotted shadow boxes) of an Air Traffic Management system (ATM). It appears that ATM has two main goals: (1) to manage and optimize flow and (2) to keep airspace safe. Goals and sub-goals presented in Figure 1 are usually interrelated. They are presented separately for the sake of clarity. The flow management goal consists in making aircraft arrive at their destination with as little delay as possible. It can be divided into three sub-goals: intra-sector, inter-sector and approach. The intra-sector sub-goal corresponds to the management of the flow inside a sector. The inter-sector subgoal corresponds to the management of flow between sectors. The approach sub-goal corresponds to managing the approach phase. The safety goal consists in preventing collisions between aircraft. It can also be divided into two sub-goals: separation and collision avoidance [34], with separation ensuring a minimum distance between aircraft. Also, goals can be characterized in terms of achievement and maintenance goals [35]. Achievement goals aim at reaching a particular state of the world. Maintenance goals aim at maintaining a given state of the world. The flow management sub-goals and separation are maintenance goals, whereas collision avoidance is an achievement goal. TABLE 1: A GENTS INVOLVED IN SEPARATION

Ground Agents Air Agents Human Machine Human Machine EC STCA PF TCAS PC MTCD PNF ND RADAR FCU/AFS Specific HMI MFD/FMGS PFD

In the following we focus on the organizational modeling of the separation sub-goal. Table 1 lists the agents and Table 2 lists the roles involved in the separation organization (acronyms are defined in appendices). TABLE 2: R OLE LIST

Abbreviations IP IG IA R M FO CmI CmE CI CN SO

Role Information Provider Information Gatherer Information Analyzer Relayer Monitor Flying Operator Command Initiator Command Executer Clearance Initiator Clearance Negotiator Spacing Operator

B. Separation including sequencing and merging today Figure 2 describes the organization associated to the description of sequencing and merging in today’s system, which is effected by the ground segment. Agents are represented with circles (plain line and green for human agents; dotted line and brown for machine agents), light blue squares represent roles and ellipses represent groups and interactions. In the remainder of the paper, XX(YY) denotes agent XX playing role YY. In the same spirit as in UML sequence diagrams, the line below the circles represents the agents’ lifeline, however without any strict sequencing of interactions.

Fig. 2. Separation in today’s setting.

In order to maintain separation when a conflict arises, EC(IG) maintains its mental picture using the information provided by the RADAR(IP) and possibly by the conflicts detected by MTCD(IA) or, at a last resort, by STCA(IA). To resolve conflicts the EC(CI) issues clearances to the aircraft involved in the conflicts, which in turn should execute the clearances. On board the PNF(CN) manages the communication with the ground, while the PF(CmI) transforms the clearance into a command that the FCU/AFS(CmE) effectively executes. Monitoring on board is performed by the PF(IG) through ND(IP) and PFD(IP). On ground, the monitoring is performed by EC(M) through RADAR(IP).

EUROCONTROL Innovative ATM Research Workshop and Exhibition 2008

C. Separation with delegation of sequencing and merging The delegation of the separation in the future ASAS scenario will consist in the delegation from the ground to the air of some of the tasks needed for separation. In this case, the aircraft manages separation based on new devices on board.

- 81 -

preconditions and context patterns, and post-conditions that include a goal (normal post-conditions) and abnormal (post)conditions. The adapted form opposed in Figure 5 describes resources (internal and external), a situation pattern including agents with their general context and activity type (action/dialogue). Goals and detailed internal and external resources are added as a textual description box.

Fig. 5. Initial ([2] -upper graph) and adapted interaction blocks (lower graph).

Fig. 3. Target selection in scenario describing ASAS Sequencing & Merging.

These devices will require the pilot to select the target from which to separate. On ground airborne separation will require the EC to indicate the target to the pilot. We will begin by describing the organization related to this new task, and then we will introduce the global organization of self-separation. Figure 3 and 4 describe the organization associated with target selection. Identical parts are marked with small red dots.

The principal difference to [29] is that we considered abnormal situation and goal in the same step without distinction. We represent this exit as an evolution in terms of contextual allocated resources. The context is detailed in each phase of the scenario, for this reason it was not included in the standard characterization of interaction blocks. The representation of changes in context is considered through an element changing in the characterization of resources, e.g. the information entering from a system or from air traffic control. Activities may be internal cognitive functions, such as cognitive processes, or external observable processes, such as pushing buttons. Similarly, examples for internal resources may be cognitive structures acquired through experience (e.g. mental models of conflict situations or perceived changed in context), or external resources such as emergency procedures or alerts. Using these resource concepts, also assigned and emerging authority principles can be represented.

Fig. 4. Self-separation supported by ASAS S&M.

The EC(IG) gathers information from the RADAR(IP) and EC(CI) issues a clearance to the PNF(CN) that indicates the target aircraft to separate from and confirms the action on a specific HMI(IG). The PF therefore operates the autopilot so that it follows the target. As a consequence the PF(CmI) sends the corresponding commands to the MFD/FMGS(CmE). The MFD/FMGS(IG) manages the self-separation with the other aircraft using the information from the target’s Transponder(IP). Finally the PNF(M) monitors the execution of the maneuver trough the ND(IP) and the EC(M) monitors through the RADAR(IP). IV. THE FUNCTIONAL PERSPECTIVE The interaction block representation was considered appropriate to describe the local and cognitive level from an agent perspective. We have adapted the original interaction block representation [29], which is defined by the following attributes: an action, a situation pattern that includes triggering

Fig. 6. A group of original ([29] -left graph) and adapted interaction blocks.

In normal situations, interaction blocks are organized and processed in a tree sequence. Groups of original [29] and adapted interaction blocks are presented in Figure 6. The resulting process is linear (strategy). Abnormal situations interrupt this linear sequence to branch into other blocks. In our context of interacting air and ground segments, an adaptation of the interaction block groups was undertaken. This adaptation was necessary to illustrate the impact of HF issues at the concept design stage (not detailed in this paper) in collaboration with interdisciplinary user groups. Again, interaction blocks are organized and processed in a parallel sequence resulting in a linear process. In contrary, the parallel sequences are linked by interactions between contextual sequences of interaction blocks (Action and/or Dialogue).

- 82 -

To characterize functions in interaction blocks in a systematic way, basic generic activity models were built for the tasks of air traffic controllers and pilots with data obtained from task and activity analyses executed in this domain [36,37,38]. These activities were described on three hierarchically oriented levels that decompose tasks, activities, and cognitive functions. Comparable forms of representation were selected for both air and ground segments. As an example, Figure 7 illustrates the airside high-level activities.

EUROCONTROL Innovative ATM Research Workshop and Exhibition 2008

initiated in the context of a certain activity are detailed in the upper window on the right. The cognitive crew activity in relation to checking and the ATCO activity occurring at the same time are presented in the lower right.

Fig. 9. Interaction block representation for air and ground activity in ASAS scenario sequence.

Fig. 7. High-level airside activities.

On a second level, high-level activities were decomposed in their essential components. Monitoring is one key activity outlined in Figure 8. Main components of the monitoring process are updating mental picture, controlling, and diagnosing in case of interference. Controlling is defined as manipulating input parameters of the system to obtain a desired output. Such an activity might be related to monitoring the fuel system. An interference of the goal results in diagnosing. Finally, on the cognitive level, controlling consists of an observable action to manipulate and the cognitive process of checking. The classification used to support the characterization of cognitive low-level functions is based on the IDA-S concept [39] and considers perception, decision, action, and control functions, whereas physical action elements are categorized according to [10].

Fig. 8. Monitoring activity (Legend: (1) update mental picture (2) controlling)
decision field activity ! meta-activity).

A. Functional representation of ASAS S&M scenario A functional representation of agents and processes in the selected scenario sequence was developed using the adapted interaction block concept. The basic model was used to define the ASAS sequence in combination with interaction blocks. Figure 9 illustrates how the assigning target activity is represented in combination with an interaction block representation between air traffic controllers and aircraft. The left upper part of the sequence illustrates the section of the sector under investigation. The high-level interaction block representation is detailed in the left lower part of the window. The defined goals, resources, and details of interaction blocks

V. DISCUSSION AND CONCLUSION We presented a method to represent functional and organizational principles around authority distribution and sharing in ATM as a way to support the design and evaluation process based on operator-defined scenarios. An adapted form of the interaction block representation was used to model the relationships between agents on a local cognitive level. We defined agents, resources and their interaction in the context of a developed scenario. Based on past research results and operational experience, a basic model was implemented to define generic activities of air and ground human agents. For each step of the scenario, we defined each agent in his/her context and the resources allocated to succeed his/her task. The functional perspective serves to make explicit cognitive functions used to execute tasks by air and ground agents as well as internal and external resources required depending on the context. Different levels of abstraction are useful to illustrate scenarios to various stakeholder groups. In addition, this form of representation helps to illustrate redundant functions, a core principle of safe design. The organizational perspective facilitates showing the interacting groups of agents within a certain task and may be used to determine if all necessary roles are present in a certain context, if roles are parts of several groups, and which form of interdependence is present [2]. For example, comparing the actual organization of separation in Figure 2 with future forms in Figure 4 helps to identify structural differences. In this situation, the risk of a contradictive role assignment and potential role conflicts might be considered. However, metrics to characterize problems related to issues such as complexity, coordination, and cooperation still need to be developed. The advantage of taking a multi-agent perspective is to see not only the impact of tasks related to new technologies , but also the impact on the relation to other agents in the air or ground segment, as at the same time, ongoing tasks are represented for both segments. They may not be directly linked to each other, but be effected by specific actions

EUROCONTROL Innovative ATM Research Workshop and Exhibition 2008

undertaken in another segment. This perspective is essential, as certain processes may have a high impact on the global system. On a more general level, this method enables: • Experience integration based on operational experts’ activity descriptions in scenarios; • Facilitation of work in interdisciplinary teams during the iterative process of design and evaluation. Through implementing scenarios with this form of representation, different settings can be compared in a more systematic way before deciding on their implementation and observation in HITL simulations. Examples for problems under investigation may not only be the impact of new technologies but also of a new procedure. Following the considerations of an iterative design process, this type of modeling can be used at two stages. Preceding HITL simulations for an analytical analysis of problems (V1) based on scenarios; or subsequent to experimental HITL simulations to interpret a combined set of human and system performance data in relation to emerging cognitive functions (V2). This approach is assumed to reduce costs in the development cycle by choosing the appropriate scenario for further studies in HITL simulations. To date, frequently operational concepts are investigated and simulated without sufficiently considering agents’ activities in the context of combined air-ground segments. For example, a frequently favored argument in the context of ASAS is the reduction of controller workload. Only after detailed simulation studies [e.g., 40], remaining cognitive activities in relation to monitoring confirm a significant level of workload. Thus, early modeling of involved activities and resources considering issues such as uncertainty and experience demonstrates tendencies even before putting operators in simulated actions. Internal and external resources used in the operational field can be compared to actual resources used or missing in a simulated setting. Of course, the preliminary version of this representation cannot cover all aspects of reality. Also, it is seen complementary to other existing forms of modeling [e. g., 19]. Its objective is however to enable a first run of human factors analyses and describe a set of emerging cognitive functions. With data obtained in HITL simulations, the first version of a model can be completed to understand emerging functions. The approach is seen in an iterative context, as the model needs to be adapted for more interactive use to integrate additional data from observations in simulations. A first qualitative evaluation of this process based on the support tool prototype was undertaken with a total of four persons and resulted in suggestions concerning the representation of information and metrics. For future initiatives, the implementation of this representation in a more interactive way with accompanying validation envisaged. Such a validation, however, requires creative alternative approaches beyond a comparison with performance prediction models applied to simulation, as the method’s objective is focused on making emerge potentially critical functions by inquiry and observation.

- 83 -

VI. OUTLOOK Integrating all stakeholders, ongoing European and NorthAmerican Programs do research and development for designing the future ATM in an interdisciplinary team of HF experts, decision makers, engineers, and operational experts. Changing roles and authorities between human and machine agents are essential parts therein [7]. A pragmatic iterative socio-cognitive modeling approach is recommended to accompany the development process during design and evaluation to facilitate this work and can especially assist safety assessment within the proposed Safety Management System [41]. However, only a combination of different forms of modeling and simulation with operational expertise will result in safe and efficient future ATM. VII. ACKNOWLEDGMENTS This work is part of the research project PAUSA funded by the French Civil Aviation Authority Department. The authors wish to thank the partners and participants involved in the process of developing this method. VIII. REFERENCES [1] EUROCONTROL STATFOR (2006). EUROCONTROL LongTerm Forecast: IFR Flight Movements 2006-2025 (DAP/DIA/STATFOR Doc216). Brussels: Eurocontrol. [2] Boy, G. & Grote, G. (2005). Coordination, authority trading, and control in the context of safety-critical systems. Proc. of the 11th HCI, Las Vegas, July 22-27, 2005. CD-ROM. [3] Rome, F., Cabon, P., Favresse, A. Mollard, R., Figarol S. & Hasquenoph B. (2006). Issues of TCAS: a Simulation Study. Proc. of HCI-Aero, September, Seattle, US. [4] Farley, T. C., HanSman, R. J., Ensley, M, R., Amonlirdviman, K., & Vigeant-Langlois, L. (1998). The Effect of Shared Information on Pilot/Controller Situation Awareness and ReRoute Negotiation. Paper presented at the 2nd USA/Europe ATM Research and Development Seminar, from, 1-4 Dec. 1998, Orlando, FL, United States. [5] SESAR Consortium (2006). SESAR Definition Phase Deliverable 1 - Air Transport Framework: The Current Situation (DLM-0602-001-03-00). Available at http://www.sesar-consortium.aero/. [6] Fan, T.P. & Kuchar, J.K. (1999). Evaluation of interfaces for pilot-air traffic control data link communications. Proc. of the 18th DASC. Vol. 1/17, pp: 4.A.5-1 - 4.A.5-8. [7] SESAR Consortium (2007). Milestone Deliverable D3 – The ATM Target Concept (DLM-0612-001-02-00). Available at http://www.sesar-consortium.aero/. [8] Zeigler, B.P., Kim, T.G., & Praehofer, H. (2000). Theory of Modeling and Simulation. Orlando, FL: Academic Press. [9] Young, M.J. (2003). Human performance model validation: one size does not fit all. Summer Computer Simulation Conference (SCSC '03), Montreal, Canada. [10] Corker, K., Pisanich, G. & Bunzo, M. (1997). A cognitive system model for human/automation dynamics in airspace management. In Proc. of the First European/U.S. Symposium on Air Traffic Management. Saclay, France, June 16-19. [11] Wickens, C., McCarley, J. & Thomas, L. (2003). AttentionSituation Awareness (A-SA) Model. In D.C. Foyle, A. Goodman & B.L. Hooey (Eds.), Proc. of the 2003 Conference on Human Performance Modeling of Approach and Landing

- 84 -

[12] [13]

[14]

[15] [16]

[17]

[18]

[19]

[20]

[21]

[22] [23]

[24]

[25] [26]

[27]

[28]

EUROCONTROL Innovative ATM Research Workshop and Exhibition 2008

with Augmented Displays, (NASA/CP-2003-212267), (pp. 189225). Moffett Field, CA: NASA. Anderson, J. (1983). The Architecture of Cognition. Cambridge, MA: Harvard University Press. Anastasi, D., Klinger, D., Chrenka, J., Hutton, R., Miller, D. & Titus, P. (2000). CFM: A Software Tool to Support Cognitive Function Modeling in System Design. In: Proc. Human Perf., Situation Awareness & Automation: User-Centered Design for the New Millenium, Savannah, Georgia. Lee, J.D. & Sandquist, T.F. (2000). Augmenting the operator function model with cognitive operations: assessing the cognitive demands of technological innovation in ship navigation. IEEE Transactions on System, Man, and Cybernetics-Part A: systems and Humans, 30/3. Hutchins, E. (1995). How a cockpit remembers its speed. Cognitive Science, 19, 265-288. Fields, R.E., Wright, P.C., Marti, P., Palmonari M. (1998). Air traffic control as a distributed cognitive system: a study of external representation. Proc. of ECCE-9, August 24-28, Limerick, Ireland. Vicente, K. J. (1999). Cognitive work analysis: toward safe, productive, and healthy computer-based work. Mahwah, N.J.: Lawrence Erlbaum. Sierhuis, M., Clancey, W.J., Hoof, R.v., & Hoog, R.d.v(2000). Modeling and simulating human activity. In M. Petsch (Ed.). Autonomous Agents 2000. Workshop on Intelligent Agents for Computer Supported Cooperative Work: Technology and Risks. Barcelona, Spain. Lee, S.M., Pritchett, A.R. & Corker, K.M. (2007). Evaluating transformations of the air transportation system through agentbased modeling and simulation. Proc. of the Eurocontrol-FAA ATM Seminar. Download at www.atm-seminar.com. Sharples, M., Jeffery, N., du Boulay, J.B.H., Teather, D., Teather, B., & du Boulay, G.H. (2002). Socio-cognitive engineering: a methodology for the design of human-centred technology. European Journal of Operational Research, 136, 2, 310-323. Rao, A. (1996). AgentSpeak(L): BDI agents Speak out in a Logical Computable Language. In W. Van de Velde & J. Perram (eds.). Agents Breaking Away, numéro 1038 in LNAI, pp. 42– 55. Springer Verlag. Shoham, Y. (1993). Agent oriented programming. Artificial Intelligence, 60(1), 51–92 . Wooldrige M. (1996). Time, knowledge, and choice. In M. Wooldrige, J.P. Muller & M. Tambe (Eds.). Intelligent Agents II, numéro 1037 in LNAI (pp. 79–96). Springer Verlag, Muller J-P. (1998). Vers une méthodologie de conception de systèmes multi-agents de résolution de problèmes par émergence. Proc. of Journées francophone d’intelligence artificielle distribuée et systèmes multi-agents (JFIADSMA‘98). pp. 355-371. Hermès. Durand, B. (1996). Simulation multi-agents et épi-démiologie opérationnelle. PhD thesis, Université de Caen. Ferber, J., Gutknecht, O. & Michel, F. (2003). From Agents to Organizations: an Organizational View of MultiAgent Systems. Agent-Oriented Software Engineering (AOSE’03), LNCS 2935, Springer-Verlag. Hübner, J. F., Sichman, J. S. & Boissier, O. (2002). A Model for the Structural, Functional, and Deontic Specification of Organizations in Multiagent Systems. In Brazilian Symposium on Artificial Intelligence (SBIA’02), pp. 118–128, London, UK,. Springer-Verlag. Collinot A. , Ploix L. & Drogoul A. (1996). Application de la

méthode Cassiopée à l’organisation d’une équipe de robots. In J.P. Muller & J. Quinqueton (Eds.), IA distribuée et systèmes multi-agent. Hermès. [29] Boy, G. (1998). Cognitive function analysis. Westport, CT: Ablex, Greenwood Publishing Group. [30] Carroll, J. M. (2000). Making Use: Scenario-Based Design of Human-Computer Interactions. Cambridge: MA MIT Press. [31] Straussberger, S. & Boy, G. (2008, in press). Designing scenarios: the challenge of a multi-agent context for the investigation of authority distribution in aviation. D. de Waard, F.O. Flemisch, B. Lorenz, H. Oberheid, and K.A. Brookhuis (Eds.) (2008), Human Factors for assistance and automation (pp. 1 - 13). Maastricht, the Netherlands: Shaker Publishing. [32] Hoffmann, E., Pene, N. & Zhegal, K. (2006). Flight deck user requirements for airborne spacing (sequencing and merging) – Volume 1 (EEC-206-004). Eurocontrol Experimental Centre: Bretigny sur Orge. [33] Ferber J. (1997). AALAADIN: a meta-model for the analysis and design of organizations in multi-agent systems. Rapport technique, LIRMM, Université Montpellier II. [34] Salis F. & S. Straussberger (2007). Technical Report Task 4 – Functional Analysis. Rapport technique TR-D1.F, PAUSA Project. [35] Cohen P. & Levesque H.(1990). Intention is choice with commitment. Artificial Intelligence, (42), 213–261. [36] Dittmann A. , K W. Kallus , K W., Dittmann A. & D. Van Damme (2000). Integrated Task and Job Analysis of Air Traffic Controllers – Phase 3: Baseline Reference of Air Traffic Controller Tasks and Cognitive Processes in the ECAC Area. (HUM.ET1.1.ST01.1000-Rep-05). Brussels: Eurocontrol. [37] Kallus, K. W. Barbarino, M. & Van Damme, D. (1997). Model of the Cognitive Aspects of Air Traffic Control (HUM.ET1.ST01.1000-REP-02). Brussels: Eurocontrol. [38] Buratto, F. & Reuzeau, F. (1999). Description de la tache d’un equipage en situation normale. Internal Report. Toulouse: Aerospatiale Airbus. [39] Dearden, A. (2001). IDA-S: A Conceptual Framework for Partial Automation, in People and Computers XV - Proc. of HCI-IHM (pp. 213-228), Springer. [40] Schaefer, D. & Modin, E. (2003). A Human Factors Perspective On Free Routing And Airborne Separation Assurance In The Mediterranean Airspace. Proc. of the 5th ATM-Seminar, Budapest, Hungary. [41] Sesar-Consortium (2007). SESAR Definition Phase: ATM SAFETY REGULATION, SESAR Safety Screening & SESAR Concept, Institutions and Regulations, WP 1.6.2/D3, DLT-0612162-00-08. Available at http://www.sesar-consortium.aero/. IX. ACRONYMS AFS Auto-Flight System. CDTI Cockpit Display of Traffic Information. FCU Flight Control Unit. FMGS Flight Management and Guidance System MCDU Multi-purpose Control-Display Unit. ND Navigation Display. PFD Primary Flight Display. P(n)F Pilot (Non-)flying. TCAS Traffic Collision Avoidance System.