cognitive system model

A Cognitive System Model for Human/Automation Dynamics in Airspace Management

Kevin Corker*, Greg Pisanich** & Marilyn Bunzo**
MS 2621 *NASA Ames Research Center Moffett Field, CA 940351000 **Sterling Software Palo Alto, CA

Introduction
The world community of aviation operations is engaged in a vast, systemwide experiment in human/system integration. This system evolution profoundly challenges human performance prediction and the cognitive sciences. Engineering systems design requires models of human performance to guide appropriate design, to evaluate the effectiveness of the system, and to assure the safe operation of the system. The performance challenge, that is represented by many concept of operation, is to link increasingly powerful and accurate data systems, sensors, and optimization systems to humans whose responsibility it is manage and act in the system. Specifically, increasingly accurate data on physical and temporal position of the assets of the ATM system are available. These include the aircraft, the crew, the cargo and the maintenance resources. More powerful and sophisticated aiding systems are being developed. The dual function of these tools is to reduce constraints when possible (providing more autonomy and thus less predictability to aircraft operations) and to provide accurate positive control in four dimensions (requiring increased system gain and constraint) in the terminal area. Our charter is to develop human performance models that predict the consequences of the interaction between these advanced automation technologies and the human component in the ATM system. These models have two purposes. First, they are to provide guidance for the design of the aiding system, to de fine the procedure s and communication protocols for their use. Second, they are to predict the performance of the human operator in the ATM system. In order to support these functions, we have developed a human/system model for advanced ATM operations that is a hybrid engineering control theoretic and cognitive performance model. Engineering models of human performance have most successfully considered the human operator as a transfer function and remnant in a continuous control. They have concentrated on the interaction of one operator and a machine system with concern for system stability, accuracy off tracking performance, information processing of displays, and ability to handle disturbances. They are intended to provide guidance in design that determines whether the information provided, and the control system through which the operator performs their functions, allows successful performance with an acceptable level of effort (Baron and Corker, 1989). These models assume a closed loop control in which the human operator observes the current state of the system, constructs a set of expectations based on his/her knowledge of the system (an internal model) modified by the most recent observation, and based on those expectations assigns a set of control gains 1

cognitive system model or weighting functions that maximize the accuracy of a command decision. In this loop the operator is also characterized as introducing observation and motor noise (effector inaccuracies) and time delay smoothed by an operator bandwidth constraint. Such a model is represented in Figure 1. In the context of air traffic management, such a representation needs to be expanded to include multiple operators in the system of control and to include the uniquely human contribution of adaptable, but potentially noisy control input. The "noise" in this view of the operator are not stationary Gaussian distributions, but errors of specific types and with potentially significant consequence. We have developed a hybrid model for multiple human operators in advanced ATM. In addition to concern for overall stability of the closed loop management of air traffic the model concerns itself with prediction of cognitive function. The specific characteristics of the human operator model are described below. In order to exercise the model we have simulated airtoair selfseparation scenarios based in a "free flight" operational concept (RTCA 1995), and addressed the question of a required time to alert in airborne and ground control. The data for the human performance parameters of the model were derived from fullmission simulation studies conducted at NASA Ames Research Center. The implications of the model's prediction are discussed in terms of system stability in airground integration.

Human Performance Model Requirements

The human operator's function in the distributed air/ground ATM system includes: visual monitoring, perception, spatial reasoning, planning, decisionmaking, communication, procedure selection and execution. The level of detail to which each of these functions need to be modeled depends upon the purpose of the prediction of the simulation model. Traditional transfer function models are adequate to the inclusion of the operator as optimal controller with lag and noise components. However, because of the monitoring and supervisory role of the operator in the advanced ATM, the specific cognitive transfer function that the human operator provides also must to be considered. Figure1. Optimal Control Model. In this model the human operator is assumed to act to observe a display of system state and to compare that display to an internal model of the system, represented as a Kalman estimator and predictor. The operator then chooses and action that will offset any observed error between current and desired system state and acts through his neuromotor processes, which include a noise and bandwidth limit, to effect the control. To that end, we have adapted and extended the functionality of the Man Machine Interactive Design and Analysis System (MIDAS) to predict the performance of multiple human operators in ATM.

cognitive system model

Figure1. Optimal Control Model. In this model the human operator is assumed to act to observe a display of system state and to compare that display to an internal model of the system, represented as a Kalman estimator and predictor. The operator then chooses and action that will offset any observed error between current and desired system state and acts through his neuromotor processes, which include a noise and bandwidth limit, to effect the control. To that end, we have adapted and extended the functionality of the Man Machine Interactive Design and Analysis System (MIDAS) to predict the performance of multiple human operators in ATM.

MIDAS Model.
In order to successfully predict human performance or to guide design in linked human/automation systems characteristics of cognitive function, both in its successful and flawed performance, must be modeled. Humans are included in (and are critical to the successful performance of) complex systems in order to exploit their adaptive and interpretative intelligence. However, the characteristic ability to deal with uncertainty, ambiguity and underdefinition predisposes the human operator in a system to certain types of errors (Reason, 1987, Reason 1990). Human performance profiles arise as a function of the dynamic interplay among the following: the task demands, the characteristics of the operator reacting to those demands, the functions of the equipment with which the operator interacts, and the operational environment, the time course of uncontrolled events Memory Representation: The role of the human operator in the ATM system places significant demands on his/her cognitive capacity, vigilance, and memory (Wickens et al., 1997). In order to capture the behaviors of the ATM practitioners we have modeled human memory structures as divided into longterm (knowledge) and working memory (shortterm store). Working memory is the store that is susceptible to interference and loss in the ongoing task context 1

cognitive system model We have implemented working memory, described by Baddeley and Hitch (1974), as composed of a central control processor (of some limited capacity), an "articulatory loop" (temporary storage of speechbased information) and a "visuospatial scratch pad" (temporary storage of spatial information). The point of transference of information from the flightdeck and ATC displays to the operators' working memory is the critical junctures in the subsequent use of the information that is exchanged. Memory structure is provided via a semantic net The interaction of procedure with memory is provided by a goal decomposition method implemented as a form of cognitive schema. A schema is "...an active organization of past reactions, or of past experiences, which must always be supposed to be operating in any welladapted organic response." (Bartlett, 1932, p. 201). The importance of schema and their influence comes from studies of various types of errors, omissions, and distortions in remembering. These are categorized as being errors that are a function of selection, interpretation, and integration. MIDAS representation of ATM operations is designed to provide potential prediction of these errors. Selection errors refer the fact that the portion of the schema that is activated limits the activation level of other memory information. Integration errors occur when pieces of one event sequence are substituted for another event sequence. Integration and interpretation errors are essentially online errors in which the operator misinterprets the incoming sensory information to fit the schema of events they expect, or in which the operator substitutes a set of information from a prior active schema (e. g., the last clearance delivery) into the current sequence. Schemas do more than "cause" errors in performance. They form the basis for structured and rapid response to a great variety of situations. Elimination of schema leads to a condition in which each situation is fundamentally new and complex knowledgebased response is required to deal with the each event (Rasmussen and Vincente 1989). This leads to different types of error on the part of the operator rather than eliminating error. Errors in the selection of activation rules or access to knowledge bases are often observed when the "skillbased" response is disrupted. In order to capture the central role of schema and internal representation we have an elaborate representation of both declarative and procedural information in the MIDAS model. In MIDAS, the internal updateable world representation (UWR) provides a structure whereby simulated operators access their own tailored or personalized information about the operational world. The structure and use of the UWR is akin to human long term memory and is one of the aspects of MIDAS unique from most humansystem modeling tools. UWR contents are defined by presimulation loading of required mission, procedural, and equipment information. Data are then updated in each operator's UWR as a function of the mediating perceptual and attentional mechanisms previously described. These mechanisms function as activation filters, allowing more or less of the stimuli in the modeled environment to enter the simulated operator's memory. A semantic network is used to organize perceptual data and knowledge in an UWR, and contains objects, called nodes, that represent concepts about the data. Relationships among nodes are expressed as links, and assigned by a user for relationships that the analyst or designer considers critical, e.g., "isdisplayedon" or "contains." The links among these nodes have strength of relatedness, and this weight governs an associated model of memory decay, which is implemented as an exponential function indexed by the time of last update or access.
1

Longterm loss would represent, for instance, a loss of skills or deep procedural memory of how to perform task. It is not considered to play a role in the scenarios under examination in this study. Attentional Control: Another capacity limit with implications for error formation and remediation in the human/automation integration task is attentional control and concurrent task performance. Distributed attention and attention switching refer to an operator's ability to perform multiple tasks simultaneously. In many cases, a second task can be added to the performance of a primary task with little or no impact to the performance of the first task. In other cases, the performance of two tasks simultaneously has a disastrous interaction. Such context and order sensitive effects require a scheduling and agenda management function that is provided in the MIDAS 4

cognitive system model model for ATM. The simulated human operator is situated in an environment where data constantly streams into the operator's physical sensors. During each simulation cycle, a perception agent computes those environment or cockpit objects imaged on the operator's retina, tagging them as in/out of peripheral and foveal fields of view, in/out of an attention field of view, and in/out of focus, relative to the fixation plane. Objects in the peripheral visual field are partially perceived and attentionally salient changes in their state are available for further processing. In order for detailed information to be fully perceived, the data of interest must be in focus, attended, and within the foveal vision for 200 ms. The perception agent also controls simulation of commanded eye movements via defined scan, search, fixate, and track modes. Differing stimuli salience are also accommodated through a model of preattention, patterned after the work of Remington, Johnston and Yantis (1992), in which specific attributes, e.g. color or flashing, are monitored to signal an attentional shift. Activity Representation Tasks or activities available to an operator are contained in that operator's UWR and generate a majority of the simulation behavior. Within MIDAS, a hierarchical representation is used (similar to, but more flexible than the MissionPhaseSegmentFunctionTask decomposition employed by many task analysis systems). Each activity contains slots for attribute values, describing, e.g., preconditions, temporal or logical execution constraints, satisfaction conditions, estimated duration, priority, and resource requirements. Resources include both physical effectors such as eyes, fingers, or hands, as well as the model of visual, auditory, cognitive, and psychomotor task loading described by Aldrich et al. (1989). A continuum of contingent or decision making behavior is also represented in MIDAS, following the skill, rule, knowledgebased distinction reported by Rasmussen (1983). Quick, skillbased, low effort responses to changes in values of information held in the UWR are captured by "daemons" when a triggering state or threshold value, sensed by perception, is reached. Daemons represent welltrained behaviors such as picking up a ringing phone or extinguishing a caution light. Classic production rulebased behavior is also available, and used when conditions in the simulation world match userdefined rule antecedent clauses active for the scenario modeled. Finally, more complex or optimizationoriented decision making is represented via a set of six prescriptive algorithms (e.g., weighted additive, elimination by aspect, etc.) as reported Payne, et al. (1988). Each of these algorithms use a different combination of attribute values, weights, and cutoff values for calculating the "goodness" of the options. Task Scheduling: Activities which have their preconditions met, temporal/logical execution constraints satisfied, and required information retrieved from memory are queued and passed to a model of operator scheduling behavior. Based on the user's selected scheduling strategy (e.g., "workload balancing" or "time minimization"), activities are executed in priority order, subject to the availability of required resources. MIDAS contains support for parallel activity execution, the interruption of ongoing activities by those of higher priority, and the resumption of interrupted activities. The specific design for this model of scheduling has been previously reported by Shankar (1991). This architecture is illustrated in Figure 2.

cognitive system model

Figure 2: MIDAS Architecture for Human Representation in Complex Systems. Each of the modules represented in this figure is a functional model of human performance. They are linked together into a closedloop simulation of operator performance. This basic structure is replicated to account for multiple crew member operations.

ATM APPLICATION IN FREE FLIGHT

Although many issues must be resolved before free flight can be fully implemented, one area that is currently under investigation is the size and shape of the warning and alert zones around the participating aircraft (see Figure 3). These zones are to be used by an alerting system to monitor and advise the flight crew on conflicting traffic flying within these areas. In a cockpitbased system, the alerting system would warn the flight crow of any aircraft entering the alert zone. The crew could evaluate the situation and choose or negotiate a preferred deviation. If the intruding aircraft continued into the smaller warning zone, the crew would be advised to take immediate evasive action.

Figure 3: Schematic of proposed Free Flight protected and Alert zones.

cognitive system model

Inner Loop A/C to AC conflict alert and resolution: t a = t(1)+ (t(2) + t(3) Middie Loop Controller to A/C conflict resolution: tc = t(4) + t(5) Outer Loop Controller to Controller Coordination: TC = tc + t(6) + tp) System Stability is compromised if TC or t c < t a Delays t(3), t(5), t(7) represent fullloop communication delays Human automation loop delays t(1), t(2) t(4), t(6) are represented as serial in this formulation that could also be considered as occurring independently and parallel. The dependent serial relation is the most conservative in terms of loop closure times. Figure 4: In the operational concept illustrated, there are two loops of alert and advisory information. The normal operational mode has the controller interacting with a conflict detection and resolution tool and providing positive guidance to and aircraft to initiate an avoidance maneuver, illustrated in the middle loop control. The optimal time to alert is a function that depends on the trade between conflict uncertainty and maneuver cost (Paeilli and Erzberger, 1997). It can be estimated to be on the order of 18 to 20 minutes to the point of closest approach of the aircraft. In some cases, there is the potential for the conflict to occur across adjacent sector boundaries. In this case an outer loop of communication among controllers is illustrated. The system also contains the inner loop of aircraft toaircraft alerting that is the focus of our simulation study. Full mission simulation data suggest that the time to initiate maneuver at strategic alerts be on the order of 7 minutes. A concern in this double loop is the convergence of inner and outer loop control time. The inner and outer loop alerting structure of air traffic management has many implications that need to be investigated to assure adequate design. First, there are control and stability Factors implicit in the design. As the inner loop response time approaches that of the outer loop stability may be compromised in that controllers may be solving a problem the nature of which has already been changed by pilot action. Second, information exchange and information presentation for both air and ground must be designed to complement as opposed to compete with each other. Third, the level of individual and shared awareness in trajectory modification and flight conformance needs to be defined. Fourth, the level of required awareness and performance impact of mixed fleet operations and failedmode recovery must be explored. Expanding the optimal control model in Figure one to account for multiple operators interacting with multiple aiding systems is illustrated in Figure 4.

Airborne Alerting
Much discussion and debate has gone into the further definition of the warning and alert zones, including their description as complex surfaces that take in account the speed, performance, and turning radius of the aircraft. Lacking up this point, however, was any discussion of human performance on the size and shape of these areas. Figure 5 proposes a redefinition of these zones based on a humanmachine system performance. Built 7

cognitive system model upon the well defined physical aerodynamic response of the aircraft are the more varying machine (sensing, communication, computation) and human (perception, communication, decision, action) responses to any alert. These zones might also differ depending on the speed of the aircraft, configuration of the conflict and the procedures used to process the conflict.

Figure 5: Alert and Protected Zones calibrated to human performance parameters, aircraft performance parameters, and communication systems parameters.

Methodology
The goal of this study was to develop a better understanding of the size and shape of the alert zones if the combination of human and machine system performance was taken into consideration. This might be accomplished by first analyzing and modeling the cognitive and procedural requirements of several candidate encounter scenarios. These models could then be populated with performance data derived from human in the loop experiments. The specified scenarios could be represented within a computational modeling and simulation system. The modeling system used in this study is MIDAS (ManMachine Interaction Design and Analysis System) (Corker & Smith, 1993). Using Monte Carlo simulation techniques, each scenario could be exercised many times, eventually establishing a statistical distribution for the humanmachine performance of that configuration. By combining this with the aerodynamic performance of the system (in this case, the closing speed of conflicting aircraft at differing encounter angles) the differences in warning requirements between the different scenarios should emerge. All encounters were assumed to be twoship interactions. Procedural Assumptions Several operational and procedural assumptions were made in the design of these scenarios about the future AATT environment. The first assumption was that some type of detection and alerting system would be installed in the AATTequipped aircraft. This system would give aural alerts along with some graphical display of the aircraft and its relationship to any conflicting aircraft. The flight crew would have to use the display to resolve the conflict: no automatic resolution would be provided.

cognitive system model Second, all communications (when possible) should be performed using datalink transmission. The CDU (Control Display Unit) would be used as the interface to enter this information. To support air to air communications (flight deck to flight deck), additional CDU functionality along with a message format would be provided (These are described later in this document). The third assumption was that any adjustments to the aircraft's vector (heading, speed, or altitude) would be implemented using FMS commands (via the CDU). Although these changes could just as easily be implemented using the Mode Control Panel (MCP), entering the information via the CDU could be used by an advanced system to communicate or verify flight crew intent. The fourth assumption was that the flight crows would not make any changes to the aircraft's vector (heading, speed, or altitude) until they understood the intent of the other flight crow and they were also certain that the other flight crew understood theirs. The scenarios are illustrated in Figure 6.

Scenario 1: Single equipped A/C can resolve conflict independently.

Scenario 2: Two equipped A/C must communicate to resolve conflict.

Scenario 3: Equipped A/C must communicate through ATC to resolve conflict.

Figure 6. Candidate AATT encounter scenarios Scenario 1. In this scenario, both aircraft are equipped with some type of AATT detection equipment (Figure 3, top left). Here a single aircraft can detect and avoid the conflicting aircraft by acting on its own (no communications are necessary). This might describe a situation where one aircraft is slowly closing on another from behind. Scenario 2. Both aircraft are again AATT equipped (Figure 3, top right). However, because of the geometry of the encounter and conflicting goals, both aircraft must be involved and negotiate to resolve the problem. The solution would be arrived at though communication and negotiation between the two flight crews. Scenario 3. This scenario describes an encounter where communications with ATC are required to resolve the problem (Figure 3, bottom left). This is necessary because one aircraft is equipped with the AATT suite of 9

cognitive system model equipment, while the other is not. Such encounters might be common early in the implementation of Force Flight or when encountering older, nonupgraded aircraft.

Model Development

High Level Activity Definition An initial cognitive and physical task analysis was performed for each of the three scenario cases. The result was a sequential model identifying the high level processes (or activities) performed the operators. In scenario two and three, the activities that were be performed in parallel by the other flight crew and ATC were also defined. Falling out of this analysis was a recognizable cycle of Alert, Recognition, Communication, Decision, Communication, & Action by the crews that is replicated throughout the scenarios for each flight crew interaction Lower Level Activity Specification Using these sequences as a guide, the lower, or leaf level, activities (corresponding to the physical or cognitive tasks actually performed by the operators) were defined for each high level task. Columns 2 and 3 of Figure 7 show the high and leaf level activities defined for Scenario 1. The remaining columns show the interrupt recovery, duration, and VACM specifications assigned to those activities. Where possible, the activities where chosen to correspond to research that had performed in previous studies (Corker & Pisanich 1995). This provided access to fully defined activity specifications. New activities, along with their specifications were developed by interpolating prior results. Case 1: Instrumented A/C can resolve conflict through its own actions.

10

cognitive system model Figure 7. Procedural Specification for Scenario I Activities. The MIDAS model can contain activities that may interrupt the flight crew from the normal activities (for example, a question in the cockpit may interrupt a flight crew member from a CDU entry task). The interrupt resumption specifications define how an activity is resumed after being suspended. Resumption methods are individually defined based on the characteristics of the activity and the sequence in which it operates. As shown in figure 7, the resumption methods used on this simulation include: notinterruptable (cannot be interrupted); resume (resume activity where interrupted), and restart (restart the activity from its beginning). Interruptions and the way that an activity is resumed directly effect the duration of the activity sequence. More on interruption methods can be found in Corker & Pisanich (1995). Column 5 in Figure 7 shows the activity duration for each of the leaf level nodes. The four values in each row specify a stochastic distribution for the duration of that activity, defined in milliseconds (2300 is read as 2.3 seconds). These four values, in order, describe the average, standard deviation, minimum, and maximum duration for that activity. This information is used in the Monte Carlo simulation to generate activity times that can exist within those distributions. These distributions are based on the performance observed in previous full mission simulations. Air to Air Datalink Activity Definition One of the assumptions made was that the flight crews would have to communicate their intention back and forth via a datalink interface (used in scenarios two and three). The duration for this activity was developed by projecting how flight crew interactions with an enhanced datalink interface might occur. The standard CDU interface was enhanced to support this task. As the goal of this project was the evaluation of the alert areas, the modifications proposed were kept to a minimum. The changes included: the addition of a function button to choose air to air (rather than ATC), an air to air page that would show which aircraft could be contacted via datalink, and a mechanism for that page which would allow a datalink message to be entered and forwarded to a selected aircraft. The composition of the air to air messages were also designed. Simple, fill word messages were provided as ATC commands. The duration for the individual button presses required to enter those messages were extracted from previous simulation data. Interrupt levels As described earlier, interrupt activities can be described as those activities that require the flight crew to turn their attention away from their normal stream of activities. Typical flight deck interrupts, along with their frequency, duration, and interrupt level (relative importance of the interrupt, both against other interrupts or other activities) were defined in previous work for the top of descent phase of flight (Corker & Pisanich, 95). Using this as a base, those interrupts that would not be expected to occur in a Free Flight environment were excluded from these runs. An assumption also was made that those interrupts remaining would occur at a frequency that was 25% less at cruise than near top of descent. An initial attempt to de fine high and low interrupt levels for this environment was evaluated, but not implemented. Experiment Runs After specification and testing, each scenario was loaded into AirMIDAS and fifty Monte Carlo runs were gathered for that simulation. The data recorded for each run included the activity sequence along with the individual activities and their duration for that sequence (including any interrupt activities). This data was written to a file for analysis in Microsoft EXCEL format. This data was postprocessed using the rules described earlier to extract a proper time for the parallel activity sets. This allowed the establishment of a total duration (time required for all operators to complete their tasks) for each scenario run. This was the dependent variable in this study. 11

cognitive system model

Results
A standard set of descriptive statistics was generated for each scenario based on the set of fifty Monte Carlo runs, which are shown in Table 1. The temporal performance data were also plotted as a histogram using a bin size of ten seconds, illustrated in Figure 9. Human Performance for 3AATT Scenarios

Figure 9. Flight Crew Time to Respond and Maneuver as a Function of Scenario.

Table 1. Response Times for an AirtoAir Encounter at 90 Degree Intercept The performance observed in each scenario above was applied to a 90 degree crossing conflict. In this geometry, the initial traffic alert was proposed to be signaled at 40 miles from the crossing point and assumed a typical commercial aircraft cruise speed (mach .82). The measure in this case was the closing distance (straightline distance between the aircraft). The minimum, maximum, and average humanmachine performance times are illustrated in Table 1. This calculation also allowed the determination of a closing distance for each performance time (potentially from 56 down to 0 miles). Using this geometry, an idea of the initial warning distance could be inferred using the worst case performance criteria. Although the average clearing distances in scenarios 1 and 3 differ significantly, given a warning at 40 miles the worst case time in both scenarios would allow an avoidance maneuver to begin well before the aircraft were 20 miles from each other. This is well beyond the 5 mile warning zone proposed earlier. In scenario 3 however, the worst and even average clearing distances observed would indicate that the 12

cognitive system model alert point for that type of interaction should be initiated well beyond 40 miles. Although these results shed light on the issue, the 90 degree encounter angle actually minimizes the relative speed problem. Shallower encounter angles can generate much higher relative speeds (and therefore reduce the amount of time available to complete the activities). Given the simulated human performance and differing encounter angles, the flight crews may or may not be able to complete the activity when alerted at a fixed distance. To further investigate this idea, a second application of the human performance data was performed. This time the goal was to determine, for each scenario and encounter angle, how much alerting distance would require to provide at least a 5 mile warning zone around the aircraft. In other words, for each scenario, when should the initial alert be made so that the flight crew could begin to move away from each other before entering the 5 mile warning zone? Calculations were again made with both aircraft maintaining a speed of mach .82. For each 15 degree angle around the aircraft, the resulting closing speed was calculated. Combining that speed and the performance distribution of each scenario resulted in a distance traveled for that angle. In this case, two standard deviations above and below the average were used as the minimum and maximum points respectively. Five miles were added to these distances to account for the warning zone. When plotted, these points create the heart shaped rosettes shown in Figure 10.

Figure 10. Carded Shaped Minimum Average and Maximum Response Distances as a Function of Encounter Geometry. In addition to showing the difference in warning distance needed to maintain the same performance at differing closing angles, these plots are also interesting because they also illustrate a difference in performance area (size of the area between minimum and maximum performance) between the three scenarios. Given the performance observed, the higher closing speeds actually exacerbate the differences between the scenarios. Although Scenarios 1 and 3 looked comparable in the 90 degree closure shown earlier, at shallower angles Scenario 3 actually requires a significantly earlier warning point to maintain the 5 mile alert zone. Conclusion

13

cognitive system model In this and in a previously validated study (Corker and Pisanich, 1996), the MIDAS model of human performance has provided data that are predictive of human performance. This model's data can be used to examine procedures implied by alternative operational concepts for advanced air traffic management. The inclusion of human performance as an active element in the system design suggests that alert system integration among air and ground elements is a primary concern. System stability must be assured by adequate between alert systems and by adequate information exchange among all participants in control. These conclusions have led us to design a program of research focused on: The shift in roles between air traffic service providers and flightcrew. The level of automation required to provide safe and stable control in such a dynamic environment. The information requirements of the flight crew and the ATC to allow then to control via that automated aiding, and The impact of the aiding systems on the awareness of airspace and of vehicular control.

The model's predictions will be tested in these experiments. Model design guidance will be elaborated and applied the coordinated operation of multiple control systems.

REFERENCES
T.B. Aldrich, S.M. Szabo, & C.R. Bierbaum. "The Development and Application of Models to Predict Operator Workload During System Design". G. MacMillan. D. Beevis. E. Salas. M. Strub. R. Sutton & L. Van Breda (Eds.). Applications of Human Performance Models to System Design. (pp. 6580). New York: Plenum Press, 1989. Baddeley, A. D. and Hitch, G. J. (1974). Working Memory. In G. Bower, ed. Advances in Learning and Motivation. Vol. 8, New York: Academic Press, pp. 4790. Bartlett, F.C. (1932). Remembering. Cambridge University Press, London. Baron, S. and Corker, K. (1989). EngineeringBased Approaches to Human Performance Modeling. in Applications of Human Performance Models to System Design. Grant McMillan etl. (eds.) Plenum Publishing. Corker, K. M., & Pisanich, G. M. (1995). Analysis and modeling of flight crew performance in automated air traffic management systems. Presented at: 6th IFAC/IFIP/IFORS/IEA Symposium: Analysis, Design, and Evaluation of ManMachine Systems. Boston MA. Corker, K.M., & Smith, B. (1993). An architecture and model for cognitive engineering simulation analysis: Application to advanced aviation analysis. Presented at AIAA Conference on Computing in Aerospace, San Diego, CA. Payne, J. W., Bettman, J. R., and E.J. Johnson (1988)., "Adaptive Strategy in Decision Making. " Journal of Experimental Psychology: Learning. Memory and Cognition, 14, No. 3, pp. 534552, 1988 Paeilli, R. A. and Erzberger, H. (1997). Conflict probability estimation for free flight. Journal of Guidance. Control and Dynamics. 20(3, 588596. Rasmussen, J (1983). "Skills, Rules, and Knowledge; Signals, Signs and Symbols, and Other Distinctions in Human Performance Models." IEEE Transactions on Systems. Man. and Cybernetics, Vol. SMC13, No. 3, 14

cognitive system model pp. 257266, 1983 Rassumussen, J. and Vincente, K. (1989). Coping with human error through system design: implications for ecological interface design. International Journal of ManMachine Studies. 31. pp. 517534. Reason, J. T. (1987). The Chernobyl errors. Bulletin of the British Psychological Society. 40, 201206. Remington, R.W., Johnston, J.C., and S. Yantis. (1992). "Involuntary Attentional Capture by Abrupt Onsets." Perception & Psychophysics, 51 (3), pp. 279290. Reason, l. T. (1990). Human Error. Cambridge University Press, Cambridge U.K., 1990. RTCA. (1995). Final Report of the RTCA Board of Director's Select Committee on Free Flight. RTCA Inc. Washington, D.C. Shankar, R (1991). "ZScheduler: Integrating Theories of Scheduling Behavior into a Computational Model." Proceedings of the EKE Conference on Systems. Man and Cybernetics, pp. 12191223. Wickens, C., Mavor, A. and McGee, J. (1997). Flight to the Future: Human Factors in Air Traffic Control. National Academy Press. Washington, D.C.

15