Good morning, everyone. I am here on behalf of my fellow Board Members, Vice Chairman Chris Hart and Member Robert Sumwalt, and the 400 men and women of the NTSB, who are represented here today by Scott Dunham. It is with great pleasure that I address the 54th Annual Conference of the Air Traffic Control Association. The people in this room and the organizations you represent are absolutely vital to the current and future success of the air traffic control system, which helps move millions of people around the world every day with a remarkable record of safety that we have all come to take for granted.
It has not always been so. ATCA was founded in 1956, around the time that United Airlines flight 817 and TWA flight 2 collided above the Grand Canyon. In preparing my remarks today, I looked back at the record of aviation accidents since the 1950s. In 1956 alone, along with the Grand Canyon collision there occurred:
- A non-fatal midair collision between an air carrier DC-3 and a Cessna 170
- Two air carrier ditchings, both involving Boeing 377s, one in Puget Sound (with five fatalities) and the other in the Pacific Ocean between California and Hawaii (amazingly enough, all rescued.)
- Separation of a propeller blade that passed through the cabin of a Viscount, causing one passenger fatality and five injuries
- A failed missed approach by a DC-6, killing 15 passengers and crew
- A Martin 404 crashed on departure from Philadelphia, killing 22
- An intoxicated passenger accidentally opened the door of a DC-3 and was sucked out of the aircraft
- There were at least 6 non-fatal air carrier landing accidents that resulted in substantial damage or total loss of the aircraft
That was just one year, and not an especially unusual one for the aviation industry of the day. The Safety Board has long been interested in improving our national air traffic control system. Through our accident investigations, our recommendations have helped spur the development of new technologies. We are truly blessed that, through the development of improved flight crew procedures and training, ground proximity warning systems, anti-collision systems, more reliable aircraft and powerplants, and the evolution of ATC procedures, it is now common for some years to pass between serious air carrier accidents. I should note, however, that if you’re in the safety business and claim to be satisfied because there aren’t very many accidents, you’re probably in the wrong line of work. There is always more to do because accidents continue to occur.
You are all familiar with the recent midair collision over the Hudson River. While there has been considerable public discourse on the ATC system – understandable given that two aircraft collided in flight – the NTSB has made no determination that air traffic control was a cause or a factor in the accident. I would like to recognize our staff for issuing a number a recommendations within weeks of the accident and Administrator Babbitt for convening a task force to examine the airspace over the Hudson. It was encouraging to see quick action to address several safety issues and we look forward to reviewing the FAA’s actions once they are published and finalized.
Getting back to 1956, our predecessors at a very busy Civil Aeronautics Board investigated the Grand Canyon collision and identified, among other contributory factors, "…insufficiency of en route air traffic advisory information due to inadequacy of facilities and lack of personnel in air traffic control." That accident caused the government to rethink the national approach to maintaining safety in the skies and move on from the 1930's procedures and technology that were still being used to control aircraft in the 1950s.
In 1958, Congress responded to the need for better ATC by establishing the Federal Aviation Agency, which immediately began an unprecedented overhaul of the United States air traffic control system. The installation of terminal and en route radar equipment and associated procedures provided controllers with the ability to track the exact positions of individual aircraft instead of being dependent solely on flight progress strips and radioed position reports. During the late 1960s and early 1970s, the air traffic control system moved from using raw radar, with controllers maintaining aircraft identity by nudging plastic tags across a radar display, to automated radar operations using some of the most advanced computers and software available at the time. Over a period of 10 to 15 years, the ATC system had traveled from the Stone Age to the 1970s equivalent of Star Wars. The new software and processors greatly simplified the process of identifying and tracking aircraft. The advanced systems also made possible the airspace, terrain, and trajectory modeling needed to support safety functions such as minimum safe altitude warning and conflict alert, helping controllers to detect hazardous situations and warn pilots of potential danger.
However, that great leap forward was to be the last really transformational change in ATC for the rest of the century, and even into the 21st century. 1970s Star Wars stopped being shiny and new a long time ago. While the old equipment has been replaced with new equivalents, the basic operational principles of ATC have remained essentially unchanged. Controllers continue to be responsible for managing relatively inflexible pieces of airspace, communicating clearances and other instructions to pilots via VHF and UHF radio, and, especially in the en route centers, tracking and separating aircraft with radar systems that were first commissioned in the 1960s. Links between the ATC processors and non-FAA weather systems such as NEXRAD have enabled controllers to provide more complete information to pilots about severe weather, but there are still issues with timeliness of delivery and the ability of controllers to filter the data to match their operational needs.
In contrast, the aircraft side of aviation has experienced remarkable development and expansion. New technology is being added to the fleet all the time. The aircraft coming off the production line are a new breed, filled with innovations like electronic flight control systems, optimized power plant management, advanced composites, basic electrical and environmental engineering support systems, and navigation options such as the electronic flight bag and surface moving maps. The rapid changes in technology provide challenges, but they also hold the keys to solutions we couldn’t have imagined 40 years ago.
This brings me to the main subject of my remarks today, NextGen, the “what’s next” in America’s air traffic control system. Congress and the FAA have recognized that the ATC system is due for another leap forward comparable to that made 40 years ago. The NextGen program sets out a comprehensive collection of tasks and development programs that aim to promote capacity and operational efficiency, reduce delays, consolidate and improve the accuracy of weather services, and establish network connections between system users that enhance the sharing of information needed to manage and operate in the system. While all of this is going on, foremost in our minds is a recognition that it is necessary to continue to improve safety while air traffic continues to grow.
Many of the topics addressed in the 2009 NextGen Implementation Plan overlap with issues that NTSB staff encounters in the course of investigating accidents and incidents. I thought I would share some of those areas with you, and discuss where we would like to see improvements as NextGen replaces the existing ATC system.
Weather Detection and Avoidance
For example, let’s talk about the impact of thunderstorms or other severe weather on the system. All of us at the NTSB fly regularly, so we’re certainly aware of the effect that weather has on airline schedules and flight routes, and the potential for severe weather to cause substantial delays. As passengers, we don’t like sitting on the ground any more than anyone else does. However, from a professional standpoint, we would much rather be safely sitting on the ground than up in the air flying through thunderstorms, icing, and possibly damaging turbulence. An on-time departure is never worth risking an accident.
Therefore, when we evaluate the FAA’s approach to severe weather issues, what we’re looking for is assurance that the system will, in all cases, avoid putting aircraft and passengers at risk by placing aircraft in unsafe proximity to convective weather – even when there appear to be efficiency or capacity benefits in doing so. Our investigators have heard accounts from controllers that describe traffic management personnel refusing to close thunderstorm-impacted routes until pilots actively refuse to continue as cleared, leaving controllers to scramble for a tactical solution to what should have been handled as a strategic problem and addressed at a system level. Pilots have described being told that they either had to fly into convective weather or declare an emergency before being permitted to deviate from their clearance. NASA ASRS reports describe situations where aircraft were essentially forced into active restricted or warning areas to avoid entering thunderstorms. These “caught between a rock and a hard place” situations need to be anticipated and resolved in advance, with a readily available alternative plan to be put into use if needed to maintain safe clearance from storms and ensure an operationally acceptable way out.
The NTSB has investigated many accidents where overt or subtle pressures on flight crews have led to poor operational decision-making. The lesson we should have learned is that safety really does come first, even when it’s not the easiest or most convenient choice. As the NextGen weather service improvements come on line, we expect to see the elimination of situations where pilots and controllers are left with only bad options when trying to avoid thunderstorms.
As part of that effort, we also encourage FAA to improve both the timeliness and configurability of ATC weather displays. During investigations of weather-related accidents, controllers have frequently expressed a lack of confidence in the NEXRAD information available to them, with concerns about the delay between detection of precipitation by NEXRAD and the appearance of the information on ATC displays, and further concerns about their inability to filter the displayed weather data to match the vertical limits of their airspace. Such concerns have contributed to accidents when controllers perceived their weather data to be inaccurate and failed to communicate the information to pilots, who then entered convective activity and crashed. No aircraft is immune to the power of a thunderstorm, and such inadvertent encounters continue to result in fatalities every year. The NTSB strongly supports any activity that improves the ability of ATC and pilots to detect and avoid this serious hazard.
NextGen is expected to substantially alter the role of controllers, providing them with automated assistance in resolving airspace and traffic conflicts, advance flight planning, traffic management, and rerouting aircraft around severe weather. This seems to be a beneficial and natural evolution in the process of air traffic control: so natural, in fact, that it isn’t really a very new idea. Back in the 1970s and 1980s, the FAA and MITRE developed a concept called “Advanced En Route Air Traffic Control” that proposed very similar functions, recasting controllers as “airspace managers” that would operate at a more strategic level while shifting much of the detail of ATC such as routine communications to the automation system. Unfortunately, it became part of the ill-fated Advanced Automation System project, which was eventually and expensively canceled – although some of the ideas did make it into the current ATC repertoire. Still, the underlying notion that the role of controllers in the system could and should be focused on higher-level tasks and less on the minutia of ATC seems valid. Pilots saw similar changes in the modern cockpit many years ago, with automation taking over virtually all of the routine monitoring tasks and only alerting the crew when an abnormal situation was noted.
Our concern in this area is that assistance from automation may turn into dependence on automation, which can lead to unintended consequences in the event of a system failure. There is a natural tendency to promote automation by suggesting that it will enhance efficiency, and in ATC that efficiency increase is often based on an expectation that, with the help of automation, each controller will be able to handle more aircraft at once. Thus, the cost per operation is reduced and efficiency is increased. However, when it comes to asking "what if?" questions about unexpected automation failures, the usual response is that the controller will take over using a backup system and things will carry on as normal. The problem with this approach is that the backup system is often not as capable as the primary system, and in fact can be an even more outdated technology. Instead, the controller may suddenly be placed in charge of more aircraft than can safely be handled with the backup system’s limited assistance. .
Probably the most extreme case of this was seen in the 1970’s following the installation of the first automation systems in en route centers. The “backup system,” such as it was, was for controllers to revert to a raw radar display and identify aircraft by writing on “shrimp boats” (small clear plastic tags) with a crayon. When the computer failed, the controller had to stand up, physically wheel the 200-pound display out of the cabinetry, rotate it from a vertical to horizontal position, push it back into position, make tags for each aircraft, figure out which tag matched which smudgy green target, put the tag on the target, and keep making tags until each aircraft was accounted for. Since aircraft move rather quickly, the controller had to keep pushing the tags across the display to maintain target identity, all the while making more tags, talking to pilots, and making and taking handoffs by talking to other controllers on the phone. It was not at all uncommon for the primary system to fail and leave the controller responsible for approximately twice as many aircraft as could be safely handled using raw radar and plastic tags.
Our expectation is that as NextGen develops, the system designers will provide a backup capability that does not require unreasonable effort by controllers to compensate for equipment deficiencies. At no time should a controller be placed in the position of taking over a traffic situation that they do not fully understand, or being expected to take responsibility for more traffic than can be safely controlled using the tools available. This concern extends into operations with the primary system as well. We expect that, with the advanced functions proposed by NextGen, as well as the expected improvements in weather services, controller workload will be predicted, monitored, and constrained as necessary to ensure that safe separation is maintained between all aircraft receiving ATC services.
As I mentioned earlier, ATC automation brought with it the ability to monitor aircraft trajectories and provide controllers with advance warning that an aircraft was in danger of striking terrain or obstacles, or in danger of colliding with another aircraft. These functions have proven their value on many occasions, compensating to some extent for the human lapses that we all, even air traffic controllers, suffer from. At the same time, they have also developed a reputation for “nuisance alerts,” where controllers are alerted about terrain or traffic situations that do not actually represent a hazard. In the Minimum Safe Altitude Warning system, this can result from the limitations of the underlying terrain model being used to represent surface elevations in the vicinity of the aircraft, as well as uncertainties in the ATC software’s trajectory model for the flight. Over time, nuisance alerts result in desensitization as controllers unconsciously dismiss even valid alerts as invalid. These warning systems can also go off too late, detecting a valid hazard but not providing sufficient warning to be effective in safely resolving the problem. As part of the NextGen development process, we encourage designers to take a fresh look at warning functions to see if there are any approaches that will reduce the number of nuisance alerts and increase the likelihood that alerts are valid, as well as increasing the warning time of valid alerts to make them more reliable and effective.
To illustrate this point, I would like to show you a replay of an operational error that occurred at San Francisco Airport on May 26, 2007, involving a Republic Airlines (“Brickyard”) Embraer E170 regional jet and a SkyWest Embraer E120 turboprop. The Republic flight was cleared to depart from runway 1 left, and the SkyWest flight was cleared to land on runway 28 right. The AMASS system worked exactly as designed, providing 15 seconds of warning before the predicted conflict. If you listen closely, you can hear the system-generated voice alert to the controller in the background of his transmission to an uninvolved aircraft.
ANIMATION: Available at http://ntsb.gov/events/2007/Most-Wanted-Progress/AnimationDescription.htm, second down the page.
As you saw, even with a warning the controller was unable to intervene in time to prevent the conflict. The captain of the Republic flight, who was given no instructions regarding the conflict, saw the Skywest aircraft coming and was able to lift off early to avoid an accident. If the departing aircraft had been larger and required a longer takeoff roll, it is quite possible that this event would have resulted in fatalities. The automation simply did not provide the support that the controller needed to compensate for his mistake.
In 2000, the NTSB asked the FAA to require, at all airports with scheduled passenger service, a ground movement safety system that will prevent runway incursions; the system should provide a direct warning capability to flight crews. In addition, demonstrate through computer simulations or other means that the system will, in fact, prevent incursions. This recommendation is now 9 years old and it has been on our Most Wanted List of Safety Improvements almost since the recommendation was issued. Although the FAA has moved beyond computer simulations and has actually tested the Runway Status Lights at DFW and LAX and next at Logan, and likewise, the FAA has completed two studies of final approach runway occupancy signal or FAROS systems, which evaluated the use of flashing PAPI lights, the Safety Board is disappointed that the FAA won’t even begin deployment of any of these systems, and then only at a limited number of airports, until 2011. While the technology is promising, the deployment has simply been too slow.
Information Sharing and ADS-B
The NTSB anticipates that many of the safety benefits of NextGen will come as a result of improved information sharing and better situational awareness. Consequently, we are very supportive of the transition to ADS-B proposed by the FAA. In our response to the FAA’s notice of proposed rulemaking on the subject, we advocated both shortening the timeframe for installation of ADS-B equipment, and requiring both ADS-B In and ADS-B Out to facilitate airborne traffic awareness, safer surface operations, and provide the ability to transmit safety-related messages directly to flight crews as necessary. ADS-B has been proven effective in the FAA’s Capstone project in Alaska, and was recently approved for operational use as a means of IFR separation over the Gulf of Mexico. We would like to see ADS-B technology advance quickly, because we believe that improved surveillance and tracking provides immediate safety benefits for all aircraft during both airborne and surface operations.
The People Element
When looking at technical systems, it is easy to become focused on the hardware and lose sight of the human factors issues that are critical for operational success.
I cannot miss this opportunity to talk about fatigue since it is one of those issues that affects all of us. The Safety Board has listed fatigue in transportation on our Most Wanted List since its inception. We have investigated numerous controller-involved incidents and accidents where fatigue has been identified. Whether it is error detection or task prioritization, controllers must be vigilant to the task at hand and being well-rested is critical to performance on the job.
Ultimately, whether a technical system delivers the promised benefits depends to a great extent on how well the people involved in the operation understand how to use it. The FAA is embarking on a major program that will change the way the ATC system works from top to bottom. Even if all the technical requirements are met, and the systems are delivered as promised, and all the required functionality is present and accounted for, the true test will be what happens when real people try to work with it.
One of the things our ATC investigators frequently encounter when interviewing controllers following an accident or incident is that many controllers don’t really understand their equipment. They usually know what buttons to push to perform routine tasks, and are quite proficient at those tasks, but when asked to explain how something actually works they are often at a loss. The processing that goes on behind alerting functions such as MSAW and conflict alert is a mystery. What happens to NEXRAD data between the time the radar detects precipitation and the time it appears on the display? They often have no idea.
In today’s ATC system, just understanding what buttons to push to accomplish the basics may be enough most of the time. As automation begins to take over more ATC functions, it will be more and more critical that the controller of the future have a clear understanding of their own tasks and the tasks being performed by the computer. As cockpits became more automated, one of the most common questions between pilots transitioning from stick-and-rudder to managing the systems was, “What’s it doing now?” (Some pilots might recognize that as a common query even today.) Controllers will face the same question. Those who have been in the business for a while will have to become proficient at managing the automation and knowing “what it’s doing now,” at least so that they can recognize potential problems and intervene if necessary. Without a clear understanding of what the system is doing, the controller will no longer be in charge – they’ll just be along for the ride, and that’s no better in ATC than it is in a cockpit.
Training for the transition needs to start early and be supported by new simulation capabilities that can effectively train the new skills, including the interactions between different types of ATC facilities, traffic management functions, weather systems, and data communications functions. Getting people familiar with their new role and a whole new way of doing business is not going to be quick or inexpensive, but it will be absolutely critical in ensuring that NextGen picks up from at least the same level of safety that the old system leaves behind. We at the NTSB will be learning right alongside the controllers, managers, and designers of NextGen, and might have to take advantage of some of those simulation capabilities ourselves. There is always something new in aviation, and with all the promised improvements coming through NextGen, these are indeed exciting times. Thank you for inviting me to speak with you today, and I hope you enjoy the remainder of the conference.