Increased Safety Goes Hand in Hand with Higher Cost Efficiency: Single-Controller Operation Showcasing Its Advantages

Abstract

While traffic levels are predicted to rise, nearly all European air navigation service providers suffer from staff shortages. In most cases, two air traffic controllers are deployed to control one airspace sector. Enabling the deployment of one controller per sector could be a solution to staff shortage problems. For this Single-Controller Operation (SCO) concept, a demonstrator with integrated support tools based on advanced information technology was developed. These partially automate some controller tasks to allow one controller to work off the same traffic amount as a controller team. The system was tested in a human-in-the-loop real-time simulation under varying traffic loads using a 2 × 2 within-subjects design. The variables assessed include separation minima infringements, exit flight level deviations, instantaneous self-assessment, voice communication, flight distance, and fuel burn. The results show no negative influence on safety, workload, situational awareness, operational efficiency, and environment, with 80% of maximum allowed declared capacity. Thus, SCO has the potential to mitigate staff shortages and raise cost efficiency by 40%. These results showcase the feasibility of the SCO concept under nominal conditions. Assessments with different traffic levels, non-nominal conditions, and an interdependent multi-sector SCO layout are recommended for further investigations.

1. Introduction

As air traffic grows, it is predicted that an increased capacity is required to ensure safe, orderly, and efficient operations [1]. Meanwhile, current traffic demands already partially exceed the available capacities. One main reason is a lack of air traffic controllers [2]. In current en route operations in Europe and the United States, two air traffic controllers (ATCOs) are typically deployed per sector [3]. These two ATCOs work in the roles of radar controller (also called executive controller) and planner controller (also called coordinator controller). The radar controller is in contact with the pilots issuing instructions, whereas the planner controller is responsible for coordination with adjacent sectors. Reducing staffing to one ATCO per sector, while maintaining or improving safety and efficiency, could offer a viable solution to address current staff shortages. This concept is called Single-Controller Operation (SCO). The operational feasibility of SCO requires further investigation. For this purpose, we developed a demonstrator system including six controller support tools. Furthermore, to enable SCO, the ability to enact Controller–Pilot Data Link Communication (CPDLC) with basic instructions was assumed and simulated for all aircraft with response times similar to voice communication. The system was assessed in a validation using a human-in-the-loop real-time-simulation in autumn 2023. The assessment was based on a comparison of a layout with two ATCOs to the SCO layout in two different traffic conditions. Measuring parameters for safety, ATCO situational awareness and workload, operational performance, and environmental impact were assessed to derive concept feasibility.

The validation conducted addressed two main aspects of SCO feasibility:

• Objective measurable benefits and drawbacks compared to current operations;
• Subjective acceptance from an ATCO point of view.

Influencing factors of the latter are analysed, for example, in [4]. The results from the validation at hand regarding the subjective acceptance are described in [5]. This paper focuses on the objective results of the validation. The main and the derived research questions are as follows:

Is a Single Controller able to control the same amount of traffic as an ATCO pair without negative impact on operational and human performance, safety, and environment?

(a)

Is safety impaired using SCO?

(b)

Does SCO lead to an increase in average flight distance?

(c)

Does SCO have an environmental impact?

(d)

Does the SC’s workload remain the same when using the implemented support tools?

(e)

Is the SC’s situational awareness comparable to that of an ATCO in an ATCO team?

(f)

Is the SC’s trust in the system comparable to that of an ATCO in an ATCO team?

Questions a–c are addressed in this paper, whereas questions d–f are assessed in [5], considering subjective measures only. This paper is the first to analyse the objective measurements obtained from the first human-in-the-loop simulation to validate the novel SCO concept on a demonstrator system to address these questions. In particular, this includes the evaluation of separation infringements and operational performance. Based on the results regarding the overall operational usability, a theoretical analysis of the possible cost efficiency increases caused by SCO was carried out for the first time.

This paper is structured as follows: Section 2 summarises previous and related works. This includes differentiating the terms used from those of neighbouring and similar concepts adhering to the status quo. Furthermore, metrics used in the literature to address the research questions are summarised. The validation setting and process are described in Section 3. The structure of the validation is described, including the sample description, the scenarios, and the technical system, as well as the process and the measurement methods, which are compared to those used in the literature regarding safety, situational awareness, workload, operational efficiency, and environmental impact. Section 4 presents the results, including unrelated discussions. The validation as a whole is discussed in Section 5 with regard to its strengths, weaknesses, and transferability. Finally, Section 6 presents our conclusions and next steps.

2. Related Work

Single-controller operation is also known as single-person operation [6,7]. However, this term is considered to be unsuitable by the authors for multiple reasons. First, single-person operation’s acronym, SPO, is also used in the literature for single-pilot operation (e.g., [8]). Second, it is used in the context of aerodrome control service for one single ATCO controlling multiple aerodromes remotely [9,10] (Multiple Remote Tower). Third, it is used to describe the current conditions under which an ATCO is deployed alone in a sector. This can be the case for situations where the traffic is low enough to permit it. At the same time, there must be a lack of ATCOs preventing the deployment of two ATCOs per sector [11]. In most cases, this is an unplanned and uncommon situation. For safety considerations, two air traffic controllers are always deployed wherever possible, even if the volume of traffic is low enough to allow the deployment of one air traffic controller. For example, in Lithuania, the deployment of one ATCO is conducted on a planned basis as well [7]. However, this only applies for tower (airport) and approach (departing traffic from and arriving traffic to airports) environments. Furthermore, this requires an additional expert opinion confirming the ATCO’s individual ability to work alone; otherwise, it is applied in low-traffic conditions only, as stated above. In addition, the focus of the ATCO is focused only on safety, thus neglecting the orderly and expeditious (efficient) handling of air traffic. Ilginis [7] states as well that the main drawback of an ATCO working alone is the workload being too large to handle. In particular, traffic under visual flight rules (VFRs) can contribute to the high workload. For that reason, SCO was initially foreseen as being used for upper airspace (here, FL 245 and above) only, excluding such traffic. Also, some roles and sectors are staffed with only one ATCO by default (e.g., a position in approach airspace responsible for spacing aircraft on the final approach — named a feeder in Europe). However, in most European area control centres (responsible units of en route traffic), having an executive and planner layout is prevalent [6]. The situation in the United States is similar: Depending on the traffic, one to three ATCOs are planned to handle traffic within a sector [3,12]. However, if only one ATCO is responsible, they have to manage all tasks of both roles [3]. This is typically completed in low and steady traffic conditions [13]. Nevertheless, the United States case is taken as an example for SCO as part of a possible future European air traffic control (ATC) scenario [14] (referred to as Single Sector Operation). However, neither of the above-mentioned examples cover the regular, planned use of one ATCO per sector without reducing the traffic load to half of the declared maximum and/or relieving any remaining ATCOs from some tasks, regardless of a specific sector.

The challenge that is addressed by SCO is also the topic of a wider range of research approaches: the matching of capacity and traffic demands in a highly dynamic, complex, and unpredictable environment. This leads to capacity shortcomings due to a lack of sufficiently trained ATCOs and spare capacity at other times and places [15]. The various approaches to tackle these shortcomings include the following:

• Flexibilisation of ATCO ratings—changing the process of approving ATCOs to work towards (a long-term final goal) a situation where any ATCO is allowed to work any sector [16];
• Dynamic Airspace Configuration (DAC)—changing the sector layout according to demand in real operations [17];
• Flight-centric ATC (FCA)—removing the sector layout and allowing several (more than two) ATCOs to work in one large area and follow a number of aircraft systems from entering to leaving this area [18] (partially using the term SPO as well for all ATCOs working in the sectorless area if the concrete concept foresees no planner);
• Multi-Sector Planner—one planner role responsible for several sectors and executive controllers [19];
• Roster optimisation [15].

At different stages, except for the latter, all of these approaches significantly change the current way of working, i.e., what (kind of) airspace an ATCO works with, whereas SCO maintains the sectorisation and licensing, building on already-practised procedures as described above and enabling a higher capacity per ATCO through enhanced system support, as achieved for decades in ATC [20]. The main difference is the substitution of the ATCO executive and planner roles. However, all ATCOs are familiar with both roles and their assigned tasks and are already able and allowed to perform them simultaneously in low-traffic situations, and it is envisaged that this role distribution will persist for higher-traffic situations. The less substantial change with the roster optimisation approach is currently focused on ATCO pairs only [15] and thus has limited potential to relax staffing shortages. SCO could further enhance the possible benefits. A comparison between SCO and the other mentioned approaches, including examples for current SPO, are summarised in Table 1, considering any required adaptation or limitation of the current ATC system as a potential shortcoming, at least for short-term introduction and use. The table also contains an assessment of the potential of the individual concepts with regard to solving the staff shortages.

Despite its potential benefits, the SCO concept is currently a rarely researched topic, as already depicted in [5,21,22]. The concept, as described in [21,22], foresees a stepwise approach towards a highly automated controller working position (CWP) with a single controller (SC) supported by an artificial intelligence (AI)-driven digital team partner. The HAIKU project describes a closely related new role, called an Air Traffic Manager, working together with AI (and partly with the Multi-Sector Planner) and being responsible for strategical planning, monitoring AI, and non-nominal operation, thereby taking over (remaining) tasks from the executive, planner, and even network manager [23]. However, it describes a direct transition from these roles without mentioning SCO. SCO might serve as an intermediate step, as foreseen in [21], with an SC supported by controller assistant systems tailored to SCO. This was the focus of the validation at hand.

The SCO concept foresees a higher degree of automation of these support systems, envisaged to enable a single ATCO to handle almost all of the current traffic in a sector and thus achieve higher productivity. ATC automation aims to improve ATCO team productivity [24]. At the same time, higher automation in ATC must always meet the current safety requirements, i.e., the safety level must never be allowed to drop. However, automation may unintentionally introduce safety risks [25], e.g., due to a drop in the situational awareness of the ATCO relying on the system [26]. This is crucial especially for SCO as there is no second ATCO to check for critical situations. In situations in which one ATCO is working alone, as described above, the high workload was found to be one of the reasons causing critical accidents like Überlingen [27]. In contrast to this situation and those operationally used in Europe, as described above, SCO will provide additional system support [5] (see Table 1). This is included in a demonstrator that was built using assistant tools, as described in [5,28], for the validation at hand. The demonstrator technical concept is exemplarily shown in Figure 1 for SCO support tool attention guidance (see Section 3.1). The user interface is visualised in Figure 2.

2.1. Measurements and Metrics in Air Traffic Management (ATM) Research

This section provides an overview of metrics and measurement methods used in ATM research to assess safety, situational awareness, workload, operational performance, and environmental impact; the metrics used in the validation at hand are described in Section 3.2.

Table 1. Comparison of approaches to address ATCO staff shortages.

Approach		Flexibilisation of ATCO Ratings	DAC	FCA	Multi Sector Planner	Roster Optimisation	SPO Example Unplanned	SPO Example Approach	SPO Example Lithuania	SPO in USA	SCO
Example		[16]	[17]	[18]	[19]	[15]	[11]	[29]	[7]	[3]	[22]
Shortcomings	Limitations of or Adaptations to Sector Structure	No	Constantly changing	Dissolved	No	No	No	Selected sectors/positions	Approach and tower environment	No	No
	Adaptations to Licencing Process	Yes	Not necessarily	Yes	Not necessarily	No	No	No	Additional expert opinion required	No	No
	Adaptation to Roster Process Required	Additional restrictions	Not necessarily	Yes	Yes	Yes	No	No	No	No	No
	Traffic Restrictions	Possibly	No	Not comparable	No	No	Low traffic	No	Low traffic	Low traffic	Envisaged at a high level
	Service Limitations	No	No	No	No	No	No	No	Safety assurance only	Safety assurance only	No
	Other Limitations and Issues	-	-	Long range communication	-	-	Unplanned	-	-	Responsible for both ATCO role’s task (workload)	Upper airspace (here: FL > 245)
Additional ATCO System Support		Possibly	Possibly	Conflict resolution	Non	Non	Non	Non	Non	Non	Support tools for SCO
Potential Regarding Staff Shortages		High	Medium	High	Medium	Low	Non	Non	Non	Non	High

Table 1. Comparison of approaches to address ATCO staff shortages.

Approach		Flexibilisation of ATCO Ratings	DAC	FCA	Multi Sector Planner	Roster Optimisation	SPO Example Unplanned	SPO Example Approach	SPO Example Lithuania	SPO in USA	SCO
Example		[16]	[17]	[18]	[19]	[15]	[11]	[29]	[7]	[3]	[22]
Shortcomings	Limitations of or Adaptations to Sector Structure	No	Constantly changing	Dissolved	No	No	No	Selected sectors/positions	Approach and tower environment	No	No
	Adaptations to Licencing Process	Yes	Not necessarily	Yes	Not necessarily	No	No	No	Additional expert opinion required	No	No
	Adaptation to Roster Process Required	Additional restrictions	Not necessarily	Yes	Yes	Yes	No	No	No	No	No
	Traffic Restrictions	Possibly	No	Not comparable	No	No	Low traffic	No	Low traffic	Low traffic	Envisaged at a high level
	Service Limitations	No	No	No	No	No	No	No	Safety assurance only	Safety assurance only	No
	Other Limitations and Issues	-	-	Long range communication	-	-	Unplanned	-	-	Responsible for both ATCO role’s task (workload)	Upper airspace (here: FL > 245)
Additional ATCO System Support		Possibly	Possibly	Conflict resolution	Non	Non	Non	Non	Non	Non	Support tools for SCO
Potential Regarding Staff Shortages		High	Medium	High	Medium	Low	Non	Non	Non	Non	High

Figure 1. Example for utilising assistant tools to monitor and control aircraft.

Figure 1. Example for utilising assistant tools to monitor and control aircraft.

Figure 2. SCO support tools used in the validation (flags: 1—attention guidance: coloured circled aircraft head symbols and framed aircraft labels; 2—auto-coordination: automatic acceptance of conflict-free coordination requests e.g., new exit flight level; 3—boundary arrival task manager: arrival manager like time-line ordered aircraft callsign in reference to sector exit time and inlcluing exit fligh level; 4—dynamic heatmap: gray shaded overlay map; 5—sonification: information through sound compositions; 6—trajectory generation and advisory tool: automatic proposal of new green marked conflict-free trajectories against red marked conflict area of black marked trajectories).

Figure 2. SCO support tools used in the validation (flags: 1—attention guidance: coloured circled aircraft head symbols and framed aircraft labels; 2—auto-coordination: automatic acceptance of conflict-free coordination requests e.g., new exit flight level; 3—boundary arrival task manager: arrival manager like time-line ordered aircraft callsign in reference to sector exit time and inlcluing exit fligh level; 4—dynamic heatmap: gray shaded overlay map; 5—sonification: information through sound compositions; 6—trajectory generation and advisory tool: automatic proposal of new green marked conflict-free trajectories against red marked conflict area of black marked trajectories).

2.1.1. Safety

The main objective of air traffic control (services) is to prevent collisions between aircraft [30]. To assess safety in air traffic control, a measurement of collisions between aircraft is a reasonable initial approach, especially since the tolerance of the public for risk in air transport is lower compared to other transportation domains [31]. Fortunately, the number of collisions (respecting the focus of the paper—here, mid-air collisions) is low [32,33]. In turn, the number of collisions or the probability of collisions is not the most feasible metric [34]. Although it was adopted by [35], most simulations are limited in time and number and cannot take the same approach. However, metrics related to it but with a higher frequency of occurrence are proposed by [32,36], as is the event of loss of minimum separation, e.g., as used in [37].

In general, two assessment methods are distinguished by [36]: First, the absolute method, with comparisons against a defined threshold, requiring an analytical model and containing high uncertainties. Second, the relative method with comparison against a reference that is considered to be safe, providing only qualitative results. The validation at hand was conducted and analysed using the latter.

The European Operational Concept Validation Methodology (E-OCVM) provides a comprehensive approach to validation, taking into account not only technical performance but also safety aspects. The maturity level of the concrete concept in E-OCVM informs the safety case’s objective. For less mature concepts, it serves as a basis for improvement; for more mature ones, it should provide evidence of safety. However, as of it’s last update, no compliant safety cases have been found that meet the requirements of E-OCVM for advanced concepts in research [38]. Nevertheless, E-OCVM points to methods like Traffic Organization and Perturbation AnalyZer (TOPAZ) [39,40] and approaches like Safety Assessment Made Easier (SAME), a predecessor of Single European Sky ATM Research (SESAR) Safety Reference Material [41] and Guidance to Apply SESAR Safety Reference Material [42]. TOPAZ is a complex and comprehensive mathematical human cognition/performance model used for the evaluation of accident risks in air traffic management (ATM) scenarios [39,40] and, as such, is feasible for additional comparisons to simulation results. In the SESAR Safety Reference Material, Accident Incident Models (AIMs) are used to identify where a change might impact in terms of safety, referring to an accident type. The fault tree includes precursors and barriers on various levels prior to the accident [42]. Such a model for mid-air collisions in en route (MAC-ENR) operational environments, for example, can help to identify precursors with higher frequencies than the accident itself:

• Mid-air collision;
• Near mid-air collision;
• Imminent collision;
• Imminent infringement;
• Tactical conflict (crew/aircraft-induced);
• Tactical conflict (planned).

The penultimate item coincides with the loss of minimum separation or separation infringement. If looking for separation infringements [36], for example, the following parameters should be tracked:

• Average time where two aircraft remain at distances lower than the minimum prescribed separation;
• Average number of separation infringements;
• Exposure time to separation infringement during ATCO conflict resolution process (excluding undetected separation infringements);
• Exposure time to separation infringement prior to the ATCO conflict resolution process;
• Exposure time to separation infringement without radar indications
• Number of conflict resolution processes.

This does focus rather intensely on time-related aspects. However, for separation infringements, it is also important how much the minima were undercut and if it was under the control of the ATCO or coincidental that there was no mid-air collision [43] (Severity Classification Scheme in ATM). However, the latter would be allocated to the near mid-air collision category in AIM MAC-ENR. Looking further ahead than mid-air collisions, a more frequent event to be measured to asses safety is a detected conflict within the next 2–20 min [44]. Here, a detected conflict is a calculated loss of the minimum separation unless the ATCO intervenes or is averted by variations in influencing parameters, such as wind. This is named a tactical conflict (planned) in AIM AMC-ENR. However, (the number of) calculated conflicts are highly dependent on the validated scenario.

Often, the safety assessment is at least supported, if not solely addressed, by conducting questionnaires and debriefing, e.g., [31,45].

In addition, other studies measure workload and situational awareness as important contributing factors to safety [32,46,47], which is addressed separately in this manuscript.

2.1.2. Situational Awareness

Situational awareness forms the basis of the ATCO’s decision-making process and is therefore crucial for safe and efficient operations [48]. According to Endsley [48], situational awareness includes three levels, namely the perception of elements in the environment, comprehension of their meaning in relation to one’s goals, and projection of current events into the future. Various methods exist for the assessment of situational awareness in en route ATC. Subjective measures include the situational awareness for SHAPE questionnaire, on which ATCOs retrospectively rate seven items related to situational awareness in ATC [49]. This method was also employed in the current validation and is reported in [5]. Another subjective method is observer ratings, in which an experienced person evaluates the behaviour of the ATCO to infer their situational awareness [50]. However, subjective methods are not free from bias and observers have no insights into the internal processes of ATCOs. An objective way to assess situational awareness is via questions targeting the three levels of situational awareness. These can be administered after the run or during the run as online or freeze probes [50]. Limitations of online and freeze probe techniques include their obtrusiveness to the primary task, thereby potentially interfering with task performance. Retrospective questionnaires have the drawback of ATCOs not being able to recall the relevant information. Another objective method is to infer situational awareness from performance measures. These can include response times, accuracy, or errors during the primary or a secondary task. A measure of primary task performance in the context of ATC is the adherence to separation minima (see also Section 2.1.1). Similarly, the authors from [51] suggest measuring the performance in handling handovers of aircraft to a neighbouring sector as a secondary task of ATCOs as an indication of their level of situational awareness. Delays or errors during handovers would then indicate degraded situational awareness. Such errors can be deviations from handover conditions to the next sector. Oftentimes, a specific exit flight level, i.e., XFL, needs to be reached. In the current study, XFL deviations between the actual XFL and the coordinated XFL were compared for all trials as a measure of situational awareness. Likewise, [12] established an ATCO model and running scenarios in which they removed aircraft if they enter a new sector without finalising the hand-off procedure (including correct XFL). They found significant increases in aircraft being removed in times of increased cognitive load, which goes hand in hand with less situational awareness.

2.1.3. Workload

Workload can be assessed via subjective questionnaires and psychophysical or physiological measures. A widely used standardised workload questionnaire is the NASA-TLX, which was administered after each run, as reported in [5]. The Instantaneous Self-Assessment (ISA) [52] was specifically designed for the online assessment of workload in ATC tasks. At regular intervals throughout the simulation run, ATCOs are asked to rate their workload on a five-point scale. This way, fluctuations in workload across the run or in response to specific events in the simulation can be measured while being minimally intrusive. Similarly, physiological measures such as eye activity, respiration, or electroencephalography (EEG) data can be used as indicators of fluctuations in workload across time [53,54]. Psychophysical approaches to workload measurement and prediction have also been applied to the field of air traffic control, including the radio communication rate and duration of ATCOs [55].

2.1.4. Operational Performance

The performance of a controller can be evaluated using various factors [56], including the following:

• The number of aircraft controlled;
• The number of controlled flight hours;
• The number of controlled kilometres;
• The number of directions/requests from the control centre.

As comparisons of the controllers in terms of number or time can be eliminated by test setups, the consideration of the actions performed and the kilometres controlled are particularly indicative regarding the performance of a controller. The consideration of controlled kilometres is particularly crucial, as it allows for the assessment of routes with optimal efficiency, given the varying optimal flight speeds for different aircraft [57]. Consequently, the efficiency of a route cannot be measured in terms of time.

2.1.5. Environmental Impact

Situational changes to the flight paths result in alterations to the planned fuel consumption. These changes are determined using the BADA models [58]. For each aircraft type, different performance data exist. Depending on the calculated fuel burned and the emission factors, it is possible to calculate the greenhouse gases [59]. A change in range due to an engine failure, as in [60], can be determined. However, it is also possible to determine the fuel consumption from the BADA models and then to calculate the difference between the two selected aircraft. The additional fuel consumption results in higher greenhouse gas emissions.

2.1.6. Cost Efficiency

Within SESAR, cost efficiency is assessed through the direct air navigation service gate-to-gate costs per flight. However, this is derived from technology cost on the one hand and ATCO hours on duty on the other [61]. The SCO concept might introduce additional technology costs for supporting ATCO tools. However, at this stage of research, it was not possible to provide an approximation of how much. The flights per ATCO hours on duty is a simple division of the number of fights by the number of ATCOs on duty. The team in [61] presuppose safe handling and equal ATCO workloads for the new researched approach compared to a reference scenario. However, ATCO hours on duty can be increased by more flights, but also by a lower number of ATCOs. In mathematical terms, situations with less capacity but higher efficiency are therefore possible. Therefore, Reference [61] scale the results to peak traffic. This limits the informative value for all other cases.

3. Validation

The validation at hand was intended to be a proof of concept. As foreseen in the concept, a demonstrator system including potential new ATCO support tools was used [21,22]. These tools are envisaged for an operational implementation step with distributed (peripheral) system support for a single controller. This chapter will repeat key elements of the validation as already described in [5]. Additionally, details about the measurement of objective criteria are given. The validation refers to current traffic levels.

3.1. Experimental Design

A total of seven male ATCOs from Germany and Austria participated in the validation, six in pairs of two and one with an additional domain expert. The participants were on average 30.86 years old and had an average of 8.57 years of experience as an ATCO. Airspace and traffic were simulated using the NLR ATC Research Simulator (NARSIM) [62] in the DLR Institute of Flight Guidance’s Air Traffic Validation Center in Braunschweig in autumn 2023. The air traffic situation was presented to the ATCOs using a state-of-the-art look-and-feel air traffic control system simulator based on the operational system used in the German upper airspace. Upper (en route) airspace was the focus of the validation at hand and was defined as reaching Flight Level 245 and above. A sector from Maastricht Upper Area Control located over north-west Germany was chosen for validation. The baseline scenarios were conducted with two ATCOs in the roles of radar and planner controllers. In contrast, in most ATC real-time simulations involving ATCOs, only the radar controller role is considered [12]. The results of the baseline are used as reference for the solution scenarios. The solution scenarios were conducted by one ATCO and additional support tools added to the baseline system. A summary of the tools is given in

Table 2. Tools used in solution scenarios [5].

Name	Main Functionality
Attention Guidance	Highlighting aircraft in case of conflict within the following 5 min, sick passenger, CPDLC failure, or sector entry.
Auto-Coordination	Automatically accept electronic coordinations if they create no conflict.
Boundary Arrival Task Manager	Indication of exit conditions, potential blocking traffic, and time left to transfer of communication.
Dynamic Heatmap	Indication of forecast lateral density of traffic.
Sonification	Auditory cues about sector entries, open required level changes, rate deviations, and sick passengers.
Trajectory Generation and Advisory Tool	Generation of new trajectory on request.

, and a graphical visualisation is given in Figure 2 [5]. A summary of the scenarios is given in

Table 3. Scenario overview.

Traffic Demand (% Declared Capacity)	Staffing Layout
	Radar + Planner	SC
40%	Baseline Low	Solution Low
80%	Baseline High	Solution High

.

A 2 (traffic load) × 2 (baseline vs. solution) within-subjects design was chosen. Both scenario types were conducted with two traffic loads: 40% and 80% of the declared capacity of the sector used in the validation. This allows a comparison between the baseline and solution scenarios with the same traffic, but also between the baseline scenario with 80% and solution scenario with 40%, as both show a theoretically equal traffic amount per ATCO. In detail, 80% was used based on the assumption that, in combination with the ATCOs working on an unknown sector (and baseline system), this will result in a situation with 100% traffic and the sector and system being known by the ATCO. Scenarios with the same traffic amount differed only in the callsigns of the flights with identical initial flight plans (IFPs). Both traffic conditions were executed post validation, without any intervention from an ATCO, as additional reference for some investigated parameters. In these uncontrolled scenarios, flights followed their IFP, leading to unresolved conflicts and the non-execution of required FL changes. The analysed length of the scenarios is 47 min, taken from a 1 h run, excluding fade-in and fade-out time. The validation was supported by pseudo pilots and pseudo air traffic controllers for neighbouring sectors. They implemented several scripted events across all scenarios to add more realism to the simulation and enable an accurate assessment of the concept [5] as follows:

• Radio communication failure or intentional wrong readback (baseline)/failure of Controller–Pilot Data Link Communication (CPDLC) (solution);
• Pilot requests a different flight level (FL);
• Sick passenger on board;
• Neighbouring sector requests to handle an aircraft prior to the transfer of control (release request);
• Incoming coordination from neighbouring sector(s);
• Intentional rate deviation;
• Aircraft diversion (new aircraft).

Other events were set up with the initial flight plan (IFP):

• Dissimilar entry FL (NFL) and exit FL (XFL);
• Planned conflicts (in case of no intervention by ATCO).

These events were often allocated to a specific short time frame with multiple options, rather than to a specific aircraft, to avoid recognition effects. Furthermore, it enabled an adaptation of the pseudo pilots to unpredictable ATCO actions. For example, it cannot be foreseen if an ATCO instructs a rate to the pilot or requests an aircraft already on a lower level to ensure that the aircraft will reach the XFL of the sector. However, sick passenger events were allocated to specific aircraft. The time frame was identical, but the concrete aircraft (and thus the IFP and requested diversion airport) varied between all scenarios. Thus, the handling of these events was not analysed. A key assumption for the solution scenario was 100% CPDLC coverage for a few main instructions (level, rate, heading, turn, direct, speed, and frequency change) [5].

The validations were conducted per ATCO pair, as shown in

Table 4. Validation process per ATCO pair [5] reproduced with permission from SNCSC from Engineering Psychology and Cognitive Ergonomics, Robert Hunger, Springer Cham, 2024.

Day	Agenda Items
1	General briefing (project, validation aim, scenarios, and pre-validation questionnaire); Sector briefing; Introduction baseline system; Training baseline system; Introduction SCO system; Training SCO system.
2	First baseline run; First solution run ATCO 1; First solution run ATCO 2; Second baseline run.
3	Second solution run ATCO 1; Second solution run ATCO 2; Third baseline run; Post-validation questionnaire.

[5]. The first day was used for the introduction of the purpose and agenda of the validation and theory explanation of the baseline and solution system, including training runs for both. On the following two days, the ATCOs conducted the scenarios. Solution scenarios were always conducted sequentially on the same day. The second ATCO was separated to avoid influences. The order of scenarios was changed between participant pairs. The baseline high scenario was executed twice with the roles of the ATCOs being swapped.

3.2. Data Gathering and Processing

Next to the data assessed in [5] during the validation runs, the following data were collected:

• Number of aircraft within the validated sector at each time;
• ISA values;
• Reaction time to ISA;
• Trajectory of each aircraft passing through the sector (latitude, longitude, speed, and flight level at any time);
• Coordinations;
• Number of radio contacts;
• Duration of each radio contact.

Furthermore, from the IFP, the aircraft types and XFL can be extracted. The length of each validation run was one hour, including thirteen minutes to start the scenario, set up the display, and build up the initial traffic picture for the ATCOs as well as to smoothly exit the run. Therefore, the analysed period was 47 min [5].

The following subsections describe the metrics used in the validation to measure safety, situational awareness, workload, operational performance, and environmental impact. Finally, Section 3.2.7 compares the metrics used with those from the literature review in Section 2.1.

3.2.1. Safety

Any separation infringement during the simulation is analysed to determine the impact of SCO on safety. To assess possible separation violations, a pairwise lateral and vertical comparison for each aircraft pair for each applicable time step is performed. With this procedure, it is assured that any possible infringement is detected. The separation minima used for this analysis are shown in

Table 5. Separation minima [5].

Dimension	Separation Minimum
Vertical	1000 ft
Lateral	5 NM
To sector boundaries	2.5 NM

and visualised in Figure 3.

The separation ‘to sector boundaries’ describes the minimum allowed distance to any boundary with sectors that are not foreseen in the flight path (see top view in Figure 3). Additionally, any handover condition, e.g., a specific FL, must reach the same distance before the aircraft passes the sector boundary to the next sector in sequence (see vertical view in Figure 3). For the evaluation, infringements with a vertical separation of less than 800 ft were taken into account. Aircraft legally adhere to their assigned FL, even with a radar-indicated deviation of 200 ft [63], as long as the pilot (based on aircraft measured FL) reports to be at the assigned FL. This takes into account technical inaccuracies, which is the reason behind the required vertical minimum. The analysis also took into account the separation infringements outside the sector boundaries of the validated sector, provided that the responsibility for this can be attributed to the participant(s) in the validated sector. This is the case if both aircraft involved had previously flown through the validated sector and there is not sufficient time for the ATCO of the sector to resolve the conflict where the infringement becomes active. An example is shown in Figure 4.

The analysis of separation infringements reviews the duration, minimal lateral and vertical distance (not necessarily at the same time), and individual recorded trajectories to understand the emergence of each infringement.

3.2.2. Situational Awareness

As an indicator of situational awareness, deviations from the coordinated flight level during handovers to a neighbouring sector were analysed. For this, the altitude when flying over the sector boundaries was considered. Operationally, the coordinated altitude must generally reach 2.5 NM before the sector boundary (see Table 5). If no XFL was coordinated, the ones noted in the IFP were referenced. Again, all deviations of up to 200 ft are regarded as compliant with the handover condition. Furthermore, deviations of aircraft that have left the sector correctly at FL 245 and downwards, but have received a lower coordinated level and for which a deviation of more than 200 ft is initially calculated as a result, are not considered. In addition, aircraft for which one of the following events was performed were also excluded:

• Sick passenger;
• Diverted aircraft;
• Release request.

3.2.3. Workload

Workload metrics are often divided into objective and subjective measurements. Subjective measurements take personal experience and individual influences into account, while objective measurements rely on quantifiable data like task completion times or error rates, offering a standardised view unbiased by the participants personal view. For the current validation, ISA [52] was used as a workload metric. ISA is a tool for the discrete recording of the perceived workload during tasks by the participants and is therefore a subjective metric. Additionally, the response time to ISA queries was utilised as an objective workload measurement. Since answering the queries is a none-operative ATCO task, such a secondary task will be dropped or postponed first in high-workload phases. During the simulation runs, the ISA query appeared automatically on the ATCO HMI every three minutes and the participants were asked to rate their current workload on a scale of 1 (underutilised) to 5 (excessive). Unanswered queries were excluded from analysis.

Furthermore, voice communication data are analysed, as this typically has a large share of the task- and workload of ATCOs [64,65]. As discussed in [66], ATCOs execute tasks in parallel. This applies in particular to system inputs corresponding to instructions given by voice. However, reducing or replacing the requirement for double input (system input and speech input) for each instruction is expected to reduce the task- and workload of ATCOs.

Each transmission is recorded. From the recordings, the average number of transmissions per run and the average transmission length can be extracted. Referring to the total run time of 47 min, the average utilisation of the radio channel can be calculated. As reference to these metrics, the number of aircraft at a time within the validated sector is recorded as well. In general, higher traffic values will correspond to higher workload values.

3.2.4. Operational Performance

The comparison between baseline and solution scenarios with the same traffic amount was enabled by using the same scenario with identical flight paths for each aircraft. The callsigns were changed for scenarios with identical IFPs to reduce recognition effects. In this setup, operational performance was measured by comparing the lateral distance flown by each aircraft in the ATCO’s sector. Aircraft outside the ATCO’s sector are not measured, nor are flight paths that include an emergency involving a sick passenger. The measured values of the executive ATCO in the baseline run are compared to the values of the same ATCO in the solution, as the executive ATCO has more influence on the flight paths. The whole flight paths of the respective aircraft are compared. By this, influences of flight path changes that shorten the distance within the validated sector but enlarge the overall distance are precluded. This prevents incorrect conclusions resulting from changes to flight routes that only shorten them within the sector but lengthen the overall routes.

Figure 5 shows a schematic example for the flight path calculation and comparison of a flight from e.g., Berlin to Paris passing through the validated sector, shown with green dashed lines. The red solid path would shorten the flight path within the sector compared to the blue dotted flight path. However, at the same time, it would increase the overall distance flown by the aircraft, as depicted with the exemplary numbers. As the validation run lasts only 47 min, the flight paths were post processed using a circle from the sector boundary to the destination airport, as also implied in Figure 5. Flights that did not reach the airspace boundaries within the run time were extended to the boundary for the calculation based on their flight plan or their last instructed track; doing so prevented the results of the operational performance being influence due to a limited view of one sector. The calculation and comparison were completed per aircraft (per ATCO and per traffic load) first and summed up thereafter.

3.2.5. Environmental Impact

The environmental impact of a flight is determined by its fuel consumption. The fuel consumption itself is affected by various aspects such as the type of aircraft and engine, flight distance, altitude, speed, and aircraft mass. To measure the environmental impact of the tools used in the solution runs, a comparison with the baseline runs without the tool support is necessary. The fuel estimation is based on the BADA 3.16 performance model, which is also used by NARSIM to calculate the aircraft performance behaviour. As general assumptions, the medium mass level and standard cruise speed of the aircraft type are used to estimate fuel flow. The fuel is calculated for the same trajectory that has been used for the operational performance analysis. The estimated fuel consumption of all aircraft is summed up, so that each scenario with similar traffic can be compared. A comparison between different traffic levels is possible using the percentage of fuel used in the solution runs compared to the baseline runs. In the calculation, only aircraft flying through the sector operated by the ATCO are used. Flights including an emergency of a sick passenger are also excluded from the calculation.

3.2.6. Cost Efficiency

Cost efficiency benefits are a foreseen major advantage of the SCO concept. If the above-mentioned aspects show the feasibility of SCO, cost efficiency benefits are inevitable, given the reduction in ATCOs per sector. The results, as derived from the other investigated aspects, will be discussed in Section 4.

3.2.7. Comparison of Metrics and Validation Limitations

As can been seen from

Table 6. Comparison of metrics.

Metric	Literature Example	Applied (Yes)-Justification If Not
Safety
Number of mid-air collisions	[35]	No occurrences
Number of loss of minimum separation	[36,42]	Yes, with operational exclusions
Number of tactical conflicts (planned)	[42,44]	Dependent on scenarios
Average time of loss of minimum separation	[36]	Yes
Average time of loss of minimum separation during ATCO conflict resolution	[36]	The correct identification of the start of the ATCO conflict resolution cannot be guaranteed
Average time of loss of minimum separation prior ATCO conflict resolution	[36]	The correct identification of the start of the ATCO conflict resolution cannot be guaranteed
Average time of loss of minimum separation without radar indication	[36]	No occurrences
Number of conflict resolution processes	[36]	The correct identification of the start of the ATCO conflict resolution cannot be guaranteed
Severity of loss of minimum separation (lateral and vertical distance)	[43]	Yes
Questionnaires	[31,45]	No objective measurement
Debriefing	[31,45]	No objective measurement
Situational Awareness
Questionnaires, e.g., situational awareness for SHAPE (SASHA) Questionnaire	[49]	Yes, in [5]
Observer ratings	[50,51]	No objective measurement
Communication patterns	[51]	Not comparable due to use of CPDLC
Online or freeze probes	[50,51]	Intrusive, altering situational awareness; low sensitivity
Overall performance	[50]	Low sensitivity
Withheld information	[50]	Intrusive, altering situational awareness
Imbedded secondary task performance (handover procedures)	[50,51]	Yes, XFL deviations
Workload
Questionnaires, e.g., NASA-TLX	[5]	Yes, in [5]
Instantaneous self-assessment	[52]	Yes
Radio communication rate and duration	[55]	Yes
Operational Performance
Number of controlled aircraft	[56]	Same scenario structure
Number of controlled flight hours	[56]	Same scenario length
Number of controlled kilometres	[56]	Yes
Number of directions/requests of ATCO	[56]	Not comparable due to different flight numbers
Environmental Impact
BADA model calculation	[58]	Yes
Cost Efficiency
Flights per ATCO hours on duty	[61]	Estimation, focusing on benefit

, due the to validation constraints in time, effort, and focus, not all researched metrics were applied. The variables addressed (safety, situational awareness, workload, operational efficiency, environmental impact, and cost efficiency) by these metrics all serve to prove the feasibility of the new SCO concept. Thus, the research excludes investigations of correlations or relationships between two or more variables that might be observable from the results. A basis for such an investigation would be an analytic model, like TOPAZ [39,40] used for safety assessment, which is not part of the analysis at hand. Furthermore, the analysis of environmental impact is restricted to influence from lateral flight path differences. Cost efficiency is automatically predetermined by the concept if the other variables are acceptable and the concept is feasible. The assessment of cost efficiency excludes the impact of additional technology costs, as this would be too early for an justified estimate. Rather, part of the validation, as presented in [5], aims to identify improvements in the technical support tools.

4. Results

This chapter will summarise the results analysed in this paper of the current validation following the collection and processing of data described in Section 3.

4.1. Safety

Table 7. Separation infringements.

Scenario	Number of Runs	Average Separation Infringements	Infringement Duration [s] (Averaged)	Minimum Lateral Distance [NM] (Averaged)	Minimum Vertical Distance [ft] (Averaged)
Baseline Low	4	0.25	21	1.63	484
Baseline High	7	0.86	28.83	3.03	448
Solution Low	7	0	-	-	-
Solution High	7	0	-	-	-

shows the results of the separation infringements. Each participant conducted the solution scenario as a SC and the baseline high scenario as a radar controller. The baseline low scenario was performed only once by the participating ATCO pairs and once by the participant supported by the ATM expert. The number of infringements is averaged over the number of runs per scenario. The infringement duration is measured between the first and last time (second) that the separation minima are undercut. The duration as well as the minimum lateral and vertical distance are averaged across the detected infringements. For example, the minimum vertical distances of separation infringements in the baseline high scenario vary between 0 and 733 ft.

A total of seven separation infringements occurred across all scenarios. As depicted in Section 3.2.1, infringements with a minimal vertical distance of 800 ft are not considered. Following this, two potential infringements of baseline high, two of solution high, and three of solution low scenarios are excluded. All excluded infringements show a minimum vertical distance of at least 988 ft, whereas all considered infringements show 733 ft or less. The number of runs performed must be taken into account when interpreting the results. It is not significant but remarkable that none of the solution scenarios included a separation infringement. The only infringement for a baseline low-traffic scenario occurred in connection with an aircraft with a sick passenger event. The separation infringement itself took place outside of the validated sector, but both aircraft were known to the participant in the validated sector (see Figure 4). All other separation infringements occurred within the baseline high-traffic scenarios. Based on the current validation, the SCO concept in terms of the validated system leads to an increase in safety. It can be assumed that the Attention Guidance Tool in particular, with the (repeated) highlighting of conflicts, was able to prevent separation infringements. Another factor may have been the increase in capacity among the controllers through the increased (possibilities to make) use of CPDLC. However, as depicted in [32,46,47], the influence on situational awareness and workload only allows comprehensive conclusions to be drawn about safety.

4.2. Workload and Situational Awareness

The analyses of ISA queries, voice communication, and XFL errors are described in the following.

In total, 308 ISA responses were considered for analysis. Due to unmatched scenario pairs, independent t-tests were performed to compare the ISA response times between traffic scenarios as well as solution and baseline scenarios. The response times did not significantly differ between the low-traffic (M = 7.30, SD = 5.35) and high-traffic (M = 7.34, SD = 5.89) runs, t = 0.057, p = 0.955. However, the response times were significantly longer in the baseline runs (M = 8.32, SD = 6.73) compared to the solution runs (M = 6.58, SD = 4.58), t = 2.56, p = 0.011. This could lead to the conclusion that the workload in solution runs was lower.

Further, Mann-Whitney-U tests were calculated to assess ISA responses across scenarios. Between baseline and solution scenarios, no significant differences were found, U = 12.48, p = 0.250. However, the high-traffic scenarios were rated significantly higher on the ISA than the low-traffic ones, U = 14.89, p < 0.001. This trend is also observed on the NASA-TLX in [5], which showed higher reported workload during the high-traffic scenarios. It may be that the higher workload during the higher-traffic scenarios is not reflected in the response times as the workload levels were too low to negatively affect the response times. Moreover, participants may take longer to respond to ISA queries during the baseline runs because they are engaged in conversation with the planning controller and are less focused on the screen. With a mean of 2.39 and a standard deviation of 0.85, the workload was generally from rated “relaxed” to “comfortable” across all conditions.

To objectively assess workload, ref. [53,54] used a variety of physiological measures that were not applied for the validation at hand. However, ref. [55] showed the correlation of those measures to the radio communication parameter, as analysed in the following. Figure 6, Figure 7 and Figure 8 visualise the average number of radio–telephony contacts (transmissions), their average overall duration, and the average utilisation in relation to the simulation time over all simulation runs. Figure 6 shows on average around 91 transmissions in the baseline low scenarios. The number clearly increases to 133 in the baseline high scenarios due to the higher amount of managed aircraft, which leads to more radio–telephony contacts. For the solution scenarios, on the other hand, there is only a minor difference in the number of transmissions between the low and high scenarios, which shows that the higher amount of aircraft did not require significantly more verbal communication in scenarios where CPDLC was the preferred way of providing clearances.

Figure 7 shows the amount of time the ATCO needed to communicate all required clearances to the pilots. For baseline low scenarios, the duration of ATCO speech during simulation runs was on average 6.6 min (395 s) and 10.1 min (608 s) for baseline high scenarios. The solution scenarios again show only a minor difference between the low (48 s) and high (55 s) scenarios.

Figure 8 sets the ATCO communication time from Figure 7 in relation to the total simulation time of a simulation run. This shows that in baseline low scenarios, the ATCO required 14% of the time in a simulation run to issue all verbal clearances. This increased to 22% in the baseline high scenarios. For the solution runs, the time needed for verbal communication from the ATCO site made up only 2% of the simulation run duration.

Figure 7. Length of all transmissions in seconds averaged over all runs per scenario.

Figure 7. Length of all transmissions in seconds averaged over all runs per scenario.

Figure 8. Percentage of run duration used for radiotelephony (sending) averaged of all runs per scenario.

Figure 8. Percentage of run duration used for radiotelephony (sending) averaged of all runs per scenario.

All parameters reflect the same relationship: the possibility of using CPDLC with all aircraft reduces the number of necessary radio transmissions and thus the average total duration of all radio transmissions and the utilisation, i.e., the proportion of time spent on (controller) voice radio in the total time. Although 100% CPDLC equipment of the aircraft was assumed, only a few, frequently used, instructions were available for CPDLC. It was also possible, and sometimes necessary, to give instructions by radio in the solution scenarios. This takes into account the current operational limitations of CPDLC: First, the wide range of possible ATCO instructions is not fully covered. Second, time critical instructions require instant responses from pilots or a clear indication possibility from the ATCO that the pilot did not react. With readback, this indication possibility is realised faster than with the current usual CPDLC response time of 2 min [67]. To obtain comparable scenarios, readback errors and missing readback events in baseline scenarios were replaced by simulated CPDLC failures, including an indication in the aircraft label in the solution scenarios, leading to roughly the same increase in workload being brought on by these events in all scenarios. However, the response times of the pseudo pilots for speech and CPDLC were not defined, resulting in similar times.

It is also evident in the comparison of both solution scenarios that there are nearly no extra transmissions despite the doubling of traffic (see Figure 6). This could be expected as voice communication is only used for complex instructions and/or such events not covered by CPDLC, i.e., aircraft with sick passengers and CPDLC failures. However, there is a similar effect for the baseline scenarios: a doubling of the traffic volume is covered with 1.5 times the number of transmissions. This is a good example to show that an increase in the traffic amount does not necessarily lead to the same increase in complexity and/or in communication. A larger proportion of the additional aircraft compared to the low scenario is passing through the sector without the need of additional instructions. Nevertheless, even these aircraft add workload to ATCOs as they need to and will be considered for other potentially conflicting traffic.

Voice communication is only one part of the ATCO’s task load and workload. However, the above-mentioned significant reduction when using CPDLC for very few basic instructions would contribute to a lower ATCO workload and enable an SC to maintain the workload level of an ATCO in an ATCO team. The usage of CPDLC reduces readback to the same extent and is not taken into account in the data, despite creating additional capacity for the ATCO. As described above, this contradicts the subjective assessment in [5], which needs further analysis.

In the analysis of XFL deviations, some aircraft were excluded as no electronic coordination was possible due to coordination system outtakes during part of the validation runs. In these cases, the controllers were instructed to consider their own coordination as accepted. Thus, the number of runs in Table 7 is higher than that in Table 8. Table 8 shows the distribution of the remaining deviations across the scenarios and the average number of deviations per scenario. The deviations are also divided into four categories:

• Minor: ≤400 ft;
• Medium: >400 ft and ≤1000 ft;
• Large: >1000 ft;
• Lateral excursion: missed to pass $FL$ 245 or below within own lateral sector boundaries.

For minor deviations, it can be assumed that they cease in the following seconds and were therefore not coordinated by the ATCOs. The effort is greater than the benefit if the controller is assumed to be aware of all surrounding traffic. All medium deviations are closer or as close to another assignable FL as to the coordinated FL, whereas large deviations correspond to an occupation of a wrong i.e., not coordinated, FL. Lateral excursions can be regarded as particularly critical, as the lateral sector may not even be aware of the aircraft and cannot include it in the preliminary planning. In addition, a separate categorisation was made for forgotten aircraft that have an identical actual entry and exit FL but a different coordinated XFL. In this case, it can be assumed that these aircraft were completely overlooked. In other cases, aircraft may have been instructed to fly to the coordinated FL, but did not reach the corresponding FL or were not coordinated in time. Although XFL deviations are used in the literature [51] to assess situational awareness, a deviation to severity levels, as used in this analysis, is not performed. The result of an “uncontrolled” scenario is given as an additional reference value. In this case, no controller intervened, and all aircraft followed their flight plan. Even in the uncontrolled scenario, the number of deviations is too low to perform t-tests. Nevertheless, from an operational perspective, the amount of XFL deviations is high. The reason for this is the intended explicit non-intervention of the pseudo pilots and, in particular, the pseudo controller. In operational mode, pilots would ask for higher or lower FLs as soon as it seemed necessary or operationally sensible from their point of view. Neighbouring sectors would call and make enquiries, act proactively, and coordinate or complain. In addition, events such as not adhering to a rate that was correctly read back actively favoured deviations. These measures were initially taken to simulate a more realistic environment (e.g., where there are also pilots mistakes) and, secondly, to ensure as far as possible the occurrence of XFL deviations to enable a comparison. This comparison contains a key message: The SCO concept and system can perform comparably well. Analysing only the low scenarios, nearly all XFL deviation categories show higher average values in the low-traffic solution runs. However, the number of considered runs was higher and the difference was not significant. Still, it is remarkable that these deviations occur in relaxed traffic conditions, as shown by ISA values. One reason could be the missing Attention Guidance for XFLs. There was no coloured indication in the label. In the baseline scenario, this could have been caught by the planner controller as it is their primary task to coordinate handover conditions with adjacent sectors. The comparison of high scenarios show the opposite: nearly all deviation categories show lower values for the solution scenario. Again, the differences are not significant. Based on this and the response time to ISA queries, it can be concluded that the level of situational awareness is hardly impaired by SCO.

Table 8. XFL deviations.

Scenario	Baseline Low	Solution Low	Uncontrolled Low	Baseline High	Solution High	Uncontrolled High
runs	3	5	1	7	7	1
average number	4.3	5.8	16	10	9.3	27
average minor	0.1	0.4	0	0.6	0.1	0
average medium	0.7	0.2	1	1.7	1	2
average large	3.3	4.6	13	6	6.6	20
average lateral excursion	0	0.6	2	1.7	1.6	5
average forgotten	0.7	0.8	not applicable	1.3	1	not applicable

Table 8. XFL deviations.

Scenario	Baseline Low	Solution Low	Uncontrolled Low	Baseline High	Solution High	Uncontrolled High
runs	3	5	1	7	7	1
average number	4.3	5.8	16	10	9.3	27
average minor	0.1	0.4	0	0.6	0.1	0
average medium	0.7	0.2	1	1.7	1	2
average large	3.3	4.6	13	6	6.6	20
average lateral excursion	0	0.6	2	1.7	1.6	5
average forgotten	0.7	0.8	not applicable	1.3	1	not applicable

4.3. Operational Performance

The results of the operational performance based on flight distance are shown in

Table 9. Flight Distance Comparison.

Comparison Parameter	High Scenarios	Low Scenarios
Average total distance difference [solution–baseline]	−21 NM	+2 NM
Average percentage change in total flight distance of all aircraft in the baseline scenarios	−0.04%	+0.01%
Average percentage change in distance within the sector of all aircraft in the baseline scenarios	−0.44%	+0.12%
Average absolute distance change per aircraft	−0.2 NM	+0.1 NM

. While not specifically mentioned, it can be assumed that ref. [56] measure the influence on flight distance only within the sector(s) in focus, whereas, in this analysis, the influence on the complete downstream flight path is considered in a simplified manner. In addition to the summed up and averaged comparison of the total flight distance, the results are also given in reference to three other parameters: Firstly, they are compared to the total flight distance of all flights in the baseline scenarios. This shows the impact of the SCO concept introduced in one single sector as a percentage. Secondly, they are shown in reference to the the total flight distance within the validated sector of all flights in the baseline scenario. This can serve as an approximation of the impact of the SCO concept introduced in all sectors. Finally, the number of flights is referred to, indicating how many miles an aircraft saves or spends extra on on average (under the assumption that SCO is only introduced in this one sector).

For the high-traffic scenario, the use of the given tools in the solution run resulted in a better operational performance, by an average total of 21 NM. In the low-traffic scenario, the use of the tools had almost no benefit, with an average distance increase of 2 NM. This may prove the SCO concept and tools to be beneficial during high traffic because they support the ATCO in high-workload situations, but may not add any benefits when traffic is low and the ATCOs can manage everything easily themselves. However, there is a potential positive impact from SCO.

4.4. Environmental Impact

To determine the environmental impact, the flight duration and distance of each aircraft was recorded. Using the operational performance data, the scenario distance, duration comparison, and the aircraft type, it is possible to calculate the fuel burned by each aircraft. The data used for the calculation are taken from the NARSIM BADA v3.16 simulation environment. Excluding the aircraft affected by the sick passenger event and combining the data for each scenario, it is possible to obtain a comparison of the baseline and solution scenario runs.

For the high-traffic scenario, a total reduction of 4010 kg of fuel is calculated. By using the tools, a fuel consumption of 98.8% of the baseline is achieved (

Table 10. Fuel consumption comparison.

Comparison Parameter	High Scenarios	Low Scenarios
Average total fuel difference [solution–baseline]	−4010 kg	+3225 kg
Average fuel difference per nautical mile flown [solution–baseline]	−0.14 kg	+0.24 kg
Average fuel difference per aircraft [solution–baseline]	−98 kg	+140 kg
Average fuel consumption of the solution relative to the baseline	98.8%	102.2%

), leading to an average fuel difference of 98 kg and saving close to 310 kg of CO₂ per flight. For the low-traffic scenario, the opposite is the case, with an additional consumption of 3225 kg of fuel and an increased consumption of 102.2% compared to the baseline.

The increase between the baseline and solution for low scenarios could be due to the influence of individual performance, as the baseline low scenario was conducted four times, whereas the solution low scenario was conducted seven times. Furthermore, the analysis is based on the lateral difference between corresponding flights of baseline and solution scenarios considering BADA [58]. Vertical differences (e.g., descending an aircraft unnecessary early) are not analysed in the study.

4.5. Cost Efficiency and Capacity

The validation at hand was not intended to identify the optimal or maximum capacity suitable for SCO. Instead, it aimed to show the ability of an SC to safely and efficiently manage 80% of the traffic of a controller team. The aim of the recordings for capacity were to evidence that potential cost efficiency, safety, and operational efficiency benefits were not caused by less traffic being handled, by the non-acceptance of individual flights, or by delays to flatten traffic peaks.

Realistic cost efficiency calculations require comparable safety, operational efficiency, and environmental impact to baseline scenarios. SCO cost efficiency gains stem from single SC deployments handling at least half the traffic of a two-person ATCO team. For simplification, this study used the declared capacity of an existing sector as a reference, which represents the maximum number of aircraft allowed in a specified sector in a specified time period. This value is typically not required continuously. The two validated conditions for traffic load (40% and 80%) are able to show that SCO is at least equally as cost-efficient as a controller team. The 40% solution scenario performs better than the 80% baseline scenario in terms of safety, workload, and situational awareness according to the applied objective measures in the validation. This also indicates a potential higher cost efficiency, as the 80% solution scenario is just as good, with some exceptions regarding the corresponding baseline scenario. The same applies for both 40% scenarios. The use of a maximum of 80% of the declared capacity was selected to take the situation of an unknown system and sector for the participants into account. However, the findings cannot be extrapolated to 100% declared capacity. Nevertheless, even a potential use of an SC working 80% instead of two ATCOs working 100% equals a theoretical increase of 60% capacity per ATCO. This can be understood through an example of two ATCOs being able to handle 60 aircraft per hour (30 per ATCO per hour) and the SC being able to handle 48 according to the results. As discussed in Section 2.1.6, the cost efficiency measure, as used in [61], shows a higher cost efficiency in terms of ATCO hours per flights but a lower overall capacity at the same time. Assuming that 100% of traffic needs to be controlled, SCO brings a potential 40% cost efficiency increase. It has to be admitted that this is a purely theoretical calculation, since, in a controller team, both ATCOs will handle all aircraft as they have different tasks and responsibilities. It is not possible to allocate half the amount to each ATCO as it cannot be assumed that two ATCOs can handle double the amount of traffic of one ATCO. For example, [13] assumed 60% more capacity if a second ATCO is joining. This would imply that a single ATCO could handle 62.5% without additional means. Furthermore, the required cost for implementation would reduce cost efficiency at least during the introduction phase, as considered in [61]. In addition, the stated benefit ignores other possible countermeasures of an air navigation service provider (ANSP), e.g., the collapsing of sectors. However, a collapsed sector consisting of two sectors will always have a lower declared capacity than the cumulative declared capacity. On the other hand, it will most likely have a higher declared capacity than any of the single sectors. Whether SCO or collapsing sectors is more beneficial depends on the concrete values of the declared capacity, the maximum traffic load for an SC, and the dependency or relative overlap of flights between the single sectors. Still, SCO has an advantage over collapsing in terms of reducing safety-critical handover times between ATCOs.

5. Discussion

This chapter will summarise the limitations and restrictions of the results of the validation at hand. Subsequently, the results will be discussed from a general perspective while also referring to the limitations.

The validation took place in an en route sector of upper airspace (here: FL > 245). Accordingly, the results may not be directly applicable to other air traffic control sectors or environments. Furthermore, the system, sector, and participating ATCOs were not harmonised. This introduces effects that will probably result in worse performance despite the briefing and training conducted for sector and system familiarisation. Independent of this, it is more reasonable to transfer results to any combination of system, sector, and ATCO origin than it would be from a harmonised validation. The operational realism was limited by the highly restrictive implementation of the planner ATCO tasks. Only a tool for electronic coordination with a limited selection of coordination options was available for this purpose. Furthermore, events were deliberately implemented to add realism to the validation (e.g., readback errors) while also highlighting ATCO mistakes to highlight the potential risks and benefits of the concept and supporting tools. However, this led to pseudo pilots and pseudo controllers leaving mistakes uncorrected. In turn, higher numbers of separation infringements and exit condition deviations (from 4.3 on average per run in baseline low up to 10 on average per run in baseline high) were measured than would be expected from real-life operations. The environmental analysis can also only be used for relative comparisons within the various test conditions. The assumptions of the calculation model cannot be transferred to real operational conditions. Again, these limitations prevent absolute values to be compared to operative data. However, they are meaningful in comparison to each other.

The influence of training effects was minimised as far as possible by varying the order of the test runs (conditions) between the participants, hence precluding sequence bias [5]. Other cross-effects or influencing factors from the validation set up are excluded from the analysis as much as possible. For example, flights with a sick passenger event are excluded for comparisons of operational performance and runs with coordination bugs are excluded for analyses of deviations of exit conditions, resulting in differences in the number of data points. In contrast, the objective measurement of the subjective-by-nature metrics workload and situational awareness is a challenge and can only serve as an indication rather than a proof. Analyses were configured from an operational perspective in order to avoid erroneous conclusions during the transfer from the inevitably limited validation (e.g., consideration of the total distance after the sector in the operational performance and reference to various reference values). Last, it has to be admitted that due to the number of participants, statistical significance could not always be ensured. As the validation was designed as a proof-of-concept with the focus on how to improve the concept and identify system refinements, results need to be confirmed in follow-up studies regardless.

(a)

Is safety impaired using SCO?

Regarding the first research question included above, it can be summarised that safety is hardly impaired by SCO, given no separation infringement was detected in solution (SCO) scenarios. This is also supported by the comparable situational awareness reported in [5] and confirmed with the, on average, 10 against 9.3 XFL deviations between the baseline high and solution high scenario, as this closely links to safety [32,46,47]. The reason can be found either in the used support tools or in the lower workload. Workload reduction itself might originate from support tools or from the CPDLC assumption. This is represented by the constant radiotelephony utilisation of 2% against 14% and 22% in the high and low baseline scenarios, respectively, which was found by [55] to be a reasonable measure. For example, ATCOs took longer to respond to ISA prompts during the baseline runs, indicating a higher workload. It may be that the support tools introduced in the solution scenarios helped to reduce the workload beyond the counteracting workload increases associated with SCO. Likewise, communication between the two ATCOs and between the executive ATCOs and pilots in the baseline runs could have added to their workload, whereas the solution runs were performed by each ATCO alone using mainly CPDLC. Taking into consideration the findings from the subjective measurements from [5], CPDLC is the main driver here. At the same time, the results presented there concluded that the subjective workload was higher in the solution runs.

(b)

Does SCO lead to an increase in average flight distance?

(c)

Does SCO have an environmental impacts?

The operational performance and environmental impact addressed in the above research questions are closely linked due to their simplified analysis. However, there is a potential positive impact from SCO, with an average flight distance reduction of $0.04\%$ resulting in a saving of $310kgC{O}_2$ under 80% traffic conditions, which might again originate from the lower workload. Nevertheless, all findings are dependent on and thus restricted to the validated traffic loads.

Is a Single Controller able to control the same amount of traffic as an ATCO pair without negative impact on operational and human performance, safety, and environmental?

However, from the discussion above, the main research question, included above, can be confirmed for traffic loads of at least up to 80% declared capacity: An SC will be able to control up to 80% of the declared capacity with neutral or positive impact on operational and human performance, safety, and environmental impact in comparison to an ATCO pair, provided that they are supported by tailored tools and the possibility of using CPDLC for basic instructions for the majority of aircraft.

6. Conclusions and Outlook

In the validation, scenarios with two different traffic volumes were compared between a reference with two ATCOs in the roles of an executive and a planning controller and a solution with one SC. The analysis considered objective data for safety, situational awareness, workload, operational performance, and environmental impact. The comparisons focused on the relative assessment, excluding data without counterparts, and were brought to a broader context if deemed useful, like extending the flown distance inside the validated sector to the destination airport using great circle for all scenarios. Other validation limitations were discussed in their influence of the found results. Finally, the analysis of the subjective measurements reported in [5] were compared to the current findings where applicable. The results show a counterintuitive dependency on amount of traffic: In low-traffic conditions (here, 40% of declared capacity), the SCO concept shows a tendency to have a negative impact on the operational efficiency, including its environmental impact, with an average increase of $0.01\%$ of the total flight distance. The same tendency can be observed with ATCO errors, i.e., deviations from XFL conditions, representing a negative impact on the ATCO situational awareness and workload. However, ISA values and response times did not confirm the latter. On the contrary, in high-traffic conditions (here, 80% of declared capacity), SCO shows a tendency to have a a positive impact on the mentioned aspects. On average, all aircraft save $0.04\%$ of their total flight distance. Situational awareness, as derived from XFL deviations and ISA response times, is hardly impaired by SCO as the differences between scenarios are not significant. Safety is not impaired by SCO in both traffic conditions. None of the solution scenarios included a separation infringement, which is remarkable given that it was designed to test the concept. Regarding the feasibility of the aforementioned results in high-traffic conditions, SCO can potentially provide a 40 % cost efficiency increase.

The SCO concept is a promising approach to solving staffing problems for ANSPs across Europe. The validation at hand showed potential benefits for safety, operational performance, and environmental impact based on objective data in high-traffic conditions. Although the subjective data analysed in [5] identified a slight workload increase, this should not prevent further research on or implementations of SCO. CPDLC was found to be the main enabler for the SCO concept in both analyses and the main driver of the benefits in terms of workload, situational awareness, and safety as it frees up capacity for controllers to take care of more important tasks and problems. Wide coverage of all aircraft types with CPDLC would be beneficial in the current operational layout of two ATCOs. However, this alone will not help overcome staffing shortages. Introducing the SCO concept through a limited but widespread application of CPDLC would do so. However, SCO requires a wide coverage of aircraft with CPDLC equipment to allow for the response times to ATCO instructions to be comparable to voice communication.

As depicted above, some results of objective measures presented herein and the subjective results presented in [5] contradict each other. This should be investigated further. Additional measures for safety, like the number of tactical conflicts [42,44], or situational awareness, like withheld information [50], would be beneficial. A further validation was planned to be carried out with more ATCOs and adaptations based on the presented results. This includes a validation of higher traffic amounts. However, there was no need to change the concept itself. In general, more practice runs/training on a new system, such as an SCO demonstrator, is needed. Furthermore, a validation under matching conditions in terms of the sector, ATCO, and system should be conducted. Some unresolved issues include the interaction of various SCs, the influence of military aircraft/areas, weather, wind, and the failure of support systems. As CPDLC was found to be the main enabler, a comparison of different implementation stages under SCO could provide benefits in current or near future mixed-traffic conditions. In any of the proposed research directions, the influence on the environment should be investigated as realistically as possible.