29 Aralık 2007 Cumartesi
DO COMPUTERS FEEL? (1500 words)
To Dr. David B. Williams,
ORAT, Illinois State University
Does computer feel? Does computer have emotions? Does computer feel joy, love, anger, fear, and others? Is the effect of the feelings of computer on its behaviour “pleasent or unpleasent, mild or intense, transient or long-lasting, and as interfering with or enhancing” [1] ? Do computers ‘experience emotions’? Do they react toward things in the environment that have such emotional qualities as frightening, cheering and saddening?
Schachter states “an emotional state may be considered a function of a state of physiological arousal and of a cognition appropriate to this state of arousal. The cognition, in a sense, exerts a steering function. Cognitions arising from the immediate situation as interpreted by past experience provide the framework within which one understands and labels his feelings. It is the cognition which determines whether the state of physiological arousal will be labelled as “anger”, “joy”, “fear”, or whatever. [4] ” Many more definitions of emotions have been made through the history beginning with 2nd cty BC, Aristotle. Descartes, Hume[3] , James, Cannon, Dewey[2], Freud, and many others.
Do computers have an ‘inner’ sentimental world? Too difficult to answer quickly… May be we should change the question a bit… Does any being except the human have feelings? Maybe the better: Do animals have feelings? Darwin writes about “most of the expressions and gestures involuntarily used by man and lower animals, under the influence of various emotions and sensations. [5]”
None of the animals can say “I feel sad.” Nevertheless, when a cat approaches a person sitting at a garden caffee, it bends its head to the ground and imitates as if it eats something. A careful observer may understand the animal needs food. Animals can communicate their needs. The problem is, most of us do not percieve the messages they are able to give. We should not judge neither animals nor computers as insensitive because they can not express themselves with the same emotional vocabulary as us the human-beings
Does this situation provide enough validity to the claim that ‘Computers do not feel’? Is there something wrong here ethically? Do we loss anything because of this silent assumption in our relations with computers? Are the Human Computer Interaction classes in many universities well equipped or even down-played as not technical enough? Why do many engineers and large system operators suffer from long duration high concentration jobs in front of their computers?
Indeed, computer does not have a face. A face like a human or even a mammal. It does not have eyes, ears, a skin, a head or a body… Wait a minute… Are you sure that computers can not see, hear or touch? What about scanner, microphone, keyboard? Computers do have many interaction functionalities similar to those that basic human senses provide.
The crux of the issue of ‘Do computers feel?’ is: Is it possible to think without feeling? Can cognition exist without emotions? Can you think even mathematics without feelings? Even if we assume that you really did not feel anything while solving a problem, you would still need to discharge the unused mental energy in some way. You might experience pride or humility depending on your success.
Even if you have the professional power to control everything, you must experience feelings when you are working in a cognitive job, like programming or air traffic control (ATC)… You can not avoid the pleasure from simple matching [6] . Otherwise, you may be working against the nature of thinking and you may hurt yourself mentally. In fact Winkielman [8] states “affective responses may also result from the dynamics of information processing itself.” ,[7], “ High fluency elicits positive affective reaction. [9] ”
The mechanics of the thinking process is affected by our emotions. Switching from one context to another, the rate of changing subjects, the amount of concentration, the depth of thinking through different abstraction levels, getting obsessed to solve the problem, thinking speed are dramatically affected by the affective situation we are in while thinking… “The various glands of the endocrine system release hormones into the bloodstream that have effects on specific sites in the brain, including those involved in emotion” says Cornelius [5] . There are different speed modes of thinking in our brains. Our brains work in a slow mode when we are doing something related with safety (not emergency) where as our ideas fly when we are doing something sentimental or dreaming… Thinking speed helps us to switch from one processor to another in our multiprocessor brain. Feelings and selecting the right mood help us to choose the right processor combination to do the ‘thinking’.
Freud states “ideas are cathexes-basically of memory traces- whilst affects and emotions correspond to processes of discharge, the final manifestations of which are percieved as feelings. [11] “ Hinde asks “Is it an intervening variable or a hypothetical construct? [12] ” and argues that “emotion is best defined in terms of chains or loops with emotion and cognition closely linked. [12] ” I believe, to reach a a conclusion on the question of “Do computers feel?” we shall have a look at the LINUX operating system books…
“An interrupt [13] is usually defined as an event that alters the sequence of instructions executed by a processor. Such events correspond to electrical signals generated by hardware circuits both inside and outside of the CPU chip.” “interrupt signals provide a way to divert the processor to code outside the normal flow of control. When an interrupt signal arrives, the CPU must stop what it's currently doing and switch to a new activity;”
If we make an analogy between Dewey’s emotion definition and work on the example of a touch to the keyboard; (1) the “feel“’s name is keyboard interrupt (2)purposeful behaviour is the interrupt handler program of Operating System (3) an object that has an emotional quality is the person who touches, namely the user. Dewey’s “Calm and Violent emotions” is analoguous to soft and hardware interrupts… The basis of the similarity between the human emotional system and the computer interrupt system arises from the very nature of cognition. Cognition can not exist without some sort of interaction with living matter.
Interrupt subsytem of computers is similar to the human physiology: “Both the hippocampus and amygdala are complexly interconnected with inputs from both the sensory organs and the viscera. … They, and perhaps other structures of the lymbic system, appear to integrate sensory information with information from the various organs of the viscera as well as feedback from the ANS to control the “output” of emotional expression in the ANS and other parts of the nervous system (LeDoux, 1986 Neurobiology of Emotion). [14]”
The nature of interaction requires the existence of a mechanism which processes “the inputs from the sensory organs [14]” When you touch the keyboard or click the mouse, press the Esc button, put a CD in the driver etc. the hardware connections, Interrupt Request Lines that carry this “sensory signal” instinctively work and trigger the interrupt controller, analogous to the amygdala…
The interrupt controller trigs the operating system very similar to the senses trigging emotions. The normal cognitive processing comes to a halt and the operating system runs the related interrupt service routine, which has a label analogous to Weyle’s “feel”… When the interrupt service routine does the task, for example writing to the disk, then returns back information about its success…
By the way, when the computer writes to the disk some trembling and noise indicate a similar situation to human “arousal”…
Aesop’s fable says; the fox tries to reach the grapes on the wine, but it can not. He says “They are sour anyway.” Sartre suggests “in emotion it is the body which, directed by consciousness, changes its relations with the world in order that the world may change its qualities. [15] ” When the computer meets a situation that it can not healthily handle, for example a division by 0, it issues a division exception and diverts the program execution to the related interrupt handler rather than abnormally ending…
Our initial question was “Do computers feel?” My answer is ‘no’ because they can not express their feelings with the same “feels” as humans, such as anger, fear. On the other hand, computers do have an embedded interrupt and exception system in soft and harware which is analogous to the human emotional system…
Then if my answer is ‘no’, why did I write this article with such an ambition? Because, the question “Do computers feel?” is wrong … A not so bad question chould be “Why don’t computers have emotions like us?” After all, it is us who have created computers with the knowledge and wisdom passed down from the distant past… Many man-years have been spent to create operating systems but relatively less on the effects of it on its users.
Large and complex systems such as ATC systems demand long duration high concentration working from engineers and controllers. I wish “Computers could feel” so that their users do not lose their feelings working with them…
Ali Rıza SARAL is an Electronics Engineer(ITU), composer(ISU) and a former civil servant of EUROCONTROL (European Agency for the Safety of Air Navigation) Software Team Karlsruhe. He has cured 24 documented Operational Deficiencies of the German KUIR airspace which includes Frankfurt.
REFERENCES:
[1] Strongman, The Psychology of Emotion, p. 1.
[2] Calhoun, Solomon, What is an Emotion, p.152, Dewey, The Theory of Emotion.
[3] Calhoun, Solomon, What is an Emotion, p.97, Hume, A Treatise of Human Nature.
[4] Calhoun, Solomon, What is an Emotion, p.174, Schachter and Singer, Cognitive, Social, and Physiological Determinans of Emotional State.
[5] Cornelius, ‘The Science of Emotion’, p. 23.
[6] Brian Bayly, The Brain’s Internal Reward from Matching, p. 1.
[7] Pronin, Wegner, Manic Thinking, Independent Effects of Thought Speed and Thought Content on Mood.
[8] Winkielman et al., The Hedonic Marking of Processing Fluency: Implications for Evaluative Judgment, p. 191.
[9] Winkielman et al., Affect and Processing Dynamics, Emotional Cognition, from Brain to Behaviour, p. 120.
[10] Cornelius, ‘The Science of Emotion’, p. 224.
[11] Calhoun, Solomon, What is an Emotion, p. 192, Freud, The Unconscious.
[12] Strongman, The Psychology of Emotion, p. 3.
[13] Daniel P. Bovet, Marco Cesati, Understanding the Linux Kernel, Interrupts and Exceptions, p. 96.
[14] Cornelius, ‘The Science of Emotion’, p. 226.
[15] Calhoun, Solomon, What is an Emotion, p.247, Sartre, The Emotions: A Sketch of a Theory.
My Address:
Ali Riza SARAL
Barbaros Mah. Sedef Sk. 13/13
Uskudar / ISTANBUL
TURKEY
Tel: 0090 (216) 474-8818
e-mail: arsaral(at)yahoo.com
DO COMPUTERS FEEL? (3000 words)
To Dr. David Williams of ORAT-ISU
Does computer feel? Does computer have emotions? Does computer feel joy, love, anger, fear, happiness, guilt, sadness, embarressment, hope and many other emotions? Is the effect of the feelings of computer on its behaviour “pleasent or unpleasent, mild or intense, transient or long-lasting, and as interfering with or enhancing” [1] ? Do computers ‘experience emotions’? Do they react toward things in the environment that have such emotional qualities as frightening, cheering and saddening?
Dewey [2] defines emotion as a composition of (1) a “feel“ (the feeling of fear, pride, humility, etc.), (2)purposeful behaviour (3) an object that has an emotional quality. He describes the so-called
expressions of emotions as ‘the reduction of movements and stimulations originally useful into attitudes”. These reductions are grouped as “servicable associated habits”, “analogous stimuli”, “antithesis”, and “direct nervous discharge”.
Hume [3] states “pride and humility, tho’ directly contrary, have yet the same object. This object is self, or that succession of related ideas and impressions, of which we have an intimate memory and consciousness”. “the passions either take place alternately; or if they encounter, the one annihilates the other, as far as its strength goes, and the remainder only of that, which is superior, continues to operate upon the mind”. “we find, that a beatiful house, belonging to ourselves, produces pride.” “a quality I discover in these passions is their sensations, or the peculiar emotions they excite in the soul, and which constitute their very being and essence. Thus pride is a pleasent sensation, and humility a painful; and upon the removal of the pleasure and pain, there is in reality no pride nor humility.”
Schachter [4] states “an emotional state may be considered a function of a state of physiological arousal and of a cognition appropriate to this state of arousal. The cognition, in a sense, exerts a steering function. Cognitions arising from the immediate situation as interpreted by past experience provide the framework within which one understands and labels his feelings. It is the cognition which determines whether the state of physiological arousal will be labelled as “anger”, “joy”, “fear”, or whatever.”
Many more definitions of emotions have been made through the history beginning with 2nd century BC, Aristotle. Descartes, Spinoza, Hume, Darwin, James, Cannon, Dewey, Schachter, Singer, Freud, Brentano, Scheler, Heidegger, Sarte and many others… Hoping to have enticed you to a wonderful journey in these precious people’s works I would like to repeat my initial question once more...
Do computers have an ‘inner’ sentimental world? Too difficult to answer quickly… May be we should change the question a bit… Does any being except the human have feelings? Maybe the better: Do animals have feelings? In his ‘The Expression of Emotions in Man and Animals,’ Darwin writes “most of the expressions and gestures involuntarily used by man and lower animals, under the influence of various emotions and sensations.” You can find “Some of Darwin’s illustrations of familiar emotional expressions in animals [5] ” in Cornelius’s book ‘The Science of Emotions’.
None of the animals can speak like us. Neither can they say “I feel sad.” Nevertheless, when a cat or a bird approaches a person sitting at a garden caffee, it bends its head to the ground and imitates as if it eats something. A careful observer or a tender person with compassion understands or feels that the animal needs food. Animals can communicate their needs. The problem is, most of us do not percieve the messages they are able to give. We do not get nervous in front of a loud speaker playing music but many get afraid when a dog says simply a’hello’ just using his very limited vocabulary and powerful vocal tract.
We should not judge neither animals nor computers as insensitive because they can not express themselves with the same emotional vocabulary as us the human-beings. In order to percieve whether computer has feelings or not its emotions have to be easily percievable by us, namely we should share more or less the same ‘feels’ with computers as in animals. We can not percieve the emotional expressions of computers easily.
Does this situation provide enough validity to the claim that ‘Computers do not feel’? Is there something wrong here ethically? Do we loss anything because of this silent assumption in our relations with computers? Are the Human Computer Interaction classes in many universities well equipped or even down-played as not technical enough? Why do many engineers and large system operators suffer from long duration high concentration jobs in front of their computers?
Indeed, computer does not have a face. A face like a human or even a mammal. It does not have eyes, ears, a skin, a head or a body… Wait a minute… Are you sure? Are you sure that computers can not see, hear or touch? What about scanners, microphones, keyboard, power-on button? Don’t they provide the similar functionality as eyes, ears, skin… Computers do have many functionalities that basic human senses provide.
Computer has a head, that you can look into its face, namely the monitor, or a body that supports its being, namely the case or box that contains the mainboard. The problem is that they do not appear to our eyes as we are conditioned to see as a head or a body… Microsoft has invented a solution to this problem… They have a sweet doggy appearing at the side of the directory search. The doggy itches the ground or searches something in a book… It can express curiosity because it has a face… Microsoft uses the dog image to express the emotions of the computer during directory search. It has a healing effect on the user… It makes the user smile and lose concentration for a short while…
* * *
The crux of the issue of ‘Do computers feel?’ is: Is it possible to think without feeling? Can cognition exist without emotions? The pith of the matter is this. Can you think even mathematics without feelings? Can you study mathematics without feeling anything? Even if we assume that you really did not feel anything while solving a problem, but after that you will need to discharge the unused mental energy in some way. Besides, you will experience pride or humility depending on your success.
Even if you have become a great ‘professional’ who has the power to control everything, you must experience feelings when you are working in a cognitive job, like programming or air traffic control… [6] “ A spasm of pleasure can arise without any external stimulus, purely by operations within one’s own brain. For example, a person who has just woken from sleep may have an insight and experience a spasm of pleasure arising from it. The insight is cognitive, with neural correlates largely in the cortex, whereas the spasm of pleasure, physiologically quite separate, is largely subcortical.” As a finite human being you can not avoid the pleasure from simple matching [6] . Otherwise, you may be working against the nature of thinking and you may hurt yourself mentally.
In fact, even the thinking process itself creates emotions without any external inputs and it does so independent from the things you think [7] . Winkielman [8] et al. states “affective responses may also result from the dynamics of information processing itself.” “Fluency with which one can extract information from the presented stimulus is hedenocially marked. High fluency elicits positive affective reaction.” “ease of processing is consistently associated with more positive evaluations. [9] ”
Our feelings about our thinking process helps us to complete missing data or speed up our thinking process. “the fluency signal may be connected to affect by indicating the state of the ongoing processing operations. Thus, high fluency may indicate progress toward successful recognition and trigger positive affect due to the reinforcing value of maintaininfg the current, successful cognitive strategy and the ability to free resources for other tasks. [9] ” The link between the metacognitive system and the affect system is further supported by neuroimaging and elektropysiological data [9] .
It has been proved that brain’s parts related to metacognitive regulation and emotion processes or emotional control are the same [9].
The mechanics of the thinking process is affected by our emotions. Switching from one context to another, the rate of changing subjects, the amount of concentration, the depth of thinking through different abstraction levels, getting obsessed to solve the problem, thinking speed are dramatically affected by the affective situation we are in while thinking… “The various glands of the endocrine system release hormones into the bloodstream that have effects on specific sites in the brain, including those involved in emotion” says Cornelius [5] . A careful observer can notice that there are different working speeds of thinking in our brains. Our brains work in a slow mode when we are doing something related with safety or security(but not related to emergency) where as our ideas fly when we are doing something sentimental or dreaming… Thinking speed helps us to switch from one processor to another in our multiprocessor brain. Feelings and selecting the right mood help us to choose the right processor (or combination of processors) to do the ‘thinking’.
Let’s ask another question from the other side… Are feelings only a by-product of the thinking process, cognition? No. If you please read Schachter’s definition at the beginning of this article once more, you will notice that ‘physiological arousal’, trembling, increase in the blood temperature, heart rate etc. are also part of emotions. Also the instincts play a vital role besides the cognition element.
By observing human behaviour we can only notice that there is an intimate relation between emotion and cognition. We can go further by enhancing our sometimes ampirical experiments with today’s advanced neurological imaging techniques…
* * *
The main problem is to define ‘What is cognition?’ and ‘What is emotion?’ inorder to understand the character of the relation between them… Freud states “ideas are cathexes-basically of memory traces- whilst affects and emotions correspond to processes of discharge, the final manifestations of which are percieved as feelings. [11] ” He also adds “Even within the limits of normal life we can recognize that a constant struggle for primacy over affectivity goes on between the two systems Conscious and Unconscious, that certain spheres of influence are marked of from one another and that intermixtures between the operative forces occur. [11 ”
Hinde asks “the common view of emotion as a state has many attendant problems. Is it a motive or a trait? Is it an intervening variable or a hypothetical construct? [12] ” and argues that “emotion is best defined in terms of chains or loops with emotion and cognition closely linked. [12] ”
Strongman states “Emotions has sometimes been analysed as an intervening variable, anchored to observable stimuli and responses.”
I believe, any person who has studied data structures and computer architecture, can come to a similar conclusion after reading this article upto this point and maybe reading the references the better… Namely, a conclusion on the question of “Do computers feel?” Let’s have a look at the LINUX operating system books…
“An interrupt [13] is usually defined as an event that alters the sequence of instructions executed by a processor. Such events correspond to electrical signals generated by hardware circuits both inside and outside of the CPU chip.” “As the name suggests, interrupt signals provide a way to divert the processor to code outside the normal flow of control. When an interrupt signal arrives, the CPU must stop what it's currently doing and switch to a new activity;” “Each hardware device controller capable of issuing interrupt requests has an output line designated as an IRQ (Interrupt ReQuest). All existing IRQ lines are connected to the input pins of a hardware circuit called the Interrupt Controller, ”
“The Intel 80x86 microprocessors issue roughly 20 different exceptions. The kernel must provide a dedicated exception handler for each exception type. For some exceptions, the CPU control unit also generates a hardware error code and pushes it in the Kernel Mode stack before starting the exception handler.”
If we make an analogy between Dewey’s definition of emotion and work on the example of a touch to the keyboard; (1) the “feel“ (the feeling of fear, pride, humility)’s name is keyboard interrupt
(2)purposeful behaviour is the interrupt handler program of the LINUX Operating System (3) an object that has an emotional quality is the person who touches, namely the user. Freud states “certain spheres of influence are marked of from one another” in my above quotation from his article ‘Unconscious’. Which is analogous to “As the name suggests, interrupt signals provide a way to divert the processor to code outside the normal flow of control.” in my quotations from LINUX manuals. Dewey’s classifications of emotions have many similarities to interrupts and exceptions which also have different types. Dewey’s “Calm and Violent emotions” vs. soft and hardware interrupts… It is impossible to tell all the similarities between the interrupt processing subsystem of the computer operating system including the hardware architecture and the human emotion processing.
The basis of the similarity between the human emotional system and the computer interrupt system arises from the very nature of cognition. Cognition can not exist without some sort of interaction with living matter. The ideas in this article can not exist without being written on some sort of interaction media, may be a newspaper the better. By that, the journey of emotions begin, the reader holds the newspaper, maybe smells it, reads it and likes or even loves an article and binds to the newspaper with devotion…
Cornelius [14] outlines the results of recent neurophysiology research in his book “The Science of Emotion” in 10 pages. His book could outline the rest of all the past studies in 210 pages…
So if you want to have the answer of our question with his style in terms of physiology: “Both the hippocampus and amygdala are complexly interconnected with inputs from both the sensory organs and the viscera. They also serve as the origin of projections that connect them with Autonomic Nerve System as well as higher cortical areas. They, and perhaps other structures of the lymbic system, appear to integrate sensory information with information from the various organs of the viscera as well as feedback from the ANS to control the “output” of emotional expression in the ANS and other parts of the nervous system (LeDoux, 1986 Neurobiology of Emotion).”
The nature of interaction requires the existence of a mechanism which processes “the inputs from both the sensory organs. [14]” When you touch the keyboard or click the mouse, press the Esc button, put a CD in the driver etc. the hardware connections, Interrupt Request Lines carry this “sensory signal” instinctively work and trigger the interrupt controller, analogous to the amygdala…
The interrupt controller trigs the operating system very similar to the senses trigging emotions. The normal cognitive processing comes to a halt and the operating system runs the related interrupt service routine, which has a label analogous to Weyle’s “feel”… When the interrupt service routine does the task, for example writing to the disk, then returns back information about its success…
By the way, when the computer writes to the disk some trembling and noise indicate a similar situation to human “arousal”…
Aesop had told once upon a time a fable about the fox and the grapes; the fox tries to reach the grapes on the wine, but it can not. He says “They are sour anyway.” Sartre suggests “In short, in emotion it is the body which, directed by consciousness, changes its relations with the world in order that the world may change its qualities. [15] ” Isn’t it the same with computers? When the computer meets a situation that it can not healthily handle, for example a division by 0, it issues an exception of Divide error and diverts the program execution to the related interrupt handler rather than abruptly stopping…
Our initial question was “Do computers feel?” My answer is no because they can not express their feelings with the same “feels” as humans, such as joy, love, anger, fear, happiness, guilt, sadness, embarressment, hope usw. On the other hand, computers do have an embedded interrupt and exception system in both soft and harware which is analogous to the human limbic system…
Then if my answer is no, why did I write this article with such an ambition? Because, “Do computers feel?” is a wrong question… The right question should be “Why don’t computers have emotions like us?” It is us who have created computers together with the knowledge and wisdom passed to us from the distant past… We are the human-being who spend many man-years to create the operating systems but think very little on the effects of it on its users.
Large and complex systems, air traffic control systems and similar jobs demand long duration high concentration working from today’s engineers and system operators. Not to mention, the new growing engineers, toddlers who spend many hours on their computer games everyday… Have you noticed every soldier killed on the computer game, has to die convincingly, thus takes some time so that the kid’s concentration relaxes a bit in the mean time…
On the Christmas of 2008, I wish “Computers could feel” so that their users do not lose their feelings working with high concentration for long hours…
Ali Rıza SARAL is an Electronics Engineer(ITU) and a former civil servant of EUROCONTROL Software Team Karlsruhe. He has cured 24 Operational Deficiencies of the German KUIR airspace which includes Frankfurt.
REFERENCES:
[1] Strongman, The Psychology of Emotion, p. 1.
[2] Calhoun, Solomon, What is an Emotion, p.152, Dewey, The Theory of Emotion.
[3] Calhoun, Solomon, What is an Emotion, p.97, Hume, A Treatise of Human Nature.
[4] Calhoun, Solomon, What is an Emotion, p.174, Schachter and Singer, Cognitive, Social, and Physiological Determinans of Emotional State.
[5] Cornelius, ‘The Science of Emotion’, p. 23.
[6] Brian Bayly, The Brain’s Internal Reward from Matching, p. 1.
[7] Pronin, Wegner, Manic Thinking, Independent Effects of Thought Speed and Thought Content on Mood.
[8] Winkielman et al., The Hedonic Marking of Processing Fluency: Implications for Evaluative Judgment, p. 191.
[9] Winkielman et al., Affect and Processing Dynamics, Emotional Cognition, from Brain to Behaviour, p. 120.
[10] Cornelius, ‘The Science of Emotion’, p. 224.
[11] Calhoun, Solomon, What is an Emotion, p. 192, Freud, The Unconscious.
[12] Strongman, The Psychology of Emotion, p. 3.
[13] Daniel P. Bovet, Marco Cesati, Understanding the Linux Kernel, Interrupts and Exceptions, p. 96.
[14] Cornelius, ‘The Science of Emotion’, p. 226.
[15] Calhoun, Solomon, What is an Emotion, p.247, Sartre, The Emotions: A Sketch of a Theory.
HOW TO PREDICT AIR MISSES
HOW TO PREDICT AIR MISSES
by Ali R+ SARAL
ABSTRACT : A method to predict the number of air-misses in a certain time duration and region based on performance, reliability, complexity and weather factors of an Air Traffic Control system.
KEYWORDS : ATC, air traffic control, vertigo, metrics, airmiss
ADDRESS: Ali R. SARAL
Barbaros Mah. Sedef Sok. Onur Sit. 13/13
Uskudar ISTANBUL
TURKEY-(TURKIYE)
MAIL ADDRESS: arsara(at)yahoo.com
TELEPHONE: 0090-(216)-474 8818
It is fatally important to ponder on the issues of Air Traffic Control (ATC) where the development pace of the available technologies may have overcome the development of the systems available and the belief in the unity of support to the people in the air is incidentally hurt in the wake of the recent air traffic accidents. I believe it is critically important to have the scientific communities' support and wide contribution in order to overcome the challenges that are coming ahead, the difficulties in the cooperation of Short Term Conflict Alert displays this alone.
This article proposes a prediction method to find the number of air misses in a given duration of time in a certain region. If it is applied concurrently and coherently it may point at where the first accident lying ahead is likely to happen. It depends on the fair and precise measurement of the controllers', ATC centers', airlines', technical support and systems' performance factors and the weather factors. The details of these metric values may be the subject of another article.
Air traffic control (ATC) system is a dynamic system. ATC system's behaviour changes through time according to the changes in the input and system parameters. In fact, 'the evolution of ATC system in time depends on the complex interactions of the timing of various discrete events' (1), such as the entry of many aircrafts in a certain period of time into a certain control region and the exit flowing rate of these aircrafts and how the ATC system reacts to this traffic both psychologically on the control team basis and the availability of the technical infra-structure of the system as a whole.
A mathematical model of an ATC system is given in equation [1]. This equation provides a metrical method, which may help to overcome the 'vertigo effect' of ATC, namely 'the false sense of safety'. Similar to any metrical value this equation may help to indicate the direction if not the value of the change of safety in the air provided that it is applied with vigorous consistency.
a*c
amiss = [ 1 - K * p * r * (1 - e * w ] * trd * dur (1)
amiss # of air misses for dur
trd average # of flights per day for the controlled duration and region [real num / day ]
dur total flight duration
p performance factor
r reliability factor
c complexity factor
w weather factor
K is a constant determined by the complex interaction of p, r, c, w. It reflects the composite effect of these factors. K can be determined and improved by using legal recording and other data.
a is a constant that determines the sensitivity of the traffic problem domain to the complexity of the ATC system. It may be determined heuristically in the beginning.
p,r,c,w are assumed constant for dur
0 < p =" 0," p =" 1," r =" 0," r =" 1," c =" 0," c =" 1," w =" 0," w =" 1" s =" amiss" safety =" number" s =" [" f =" amiss" size="1">NOTES
1- p(t) indicates performance factor which is calculated from the daily measurement of the control center, airlines and the airport performances.
2 - r(t) indicates the reliability of the ATC center availability or some of its facilities, the reliability of the airlines and the airports.
3 - c(t) indicates operational complexity such as route complexity, operational complexity and the technical system soft-hardware and support-development complexity.
4- w(t) indicates the risk affect of repeated or random weather difficulties in the controlled region.
REFERENCES
(1) Yu-chi Ho, "Performance Evaluation and Perturbation Analysis of Discrete Event Dynamic Systems", Transaction on Automatic Control, Vol. AC-32, No.7, July 1987
(2) Paul M. Frank, "Introduction to System Sensitivity Theory", Academic Press, New York, ISBN 0-12-265650-4
(3) Deutsche Flug Sicherung Presseinformation, Offenbach, 2 July 1996
(4) Rules for the Air and Air Traffic Services (Doc 4444 inter alia)
(5) The Karlsruhe Operating Data System EUROCONTROL
ABOUT THE AUTHOR
Ali R+ SARAL holds a M.Sc. (1985) degree in Electronics and Telecommunication Engineering from Istanbul Technical University, Istanbul, TURKEY and a second M.M. degree (1992)in Music Theory and Composition from Illinois State University, Normal, Illinois, USA. He has worked as a systems programmer in major banks and holdings in Istanbul and has served 5 years to the European Organisation for the Safety of Air Navigation (EUROCONTROL) as a senior analyst programmer. The Operational Deficiencies he has fixed in concurrence with his colleaques' other works have contributed to the safety of people in Germany inter alia. Currently, he teaches at Yeditepe University, Istanbul.
MATCHING – THE ROLE OF EMOTIONS IN ENGINEERING
You may wonder what relation do emotions have with engineering… Engineering is considered mostly in relation with mathematics and other positive sciences. This misconception arises from the wrong systems definition that we use to make. A system may roughly be defined as a structure that produces certain outputs for certain inputs outcome of which may be affected by some distortions from the environment. Although there exists a user in the real life which is excluded in this definition…
The inclusion of the user to the definition of the system may become a necessity in some cases. The complexity or largeness of the systems that are used requires the inclusion of the user to the system design. For ex. the safety and security of an airplane depends largely on the flight crew.
Thus the design of the system is designed according to this phenomenon.
An Air Traffic Control system, a nuclear reactor or even a traditional electric reactor, any system of which safety or security is vital depends on a single main human feeling: TRUST.
The pilots have to trust the air traffic controllers, the controllers have to TRUST the control devices and the engineers who develop and maintain them. The difficulty is not in assembling an electronic device box or running an assembler program but to BUILD THE TRUST of the users to this box or program.
Indeed, if you think a little bit, you may share the idea that, even though it is never expressed explicitly, from requirements to delivery and, from the calculation of costs to long term maintenance and enhancement, all over the project lies small and large, many conditions, suggestions and advises related to TRUST.
A good and successful engineer is one that you can easily trust, one that works like worshipping, one whose word is always true and when it is not, one who makes all the sacrifices to make his word come true with dignity, one who has no lies, no tricks, no guiles, one that can never be bribed, one does everything in his hand not to bribe and when he is obliged to do so one who knows very well that bribing hurts his very own efforts. Bribery and other kinds of social decay hurts first of all the feeling of TRUST in LARGE SYSTEMS and the projects that develop them.
When inspected closer, it can be easily seen that emotions such as fear and compassion may play secondary but important roles in some of the engineering projects… These effects can be observed in the behaviour of the teams at the end of the big projects or in the behavioural patterns of people performing jobs that may affect the lives of many people… The management of a project is not the application of some patterns such as MIL498, ISO12207 in a ‘military style’ without understanding their spirit.
The ability to control the motivation of a team and to lead it successfully through an engineering project lies in managing the emotions of that team. If you suggest otherwise, I would like to pose this question to you: The job is exciting, the payments are satisfying, then why do some of the engineers commit suicide?
You can find the name of a vitally important article related to this subject below at the end of my article. You may not only find the basis of some of my opinions above, but also health problems related to concentrating too much for too long durations, etc. which are related to the affective fundementals of large systems psychology. I will be concentrating on affections – affective disorders etc. subjects related to emotions in engineering in the near future.
Of course, belongs the last word to CONSCIENCE… European Organisation for the Safety of Air Navigation(EUROCONTROL)’s civil servant evaluation form which is filled every two years, has 12 items. One of these 12 items is ‘professional conscience’. May the forthcoming LARGE SYSTEMS companies of our ountry not forget the ‘professional conscience’ in their personnel evaluations. May our country not ‘give herself up’ to the European Union just for realizing this kind of simple things…
Ali R+ SARAL
Note: Please continue to Brian Bayly’s The Brain’s Internal Reward from Matching which you can find on the Internet. I have done a Turkish translation and editing of this article also. You may find it in the same blog. It resides here in the Turkish version.
THE DEVIATING MIND
To Mr. Ahmet ARZIK,
Brain is one of our organs which does not have the ability to move. Think of the brain’s functional development during the process in which a new born grows up to become an adult. Our brains develop from the cognitive level of a little ‘snail’ which moves with its nutrition instinct, to a chess master who challenges a supercomputer…
What surprises us is not solely the impressive amount of change that our cognitive abilities undergo in our personal development process… This organ of ours which can not even move by itself, can deviate itself in a matter of a season, a couple of days or a few seconds because of the changing environment or its own inner conditions. According to our mood may this organ remember what it likes or forget what it does not, namely it deviates our remembering ability depending on the subject, it certainly does not work very well in hot summer days, on the other hand ina state of emergency, your brain orders your body to make the correct move in a much shorter time than you can consciously decide...
If we look in our cognitive activities closely, we can notice a complexity rising from variety and adjustability. This complexity increases because of the variety and uniqueness of each adult person’s individual solution in comparison to many others… ‘No two fingers of a single hand are the same’. On the other hand, ‘Every person is different but not different from all’…
The fact that our brains have many different abilities, gives us the possibility of creating our cognitive functions one by one through different combinations of these abilities. For example, a not very well educated person can still make quick and correct decisions with his/her feelings and instinct. University language preperatory school English teachers can at least handle ‘sharp’ students who have got much higher grades in the university entrance exam than them, with their teaching experience and knowledge. Our cognitive abilities can not only change depending on the mental, social and physical conditions but they also vary from person to person. The effect of his/her family’s child upbringing, the individual’s knowledge and experience reservoir, the point he/she stands in life, creates variety between individuals and how they survive in the competition to be successful.
Society and individuals reduce the difficulty of problems they meet by converting them to easily percievable models. Even to a single symbol or figure... In this process our brain is sometimes reduced to a small black box by the model makers. Society has the tendency to group everything related to cognitive ability under the title of ‘intellect’… Also, if a person is ‘sharp’ he/she is frequently considered to be so always and under all conditions whatsoever…
Everyone of us takes an important exam at one stage of his or her life. We all remember the level of ‘intellectual sharpness’ or acuteness we have reached during our preparations. On the other hand, there may be moments you may have difficulty to utter even a single word after you wake up in a hot summer morning. Then, which of these two people is you, yourself? The ‘sharp’ or the ‘moron’? The answer is ‘None of them solely’. Then what is wrong about the question? The mistake is in the way we look at the cognitive abilities of human-beings… We should never forget that, even though our brain can not move an inch by itself our mind does not have a static and frozen architecture or capacity. Our brain manages to cope with changing situations not by changing its location but by deviating its own self.
A person’s mental abilities change according to its age, the situation he is in, the current subjects he deals with and many similar factors. If an experiment were made, even the sharpest person on earth might not be able to make the right decision if he were being interrogated as a prisoner of war or if his airplane lose one of its motors at 10000m’s altitude, given that he does not have the necessary training and experience… Moreover, even if he had the knowledge and experience to do so, he might still not be able to make the right decision in some cases, because the professional human brain can not stay as constant as it were when it took the qualification exam…
When the architecture of the human mind is inspected, an anatomical and biological wealth can be observed underneath its functional variety. It is not a wonder such a complex living architecture can create personalities with extraordinary abilities… The most wonderful is the fact that brain is able to provide the human-being everything needed to cope for its complex social and individual challenges.
The complexity of our brains is reflected in the way we percieve and interact with things and other people. Designing tools and systems to be used by humans requires to handle this complexity in a simplified way. Faced with any complexity, we tend to make abstractions. Abstractions not only reduce the number of the things we are concerned but also limits the domains of their items. This also applies to our approaches to the complexity of our brains.
Wickens Information Model is developed to calculate how long it will take for the user to respond to an input. The below given depiction has got so much popular that it has gained a function similar to the model that describes to primary school kids the creation of seasons based on the so called ellipse shaped path of earth around the sun.
The Wickens Information Processing Model was created to provide a convenient method to calculate the response time of the user to a signal from a system.
………………….Attention Resources
Perception……………………Cognition…………Motor
(transfer to ……………….(math,decide,…………Response
working memory)………...memory transfer)
Short term sensory store……Long term memory
Visual Image Store………….Dltm=infinity
Dvis=1500[900-3500]msec…Mltm=infinity
Mvis=5[4.4-5.2]letters………Kltm=semantic
Kvis=Physical
Auditory Image Store…….. Working Memory
Daud=200[70-1000]msec….Dwm=3[2.5-4.1] chunks
Maud=17[7-17]items………Dwm(1chunk)=7[5-9]chunks
Kaud=Physical……………..Dwm(3chunks)=7[5-226]sec
……………………………...Mwm(1chunk)=73[73-226]sec
………………………………Mwm(3chunks)=7[5-34]sec
………………………………Kwm=Acoustic or visual
Transfer durations:
(Perception)--->100msec(cognition)-->70msec(motor)->70msec
- Attention resources are used in all three stages..
- D = decay, M= residing duration in memory, K= representation format of the information
(EBERTS, Prentice Hall, User Interface Design, sayfa 166).
An other name of this model is Discrete Stages Model. The contributions of the Wickens Model may be outlined as:
1. Perception does not happen in a single moment. On the contrary, human processes the inputs and a functional transformation (for ex. from visual to semantical) happens.
2. Processing information requires time. The time that passes between the moment input comes and human responses is called the reaction time.
3. The mental timing of events that happen in a single response process. The nomenclature of the stages, durations and the definition of operations or transformations done in each stage.
4. Transformations related to the presentation of information.
5. Limits that do exist in the time and quantity domains.
6. The unit of information. Miller’s seven plus/minus two rule is alluded above in the working memory. This also points at the effect of the gained experience on the size of chunks and thus determines the perception speed.
Today, all sorts of references to this model, are not limited to engineering books as it should. Many other psychology related books refer to this model or at least have similar approaches although this model is created primarily for guessing the response time of the human to certain systems.
In this model, there are visual and auditory image stores in the short term perception memory. When we think of memory we tend to imagine a single area or even a single organ. In fact, our brain is composed of many sub-structures and sub-functions, or sub-processors as in the computer nomenclature. The visual store should be located somewhere related to the visual part of the brain and auditory memory likewise…
Wickens model states that any information written into the longterm memory is never erased.
This does not mean that, that information is accessible. Commonly established belief is ‘our memory works linearly’. On the contrary, experiments have shown that we can remember some parts of the past better than others. For example, we may remember 30-40 year old events better than closer events in the past. Our memories do not work linearly on the time basis.
Our memories have an addressing mechanism which is triggered by content. Human memory is a marvel on one hand and an enigma on the other because of its non-linearity… The complexity of social events may be explained by the complexity of the minds of people who create them and the way their minds work… Writing to the memory and access to it is determined not only by content but also the environment, the mood, etc. Our memories’ refreshing mechanism is also not linear… It is a scientificly proven fact that a person who remembers a bad event in the past tends to remember bad things after this… An other example for the content triggered addressing mechanism is the fact that we can remember things related to ourselves better than other things…
The basic speciality of the Wickens model is the transformation of the information’s presentation format. For example, a figure percieved by the eye is stored in the visual image store in the physical format but transformed to the visual format when passed to the working memory…
It is the most reasonable approach to assume that these physically percieved information are accessed in the working memory through some buffer zones. This also implies that the working memory does not have a homogenous function as commonly assumed. The saying that people working under heavy mental load ‘can not see or think anything else than their work’ has a piece of truth in it. The increased mental load causes temporary changes in the memory usage. These people become forgetful or get easily distracted when doing even simple daily things. The reduction of perception abilities of people working under heavy mental load can be attributed to the reduction of input buffer space by the working memory to increase space for logical etc. cognitive tasks.
A common misunderstanding in the society that is fostered by the Wickens model is that human memory is a uniform single structure. For example the episodic bellek which is located in the frontal part of our brain is a special memory that helps to form the sense of time and reality. Episodic memory keeps track of events and provides information about sequence, duration, reality to the general use of our brain. People who work under heavy mental load frequently forget what they have done. They first take a book from the table and put it on the bookshelf, then a few moments later they forget what they have done and try to put the book on the shelf again, thus they can not find it on the table. While working at EUROCONTROL Software Team Karlsruhe, Chritian PETIT who was working on a difficult task in a terrible political climate had told me ‘This is a natural situation, I can not remember the color of the traffic light after I pass them while driving’ as an answer to my similar complaints.
If we study this example closely, with the assumption that the episodic memory has a buffer;
the events that have happened should have been written to the buffer in their happening sequence… If the working memory is overloaded during the events, the memory allocated to the episodic memory buffer is deallocated and put in the service of general purpose or other working memory. As a result of this the working memory allocated to the episodic memory buffers is cancelled or dramatically reduced. In this case, the mentally overloaded person can not remember an event which has happened a few moments ago, because the episodic memory input buffer related to that event has been erased and used for some other purpose.
An other example to the case of mental overload reducing the perception is: a person driving an automobile, airplane or any system loses control of command due to the increase in his reaction time caused by mental overload(mostly talking). A special case related to this situation is air traffic controllers making mistakes while working with divided attention (Investigating Controller Blindspots, Dr. Barry Kirwan, HINDSIGHT 5 – July 2007 ). When dealing with a difficult situation with a relatively calm background , the controllers have to focus on the high priority troublesome situation but after fixing this problem they should remember the cases in the background. Unfortunately in some cases it has been observed that after the primary problem is solved, some of the secondary problems related to the general situation have been completely forgotten and thus they have caused other important problems. The problem is the same as in the example of Ray EBERTS’s, User Interface Design book of a driver not hearing the radio when the traffic gets dense… I believe, the problem is not inability to percieve but the insufficiency of working memory resources(input buffers) which enables the resolution of the perception process in the consciousness.
Let’s study the hypothesis of mentally loaded person’s perception deficiency reversely. A person whose perception is heavily loaded should have reduced or weakened cognitive(logical, decision making etc) functions… Let’s imagine a commando soldier in a commando exercise as a person whose perception is heavily loaded. Fast moving targets appear suddenly or move in front of him during the exercise. The soldier is expected to fire and hit the targets with his reflexes rather than think and make decisions cognitively. Balthazar GRACIAN alludes to an old addage in his ‘The Art of Worldly Wisdom’… ‘It is difficult to make decisions when driving a horse’. The more the percieved things, the more buffers for different inputs… If you continue to increase the inputs even more, wrong actions produced by making decisions based only on reflexes rather than judgement appear. We end up with incidents such as the 1992 incident when an American pilot fired at an helicopter which carried American and Turkish officers.
An other aspect of this subject is how much should the system user be loaded when designing complex screens such as radar displays. Displaying every information spatially makes the access to them easy but the designers’ general tendency is to abuse this principle. The requirements creep also fosters this tendency… The output of these wrong tendencies is visually overloaded screens. The overloaded screens is developing at the expense of losing and leaving the judgement ability of the large systems or air traffic controller out of function… The large system controller is turning out to be a simple sensor that reacts rather than judges and decides…
Contrary to this phenomenon, Situation Awareness should depend on human mind’s variable thinking depth, variable thinking speed and ability to think with things it does not know or remember, its multi-processor pseudo-god control ability which directs its conscious-subconscious balance.
I tried to drive your attention to the common misbeliefs about the human mind. Besides this, I outlined the popular Wickens Model and noted some misunderstandings about it which reduces the system user to a simple sensor. I hope to be pondering on thinking speed vs thinking depth, the balance between conscious and subconscious and mental control vs automatic processes in my future articles.
An antique Hellenic philosopher has said ‘Know yourself’. A weak point of this adage is that the person or anonym persons who used this adage have at least a single self. The Anatolian-Eastern tolerance of Mevlana, although not that old, reflected in the adage ‘There is a self in myself’ would perhaps say ‘My son, be aware of yourself from time to time without any intention to do so and do not forget to feel your poor body once in a while’.
‘May your mind be fresh and be all the rest nice’.
Ali R+ SARAL
Note: Besides serving the benefit of the general public, has this article been written to be used in the education of air traffic controllers, large system operators and the engineers.
EMBODIMENT AND MAN – MACHINE INTERACTION
To my kind colleague Herr EHRENBERGER
who drew my attention to the importance of HCI
after viewing an airplane accident replay
at Karlsrue Upper Info Control Center in 1992;
Through our bodies we reach other people and the world. To speak with others, to help others, to work, to create, to love we use our bodies. We exist with our bodies. We feel our existance through our bodies…
“Behind your thoughts and feelings, my brother, stands a mighty commander, an unknown sage – he is called Self. He lives in your body, he is your body.” (Nietzsche, 1883, ‘Thus Spoke Zarathustra’ from Learning Space – OpenLearn – The Open University).
We know our body by its abilities. We can turn our hand, open it, make it a fist, move our fingers one by one etc. We can also feel every movement our hand does if we listen it. We can feel it as a whole or its parts seperately...
If a human has a hand, he or she feels more or less the same abilities with his hand and similar basic feelings… But was the hand of Rembrandt the same as mine? Was the relation of Rembrandt’s hand with his mind the same as mine? Merlau-Ponty has written “I do not simply possess a body; I am my body” in ‘Phenomenology of Perception’. Rembrandt’s hand was not simply a hand, it was Rembrandt the painter’s hand… It was Rembrandt the painter himself.
“Phenomenological theorists distinguish between the subjective body(as lived and experienced) and the objective body (as observed and scientifically investigated). My lived body is an EMBODIED CONSCIOUSNESS which fluidly and pre-reflectively engages the world. As we engage in our daily activities, we tend not to be conscious of our bodies and we take them granted – body that is passed-by-in-silence (Jean-Paul SARTRE, 1943, Being and Nothingness)”.
“Embodiment is the process or state of living in a body.” All embodiments do not need to be the embodiment of living things… An existing thing can have a body and thus can be an embodiment of an identity that can be identified… For example, water is the embodiment of all the things that identify water. An aeroplane is an embodiment of everything that identifies it; it flies, carries goods, can stand difficult climate conditions, it has a speed, it carries an accumulation of expertise and experience, it has a history, it materializes the ambitions of many individuals both in the past and today…
All embodiments do not need to be simple or single embodiments… There can be composite embodiments in the world. Composite embodiments can and do exist. Composite embodiments form when simple embodiments of things mix and act together with a new and single identity, all interacting with each other and as a virtual self…
In 1996 I listened a piano concert at Darmstadt. The program was composed of a group of extremely difficult works by a single composer. The performer was not a single pianist as usual… The pianist was embodied by two seperate and different pianists… They had prepared collectively for this concert and played the series of pieces one by one in sequence. The pianist whose turn passes listened the other pianist performing.
Having prepared together gave them the ability to perform as if there is a single performer, with his single identity, feeling and so on… Using complex embodiment gave the two pianists the ability to do the impossible and achieve the extremely difficult.
Embodiment has the gift that enables us to achieve the impossible or extremely difficult things and create new things. A person holding a hammer is a composite embodiment. A hammer and a person are seperate embodiments. A hammer holding man is a different and composite embodiment… Moreover, the person that holds the hammer experiences knocking the nail as if the hammer is a part of his body himself… Because, he is aware that he is knocking the nail with the hammer… He is hammer using man… He is the embodiment of consciousness defined and required by nail knocking activity indicated by the affordance of the hammer.
“Embodiment is the process or state of living in a body”… Some of the composite embodiments form when we use a tool. “Prothestic devices stretch the boundaries of the body. They create a continuity beyond the limits of the skin”(Carolien HERMANS, 2002, Embodiment: the flesh and bones of my body). “A body schema works on a subconscious level. It registers shape and posture of the body(without coming to awareness). It makes a record of the momentary relative disposition of one’s own body parts”. “Prothestic devices can be absorbed in the body schema. Just as a hammer in the carpenter’s hand is incorporated into his body schema, any virtual body part or interface(keyboard, mouse, joystick) can become part of the schema in a temporary or longlasting way…”
"The driving of a car. We are intimately aware of how a particular car's gearshift needs to be treated, its ability to turn, accelerate, brake etc, and importantly, also of the dimensions of the vehicle. When we reflect on our own parking, it is remarkable that there are so few little bumps considering how many times we are actually forced to come very close. The car is absorbed into our body schema with almost the same precision that we have regarding our own spatiality. It becomes an "area of sensitivity" which extends "the scope and active radius of the touch" (Merleau-Ponty, Maurice (1962). Phenomenology of Perception. C. Smith (translator). Routledge & Kegan Paul.) and rather than thinking about the car, it is more accurate to suggest that we think from the point of view of the car, and consequently also perceive our environment in a different way".(Reynolds, Jack (2002). Merleau-Ponty. Amsterdam: internet.)
Going back to the hammer example… The person holding the hammer does not feel he is holding it when he is knocking. The subjective body of the composite identity focuses on the knocking process. Holding the hammer is not very different from moving his arm and using his muscles to produce force. The hammer has become part of the body schema of the nail knocking man… If something wrong happens and this process is interrupted, then the nail knocking man becomes aware of the hammer that he is holding and changes its direction etc… The hammer becomes the objective self of the nail knocking man.
My questions are: what happens when an accident happens while a human uses a tool, device or vehicle? What happens when an executive air traffic controller is over-loaded? What is the effect of stress on the embodiment of a large system operator like a nuclear reactor? What are the psychological effects of a complex software development tool such as Rational on a large systems software developer who has to work one year on the same difficult project?
Let’s think of a race car driver… He studies the race road before the race. During the race he must maximize his speed at every and each turn or straight part of the road. He tries to adjust and catch the max speed according to the road piece he faces and the status of his car… Actually it is the road and the car that orders him to change the gear and press the gas pedal as such… The driver has the ability to set the initial and previous conditions of the car, his choices determine the past and the cumulative effect of the past determine his effectiveness on the future… This intertwining can be seen in simple holding hands also:
"If I touch with my left hand my right hand while it touches an object, the right hand object is not the right hand touching: the first is an intertwining of bones, muscles and flesh bearing down on a point in space, the second traverses space as a rocket in order to discover the exterior object in its place" (Merleau-Ponty, Maurice (1962)
If the driver forgets himself and begins to act only according to the messages he gets from the road, this may cause disaster. If the driving man identity is lost and the car which has become part of the man’s body schema takes over the control, the driver enters a turn with a speed which may be impossible for the car…
Forgetting the abilities of the system or misinterpretting them is also explained as a ‘mental model’ mistake which leads to an accident. Embodiment can explain accidents better as it provides more on the psychology of the operator and the intertwining between the environment and him.
Accidents happen because of anomalies in the embodiment of complex identities. A mistake in the embodiment of the car, and the human, such as a failing tire or a physical anomaly of the human(alcohol) will cause an accident. If the complex identity, the driver becomes too dominant, such as the drive to achieve a goal as a driver, and causes the abilities of the car and the driver as seperate embodiments to be forgotten, also accidents happen. Mistaking identities or losing, forgetting them causes the failure of the complex identity.
The successful operator is the one who can find the ultimum balance between the identities of the complex embodiment, namely the simple selves and the complex itself with in the prenoetic limits.
Driving a car or operating any system requires the operator to arrange his priorities… His priorities to take care of the simple embodiments as the car, its status, gas, oil etc… As the human being, tiredness, sleep, etc. as the complex embodiment, the driver, cruising speed, road status, possible obstacles etc…. Driver, the complex embodiment has to create a special consciousness to be successful. This conscioussness has to be subjective… You can not do all of these continiously with full concentration.
If we go back once more to SARTRE;
“Phenomenological theorists distinguish between the subjective body(as lived and experienced) and the objective body (as observed and scientifically investigated). My lived body is an EMBODIED CONSCIOUSNESS which fluidly and pre-reflectively engages the world. As we engage in our daily activities, we tend not to be conscious of our bodies and we take them granted – body that is passed-by-in-silence (Jean-Paul SARTRE, 1943, Being and Nothingness)”.
The danger in this is, our bodies have the tendency to execute their body schemas, namely to exist, subjectively. We try to do things automatically after we repeat them for a while. An experienced driver tends to do things automatically and forgets the rules after a while…
Hence a safety related systems operator such as an air traffic controller or a pilot, must rise above its complex identity as an embodied consciousness of the human and the system and foster a special awareness of things existing around in the cockpit or the control board. This is called situation awareness by a few ‘mortals’.
Ali Rıza SARAL is an Electronics Engineer(ITU), composer(ISU) and a former civil servant of EUROCONTROL (European Agency for the Safety of Air Navigation) Software Team Karlsruhe. He has cured 24 documented Operational Deficiencies of the German KUIR airspace which includes Frankfurt.
My Address:
Ali Riza SARAL
Barbaros Mah. Sedef Sk. 13/13
Uskudar / ISTANBUL
TURKEY
Tel: 0090 (216) 474-8818
e-mail: arsaral(at)yahoo.com
who drew my attention to the importance of HCI
after viewing an airplane accident replay
at Karlsrue Upper Info Control Center in 1992;
Through our bodies we reach other people and the world. To speak with others, to help others, to work, to create, to love we use our bodies. We exist with our bodies. We feel our existance through our bodies…
“Behind your thoughts and feelings, my brother, stands a mighty commander, an unknown sage – he is called Self. He lives in your body, he is your body.” (Nietzsche, 1883, ‘Thus Spoke Zarathustra’ from Learning Space – OpenLearn – The Open University).
We know our body by its abilities. We can turn our hand, open it, make it a fist, move our fingers one by one etc. We can also feel every movement our hand does if we listen it. We can feel it as a whole or its parts seperately...
If a human has a hand, he or she feels more or less the same abilities with his hand and similar basic feelings… But was the hand of Rembrandt the same as mine? Was the relation of Rembrandt’s hand with his mind the same as mine? Merlau-Ponty has written “I do not simply possess a body; I am my body” in ‘Phenomenology of Perception’. Rembrandt’s hand was not simply a hand, it was Rembrandt the painter’s hand… It was Rembrandt the painter himself.
“Phenomenological theorists distinguish between the subjective body(as lived and experienced) and the objective body (as observed and scientifically investigated). My lived body is an EMBODIED CONSCIOUSNESS which fluidly and pre-reflectively engages the world. As we engage in our daily activities, we tend not to be conscious of our bodies and we take them granted – body that is passed-by-in-silence (Jean-Paul SARTRE, 1943, Being and Nothingness)”.
“Embodiment is the process or state of living in a body.” All embodiments do not need to be the embodiment of living things… An existing thing can have a body and thus can be an embodiment of an identity that can be identified… For example, water is the embodiment of all the things that identify water. An aeroplane is an embodiment of everything that identifies it; it flies, carries goods, can stand difficult climate conditions, it has a speed, it carries an accumulation of expertise and experience, it has a history, it materializes the ambitions of many individuals both in the past and today…
All embodiments do not need to be simple or single embodiments… There can be composite embodiments in the world. Composite embodiments can and do exist. Composite embodiments form when simple embodiments of things mix and act together with a new and single identity, all interacting with each other and as a virtual self…
In 1996 I listened a piano concert at Darmstadt. The program was composed of a group of extremely difficult works by a single composer. The performer was not a single pianist as usual… The pianist was embodied by two seperate and different pianists… They had prepared collectively for this concert and played the series of pieces one by one in sequence. The pianist whose turn passes listened the other pianist performing.
Having prepared together gave them the ability to perform as if there is a single performer, with his single identity, feeling and so on… Using complex embodiment gave the two pianists the ability to do the impossible and achieve the extremely difficult.
Embodiment has the gift that enables us to achieve the impossible or extremely difficult things and create new things. A person holding a hammer is a composite embodiment. A hammer and a person are seperate embodiments. A hammer holding man is a different and composite embodiment… Moreover, the person that holds the hammer experiences knocking the nail as if the hammer is a part of his body himself… Because, he is aware that he is knocking the nail with the hammer… He is hammer using man… He is the embodiment of consciousness defined and required by nail knocking activity indicated by the affordance of the hammer.
“Embodiment is the process or state of living in a body”… Some of the composite embodiments form when we use a tool. “Prothestic devices stretch the boundaries of the body. They create a continuity beyond the limits of the skin”(Carolien HERMANS, 2002, Embodiment: the flesh and bones of my body). “A body schema works on a subconscious level. It registers shape and posture of the body(without coming to awareness). It makes a record of the momentary relative disposition of one’s own body parts”. “Prothestic devices can be absorbed in the body schema. Just as a hammer in the carpenter’s hand is incorporated into his body schema, any virtual body part or interface(keyboard, mouse, joystick) can become part of the schema in a temporary or longlasting way…”
"The driving of a car. We are intimately aware of how a particular car's gearshift needs to be treated, its ability to turn, accelerate, brake etc, and importantly, also of the dimensions of the vehicle. When we reflect on our own parking, it is remarkable that there are so few little bumps considering how many times we are actually forced to come very close. The car is absorbed into our body schema with almost the same precision that we have regarding our own spatiality. It becomes an "area of sensitivity" which extends "the scope and active radius of the touch" (Merleau-Ponty, Maurice (1962). Phenomenology of Perception. C. Smith (translator). Routledge & Kegan Paul.) and rather than thinking about the car, it is more accurate to suggest that we think from the point of view of the car, and consequently also perceive our environment in a different way".(Reynolds, Jack (2002). Merleau-Ponty. Amsterdam: internet.)
Going back to the hammer example… The person holding the hammer does not feel he is holding it when he is knocking. The subjective body of the composite identity focuses on the knocking process. Holding the hammer is not very different from moving his arm and using his muscles to produce force. The hammer has become part of the body schema of the nail knocking man… If something wrong happens and this process is interrupted, then the nail knocking man becomes aware of the hammer that he is holding and changes its direction etc… The hammer becomes the objective self of the nail knocking man.
My questions are: what happens when an accident happens while a human uses a tool, device or vehicle? What happens when an executive air traffic controller is over-loaded? What is the effect of stress on the embodiment of a large system operator like a nuclear reactor? What are the psychological effects of a complex software development tool such as Rational on a large systems software developer who has to work one year on the same difficult project?
Let’s think of a race car driver… He studies the race road before the race. During the race he must maximize his speed at every and each turn or straight part of the road. He tries to adjust and catch the max speed according to the road piece he faces and the status of his car… Actually it is the road and the car that orders him to change the gear and press the gas pedal as such… The driver has the ability to set the initial and previous conditions of the car, his choices determine the past and the cumulative effect of the past determine his effectiveness on the future… This intertwining can be seen in simple holding hands also:
"If I touch with my left hand my right hand while it touches an object, the right hand object is not the right hand touching: the first is an intertwining of bones, muscles and flesh bearing down on a point in space, the second traverses space as a rocket in order to discover the exterior object in its place" (Merleau-Ponty, Maurice (1962)
If the driver forgets himself and begins to act only according to the messages he gets from the road, this may cause disaster. If the driving man identity is lost and the car which has become part of the man’s body schema takes over the control, the driver enters a turn with a speed which may be impossible for the car…
Forgetting the abilities of the system or misinterpretting them is also explained as a ‘mental model’ mistake which leads to an accident. Embodiment can explain accidents better as it provides more on the psychology of the operator and the intertwining between the environment and him.
Accidents happen because of anomalies in the embodiment of complex identities. A mistake in the embodiment of the car, and the human, such as a failing tire or a physical anomaly of the human(alcohol) will cause an accident. If the complex identity, the driver becomes too dominant, such as the drive to achieve a goal as a driver, and causes the abilities of the car and the driver as seperate embodiments to be forgotten, also accidents happen. Mistaking identities or losing, forgetting them causes the failure of the complex identity.
The successful operator is the one who can find the ultimum balance between the identities of the complex embodiment, namely the simple selves and the complex itself with in the prenoetic limits.
Driving a car or operating any system requires the operator to arrange his priorities… His priorities to take care of the simple embodiments as the car, its status, gas, oil etc… As the human being, tiredness, sleep, etc. as the complex embodiment, the driver, cruising speed, road status, possible obstacles etc…. Driver, the complex embodiment has to create a special consciousness to be successful. This conscioussness has to be subjective… You can not do all of these continiously with full concentration.
If we go back once more to SARTRE;
“Phenomenological theorists distinguish between the subjective body(as lived and experienced) and the objective body (as observed and scientifically investigated). My lived body is an EMBODIED CONSCIOUSNESS which fluidly and pre-reflectively engages the world. As we engage in our daily activities, we tend not to be conscious of our bodies and we take them granted – body that is passed-by-in-silence (Jean-Paul SARTRE, 1943, Being and Nothingness)”.
The danger in this is, our bodies have the tendency to execute their body schemas, namely to exist, subjectively. We try to do things automatically after we repeat them for a while. An experienced driver tends to do things automatically and forgets the rules after a while…
Hence a safety related systems operator such as an air traffic controller or a pilot, must rise above its complex identity as an embodied consciousness of the human and the system and foster a special awareness of things existing around in the cockpit or the control board. This is called situation awareness by a few ‘mortals’.
Ali Rıza SARAL is an Electronics Engineer(ITU), composer(ISU) and a former civil servant of EUROCONTROL (European Agency for the Safety of Air Navigation) Software Team Karlsruhe. He has cured 24 documented Operational Deficiencies of the German KUIR airspace which includes Frankfurt.
My Address:
Ali Riza SARAL
Barbaros Mah. Sedef Sk. 13/13
Uskudar / ISTANBUL
TURKEY
Tel: 0090 (216) 474-8818
e-mail: arsaral(at)yahoo.com
A Few Notes on the EUROCONTROL Safety R&D Seminar
A Few Notes on the EUROCONTROL Safety R&D Seminar
Barcelona, Spain
25-27 October 2006
EUROCONTROL held a Safety R & D Seminar at Barselona late October 2006. This seminar took place in a decade that is marked not only by change in ATC technologies but also a continued trend of increase in air traffic. It must be noted that the increase in the air traffic is dramatic. For example the air traffic has risen from approx. 2000 flights per day to 4000 flights per day at KARLDAP central Germany and Europe. This is not a fast and natural load increase in a brand new system. The KARLDAP system is at the edge of a big transition to a brand new one and the technical staff is almost getting retired as a whole…
Big investments are being made for new systems… Yet Europe has seen her worst air traffic accident at Switzerland in this decade… Managers need to have objective methods and tools to justify new costs… The aviation industry is faced with increasing pressure to minimize its costs… Rationalisation sometimes causes experienced ATCOs to work two shifts 8 hours per day as DSF did in late 1990s…
These tendencies are reflected in the Swedish presentation on the “Impact of change processes on safety culture and organizational climate” and “Swed Lund Operational Readiness in Transition” and a not so good other presentation about the Switzerland accident “Human reaction to safety nets”…
I have witnessed the German KARLDAP and Turkish systems and I have not been able to find a comprehensive definition of SAFETY in these places… People are working with rule of thumbs and mutually FELT and SHARED feelings of safety but not objective understandings of it… The traffic load is increasing substantially but no one can judge what is exactly safe and what is not – accept to a certain degree simulation guys…
IATA comes into the arena with the “IATAData driven approach to ATM Safety” presentation in the EUROCONTROL seminar.
In order to measure whether a system is safe or not, one must first identify which risks associated with which hazards to measure… Here comes a group of presentations, first two by NLR “NLR Identification of emergent hazards and behaviour” and “NLR Identification of emergent hazards and behaviour”, and a special case “The Functional Resonance Accident Model” and last one from FAA “Human Error Safety Risk Analysis FAA Human Factors Research Group”…
Part of the problem arises from not having the data at all “Confidential Reporting”… Reporting methods, organization and environment are important according to EUROCONTROL presentation which indicates a method and independent Safety Group organisation. “Eliciting Info for Safety Assessment” is a similar presentation…
Once the data is gathered we have to assess it according to a method in order to evaluate the safety of our system… NLR steps in once more with the “NLR Need_for_novel_approach_to_aviation_safety_validation” article along with “resilience in safety assessment”.
Safety culture is the key phrase that is most emphasized in the seminar presentations… “ATM Safety Maturity Model”, “Boeing Safety Culture Survey”, Swedish “safety management system”, “UK Safety Regulation Group” presentation are noteworthy. I am impressed by the FAA, UK and NLR presentations but the Swedish quality and amount at most…
25-27 October 2006
EUROCONTROL held a Safety R & D Seminar at Barselona late October 2006. This seminar took place in a decade that is marked not only by change in ATC technologies but also a continued trend of increase in air traffic. It must be noted that the increase in the air traffic is dramatic. For example the air traffic has risen from approx. 2000 flights per day to 4000 flights per day at KARLDAP central Germany and Europe. This is not a fast and natural load increase in a brand new system. The KARLDAP system is at the edge of a big transition to a brand new one and the technical staff is almost getting retired as a whole…
Big investments are being made for new systems… Yet Europe has seen her worst air traffic accident at Switzerland in this decade… Managers need to have objective methods and tools to justify new costs… The aviation industry is faced with increasing pressure to minimize its costs… Rationalisation sometimes causes experienced ATCOs to work two shifts 8 hours per day as DSF did in late 1990s…
These tendencies are reflected in the Swedish presentation on the “Impact of change processes on safety culture and organizational climate” and “Swed Lund Operational Readiness in Transition” and a not so good other presentation about the Switzerland accident “Human reaction to safety nets”…
I have witnessed the German KARLDAP and Turkish systems and I have not been able to find a comprehensive definition of SAFETY in these places… People are working with rule of thumbs and mutually FELT and SHARED feelings of safety but not objective understandings of it… The traffic load is increasing substantially but no one can judge what is exactly safe and what is not – accept to a certain degree simulation guys…
IATA comes into the arena with the “IATAData driven approach to ATM Safety” presentation in the EUROCONTROL seminar.
In order to measure whether a system is safe or not, one must first identify which risks associated with which hazards to measure… Here comes a group of presentations, first two by NLR “NLR Identification of emergent hazards and behaviour” and “NLR Identification of emergent hazards and behaviour”, and a special case “The Functional Resonance Accident Model” and last one from FAA “Human Error Safety Risk Analysis FAA Human Factors Research Group”…
Part of the problem arises from not having the data at all “Confidential Reporting”… Reporting methods, organization and environment are important according to EUROCONTROL presentation which indicates a method and independent Safety Group organisation. “Eliciting Info for Safety Assessment” is a similar presentation…
Once the data is gathered we have to assess it according to a method in order to evaluate the safety of our system… NLR steps in once more with the “NLR Need_for_novel_approach_to_aviation_safety_validation” article along with “resilience in safety assessment”.
Safety culture is the key phrase that is most emphasized in the seminar presentations… “ATM Safety Maturity Model”, “Boeing Safety Culture Survey”, Swedish “safety management system”, “UK Safety Regulation Group” presentation are noteworthy. I am impressed by the FAA, UK and NLR presentations but the Swedish quality and amount at most…
A FEW CORRECTIONS and SOME COMMENTS
A FEW CORRECTIONS and SOME COMMENTS
ON EUROCONTROL’s Safety Regulation Requirement
ESARR 6 – Software in ATM Systems
CORRECTIONS
I - Mandatory Provisions, 1. General safety Requirements, item 1.2
a) The software requirements correctly state what is required by the software, in order to meet safety objectives and requirements, as identified by the risk assessment and mitigation process;
should rather be
a) The software requirements correctly state what is required from the software,
II - Requirements applying to the software safety assurance system, item 2.4,
b) the assurances corresponding to each software assurance level shall give sufficient confidence that the ATM software can be operated tolerably safely.
The term tolerably safe is not explained in the document, safety is defined as “freedom from unacceptable risk”,
Should rather be
… can be operated with acceptable risk
or
… can be operated with safety. (the flexibility in the definition itself suffices)
III – Item 2.6,
… developmental and non-developmental are unnecessary new words which do not contribute to the jargon more than the overhead they create.
IV. Requirements applying to the software assurance level, item 3.2
… the architectural and/or procedural defences identified
defences should be precautions or precaution systems if you like. (would be nice if it were football;-)
IV – Appendix A
Accuracy: The required precision of the computed results.
Accuracy and precision and the relation between them should be clearly defined. Some university books define precision as the “repeatibility of results” regardless of their accuracy. Accuracy is only the correctness of a measurement nothing else… …
V - Resource usage: The amount of resources within the computer system that can be used by the application software.
Should be
by a specific application in the software
VI - The definition for the word ‘risk’ is a little bit cumbersome but perfact in meaning…
VII – Safety: Freedom from unacceptable risk
implies that freedom includes acceptable risk which is quiet clever… And after this, safety is referred to in‘acceptable or tolerable safety’, which means ‘acceptable or tolerable acceptable risk situation’ according to the definition of ‘safety.’
acceptable or tolerable safety
Should be either
Safety
Or
Acceptable or tolerable risk (situation)…
VIII – The term ‘Software Timing Performances’ may have been used to bring in meaning flexibility for future developments and it is also out of any jargon that I have heard of… The definition given points at exactly the term ‘response time’. It does not sound ‘just’ to do things like this unless they are done unintentionally.
COMMENTS
I - This is a difficult document to write. Many who are involved with ATC rather closely would choose not to write it at all…
II -The document has to set a framework so that assigned authorities, service providers etc. should be gently leaded to a more formal way of doing things and maybe doing them better as a natural result. The document is good in this respect.
III - On the other hand, the document misses conscientious aspect of software development and maintenance in ATC in the thick cloud of gentle politics, interest balancing etc. Bluntly, there is nothing in the document which ensures the identification of who has done which software change or development item. ESARRs have conscientiously protected anonymity of engineers who may have caused involuntary harm to the air traffic. ESARR 6 falls short of adressing the individual responsibility in retrograde of this.
should be
6.4 A person who has done an error in the ATM software should be easily identifiable through the use of Configuration management.
IV – Testing should have been mentioned explicitly
VII – Software inspection by peers and group leaders should have been mentioned explicitly
The last two items are no less important or relevant than traceability in software requirements.
APPENDIX
TURKISH TRANSLATION OF ESARR 6
WORK IN PROGRESS
By Ali R+ SARAL
EUROCONTROL
Hava Seyrüseferi Güvenliği için Avrupa Kuruluşu
(EUROCONTROL-European Organisation for the Safety of Air Navigation)
EUROCONTROL Güvenlik Düzenleyici Şartnamesi
(ESARR–EUROCONTROL Safety Regulatory Requirement)
ESARR 6
Hava Trafik Yönetim Sistemlerindeki Yazılımlar
(Software in ATM Systems)
F.2 BELGE ÖZELLİKLERİ
ESARR6 yazılım güvenliği güvence sistemlerinin hayata geçirilmesi ile ilgilenir. Bu sistemler güvenlik ile ilgili yer yüzüne-konumlandırılmış ATM sistemlerindeki yazılımların kullanımlarına ilişkin risklerin hoş görülebilecek bir seviyeye indirilmesini güvenceye alır.
ESARR6 yazılım için herhangi bir destekleyici uyum yöntemi öngörmez. Bunu yapmak yazılım güvencesi standartlarının payına düşer. Dolayısıyla, özgün milli ve uluslararası yazılım güvencesi standartlarını harekete geçirmek bu şartnamenin sınırları dışındadır.
Bu şartnamenin amacı ATM güvenlik düzenleyici kuruluşları ve ATM hizmet sunucularına ATM sistemlerinde yazılım kullanımı için bütünsel ve uyumlu bir grup güvenlik düzenleme şartı sağlamaktır.
…
F.6 YÖNETİMSEL ÖZET
Bu EUROCONTROL Güvenlik Düzenleyici Şartnamesi(ESARR) Güvenlik Düenleyici Komisyon tarafından hazırlanmıştır.
ESARR6 yeryüzüne-konumlandırılmış ATM güvenlik sistemlerindeki yazılımların kullanım risklerinin hoş görülebilecek bir seviyeye indirilmesinden emin olmak için yazılım güvencesi sistemlerinin hayata geçirilmesi ile ilgilenir.
Bu yüzden, bu ESARR’ın amacı ATM sistemlerinde yazılım kullanımı için bir grup uyumlu güvenlik düzenleyici şartı sağlamaktır. Hiçbir yazılım güvencesi standardını kendi zorunlu koşullarını karşılamak için kabul edilebilir bir uyum yöntemi olarak belirlemez. Buna bağlı olarak, özgün milli ve uluslararası yazılım güvencesi standartlarını harekete geçirmek bu şartnamenin sınırları dışındadır.
Bu ESARR’ın koşulları EUROCONTROL Daimi Komisyonu tarafından onaylanmasından 3 yıl sonra uygulamaya girecektir.
…
…
TANITICI MALZEME
Bu kısımdaki koşullar zorunlu değildir.
A. KAPSAM
i. ESARR 6, sivil hava trafiğine ATM hizmetleri sağlamak için kullanılan, güvenlik ile ilgili, yeryüzüne konumlandırılmış ATM(hava trafik yönetimi) sistemlerinde yazılım kullanımıyla (cutover / hot swapping gibi tüm işletimsel yazılım değiştirme işlemleri dahil) ilişkilidir.
ii. ESARR 6’nın kapsamı ATM hizmet-sağlayıcının idari kontrolü altındaki yeryüzüne konumlandırılmış CNS gibi destek hizmetleri dahil, ATM’in yeryüzü bileşeni ile sınırlıdır. Değiştirilmediği ve uygun bir şekilde yeniden gözden geçirilmediği takdirde ESARR6 gökte ya da uzayda uçan ATM sistemi bileşenleri için uygulanamaz.
iii. Bu güvenlik düzenleyici şartnamenin koşulları, yazılım tarafından icra edilen ATM işlevleri dahil ATM’in tüm sahalarının gereğince değerlendirilmesinden emin olmak için, a priori, önkoşul olarak, etkin risk değerlendirme ve uygun bir seviyeye risk azaltması çalışması yapılması temelinde geliştirilmiştir.
iv. ESARR 6 yazılım için herhangi bir destekleyici uyum yöntemi öngörmez. Bunu yapmak yazılım güvencesi standartlarının payına düşer. Buna bağlı olarak, özgün milli ve uluslararası yazılım güvencesi standartlarını harekete geçirmek bu şartnamenin sınırları dışındadır.
B. GEREKÇE
i. SRC’nin 6/8/5 kararı SRC İş Programı içinde yazılım temelli ATM sistemleri için bir EUROCONTROL Güvenlik Düzenleyici Şartnamesi geliştirilmesini içermeyi onayladı. Aynı zamanda, ICAO standartları ve tavsiye edilen ICAO uygulamalarında ilk örnek teşkil edecek hiçbir şey olmadığı olgusu da kabul edildi.
ii. ESARR 3(Güvenlik Yönetim Sistemlerinin ATM hizmet sağlayıcıları tarafından kullanımı) ATM sistemine yapılan değişikliklerin önemlerine göre değerlendirilmesini ve ATM sistem işlevlerinin ciddiyetlerine göre sınıflandırılmasını güvenceye almak için güvenlik yönetim sistemlerinin Risk Değerlendirme ve Azaltma içermelerini şart koşar.
iii. ESARR 4 (Hava Trafik Yönetiminde Risk Değerlendirme ve Azaltma – Risk Assessment and Mitigation in ATM) Risk Değerlendirme ve Azaltma üzerinde ESARR3’ün şartlarını genişletir ve Hava Trafik Yönetimi sistemini insanlar, işlemler ve cihazlar (yazılım ve donanım) açısından ve onların ATM sisteminde değişiklik yapmaları / tasarlamaları açısından ele almak için her yönden kapsayıcı bir işlemler dizisi sağlar.
iv. ESARR 6 bu güvenlik düzenleyici geliştirme sürecinin devamıdır ce ATM sistemlerinin yazılım yanına ilişkin olarak ESARR 4’ü genişletir. Donanım yanı için tamamlayıcı güvenlik düzenleyici şartname değerlendirme altındadır.
v. Güvenlik ATM sistemlerinin temel bir özelliğidir. İşletimsel etkinlik üzerinde ağırlıklı bir çarpıcı etkiye sahiptir. Yığınsal ve sistemli yazılım kullanımı, daha önce elle icra edilen işletimsel işlevlerin otomasyonu ve sürekli büyüyen tümleşik ortamlarda önemli etkileşimler içeren ATM sistemleri güvenlik elde edilmesinde daha resmi-formal yaklaşımlar talep etmektedir.
vi. Bu ESARR’ın amacı ATM sistemlerinin kullanımı için ATM güvenlik kuruluşları ve ATM hizmet sunucularına bütünsel ve uyumlu bir grup güvenlik düzenleyici şart sağlamaktır.
C. GÜVENLİK HEDEFİ
Yazılım içeren ATM sistemlerinin sağlaması gereken birincil yazılım güvenlik amacı
ATM yazılımı kullanımı ile ilişkilendirilmiş risklerin hoş görülebilir bir seviyeye indirilmesinden emin olunmasıdır.
ZORUNLU KOŞULLAR
1. GENEL GÜVENLİK ŞARTLARI
1.1 Güvenlik Yönetim Sistemi yapısı içinde ve risk değerlendirme - azaltma faaliyetlerinin bir parçası olarak, ATM hizmet-sağlayıcısı sorunun yazılım ile ilgili yanlarını ele almak için (cutover/hot swapping gibi bütün kullanım sırasındaki işletimsel yazılım değişiklikleri dahil) bir Yazılım Güvencesi Sistemini uygulamaya koymalıdır.
1.2 ATM hizmet-sağlayıcı, Yazılım Güvenlik Güvencesi Sisteminde, en azından, şunlardan emin olmalıdır;
a) Yazılım şartnamesi, risk değerlendirme – azaltma sürecinde belirlendiği şekilde, güvenlik amaçlarını ve şartlarını sağlamak için yazılımın(?) yapması gereken şeyleri doğrulukla belirtir.
b) İzsürülebilirlik–traceability bütün yazılım şartları açısından ele alınmış;
c) Yazılım gerçekleştirliş şekli güvenliği olumsuz etkileyecek hiçbir işlev içermez;
d) ATM kendi yazılım şartnamesini yazılımın hayatiyeti ile tutarlı bir güvenlik seviyesi yüksekliğinde sağlar;
e) Yukarıdaki Genel Güvenlik Şartnamesi’nin sağlandığına ilişkin güvencelerin ve gereken güvencelerin sağlandığına ilişkin tartışmaların her zaman aşağıdakilere dayandırılması;
i. yazılımın belirli bir icra edilebilir sürümü
ii. bir dizi yapısal-kurulum–configuration verisi
iii. belirli bir grup yazılım ürünü ve o sürümün üretilişinde kullanılmış tanımlar(tarifnameler dahil).
1.3 ATM hizmet-sağlayıcısı Atanmış Otoriteye, yukarıda bölüm 1.2’deki şartların sağlandığına ilişkin gerekli güvenceleri sağlamalıdır.
2. YAZILIM GÜVENLİK GÜVENCESİ SİSTEMİNE UYGULANAN ŞARTLAR
ATM hizmet-sağlayıcı, Yazılım Güvenlik Güvencesi Sisteminin en azından şunları sağladığından emin olmalıdır;
2.1 Belgelenmiş olmalı, özellikle genel Risk Değerlenirme – Azaltma Belgeleme Sisteminin parçası olarak.
2.2 Bütün işletimsel ATM yazılım yazılım güvence seviyeleri ataması.
2.3 Aşağıdakilerin güvencelerine sahiptir;
a) Yazılım şartları geçerliliği–software requirements validity
b) yazılım doğrulama–software verification
c) yazılım yapısal-kurulum yönetimi–software configuration management
d) yazılım şartnamesi izsürülebilirliği – software requirements traceability
2.4 Güvencelerin hangi azim ve ısrar ile gerçekleştirildiğini belirler. Azim ve ısrar her yazılım güvencesi seviyesi için tanımlanmalı ve yazılımın hayatiyeti ile doğru orantılı artmalıdır. Bu amaçla;
a) Her yazılım güvencesi seviyesi başına güvence azim ve ısrarındaki değişim aşağıdaki kriterleri içermelidir:
i. bağımsız olarak başarılması gerekir
ii. başarılması gerekir
iii. şart değil.
b) Her yazılım güvence seviyesine denk düşen güvenceler ATM yazılımının hoş görülebilir(?) şekilde güvenli işletilebileceğine yeterli güven vermelidir.
2.5 Yazılı Güvenlik Güvencesi Sisteminin ve güvence seviyelerinin atamasının uygun olduğunun doğrulanması için ATM yazılım tecrübesinden geri dönerek faydalanır. Bu amaçla, ESARR 2’ye göre raporlanmış ATM işletimsel tecrübesinden herhangi bir hata veya yazılım arızası sonucu etkiler ESARR 4 yapısı bağlamında değerlendirilmelidir.
2.6 Atanmış Otorite tarafından seçilmiş ve kabul edilmiş herhangi bir yöntem ile, eşit yazılım güvencesi seviyelerindeki, geliştirilmiş ya da hazır alınmış ATM yazılımı için(COTS vb.), eşit güvenlik seviyesi sağlar.
3. YAZILIM GÜVENCESİ SEVİYESİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından şunlardan emin olmalıdır:
3.1 Yazılım güvencesi seviyesi, yazılım güvencelerinin azim ve ısrarını ATM yazılımının hayatiyetine, ESARR 4 ciddiyet sınıflama şeması ile belirli bir olumsuz etkinin oluşması olasılığını birleştirerek, ilişkilendirir. 1. yazılım güvencesi seviyesi en hayati seviyeyi belirtmek üzere, en az 4 yazılım güvencesi seviyesi tanımlanmalıdır.
3.2 Ayrılmış bir yazılım güvencesi seviyesi ESARR 4’e göre yazılım arızaları ve hatalarının neden olabileceği en olumsuz etki ile denk düşmelidir. Bu, yazılım arızaları ve hataları ile ilişkili riskleri ve belirlenmiş yapısal ve/veya işlem-dizisel-procedural savunmaları(?-tedbirleri demek istiyor-ARS) hesaba katmalıdır.
3.3 Birbirlerinden bağımsız oldukları gösterilemeyen ATM yazılım unsurları bağımlı unsurlar arasındaki en hayati yazılım güvencesi seviyesine ayrılmalıdır.
4. YAZILIM ŞARTNAMESİ GEÇERLİLİK GÜVENCELERİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından yazılım şartlarının:
4.1 ATM yazılımının (normal ve geriseviyelendirilmiş-downgraded çalışma türlerinde) işlevsel davranışını, icra hız(?) seviyeleri, kapasite, doğruluk, hedef bilgisayarda yazılımın kaynak kullanımı, anormal işletimsel durumlarda ayakta kalma yeteneği - robustness
ve aşırı yüklenmeye dayanıklılık, uygun şekilde belirlemesi.
4.2 Tam ve doğru olmaları ve sistem güvenlik şartnamesi koşullarına uymaları gerekir.
5. YAZILIM DOĞRULAMA GÜVENCELERİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından şunlardan emin olmalıdır:
5.1 ATM yazılımının işlevsel davranışının, icra hız(?) seviyeleri, kapasite, doğruluk, hedef bilgisayarda yazılımın kaynak kullanımı, anormal işletimsel durumlarda ayakta kalma yeteneği - robustness ve aşırı yüklenmeye dayanıklılığının yazılım şartnamesi koşullarını sağlar.
5.2 ATM yazılımı, Atanmış Otorite ile mutabakata varıldığı gibi, analiz ve/veya deneme ve/veya eşdeğer yöntemlerle uygun bir şekilde doğrulanır.
5.3 ATM yazılımının doğrulanması doğru ve tamdır.
6. YAZILIM KURULUM-YAPISI(configuration) YÖNETİMİ GÜVENCELERİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından şunlardan emin olmalıdır:
6.1 Yapısal-kurulum–configuration belirlemesi, iz-sürülebilirlik ve durum takibi-status accounting vardır öyle ki, ATM yazılım yaşam-döngüsü-lifecycle boyunca yazılım yaşam-döngüsü verilerinin yapısal-kurulum kontrolü altında olduğu gösterilebilir.
6.2 Sorun raporlama, takip ve düzeltici eylemler vardır öyle ki yazılıma ilişkin güvenlik ile ilgili sorunların azaltıldığı gösterilebilir.
6.3 Öyle yeniden ele alma ve hizmete sunma eylem dizileri-procedure vardır ki ATM yazılım yaşam-döngüsü sırasında yazılım yaşam-döngüsü verileri yeniden canlandırılabilir ve teslim edilebilir.
7. YAZILIM ŞARTNAMESİ İZSÜRÜLEBİLİRLİK GÜVENCELERİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından şunlardan emin olmalıdır:
7.1 Sağlandığı gösterilmiş olan her tasarım seviyesine her bir yazılım şartının izi-sürülebilir.
7.2 Tasarımdaki her seviyede, sağlandığı gösterilmiş olan her bir yazılım şartının bir sistem şartına kadar izi-sürülebilir.
8. UYGULANABİLİRLİK
8.1 Bu güvenlik şartnamesi idari kontrolleri altındaki, yeryüzüne-konuşlandırılmış ATM sistemleri ve destek hizmetleri (CNS gibi)’nden sorumlu olan sivil ve askeri ATM hizmet sağlayıcıları için geçerlidir.
8.2 Askeri ATM kuruluşunun doğrudan idari kontrolü altındaki ATM sistemlerinin zaten var olan yazılım güvencesi sistemi, ESARR 6’nın zorunlu koşulları ile denk düşmek şartı ile geçerli kabul edilebilir.
8.3 Bu ESARR’ın zorunlu koşulları milli güvenlik düzenleyici şartnamelerin asgari koşulu olacaktır.
9. GERÇEKLEŞTİRME
9.1 ESARR 6’nın koşulları EUROCOMTROL komisyonu tarafından onaylandığı tarihten itibaren 3 yıl içinde etkin olacaktır.
…
APPENDIX
…
ON EUROCONTROL’s Safety Regulation Requirement
ESARR 6 – Software in ATM Systems
CORRECTIONS
I - Mandatory Provisions, 1. General safety Requirements, item 1.2
a) The software requirements correctly state what is required by the software, in order to meet safety objectives and requirements, as identified by the risk assessment and mitigation process;
should rather be
a) The software requirements correctly state what is required from the software,
II - Requirements applying to the software safety assurance system, item 2.4,
b) the assurances corresponding to each software assurance level shall give sufficient confidence that the ATM software can be operated tolerably safely.
The term tolerably safe is not explained in the document, safety is defined as “freedom from unacceptable risk”,
Should rather be
… can be operated with acceptable risk
or
… can be operated with safety. (the flexibility in the definition itself suffices)
III – Item 2.6,
… developmental and non-developmental are unnecessary new words which do not contribute to the jargon more than the overhead they create.
IV. Requirements applying to the software assurance level, item 3.2
… the architectural and/or procedural defences identified
defences should be precautions or precaution systems if you like. (would be nice if it were football;-)
IV – Appendix A
Accuracy: The required precision of the computed results.
Accuracy and precision and the relation between them should be clearly defined. Some university books define precision as the “repeatibility of results” regardless of their accuracy. Accuracy is only the correctness of a measurement nothing else… …
V - Resource usage: The amount of resources within the computer system that can be used by the application software.
Should be
by a specific application in the software
VI - The definition for the word ‘risk’ is a little bit cumbersome but perfact in meaning…
VII – Safety: Freedom from unacceptable risk
implies that freedom includes acceptable risk which is quiet clever… And after this, safety is referred to in‘acceptable or tolerable safety’, which means ‘acceptable or tolerable acceptable risk situation’ according to the definition of ‘safety.’
acceptable or tolerable safety
Should be either
Safety
Or
Acceptable or tolerable risk (situation)…
VIII – The term ‘Software Timing Performances’ may have been used to bring in meaning flexibility for future developments and it is also out of any jargon that I have heard of… The definition given points at exactly the term ‘response time’. It does not sound ‘just’ to do things like this unless they are done unintentionally.
COMMENTS
I - This is a difficult document to write. Many who are involved with ATC rather closely would choose not to write it at all…
II -The document has to set a framework so that assigned authorities, service providers etc. should be gently leaded to a more formal way of doing things and maybe doing them better as a natural result. The document is good in this respect.
III - On the other hand, the document misses conscientious aspect of software development and maintenance in ATC in the thick cloud of gentle politics, interest balancing etc. Bluntly, there is nothing in the document which ensures the identification of who has done which software change or development item. ESARRs have conscientiously protected anonymity of engineers who may have caused involuntary harm to the air traffic. ESARR 6 falls short of adressing the individual responsibility in retrograde of this.
should be
6.4 A person who has done an error in the ATM software should be easily identifiable through the use of Configuration management.
IV – Testing should have been mentioned explicitly
VII – Software inspection by peers and group leaders should have been mentioned explicitly
The last two items are no less important or relevant than traceability in software requirements.
APPENDIX
TURKISH TRANSLATION OF ESARR 6
WORK IN PROGRESS
By Ali R+ SARAL
EUROCONTROL
Hava Seyrüseferi Güvenliği için Avrupa Kuruluşu
(EUROCONTROL-European Organisation for the Safety of Air Navigation)
EUROCONTROL Güvenlik Düzenleyici Şartnamesi
(ESARR–EUROCONTROL Safety Regulatory Requirement)
ESARR 6
Hava Trafik Yönetim Sistemlerindeki Yazılımlar
(Software in ATM Systems)
F.2 BELGE ÖZELLİKLERİ
ESARR6 yazılım güvenliği güvence sistemlerinin hayata geçirilmesi ile ilgilenir. Bu sistemler güvenlik ile ilgili yer yüzüne-konumlandırılmış ATM sistemlerindeki yazılımların kullanımlarına ilişkin risklerin hoş görülebilecek bir seviyeye indirilmesini güvenceye alır.
ESARR6 yazılım için herhangi bir destekleyici uyum yöntemi öngörmez. Bunu yapmak yazılım güvencesi standartlarının payına düşer. Dolayısıyla, özgün milli ve uluslararası yazılım güvencesi standartlarını harekete geçirmek bu şartnamenin sınırları dışındadır.
Bu şartnamenin amacı ATM güvenlik düzenleyici kuruluşları ve ATM hizmet sunucularına ATM sistemlerinde yazılım kullanımı için bütünsel ve uyumlu bir grup güvenlik düzenleme şartı sağlamaktır.
…
F.6 YÖNETİMSEL ÖZET
Bu EUROCONTROL Güvenlik Düzenleyici Şartnamesi(ESARR) Güvenlik Düenleyici Komisyon tarafından hazırlanmıştır.
ESARR6 yeryüzüne-konumlandırılmış ATM güvenlik sistemlerindeki yazılımların kullanım risklerinin hoş görülebilecek bir seviyeye indirilmesinden emin olmak için yazılım güvencesi sistemlerinin hayata geçirilmesi ile ilgilenir.
Bu yüzden, bu ESARR’ın amacı ATM sistemlerinde yazılım kullanımı için bir grup uyumlu güvenlik düzenleyici şartı sağlamaktır. Hiçbir yazılım güvencesi standardını kendi zorunlu koşullarını karşılamak için kabul edilebilir bir uyum yöntemi olarak belirlemez. Buna bağlı olarak, özgün milli ve uluslararası yazılım güvencesi standartlarını harekete geçirmek bu şartnamenin sınırları dışındadır.
Bu ESARR’ın koşulları EUROCONTROL Daimi Komisyonu tarafından onaylanmasından 3 yıl sonra uygulamaya girecektir.
…
…
TANITICI MALZEME
Bu kısımdaki koşullar zorunlu değildir.
A. KAPSAM
i. ESARR 6, sivil hava trafiğine ATM hizmetleri sağlamak için kullanılan, güvenlik ile ilgili, yeryüzüne konumlandırılmış ATM(hava trafik yönetimi) sistemlerinde yazılım kullanımıyla (cutover / hot swapping gibi tüm işletimsel yazılım değiştirme işlemleri dahil) ilişkilidir.
ii. ESARR 6’nın kapsamı ATM hizmet-sağlayıcının idari kontrolü altındaki yeryüzüne konumlandırılmış CNS gibi destek hizmetleri dahil, ATM’in yeryüzü bileşeni ile sınırlıdır. Değiştirilmediği ve uygun bir şekilde yeniden gözden geçirilmediği takdirde ESARR6 gökte ya da uzayda uçan ATM sistemi bileşenleri için uygulanamaz.
iii. Bu güvenlik düzenleyici şartnamenin koşulları, yazılım tarafından icra edilen ATM işlevleri dahil ATM’in tüm sahalarının gereğince değerlendirilmesinden emin olmak için, a priori, önkoşul olarak, etkin risk değerlendirme ve uygun bir seviyeye risk azaltması çalışması yapılması temelinde geliştirilmiştir.
iv. ESARR 6 yazılım için herhangi bir destekleyici uyum yöntemi öngörmez. Bunu yapmak yazılım güvencesi standartlarının payına düşer. Buna bağlı olarak, özgün milli ve uluslararası yazılım güvencesi standartlarını harekete geçirmek bu şartnamenin sınırları dışındadır.
B. GEREKÇE
i. SRC’nin 6/8/5 kararı SRC İş Programı içinde yazılım temelli ATM sistemleri için bir EUROCONTROL Güvenlik Düzenleyici Şartnamesi geliştirilmesini içermeyi onayladı. Aynı zamanda, ICAO standartları ve tavsiye edilen ICAO uygulamalarında ilk örnek teşkil edecek hiçbir şey olmadığı olgusu da kabul edildi.
ii. ESARR 3(Güvenlik Yönetim Sistemlerinin ATM hizmet sağlayıcıları tarafından kullanımı) ATM sistemine yapılan değişikliklerin önemlerine göre değerlendirilmesini ve ATM sistem işlevlerinin ciddiyetlerine göre sınıflandırılmasını güvenceye almak için güvenlik yönetim sistemlerinin Risk Değerlendirme ve Azaltma içermelerini şart koşar.
iii. ESARR 4 (Hava Trafik Yönetiminde Risk Değerlendirme ve Azaltma – Risk Assessment and Mitigation in ATM) Risk Değerlendirme ve Azaltma üzerinde ESARR3’ün şartlarını genişletir ve Hava Trafik Yönetimi sistemini insanlar, işlemler ve cihazlar (yazılım ve donanım) açısından ve onların ATM sisteminde değişiklik yapmaları / tasarlamaları açısından ele almak için her yönden kapsayıcı bir işlemler dizisi sağlar.
iv. ESARR 6 bu güvenlik düzenleyici geliştirme sürecinin devamıdır ce ATM sistemlerinin yazılım yanına ilişkin olarak ESARR 4’ü genişletir. Donanım yanı için tamamlayıcı güvenlik düzenleyici şartname değerlendirme altındadır.
v. Güvenlik ATM sistemlerinin temel bir özelliğidir. İşletimsel etkinlik üzerinde ağırlıklı bir çarpıcı etkiye sahiptir. Yığınsal ve sistemli yazılım kullanımı, daha önce elle icra edilen işletimsel işlevlerin otomasyonu ve sürekli büyüyen tümleşik ortamlarda önemli etkileşimler içeren ATM sistemleri güvenlik elde edilmesinde daha resmi-formal yaklaşımlar talep etmektedir.
vi. Bu ESARR’ın amacı ATM sistemlerinin kullanımı için ATM güvenlik kuruluşları ve ATM hizmet sunucularına bütünsel ve uyumlu bir grup güvenlik düzenleyici şart sağlamaktır.
C. GÜVENLİK HEDEFİ
Yazılım içeren ATM sistemlerinin sağlaması gereken birincil yazılım güvenlik amacı
ATM yazılımı kullanımı ile ilişkilendirilmiş risklerin hoş görülebilir bir seviyeye indirilmesinden emin olunmasıdır.
ZORUNLU KOŞULLAR
1. GENEL GÜVENLİK ŞARTLARI
1.1 Güvenlik Yönetim Sistemi yapısı içinde ve risk değerlendirme - azaltma faaliyetlerinin bir parçası olarak, ATM hizmet-sağlayıcısı sorunun yazılım ile ilgili yanlarını ele almak için (cutover/hot swapping gibi bütün kullanım sırasındaki işletimsel yazılım değişiklikleri dahil) bir Yazılım Güvencesi Sistemini uygulamaya koymalıdır.
1.2 ATM hizmet-sağlayıcı, Yazılım Güvenlik Güvencesi Sisteminde, en azından, şunlardan emin olmalıdır;
a) Yazılım şartnamesi, risk değerlendirme – azaltma sürecinde belirlendiği şekilde, güvenlik amaçlarını ve şartlarını sağlamak için yazılımın(?) yapması gereken şeyleri doğrulukla belirtir.
b) İzsürülebilirlik–traceability bütün yazılım şartları açısından ele alınmış;
c) Yazılım gerçekleştirliş şekli güvenliği olumsuz etkileyecek hiçbir işlev içermez;
d) ATM kendi yazılım şartnamesini yazılımın hayatiyeti ile tutarlı bir güvenlik seviyesi yüksekliğinde sağlar;
e) Yukarıdaki Genel Güvenlik Şartnamesi’nin sağlandığına ilişkin güvencelerin ve gereken güvencelerin sağlandığına ilişkin tartışmaların her zaman aşağıdakilere dayandırılması;
i. yazılımın belirli bir icra edilebilir sürümü
ii. bir dizi yapısal-kurulum–configuration verisi
iii. belirli bir grup yazılım ürünü ve o sürümün üretilişinde kullanılmış tanımlar(tarifnameler dahil).
1.3 ATM hizmet-sağlayıcısı Atanmış Otoriteye, yukarıda bölüm 1.2’deki şartların sağlandığına ilişkin gerekli güvenceleri sağlamalıdır.
2. YAZILIM GÜVENLİK GÜVENCESİ SİSTEMİNE UYGULANAN ŞARTLAR
ATM hizmet-sağlayıcı, Yazılım Güvenlik Güvencesi Sisteminin en azından şunları sağladığından emin olmalıdır;
2.1 Belgelenmiş olmalı, özellikle genel Risk Değerlenirme – Azaltma Belgeleme Sisteminin parçası olarak.
2.2 Bütün işletimsel ATM yazılım yazılım güvence seviyeleri ataması.
2.3 Aşağıdakilerin güvencelerine sahiptir;
a) Yazılım şartları geçerliliği–software requirements validity
b) yazılım doğrulama–software verification
c) yazılım yapısal-kurulum yönetimi–software configuration management
d) yazılım şartnamesi izsürülebilirliği – software requirements traceability
2.4 Güvencelerin hangi azim ve ısrar ile gerçekleştirildiğini belirler. Azim ve ısrar her yazılım güvencesi seviyesi için tanımlanmalı ve yazılımın hayatiyeti ile doğru orantılı artmalıdır. Bu amaçla;
a) Her yazılım güvencesi seviyesi başına güvence azim ve ısrarındaki değişim aşağıdaki kriterleri içermelidir:
i. bağımsız olarak başarılması gerekir
ii. başarılması gerekir
iii. şart değil.
b) Her yazılım güvence seviyesine denk düşen güvenceler ATM yazılımının hoş görülebilir(?) şekilde güvenli işletilebileceğine yeterli güven vermelidir.
2.5 Yazılı Güvenlik Güvencesi Sisteminin ve güvence seviyelerinin atamasının uygun olduğunun doğrulanması için ATM yazılım tecrübesinden geri dönerek faydalanır. Bu amaçla, ESARR 2’ye göre raporlanmış ATM işletimsel tecrübesinden herhangi bir hata veya yazılım arızası sonucu etkiler ESARR 4 yapısı bağlamında değerlendirilmelidir.
2.6 Atanmış Otorite tarafından seçilmiş ve kabul edilmiş herhangi bir yöntem ile, eşit yazılım güvencesi seviyelerindeki, geliştirilmiş ya da hazır alınmış ATM yazılımı için(COTS vb.), eşit güvenlik seviyesi sağlar.
3. YAZILIM GÜVENCESİ SEVİYESİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından şunlardan emin olmalıdır:
3.1 Yazılım güvencesi seviyesi, yazılım güvencelerinin azim ve ısrarını ATM yazılımının hayatiyetine, ESARR 4 ciddiyet sınıflama şeması ile belirli bir olumsuz etkinin oluşması olasılığını birleştirerek, ilişkilendirir. 1. yazılım güvencesi seviyesi en hayati seviyeyi belirtmek üzere, en az 4 yazılım güvencesi seviyesi tanımlanmalıdır.
3.2 Ayrılmış bir yazılım güvencesi seviyesi ESARR 4’e göre yazılım arızaları ve hatalarının neden olabileceği en olumsuz etki ile denk düşmelidir. Bu, yazılım arızaları ve hataları ile ilişkili riskleri ve belirlenmiş yapısal ve/veya işlem-dizisel-procedural savunmaları(?-tedbirleri demek istiyor-ARS) hesaba katmalıdır.
3.3 Birbirlerinden bağımsız oldukları gösterilemeyen ATM yazılım unsurları bağımlı unsurlar arasındaki en hayati yazılım güvencesi seviyesine ayrılmalıdır.
4. YAZILIM ŞARTNAMESİ GEÇERLİLİK GÜVENCELERİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından yazılım şartlarının:
4.1 ATM yazılımının (normal ve geriseviyelendirilmiş-downgraded çalışma türlerinde) işlevsel davranışını, icra hız(?) seviyeleri, kapasite, doğruluk, hedef bilgisayarda yazılımın kaynak kullanımı, anormal işletimsel durumlarda ayakta kalma yeteneği - robustness
ve aşırı yüklenmeye dayanıklılık, uygun şekilde belirlemesi.
4.2 Tam ve doğru olmaları ve sistem güvenlik şartnamesi koşullarına uymaları gerekir.
5. YAZILIM DOĞRULAMA GÜVENCELERİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından şunlardan emin olmalıdır:
5.1 ATM yazılımının işlevsel davranışının, icra hız(?) seviyeleri, kapasite, doğruluk, hedef bilgisayarda yazılımın kaynak kullanımı, anormal işletimsel durumlarda ayakta kalma yeteneği - robustness ve aşırı yüklenmeye dayanıklılığının yazılım şartnamesi koşullarını sağlar.
5.2 ATM yazılımı, Atanmış Otorite ile mutabakata varıldığı gibi, analiz ve/veya deneme ve/veya eşdeğer yöntemlerle uygun bir şekilde doğrulanır.
5.3 ATM yazılımının doğrulanması doğru ve tamdır.
6. YAZILIM KURULUM-YAPISI(configuration) YÖNETİMİ GÜVENCELERİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından şunlardan emin olmalıdır:
6.1 Yapısal-kurulum–configuration belirlemesi, iz-sürülebilirlik ve durum takibi-status accounting vardır öyle ki, ATM yazılım yaşam-döngüsü-lifecycle boyunca yazılım yaşam-döngüsü verilerinin yapısal-kurulum kontrolü altında olduğu gösterilebilir.
6.2 Sorun raporlama, takip ve düzeltici eylemler vardır öyle ki yazılıma ilişkin güvenlik ile ilgili sorunların azaltıldığı gösterilebilir.
6.3 Öyle yeniden ele alma ve hizmete sunma eylem dizileri-procedure vardır ki ATM yazılım yaşam-döngüsü sırasında yazılım yaşam-döngüsü verileri yeniden canlandırılabilir ve teslim edilebilir.
7. YAZILIM ŞARTNAMESİ İZSÜRÜLEBİLİRLİK GÜVENCELERİNE UYGULANAN ŞARTLAR
ATM servis-sağlayıcısı Yazılım Güvenliği Güvence Sistemi içinde, en azından şunlardan emin olmalıdır:
7.1 Sağlandığı gösterilmiş olan her tasarım seviyesine her bir yazılım şartının izi-sürülebilir.
7.2 Tasarımdaki her seviyede, sağlandığı gösterilmiş olan her bir yazılım şartının bir sistem şartına kadar izi-sürülebilir.
8. UYGULANABİLİRLİK
8.1 Bu güvenlik şartnamesi idari kontrolleri altındaki, yeryüzüne-konuşlandırılmış ATM sistemleri ve destek hizmetleri (CNS gibi)’nden sorumlu olan sivil ve askeri ATM hizmet sağlayıcıları için geçerlidir.
8.2 Askeri ATM kuruluşunun doğrudan idari kontrolü altındaki ATM sistemlerinin zaten var olan yazılım güvencesi sistemi, ESARR 6’nın zorunlu koşulları ile denk düşmek şartı ile geçerli kabul edilebilir.
8.3 Bu ESARR’ın zorunlu koşulları milli güvenlik düzenleyici şartnamelerin asgari koşulu olacaktır.
9. GERÇEKLEŞTİRME
9.1 ESARR 6’nın koşulları EUROCOMTROL komisyonu tarafından onaylandığı tarihten itibaren 3 yıl içinde etkin olacaktır.
…
APPENDIX
…
Due Respect to Istanbul
At the entrance of the Istanbul port,
there is a lighthouse,
in front of Haghia Sophia on the coast.
Lighthouse stands for FENER(lantern) in Turkish.
One of the reasons I like English more sometimes...
The name of this lighthouse is Ahirkapi Feneri
(heavy entrance lantern). Just above this lighthouse,
at the top of the small hill stands Haghia Sophia.
This museum enlightens our minds and shows us
how very large systems can be built to endure.
Previously, it was assigned to be a mosque by
Fatih Sultan Mehmed(Conquerror Sultan).
Before its conquerror, it was meant to be
built as a Church by a Byzantium Emperor.
There is a mysterious water sistern
in the same district left from the Byzantium,
Yerebatan Sarayi(The Sunken Palace).
The Sunken Serail can be visited easily,
walking on pedestrian bridges underground
over the water filled bottom... Its mystery
comes from a collossal head of Medusa dating
from pre-Christian times...
This antique marble head belonged to
a temple that was originally built at the
location of Haghia Sophia or the same vicinity.
The temples were built at the top of hills
to help ship navigation with their burning torches
in those past times. With their wisdom,
they not only guided their society through
violent times but also they managed navigation.
As my former EUROCONTROL colleague had mentioned
once funnyly, the oracle at Didyma, was one of them,
which also gave advises to the king, but the
king was responsible for the results of his decision.
The same principle applies to the pilot and the
Air Traffic controller in the upper airspace.
Returning back to the antique marble head,
turned upside down and used as a base for one of
many columns at the deepest point of the Sunken Palace-
water sistern, I would like to allude:
"just as we forbid sacrifices, so it is Our will that
the ornaments of public works shall be preserved"
The Survival of Roman Antiquities in the Middle Ages,
Michael GREENHALGH 1989 Duckworth, p.93,
Badische Landes Bibliothek.
Said one of the dieties just after the Christian
religion got established. Probably, the Byzantium
Christians liked this but they could not keep it
publicly because it was Pagan.
"From the mid-fourth century it became both
dangerous and unprofitable to be a pagan (survey in
Cochrane 1940, 329 ff.) as 'imparial legislation
offended the Christians a pretext for physical action'
against the cults(Borner, 1984, 346). In the year
365, worshipping images or sacrificing to them
became a capital offence (Cod Th. 16.10.6).
Infact, "pagans gave Christianity 'a good
deal of pagan culture and not a little pagan practice'
(Bonner, 1984, 356).
What strikes me most about ISTANBUL is how
she managed to keep different cultures in herself.
If you have an opportunity to come and visit Istanbul,
please keep an eye on how Istanbul has first hidden
then kept and finally brought her own to the sunlight
again, thus preserved her own culture...
If you sit at Harem and drink a tea at the
Damalis kaffee or at the miniature Virgin tower island,
you enjoy the 360 degrees view of Istanbul... I love
to drink my tea changing locations in the same afternoon,
looking at my city from different locations on the
Bosphorus... Istanbul is a marvelous city built on
seven hills, a water strait and three peninsula...
I grew up in ISTANBUL and with different views
of her.
Istanbul has been a center of ship navigation
and trade for thousands of years. Conquerror Sultan
Mehmed decided to KEEP the city as it is. You will be
able to see with your own eyes, when you visit Haghia Sophia.
He ordered the precious mosaics to be covered with
lime paint. Similar to Byzantians hiding the Medusa head.
Whoever conquers it, Istanbul is a city of TOLERANCE.
She is a country miniaturized in a city... She is a
thousand years time imbued in stone and flesh... She is
millions of soul in a single body. She deserves every bit of
minute interest she drives.
As the European Union is approaching Turkey and
expressing interest to reclaim its own and maybe its
source of aspiration for its next Renaissance,
Istanbul shines as a city of tolerance preserving
what belongs very much to Her.
Istanbul deserves due respect in everything she does.
I wish you a Merry Christmas and happy New Year...
Seasons Greetings to you all...
Ali R+ SARAL
there is a lighthouse,
in front of Haghia Sophia on the coast.
Lighthouse stands for FENER(lantern) in Turkish.
One of the reasons I like English more sometimes...
The name of this lighthouse is Ahirkapi Feneri
(heavy entrance lantern). Just above this lighthouse,
at the top of the small hill stands Haghia Sophia.
This museum enlightens our minds and shows us
how very large systems can be built to endure.
Previously, it was assigned to be a mosque by
Fatih Sultan Mehmed(Conquerror Sultan).
Before its conquerror, it was meant to be
built as a Church by a Byzantium Emperor.
There is a mysterious water sistern
in the same district left from the Byzantium,
Yerebatan Sarayi(The Sunken Palace).
The Sunken Serail can be visited easily,
walking on pedestrian bridges underground
over the water filled bottom... Its mystery
comes from a collossal head of Medusa dating
from pre-Christian times...
This antique marble head belonged to
a temple that was originally built at the
location of Haghia Sophia or the same vicinity.
The temples were built at the top of hills
to help ship navigation with their burning torches
in those past times. With their wisdom,
they not only guided their society through
violent times but also they managed navigation.
As my former EUROCONTROL colleague had mentioned
once funnyly, the oracle at Didyma, was one of them,
which also gave advises to the king, but the
king was responsible for the results of his decision.
The same principle applies to the pilot and the
Air Traffic controller in the upper airspace.
Returning back to the antique marble head,
turned upside down and used as a base for one of
many columns at the deepest point of the Sunken Palace-
water sistern, I would like to allude:
"just as we forbid sacrifices, so it is Our will that
the ornaments of public works shall be preserved"
The Survival of Roman Antiquities in the Middle Ages,
Michael GREENHALGH 1989 Duckworth, p.93,
Badische Landes Bibliothek.
Said one of the dieties just after the Christian
religion got established. Probably, the Byzantium
Christians liked this but they could not keep it
publicly because it was Pagan.
"From the mid-fourth century it became both
dangerous and unprofitable to be a pagan (survey in
Cochrane 1940, 329 ff.) as 'imparial legislation
offended the Christians a pretext for physical action'
against the cults(Borner, 1984, 346). In the year
365, worshipping images or sacrificing to them
became a capital offence (Cod Th. 16.10.6).
Infact, "pagans gave Christianity 'a good
deal of pagan culture and not a little pagan practice'
(Bonner, 1984, 356).
What strikes me most about ISTANBUL is how
she managed to keep different cultures in herself.
If you have an opportunity to come and visit Istanbul,
please keep an eye on how Istanbul has first hidden
then kept and finally brought her own to the sunlight
again, thus preserved her own culture...
If you sit at Harem and drink a tea at the
Damalis kaffee or at the miniature Virgin tower island,
you enjoy the 360 degrees view of Istanbul... I love
to drink my tea changing locations in the same afternoon,
looking at my city from different locations on the
Bosphorus... Istanbul is a marvelous city built on
seven hills, a water strait and three peninsula...
I grew up in ISTANBUL and with different views
of her.
Istanbul has been a center of ship navigation
and trade for thousands of years. Conquerror Sultan
Mehmed decided to KEEP the city as it is. You will be
able to see with your own eyes, when you visit Haghia Sophia.
He ordered the precious mosaics to be covered with
lime paint. Similar to Byzantians hiding the Medusa head.
Whoever conquers it, Istanbul is a city of TOLERANCE.
She is a country miniaturized in a city... She is a
thousand years time imbued in stone and flesh... She is
millions of soul in a single body. She deserves every bit of
minute interest she drives.
As the European Union is approaching Turkey and
expressing interest to reclaim its own and maybe its
source of aspiration for its next Renaissance,
Istanbul shines as a city of tolerance preserving
what belongs very much to Her.
Istanbul deserves due respect in everything she does.
I wish you a Merry Christmas and happy New Year...
Seasons Greetings to you all...
Ali R+ SARAL
SITUATION AWARENESS IN THE MAINTENANCE AND ENHANCEMENT OF ATC SYSTEMS
This is the third of my four articles serie on FALSE SENSE OF SAFETY
in the Air Traffic Control systems. The fourth article will be on
the "Passenger's Right to Know"...
I would like to draw your attention to a brilliant article on the situation awareness of the air traffic controller:
ATTENTION DISTRIBUTION AND SITUATION AWARENESS IN AIR TRAFFIC CONTROL
by Endsley and Rodgers (1996).
You can find this article on the internet.
Endsley and Rodgers article is about a scientific experiment done to measure the situation awareness of air traffic controllers. "A study was conducted to investigate the way in which controllers deploy their attention in processing information in en route air traffic control scenarios.(1)" The article is 4 pages long and explains clearly the terms and conditions the test was made.
The test procedure was described as: The subjects do normal controlling in an area for which they were licensed. "Each scenario consisted of a recreation of the ten minutes immediately prior to the occurrence of
the OE(operational errors). Twice during each scenario, the recreation was halted and the screen blanked."
After that:
"Subjects were asked to indicate the location of all known aircraft on the map, and, for each aircraft, to indicate or make a judgment of:
(1) if the aircraft was:
(a) in the displayed sector’s control,
(b) other aircraft in the sector not under sector control, or
(c) would be in the sector’s control in the next two minutes,
(2) aircraft call sign,
(3) aircraft altitude,
(4) aircraft groundspeed,
(5) aircraft heading,
(6) the next sector the aircraft would transition to, (7) whether the aircraft was climbing, descending or
level,
(8) whether the aircraft was in a right turn, left turn or straight,
(9) which pairs of aircraft had lost or would lose separation if they stayed on their current
(assigned) courses,
(10) which aircraft would be leaving the sector in the next two minutes,
(11) which aircraft had received clearances that had not been completed, and, for those, whether the
aircraft received its clearance correctly and whether the aircraft was conforming to its clearance, and
(12) which aircraft were currently being impacted by weather or would be impacted in the next five
minutes."
The article describes the results and evaluation also:
"RESULTS AND DISCUSSION
Subjects’ responses to each question were scored for accuracy based on computer data for each aircraft at the time of each freeze. Responses were scored as either correct or incorrect based on operationally determined tolerance intervals. Missing responses were scored as incorrect."
You can find the complete article at:
http://www.satechnologies.com/Papers/pdf/HFES96-ATC-SA.pdf
My point is: A similar experiment could be done for measuring SITUATION AWARENESS IN THE MAINTENANCE AND ENHANCEMENT OF ATC SYSTEMS. As an example, I will state below a number of SA criteria similar to the above given...
------------------------------------------------------
The persona who should be taking the test are:
1-Operationally responsible person from the software maintainer/developer
2-Operational interface person between the operational institution and the software maintainer/developer
3-their first aids or replacements
4-software configuration's responsible person
5-version control's responsible person
6-various group supervisors who are also quality inspectors such as Radar, FPP and ATN groups.
------------------------------------------------------
The questions they should answer could be:
1- How many releases are released in the last six months, one month, last week respectively?
2- How many errors and system abends were done for each month and each release in the last six months,
one month, last week?
3- How many operational deficiencies are solved in each release in the last six, one months and last week?
What are the operational and technical difficulties of these according to a well established complexity
criterium? (system LOC, change LOC, system complexity, changed region complexity).
4- What structure and content has the release? Multi-changes, small changes, big changes etc.
5- What direction is the system maintenance effort cruising in terms of four items above? More difficult, same or relaxed?
Human factors
1- What is the motivation level in the software team? Specially people who work on the current changes?
2- What is the number of hospital visits, doctor visits, nervous breakdowns in the team?
3- What is the number of sick days taken of by the software personnel?
4- What is the number of leaves taken from annual vacation?
5- What is the number of days that could not be used for vacation leaves although they were used?
6- What is the number of official complaints or telephone calls to the welfare services?
7- What is the total duration of time spent in technical and other meetings, including official but personal
ones?
8- What are the number and duration of telephone calls made in the team?
9- What is the daily and total working duration?
10- What is the number and duration of lates at lunch and other breaks?
11- What are the number of quarrels and heated discussions in the team?
Weather conditions
1- last week (sudden changes?)
2- at the planned time for the release.
Adjacent centers and other affiliates
1- Communication conditions
2- The availability of service at the adjacent centers 3- track record of adjacent centers' availabilities at that
time of the year
Military conditions
1- the level and quality of interaction with military
2- temporary reserved area situations
3- communication lines etc quality
Availability
1- system availability: hardware, planned maintenance etc.
2-personnel: leaves, new policies such as
personnel reduction, service time increase etc.
Airmisses
1- number of at that time of the year
2- track record of airmisses for the last
six months including the recent
Traffic
1- Number of flights:general, sector, point
2- Flights at that time of the year and at that hour
3- Number of special events at that time of the year
highjack, emergency sicknesses etc.
Flights of airlines involved
1-Airlines related with scheduled flights at the release moment
Night - day conditions
Operational team - controllers' condition
1- strike
2- reduced team for some reason
3- workload and experience of the controller directly involved.
4- personal condition if any of the controller
As the saying goes "You can not manage if you can not measure". These questions and possibly others have to be detailed and distributed to the related members and supervisors of the ATC software-maintenance team. They should regularly answer these questions and an automatic system should produce a single number indicating the RISK of realising the changes at that moment of the time.
This number could be conveyed to adjacent centers so that they could calculate their own risks. All of this is possible and meaningful in relation to a series of values taken through the time(as in (1)).
These are simple principles to think but very "complex" things to realise. The reason behind this is ATC people are generally "too busy" and "overloaded". Namely, their motivation is low.
If anybody had known there were 3 levels of maintenance or tech problems going on in Switzerland, they would not let an airplane full of chieldren go there... People SHOULD HAVE the RIGHT TO KNOW. And we the engineers should provide the existing information with due transparency and respect to human life.
Kind regards.
Ali R+ SARAL
Note:
REFERENCES:
1- (1996) In Proceedings of the 40th Annual Meeting of the Human Factors and Ergonomics Society ( pp. 82-85). Santa Monica, CA: Human Factors and Ergonomics Society.
ATTENTION DISTRIBUTION AND SITUATION AWARENESS IN AIR TRAFFIC CONTROL
Mica R. Endsley Mark D. Rodgers
Texas Tech University Federal Aviation Administration Lubbock, TX Washington, D.C.
2- Schneidewind, Methodology for Validating Software Metrics
IEEE Transactions on Software Engineering VOL 18 No 5 May 1992.
in the Air Traffic Control systems. The fourth article will be on
the "Passenger's Right to Know"...
I would like to draw your attention to a brilliant article on the situation awareness of the air traffic controller:
ATTENTION DISTRIBUTION AND SITUATION AWARENESS IN AIR TRAFFIC CONTROL
by Endsley and Rodgers (1996).
You can find this article on the internet.
Endsley and Rodgers article is about a scientific experiment done to measure the situation awareness of air traffic controllers. "A study was conducted to investigate the way in which controllers deploy their attention in processing information in en route air traffic control scenarios.(1)" The article is 4 pages long and explains clearly the terms and conditions the test was made.
The test procedure was described as: The subjects do normal controlling in an area for which they were licensed. "Each scenario consisted of a recreation of the ten minutes immediately prior to the occurrence of
the OE(operational errors). Twice during each scenario, the recreation was halted and the screen blanked."
After that:
"Subjects were asked to indicate the location of all known aircraft on the map, and, for each aircraft, to indicate or make a judgment of:
(1) if the aircraft was:
(a) in the displayed sector’s control,
(b) other aircraft in the sector not under sector control, or
(c) would be in the sector’s control in the next two minutes,
(2) aircraft call sign,
(3) aircraft altitude,
(4) aircraft groundspeed,
(5) aircraft heading,
(6) the next sector the aircraft would transition to, (7) whether the aircraft was climbing, descending or
level,
(8) whether the aircraft was in a right turn, left turn or straight,
(9) which pairs of aircraft had lost or would lose separation if they stayed on their current
(assigned) courses,
(10) which aircraft would be leaving the sector in the next two minutes,
(11) which aircraft had received clearances that had not been completed, and, for those, whether the
aircraft received its clearance correctly and whether the aircraft was conforming to its clearance, and
(12) which aircraft were currently being impacted by weather or would be impacted in the next five
minutes."
The article describes the results and evaluation also:
"RESULTS AND DISCUSSION
Subjects’ responses to each question were scored for accuracy based on computer data for each aircraft at the time of each freeze. Responses were scored as either correct or incorrect based on operationally determined tolerance intervals. Missing responses were scored as incorrect."
You can find the complete article at:
http://www.satechnologies.com/Papers/pdf/HFES96-ATC-SA.pdf
My point is: A similar experiment could be done for measuring SITUATION AWARENESS IN THE MAINTENANCE AND ENHANCEMENT OF ATC SYSTEMS. As an example, I will state below a number of SA criteria similar to the above given...
------------------------------------------------------
The persona who should be taking the test are:
1-Operationally responsible person from the software maintainer/developer
2-Operational interface person between the operational institution and the software maintainer/developer
3-their first aids or replacements
4-software configuration's responsible person
5-version control's responsible person
6-various group supervisors who are also quality inspectors such as Radar, FPP and ATN groups.
------------------------------------------------------
The questions they should answer could be:
1- How many releases are released in the last six months, one month, last week respectively?
2- How many errors and system abends were done for each month and each release in the last six months,
one month, last week?
3- How many operational deficiencies are solved in each release in the last six, one months and last week?
What are the operational and technical difficulties of these according to a well established complexity
criterium? (system LOC, change LOC, system complexity, changed region complexity).
4- What structure and content has the release? Multi-changes, small changes, big changes etc.
5- What direction is the system maintenance effort cruising in terms of four items above? More difficult, same or relaxed?
Human factors
1- What is the motivation level in the software team? Specially people who work on the current changes?
2- What is the number of hospital visits, doctor visits, nervous breakdowns in the team?
3- What is the number of sick days taken of by the software personnel?
4- What is the number of leaves taken from annual vacation?
5- What is the number of days that could not be used for vacation leaves although they were used?
6- What is the number of official complaints or telephone calls to the welfare services?
7- What is the total duration of time spent in technical and other meetings, including official but personal
ones?
8- What are the number and duration of telephone calls made in the team?
9- What is the daily and total working duration?
10- What is the number and duration of lates at lunch and other breaks?
11- What are the number of quarrels and heated discussions in the team?
Weather conditions
1- last week (sudden changes?)
2- at the planned time for the release.
Adjacent centers and other affiliates
1- Communication conditions
2- The availability of service at the adjacent centers 3- track record of adjacent centers' availabilities at that
time of the year
Military conditions
1- the level and quality of interaction with military
2- temporary reserved area situations
3- communication lines etc quality
Availability
1- system availability: hardware, planned maintenance etc.
2-personnel: leaves, new policies such as
personnel reduction, service time increase etc.
Airmisses
1- number of at that time of the year
2- track record of airmisses for the last
six months including the recent
Traffic
1- Number of flights:general, sector, point
2- Flights at that time of the year and at that hour
3- Number of special events at that time of the year
highjack, emergency sicknesses etc.
Flights of airlines involved
1-Airlines related with scheduled flights at the release moment
Night - day conditions
Operational team - controllers' condition
1- strike
2- reduced team for some reason
3- workload and experience of the controller directly involved.
4- personal condition if any of the controller
As the saying goes "You can not manage if you can not measure". These questions and possibly others have to be detailed and distributed to the related members and supervisors of the ATC software-maintenance team. They should regularly answer these questions and an automatic system should produce a single number indicating the RISK of realising the changes at that moment of the time.
This number could be conveyed to adjacent centers so that they could calculate their own risks. All of this is possible and meaningful in relation to a series of values taken through the time(as in (1)).
These are simple principles to think but very "complex" things to realise. The reason behind this is ATC people are generally "too busy" and "overloaded". Namely, their motivation is low.
If anybody had known there were 3 levels of maintenance or tech problems going on in Switzerland, they would not let an airplane full of chieldren go there... People SHOULD HAVE the RIGHT TO KNOW. And we the engineers should provide the existing information with due transparency and respect to human life.
Kind regards.
Ali R+ SARAL
Note:
REFERENCES:
1- (1996) In Proceedings of the 40th Annual Meeting of the Human Factors and Ergonomics Society ( pp. 82-85). Santa Monica, CA: Human Factors and Ergonomics Society.
ATTENTION DISTRIBUTION AND SITUATION AWARENESS IN AIR TRAFFIC CONTROL
Mica R. Endsley Mark D. Rodgers
Texas Tech University Federal Aviation Administration Lubbock, TX Washington, D.C.
2- Schneidewind, Methodology for Validating Software Metrics
IEEE Transactions on Software Engineering VOL 18 No 5 May 1992.
Kaydol:
Kayıtlar (Atom)
