A federal radar in Kirksville, Mo., picked up United Airlines Flight 1312 as it made its way east from Los Angeles, transmitting the plane’s signal over phone lines to the Chicago Air Route Traffic Control Center in Aurora.
After the signal had coursed its way through a maze of electronic equipment in a large high-ceilinged room on the ground story of the center at 619 Indian Trail Rd., a blip representing the United MD-80 twin-jet appeared one floor above on the green radar screen of controller Steve Smart.
Smart guided Flight 1312, then at 37,000 feet and about 200 miles southwest of Chicago, through “Bradford High,” the chunk of airspace he was working. He then punched a few buttons at his work station, one of 47 at the facility, and electronically “handed off” the plane to colleague Laura Piccolin.
Piccolin, seated a few feet to Smart’s left in the darkened control room and busy handling planes in the adjacent “Plano” sector, took over the United jet that now appeared on the edge of her screen. A few minutes later as it progressed eastward, she cleared it to descend to 11,000 feet and, ultimately, handed it off to controllers at O’Hare International Airport who guided it in for a routine landing.
This is the way it’s supposed to work at Chicago Center, the busiest control facility in the nation. And this is the way it usually does.
But an alarming number of computer failures in the last year, the most recent Sept. 12, has disrupted operations and raised troubling questions about safety at the sprawling facility.
Federal Aviation Administration officials contend that even when problems hit, the air traffic control system is completely safe.
Controller union officials counter that any glitch opens the door, if only a crack, to a possible mistake that could lead to an in-air collision.
As public concern about Chicago Center’s dependability grows, a congressional subcommittee is scheduled to sort through the conflicting assessments at a Tuesday hearing at the facility.
And while the panel won’t produce any instant solutions, testimony is expected to shed light on how the computer system and its two backups function.
When operations are normal, signals from airplanes collected by nine radar sites in six states come into the Chicago Center’s main computer, called the “host.”
The host creates an airspace “mosaic,” effectively placing the aircraft in proper relation to one another and adding information from each plane’s flight plan.
The host relays all of this data to an IBM computer system called the 9020E, which processes it, sending it in usable form to the controllers’ displays.
Failures involving the 9020E-an increasingly brittle 25-year-old fossil, even by the FAA’s assessment-have hit the Aurora center four times since July.
When the 9020E goes down, radar data is sent by the host to a computer system called Direct Access Radar Channel, or DARC, that bypasses the old IBM.
From the view at the radar screen, this backup system is virtually indistinguishable from the primary system.
The blips continue to appear along with the accompanying “data blocks” containing flight number and computer ID number of each plane, its altitude, and its speed.
But losing the 9020E means that four special features are no longer available to controllers. They are:
– A “conflict alert” that warns of an impending loss of proper separation between planes.
– Route projection, a feature that permits the controller to project a plane’s intended flight path on the screen.
– The “J-ball” or “Pandora’s circle,” a circle the controller can paint around any plane on the screen to help visualize the required 5-mile separation from another plane.
– A “minimum safe altitude warning,” something of greater importance in mountainous regions than in the relatively flat upper Midwest.
The features are “enhancements” for controllers, who are trained to keep proper distance between planes, according to the FAA.
The National Air Traffic Controllers Association takes a different view.
“Any time you take a tool away from us, safety is compromised,” asserted Bill Seay, a Chicago Center controller who is the union’s regional training coordinator.
The host-DARC backup allows controllers to handle virtually the same number of planes they control using the primary system, though the ability to call up weather and other ancillary data may be sacrificed to maintain that volume.
If the 9020E and host computers fail simultaneously, leaving DARC to process radar data by itself, controllers can handle only a fraction of their normal volume.
In this “backup to the backup” mode, the blips and flight data blocks remain on the screen, but controllers must do much more of their work without computer assistance.
No longer able to hand off planes with a few keyboard strokes, for example, they must pick up phones to talk to controllers in adjacent blocks of airspace and make the switches verbally.
In addition, strips of paper with details of each flight that are kept in a rack next to each controller’s radar screen-used to help keep track of planes in the controller’s airspace and other flights that are scheduled to arrive soon-must be written by hand instead of printed by computer.
If DARC is the only system operating, standard FAA procedure dictates that some flights scheduled for takeoff are delayed on the ground and spacing between planes in the air is increased as Chicago Center handles only about 25 percent of its normal volume.
During most of the six outages over the last year at the center, controllers have operated without the 9020E in the host-DARC mode.
But on Sept. 14, 1994, an electrical short caused by a contractor knocked out the 9020, the host and DARC.
Radar screens were plunged into darkness for up to seven minutes, according to the FAA, and controllers were left to keep track of planes using their paper strips.
Even with such total computer outages, however, FAA officials insist safety is built into the system.
Controllers are able to “sterilize” Chicago Center’s airspace, handing off all traffic to other facilities in such places as Minneapolis, Kansas City and Indianapolis in as little as 12 minutes, said Denis Burke, the facility’s manager.
Theoretically, much worse things can happen than total computer failure, according to FAA officials. Disasters ranging from sabotage to tornadoes could knock a control center completely out of commission.
But in these situations, contingency plans would kick in, with neighboring facilities taking control of flights in the affected airspace, officials said.
However, controllers contend-and some FAA managers agree-that even a switch from the primary computer system to the host-DARC backup can cause momentary confusion and a scramble to adjust.
That means risk, critics say.
“I think common sense tells you that the transition period is perhaps the most critical,” acknowledged Monte Belger, head of air traffic services for the FAA.
But the men and women at the radar screens “are very, very capable and they are extremely resourceful, and they know what to do when we have these interruptions,” he asserted.
Nevertheless, outages at Chicago Center and several other control facilities nationwide that have suffered similar computer failures have prompted the FAA to plan refresher training to help controllers polish their skills until temporary replacements to the 9020E arrive in two years.
When computer problems are chronic, it can have longer-term consequences, according to Mike Connor, director of safety and technology for the National Air Traffic Controllers Association.
“I think controllers begin to question the reliability of their equipment, and that places a subconscious burden on them about when this damn thing is going to go again,” he said.
“Ultimately, it creates stress,” Connor said.
“You keep (getting) these little surprises. It wears you down after a while.”
