Carl Westin

164 Discussion and recommendations used as an indirect measure of automation use, requiring the controller to reflect and evaluate the advisory given. A person is likely to accept an advisory if she/he agrees with it, or reject it if she/he disagrees with it. Although this relationship was proven true in most cases, occasionally a controller would agree with an advisory but still reject it, or the other way around. This discrepancy can, perhaps, be attributed to effects of trust. Controllers were instructed that advisories always were safe and would solve the conflict, although not necessarily in the most optimal way. The in- tention was to neutralize trust (acting as a confound) by preventing controllers from questioning the safety of advisories. At the same time, instructions sought to pre- vent controllers from blindly accepting advisories, but questioning and comparing them with their own solutions. Given what is known about dispositional trust (see Chapter 4), however, it can be assumed that controllers had different trust attitudes that influenced their willingness to rely on advisories. Therefore, future research should investigate the effects of strategic conformance on participants’ trust in both the system and its outputs. The number of separation losses (for designed conflicts) was used as a measure of safety. Since no separation losses were recorded, safety was maintained. While the minimum separation distance between aircraft could have been used as a proxy for safety, it was decided not to. If considering a conflict between two aircraft, a theoretical perspective argues that safety increases with increased separation. From a practical perspective, however, safety appears to be more ambiguously applied. At distances above the separation requirements (typically 5 nmi horizontally and 1000 ft vertically) the perception of safety does not appear to increase linearly with the separation distance. Rather, the issue of loosing efficiency by distancing air- craft unnecessarily far apart appears increasingly important for controllers. Indeed, controllers’ sometimes implemented “tight” vectors to increase efficiency while still maintaining separation. These “tight” solutions may be linked to the SSDs explicit visualization of boundaries for safe separation, which invited controllers to “push” the safety en- velope, reducing the margins for error, and operating closer to safety limits. This ties on to safety concerns of boundary migration in resilience engineering, 274 which also have been observed in empirical research with ecological interfaces. 121 Opera- tors in safety-critical, dynamic environments typically view safety as the absence of failure and incidents. 275 This perspective has analogously been found representative for controllers, who judge the risk for conflict and need to intervene dichotomously depending on the distance between aircraft in relation to the stipulated separation minima. 61, 276 As such, safety appears to be perceived binary and there may be little incentive for enhancing safety above the required safety threshold. Further research should investigate how controllers perceive safety.