Cognitive Engineering in the Aviation Domain

title author publisher isbn10 | asin print isbn13 ebook isbn13 language subject publication date lcc ddc subject

: : : : : : : : : : :

Cognitive Engineering in the Aviation Domain Sarter, Nadine B. Lawrence Erlbaum Associates, Inc. 0805823158 9780805823158 9780585344249 English Aeronautics--Human factors, Cognitive science. 2000 TL553.6.C64 2000eb 629.13 Aeronautics--Human factors, Cognitive science. cover Page iii

Cognitive Engineering in the Aviation Domain Edited by Nadine B. Sarter The Ohio State University René Amalberti IMASSA, Brétigny-sur-Orge, France

page_iii

Page iv Copyright © 2000 by Lawrence Erlbaum Associates, Inc. All rights reserved. No part of the book may be reproduced in any form, by photostat, microform, retrieval system, or any other means, without the prior written permission of the publisher. Lawrence Erlbaum Associates, Inc., Publishers 10 Industrial Avenue Mahwah, New Jersey 07430 Cover design by Kathryn Houghtaling Lacey Library of Congress Cataloging-in-Publication Data Cognitive engineering in the aviation domain / edited by Nadine B. Sarter, René Amalberti. p. cm. Includes bibliographical references and index. ISBN 0-8058-2315-8 (cloth : alk. paper) -- ISBN 0-8058-2316-6 (pbk. : alk paper) 1. Aeronautics--Human factors. 2. Cognitive science. I. Sarter, Nadine B. II. Amalberti, René. TL553.6 .C64 2000 629.13--dc21

99-058493

Books published by Lawrence Erlbaum Associates are printed on acid-free paper, and their bindings are chosen for strength and durability. Printed in the United States of America 10 9 8 7 6 5 4 3 2 1 page_iv Page v

CONTENTS

Foreword Charles E. Billings, M.D.

vii

Introduction: Cognitive Engineering in the Aviation DomainOpportunities and Challenges René Amalberti and Nadine B. Sarter

1

Part I: Frameworks and Models of Human-Automation Coordination and Collaboration 1. Cognitive Models and Control: Human and System Dynamics in Advanced Airspace Operations Kevin M. Corker

13

2. Mental Workload and Cognitive Complexity Véronique De Keyser and Denis Javaux

43

3. Modeling the Orderliness of Human Action Erik Hollnagel

65

4. Cognitive Aspects and Automation Marcel Leroux

99

Part II: Use(r)-Centered System Design and Training in Support of Joint System Performance 5. Task-Oriented Display Design: The Case of an Engine-Monitoring Display Terence S. Abbott

133

6. Cognitive Engineering: Designing for Situation Awareness John M. Flach and Jens Rasmussen

153

page_v

Page vi 7. Context Simulation: An Interactive Methodology for User-Centered System Design and Future Operator Behavior Validation Peter G. A. M. Jorna

181

8. Horizons in Pilot Training: Desktop Tutoring Systems Christine M. Mitchell

211

9. Aviation Safety Paradigms and Training Implications Jean Pariès and René Amalberti

253

10. Experimental Crew Training to Deal with Automation Surprises Marielle Plat and René Amalberti

287

11. A Cognitive Engineering Perspective on Maintenance Errors James Reason

309

12. Learning from Automation Surprises and "Going Sour" Accidents David D. Woods and Nadine B. Sarter

327

Author Index

355

Subject Index

361 page_vi Page vii

FOREWORD Charles E. Billings, M.D. The Ohio State University This volume illustrates how far we have come, in a very short period of time, in our understanding of the cognitive bases of human work in complex human-machine systems. In a few decades, we have moved from studies of human behavior based on elegant theories, but evaluated in grossly simplified empirical studies in relatively sterile environments, to studies based on a more ecological view of the human embedded in a complex world, based on ethnographic studies in which the world of work is taken as it comes, with all of its richness and variance, and humans are recognized as adaptive organisms, learning from their experiences, tailoring their working environments and their own performance to meet the requirements of the tasks they are given. Humans have been phenomenally successful in meeting those requirements, even using tools that may not be conducive to success, in environments that are dangerous or poorly controlled. Yet our studies until comparatively recently have usually been of human performance failures, and of the human shortcomings that contribute to such failures. We have too often failed to recognize that successful performance is the norm, and performance failures are rare. There are not enough good studies of why humans succeed despite the handicaps they may face. It has taken us even longer to recognize that expertise and error are opposite faces of the same coin, and that the same factors that usually contribute to successful performance may, under unusual circumstances, enable failures of performance. To begin to understand success and failure in complex, real-time human-machine systems involving risk and danger, we have had to look beyond the human, into the environments in which persons attempt to perform useful work. We have been forced to look beyond the immediate circumstances of accidents, catastrophes, disasters: to examine the physical, organizational, and social environments in which work is performed, the tools that are provided to support that performance, the machines that accomplish the work, the policies and procedures that guide humans in their control of those machines, and the training and education provided to workers to give them the expertise necessary to exert that control. We have had to test our hypotheses in much more difficult experiments in which the context of page_vii

Page viii humans' work is recreated, either in their work places themselves, or in simulations designed to reproduce, as much as possible, the machines and environments in which they function. We have had to recast our notions and theories in terms not only of the humans, but also of the machines and environments that shape their behavior for better or worse. We have had to test those theories using real experts doing real work in real contexts. We have had to try to convince design engineers to modify the machinery they make, and the managers who control environments in which work is performed to conform to our views of how to help humans to perform more effectively, for this is the ultimate test of our effectiveness. We have had to convince both groups that modifying the work environment can be cost-effective in terms of product or of service improvement, even if we are unable to prove the costs avoided by a reduction in accidents or wastage. The editors of this book, and the authors whose work is included, have much in common. They subscribe, in varying degrees, to the need to evaluate work in context. They have accepted new paradigms for the study of humans working in complex environments. They view the human as an asset, indeed a necessity, in human-machine systems and they accept and take advantage of variations in human behavior. They recognize that much or most error is the result of mismatches between human capabilities and the demands placed on those humans by the machines that they use in the environments in which they are placed. The authors come from many nations; they have been trained in various disciplines and schools; they work in a variety of settings. They use a variety of approaches to a common set of problems, an advantage because they have produced converging evidence in support of this new approach. There is much more in common among their conclusions than may be evident at first glance. Even when the results of their researches may have been variously interpreted by those who use such results, there is emerging, although slowly, a general recognition that complex machines must be designed and built as tools to assist and enhance the work of humans, who remain the last line of defense against disaster in the complex aviation system (and this is true in other systems as well). Herein lies the rub. Those who design, build, buy, and operate complex machinery have been exposed for a long time to the older concept that human error is the primary and overarching cause of failure in complex systems. In aviation and in most other industrial enterprises that have been studied, human errors are thought to cause or contribute to between 70% and 90% of accidents, and this figure changes little over time. It is generally accepted (and reinforced, not only by media accounts of disasters but too often even by official investigations of such events) that the human is the least reliable element in complex industrial operations. Much of our regulatory and enforcement apparatus in aviation is designed to standardize human behavior in every facet of flight operations, to minimize the variability believed to give rise to such errors. page_viii Page ix Much expensive automation has been introduced, largely to minimize the likelihood of human failures by making the human operator less central to system functioning. The elaborate infrastructure of policies and procedures that govern operator behavior has arisen as a result of studies of such behavior in incidents, accidents, and disasters. Less attention has been given to how, and why, these same humans have helped the system to succeed in the overwhelming majority of its operations, and in many cases have brought success out of almost certain failure under extremely difficult circumstances, as in several narrowly averted disasters in manned space operations (e.g., Apollo 13). Cognitive systems engineering represents an attempt to balance these scales by studying the human at work in the context of the persons, the work, the machines, and the environments in which work is performed. This expanded approach to human performance has emerged because of spectacular failures in the performance of complex systems operating in high-risk environments: nuclear power systems, industrial process control systems, aviation operations, complex medical treatment operations. Careful studies of these failures have led to the recognition that not only workers, but machines, the environments in which they are operated, and often the conditions of work, enable such failures to occur. What is needed now is to help those who create these tools and working environments to understand how they can be made more conducive to uniformly safe and productive endeavor. In this task, we have not yet succeeded. The older concepts of failure prevail in many quarters, and will continue to prevail until we can communicate our new knowledge more effectively to designers, to engineers, to managers who buy these machines, and to operators who create the environments and supervise the people at the sharp endthe ultimate users of the machines. Given that we know much more now about how humans function in these complex systems, why have we, the theorists and researchers who think about these problems, not been more effective in "selling our wares"? There are several reasons. It may be worthwhile to consider some of them. I have alluded to one important factor earlier. The entire design process is built on trade-offs. At every step, designers and builders must balance the probable effectiveness of a new approach against the full costs of designing and implementing that approach. "What must users have?" must always compete with "What would users like to have?" We have often been unable to demonstrate conclusively that an innovation will have a payoff sufficient to overcome the cost of implementing it. In part, this is because we usually count our successes in terms of failures, or accidents, that do not occur (and it is very difficult to estimate these) but in part, it is also because safety is relatively intangible. We have often not been able to demonstrate that an innovation will have significant benefits even if catastrophic performance failures do not happen: that a new approach can help an operation become more successful under normal circumstances, as well as more safe. The aviation system is extremely safe now; page_ix

Page x how will an expensive change make it significantly better (in the last analysis, more profitable)? We are not used to thinking in these terms, but we need to begin if we are to become more effective. We have also (like designers and builders of systems) not always given sufficient thought and effort to taking a systematic, or systems, approach to the problems with which we are confronted. As human-machine systems have become more and more complex, they have also become more tightly coupled or integrated. It has become more difficult to predict potential failure modes, as well as to understand those failures after they have occurred. We, the investigators who delve into success and failure in such complex systems, must adopt a more proactive stance with respect to our evaluation of proposed new systems. We must examine these systems more aggressively at the conceptual stage, and even before the concepts are firm, to detect potential sources of future trouble in human-machine-environment interactions. This is the stage at which our insights can be most helpful to engineers who must realize such systems, for it is the stage at which resolution of the problems is least expensive and usually most effective. We believe that training humans to cope with system shortcomings is a poor way to compensate for those shortcomings, but we have been less effective in predicting those problems than in correcting for them once a new system is in place. This must change, and we are the people who are going to have to make that change. It is difficultbut not impossibleto study envisioned worlds, and we must learn to do so if we hope to influence the shape of those future worlds. Most of us have been trained in scientific disciplines. Although this have given us a unique ability to provide rigorous proof of theorems and hypotheses, it has made it more difficult for us to sympathize with the pragmatism that is inherent in the disciplines of design and engineeringthe evaluation of trade-offs discussed previously. Our lack of success in "selling" our concepts is partly for that reason, but also partly because our language, our jargon, and our ways of communicating ideas differ so significantly from those of the engineers and technologists with whom we must work if our ideas are to be incorporated into new designs and new products. Yet our knowledge, however important, will be used only to the extent that potential users of this knowledge can understand its implications. We often do not communicate effectively with our "customers," who incorporate that knowledge into new products. Nor do we generally empathize with the time constraints under which engineers and technologists must work. Our scientific processes usually proceed at a stately pace; it is our aim to reach "right" conclusions, not quick ones. Their timelines demand answers when they are needed, even if incomplete or not the "right" ones. With high-value products such as airplanes, the costs of not getting them "out the door" when they are promised are huge for both manufacturers and operators, page_x Page xi and the costs of redesign or significant modifications may be as large. Human factors specialists have often not been able to provide good answers when they are needed, or in the form in which they are needed, to facilitate the conceptualization and design process. This is our problem, not the designers', but it becomes their problem too, if we cannot give them the help they need. We need more training to help us learn how to develop, then communicate effectively, new knowledge that cognitive engineering is helping us to gain about future systems, in future contexts. I believe that this education can be most effectively (and perhaps only) gained in the workplace; that we must actively seek out opportunities for ourselves, and our students, to work with and provide assistance to engineers during the earliest phases of challenging advanced design projects. In this process, we will also help to educate our customers to the necessity of performing future-oriented research to answer questions about envisioned systems. Our work, and their products, will be better for such efforts. I began this foreword by lauding the important new concepts and methods presented here, and the unifying thread among themthe adoption of a new and more powerful paradigm for the study of human work in complex domains involving advanced technologies. I end it by lamenting the enormity of the unfinished taskthe effective communication of the new insights provided by cognitive engineering to those who can embody them in new tools and new, more effective systems for the performance of useful work. I hope that the major research efforts represented in this useful book will assist in the most important effort to communicate between the disciplines that acquire, and those that implement, the knowledge gained, in order that disasters like Three Mile Island, Bhopal, Chernobyl, and the several major aviation catastrophes that inspired much of this work can be avoided in the future. page_xi Page 1

INTRODUCTION: COGNITIVE ENGINEERING IN THE AVIATION DOMAINOPPORTUNITIES AND CHALLENGES René Amalberti IMASSA, Brétigny-sur-Orge, France Nadine B. Sarter Cognitive Systems Engineering Laboratory The Ohio State University Cognitive engineering has gained widespread acceptance as a very promising approach for addressing and preventing difficulties with humanautomation coordination and collaboration. Still, there is considerable skepticism about, and resistance to, this approach within various industries that could benefit from its insights and recommendations. As pointed out by Dr. Billings in the Preface to this book, the challenge for cognitive engineers is to better understand the reasons underlying these reservations and to overcome them by demonstrating and communicating more effectively concepts, approaches, and proposed solutions. To contribute to this goal, the current volume presents concrete examples of cognitive engineering research and design. It is an attempt to complement the already existing excellent literature on cognitive engineering in domains other than aviation (e.g., Rasmussen, Pejtersen, & Goodstein, 1990) and to introduce professionals and students in a variety of domains to this rather young discipline.

The idea for this book was born while the two editors were serving as members of the Federal Aviation Administration (FAA) Human Factors team that was formed in 1994 in response to a number of aviation incidents and accidents involving breakdowns in human-machine interaction. The team's mandate was to review the design, training, and operation of modern glass cockpit aircraft and to make recommendations for possible improvements. After meeting for approximately 1 1/2 years, the page_1 Page 2 team delivered a final report on its findings in June 1996 (Abbott et al., 1996). Our participation in this effort provided a remarkable opportunity to gather information and collaborate with people from different backgrounds and countries. The editors would like to thank the three U.S. chairpersons of the teamDr. Kathy Abbott from the National Aeronautics and Space Administration (NASA), and Steve Slotte and Donald Simpson from the FAAand all team members for sharing with us their insights and concerns and for triggering the idea for this book. A Window of Opportunity for Cognitive Engineering Civil aviation has reached a remarkable safety level with less than one accident per million departures. This places aviation among the safest industries in the world. Still, given the considerable growth expected in air travel (the current number of 25 million flights per year worldwide is expected to double by the year 2010), it is not sufficient to maintain the status quo. Unless the already low accident rate in aviation is reduced even further, the increased traffic volume will lead to an average of 25 accidents per year, with over 1,000 fatalities. Because 70% to 80% of all aviation accidents are considered to involve human error, one promising avenue appears to be investments in a better understanding of, and better support for, human performance and human-machine interaction. This includes improved system and feedback design as well as new forms of pilot training to reduce the potential for errors and their catastrophic consequences. Although the need for introducing these changes is widely acknowledged, progress is slow and faces a number of challenges. The economic pressure and competition in the worldwide aviation industry are intense, and manufacturers and carriers are careful not to invest in proposed solutions without guaranteed safety (and financial) paybacks. Also, the time of national standards and regulations in the aviation domain has ended. Many proposed changes in design, training, or operations need to be accepted and applied worldwide. This need for international consensus slows down, and sometimes prevents, progress. Yet another obstacle is the fact that some in the aviation industry still consider increased automation to be the solution to, rather than a potential source of, human factors problems. To them, observed difficulties are the consequence of human error rather than symptoms of mismatches between human(s), machine(s), and the environment in which they collaborate. The next decade may provide a window of opportunity for overcoming these obstacles. The cognitive engineering community can contribute to this goal if it succeeds in communicating more clearly its concepts and approachpage_2 Page 3 es for addressing observed difficulties with human-machine coordination and cooperation. The benefits and implications of an ecological approach to the design and evaluation of joint cognitive systems need to be demonstrated more convincingly. Also, there will be a rare opportunity to address not only known difficulties with existing technologies (e.g., Sarter & Woods, 1995, 1997) but to predict and prevent potential future problems with planned air traffic management (ATM) operations. A review of some of the envisioned concepts, systems, and procedures for the future ATM system suggests that operators may find themselves again working with systems that lack basic communicative skills and fail to coordinate their activities with human operators. Diffusion of responsibility and unresolved goal conflicts between the various parties in the system may lead to breakdowns in safety and efficiency. To prevent this from happening, cognitive engineering needs to take a proactive approach and get involved in the design and evaluation of ATM systems, procedures, and training to prevent rather than correct problems after the fact. Cognitive Engineering in Perspective: From Traditional Human Factors to Cognitive Engineering For millennia, tools have been developed and improved to fit human goals, abilities, and limitations. Still, the term human factors was not introduced until the 1940s, when the growing complexity of combat aircraft required designs that would be compatible with human information processing. The introduction of increasing machine power also called for the development of reasonable and efficient approaches to task and function allocation. Fitts was one of the pioneers in the field. He applied psychological principles to equipment design and proposed a rationale for assigning tasks to humans and machines based on their assumed reciprocal capacities. This was the beginning of human factors or engineering psychology (this was the term used by Fitts, 1951) in the aviation domain. Human factors considerations quickly spread to other branches of industry as well. In particular, the unique safety challenges of nuclear power operations brought this industry to the forefront of human factors research and led to the introduction of cognitive engineering in the late 1980s (e.g., Bainbridge, 1987; Hollnagel & Woods, 1983; Rasmussen, 1986). The goal of cognitive engineering is to support human problem solving with tools and machine agents in a variety of complex domains. In pursuing this goal, new cognitive demands imposed by modern technology were identified, new concepts were introduced, and new methods were developed for the design and evaluation of automated systems. page_3

Page 4 New Demands The introduction of increasingly sophisticated automation technology to a variety of complex work domains (as well as everyday life) has created new affordances as well as new cognitive demands for practitioners. Benefits brought about by advances in computational power include an increased efficiency, precision, and flexibility of operations. At the same time, unexpected difficulties with the communication and coordination between humans and machines were introduced. Modern technology seems to be a success story when it is allowed to operate on its own in a self-sufficient manner, but it is not capable of handling the communication and coordination demands involved when cooperating with a human agent. As a result, operators find it difficult to keep track of and orchestrate the behavior of these new systems. Systems are increasingly coupled, and they involve extremely high-risk operations. The prevention of breakdowns in human-machine cooperation is becoming increasingly important, given that they can result in catastrophic events that no longer affect only the operators involved but that also can have more wide-reaching consequences. The development and introduction of modern automation technology has led to new cognitive demands as operators are no longer tasked with active system control but need to engage primarily in supervisory control of the automation. The result is new knowledge requirements (e.g., understanding the functional structure of the system), new communication tasks (e.g., knowing how to instruct the automation to carry out a particular task), new data management tasks (e.g., knowing when to look for, and where to find, relevant information in the system's data architecture), and new attentional demands (tracking the status and behavior of the automation as well as the controlled process). New automation technology also creates the potential for new forms of erroneous actions and assessments (see Woods et al., 1994). One of the reasons for these new cognitive demands and error types is that many automated systems provide their operators with a large number of functions and options for carrying out a given task under different circumstances. This flexibility is often construed as a benefit that allows the operator to select the mode of operation that is best suited for a particular task or situation. However, this flexibility also implies that operators must know about the availability and purpose of the different modes, when to use which mode, or how to smoothly switch from one mode to another. In other words, the practitioner must know how the automated system works, and he or she must develop the skill of knowing how to work the system (Woods et al., 1994). To meet the latter criterion, an operator must: Learn about all of the available options. Learn and remember how to deploy them across a variety of operational circumstances, especially rarely occurring but more difficult or critical ones. page_4 Page 5 Learn and remember the interface manipulations required to invoke the different modes or features. Learn and remember where to find or how to interpret the various indications about which option is active or armed and what are its associated target values. Note that modern technology not only creates these new demands but also holds the potential for supporting them effectively. However, this potential has not yet been realized as the ability of modern systems to preprocess, filter, integrate, or visualize information for the operator is not being exploited. System interfaces tend to be designed for data availability rather than observability. In other words, the amount of available data is sufficient and clearly exceeds that of earlier systems. However, the way in which data are presented does not match human informationprocessing abilities and limitations, and thus the burden of locating, integrating, and interpreting these data still rests with the practitioner (e.g., Billings, 1997). New Concepts Until the 1980s, human factors tended to focus on the surface appearance of technology, on the design of interfaces for individual systems from an ergonomic point of view. With the introduction of cognitive engineering, the focus shifted toward the design of joint cognitive systems that encompass the user, the system, and the environment in which the two collaborate. As a result, cognitive engineering is a truly interdisciplinary venture that is no longer dominated by either engineers or psychologists but rather embraces and tries to combine the knowledge bases and methodologies of fields such as cognitive science, psychology, sociology, systems engineering, anthropology, or computer science. Cognitive engineering represents a fundamental shift also in terms of its objectives and approaches to studying, modeling, and supporting human problem solving and to improving the safety and efficiency of human-human and human-machine cooperation in real-world operations. Its focus is on (cognitive) processes rather than (performance) outcomes. Understanding the cognitive processes involved in bringing about a particular outcome is critical to identifying how, why, and at what stages of information-processing performance breaks down. This knowledge, in turn, is essential to being able to address the problem through modifications of system design, training, and operations. By approaching the design and evaluation of modern technology as an opportunity to analyze and learn more about the cognitive processes involved in humanmachine collaboration, cognitive engineering is capable of building a generic knowledge base that can guide future innovation and development in a variety of domains. page_5

Page 6 New Methods One important characteristic of cognitive engineering is its systems approach and ecological orientation. The emphasis is on examining and modeling relationships between the various elements of the joint system rather than studying its individual components in isolation. Cognitive modeling no longer focuses on isolated cognitive structures or processes but rather on contextual cognitive control. Cognition is considered mainly for its dynamics, not for its analytic content (Hollnagel, 1993). Also, the goal is no longer to develop competence models but rather to develop contextual performance models. For example, errors are no longer seen as isolated problems. Instead, they are incorporated into a cognitive supervisory control model that encompasses metaknowledge, trust, perception of positive and negative affordances within the environment, error protection, error detection and error recovery, and the overall formation of a global protection against the loss of control (e. g., see the concepts of safe field of travel and ecological safety, Gibson & Crooks, 1938; see also Amalberti, 1994, 1996; Flach & Dominguez, 1995; Rasmussen, 1996). Consequently, research in cognitive engineering relies heavily on naturalistic observations and ethnographic studies that look at human-machine interactions in real-world environments or in the context of simulations that are representative of those environments (e.g., Klein, Oranasu, Calderwood, & Zsambok, 1993). The goal is to understand practitioner behavior in the presence of effective cues and in the context of a collaborative environment rather than in spartan experimental laboratory conditions. Cognitive engineering is concerned with a wide variety of issues related to human-machine collaboration. Its overall goal is to find ways to support the cooperation and coordination between human and machine agents by integrating the constraints associated with these different system players. Issues of interest include but are not limited to: The role of expertise and skill in shaping strategies and performance. The nature of and reasons for, as well as possible countermeasures to, human error. Effective decision support. Problem and information representation. The adaptation of systems by practitioners to their needs in the context of workplaces that often involve time pressure, high risk, and multipletask demands. The basis for both successful and poor task performance. These issues are approached from the perspective of the practitioner in the situation. The underlying assumption is that his or her behavior is page_6 Page 7 locally rational, that is, that the operators' decisions and actions are rational given the knowledge and information that is available to the operator at that time. By using this approach rather than some normative or hindsight-driven perspective, cognitive engineering attempts to explain and prevent poor performance rather than blame or glorify practitioners for their behavior. Understanding and Overcoming Skepticism: A Challenge for Cognitive Engineers and the Aviation Industry In the 1980s, an important human factors concept was developed by a group of researchers at NASA-Ames Research Center called crew resource management (CRM; e.g., Cooper, White, & Lauber, 1980). This work was triggered, in part, by a series of aviation accidents in the 1970s that puzzled the industry, as they involved technically sound aircraft that were flown by highly competent professional pilots. The aviation community tried to understand how these mishaps could occur and soon realized that the failure to fully exploit and coordinate the resources available to the flight crew had played a major role in these events. In response, CRM training programs were pioneered by United Airlines in the early 1980s (Blake & Mouton, 1982) and were eventually applied by carriers (as well as other industries) around the world. The development of CRM involved a shift from ''training for the abnormal" to "training for the normal," and it emphasized that the prevailing safety equation pilot proficiency + aircraft reliability = safe flights was inadequate. The first generation of CRM training programs aimed at improving pilots' attitudes and behavior with respect to team performance. CRM training programs typically consisted of 2- or 3-day seminars during which human attitudes and actions in small-team environments were discussed with the help of facilitators. Role games, situation exercises, accident case studies, and the exchange of personal experiences allowed the trainees to evaluate their own skills and viewpoints and understand their potential implications for crew performance. CRM training underwent a number of changes and adjustments over time. It became the staple of human factors at most airlines, whereas the need for human factors considerations in the design and certification of aviation equipment was acknowledged to a much lesser extent for some time to come. Another important concept that emerged and spread through the aviation industry in the 1990s was the need for a systems approach to the analysis and management of human error. The goal of this approach is to understand the underlying reasons for, and discover the multiple contribpage_7

Page 8 utors to, erroneous actions and assessments in the interest of preventing their reoccurrence rather than attempting to identify one responsible party. One of the major proponents of this "new look at error" was Reason (1990), whose ideas were soon adopted by many in the aviation domain. For example, the International Civil Aviation Organization (ICAO) is conducting its safety investigations and considerations based on this concept of human error where performance breakdowns are considered symptoms of mismatches between the various components and layers of the overall system. The aforementioned concepts and ideas are in agreement with many of the premises of cognitive engineering. But whereas human error considerations and, even more so, CRM are very popular in the aviation industry, the rather young discipline of cognitive engineering still faces a number of reservations because some of its concepts are rather difficult to grasp, its methods tend to be effortful and time-consuming in comparison, and, very importantly, it often calls for fundamental changes to, rather than minor adjustments and modifications of, training and design. Still, given the considerable technological changes that have taken place, and will continue to occur, in the aviation domain, it will be critical to embrace this new approach to system design and evaluation. This book is an attempt to illustrate its relevance and importance by presenting examples of the valuable contributions that cognitive engineering can make to aviation safety. References Abbott, K., Slotte, S., Stimson, D., Bollin, E., Hecht, S., Imrich, T., Lalley, R., Lyddane, G., Thiel, G., Amalberti, R., Fabre, F., Newman, T., Pearson, R., Tigchelaar, H., Sarter, N., Helmreich, R., & Woods, D. (1996). The interface between flightcrews and modern flight deck systems. Washington, DC: Federal Aviation Administration. Amalberti, R. (Ed.). (1994). BriefingA human factors course for professional pilots (French, English, and Spanish versions). Paris: IFSADEDALE. Amalberti, R. (1996). La conduite de systemes et risques [The control of systems and risks]. Paris: Presses Universitaires de France. Bainbridge, L. (1987). Ironies of automation. In J. Rasmussen, J. Duncan, & J. Leplat (Eds.), New technology and human error (pp. 271 286). New York: Wiley. Billings, C. (1997). Aviation automation: The search for a human-centered approach. Mahwah, NJ: Lawrence Erlbaum Associates. Blake, R. R., & Mouton, J. S. (1982). Cockpit resource management. Denver, CO: Scientific Methods, Inc. & United Airlines. Cooper, G. E., White, M. D., & Lauber, J. K. (1980). Resource management on the flightdeck: Proceedings of a NASA/industry workshop (NASA CP-2120). Moffett Field, CA: NASA-Ames Research Center. Fitts, P. (1951). Engineering psychology and equipment design. In E. S. Stevens (Ed.), Handbook of experimental psychology (pp. 245 250). New York: Wiley. page_8 Page 9 Flach, J., & Dominguez, C. (1995, July). Use-centered design: Integrating the user, instrument and goal. Ergonomics in Design, pp. 19 24. Gibson, J., & Crooks, L. (1938). A theoretical field analysis of automobile-driving. American Journal of Psychology, 51, 453 471. Hollnagel, E. (1993). Human reliability analysisContext and control. London: Academic Press. Hollnagel, E., & Woods, D. D. (1983). Cognitive engineering: New wine in new bottles. International Journal of Man-Machine Studies, 18, 583 600. Klein, G., Oranasu, J., Calderwood, R., & Zsambok, C. (1993). Decision making in action: Models and methods. Norwood, NJ: Ablex. Rasmussen, J. (1986). Information processing and human-machine interaction. Amsterdam: Elsevier North Holland. Rasmussen, J. (1996, April). Risk management in a dynamic society: A modeling problem. Keynote address presented at the Conference on Human Interaction With Complex Systems, Dayton, OH. Rasmussen, J., Pejtersen, A., & Goodstein, L. (1990). Cognitive system engineering. New York: Wiley. Reason, J. (1990). Human error. Cambridge, England: Cambridge University Press. Sarter, N. B., & Woods, D. D. (1995). "How in the world did we ever get into that mode?" Mode error and awareness in supervisory control. Human Factors, 37(1), 5 19. Sarter, N. B., & Woods, D. D. (1997). Teamplay with a powerful and independent agent. Human Factors, 39(4), 553 569. Woods, D. D., Johannesen, L., Cook, R. I., & Sarter, N. B. (1994). Behind human error: Cognitive systems, computers, and hindsight (State-ofthe-Art Report). Dayton, OH: Crew Systems Ergonomic Information and Analysis Center. page_9

Page 11

PART I FRAMEWORKS AND MODELS OF HUMAN-AUTOMATION COORDINATION AND COLLABORATION page_11 Page 13

Chapter 1 Cognitive Models and Control: Human and System Dynamics in Advanced Airspace Operations Kevin M. Corker NASA-Ames Research Center, Moffett Field, CA Now all scientific prediction consists in discovering in the data of the distant past and of the immediate past (which we incorrectly call the present), laws or formulae which apply also to the future, so that if we act in accordance with those laws our behavior will be appropriate to the future when it becomes the present. K. J. W. Craik (1947, p. 59) NASA (National Aeronautics and Space Administration), the FAA (Federal Aviation Administration), and Eurocontrol have initiated programs of research and development to provide flight crew, airline operations, and air traffic managers with automation aids to increase capacity in enroute and terminal area operations. These are to support the goals of free flight for safe, flexible, predictable, and efficient operations. To support the development of those aiding systems, human performance in automated aiding has been examined in empirical and computational analytic studies. This chapter presents a set of those studies in full-mission simulation and the development of a predictive computational model of human performance. We have found that the combination of methodologies provides a powerful design-aiding process. We have examined a number of operational issues using the model framework. We have examined procedures and communications in use of voice and datalink operation at the transition between unconstrained (en route) and constrained (terminal) page_13 Page 14 airspace operations. We have investigated the shape and dimensions of an "alert zone" for air-based separation in unconstrained operations. We are examining the decision processes in the interaction of a ground-based conflict detection/resolution-aiding system coordinated with a cockpit-based conflict-alerting mechanism. We present a computational model for decision making that includes representation of multiple cognitive agents (both human operators and intelligent aiding systems), the man-machine integrated design and analysis system (MIDAS). The demands of this application require representation of many intelligent agents sharing world-models, and coordinating action/intention with cooperative scheduling of goals and actions in a potentially unpredictable world of operations. The operator model includes attention functions, action priority, and situation assessment functions. The cognitive includes working-memory operations including retrieval from longterm store, and interference loss. The operator's activity structures have been developed to provide for anticipation (knowledge of the intention and action of remote operators), and to respond to failures of the system and other operators in the system in situation-specific paradigms. System stability and operator actions can be predicted by using the MIDAS model. Multiple operational concepts can be explored in this computational environment before committing to full-mission simulation. The model's predictive accuracy was validated using the full-mission simulation data of commercial flight deck operations with advanced alerting/warning logic. Introduction The world community of aviation operations is engaged in a vast, systemwide evolution in human-system integration. The nature of this change is to relax restrictions in air transport operations wherever it is feasible. The relaxation includes schedule control, route control, and, potentially, separation authority in some phases of flight, for example, aircraft self-separation in en route and oceanic operations. The process of relaxation of constraints is motivated by studies that suggest that reduction in schedule and route constraints (calculated in U. S. National Airspace [NAS] operations) could save the operator as much as 3.5 billion U.S. dollars annually (Coularis & Dorsky, 1995). The reduction of constraints is made possible by an assumed improvement in navigational precision and by improvements in communications (global positioning systems and satellite datalink capability). In the United States, this effort has been termed free flight (RTCA, 1996). page_14

Page 15 System Impact on Human Performance and Cognitive Engineering Models The consistent result of the relaxation of system constraints is to change and challenge human performance in that system in two dimensions. First, the decision-making process becomes distributed. This distributed decision differs from current operation and has direct impact on crew and team resource management processes. Second, the dynamic concept of operations provides new challenge to the human operators of that system. The human operators (pilots, air traffic controllers, and airline operations personnel) must monitor and predict any change in the distribution of authority and control that might result as a function of the airspace configuration, aircraft state or equipage, and other operational constraints. The operators are making decisions and sharing information not only about the management of the airspace, but also about the operating state of that airspace. In order to safely and effectively describe the new process and procedures for this evolving concept, the human operator's performance must be clearly and consistently included in the design of the new operation and of any automation aiding that is proposed to help the operators in their distributed activities. There is a potential conflict in the NAS goals of improved prediction and lack of restriction. In order to be predictive, more information and better models of performance (aircraft and human) are sought. These are usually constrained to prediction of behavior for some prescribed time in the future: schedule for the days of flight, flight plan for the duration of the flight, trajectory synthesis for the next 20 minutes of flight, and human performance to the next decision point. In order to be flexible, constraints are reduced (and some level of prediction is sacrificed). In order to support collaborative and distributed control between air and ground for any of the aforementioned, but especially for separation assurance, modifications to the roles and decision authority must be explored. Bringing the user into the decision loop for both strategic and tactical operation requires definition of user preference. User preference is a dynamic, complex, and market-driven flexibility that needs to be accommodated. In addition to its intermediate time stability (wind-optimal routes, slot swapping, surface-gate negotiations), user preference has the potential for proprietary and competitive factors playing a role in the degree of predictability that will be shared. The evolution of the air transportation system, therefore, profoundly challenges human performance prediction and the cognitive sciences. Previous models of human performance linked to machine performance have had distinct boundaries in the human-machine elements to be modpage_15 Page 16 eled. Current system design requires models of human, machine/automation, aircraft, airline operations, air traffic management (ATM), and NAS management to be tightly coupled in order to guide design, to evaluate the effectiveness, and to assure the safe operation of the system. Impact of Design Cycle on Human Performance and Cognitive Models Insofar as representation of human performance in a system is undertaken to support engineering and design teams, the type of representation provided should complement the level of design at a stage. The traditional waterfall design process represents the human operators in presimulation phase only once and only at one level of granularity. The crew station development process, as it is currently undertaken, is illustrated in Fig. 1.1. The design proceeds from requirements and capabilities in conceptual design, through increasing specification to hardware and software prototypes and simulation tests. Human performance evaluation occurs after prototype design and development. Results from testing the prototype are then used to guide prototype redesign. Though later, detailed-design phases in the traditional process have "hard" data to guide development, the most advantageous time for making improvements to a system's design is early in the development process. In fact, studies have shown that although less than 15% of a system's cost is incurred during the concept exploration, demonstration, and validation phases, 70% to 85% of the actual life-cycle cost is dictated by the decisions made in these early stages of development (Gansler, 1987). The traditional design process often considers ergonomics late; this often results in costly revisions required to solve human factors problems. In the traditional process, assessment of performance time and accuracy is undertaken later in the design cycle, when the location, physical layout, and assignment of function have been established. The purpose of the human performance model at that point is feasibility and usability analysis. The single-point analytic technique implies limited requirement for modification of

Fig. 1.1. Current crew station development process. page_16

Page 17 the model and its function. The time-consuming and expensive process of hardware simulation development results in the technology of system development that does not take advantage of the human factors empirical data and knowledge bases. Finally, the training system requirements are considered last, completely decoupling them from the design process. MIDAS integrates the design process by using human performance models in the conceptual design phases of system development, illustrated in Fig. 1.2. This more contemporary design process has a successive iteration in the cycles of evaluating the human performance contribution to the system. The multi-iteration process of design puts more stringent demand on the human performance model. In this environment, the model's architecture must allow for the following: Different levels of granularity in the representation of the human operator(s) (from detailed cognitive models to black box representations). Flexibility of functional assignments among human and machines. Varied temporal resolution in model performance and in results analysis. Varied levels of details in activity representation. By appropriate selection of detail in the model development matched to the level and maturity of the design process, some of the issues associated with the cost and complexity of model development, maintenance, and use can be addressed (Pew & Mavor, 1998). Human Performance Model and Air Traffic Management Automation In specifying the development of the NAS for free-flight operations, a strong statement is made as to the inclusion and concern for human factors and human-centered design in the development of tools for aiding

Fig. 1.2. Revised crew station development process. page_17 Page 18 operators (air and ground based) in the performance of the tasks dictated by the RTCA Task Force and FAA implementation plans. "A founding principle is that human factors concerns must be raised and addressed from the beginning and throughout" (RTCA, 1999, p. 103). There is an equally strong statement that reliance on automation should "support, but not replace, human reasoning and decision making with ground-based automation to: 1) resolve tactical conflicts, 2) manage traffic flows in congested airspace, 3) prevent unauthorized entry into special use airspace, 4) assure safety of flight" (RTCA, 1995a, p. 106). Human decision making supported by automation is a complex design endeavor; splitting the automation into air and ground components with complementary aiding functions is a more complex endeavor (Billings, 1997). How Are Distributed Decision Systems in Air-Ground Integration to Be Designed and Evaluated? Our goal is to develop human performance models that predict the consequences of the interaction between these advanced automation technologies and the human component in the ATM system. These models have two purposes. First, they are to provide guidance for the design or required aiding systems, and to define the procedures and communication protocols for their use. Second, they are to predict the performance of the human operator in the ATM system. In order to support these functions, we have developed a human-system model for advanced ATM operations that is a hybrid engineering control theoretic and cognitive performance model. There is a long history of the use of human performance models based on a combination of engineering and psychological principles in dealing with complex aeronautical systems. Craik (1947) performed seminal work in human control of large inertial systems and characterization of that control through models. There are three legacies that Craik's work provides: A way to describe human and machines in collaboration in the same mathematical terms, the same structural terms, and the same dynamical terms. Analytic capability to define what information should be displayed to the human operator in the human system as a consequence of his or her sensory/perceptual and cognitive characteristics in control. A fundamental paradigm shift in which man-machine systems could be conceptualized as a single entity linked/coupled to perform a specific task or set of tasks. A new level of abstraction was introduced and systematized by Craik and subsequent developers of operator control page_18

Page 19 models. In this paradigm, the description of the operator in the man-machine system could be used to guide the machine design. Furthermore, the linked system could be used to explore the parameters of human performance (i.e., by changing the characteristics of the machine, the scientist could observe the human's response and infer something about the characteristics of the human operator). In performing such experiments, data in tracking control studies led Craik (1947) to conclude the human operator behaves basically as an intermittent correction servo. This formulation was further refined by McRuer and Krendall (1957) and summarized by McRuer and Jex (1967). The resultant description of the human operator is a good servo with bandwidth constraints and a cross-over frequency response characteristic. The human operator in tracking systems tasks can operate as a good servo because of their ability to identify consistent forcing functions and consistent response in control. The human can function effectively if the control order (position, velocity, rate) and the rate of change in the forcing function is consistent with the physical characteristics of neuromotor control (reaction time and neuromotor lags). If the control order and forcing function are not within the perceptual cognitive and neuromotor constraints of the operator, then aiding systems can be developed to augment control stability and/or offset control lags or ''predict" system behavior and display that prediction to the human operator. The model of the human operator as servo guided the design of aiding systems for the operator in that servo task (Birmingham & Taylor, 1954). As the human operator was served by automation that operated at remote sites in semiautonomous modes, a new set of model descriptors was developed, led by Sheridan's work in supervisory control (Sheridan & Ferrell, 1969). In this mode the operator stands back form the direct manual control of the systems and has managerial functions, setting goals, training, observing performance, intervening, and so on. The requirement for local autonomy of a function could be distance-time relationships, bandwidth limits, or efficiencies gained by removing the human from the direct critical path of control. This view of human as supervisor has spawned a considerable body of research and development. Following this same paradigm of defining a control representation consistent with the human operator(s) mode of control in the system, we have undertaken representation of the "internal models and cognitive function" of the human operator in control complex control systems. These systems are a hybrid of continuous control, discrete control, and critical decision making. These systems are characterized by critical coupling among control elements that have shared responsibility among humans and machines in a shifting and context-sensitive function (Billings & Woods, 1995). page_19 Page 20 As noted, traditional engineering models of human performance have considered the human operator as a transfer function and remnant in a continuous control. They have concentrated on the interaction of one operator and a machine system with concern for system stability, accuracy of tracking performance, information processing of displays, and ability to handle disturbances. They are intended to provide guidance in design that determines whether the information provided, and the control system through which the operator performs their functions, allows successful performance with an acceptable level of effort (Baron & Corker, 1989). These models assume a closed-loop control in which the human operator observes the current state of the system, then constructs a set of expectations based on his or her knowledge of the system. This internal model is modified by the most recent observation, and based on expectations the operator assigns a set of control gains or weighting functions that maximize the accuracy of a command decision. In this loop the operator is also characterized as introducing observation and motor noise (effector inaccuracies) and time delay smoothed by an operator bandwidth constraint. Such a model is represented in Fig. 1.3. In the context of ATM, such a representation needs to be expanded to include multiple operators in the system of control and to include the uniquely human contribution of adaptable, but potentially noisy control

Fig. 1.3. Optimal control model: In this model the human operator is assumed to act to observe a display of system state and to compare that display to an internal model of the system, represented as a Kalman estimator and predictor. The operator then chooses an action that will offset any observed error between current and desired system state and acts through his or her neuromotor processes, which include a noise and bandwidth limit, to effect the control. page_20

Page 21 input. The "noise" in this view of the operator is not stationary Gaussian distributions, but errors of specific types and with potentially significant consequence. We have developed a hybrid model for multiple human operators in advanced ATM. In addition to concern for overall stability of the closed-loop management of air traffic, the model concerns itself with prediction of cognitive function and decision making. The human operator's function in the distributed air-ground ATM system includes visual monitoring, perception, spatial reasoning, planning, decision making, communication, procedure selection, and execution. The level of detail to which each of these functions needs to be modeled depends on the purpose of the prediction of the simulation model. Traditional transfer function models are adequate to the inclusion of the operator as optimal controller with lag and noise components. However, because of the monitoring and supervisory role of the operator in the advanced ATM, the specific cognitive transfer function that the human operator provides also must to be considered. MIDAS, a model of human operator performance with explicit representation of the perceptual and decision-making processes (Corker & Smith, 1993), serves as the basis of the advanced ATM performance developments addressed herein. MIDAS Model In order to successfully predict human performance or to guide design in linked human/automation systems, characteristics of cognitive function, both in its successful and flawed performance, must be modeled. Humans are included in (and are critical to the successful performance of) complex systems in order to exploit their adaptive and interpretative intelligence. However, the characteristic ability to deal with uncertainty, ambiguity, and underdefinition predisposes the human operator in a system to certain types of errors (Reason, 1987, 1990). Human performance profiles arise as a function of the dynamic interplay among the following: The task demands. The characteristics of the operator reacting to those demands. The functions of the equipment with which the operator interacts. The operational environment, the time course of uncontrolled events. General Architecture The MIDAS system has evolved over a 10-year development period. The basic structure of the core system, based on the work of Tyler, Neukom, Logan, and Shively (1998), is presented here. This architecturpage_21 Page 22 al version of MIDAS has through its development been used to evaluate helicopter crew stations, short-haul civil tiltrotor emergency handling operations, and the impact of protective flight gear on crew performance (Atencio, Banda, & Tamais, 1998; Atencio, Shively, & Shankar, 1996; Shively et al., 1995). The specific development for analysis of ATM systems is provided here. The user enters the system through the graphical user interface (GUI) that provides the main interaction between the designer and the MIDAS system. The user selects among four functions in the system. Generally the sequence would require the user to establish (create and/or edit) a domain model (which includes establishment and selection of the parameters of performance for the human operator model[s] in the simulation). The user can then select the graphical animation or view to support that simulation or a set of simulations. The user can specify in the simulation module the parameters of execution and display for a given simulation set, and specify in the results analysis system the data to be collected and analyzed as a result of running the simulation. The results analysis system also provides for archival processes for various simulation sessions. The user would typically use all of the top-level features to support a new simulation. If a user were exploring, for instance, the assignment of function between a human operator and an automated assistant the user could maintain the majority of the extant domain, graphical, and analytic models and make modification through the domain model to the human operator model, to the equipment model, and to the simulation scenario. Domain Model The domain model consists of descriptors and libraries supporting the creation of: Vehicle characteristics: location space, aerodynamic models of arbitrarily detailed fidelity, and guidance models for vehicle (automatic) control. Environment characteristics: This provides the external interactions including terrain from selected databases at varied levels of resolution, weather features insofar as they affect vehicle performance or operator sensory performance, and cultural features (towns, towers, wires, etc.). In short, the analyst here specifies the world of action of the experiment/simulation. Crew-station/equipment characteristics: The crew station design module and library is a critical component in the MIDAS operation. Descriptions of discrete and continuous control operation of the equipment simulations are provided at several levels of functional detail. The system can provide discrete equipment operation in a stimulus-response page_22

Page 23 (black-box) format, in a time-scripted/event-driven format, or in a full discrete space model of the transition among equipment states. Similarly the simulated operator's knowledge of the system can be at the same varied levels of representation, or can be systematically modified to simulate various states of misunderstanding the equipment function. The human operator (HO) model: The human performance model in MIDAS allows for the production of behavior and response for single and multiple operators in the scenarios. The HO model is the key to the MIDAS function as a predictive design aid. It is composed of integrated functions as submodels, which include an anthropometric model, sensation and perception models, attention (and other resource) models, central processing cognitive functions such as decision making, evaluation, and action selection, and finally behavioral models to guide the anthropometric model in the execution of action. Mission and activity models: These describe in a hierarchic structure the goals and the available recovery activities from missions-not-asplanned that make up the human operator's high-level behavioral repertoire in the mission. The next level of decomposition of the action of the mission is a set of high-level procedures (which can be stored as a fairly generic set of routines, e.g., look at or fixate). Finally, there are the specific activities in reactive action packets (RAPS), which are the processes by which the human operator affects the simulation. In addition to the model development environment, editors provide tools for the user to define, or modify extant domain models. Human Operator Model The HO performance model is a combination of a series of functionally integrated micromodels of specific cognitive capabilities within a human operator. The HO model functions as a closed-loop control model with inputs coming from the world and action being taken in the world. The model provides psychological plausibility in the cognitive constructs of long-term, working memories (with articulation into spatial and verbal components of these models) and with sensory/perceptual and attentional components that focus, identify, and filter simulation world information for the operator, action, and control. The cognitive function is provided by the interaction of context and action. Context is a combination of declarative memory structures, and incoming world information is mapped to the agenda manager that is making the plan (overall mission). This, combined with the plan interpreter, provides a series of RAPS to be performed in order to meet mission goals and to handle contingent activities (like interruption or plan repair). Output of action in the world is effected through the models of the operator linked to the anthropometric representations (if they are invoked by the analyst). The action changes the external world and the cycle begins again. page_23 Page 24 Memory Representation The role of the HO in the ATM system places significant demands on his or her cognitive capacity, vigilance, and memory (Wickens, Mavor, & McGee, 1997). In order to capture the behaviors of the ATM practitioners, we have modeled human memory structures as divided into longterm (knowledge) and working memory (short-term store). Working memory is the store that is susceptible to interference and loss in the ongoing task context.1 We have implemented working memory, described by Baddeley and Hitch (1974), as composed of a central control processor (of some limited capacity), an "articulatory loop" (temporary storage of speech-based information), and a "visuo-spatial scratch pad" (temporary storage of spatial information). The point of transference of information from the flight deck and ATC (air traffic control) displays to the operator's working memory is the critical juncture in the subsequent use of the information that is exchanged. Memory structure is provided via a semantic net. The interaction of procedure with memory is provided by a goal decomposition method implemented as a form of cognitive schema. A schema is "an active organization of past reactions, or of past experiences, which must always be supposed to be operating in any well-adapted organic response" (Bartlett, 1932, p. 201). In order to capture the central role of schema and internal representation, we have included an elaborate representation of both declarative and procedural information in the MIDAS model, called the internal updateable world representation (UWR). The UWR provides a structure whereby simulated operators access their own tailored or personalized information about the operational world. The structure and use of the UWR is akin to human long-term memory and is one aspect of MIDAS that makes it unique from most human-system modeling tools. UWR contents are defined by presimulation loading of required mission, procedural, and equipment information. Data are then updated in each operator's UWR as a function of the mediating perceptual and attentional mechanisms previously described. These mechanisms function as activation filters, allowing more or less of the stimuli in the modeled environment to enter the simulated operator's memory. Knowledge of what is on each operator's mind is a key modeling feature that allows MIDAS to examine decision making and the information exchange that is critical to decision making. (See Fig. 1.4 for a schematic representation of the MIDAS architecture.) 1 Long-term loss would represent, for instance, a loss of skills or deep procedural memory of how to perform tasks. It is not considered to play a role in the scenarios under examination in this study. page_24

Page 25

Fig. 1.4. MIDAS architecture for human representation in complex systems. Each of the modules represented in this figure is a functional model of human performance. They are linked together into a closed-loop simulation of operator performance. This basic structure is replicated to account for multiple crew member operations. page_25 Page 26 Attentional Control Another capacity limit with implications for error formation and remediation in the human/automation integration task is attentional control and concurrent task performance. Distributed attention and attention switching refer to an operator's ability to perform multiple tasks simultaneously. In many cases, a second task can be added to the performance of a primary task with little or no impact on the performance of the first task. In other cases, the performance of two tasks simultaneously has a disastrous interaction. Such context- and order-sensitive effects require a scheduling and agenda management function that is provided in the MIDAS model for ATM. Activity Representation Tasks or activities available to an operator are contained in that operator's UWR and generate a majority of the simulation behavior. Within MIDAS, a hierarchical representation is used (similar to, but more flexible than the mission-phase-segment-function-task decomposition employed by many task analysis systems). Each activity contains slots for attribute values, describing, for example, preconditions, temporal or logical execution constraints, satisfaction conditions, estimated duration, priority, and resource requirements. A continuum of contingent or decision-making behavior is also represented in MIDAS, following the skill, rule, knowledge-based distinction reported by Rasmussen (1983). The activity structures in MIDAS are currently being implemented as sketchy plans in the RAPS paradigm of Firby (1989). This structure of activities will interact with resource and context managers to structure an agenda. Task Agenda The agenda structure stores instantiated RAPS as goals with subnetworks and logical control flags, object bindings, and history of state and completion. This network represents the current set of tasks to be performed by the operators of the simulation given the current goals and context. The network can complete successfully, be interrupted by other task networks, or be aborted. The relationship among the actions in terms of logic of performance (e.g., sequential or concurrent tasks) is also specified in the agenda structure. Whether in fact tasks can be performed concurrently is a function of resource relations in the cognitive model (sensation/reception, central/attentional/effectors). Work is currently underway to unify the representation of action and resources in the various version of the MIDAS system. Decision Making Quick, skill-based, low-effort responses to changes in values of information held in the UWR are captured by "daemons" when a triggering state or threshold value, sensed by perception, is reached. Daemons represent well-trained behaviors such as picking up a ringing phone page_26

Page 27 or extinguishing a caution light. Classic production rule-based behavior is also available, and used when conditions in the simulation world match user-defined rule antecedent clauses active for the scenario modeled. Finally, more complex or optimization-oriented decision making is represented via a set of six prescriptive algorithms (e.g., weighted additive, elimination by aspect, etc.) as reported Payne, Bettman, and Johnson (1988). Each of these algorithms uses a different combination of attribute values, weights, and cut-off values for calculating the "goodness" of the options. ATM Applications in Free Flight Many issues must be resolved before free flight can reach a mature state of relaxed constraints in all airspace environments and incorporation of user preferences (RTCA, 1995b; Wickens, Mavor, Parasuraman, & McGee, 1998). We have focused our early investigation on critical issues in airground coordination and in distributed decision making. The interaction among aircraft and controllers is proposed to occur at points in space around each aircraft called alert and protected zones (see Fig. 1.5). These zones are used by an alerting system to monitor and advise the flight crew on conflicting traffic flying within these areas. In a cockpitbased system, the alerting system would warn the flight crew of any aircraft entering the alert zone. The crew could evaluate the situation and choose or negotiate a preferred deviation. If the intruding aircraft continued into the smaller warning zone, the crew would be advised to take evasive action. In addition to crew alerting, the air traffic service provider also supplies a ground-based conflict alerting and resolution system. An area of concern from the point of view of system stability is the interaction of the

Fig. 1.5. Schematic of proposed free-flight protected and alert zones. page_27 Page 28 ground-based alerting system with the aircraft-based alerting system. In order to examine this decision process, we expanded the optimal control model in Fig. 1.1 to account for multiple operators interacting with multiple decision-aiding systems as illustrated in Fig. 1.6. The inner and outer loop alerting structure of ATM has many implications that need to be investigated to assure adequate design. First, there are control and stability factors implicit in the design. As the inner loop response time approaches that of the outer loop, stability may be compromised in that controllers may be solving a problem the nature of which has already been changed by pilot action. Second, information exchange and information presentation for both air and ground must be designed to complement

Fig. 1.6. In the operational concept illustrated, there are two loops of alert and advisory information. The normal operational mode has the controller interacting with a conflict detection and resolution tool and providing positive guidance to an aircraft to initiate an avoidance maneuver, illustrated in the middle loop control. The optimal time to alert is a function that depends on the trade-off between conflict uncertainty and maneuver cost (Paeilli & Erzberger, 1979). It can be estimated to be on the order of 18 to 20 minutes to the point of closest approach of the aircraft. In some cases, there is the potential for the conflict to occur across adjacent sector boundaries. In this case an outer loop of communication among controllers is illustrated. The system also contains theinner loop of aircraft-to-aircraft alerting that is the focus of our simulation study. Full-mission simulation data suggest that the time to initiate maneuver at strategic alerts is on the order of 7 minutes. A concern in this double loop is the convergence of inner and outer loop control time. page_28 Page 29 rather than compete with each other. Third, the level of individual and shared awareness in trajectory modification and flight conformance needs to be defined. Fourth, the level of required awareness and performance impact of mixed-fleet operations and failed-mode recovery must be explored. ATM Alerting Much discussion and debate has gone into the further definition of the warning and alert zones, including their description as complex surfaces that take into account the speed, performance, and turning radius of the aircraft. Up until this time, the process of definition lacked data for inclusion of human performance in the size and shape of these areas. Figure 1.7 proposes a redefinition of these zones based on a humanmachine system performance. Built upon the well-defined physical aerodynamic response of the aircraft are the more varying machine (sensing, communication, computation) and human (perception, communication, decision, action) responses to any alert. These zones might also differ depending on the speed of the aircraft, configuration of the conflict, and procedures used to process the conflict. Study 1 Model Analysis Methodology The goal of this study was to develop a better understanding of the impact of joint and distributed decision making on the size and shape of the alert zones. This was accomplished by first analyzing and modeling the cogni-

Fig. 1.7. Alert and protected zones calibrated to human performance parameters, aircraft performance parameters, and communication systems parameters. page_29

Page 30 tive and procedural requirements of several candidate encounter scenarios. These models were then populated with performance data derived from humans in the loop experiments. The specified scenarios were then represented within the MIDAS computational modeling and simulation system. Using Monte Carlo simulation techniques, each scenario could be exercised many times, eventually establishing a statistical distribution for the human-machine performance of that configuration. By combining this with the aerodynamic performance of the system (in this case, the closing speed of conflicting aircraft at differing encounter angles), the differences in warning requirements between the different scenarios should emerge. All encounters were assumed to be two-ship interactions. Procedural Assumptions Several operational and procedural assumptions were made in the design of these scenarios about the future ATM environment. These assumptions were also used to guide the full-mission simulation that served as a validation point for these studies: The first assumption was that some type of detection and alerting system would be installed in the equipped aircraft. This system would give aural alerts along with some graphical display of the aircraft and its relationship to any conflicting aircraft. The flight crew would have to use the display to resolve the conflict: No automatic resolution would be provided. Second, all communications (when possible) should be performed using datalink transmission. The CDU (control display unit) would be used as the interface to enter this information. To support air-to-air communications (flight deck to flight deck), additional CDU functionality along with a message format would be provided (these are described later in this chapter). The third assumption was that any adjustments to the aircraft's vector (heading, speed, or altitude) would be implemented using FMS (flight management system) commands (via the CDU). Although these changes could just as easily be implemented using the mode control panel (MCP), entering the information via the CDU could be used by an advanced system to communicate or verify flight crew intent. Flight crews' choice of control options in the simulation was considerably more variable than that of the model-specified behavior. The fourth assumption was that the flight crews would not make any changes to the aircraft's vector (heading, speed, or altitude) until they understood the intent of the other flight crew and they were also certain that the other flight crew understood theirs. Our flight crew data indicatpage_30 Page 31 ed that this was, in fact, the operating mode in the majority of the encounter scenarios. Scenarios Three encounter scenarios were examined: Scenario 1: In this scenario, both aircraft are equipped with some type of CDTI detection equipment. Here a single aircraft can detect and avoid the conflicting aircraft by acting on its own (no communications are necessary). This might describe a situation where one aircraft is slowly closing on another from behind. Scenario 2: Both aircraft are again equipped. However, because of the geometry of the encounter and conflicting goals, both aircraft must be involved and negotiate to resolve the problem. The solution would be arrived at through communication and negotiation between the two flight crews. Scenario 3: This scenario describes an encounter where, because one aircraft is equipped with the required suite of equipment and the other is not, communications with ATC are required to resolve the problem. Such encounters might be common early in the implementation of free flight or when encountering older, nonupgraded aircraft. Model Development High-Level Activity Definition An initial cognitive and physical task analysis was performed for each of the three scenario cases. The result was a sequential model identifying the high-level processes (or activities) performed the operators. In Scenario 2 and 3, the activities that were to be performed in parallel by the other flight crew and ATC were also defined. Falling out of this analysis was a recognizable cycle of alert, recognition, communication, decision, then communication and action by the crews. This process is replicated throughout the scenarios for each flight crew interaction. Lower Level Activity Specification Using these sequences as a guide, the lower, or leaf-level activities (corresponding to the physical or cognitive tasks actually performed by the operators) were defined for each high-level task. Columns 2 and 3 of Table 1.1 show the high- and lower (leaf-) level activities defined for Scenario 1. The remaining columns show the interrupt recovery, duration, and VACM (visual, auditory, cognitive, and motor channel capacity requirements) specifications assigned to those activities (Aldrich, Szabo, & Bierbaum, 1989). Where possible, the activities where chosen to correspond to those activities that had performed in page_31

Page 32 TABLE 1.1 Procedural Specification for Scenario 1 Activities: Instrumented A/C Can Resolve Conflict Through Its Own Actions Recorded Activity

Leaf Activity

Interrupt Spec.

0 A2T2 Alert tone

none

:not interruptable

Duration Spec. 500, 0, 500, 500

1 Recognize and Understand Situation

2 Communicate Situation

Change Focus to Display

:restart

2,300, 835, 1,000, 4222

Reconfigure Display

:not interruptable

1,200, 1,128, 500, 3,000

Understand Conflict

:resume

1,150, 426, 411, 2,117

None

:restart

2,300, 850, 1,000, 4,223

Change Focus to Display

:restart

2,300, 853, 1,000, 4222

Understand Conflict

:resume

1,150, 426, 411, 2,117

Decide Action

:not interruptable

7,000, 8,000, 1,000, 38,000

None

:restart

3,500, 4,500, 1,000, 17,000

Change Focus to CDU

:restart

2,300, 853, 1,000, 4,222

Enter CDU Automation

:not interruptable

Change Focus to Display

:restart

2,300, 853, 1,000, 4,222

Verify Solution

:resume

1,667, 1,824, 0, 7,138

3 Decide Action

4 Communicate Action 5 Implement Action

6 Confirm Result

16,500, 11,838, 7,600, 62,935

Note. Column 5 in Table 1.1 shows the activity duration for each of the leaf-level nodes. The four values in each row specify a stochastic distribution for the duration of that activity, defined in milliseconds (2,300 is read as 2.3 sec). These four values, in order, describe the average, standard deviation, minimum, and maximum duration for that activity. This information is used in the Monte Carlo simulation to generate activity times that can exist within those distributions. These distributions are based on the performance observed in previous full-mission simulations. previous studies (Corker & Pisanich, 1995). This provided access to fully defined activity specifications. New activities, along with their specifications, were developed by interpolating prior results. The MIDAS model can contain activities that may interrupt the flight crew from the normal activities (e.g., a question in the cockpit may interrupt a flight crew member from a CDU entry task). The interrupt resumption specifications define how an activity is resumed after being suspended. Resumption methods are individually defined based on the characteristics of the activity and the sequence in which it operates. As shown in Fig. 1.7, the resumption methods used on this simulation include: page_32 Page 33 not-interruptible (cannot be interrupted), resume (resume activity where interrupted), and restart (restart the activity from its beginning). Interruptions and the way an activity is resumed directly effect the duration of the activity sequence. More on interruption methods can be found in Corker and Pisanich (1995). Air-to-Air Datalink Activity Definition One of the assumptions made was that the flight crews would have to communicate their intention back and forth via a datalink interface (used in Scenarios 2 and 3). The duration for this activity was developed by projecting how flight crew interactions with an enhanced datalink interface might occur. The standard CDU interface was enhanced to support this task. As the goal of this project was the evaluation of the alert areas, the modifications proposed were kept to a minimum. The changes included: the addition of a function button to choose air-to-air control (rather than ATC), an air-to-air page that would show which aircraft could be contacted via datalink, and a mechanism for that page that would allow a datalink message to be entered and forwarded to a selected aircraft.

The composition of the air-to-air messages was also designed. Simple, full-word messages were provided as ATC commands. The duration for the individual button presses required entering those message were extracted from previous simulation data. Interrupt Levels As described earlier, interrupt activities are those activities that require the flight crew to turn their attention away from their normal stream of activities. Typical flight deck interrupts, along with their frequency, duration, and interrupt level (relative importance of the interrupt, both against other interrupts or other activities), were defined in previous work for the top of descent phase of flight (Corker & Pisanich, 1995). Using this as a base, those interrupts that would not be expected to occur in a free flight environment were excluded from these runs. An assumption also was made that those interrupts remaining would occur at a frequency that was 25% less at cruise than near top of descent. An initial attempt to define high and low interrupt levels for this environment was evaluated, but not implemented. Experiment Runs After specification and testing, each scenario was loaded into Air-MIDAS and 50 Monte Carlo runs were gathered for that simulation. The data recorded for each run included the activity sequence along with the individual activities and their duration for that sequence (including any interrupt activities). These data were written to a file for analysis in Microsoft Excel format and were postprocessed using the rules described earlier to extract a proper time for the parallel activity sets. This page_33 Page 34 allowed the establishment of a total duration (time required for all operators to complete their tasks) for each scenario run, the dependent variable in this study. Results A standard set of descriptive statistics was generated for each scenario based on the set of 50 Monte Carlo runs, which are shown in Table 1.2. The temporal performance data were also plotted as a histogram using a bin size of 10 seconds, illustrated in Fig. 1.8. TABLE 1.2 Response Times for an Air-to-Air Encounter at 90-Degree Intercept. Time to Initiate Maneuver (sec) Self Sep

Dual Sep

ATC Sep

Min

35

182

109

Average

58

237

134

Max

98

303

164

Fig. 1.8. Flight crew time to respond an maneuver as a function of scenario. page_34

Page 35 The performance observed in each scenario described earlier was applied to a 90° crossing conflict. In this geometry, the initial traffic alert was proposed to be signaled at 40 miles from the crossing point and assumed a typical commercial aircraft cruise speed (mach .82). The measure in this case was the closing distance (straight-line distance between the aircraft). The minimum, maximum, and average human-machine performance times are illustrated in Table 1.2. This calculation also allowed the determination of a closing distance for each performance time (potentially from 56 down to 0 miles). Using this geometry, an idea of the initial warning distance could be inferred using the worst case performance criteria. Although the average clearing distances in Scenarios 1 and 3 differ significantly, given a warning at 40 miles the worst case time in both scenarios would allow an avoidance maneuver to begin well before the aircraft were 20 miles from each other. In Scenario 3, however, the worst and even average clearing distances observed would indicate that the alert point for that type of interaction should be initiated well beyond 40 miles. Although these results shed light on the issue, the 90° encounter angle actually minimizes the relative speed problem. Shallower encounter angles can generate much higher relative speeds (and therefore reduce the amount of time available to complete the activities). Given the simulated human performance and differing encounter angles, the flight crews may or may not be able to complete the activity when alerted at a fixed distance. To further investigate this idea, a second application of the human performance data was performed. This time the goal was to determine, for each scenario and encounter angle, how much alerting distance would be required to provide at least a 5-mile warning zone around the aircraft. In other words, for each scenario, when should the initial alert be made so that the flight crew could begin to move away from each other before entering the 5-mile warning zone? Calculations were again made with both aircraft maintaining a speed of mach .82. For each 15° angle around the aircraft, the resulting closing speed was calculated. Combining that speed and the performance distribution of each scenario resulted in a distance traveled for that angle. In this case, two standard deviations above and below the average were used as the minimum and maximum points respectively. Five miles were added to these distances to account for the warning zone. When plotted, these points create the heart-shaped rosettes shown in Fig. 1.9. In addition to showing the difference in warning distance needed to maintain the same performance at differing closing angles, these plots are also interesting because they illustrate a difference in performance area (size of the area between minimum and maximum performance) between page_35 Page 36

Fig. 1.9. Cartoid-shaped minimum average and maximum response distances as a function of encounter geometry. the three scenarios. Given the performance observed, the higher closing speeds actually exacerbate the differences between the scenarios. Although Scenarios 1 and 3 looked comparable in the 90° closure shown earlier, at shallower angles Scenario 3 actually requires a significantly earlier warning point to maintain the 5-mile alert zone. Study 2 Human Performance Experiment in Full-Mission Simulation In addition to the modeling and analysis provided in the MIDAS operation, a full-mission simulation has been undertaken to examine the use of cockpit display of traffic information and conflict alerting for airborne self-separation (Lozito, McGann, Mackintosh, & Cashion, 1997). This simulation examined the behaviors of 20 flight crews in an enroute scenario with self-separation at two levels of surrounding traffic density. The crews were provided with traffic information and alerting mechanisms on the horizontal situation indicator (nav display) of a 747400 fully certified full-motion simulator. The study controlled the geometry of encounter between pseudo-pilot traffic and the subject aircraft. Available escape maneuvers were kept constant in the two traffic conditions.

page_36 Page 37 Data were analyzed to examine: the use of visual flight rules to guide separation in an electronic display environment, air-to-air flight crew communications (in this experiment the flight crews could and did communicate via voice rather than datalink communications as represented in the computational model analysis), maneuvering procedures, impact of traffic density, and uncertainty in alert using a potential false alarm maneuver. The full experiment description and data analysis are reported in Lozito et al. (1997). A subset of the data is presented in Fig. 1.10, which charts the performance of flight crews in both high- and low-density traffic, and provides reference to the predictions by the MIDAS computational model and the performance of the flight crews. There is also a close correspondence (no significant difference in two-tailed t) between the crew performance times (high-density mean time to maneuver = 210 seconds) and the MIDAS-predicted time to action from alert (mean time 237 seconds). The study of aircrew separation represents one inner-loop element of the full-operation links between air and ground. The MIDAS model has been expanded to include the interaction of two air traffic controllers interacting with multiple flight crews in an enroute self-separation environment. The ground controllers in the mode are provided a conflict alerting system, following specifications of current prototype systems. The flight crew is provided alerting mechanisms as described previously. The model runs for the three scenarios are completed and will be compared to human performance data in full-mission simulation of both flight crew and ground. This will be an attempt to provide detailed verification of

Fig. 1.10. Data illustrating time to maneuver as a function of traffic density. Human performance data from 10 flight crews in full-mission simulation. page_37 Page 38 microbehaviors among the human operators and actions predicted by the MIDAS model. Conclusion General In this and in previous studies (Corker & Pisanich, 1995), the MIDAS model of human performance has provided data that are predictive of human performance. The MIDAS data can be used to examine procedures implied by alternative operational concepts for advanced ATM. In the analysis of the NAS, the inclusion of human performance as an active element in the system design suggests that alert system integration among air and ground elements is a primary concern. System stability in decision making must be assured by adequate communication between alert systems and by adequate information exchange among all participants in control. The model's predictions will be tested in these experiments. Model design guidance will be elaborated and applied to the coordinated operation of multiple control systems. Model Development Conclusions Human performance models of sufficient complexity to predict human interaction with automation in complex and dynamic operations have a number of shortfalls in the state of knowledge relative to their development and application. System performance modeling (in which the operators and the system function are modeling in the same formalism and support allocation of function) leads to issues such as: 1. The ensemble system goals are accessed and the human performance is characterized relative to that system at a given point in time, or over a time period. Explanatory or normative system models are developed in which data or phenomena are observed and a structure or process is asserted to produce such behavior. The model basis is ad hoc and data driven. Various researchers would maintain that this kind of model development is in fact what is called for (Moray, 1998). The problem here is that there is often no clear diagnosticity in the explanation provided as opposed to alternative suggestions. Model validity then is likely to be based on characteristics like parsimony or generalizability rather than structural completeness.

2. Analytic models assert a required performance for system operation. They then assert a method or structure/process for its achievement and then test model outcomes against data ranges of system operation. These model development techniques tend to produce specific models that adequately represent a specific task with a specific formulation and may have a very page_38 Page 39 highly predictive accurate performance profile Optimal Control Model (OCM and other manual models). However, attempts to cover a broader range of behaviors (e.g., decision making; Govindaraj, Ward, Poturalski, & Vikmanis, 1985) find the accuracy diminished as the characteristics of the behavior move away from the fundamental assumptions of the model. We have attempted to capture the accuracy and avoid the pitfalls in the processes discussed herein by establishing a framework wherein models based on multiple architectural assumptions can be established and interact with other models of hybrid formulation. Such framework, specifically, does not impose a single representational schema on human performance, nor does it attempt to extend a single computational mechanism to all required tasks (e.g., hands and eyes in EPIC; Kieras, Wood, & Meyer, 1997). The hybrid and linked framework also supports emergent behaviors from the interaction of the individual models in the framework. Properly interpreted, the emergent behavior provides potential for the generation of unanticipated (n + 1) event behaviors, useful in studies of the propagated effect of error. Finally, coordinated multimember team models for cockpit-ground and ground operations coordination require a predictive structure for accessing what each team member is doing in support of the mission (particularly that portion of the mission that is ascribed to them). Those team members can be automated or human, and representation of their function can be handled in at least two ways: Either full functional models of equipment and operator interacting with that equipment can be provided across a full range of expected scenarios (which is an arduous and time-consuming process), or human or machine behavior can depend on changes in the environment to flag expected or required behavior (essentially rule-based operation). In this case the operator model must have ''expectations" of action built into the recognized environmental events. This is essentially the current mechanism in MIDAS operations. Both of these processes require the designer/analyst to be aware of all significant actions that are likely to or expected to occur and require response. This requirement for omniscience in decision represents a significant challenge. On the one hand, information requirements (in the form of what needs to be provided to the operator) can be deduced, if one assumes that the display/control environment should provide all necessary information. It also makes clear what information the designer intends to have been "learned" by the performing operator and therefore is an indication of training requirement. On the other hand, the unexpected event is not anticipated, by definition, and operator states of omission (in which significant states of the environment or mission are not noticed) engender no response on the part of the operator. page_39 Page 40 A third way to deal with the coordinated informational requirements is to have an internal representation of the operator's internal states, a schema or plan (sketchy plans). The operator model also must have sketchy plans of the other operators and automation elements in the simulation. This requires monitoring events with both the subjective operator's plan functioning while maintaining a representation of other operators and the states of their plans in the system. Models with plans multiply represented then have a significant coordination and synchronization burden. The issue of scalability in such a confederation of independent agents is yet to be dealt with in this architecture. As we expand our investigations to include more ATM services, more aiding systems, and more operators in the NAS, we anticipate required development to effectively manage the complexity. We are initiating investigation into integrated representations that can be run at varied levels of temporal and physical resolution. We are also exploring computational requirements for such a complex confederation of models. It is an interesting irony that the utility of human performance models (in terms of effective cost-efficient methods to support system design) is derived from the complexity of the simulation required. However, the complexity of the required simulation may stress the current generation of human performance representations to such an extent that we must evolve a new paradigm for human performance and cognitive engineering modeling. Acknowledgments The author would like to gratefully acknowledge the entire MIDAS development team at NASA (the work has been theirs, the reporting mine), the U.S. Army Aeroflightdynamics Directorate support, the NASA Ames Aviation Capacity Programs support, and a special thanks to my two colleagues and authors "in abstentia," Greg Pisanich and Marilyn Bunzo. References Aldrich, T. B., Szabo, S. M., & Bierbaum, C. R. (1989). The development and application of models to predict operator workload during system design. In G. MacMillan, D. Beevis, E. Salas, M. Strub, R. Sutton, & L. Van Breda (Eds.), Applications of human performance models to system design (pp. 65-80). New York: Plenum. Atencio, A., Banda, C., & Tamais, G. (1998). Evaluation of a short haul civil tiltrotor in emergency go-aroundA MIDAS simulation. Paper presented at the American Helicopter Society 54th Annual Forum, Washington, DC. Atencio, A., Shively, R. J., & Shankar, R. (1996). Evaluation of air warrior baselines in a Longbow Apache Helicopter crewstation in a MIDAS simulation. Paper presented at the American Helicopter Society 52nd Annual Forum, Washington, DC. page_40

Page 41 Baddeley, A. D., & Hitch, G. J. (1974). Working memory. In G. Bower (Ed.), Advances in learning and motivation (Vol. 8, pp. 47 90). New York: Academic Press. Baron, S., & Corker, K. (1989). Engineering-based approaches to human performance modeling. In G. R. McMillan, D. Beevis, E. Sallas, M. Strub, R. Sutton, & L. van Breda (Eds.), Applications of human performance models to system design (pp. 203 216). New York: Plenum. Bartlett, F. C. (1932). Remembering. London: Cambridge University Press. Billings, C. E. (1997). Aviation automation. The search for a human-centered approach. Mahwah, NJ: Lawrence Erlbaum Associates. Billings, C. E., & Woods, D. D. (1995, April). Coordination coupling and complexity in the future aviation system. Paper presented at the VIII International Symposium on Aviation Psychology, Colombus, OH. Brirmingham, H. P., & Taylor, F. V. (1954). A design philosophy for man-machine control systems. Proceedings of the IRE, 42, 1748 1758. Corker, K. M., & Pisanich, G. M. (1995, June). Analysis and modeling of flight crew performance in automated air traffic management systems. Paper presented at the 6th IFAC/IFIP/IFORS/IEA Symposium: Analysis, Design, and Evaluation of Man-Machine Systems, Boston. Corker, K. M., & Smith, B. (1993, October). An architecture and model for cognitive engineering simulation analysis: Application to advanced aviation analysis. Paper presented at the AIAA Conference on Computing in Aerospace, San Diego. Coularis, G., & Dorsky, S. (1995). AATT potential benefits analysis (NASA-Ames Report No. AATT-95-001). Sunnyvale, CA: Seagull Technology, Inc. Craik, K. J. W. (1947). Theory of the human operator in control systems: I. The operator as an engineering system. British Journal of Psychology, 38, 56 61. Firby, R. J. (1989). Adaptive execution in complex dynamic worlds (Tech. Rep. YALEU/CSD/RR #672). New Haven, CT: Yale University Press. Gansler, J. S. (1987). Time and cost reductions in flight vehicle acquisitions (The Analytical Sciences Corporation Briefing to NATO Advisory Group for Aeronautical Research and Development). Neuilly-sur-Seine Cedex, France: Advisory Group for Aerospace Research and Development. Govindaraj, T., Ward, S., Poturalski, R., & Vikmanis, M. (1985). An experiment and a model for the human operator in time-constrained competing-task environment. IEEE Transactions on Systems Man and Cybernetics, SMC-15(4), 496 503. Kieras, D. E., Wood, S., & Meyer, D. (1997). Predictive engineering models based on the EPIC architecture for a multimodal highperformance human-computer interaction. ACM Transactions Computer-Human Interaction, 4(3), 230 275. Lozito, S., McGann, A., Mackintosh, M., & Cashion, P. (1997, June). Free flight and self-separation from the flight deck perspective. Paper presented at The First United States/European Air Traffic Management Research and Development Seminar, Saclay, France. McRuer, D. T., & Jex, H. R. (1967). A review of quasi-linear pilot models. IEEE Transactions on Human Factors in Electronics, HFE-8(3), 231 249. McRuer, D. T., & Krendal, E. S. (1957). Dynamic response of the human operator (Tech. Rep. No. WADC-TR-56-524). Dayton, OH: Wright-Patterson Air Force Base. Moray, N. (1998, October). The psycho-dynamics of human-machine interaction. Keynote speech presented at the 2nd International Conference on Engineering Psychology and Cognitive Ergonomics, Oxford, England. Paeilli, R. A., & Erzberger, H. (1997). Conflict probability estimation for free flight. Journal of Guidance, Control and Dynamics, 20(3), 588 596. Payne, J. W., Bettman, J. R., & Johnson, E. J. (1988). Adaptive strategy in decision making. Journal of Experimental Psychology: Learning, Memory, and Cognition, 14(3), 534 552. Pew, R. W., & Mavor, A. S. (1998). Modeling human and organizational behavior: Applications to military simulations. Washington, DC: National Academy Press. page_41

Page 42 Rasmussen, J. (1983). Skills, rules, and knowledge: Signals, signs and symbols, and other distinctions in human performance models. IEEE Transactions on Systems, Man, and Cybernetics, SMC-13(3), 257 266. Reason, J. T. (1987). The Chernobyl errors. Bulletin of the British Psychological Society, 40, 201 206. Reason, J. T. (1990). Human error. Cambridge, England: Cambridge University Press. RTCA, Inc. (1995a). Final report of the RTCA Board of Director's Select Committee on Free Flight. Washington, DC: Author. RTCA, Inc. (1995b). Final Report of RTCA Task Force 3: Free Flight Implementation. Washington, DC: Author. RTCA, Inc. (1996). Free flight action plan. Washington, DC: Author. RTCA Select Committee on Free Flight Implementation. (1997). A joint government/industry operational concept for the evolution of free flight. Washington, DC: RTCA, Inc. Sheridan, T. B., & Ferrell, W. R. (1969). Human control of remote computer manipulators. Paper presented at the International Joint Conference on Artificial Intelligence, Washington, DC. Shively, R. J., Atencio, A., Bunzo, M., Tyler, S., & Logan, M. (1995). MIDAS evaluation of AH-64D Longbow crew procedures in a airground flight segment: MOPP versus unencembered (Sterling Federal Systems CR). Moffett Field, CA: NASA Ames Research Center. Tyler, S., Neukom, C. Logan, M., & Shively, J. (1998). The MIDAS human performance model. In Proceedings of the Human Factors and Ergonomics Society 42nd Annual Meeting (pp. 320 325). Wickens, C., Mavor, A., & McGee, J. (1997). Flight to the future: Human factors in air traffic control. Washington, DC: National Academy Press. Wickens, C., Mavor, A., Parasuraman, R., & McGee, J. (1998). The future of air traffic control: Human operators and automation. Washington, DC: National Academy Press. page_42 Page 43

Chapter 2 Mental Workload and Cognitive Complexity Véronique De Keyser Denis Javaux University of Liège, Belgium The analysis of the constraints that technology and the environment have imposed on humans has undergone some important methodological changes over the past few years. In the area of research on mental workload, the conception of man as a limited-capacity reservoir for information processing has taken over the study of cognitive mechanisms that allow man to master a complex situation, whether it be habitual, unexpected, or getting worse. In the field of aeronautics, where technology has undergone spectacular advances and the risk for latent human error is high, new data on the problem can best be measured. In this chapter, we try first to understand these changes, and then develop the methodological consequences in the area of design and certification of new-generation airplanes. Mental Workload Do the changes in perspective uncovered by the studies constitute a new paradigm, or a methodological tinkering based on proven techniques? In order to attempt to respond to these questions, it is useful to compare the concept of mental workload, which is already an old one, to that of cognitive complexity. In doing so, we see that in spite of their methodological invariants in their respective exploration, a difference appears. Today, it is less a matter of knowing whether humans are overloaded by constraints, than determining whether or not they understand and how they page_43

Page 44 interpret the situation with which they are interacting. Thus, the context takes on considerable importance, as well as the role of human and technical agents that belong to it. Information theory has modeled the human as a sender-receiver message system, with limited capacity for information processing (Shannon & Weaver, 1949). Within this epistemological framework, information processing is sequential and the quantity of information that humans can process depends directly on the probability of appearance of the message, which conditions its optimal codification; the entropy can be interpreted as the average information emitted per message (Faverge, 1965). Assuming that the noise inherent to the system is zero, and that the entropy is below a threshold limitand this is where you begin to see the emergence of the mental workloadthe messages transmitted are received without error. Beyond this threshold, the information transmitted and the information received divergewhich explains the function R = f(H); see Fig. 2.1. Experimental results, such as Miller's magic number (1956), added strength to this theory of the human as a system of information processing of limited capacity. The hope for some quantification of the amount of information weighing on humans and for human-centered design that allows for a reduction of the resulting mental workload, inspired researchers for decades. In the attempt at quantification, several paths were followed. The first is centered around the constraints of the situation, that is to say, on the input to the system. The number of messages to process, their probability of appearance, the time necessary to carry out a task in relation to the time available are variables that were widely used in the literature to quantify mental workload. The second stems from performance, that is to say, from the system's output. Productivity, errors, the variations in operators' strategies, and the dual-task method, are just some of the means used by researchers to objectively verify the surpassing of a limited capacity of information processing, or at least, a malfunctioning in the human-situa-

Fig. 2.1. The function R = f(H). page_44 Page 45 tion interaction. But hopes for an objective measure of mental workload dissolved over time. It seems obvious, in a variety of domains, that the information-processing capacity of man goes way beyond Miller's magic number seven; operator performance in the nuclear control room, in airplane cockpits, or in automobile driving in heavy traffic clearly illustrates this. As the modeling of man evolved further, it was proposed that there is not just one but several attention resources. The limited capacity of working memory is widely known; the existence of multiple cognitive control levels, including automatic processing and tasks under more or less intense attentional control, was supported both at the theoretical and the empirical levels; and today, the possibility of connectionism, and thus of a parallel processing of information, are being explored (French, 1995; Sougné, 1996). Moreover, man's active role in shaping situations has been highlighted. Humans are no longer considered to passively yield to constraints that surround them; instead, they manage their workload, modify their strategies (Bellorini & Decortis, 1994; Sperandio, 1972), transforms the context in which they operate. This is the idea of situated cognition that has been defended by several authors (Amalberti, 1996; Sternberg & Wagner, 1994). It explains why, for lack of having been able to quantify mental load imposed by constraints, most researchers opted for the study of system output. This can be physiological parameters, performance indexes, or subjective measures of workloadfor example, the NASA (National Aeronautics and Space Administration) TLX (Task Load Index) scale (Hart & Staveland, 1988) and the SWAT (Subjective Workload Analysis Technique) technique (Reid & Nygren, 1988). It is these combined techniques that were employed in the certification of the two-person crew by Airbus Industry. Certain performance indexes, like human error, have become particularly important over the last few years. And this is, no doubt, because they enter into the chain of factors that can lead to catastrophes in high-risk environmentslike in the nuclear industry, in transportation, and in other process control domains. In combination with latent organizational and technical failures, and with fortuitous circumstances, they can lead to accidents in a probabilistic manner, whose consequences will be more or less severe according to the nature of the environment (Reason, 1990). But errors can also be considered as symptoms, allowing for a better analysis of the malfunctioning of the human-machine-environment system. The study of human errors occurring in aviation accidents, such as the Mont Ste. Odile crash (Monnier, 1993), show that these events can arise in environments without any major disturbance, without any technical malfunction, and without any apparent mental overload. Analysis of the input and the output of the system, which is characteristic of the evaluation of mental workload, has its limits. In response, we see the appearance today of the study of complexity and of situation awareness. page_45

Page 46 Do we have the means today to describe the complexity of a technological and organizational situation, and to evaluate in a predictive manner its impact on the cognitive processes brought into play by a worker and his or her behavior? This is what we attempt to do in this chapter, while at the same time recognizing that neither the concept of complexity nor that of situation awareness are free of ambiguity. There is a risk, if we are not careful, that these inquiries will lead to research along dead-end paths just like those along which the studies of mental workload were led. Complexity Defining the concept of complexity presents the same difficulties as those already encountered in relation to mental workload: how to objectify and select the relevant variables of the situation, how to account for the subjective, deciding whether or not complexity can be quantified. Authors such as Woods (1988), De Keyser (1988), Hoc (1993), Brehmer (1990), and Van Daele (1993) identified a number of variables that can make control difficult for the operator: the number of variables to control, the dynamics of the situation, temporal pressure, risk, and so forth. But all of them have made the observation that the objective description of the variables of a technical system is insufficient for pinpointing the concept of complexity and explaining the errors encountered. Objective complexity has been contrasted with subjective complexity, that is, that aspect of complexity that stems from the characteristics of the operator, his or her expertise, stress, fatigue, and so on. Here again the description does not account for the interaction of the subject with his or her environmentand notably with the task. Amalberti (1996) summed up these multiple approaches in a heuristic manner by identifying within complexity the characteristics of the technical system, those of the agents and of the representations, the dynamics of the process, temporal pressure, the irreversibility of acts, the nonpredictability of the process, the number of temporal reference systems to manage simultaneously, the risk, certain factors stemming from the insertion of highrisk systems into cooperative macrosystems (influence of hierarchical, functional, and temporal structures) and finally, the factors linked to human-machine interface. These categories and factors are interesting but difficult to use upstream in the design cycle in the aviation domain. Although they suggest important aspects and criteria to be taken into account, they do not propose an explicit model of the genesis of complexity, nor a method for measuring complexity at the end of the design cycle. An explanation of the genesis of the complexity is missing, and it is therefore important, without ignoring the aforementioned heuristic approach, to turn toward models of cognitive complexity. page_46 Page 47 Cognitive Complexity and Its Operationalization Approaches focused on the notion of cognitive complexity start from the idea that the complexity of the human-machine-environment system is reflected in the complexity of cognitive processes underlying the performance of tasks. The tasks and thus the action are replaced in the center of this conception, as are the modalities of information processing necessary for each task. The Computational Approach to Cognitive Complexity The cognitive complexity theory (CCT) model, introduced by Kieras and Polson (1985), constitutes the best-known attempt at the operationalization of cognitive complexity. It resembles the sophistication of the GOMS (Goals, Operators, Methods, and Selection rules) model of Card, Newell, and Moran (1983) applied to human-computer interaction (HCI), and is based on the idea that the users possess procedural representations conditioning the action, in the form of hierarchical plans (or goal hierarchies). The knowledge possessed by users is presented in the form of production rules. The model is cognitive because it refers explicitly to working memory, considered as a workspace where the activated rules and the internal variables describing current states and goals are stored. It allows for the operationalization of complexity as it proposes several measures: The number of production rules necessary to use a software application turns out to be a predictor of its complexity and of the learning time necessary for proficiency. The number of items maintained temporarily in working memory is a predictor of the probability of errors or delays. John and Kieras (1994) summarized in a report the predictive capabilities of the GOMS, the CCT, and their derivatives. They showed that their predictions of duration of task execution are generally well correlated with the duration observed in experimental situations. These predictive capabilities justify the interest shown in these models, which allow, from the initial phases of design, the prediction of certain aspects of humanmachine interaction as they will be revealed in an operational context. The operationalization of the CCT approach is a computational approach in which, in order to study the complexity of a human-machineenvironment, a model is created on a computer. This model allows for the description and simulation of cognitive processes in order to study their page_47

Page 48 complexity. However, the CCT cannot claim to be a general theory of cognitive complexity because it models only a certain class of cognitive processes in a certain type of environment. These are notably high-level processes, those having to do with the planning of actions and with their execution that can, under certain approximations, be modeled by symbolic information processing. Perceptual processes, the application of mental models, and multicriteria decision making are not taken into account in the basic CCT model. Moreover, the environment under consideration is static, with one single agent; it is not a dynamic situation of distributed control among several agents, as is the case in natural environments. It should be noted, however, that recent models, like the EPIC (Executive-Process/Interactive Control) model (Kieras & Meyer, 1995) and the MIDAS (Man-Machine Integration Design and Analysis System) model (Pisanich & Corker, 1995) are beginning to integrate the dynamic dimension of process control. Thus it seems difficult today to base the operationalization of cognitive complexity on a single model, but it still seems desirable to choose or develop, for each human-machine interaction studied, the best-adapted computational model. Then a major problem arises, just like in the study of mental workload and of cognitive sciences in general: the observability of the object of study. The Observability of the Cognitive Processes Brought into Play in an Interaction Situation Cognitive processes are not directly observable. We think that it is possible to get around this difficulty in four ways: 1. Through the structural approach to situations and to tasks: In this procedure, cognitive processing remains implicit, but there is a formalization of structures considered as invariants of the system of human-machine interaction that can be considered as determining the nature and the complexity of the cognitive process put in place. Hence, the complexity of the object under control, the environment or the machines, will be characterized in terms of its spatial or temporal structure, its indeterminism, its interaction structures of dialogue, and its functional properties. For example, metrics have been obtained by Tullis (1988) or Comber and Maltby (1996) when evaluating layout complexity of computer screens. The complexity of tasks (e.g., Følleso, Karstad, & Døivoldsmo, 1995) will be analyzed equally in terms of indeterminism, reactivity or interruptive character, and branching factors. Javaux (1996) applied this approach to planning, distinguishing between different, more or less complex task-planning structures for one individual (see Fig. 2.2). This structural approach always goes through the search for a formal method or language page_48 Page 49

Fig. 2.2. Complex plans as they can be found in real-world situations. capable of describing the variables observed and their interactions: It allowed for good exploration of dynamic situations. Yufik and Sheridan (1993), for example, relied on abstract formalisms when evaluating the cognitive complexity of human-machine interfaces by means of weighted graphs of tasks and control procedures. 2. Through computational models of cognitive processing: This refers to the procedure followed by models already described (CCT, GOMS, MIDAS, EPIC, etc.). In this case, the models of cognitive processing are explicit. They are described with sufficient precision to allow for their implementation on the computer and, consequently, cognitive simulation of information processing in situ. Such an approach was used by S. Irving, Polson, and J. E. Irving (1994) for modeling the cognitive processes involved in the interaction with the flight management system (FMS) in highly automated cockpits. The predictive validity of human performance carried out based on these models is important insofar as they have been well chosen according to the characteristics particular to the situation and to the tasks. And this allows measuring cognitive complexity on the computational models themselves, in place of the cognitive processes, which remain unobservable. 3. Through experimentation and measures of performance: This approach is more heuristic than the preceding ones. It postulates the existence of an implementation, either a prototype or final, of the situation of the human-machine-environment interaction that we want to evaluate. The choice of scenarios and performance indicators in combination with indicators of the complexity of the underlying cognitive processes is critical for the validity of the approach. Few performance indicators allow for inferences about cognitive processes (anticipation, prospective memory, etc.). Thus, unless combined with other approaches, this technique is hardly predictive but rather very similar to everything that has been done up until now in the area of mental workload. 4. Through experience feedback: This approach is being taken by designers and companies making use of information from accidents, incidents, and problems (e.g., reporting systems) encountered in operational envipage_49

Page 50 ronments. The ecological validity of the approach is very high but it involves some other problems: for example, confidentiality of information and economic difficulties in reviewing existing systems. In general, this approach is most successful when the problems encountered are of a technical nature and directly threaten the safety of the system; it is less efficient for problems that are more subtle and underestimated because they do not directly or on their own cause accidents but rather are one factor among others that, when combined, increase the probability of an accident. The Levels of Analysis Human-machine interactionlike any communication actmust be analyzed according to three tightly intermingled levels: the syntactical, the semantic, and the pragmatic. Whereas the syntactical level can be seen as an objective way to describe the situation invariants, both the semantic and the pragmatic levels bring the human subject back into the analysis: These levels cover the subject's experience, his or her interpretation of the context, as well as his or her behavior. Each of these levels could be tapped using specific cognitive complexity indexes. However, up to now, most of the research progress in this matter focused on the syntactical and pragmatic levels. The levels break down as follows: 1. The syntactical level of analysis of cognitive complexity reflects the invariants in the structure of human-machine interaction; it is an analysis of a structural type describing the situation and the processes brought into play, starting from a certain model of the human operator, in order to satisfy the constraints imposed by this situation. This level is open to a measurement of cognitive complexity, which is variable according to the type of formalism and the model of human operator used. 2. The semantic level is contextualized: It reflects the meaning, and thus the awareness of the situation that the operator will have, taking into account available data, the attention given to those data, and the high degree of dynamism of the situation. Emphasis is thus no longer placed on the invariants of the situation, but rather on its variability and the interpretation by the operator. The complexity linked to this level has not been the object of a measurement, but can be more or less predicted based on certain data from the field and from the exploration of the operator's expertise. A good example of this approach can be found in the studies of Sarter and Woods (1992, 1994) on the difficulties of using the FMS. 3. The pragmatic level is concerned with behavior and conduct. Within the framework of the study of cognitive complexity, the pragmatic level is strongly influenced by the design of systems and interfaces. At the same page_50 Page 51 level of syntactical complexity, and in very similar situations on the semantic level, the design of an interface can play a determining role, being able to limit, or even neutralize, the effects of syntactical complexity. The Measure of Cognitive Complexity It is not always necessary, nor always possible, to obtain a quantitative measurement of cognitive complexity, like the one proposed by Kieras and Polson in the CCT. Other forms of operationalization are possible. We propose four of them, organized around the notion of comparison of human-machine interactions (see Table 2.1): 1. The variation of factors: It constitutes the simplest form of the measurement of cognitive complexity. We are not seeking here to produce an index of cognitive complexity, but to define a method for determining if the introduction or a modification of a human-machine interaction will lead to an increase or a reduction in cognitive complexity. This first level was achieved in studies of mental workload that used performance indices such as errors, response times, and so on: for example, ''If we modified the format of this display, we would reduce the cognitive complexity (the computational complexity of underlying information processing)." 2. The ordinal comparison: This constitutes a more sophisticated version of the previous approach. In this case, we seek to compare two possible forms or options of a human-machine interaction situation, two design alternatives, without necessarily having recourse to any complexity index. It is this type of measurement that is ordinarily obtained when we attempt to compare two tasks, on the level of mental workload, by the dual-task method: for example, "We have two alternatives for formatting this display, but the first option turns out to be less complex than the second." 3. The ordinal comparison with a nominal index of cognitive complexity: For each option or situation of human-machine interaction, there is an associated nominal index of cognitive complexity. The possible values of the TABLE 2.1 The Forms of Operationalization of Cognitive Complexity Forms of Operationalization

Relations

Variation of factors

C(Va) > C(Vb)

Ordinal comparison without index of CC Ordinal comparison with nominal index of CC Metrical comparison

C(a) > C(b) C(a) = A; C(b) = B; A > B C(a) = A; C(b) = B; A > B; A - B = C; A/B = D page_51

Page 52 nominal index are ordered linearly in order of increasing value. It is thus possible to not only compare two options but to locate them on a scale possessing a threshold value that is independent of these options. This is what the subjective questionnaires on mental workloadsuch as NASA, TLX, or SWATsucceed in doing: for example, "the complexity of Option A is weak, and the complexity of Option B is high (on the 'very weak, weak, average, average-high, high' scale)." 4. The metrical comparison, on a scale of supposedly equal intervals: This is the most powerful form of measurement. For each option or design, there is an associated numerical value that allows for comparison as well as subtraction and division. In the area of mental workload, such powerful measuring tools are not yet available. An example is: "the complexity of Option A is 0.3, and the complexity of Option B is 0.6. Option B is thus twice as complex as Option A." As we have seen, cognitive complexity can be measured in different ways, and up to a certain point, the different forms of measurement are similar to those used for measuring mental workload. What we have here is not a metrical revolution, but simply an attempt to attain the fourth level of measurement, which has been elusive up to this point. Operationalization of the Cognitive Complexity of Autopilot Modes Autopilot modes constitute an example of resources offered to pilots by the automation of new-generation airplanes. Though intended to facilitate crew performancean objective that is achieved most of the timeit appears that under certain conditions they make flying the plane more difficult as their behavior and its underlying logic are often unavailable to pilots (Sarter & Woods, 1994, 1995). Their complexity should be evaluated early on in the design process in order to guide the design of new-generation airplanes and to help with their certification. The Cognitive Complexity of Modes The complexity of modes is considerable. There are numerous modes for vertical and lateral navigation, and they are linked in many ways. In order to make things easier to understand, we focus on individual modes rather than their interactions. Modes are either engaged, armed, or disengaged. A mode only exerts its effects once it is engaged. An armed mode is prepared for activation but is not yet active. An inactive mode exerts no effect. Changes in the activation state can be ordered by the pilots or by page_52 Page 53 the automation itself. In order to indicate to a particular mode what task it must carry out, the pilots must generally specify one or several parameters (e.g., the new altitude to reach for the LVL CHG or V/S modes, the vertical flight plan, A/C weights, cost index) that will determine the system behavior once the mode is engaged. The study of cognitive complexity associated with human-system interaction in the context of modes is, first of all, linked to the analysis of the interaction with these settings and parameters. We approach it along three aspects, derived from a cognitive task analysis of the interaction with modes, that have proved to constitute possible sources of human error on the flight deck: mode awareness, intentional mode transitions, and autonomous mode transitions. 1. Mode awareness: In the process of using modes and setting parameters that determine system behavior once the mode is engaged, pilots maintain mode awareness by using multiple resources: knowledge in long-term memory (e.g., their knowledge about mutually exclusive modes, i.e., modes that cannot be active simultaneously), information in working memory (e.g., the knowledge about what mode was just engaged), and available information in the environment, including the cockpit (e.g., the load factor that indicates that a vertical mode is active, indications on the FMA (Flight Mode Annunciator) that indicate which lateral and vertical modes are active, etc.). To study the cognitive complexity within this framework is thus to study the complexity of cognitive processes that manipulate this information, manage associated perceptive behaviors, and thus maintain mode awareness. 2. Intentional mode transitions: Once the decision to modify the target parameters or the state of engagement of a mode has been made, this intention must be translated into an effective modification, by means of an interaction with the interfaces that support these modes (MCP/FCU panels, CDU/MCDU keyboards). In order to describe this cognitive operation, which consists of transforming an intention into an action with effects on the world, Norman (1988) talked about a gulf of execution that needs to be bridged. The cognitive transformation must be the simplest possible. In order to study the cognitive complexity of the intentional modification of the mode configuration, it is necessary to study the complexity of the cognitive processes that are involved in the transformation of the intention into an interaction with the automation interfaces. 3. Autonomous mode transitions: The ability to predict mode changes that are initiated by the automation is important for pilots. It is critical for maintaining mode awareness, and it is useful for planning mode usage during the flight. Modes on glass cockpit aircraft can change in an autonomous manner for three reasons. There is a transition by capture when the target assigned to the current mode is reached. The current mode page_53

Page 54 is thus no longer useful, and another mode, which maintains the parameter (e.g., altitude, LOC, and G/S deviations) around the target value (possibly dynamic), is activated instead. This is the case, for example, in typical altitude capture modes (such as ALT ACQ or ALT*) or ILS modes (G/S and VOR LOC). Mode reversions can also happen when the current mode cannot satisfy the objectives assigned to it by the pilot, for example, attaining a target without violating certain constraints (e.g., to avoid stalling the aircraft). This is the case with reversions from V/S (vertical speed mode) toward LVL CHG (level change mode) in the B737-300 or from OPEN CLB (open climb) to V/S (vertical speed mode) in the A320. Finally, a transition can occur as a result of the activation of a protection feature. This is the case for the α-floor protection in the A320 aircraft, which helps avoid stalling the aircraft when the angle of attack of the wing is greater than a given threshold. To study the cognitive complexity here is thus to study the complexity of cognitive processes that carry out the prediction of autonomous mode transitions in these three different feature cases. It is easy to tell, by reading the preceding pages, how much this description of situations of interaction with automation owes to a structural approach, allowing the inobservability of cognitive processes to be circumvented. Moreover, it is possible to derive an approach by a model, for example, a symbolic model of information processing, based on general knowledge of cognitive structures capable of managing objects that are functionally similar to the modes based on descriptions of their functional properties. The discrete nature of the situation (a limited number of activation states) and the deterministic behavior of modes as well as the fact that they can be described by means of production rules and finite automatons (Degani, Mitchell, & Chappell, 1995; Degani & Kirlik, 1995) allow for an operationalization of cognitive complexity linked to modes. This is achieved by combining the structural approach and modeling, with the option of verifying the ecological validity of this approach through more classical methods, such as experimentation based on scenarios and operational experience. An Example of Operationalization We can use production rules to describe the basis for mode awareness and for how changes in the status or targets of modes are implemented or how autonomous automation transitions are carried out. Part of the information necessary to create rules is available in the operations manual. Other information can be obtained through questionnaires, interviews, and observations in context. Once the production rules are described, they can be formalized with the aid of Boolean logical expressions that will later be page_54 Page 55 evaluated (for their cognitive complexity). The following two examples, activation of the α-floor protection (autonomous mode transition) and arming of LOC mode (intentional mode transition) on the A-320, illustrate this claim: The activation of the α-floor protection can be expressed as in Fig. 2.3, and can thus be described with the aid of the production rule displayed in Fig. 2.4. The arming of the LOC mode used for the approach obeys the conditions in Fig. 2.5, and can be described with the aid of the production rule expressed in Fig. 2.6. Formalized production rules of this type constitute some of the invariants of the human-machine interaction situation based on which cognitive complexity is calculated. They are the basis for a structural or syntac-

Fig. 2.3. The conditions for activation of the α-floor protection.

Fig. 2.4. The production rule for the activation of the α-floor protection.

Fig. 2.5. The conditions for the arming of the LOC mode.

Fig. 2.6. The production rule for the arming of the LOC mode. page_55 Page 56

Fig. 2.7. The precondition for LOC armed. tical analysis associated with the precondition (see Fig. 2.7) of the production rule already described and that allows for the calculation of an index of structural complexity on a syntactical tree derived from the logical expression. This index is based on the iterative method (see Fig. 2.8), which consists of studying the instantiations of the precondition expression on the set of possible truth values of its arguments. The index obtained represents the average number of argument evaluations (e.g., is RA > 100, true or false) that it is necessary to carry out before being able to determine if the complete expression is true or false. A structural analysis of the precondition in terms of a syntactical tree is used for the purpose of computation. The structural or syntactical analysis, which reflects the invariants of the interaction situation, does not, however, reflect the constraints that are imposed on a specific individual operator. First, its measure is contingentas in the case of attempts at quantification of mental workload through information theoryon the type of model of information processing taken into account. In this case, we made the implicit assumption of symbolic information processing. Other recent attempts at modeling high-level processes such as reasoning based on a connectionist approach would lead to different results (French, 1995; Sougné, 1996). Moreover, the semantic analysis of the situation by the pilot plays an important role; it depends on the contextthe crew, other planes, air traffic control, and so onand on the expertise of the individual. In the case of interaction with modes, we

Fig. 2.8. Metric evaluation of the cognitive complexity of LOC armed. page_56 Page 57 are interested in the impact of operational context on the cognitive processes involved in evaluating logical expressions. The evaluation of logical expressions is but one of the basic operations assumed to be associated with the overall process of mode interaction, which is itself only one of the tasks to be performed on the flight deck (along with, e.g., flight and trajectory management, communication with the air control center, the interactions with the navigational personnel, etc.). By taking into account the operational context, the process of interaction with the automation is situated in the larger context of the full range of tasks to be carried on in parallel. The well-known problems associated with managing limited resources then arise, among them the limits on cognitive and attentional resources and limitations of the time available to accomplish these tasks (time pressure). Understanding this contextualization of interaction with the automation may eventually lead to a better understanding of the heuristic strategies used by pilots in their interaction with automated equipment that are less efficient in terms of performance but are more economic in terms of resource expenditure. In general, situating the interaction with automation within the larger context of the flight usually allows pilots to improve and refine their decision-making faculties. On the other hand, it may also sometimes lead to problems with attentional focus and hence to a decrease in situation awareness (e.g., a failure to detect automatic mode transitions). Loss of mode awareness has played a role in conflicts with the automation (e.g., pilots flying through the autopilots, pilots fighting against the automation), as witnessed by incidents such as Moscow (1990) or Orly (1993) and the Nagoya accident (1992). Finally, whereas the structural analysis is concerned with the function of logical expressions, and the semantic analysis with interpretation, the pragmatic analysis looks at arguments. How are arguments evaluated in the cockpit, such as "ILS tuned," "RA > 400," "TAKEOFF engaged," or "LOC pushed"? The answer to this question depends on the availability and the format of information presentation in the cockpit. The arming of the CLB mode in the A320 specifies, for example, in its preconditions that no vertical mode must be engaged for arming the mode if the plane is still on the

ground or if the TAKEOFF or the GO-AROUND modes are active (A320 FCOM, rev. 18, seq. 103). This condition on the engagement of vertical modes in thus an argument of the precondition production rule that formally directs the arming. This argument can be expressed in logical terms as in Fig. 2.9. Figure 2.9 describes a logical argument that makes visible the level of complexity. From a pragmatic point of view, the evaluation of the argument is simple in the A320 cockpit. One simply has to consult the FMA column dedicated to vertical modes to determine if a vertical mode is already active. The accessibility and the format of information presentation thus determine the ease of evaluation of the argument in the cockpit. page_57 Page 58

Fig. 2.9. The logical expression for "no vertical mode engaged." A theoretical approach to the evaluation of arguments in the cockpit is possible with the aid of standards of accessibility, such as the MIL-1472 STD. Such standards have been used by NASA in the framework of the MIDAS model coupled with the JACK (name of simulated character) model to study the different configurations of the cockpits. The exploitation of MIDAS in this feature case shows, moreover, that an approach through computational models of evaluation of arguments is equally possible. The use of standards of accessibility or of computational models such as MIDAS or EPIC should thus allow for the operationalization of the cognitive complexity of the evaluation of arguments, even if it is doubtful that numerical indices can be obtained. Discussion and Conclusions Does the proposed approach of investigating the constraints that technology imposes on the individual by examining cognitive complexity constitute a paradigm shift? Let us point out some of the similarities and differences between the proposed and more traditional approaches like the ones used in the study of mental workload. Quantification For over half a century now, researchers have been attempting to quantify the cognitive constraints imposed on the individual at work. Drawing support from the theory of information and concomitant experiments, like that of Miller's magic number (1956), they hoped, in the study on mental workload, to end up with a metric based on a neurophysiological reality, that is to say on the limits of information-processing ability in working memory. We know the outcome of this story, and the progressive discovery of the extreme complexity of cognitive functioning, which could not be modeled like a simple telephone receiver. The computer metaphor replaced that of the telephone, but neither did it discourage researchers nor did it solve the methodological problems encountered in the past. The goal to quantify is still being pursued; the idea of a metric of optimal coding of messages has been replaced, for example, by the idea of a metric based on the syntaxitself also optimalof logical expressions expresspage_58 Page 59 ing the constraints of work. Although the analysis of cognitive constraints has been refined and languages of formalization have been developed, the direction of research has not been altered in fundamental ways. This can be explained by the need for methods for predicting difficulties that can arise in human-machine interactions. This need is becoming increasingly urgent given the length of the design cycle for certain technologies, like airplanes. The Plurality of Models and the Relativity of Measurements Researchers today seem convinced of the impasse constituted by the search for a single measurement, indeed a unique metric of complexity. The extreme plasticity offered by the possibility of modeling cognitive functioning, with the aid of different computer models, allows us to imagine that it may be the choice of the model that determines the type of measurement of cognitive complexity. This choice of model requires us to take into account the objects that the model can process. We have discussed previously the attempts of KLM, GOMS, and CCT to find a measure of cognitive complexity for static situations, and the new directions of EPIC and MIDAS toward dynamic situations. It is no doubt in this areathe idea of a relativity of the measure according to the model chosenthat the approach to cognitive complexity once more distinguishes itself from the studies on mental workload. The Final Evaluation and Operational Feedback Little progress has been made with respect to the analysis of performance and the use of operational experience as final criteria for the identification and verification of cognitive constraints over the course of these last years. Indeed, experiments are still conducted to record errors, response times, and physiological parameters in order to test hypotheses about cognitive functioning. Two paths are being explored today, which, although not new, mark a methodological refinement. The first one is the increasingly widespread use of simulatorswhether it be in aeronautics, anesthesia, the nuclear industry, and continuous processes in general. When used for recording parameters defining the situation, and for the systematic gathering of information on operator performance, they are very valuable means of investigation. Moreover, the creation of databases of problematic operational scenarios that are exchangeable from country to country allows for the control of certain organizational and cultural factors in supporting performance. The next research path is to combine a small number of new performance measures and criteriafor example, prospective page_59

Page 60 memory, anticipation, and systematically analyzed and classified errorswith an emphasis placed on verbalizations. Such approaches, even though not totally innovative, represent progress. Distributed Control The model of mental workload was based on the idea of an individual engaged in information processing. Presently, researchers are turning toward models that bring into play the multiple human and nonhuman agents that perform tasks in a distributed manner. This new perspective was not strongly emphasized in this chapter because we based our mode example on a structural description of the invariants of the situation. It is nonetheless inherent to the idea of distributed task sharing between the crew, the automation, air traffic control, and the environment with other planes (Hutchins & Klausen, 1991). The approach pursued in this workthat is, the implicit hypothesis of a symbolic information processinghas remained very classical because it was influenced by the idea of a possibility of prediction of the cognitive complexity of a system able to serve as a plane certification system. Current attempts to model complex systems that introduce the principles of autoorganization and feedback, based on connectionist models (empirically taken up by a descriptive anthropological current), do not allow at the current time this type of prediction. The Three Levels of Analysis It is clear, however, that the approach to cognitive complexity through computational complexity is not enough to fully explain performance in context. We have, in this respect, distinguished between three levels of analysis. The first, structural or syntactical, is tightly linked to the model and to the language of formalization used to describe the invariants of the situation. But it is mediated, on the one hand, by the interpretative framework in which the agents are placedexpertise, environment, and so forththat is to say, by a semantic level. On the other hand, it is equally mediated by the interfaces whose ergonomical characteristics neutralize or reinforce the primitive computational complexity, that is to say, by a pragmatic level. These three levels are not open to the same types of measurementnotably metricsand right now it seems difficult to imagine a linear model coming out to the combination of their effects. It is better to process them as distinct levels, open to interventions at specific moments of the design cycle of a systemeven if, in reality, they appear inseparable. Studies centered on cognitive complexity thus mark a considerable evolution compared to the approach of studying mental workload. Modpage_60 Page 61 els were diversified, the relativity of a measure was recognized, methodological approaches were refined, and the idea of distributed control of tasks appeared as a dominant constraint. But we cannot really speak of a paradigm change up until now. The main reason is, in our view, that both users and human factors specialists insist on placing the emphasis on the possible prediction of complexityits evaluation, its measurement, and its control all throughout the design cycle. This was the key idea in research on mental workload; it persists today in studies on cognitive complexity and imprints a certain type of exploration methodologyeven if the methods are diversified and refined. This is supported by the analysis of human errors in recent aviation accidents that demonstrate the difficulties that pilots experience when interacting with automated flight deck systems and trying to track, understand, and manage the system. A total paradigm change would be to abandon any ideas of prediction of complexity, to let technology go to its most extreme limits, to opt for models of auto-organization of complex systems, and to do technical work on the possibilities of management of and recovery from errors. Without neglecting the importance of such an outcomethere will always remain, whatever means of prediction are realized, residual human errors to recoverleaving an exclusive place for it would be heavy with consequences on both the social and economic level. Acknowledgments This research could be carried out thanks to the Interuniversity Poles of Attraction ProgrammeBelgian State, Prime Minister's OfficeFederal Office for Scientific, Technical and Cultural Affairs, and to a contract agreement with SFACT/DGAC (Direction Générale de l'Aviation Civile) in France, within the frame of a study group on human factors. References Amalberti, R. (1996). La conduite des systèmes à risques [The management of risky environments]. Paris: Presses Universitaires de France. Bellorini, A., & Decortis, F. (1994). Régulation collective des activités basée sur une connaissance mutuelle de la charge de travail [Collective regulation of activities based on mutual workload awareness]. In B. Pavard (Ed.), Activités coopératives: De l'analyse à la modélisation (pp. 253 270). Octaris: Toulouse. Brehmer, B. (1990). Towards a taxonomy for microworlds. In J. Rasmussen, B. Brehmer, M. de Montmollin, & J. Leplat (Eds.), Taxonomy for analysis of work domains. Proceeding of the 1st MOHAWC workshop (Vol. 3, pp. 1 21). Roskilde, Denmark: Risø National Laboratory. Card, S. K., Moran, T. P., & Newell, A. (1983). The psychology of human-computer interaction. Hillsdale, NJ: Lawrence Erlbaum Associates. page_61

Page 62 Comber, T., & Maltby, J. R. (1996). Investigating layout complexity. In J. Vanderdonckt (Ed.), Proceedings of the 3rd International Eurographics Workshop on Design, Specification, and Verification of Interactive Systems (DSV-IS'96) (pp. 209 227). Namur, Belgium: Facultés Universitaires Notre-Dame de la Paix (FUNDP). Degani, A., & Kirlik, A. (1995, October). Modes in human-automation interaction: Initial observations about a modeling approach. In Proceedings of the IEEE International Conference on Systems, Man, and Cybernetics (SMC) (pp. 3443 3450). Vancouver, British Columbia: IEEE. Degani, A., Mitchell, C., & Chappell, A. (1995, April). Task models to guide analysis: Use of the Operator Function Model to represent mode transitions. In R. S. Jensen & L. A. Rakovan (Eds.), Proceedings of the Eighth International Symposium on Aviation Psychology (pp. 210 215). Columbus: OH. De Keyser, V. (1988). De la contingence à la complexité: L'évolution des idées dans l'étude des processus continus [From contingency to complexity: Evolution of ideas in the study of continuous processes]. Le Travail Humain, 51(1), 1 18. Faverge, J. M. (1965). Méthodes statistiques en psychologie appliquée [Statistical methods in applied psychology]. (Tome III). Paris: Presses Universitaires de France. Følleso, K., Kaarstad, M., & Drøivoldsmo, A. (1995, August). Relations between task complexity, diagnostic strategies and performance in diagnosing process disturbances. Paper presented at the 5th European Conference on Cognitive Science Approaches to Process Control, Hanasaari, Espoo, Finland. French, R. M. (1995). The subtlety of sameness. Cambridge, MA: MIT Press. Hart, S. G., & Staveland, L. E. (1988). Development of a multi-dimensional workload rating scale: Results of empirical and theoretical research. In P. A. Hancock & N. Meshkati (Eds.), Human mental workload (pp. 139 183). Amsterdam, The Netherlands: Elsevier. Hoc, J. M. (1993). Some dimensions of cognitive typology of process-control situations. Ergonomics, 36(11), 1445 1455. Hutchins, E., & Klausen, T. (1991). Distributed cognition in an airline cockpit (Internal Report). La Jolla: University of California, Department of Cognitive Science. Irving, S., Polson, P., & Irving, J. E. (1994). A GOMS analysis of the advanced automated cockpit. In Proceedings of CHI'94 (pp. 344 350). Boston: Association for Computing Machinery. Javaux, D. (1996). La formalisation des tâches temporelle [Formalization of temporal tasks]. In J. M. Cellier, V. De Keyser, & C. Valot (Eds.), Gestion du temps dans les environments dynamiques (pp. 122 158). Paris: Presses Universitaires de France. John, B. E., & Kieras, D. E. (1994). The GOMS family of analysis techniques: Tools for design and evaluation (Report No. CMU-CS-94181). Carnegie-Mellon University, School of Computer Science, Pittsburgh, PA. Kieras, D. E., & Meyer, D. E. (1995). An overview of the EPIC architecture for cognition and performance with application to human computer interaction (EPIC Report No. 5, TR 95/ONR-EPIC-5). Ann Arbor: University of Michigan. Kieras, D. E., & Polson, P. G. (1985). An approach to formal analysis of user complexity. International Journal of Man-Machine Studies, 22, 365 394. Miller, G. A. (1956). The magical number seven plus or minus two: Some limits on our capacity for processing information. Psychological Review, 63, 81 97. Monnier, A. (1993). Rapport de la Commission d'enquête administrative sur l'accident du Mont Saint Odile du 20 Janvier 1992 [Report from the administrative inquiry commission on the Mont Sainte Odile crash]. Paris: Ministère de l' Equipement, des Transports et du Tourisme. Norman, D. A. (1988). The design of everyday things. New York: Doubleday Currency. Pisanich, G., & Corker, K. (1995). Predictive model of flight crew performance in automated air trafic control and flight management operations. In R. S. Jensen & L. A. Rakovan page_62 Page 63 (Eds.), Proceedings of the Eighth International Symposium on Aviation Psychology (pp. 335 340). Columbus: Ohio State University. Reason, J. (1990). Human error. Cambridge, England: Cambridge University Press. Reid, G. B., & Nygren, T. E. (1988). The subjective workload assessment technique: A scaling procedure for measuring mental workload. In P. A Hancock & N. Meshkati (Eds.), Human mental workload (pp. 185 218). New York: North Holland. Sarter, N. B., & Woods, D. D. (1992). Pilot interaction with cockpit automation. I. Operational experiences with the flight management system. International Journal of Aviation Psychology, 2, 303 321. Sarter, N. B., & Woods, D. D. (1994). Pilot interaction with cockpit automation: II. An experimental study of pilot's mental model and awareness of the flight management system (FMS). International Journal of Aviation Psychology, 4(1), 1 28. Sarter, N. B., & Woods, D. D. (1995). Strong, silent, and ''out-of-the-loop." CSEL Report No. 95-TR-01. The Ohio State University. Shannon, R., & Weaver, W. (1949). The mathematical theory of communications. Urbana: University of Illinois Press.

Sougné, J. (1996). A connectionist model of reflective reasoning using temporal properties of node firing. In G. W. Cottrel (Ed.), Proceedings of the Eighteenth Annual Conference of the Cognitive Science Society (pp. 666 671). Mahwah, NJ: Lawrence Erlbaum Associates. Sperandio, J. C. (1972). Charge de travail et régulation des processus opératoires [Workload and regulation of operative processes]. Le Travail Humain, 35, 85 98. Sternberg, R. J., & Wagner, R. K. (1994). Mind in context. Cambridge, England: Cambridge University Press. Tullis, T. S. (1988). Screen design. In M. Helander (Ed.), Handbook of human-computer interaction (pp. 377 411). Amsterdam: Elsevier. Van Daele, A. (1993). La réduction de la complexité par les opérateurs dans le contrôle de processus continus [Reduction of complexity by operators continuous processes control]. Unpublished doctoral thesis, Université de Liège, Belgium. Yufik, Y. M., & Sheridan, T. B. (1993). A framework for measuring cognitive complexity of the human-machine interface. In M. J. Smith & G. Salvendy (Eds.), In Proceedings of the HCI'93 (pp. 587 592). Amsterdam: Elsevier. Woods, D. D. (1988). Coping with complexity: The human behavior in complex systems. In L. P. Goodstein, H. B. Andersen, & S. E. Olsen (Eds.), Mental models, tasks and errors (pp. 128 148). London: Taylor & Francis. page_63 Page 65

Chapter 3 Modeling the Orderliness of Human Action Erik Hollnagel University of Linköping, Sweden Psychology has for more than 50 years tried to develop theories and models that could be used to explain the characteristics of human performance in specific situations. Examples range from the classical studies of problem solving (Duncker, 1945; Maier, 1930) via descriptions of cognitive development in children (Piaget, 1952) to humans at work with complex processes (Hoc, Cacciabue, & Hollnagel, 1995). Throughout this effort there has been a need for metaphors, analogies, models, and theories that could be used to describe the "mechanisms" of the mind and explain performance. Before the 1950s several attempts to apply mathematical constructs were made, for instance field theory as used by Kurt Lewin and lattice theory as used by Jean Piaget, but neither of these were completely successful. Mathematics could provide a strong formalism for describing relations between conceptual entities, but offered only a weak analogy for the structure of mind. Conversely, the existing technologies could provide strong analogies, but only weak formalisms; examples are the switchboard model or Freud's hydraulic model. The solutionsomething that provided both a strong formalism and a strong analogycame from general systems theory, and the notion that human behavior is controlled by an inner, mental or cognitive model and was first effectively proposed by Craik (1943). This was enthusiastically seized upon when the computer analogy became popular among behavioral scientists with the effect that the view of the humanor rather the human mindas an information-processing system has become almost inseparable from cognitive psychology as it is currently practiced. page_65 Page 66 Through the second half of the 20th century, the view of the human mind as an information-processing mechanism became accepted to the extent that it constituted the foundation for most theories and models. The phenomena that have been investigated and explained in this way were initially rather specific psychological functions, such as selective attention (Broadbent, 1958; Moray, 1970) and memory (Norman, 1976; Sperling, 1960), but quickly grew to encompass more higher level phenomenathat is, phenomena that take place on a longer time scalesuch as problem solving (Newell & Simon, 1961), decision making (Rouse, 1983), and even mental models themselves (Johnson-Laird, 1983; Newell, 1990). The need for proper models and theories of cognition became apparent as technological systems continued to grow in complexity, thereby increasing the demands on human adaptation and ingenuity. The expertise of applied psychologists or human factors specialists was called upon to help in the design of work environments in general and human-machine interaction systems in particular. In the beginning, the information-processing approach looked like the needed solution, but during the late 1980s it was gradually realized that it included some basic and serious shortcomings. Flowchart Models It must be a fundamental assumption for the study of cognition at work that human behavior is orderly, in the sense that it can be described as if it were guided or directed by somethingwhether this is called a goal, a purpose, or an intention. Behavioras far as anyone can tellis essentially purposive. There are several ways in which this fundamental trait can be accounted for, and the information-processing approach is strangely enough not the most appropriate. Control theory and cybernetics can, for instance, provide much more powerful ways of describing the orderliness of human performance (Buckley, 1968; for an interesting alternative see also Allport, 1954). Any psychological model or theory that endeavors to describe or explain human performance must necessarily be able to account for the orderliness of human action. In this respect the main weakness of the information-processing approach is the reliance on the notion of the stored program or the procedure, which in cognitive psychology and cognitive science has taken the form of the flowchart description of cognitive functions. Few modeling attempts have been able to avoid this way of accounting for the organization of behavior, either implicitly or explicitly. The virtues of the flowchart description were strongly argued by G. A. Miller, Galanter, and Pribram (1960), and the approach is, indeed, very powerful, not only for human action but for any kind of system functions. In cognitive psychology it has led to the ubiquipage_66

Page 67 tous representation of cognitive functions as a set of "elementary" steps or stages connected in various ways that represent the typical flow of action. (This notion of segmentation of cognitive or mental functions can actually be traced back at least as far as Donders, 1862.) as an example consider the typical representation of decision making shown in Fig. 3.1. Models of human action, such as the one in Fig. 3.1, that accord with the view of the mind as an information-processing system will certainly be orderlyand to a considerable extent even be predictable. Unfortunately, the kind of orderliness that is expressed by these models comes from their structure rather than their function and therefore does not correspond to the orderliness that is observed in practice. The predictability of a procedure is based on a description of the function in isolation or, at most, as reactions to external events. Humans are, however, proactive as well as reactive and never exist in isolation. This is easily demonstrated by considering the notion of diagnostic strategies. It is not difficult in the psychological literature to find a number of diagnostic strategies with evocative names such as topographic, symptomatic, hypothesis driven, data driven, and so on. However, these are idealized descriptions of what performance could be like and rarely correspond to what performance is like (e.g., Jones, Boreham, & Moulton, 1995). The correspondence occurs only if the performance conditions are sufficiently restrained, as for example, in an experimental or controlled setting. The experience from observing performance at work is that rather than adhering to a single strategy, humans tend to combine strategies or switch between them in ways that are difficult to predict from the modelsalthough these can usually always explain performance post hoc. The fact nevertheless remains that performance is orderly in the sense that it usually achieves the goal efficiently and also in the sense that there are characteristic patterns that occur frequently.

Fig. 3.1. A typical information-processing model. page_67 Page 68 Orderliness Is Exogenous! These facts, the orderliness or regularity of human actions combined with the inability of information-processing models to predict this orderliness beyond the level of the procedure, could lead to the suspicion that performance, perhaps, is not controlled by a hypothetical information-processing mechanism but by something else. This view has been well argued by the so-called ant analogy introduced by Simon (1972). According to this, if a person describes an ant moving around its path, the description will come out as a sequence of irregular, angular segments. Although there may be an overall sense of direction, the movements on a smaller scale appear to be random. Simon made the point that the apparent complexity of the ant's behavior over time for the most part was a reflection of the complexity of the environment, and that this also was the case for humans: "A man, viewed as a behaving system, is quite simple. The apparent complexity of his behavior over time is largely a reflection of the complexity of the environment in which he finds himself" (p. 25). Although this analogy has been widely recognized and often is referred to, it has mostly been given lip service. (This may perhaps be because there is an inherent contradiction between this view and the strong version of human information processing that Simon also promoted and for which he probably is better known. The latter is clearly expressed by the assumption that the human, as a behaving system, is quite simple.) Thus the majority of models of cognition concentrate on explaining in detail the steps of information processing, and consider the environment only in terms of input and output. It should, however, be obvious that the orderliness of human action cannot be accounted for if the determining influence of the environment or context is reduced to an input vector and if behavior is seen only as reactive. Unfortunately, information-processing models leave little room for intention or purpose, except as the built-in direction or organization of the prototypical performance steps. These models are also quite incapable of describing the context in anywhere near adequate terms. There thus seems to be a discrepancy between the needs arising from practical applications and the tools and concepts provided by the scientific study of the human mind. It is this discrepancy that I address here. Orderliness and Control The precondition for purposeful or orderly behavior in a task is knowing what the goal or objective is and being able to assess how much remains to be done before the goal is reached. Together this can be used to determine which further actions should be taken. In other words, the person page_68

Page 69 seeks to control the situation, in the sense of ensuring that the actions taken will achieve the goal. It is this that accounts for the orderliness of human action, and the focus must therefore be on how this control can be described. In practical terms we should be interested in finding out how we can make it easier for people to achieve control of their work situations. In theoretical terms we should be interested in how we can model, hence explain, control and the orderliness of actions. As an everyday example, which many people have experienced, consider the situation when you are on the way to the airport to catch a plane. If things have been planned so that there is time to spare, you will feel in control even though trains or busesto say nothing of the traffic in generalactually are beyond the control of the individual. We know, however, that there is a certain regularity and reliability in the transportation systems that effectively puts us, as users, in control. We can foresee the consequences of the actions we have planned, and also that they will achieve the goal. Compare that with the situation when something goes wrong, for example, a breakdown or a delay caused by some unforeseen event. In these situations the outcome is no longer certain, and we may consequently feel out of control. The situation is exactly the same for people in work situations, such as the pilot in the cockpit. If he or she has planned the actions correctly and if the systems function as expected, then the pilot is in control. If, however, a system fails or if it behaves in a way that is not fully understoodsuch as an advanced FMS (flight management system) is wont to dothen control is to some degree lost. As a consequence of that, actions may become less orderly, hence less effective. It is a common conclusion from these simple examples that it is impossible ever to be in control if one cannot assume that certain functions or services will be reliable, that is, unless the environment has an acceptable level of predictability. Conversely, control over systems that have a low degree of predictability, such as a national economy, rush hour traffic, or processes with clumsy automation, will inevitably be difficult. Control and Cognition A model can be defined as a schematic description of a system, theory, or phenomenon that accounts for its known or inferred properties and that may be used for further study of its characteristics. A model may in particular be used in design as the basis for predicting the effect of specific design features or, conversely, as a basis for identifying those design features that will bring about a specific desired effect. When the design is about systems where people and technology must interact to achieve a specific goal, the models must address the salient features of the joint syspage_69 Page 70 tem in a way that achieves the goals of the design. Modeling in joint systems must therefore focus on how control is maintained or reestablished, both for the human and for the system as a whole. Preferably, this should be achieved by a common set of concepts, in accordance with the principles of cognitive systems engineering (Hollnagel & Woods, 1983). This chapter, however, focuses on how the modeling of cognition in the human can be achieved by means of the notion of control. The essence of control is the ability to predict, and to predict correctly, which is tantamount to having a correct understanding or model of the situation. Being able to anticipate the consequences of actions requires a set of constructs, that is, expressions or representations of what the system knows or believes about the world, where these constructs are used in selecting appropriate actions. A system that can achieve that will be in control of the situation. Conversely, a system that cannot do that will have lost control. On the operational level, loss of control means precisely that the predicted events do not match the actual events, in other words that the consequences of actions are unexpected or surprising. In some systems, such as a national lottery, this is precisely the purpose, but in most other systems it is not a desirable characteristic. (Even in a national lottery, people like to have the illusion that they are in control by selecting numbers that they believe will maximize the probability of winning.) Inner Worlds and Outer Worlds The traditional approach to description and analysis of human performance makes a strong distinction between two entities (Fig. 3.2). One is an "inner" world or a "cognitive mechanism." This is the brain or the mind, commonly described as an information-processing system. The other is the "outer'' world, that is, the environment or the context. In the traditional view the two are linked by the exchange of input and output described, for example, as information vectors or as events and actionsnot as stimuli and responses. The general conception here is that the inner world is different from the outer world, almost as a form of representational dualism. Furthermore, the emphasis in psychology has been on describing the inner world, whereas the outer world has been reduced to the input-output parameters. This corresponds to a perfect mechanistic or deterministic description of psychology. As noted in Fig. 3.2, the classical models describe humans as information-processing systems that are decoupled from the context and affected by it only via input and output. The adherence to the sequential information-processing model, or the physicalistic approach, has created a number of problems that have been difficult to solve. Chief among these is how to account for the influence of performance-shaping factors, how to page_70

Page 71

Fig. 3.2. Inner and outer worlds. describe the selection of and switch between strategies, how decisions are made, how and why performance levels may change, and so forth (Hollnagel, 1983). The inability to solve these problems is not due to a lack of trying, but is rather because the problems turn out to be artifacts of the underlying theory. Any attempt to model cognition must begin by acknowledging that cognition is always embedded in a context or a situation. Thus, cognition is always "cognition in the wild" (T. E. Miller & Woods, 1996). This includes demands and resources, physical working environment, tasks, goals, organization, social environment, and so on. A model of cognition must therefore account for how cognition depends on the context rather than on the input in a narrow sense. What we perceive depends on what we expect to see and that is determined by the context, as described by the "perceptual cycle" (Neisser, 1976). The modeling of cognition must therefore abandon the notion of input information as "objects" that exist independently of the situation and the behaving system. The Sequentiality of Cognition Descriptions of human performance must necessarily refer to what has happened. Records of human performance typically describe a sequence of actions and events, but the orderliness of this sequence is illusory. It is a simple matter of fact that any description or recording that is organized in relation to time must be well ordered and sequential, simply because time is directed and one-dimensional. Human behavior appears sequential when viewed in retrospect, but this orderliness is an artifact of the asymmetry of time. This is illustrated in a rather primitive way by Figs. 3.3 and 3.4 that show how the "same" development looks in the "future" and in the "past," respectively. Figure 3.3 shows some of the possible sequences of cognitive page_71 Page 72

Fig. 3.3. Performance in the "future." functions that could occur in the immediate future. (In Fig. 3.3 the set of cognitive functions has been limited to observation, identification, planning, and action, that is, the cognitive functions in the simple model of cognition; cf. Hollnagel & Cacciabue, 1991.) Initially the person makes an observation, for example, notices a change in the system. That will in terms of the model lead to another cognitive function, but it is impossible in advance to determine which. The only exception is cases where there is complete knowledge of the state of the system and where the system is completely deterministic (state based) as for example a Turing machine. In practice it is usually impossible to predict which cognitive functions will be invoked. In contrast, Fig. 3.4 shows the sequence after it has occurred. From this perspective the cognitive functions did occur in an orderly way, appropriate to achieve the desired goal. Although this specific sequence was impossible to predict before it happened, it is easy afterwards to ascribe a rational process to explain the specific sequence of events. The example shows, however, that it is a mistake to assume that an orderly underlying process

Fig. 3.4. Performance in the "past." page_72 Page 73 or "mental mechanism" alone produced the observed sequence of actions. In practice, people usually prepare themselves for the most likely development of events, whether they are planning to fly a mission over enemy territory (Amalberti & Deblon, 1992) or are going for an important meeting with their boss. Yet the actual sequence of actions is the result of a coupling between the internal and external processesbetween the person's control of the situation and the conditions that existed at the time. If the sequential ordering of performance is recognized to be an artifact of time, then it is no longer necessary that models or explanations of cognition contain specific prototypical sequences. In other words, models of cognition do not have to account for cognitive processes as a set of steps or stages that are executed one by one. In particular, the seemingly disorder or complexity of actionsjumps, disruptions, reversals, capturesdoes not need to be explained as deviations from an underlying sequence or from the well-ordered flow of cognition that is an unavoidable consequence of human information-processing models. Modeling Approaches The information-processing approach is a structural approach in the sense that it uses the (assumed) elements or structures of the human information-processing system as the basic building blocks for models and theories. Thus elements such as short-term memory, long-term memory (knowledge base), attention capacity, and so on, are common primary components. Structural approaches have always been attractive because they provide a seemingly objective frame of reference that allows us to describe the interaction as reciprocal information processinginformation processing in humans as a reflection of information processing in the machine. The disadvantage is that structural theories refer to an information-processing mechanism in isolation, that is, to the hypothetically pure information processes of the brain, which are set in motion by events in the external world. Cognition is seen as a kind of higher level information processing that occurs entirely within the human mind, and the holy grail of cognitive science is to unravel the mechanisms of pure cognition. In technological domains information processing can well exist as a pure process, for instance, the function of an adder or a pattern-matching algorithm. But it does not make sense to speak of basic human information processes in the same manner. The fact that the information-processing metaphor is useful to understand some fundamental features of human thinking does not mean that the mind is an information processor. In the late 1980s many people began to realize that cognition actually occurs in a context, as illustrated by the notion of situated cognition. This page_73 Page 74 view, however, implicitly maintains a distinction between cognition and context by describing them as two separate entities. The full consequence of acknowledging the context is that it becomes meaningless to describe cognition separately from the context because the inner world and the outer world are the same. From the perspective of cognitive systems engineering (Hollnagel & Woods, 1983), it is self-evident that there is no cognition without a context. There can be no being, without being in a context or in a situation. Even in pure conditions, such as can be created in laboratory experiments or found in moments of quiet introspection, there is still a context because a person exists in a world. The view of pure or context-independent cognition is therefore a category mistake, and the "discovery" of situated cognition is accordingly superfluous. Functional approaches, on the other hand, aim to describe the regularities of performance rather than the workings of an inner informationprocessing mechanism. Functional approaches are driven by phenomena, specifically the observed regularities of human performance, rather than by hypothetical conceptual constructs. In a functional approach actions do not occur just as responses to events, but also in anticipation of events. This means that functional theories are intrinsically linked to the context, because the phenomena (the regularities of human behavior) by definition exist only in a given context. Functional approaches therefore avoid the problems that stem from the notion of pure mental processes, and in particular do not make the mistake of assuming that cognition is an epiphenomenon of information processing. Thus, whereas a structural approach makes it necessary to account for the context separately from the processes of the mind, the functional approach makes this problem disappear. The advantages of that should be obvious. Minimization of Models

Although models are necessary to study and understand the nature of human action, they should not be used wantonly. If the investigation of human action starts with the model, the perspective and possibilities may be limited. Relying on models as a basis for research may lead to failures of communication (misunderstandings of terminology), incorrect selection of information, and inefficient research strategies (experimental design). Most experiments and reports conclude either by confirming the model and the hypotheses that go with it, or by pinpointing the circumstances and conditions that prevented that. Too few lead to a rejection of the model, or even consider what role it may have played. The advice to avoid the risk of exaggerated use of models is far from new. Craik (1943) discussed the general dangers of being guided by a theory rather than by empirical data. Although he took his examples from page_74 Page 75 philosophy, the cautions also apply to cognitive psychology, particularly the concern that the perception of reality may be as narrow as the theory behind it. In a discussion of the information-processing model, Neisser (1976) warned against psychology committing itself too thoroughly and argued for a more realistic turn in the study of cognition. This led to the following four "requirements" to cognitive psychology: First, a greater effort should be made to understand cognition out of the laboratory, that is, in the ordinary environment and as part of natural purposeful activity. Second, more attention should be paid to the details of the real world and the fine-grain structure of the information that is available. Third, psychology should come to terms with the complexity of cognitive skills that people are able to acquire and the way in which they develop. Finally, the implications of cognitive psychology for more fundamental questions of human nature should be examined, rather than being left to "behaviorists and psychoanalysts." Neisser (1976) was reflecting on the then burgeoning discipline of experimental cognitive psychology, which had so enthusiastically embraced the information-processing approach. Even at that time the preponderance of mental models was obvious and Neisser sternly warned that: "We may have been lavishing too much effort on hypothetical models of the mind and not enough on analyzing the environment that the mind has been shaped to meet" (p. 8). As we all know, this warning was not taken seriously. If anything, the attraction of mental models grew during the 1980s, spreading from cognitive psychology into many other disciplines (cf. Hollnagel, 1988). An echo of Neisser's warnings about the dangers in an unreflecting use of modeling is found in an extensive discussion by Donald Broadbent (1980) of what he termed "the minimization of models." After looking at the ways in which models were being applied in research, Broadbent made the plea that "models should as far as possible come at the end of research and not at the beginning" (p. 113) or, failing that, that one should at least start from extremely simple models. The alternative to start from a model would be to start from practical problems and concentrate on the dominant phenomena that were revealed in this way, corresponding to Neisser's notion of natural purposeful activity. Models would still play a role to help choose between alternative methods of investigation and to support the interpretation of data; but models should in all cases be minimized to avoid choices becoming driven by the model rather than by practical problems. Broadbent further made the point that: page_75 Page 76 One should [not] start with a model of man and then investigate those areas in which the model predicts particular results. I believe one should start from practical problems, which at any one time will point us towards some part of human life. (p. 117) The focus should be on problems that are representative of human performance, that is, that constitute the core of the observed variety. The implication is that the regularity of the environment gives rise to a set of representative ways of functioning, and that these should be investigated rather than performances that emerge from attempts to confirm theoretical predictions in controlled experimental conditions. If this advice is followed, the resulting models will be minimized in the sense that they focus or concentrate on essential phenomena. One problem that is representative of human performance is that of control. Human performance is deliberate or intentional; that is, it is controlled. This can also be expressed by saying that human performance is adaptive, in the sense that it is continuously adjusted to the conditions. Another representative problem of human performance is learning, that is, the way in which experiences are used to improve performance in the long term. Closely related to that is the ability to generalize. Yet another is the trade-off between automated (nonattended) and attended actions that ensure that human performance as a whole is efficient or optimized in the use of the available mental resources. Although these problems are not independent, this chapter concentrates on giving an account of the problem of control. Procedural Prototypes In terms of models of cognition, a distinction can be made between procedural prototype models, which emphasize the sequential nature of cognition, and contextual control models, which view cognition as being determined by the context. A procedural prototype model of cognition is a normative description of how a given task should be carried out; it implies that one sequence of actions represents a more natural way of doing things than other sequences, or that a certain sequence or ordering is to be preferred. A contextual control model, on the other hand, implies that actions are determined by the context rather than by an inherent sequential relation between actions. This view acknowledges that the choice of the next action at any given point in time is determined by the nature of the situation and therefore does not prescribe certain sequences as being more proper or likely than others. A contextual control model rather concentrates on how the control or the choice of next action takes place. The difference can be illustrated by considering a common form of the procedural prototype model, for example, as shown in Fig. 3.1, which is a page_76

Page 77 variation of the common model of decision making. The view of decision making implied by this model is clearly idealistic; even if decision making ought to take place as a series of steps, it rarely does so in practice. To account for that the models usually require the introduction of a number of embellishments (bypasses or short cuts), which allow alternative paths to be taken. The procedural prototype model thus contains a basic sequence of functions that is carried out in turns, that is, one time after another. Changes in the environment are described as changes in the input to the model, but do not directly have any effect on how the steps are ordered. The bypasses are variations of the prototypical sequence; a variation may skip one or more steps but the underlying step-by-step progression is immutable. Although this kind of modeling is appealing on a conceptual level, it does present some practical problems. This becomes clear when more elaborate versions with a large number of bypasses are considered, because these bring the problem of control to the fore. In the simple version, control is an integral part of the model: When a step has been completed, the person goes on to the next, until the overall objectives have been achieved. In the embellished version the control issue is more complex and basically unsolved. If we want to account for realistic patterns of performance where a person may interrupt the task, leave it unfinished, or imbed one task in another, the control problem becomes worse still. The straightforward solution of assuming that the control is carried out as a higher level repetition of the same procedure only aggravates the problem, as shown by, for example, Lind (1991). The procedural prototype model describes the task as if the person attempted a rational progress through the various phases. But because this rarely is the case the model only poorly matches the variety of human action. Other solutions must therefore be found. Competence, Control, and Constructs The alternative is to view human performance as determined, largely, by the situation. People can do many things and achieve their objectives in many different ways. The selection among the possible actions is not determined by normative characteristics of the action elements (as components), but by the current needs and constraintsthat is, by the demand characteristics of the situation. Due to the regularity of the environment there may be frequently recurring patterns or configurations of actions, but these must not be confused with the procedural prototypes. The challenge of cognitive systems engineering is to provide a reasonable account of how this regularity can occur without making too many assumppage_77 Page 78 tions about human cognition or about the capabilities of an internal information-processing system. The contextual control approach to the modeling of cognition has three main components: competence, control, and constructs. The competence represents the set of capabilities for actions that the person can bring to bear on a situation according to the current needs and demands. The extent of this set of possible actions mainly depends on the level of detail or the granularity of the analysis, and is potentially not denumerable. The possible actions provide a set to choose from; consequently, the person cannot do something that either is not available as a possible action or cannot be constructed or aggregated from the available possible actions. Possible actions may exist on different levels of aggregation, that is, a mixture of simple and composite actions. Common to them is only that they are ready to use in the context. Control can be described in a number of ways. An important issue is the granularity of the description and the mode of functioning. Here the law of requisite variety can be of assistance: The modeling of cognition must refer to a pragmatic definition of the variety (or variability) that needs to be modeled (Ashby, 1956). The nature and range of this variabilitybut not its originwill provide guidance for how control is accomplished and for how much the model of control should be able to do. From the practical point of view, it is sufficient to match only the requisite variety. Constructs, finally, refer to what the person knows or assumes about the situation in which the action takes place. In informationprocessing psychology, constructs have normally been referred to as knowledge representation, frames, (mental) models, and so on. The term constructs is used to emphasize that they are artificial, in the sense of being constructions or reconstructions of salient aspects of the situation, and also that they may be temporary. Constructs may thus be correct or incorrect and may change from situation to situationor, indeed, within a situation. Constructs are similar to the schemata of Neisser (1976) in that they serve as the basis for selecting actions and interpreting information. Competence Competence describes what we are able to do and includes various functions ranging from elementary actions to composite types of behavior like decision making, problem solving, planning, and the like. A person's competence must first of all include the various capabilities for action that a person has. These need not be elementary actions, such as one would find at the bottom of an action hierarchy, but rather the actions that the person is capable of carrying out. A given action may be a single action for a skilled person but a series or complex of multiple actions for an unskilled person. page_78

Page 79 The definition of what constitutes a single or a complex action in the model thus depends on the situation and on the person's background and experience. This part of the competence could be called the activity set. A person's competence must also include a set of recurrent patterns or specific relations between two or more actions that in a given situation can determine the order in which they are carried out. Such groupings or templates are necessary for human action to be efficient (cf. earlier discussion); if every action were the result of an explicit choice or decision, very little would be accomplished in practice. At most we would, as a child who has just learned to walk, be able to do only one thing at a time. Templates may be plans, procedures, guidelines, heuristics, strong associations, or anything else that can serve as a guide for performance. This part of the competence could be called the template set. The separation of the template set from the action set serves several purposes. First of all the notion of templates makes it easier to account for how a person can be involved in several lines of actions at the same time, and how a new goal can be established. It also becomes possible to describe how rigid performance can come about (as strict compliance to a template), how mistakes are made (strong associations between actions that may override a plan or procedure), how random performance can be modeled (by unsystematic choice among plans or even choice among actions without consideration of plans), and how dominant phenomena can be modeled (leading to frequent error modes). The separation provides a way of modeling very diverse phenomena with a few and simple principles. Control Control describes how we do things and how actions are carried out. The essential part of the control is planning what to do in the short term, within the person's time horizon (e.g., Amalberti & Deblon, 1992). This planning is influenced by the context, by knowledge or experience of dependencies between actions, and by expectations about how the situation is going to developin particular about which resources are and will be available to the person. The outcome prescribes a certain sequence of the possible actions; but as argued previously the sequence is constructed rather than predefined. In this view frequent patterns or characteristic distributions of actions reflect a relative constancy (regularity) of the environment as well as the constituent features of human cognition rather than the constraints of the performance model. Control can obviously occur on several levels or in several modes. Although the levels of control that a personor a joint systemcan have over a situation can vary continuously, it is useful to make a distinction between the following four characteristic control modes: page_79 Page 80 In the scrambled control mode, the choice of next action is basically irrational or random. The person is in a state where there is little, if any, reflection or cognition involved but rather a blind trial-and-error type of performance. This is typically the case when people act in panic, when cognition is paralyzed and there accordingly is little or no correspondence between the situation and the actions. The scrambled control mode includes the extreme situation of zero control. The performance is unpredictable from the person's point of view; although it, paradoxically, may be relatively easy to predict from an observer's point of view. In the opportunistic control mode, the next action is determined by the salient features of the current context. There is only little planning or anticipation, perhaps because the context is not clearly understood or because the situation is chaotic. Opportunistic control is a heuristic that is applied when the constructs (knowledge) are inadequate, either due to inexperience, lack of knowledge, or an unusual state of the environment. The resulting choice of actions may not be very efficient and many useless attempts may be made. In this type of situation people will often be driven either by the perceptually dominant features of the interface or by those that due to experience or habit are the most frequently used, for example, similarity-matching or frequency-gambling heuristics (Reason, 1990). The tactical control mode is characteristic of situations where performance more or less follows a known procedure or rule. The person's time horizon goes beyond the dominant needs of the present, but planning is of limited scope or limited range and the needs taken into account may sometimes be ad hoc. If a plan is frequently used, performance may seem as if it were based on a procedural prototypecorresponding to, for example, rule-based behavior (Rasmussen, 1986). Yet the underlying basis is completely different. Finally, in the strategic control mode, the person uses a wider time horizon and looks ahead at higher level goals; the choice of action is therefore less influenced by the dominant features of the situation or the interface. Strategic control provides a more efficient and robust performance than the other modes. The attainment of strategic control is influenced by the knowledge and skills of the person, and although all competence (the basic capabilities) can be assumed to be available, the degree of accessibility may greatly vary between persons, hence be a determiner of their performance. At the strategic level the functional dependencies between task steps and the interaction between multiple goals will also be taken into account in planning. The scrambled control mode is clearly the least attractive, whereas the strategic is the most attractiveseen in relation to efficacy and reliability page_80

Page 81 of performance. In practice, people will usually be working in what corresponds to an opportunistic or tactical control mode. Most cases of controlled flight into ground do, for instance, correspond to the pilots being in an opportunistic mode. Although the strategic control mode is the optimal one, it is not often achieved. Consider, for instance, all the situations when you afterwards, that is, in hindsight, realize what you should have done or said. Whenever this occurs, it is a good indication that you acted in a tactical or opportunistic way. On the other hand, preparing for the contingencies that may arise is a way of guarding against having to function in an opportunistic mode. Constructs Constructs are the mental representations of what a person may know or assume about the situation in which the action takes place. As mentioned earlier, constructs are often temporary, although the time scale may vary considerably. Constructs can deliberately be temporary, such as where the car is parked, the weather forecast for the destination at the time of arrival, or the value of a measurement 5 minutes ago. In such cases the constructs are only placeholders for information, and it would in fact be detrimental to performance if they were permanent. In other cases constructs are of a longer duration, such as the operating instructions for a machine, knowledge about how a specific device works, and the way to the office. Some constructs are in the nature of hypotheses, some are in the nature of beliefs, and some represent general or ''universal" knowledge. However, for the purpose of modeling of cognition constructs need not be permanent or true in an absolute sense. Furthermore, constructs as well as competence can change as a consequence of learning. In the explanation of action and modeling of cognition, constructs are what the person can refer to and use (thus equivalent to the person's knowledge about something). If the person does not have (or cannot remember) a construct about something, action will not be possible except in a random fashion based on guesses, that is, shallow ad hoc constructs. This corresponds to performance in the scrambled or opportunistic modes of control. Constructs are intrinsically linked with competence, the difference being that competence always includes the ability to do something. (From a formalistic point of view, competence may easily be seen as a special form of constructs.) Knowing the characteristics of a hydraulic or electronic system may be a construct, but the ability to make use of, diagnose, or maintain the system is a competence. Knowing what happens when the page_81 Page 82 system is in use is a construct, although that construct is also part of the goal (goals-state) of the competence. Interaction between Competence, Control, and Constructs All models or descriptions of human performance contain some distinction between the various ways in which a plan or an action can be carried out, corresponding to different levels of performancesuch as skill based and knowledge based. Because this is an essential characteristic of human action, it would seem sensible to make a clear separation between control and competence in the models. This provides a way of working with the principles that govern behavior rather than with specific exemplars or prototypes of performance. A good model should not prescribe a sequence of actions but describe how sequences are planned and how specific actions are chosen. Even though this may fall short of being a scientific model that explains the phenomenon in question, it may still serve the needs for modeling according to the law of requisite variety. There is clearly a strong coupling between the different modes of control, the level of competence, and the nature and contents of the constructs. Here concepts such as feedback-driven and feedforward-driven performance are important. Information-processing models typically focus on feedback-driven performance, although any student of human performance knows that it is open loop as well as closed loop. The characteristics of open-loop performance require that models of cognition include something that is functionally equivalent to knowledge or constructs. The level of control is a function of what happens, which in turn is a function of what the person expects to happen. Yet what a person expects to happen is, in terms of modeling of cognition, determined mainly by the constructs and the competence. If, for instance, a flight develops as expected with no untoward events, then it is reasonable to expect that the pilot will remain in full control. But if something goes wrong, either in the airplane, the flight plan, or on the ground, a pilot can maintain control only if the requisite knowledge and competence are available. In the current approach to modeling, the four modes of control can be seen as representative points in the control space without claiming that they are absolute categories. It is important that the model of cognition is able to replicate the dynamic selection of actions, the various modes in which this can take place, and the influence of internal and external information such as the operator's current interpretation of the state, previous actions, time and resource constraints, competence, constructs, and external factors (communication). page_82 Page 83 Issues in Contextual Control Models In order to be more than a loosely formulated set of principles, it is necessary that contextual control models are expressed in terms that make them useful in practice, for instance as a basis for simulations, for analyses, and so on. First and foremost it is necessary to provide a descriptionand preferably a set of operational principlesthat can account for how control depends on the context, and that accordingly can describe how performance is shaped by the events. There are in particular two aspects of the contextual control model that must be accounted for: (a) how the transition between control modes takes place, and (b) the characteristics of performance in a given control mode

The very fact that the model describes a continuum of control, summarized in terms of the four control modes, requires that changes in control can be explained. This actually entails two slightly different questions. The first is to explain the loss of control, and the second is to explain the regaining or maintenance of control. Both correspond to well-established empirical facts. It is easy to find instances when a person loses control of the situation, typically when something unexpected occurs (e.g., Sarter & Woods, 1995; Wiener, 1989). Each instance can be corroborated by our personal experience. The same goes for the regaining or maintenance of control, which is very important in high-risk, high-impact systems. This aspect has been captured by one of the most famous simplifications of human performance characteristics, the so-called time reliability correlation or TRC (Hall, Fragola, & Wreathall, 1982). The TRC simply states that the probability of not responding to an event, or in some cases the probability of responding incorrectly, decreases as a function of time. In other words, if more time has elapsed, then it is more likely that the person will respondand respond correctly. This can easily be seen as a case of regaining control. (The TRC is, of course, of little comfort for situations where time is at a premium.) The main complication is that for identical circumstances one person may lose control whereas another may maintain control. Or that the same person may behave differently at different times! This calls for a closer study of the personal and interpersonal (situation) parameters that determine the type of response. The well-established field of cockpit resource management (Caro, 1988) is a good example of that. The second important aspect of the model is to account for the characteristics of performance in a control mode. It is a natural fact that the quality of performance depends on the degree of control the person has over the situation. In terms of the model, a person who is in an opportunistic control mode behaves differently from a person who is in a tactipage_83 Page 84 cal control mode, and the latter is assumed to do better. The model must, however, provide a description of the specific characteristics of performance at a given level of control. This description should not only correspond to the general experience and potential specific empirical data, but should also serve as a blueprint for implementation, for example, as a software model. Part of that description must be an account of the interaction between competence and control. It is common sense that higher competence makes it more likely that control is maintainedand, if lost, regainedbut this should also be expressed in terms of the model's parameters. COCOM Parameters The description of the proposed contextual control model (COCOM) is given in terms of the basic model parameters and model characteristics. This is done without using any of the traditional assumptions about the nature of human information processing. In general, the parameters of a model are important for how easy it is to use and how accurately it can describe the target phenomenon. Structural models have naturally depended on the parameters of the underlying constructs, such as short-term memory span and decay rate, attention span, depth of knowledge, and so on. In a functional model, such as COCOM, the parameters reflect the main characteristics of human performance and the model is proposed to use as few and as simple parameters as possible. In order to describe the control of performance, the current version of COCOM requires three parameters (number of goals, subjective available time, and the current control mode) and two "functions" (choice of next action and evaluation of outcome). The two other main components of the model, competence and constructs, are here only referred to on a general level, although some of the requirements to their description can be derived from the characteristics of how the control component is assumed to function. Number of Goals One notion that occurs directly or indirectly in all models of cognition is that of mental load and specifically mental overload, when the demands exceed capacity. This is referred to in many different ways, such as task demands, (mental) workload, task load, information (over) load, attention demands, stress, and so forth. It is sometimes expressed as an external parameter (task load) and sometimes as an internal parameter (mental workload). In COCOM the parameter is referred to as the number of goals that the person can attend to at the given time. It is thus an internal or subjective parameter; the corresponding objective parameter is the page_84 Page 85 number of tasks that the person must attend to, as derived, for example, from a goals-means task analysis. One of the classical studies of the effects of demand-capacity mismatches is the article information-processing overload by J. G. Miller (1960). The notion of information input overload was formulated in the late 1950s when experimental psychology was rapidly embracing the concepts of mathematical information theory and the view of the human as an information-processing system. In a survey of the then available literature, Miller proposed a small set of typical ways of reacting to information input overload, that is, to the situations where a person had to deal with more information than he or she could handle. Referring to a number of examples from different system levels (the cell, the organ, the individual, the group, and the social institution) as well as a number of experiments, the article listed the following seven typical reactions, shown in Table 3.1. These seven types of reaction can easily be expressed in terms of losing control of the situationalthough not necessarily in the order proposed by J. G. Miller. Filtering and cutting categories, for instance, mean that the person is resorting to an opportunistic type of control, where the choice of action may be inadequate due to the reduced scope of situation assessment. Escape, of course, corresponds to scrambled control, where the only objective is to get out of the situation regardless of the cost. The reactions express a trade-off between demand and resources (capacity) that is one of the essential phenomena that cognitive psychology should study. The problem can be expressed as the person's strategy for maintaining an appropriate construct of the situation or maintaining situation awarenessin a sense ensuring an acceptable correspondence between the construct and the current working conditions. It might also be described as the ways of coping with the complexity of the world, by reducing the complexity in various ways to match the available needs and capacity, to maintain a homeostasis with the world. The very notion of

TABLE 3.1 Typical Reactions to Information Overload Typical Reaction

Explanation/Description

Omission

The temporary nonprocessing of information

Reduced precision

Trading off precision for speed and time

Queuing

Delayed response during high load, in the hope of a later pause or lull

Filtering

Neglecting to process certain categories of information

Cutting categories

Reducing the level of discrimination

Decentralization

Distributing the processing (work) if possible

Escape

Abandoning the task altogether

Note. Data from J. G. Miller (1960). page_85 Page 86 these reactions implies a coupling between the person's competence, constructs, and actions: The person tries to retain essential information, in order to cope with or control the situation. The definition of essential information is clearly relative to what the person intends to do, hence to the number of goals. An increase in the number of goals may lead to information overload, because it will both increase the information needed to be considered and reduce the resources available to do it. The likely consequence is a loss of control, and the coupling between the number of goals and control mode is therefore an important one. There is a rather tight coupling between the information that is potentially available, the information that the person looks for, and the way in which this information is used. One proposal for how this coupling may take place is Neisser's (1976) notion of the perceptual cycle. Subjectively Available Time The second parameter of COCOM is the subjectively available time. There is little need to argue for the importance of this parameter. All that we do, and in particular the ways we plan the things we intend to do, depend on the estimated available time (Decortis & Cacciabue, 1988). In COCOM the time clearly has to be subjective time rather than objective time, in order to allow for the consequences of incorrect time estimates (either optimistic or pessimistic). The relation to control modes is also straightforward. In cases where we feel that there is sufficient time available, we can afford to look ahead, to plan and consider detailed consequences of the actions we contemplate. This is typical of the strategic control mode. In cases where we feel that there is insufficient time available, the choice of action is likely to be less elaborate and to be based on approximate or incomplete situation assessment, corresponding to an opportunistic control mode, with the tactical control mode occupying an intermediate position. Choice of Next Action In addition to the two parameters, COCOM also contains two main functions. The first of these is the choice of next action. It is a fundamental requirement to a contextual control model that it can explain how actions are chosen. This does not imply that every action is the result of a deliberate choice. If that were the case, the smoothness and efficiency of human performance would be impossible. But performance is controlled by deliberate choices of what to do, where this may easily cover a procedure, that is, a collection of actions that are performed in a (semi)autonomous fashion as a skill. page_86 Page 87 The details of how the choice of next action is described in COCOM are given later. At this point it is sufficient to note that the choice of action makes use of the competence to a varying degree, corresponding to the control mode. The competence thus describes what the person is capable of doing in an abstract, absolute sense. The fact that only some of the competence may be used on a particular occasion is explained by the characteristics of the control modes, rather than in terms of limited competence per se. (Although this may seem a moot question, the distinction has important theoretical consequences.) The choice of next action also depends on the constructs, which represent the current assumptions (situation awareness) about the situation. The constructs are used to determine whether the alternatives being considered are appropriate or satisfying. Evaluation of Outcome Equally important to the choice of the next action is the way in which the outcome of previous actions is determined. This is, of course, the function or process of feedback. The choice of an action or a procedure has some consequences for the evaluation of the outcome. The choice of action carries with it a set of expectations about what the outcome of the action(s) will be and therefore also a set of criteria for whether or not the outcome is satisfactory. This means that the evaluation of the outcome depends on the expectations, hence also on the control mode. If, for instance, there is little time and the control mode is tactical or opportunistic, the evaluation will focus on the primary, immediate effects. If, on the other hand, the person is in a tactical or strategic mode of control, the evaluation of the outcome may be more elaborate and consider protracted effects and side effects. The importance of action outcome should be obvious. If an action fails, the consequences may be reduced time to reach the goal, increased task load (e.g., diagnosing the reason for failure, repeating the action) which means an increased number of goals, loss of orientation, lack of relevant knowledge due to the unexpected outcome, and so on. If an action succeeds, the opposite consequence may result.

There is potentially a significant difference between the evaluation of outcome for expected events (feedback) and unexpected events. Examples of the latter are alarms, communication, interruptions, faults, and the like. In principle, whenever something happens the person first has to decide whether it was something that was expected or whether it was unexpected. (An alarm can, of course, also be expected, if it is a consequence of a control action or part of a familiar situation.) In some cases even this decision may be incorrect, corresponding to false recognition or mistakes in interpretation (Sorkin & Woods, 1985). In terms of COCOM the level of descrippage_87 Page 88 tion focuses on how the accuracy of the evaluation of outcome depends on the control mode, rather than on the more philosophical question of how one can correctlyor falselyrecognize an event. Whereas action feedback is evaluated according to the control mode, unexpected events may be one of the main determinants of a transition in control mode. Thus, the occurrence of an alarm may completely change the situation, either in a negative or in a positive fashion. It may increase the number of goals, and in that respect have consequences in terms of a degradation of control. The new alarm may, however, also effectively become the only goal, hence lead to better focused performance. The understanding of whether one or the other will happen is clearly an important issue. Control Mode The final parameter of COCOM is the control mode. This is, however, a parameter in a different sense because it does not easily correspond to an objective characteristic of the situation. In fact, the control mode is a hypothetical intervening variable, which (at present) is necessary to describe how the model works. To say that the control mode has changed is a short way of saying that the characteristics of performance have changed. These are not explained by the control mode, but it acts as a useful conceptual device to simplify the otherwise lengthy explanations. Functional Relations in COCOM The overall configuration of COCOM is shown in Fig. 3.5. Although the diagram is composed of "boxes and arrows," the purpose is not to depict the structure of COCOM, but rather to show the functional relations between the various components of the model. The difference between the gray and the black arrows is that the former indicate a direct effect of one model parameter or function on another, whereas the latter indicate an indirect or potential effect. For example, the choice of next action leads to the next action, but also effects the way in which the evaluation of the outcome will be made. That, however, becomes effective only when the next event occurs; if the next event is delayed or does not manifest itself, the potential change in the evaluation of the outcome will not be realized. In order to appreciate the contents of the model, the two main functionschoice of next action and evaluation of outcomeare described in additional detail. Choice of Next Action In order to make COCOM as simple as possible, the choice of next action follows the same principle in all control modes. The difference in the result, that is, the quality or appropriateness page_88 Page 89

Fig. 3.5. Functional relations in COCOM. of the chosen action, is because the competence and constructs are used to different degrees; that is, the depth of search or matching depends on the control mode.

According to the general principle for choice of next action, the first step is to screen for apparent or superficial action characteristics that correspond to the goal. This is followed by checking that the primary or immediate effects of the action do match the current goals, that the preconditions for the action are fulfilled, and finally that the side effects are not inconsistent with the goal or with the goals of the following actions. At the same time the person may possibly consider other current goals, either with the purpose of selecting the one that is most relevant at the moment, or in order to assess dependencies between goals and actions. This principle is proposed as a possible functionor microcodeof the model that will enable a different outcome depending on the control mode. The way in which this can be achieved is shown in Fig. 3.6. As seen in Fig. 3.6, the difference between the control modes is the "depth" or the scope of the selection function: In the scrambled control mode, the choice of next action is determined by the need to achieve the single, dominant goal of the situation. Any action that seems likely to succeed, either because it in some way looks promising or simply because others do it, will be tried. The selection is "shallow" because only the first step is performed, and the resulting action may therefore not be very efficient in achieving the goal. There is page_89 Page 90

Fig. 3.6. COCOM principle for choice of next action. no deliberate search for an appropriate action and no planning; anything that seems likely is tried, even if it has failed a moment ago. In the scrambled control mode, subjectively available time will always be inadequate. In the opportunistic control mode, the choice of next action also includes a simple check of whether the primary effects are the desired ones. In many cases there will, however, only be a superficial check of whether the action is actually possible under the circumstances, for example, whether the preconditions are met. In this control mode the person may pursue more than one goal at a time, but does not consider two goals together. Furthermore, there is no systematic overall pattern for when one action or another is chosen. A change of goals may happen because the result of the previous action was disappointing, leading to a kind of failure-driven focus gambling. There is little anticipation and planning, and the choice can seem to be driven almost by association; that is, something is tried if it looks good. The choice is nevertheless more deliberate than for the scrambled control mode. In the opportunistic control mode, subjectively available time will be short or just adequate. In the tactical control mode, the choice is extended to include both the preconditions and the interactions with other goals. In this mode, if the preconditions are not met, a new goal may be established in order to obtain the preconditions. This would not happen in the opportunistic control mode. The choice makes extensive use of known plans and procedures. The person both looks ahead into the future, and takes the results of previous actions into accountsubject, of course, to the normal biases of hindsight (Fischhoff, 1975). In the tactical control mode, subjectively available time will be adequate. Finally, in the strategic control mode, the planning and prior evaluation of the possible outcomes is extended to include present and also page_90 Page 91 future conflicts between goals, for example, how side effects may influence conditions for the following actions. Plans and procedures are used extensively, either as they have been defined in advance or as they are generated and adapted to the situation. Past experience is also important, including experiences from similar situations. In many ways, the playing of a chess grandmaster is a typical example of performance in a strategic control mode. In the strategic control mode, subjectively available time will always be adequate or even abundant. Evaluation of Outcome The evaluation of outcome also takes place according to the same principle regardless of the control mode. The difference in the result, that is, whether the evaluation led to a success rather than a failure, is due to the degree of elaboration of the evaluation depending on the control mode. In line with the principle for choice of next action, the first step of general principle for evaluation of outcome is to check whether the outcome appears to be a success or a failure, that is, whether the goal for the action has been achieved. This is followed by distinguishing between whether the outcome actually corresponded to the expected feedback from a previous action or whether it must be classified as a new event. In the former case it is checked whether outcome matches the goal(s) of the action. At first this looks at the immediate outcome of the action, but it may be extended to look also at the protracted or delayed effects. The latter clearly requires that the person can either just wait for the required time, or remember that this needs to be done while doing something else. Finally, the evaluation may also consider possible secondary effects and long-term consequences. The overall principle is illustrated in Fig. 3.7.

As shown by Fig. 3.7, the difference between the control modes is the depth or the level of elaboration of the evaluation: In the scrambled control mode, the evaluation is as simple as possible; the goal is to get away from the situation and the simple, and only, criterion is that the goal appears to have been achieved. This may help to bring the person out of the scrambled control mode, so that the quality of actions will improve. As an example, if the engine of your car has stalled in the middle of town, the simple goal is to get it running again. If that succeeds, then it is possible to relax and think of what to do next. If it fails, it may be difficult not to become more hectic. The criterion for success is, of course, situation dependent, but in the scrambled control mode the perspective is limited to a single item. If the situation is interrupted by a new event, this will typically become the new top (and only) goal. In the scrambled control mode, the person can consider only one goal at a time, and it is not necessarily a task-relevant one. page_91 Page 92

Fig. 3.7. COCOM principle for evaluation of outcome. In the opportunistic control mode, the evaluation is taken a step further, first by asserting that the outcome corresponded to an expected one and second by checking that it was the right outcome. Because the opportunistic control mode only looks for the primary effects when the action is chosen, the evaluation remains on the same level. Moreover, complicating factors such as delays and not directly perceivable effects are not taken into account. The sought for effect is a ''here and now" one. In the case of a new event, the response depends on whether it is perceived as immediately relevant, for instance, using reduced precision or cutting categories (cf. Table 3.1). If so it will typically replace a nonactive goal if there are more than one, or become a second goal if there was only one before. Otherwise it will simply go unnoticed. In the tactical control mode, the evaluation is more elaborate and the person will take into account possibly complicating factors, such as protracted or delayed effects and indirect indications of the outcome. The interaction with other goals may have been considered in the choice of the action, and the evaluation may therefore use direct evidence as well as inferences. In the tactical control mode, a new event will be evaluated before possibly replacing a goal in the goal list. It will not automatically lead to an increase in the number of goals, because the capacity is limited. If it replaces an already existing goal, the latter may possibly be remembered later, but this depends on many different factors. It is a common experience that an activity that has been interrupted will be incorrectly resumed and/or completed. In the strategic control mode, both the short-term and long-term effects of actions are considered. An outcome is therefore considered to be a success only if it does not jeopardize other goals, at least within the time horizon of the situation. In the case of a new event, it will be evaluated before being inserted at the appropriate place in the goal list. In this case page_92 Page 93 the goal list may actually increase, and the person can use various techniques to keep track of the goals, for example, by combining or grouping them. Of course, the number of goals may become so large that adequate performance cannot be sustained, and this will then correspond to a transition to a tactical mode of control. Summary As a summary of the preceding, the main characteristics of the four control modes with regard to the COCOM parameters and functions are shown in Table 3.2. The details of the relations have been described in the text. In accordance with the principles of minimal modeling, COCOM has been made as simple as possible. Although it is not assumed that the human mind actually functions in the way described here, it is proposed that a model built according to these principles will be able to reproduce some of the fundamental characteristics of human performance, in particular the orderliness of human action and how this depends on the context. A contextual control model, such as COCOM, can be applied for many different purposes. Two of the most important ones are joint system simulations and the analysis and prediction of human performance. A joint system simulation is a dynamic or nonmonotonic analysis that makes use of two simulators coupled together: a simulation of the technical system (the process) and a simulation of the operator or operators controlling the process. A joint system simulation can be used to trace the development of the interaction between the two systems, given the initial conditions and the system characteristics. The specific applications are as a part of system design and evaluation, for example, for issues such as function allocation (Sasou, Yoshimura, Takano, Iwai, & Fujimoto, 1993), interface (Corker & Smith, 1993), or procedures (Izquierdo-Rocha & Sánchez-Perea, 1994). The technique can, in particular, be used to determine whether the joint system can accomplish its functions, whether an initiating event will lead to an incident, and how the Man-Machine System (MMS) will react to an initiating event, hence what the response potential is.

TABLE 3.2 Main Characteristics of the Control Modes Number of goals Subjectively available time

Scrambled

Opportunistic

Tactical

Strategic

One

One or two (competing)

Several (limited)

Several

Inadequate

Just adequate

Adequate

Adequate

Choice of next action

Random

Association based

Plan based

Prediction based

Evaluation of outcome

Rudimentary

Concrete

Normal

Elaborate

page_93 Page 94 In the general technique of joint system simulation, the operator models are poorly developed compared to the process models (Hollnagel & Cacciabue, 1992). This is mainly due to the fact that operator models have focused on the details of human information processing rather than the interaction with the work environment. In order to develop practical solutions to meet the growing interest for joint system simulations, it is therefore necessary to advance the state of the art of operator modeling, and the use of contextual control models promises to be an important part of that development. The analysis and prediction of human performance, in particular of human erroneous actions, have traditionally been pursued as two separate endeavors. Performance analysis has focused on the study of the ubiquitous "human error" and the emphasis has been to provide explanations in terms of human information-processing characteristics (Reason, 1990). Performance prediction, exemplified by the discipline of human reliability analysis (HRA), has been based on a discrete representation of accident sequences using event trees, where each step of the event tree may be analyzed in further detail to provide the required quantitative estimates. These techniques have relied on very simple human factors models of performance, often based on the phenomenological distinction between "errors of omission" and "errors of commission." The lack of a common model to support performance analysis as well as performance prediction has made it difficult to use the experience from either discipline to advance the other. In HRA several attempts have been made to use information-processing models as the foundation for performance prediction (e.g., Hannaman & Worledge, 1988), but none has been entirely successful. In the study of human error, the simplified human factors models of HRA have usually been ignored. This state of affairs is, however, unproductive in the long run, particularly as both disciplines have realized the need to enlarge the view of human action to include the context in which the actions take place (Bainbridge, 1993). There is therefore scope for a type of model that can be used both to improve the theoretical understanding and practical analysis of erroneous actions as well as the qualitative-quantitative prediction of performance characteristics. Contextual control models offer the prospect of a common ground (Cojazzi, Pedrali, & Cacciabue, 1993; Hollnagel, 1998). Conclusion People are willy-nilly forced to use technology and work together with machines, and that creates a necessity for modeling the orderliness of human action. As scientists we are faced with a need to account for how people interpret the states of the system and how they decide to act: in page_94 Page 95 short, what constitutes the fundamentals of regulation or control. According to cybernetics and the law of requisite variety, a controller of a system must be a model of the system that is controlled (Conant & Ashby, 1970). The system to be controlled must be orderly and predictable, perhaps not completely but to a significant degree. The system that controls must reflect that orderliness; in particular, it must be able to predict the other future states of the target system. Otherwise the controlling system will not be able to make the right choices. In the endeavor of joint cognitive systems, we have fairly good descriptions or models of how the technology works. This is so both because technology is the result of an intentional design, and because technology is designed to be deterministic. In practice, the limitations of the human mind preclude other solutions. It would be senseless to design a system to be random because this would defeat the purpose of the design. The rare exceptions are cases where randomness is a functional requirement, such as in the case of a national lottery. Yet even here randomness has a very small and well-defined role. When it comes to humans, we do not in general have good descriptions or models to work with. Currently available models of cognition are in particular unable to account adequately for anticipatory performance. Information-processing models, such as GEMS (Reason, 1990) or the model shown in Fig. 3.1, are limited by the fact that they really have only one state; that is, they are "flat." They always model functions in exactly the same way, and the only difference is the path taken through the various steps or stages. The models cannot function in ways that are qualitatively different, because the execution of a function (e.g., decision, observation) is state independent. In contrast, COCOM introduces the notion of state-dependent functions; that is, the depth of processing basically depends on the state of the model, which in turn depends on the situation as it has developed through previous actions. This makes the model more flexible than the standard information-processing models. The advantage of COCOM lies in proposing a few principles that can be used with different temporal and spatial resolutions. In other words, it is not necessary to have different models for, for example, skills and problem solving. It is assumed in COCOM that the competence underlying actions are the same, corresponding to the potential competence of the person. The differences in performance come about because the competence is used to a different degree. Thus, the level of resolution differs depending on the situation. This is a powerful but very general approach that helps to make the model simpler. The guiding principle for interaction design should be to sustain the prevailing mode of action while at the same time gently prompt the user toward a more orderly type of performance. This can be achieved if it is page_95

Page 96 possible to detect or identify the current mode of control; assuming this to be the case, one can design a closely coupled system that will amplify operator cognition and thereby gradually achieve better performance. This differs from the notion of forcing the operator to work on a specific, model-defined level of behavior (e.g., Vicente & Rasmussen, 1992), and rather underlines the importance of providing the right or proper context. The right context is one where the significant goals of the system are easy to see, and where the facilities and possibilities to pursue these goals are provided. This includes finding the means to solve them, resolve them into subgoals, evaluate the consequences, plan on a long range, and so on, without assuming a priori that a specific performance mode is to be preferred or even enforced. References Allport, F. H. (1954). The structuring of events: Outline of a general theory with applications to psychology. Psychological Review, 61(5), 281 303. Amalberti, R., & Deblon, F. (1992). Cognitive modeling of fighter aircraft process control: A step towards an intelligent onboard assistance system. International Journal of Man-Machine Studies, 36, 639 671. Ashby, W. R. (1956). An introduction to cybernetics. London: Methuen. Bainbridge, L. (1993). Building up behavioural complexity from a cognitive processing element. London: University College, Department of Psychology. Broadbent, D. E. (1958). Perception and communication. London: Pergamon. Broadbent, D. E. (1980). The minimization of models. In A. J. Chapman & D. M. Jones (Eds.), Models of man (pp. 113 128). Leicester: The British Psychological Society. Buckley, W. (1968). Modern systems research for the behavioral scientist. Chicago: Aldine. Caro, P. W. (1988). Flight training and simulation. In E. L. Wiener & D. C. Nagel (Eds.), Human factors in aviation (pp. 229 262). San Diego: Academic Press. Cojazzi, G., Pedrali, M., & Cacciabue, P. C. (1993). Human performance study: Paradigms of human behaviour and error taxonomies (ISEI/IE/2443/93). JRC. Ispra, Italy: Institute for Systems Engineering and Informatics. Conant, R. C., & Ashby, W. R. (1970). Every good regulator of a system must be a model of that system. International Journal of Systems Science, 1(2), 89 97. Corker, K. M., & Smith, B. R. (1993, October). An architecture and model for cognitive engineering simulation analysis: Application to advanced aviation automation. Paper presented at the AIAA Computing in Aerospace 9 Conference, San Diego. Craik, K. (1943). The nature of explanation. Cambridge, England: Cambridge University Press. Decortis, F., & Cacciabue, P. C. (1988, June). Temporal dimensions in cognitive models. Paper presented at the 4th IEEE Conference on Human Factors and Power Plants, Monterey, CA. Donders, F. C. (1862). Die Schnelligkeit psychishcer Processe [On the speed of mental processes]. Archives of Anatomy and Physiology, pp. 657 681. Duncker, K. (1945). On problem solving. Psychological Monographs, 58(5, Whole No. 270). Fischhoff, B. (1975). Hindsight. Hindsight = foresight: The effect of outcome knowledge on judgment under uncertainty. Journal of Experimental Psychology: Human Perception and Performance, 1, 288 299. page_96 Page 97 Hall, R. E., Fragola, J., & Wreathall, J. (1982). Post event human decision errors: Operator action tree/time reliability correlation (NUREG/ CR-3010). Washington, DC: U.S. Nuclear Regulatory Commission. Hannaman, G. W., & Worledge, D. H. (1988). Some developments in human reliability analysis approaches and tools. In G. E. Apostolakis, P. Kafka, & G. Mancini (Eds.), Accident sequence modeling: Human actions, system response, intelligent decision support (pp. 235 256). London: Elsevier Applied Science. Hoc, J.-M., Cacciabue, P. C., & Hollnagel, E. (Eds.). (1995). Expertise and technology: Cognition and human-computer cooperation. Hillsdale, NJ: Lawrence Erlbaum Associates. Hollnagel, E. (1983). What we do not know about man-machine systems. International Journal of Man-Machine Studies, 18, 135 143. Hollnagel, E. (1988). Mental models and model mentality. In L. P. Goodstein, H. B. Andersen, & S. E. Olsen (Eds.), Task, errors and mental models (pp. 261 268). London: Taylor & Francis. Hollnagel, E. (1998). CREAMCognitive reliability and error analysis method. London: Elsevier. Hollnagel, E., & Cacciabue, P. C. (1991, September). Cognitive modelling in system simulation. Paper presented at the Third European Conference on Cognitive Science Approaches to Process Control, Cardiff, Wales.

Hollnagel, E., & Cacciabue, P. C. (1992, June). Reliability assessment of interactive systems with the system response analyser. Paper presented at the European Safety and Reliability Conference '92, Copenhagen, Denmark. Hollnagel, E., & Woods, D. D. (1983). Cognitive systems engineering: New wine in new bottles. International Journal of Man-Machine Studies, 18, 583 600. Izguierdo-Rocha, J. M., & Sánchez-Perea, M. (1994). Application of the integrated safety methodology to the emergency procedures of a SGTR of a PWR. Reliability Engineering and Systems Safety, 45, 159 173. Johnson-Laird, P. N. (1983). Mental models: Towards a cognitive science of language, inference, and consciousness. Cambridge, England: Cambridge University Press. Jones, L., Boreham, N., & Moulton, C. (1995). Social aspects of decision-making in a hospital emergency department: Implications for introducing a computer information tool. In L. Norros (Ed.), 5th European Conference on Cognitive Science Approaches to Process Control (VTT Symposium 158) (pp. 196 212). Espoo: Technical Research Centre of Finland. Lind, M. (1991, September). On the modelling of diagnostic tasks. Paper presented at the 3rd European Conference on Cognitive Science Approaches to Process Control, Cardiff, Wales. Maier, N. R. F. (1930). Reasoning in humans: I. On direction. Journal of Comparative Psychology, 10, 115 143. Miller, G. A., Galanter, E., & Pribram, K. H. (1960). Plans and the structure of behavior. New York: Holt, Rinehart & Winston. Miller, J. G. (1960). Information input overload and psychopathology. American Journal of Psychiatry, 116, 695 704. Miller, T. E., & Woods, D. D. (1996). Key issues for naturalistic decision making researchers in systems design. In C. Zambok & G. Klein (Eds.), Naturalistic decision making (pp. XX XX). Mahwah, NJ: Lawrence Erlbaum Associates. Moray, N. (1970). Attention: Selective processes in vision and hearing. New York: Academic Press. Neisser, U. (1976). Cognition and reality. San Francisco: Freeman. Newell, A. (1990). Unified theory of cognition. Cambridge, MA: Harvard University Press. Newell, A., & Simon, H. A. (1961). GPSA program that simulates human problem-solving. In Proceedings of a Conference on Learning Automata (pp. XX XX). Norman, D. A. (1976). Memory and attention (2nd ed.). New York: Wiley. Piaget, J. (1952). The origins of intelligence in children. New York: International Universities Press. page_97 Page 98 Rasmussen, J. (1986). Information processing and human-machine interaction: An approach to cognitive engineering. New York: NorthHolland. Reason, J. T. (1990). Human error. Cambridge, England: Cambridge University Press. Rouse, W. B. (1983). Models of human problem solving: Detection, diagnosis, and compensation for system failures. Automatica, 19, 613 625. Sarter, N., & Woods, D. D. (1995). "How in the world did we ever get into that mode?" Mode awareness and supervisory control. Human Factors, 37, 5 19. Sasou, K., Yoshimura, S., Takano, K., Iwai, S., & Fujimoto, J. (1993). Conceptual design of simulation model for team behaviour. In E. Hollnagel & M. Lind (Eds.), Designing for simplicity. Proceedings of 4th European Conference on Cognitive Science Approaches to Process Control (pp. 109 122). Simon, H. A. (1972). The sciences of the artificial. Cambridge, MA: MIT Press. Sorkin, R. D., & Woods, D. D. (1985). Systems with human monitors: A signal detection analysis. Human-Computer Interaction, 1, 49 75. Sperling, G. A. (1960). The information available in brief visual presentation. Psychological Monographs, 74 (No. 498). Vicente, K. J., & Rasmussen, J. (1992). Ecological interface design: Theoretical foundations. IEEE Transactions on Systems, Man, and Cybernetics, SMC-22, 589 596. Wiener, E. L. (1989). Human factors of advanced technology ("glass cockpit") transport aircraft (BASA CR-177528). Moffet Field, CA: NASA Ames Research Center. page_98

Page 99

Chapter 4 Cognitive Aspects and Automation Marcel Leroux CENA, Toulouse Cedex, France Automation or Cognitive Tools? The European air traffic control (ATC) system has entered a deep crisis: It is unable to meet a tremendous increase in demand. This is not only the consequence of its inertia; such inertia is normal for any complex system. Short-term measures to optimize the present tools appear to be insufficient: These tools have already reached the limits of their development capability. A wide-ranging discussion on how to enhance ATC methods and tools has begun. Very ambitious goals have been set for future systems: For example, the French CAUTRAV project plans to double the capacity of the system by the year 2005 and to significantly increase safety. Numerous ambitious projects exist but none of them has yet proved its efficiency or even its feasibility. ATC automation is short of effective solutions. Obviously, major technology improvements (FMS, Data Link, 4D-Navigation, computational power) must be intensively used. But full automation cannot be a solution, at least for the next two or three decades. Human controllers must remain in the decision-making loop. As automation cannot replace human operators, it must assist them. This is one of the paradoxes of automation: Until full automation is proven to be feasible and efficient, that is, as long as controllers need to make decisions, even occasionally, it is essential to preserve the controller's skills. Whatever page_99 Page 100 tools may be designed, human controllers must exercise their skills continuously. Human operators provide flexibility, the capability to deal with unexpected situations, creativity, and safety thanks to their ability to compensate for the failures and inadequacies of machines. To preserve these capabilities, we may have to automate "less" than is possible from a purely technological point of view. But the human operators are also a potential source of error. For years system designers thought that the more human operators could be put on the fringe, the more the risk of error would decrease. The underlying assumption was twofold: The technological advances will be sufficient to significantly improve the performance of the joint human-machine system. Human operators are flexible enough to adapt to the new working environment, which is in contradiction with the initial goal of expelling humans from the decision-making loop in order to exclude their potential for introducing errors. In fact, technology-driven automation adds another kind of difficulty to the supervision of the initial system: the difficulty of understanding the behavior of the automatic systems that partly monitor the system. Thus, it creates additional sources of errors, the consequences of which are much more serious than the previous ones. So it would seem that rather than eliminating human operators, which would deprive the joint system of major benefits and increase the risk of errors, it would be more sensible to design a system that was error tolerant. Such a system cannot be designed merely by making use of technical advances: We must automate in a different way than suggested by technology alone. Thus the word automation seems to be inappropriate; cognitive tools or computer assistance with cognitive tasks would appear to be more suitable. The problem that we have to consider is how to assist the controller in processing information: The controller's activity consists of real-time and cooperative data processing so as to "produce decisions" under risk pressure. Up to now, the objects presented on the interfaces (the paper flight progress strips and the radar display) correspond to the aircraft, whereas the controller mainly processes the interactions between aircraft. Can computers help the controller to perform this task? The aim is no longer to show the results of radar tracking, but to use these results as well as all the technological advances in order to present relations between aircraft in a more manageable way. In this chapter, the cognitive engineering approach is presented as an alternative to technology-driven approaches. page_100 Page 101 The Cognitive Engineering Approach The cognitive engineering approach is presented using the example of the en route air traffic organizer (ERATO). This project is aimed at specifying and designing decision aids for en route air traffic controllers, and results in a controller's electronic assistant. The new philosophy of human-machine cooperation central to its design is described. The Steps of the Project Eight steps can be identified in the process of designing cognitive tools. These steps are summarized in Fig. 4.1. Explicitation of the Cognitive Model Cognitive engineering has arisen from the expression of a need by numerous system designers: to understand what really makes the task difficult for the operators and how this difficulty impairs human performance, so they can define the most effective aids (see, e.g., De Montmollin & De Keyser, 1985; Hollnagel, 1988; Rasmussen, 1986).

We must not only elicit the knowledge of operators, but, first of all, we must understand how this knowledge is activated and utilized in the actual problem-solving environment. The central question is not to identify the domain knowledge possessed by the practitioner, but rather to point out under which conditions this knowledge is (or is no longer) accessible. This is the problem of defining a validity domain for human performance.

Fig. 4.1. Eight phases for the design of the electronic assistant. page_101 Page 102 Cognitive engineering must also identify and predict the sources of error and the mechanisms of error. When several agents can act on the system, under which conditions can they cooperate efficiently under time pressure? What are the mental resources that are involved? What is the cognitive cost of cooperation? It is necessary to point out in what ways the present tools are inadequate and how the operators compensate for the deficiencies of their tools. Therefore, it is necessary to examine how tools provided for an operator are really used by the operators. All these analyses are needed to produce a satisfactory cognitive model of the operator. Such a model is central to defining a global approach to the design of effective decision aids. This model identifies the mental mechanisms that are common to all controllers and that enable them to process data and to make real-time decisions. These mental processes are analyzed for the executive controller, the planning controller, and then for both controllers as a whole, to assess the consequences of cooperation on mental load as well as on global performance. The main goal remains to describe the mental mechanisms involved in the decision-making process, and how these mechanisms evolve and decay under time pressure. Four kinds of mental mechanisms, or use of mental resources, are described: Those that are involved in the management of the physical process (i.e., maintaining sufficient separation between aircraft). Those that are involved in cooperation between controllers working at the same control position. Those that are involved in interface management. Those that are involved in the management by the controller of his or her own cognitive resources. The cognitive model is the key element of this approach, from the very specification of the functions up to the evaluation of the joint humanmachine system in operational conditions. Its formulation is critical and several techniques have been used. But whatever the techniques, they must be ecological. The target must be the operator working in the multidimensional, open worlds that are his or her effective working context. The aim is to understand and describe the present-day mental activity of operators, given their present-day tools, and how these mental mechanisms decay under time pressure, fatigue, and stress. When we cannot help but experiment in laboratory conditions, the context must be as realistic as possible. page_102

Page 103 The first technique consisted in the observation of air traffic controllers in real working conditions, followed by interviews. A very creative technique consisted in combining both an artificial intelligence approach and a psychological approach, which enabled us to understand default reasoning and ambiguity elimination mechanisms. Bottleneck Assessment Decaying processes become bottlenecks in data processing and decision making. This step is a diagnosis phase: We have to point out the sources of poor and good performance of the air traffic controllers, given their actual working context. As long as the situation is not too demanding, controllers can compensate for these bottlenecks; but in very demanding situations these bottlenecks may severely impair the controllers' performance. The initial explicitation of the cognitive model and the assessment of bottlenecks ended in 1991 in laboratory experiments. These experiments enabled the design team to verify that the main characteristics of the models were common to 10 controllers, and to observe how these mental mechanisms evolve and decay under time pressure, fatigue, and stress. Functional Specifications of Decision Aids The assessment of bottlenecks makes it possible to specify the basic functions of effective decision aids. Prior to this specification is the definition of the working method in an electronic environment: What do controllers actually need to build an effective mental representation of traffic in a cooperative way and under time pressure? How should the system support decision-making processes? This strong interaction between the specification of the tools and the definition of the working method is critical throughout the iterative process of defining the joint human-machine system. This distinction enables the organizing of the problems associated with the specification of human-machine interaction into a hierarchy. The human-machine interaction must meet the following conditions, cited in order of their criticality: 1. Enable operators to exercise all the mental mechanisms that enable them to build the relevant mental representation of the system to be monitored. 2. Enable operators to cooperate in an efficient way. 3. Enable efficient inputs into the system. page_103 Page 104 These three points are all necessary, but too often the third is the tree that hides the forest, as its single purpose is to ease the first two. The assessment of bottlenecks in data processing and in real-time decision-making processes shows that, given a working context, human performance has a validity domain. The aim of future tools is to expand the limits of the validity domain of human resources. Thus, automation is no longer thought of as a means of progressively expelling human operators from the decision-making process, becoming instead a means of improving human performance, either by magnifying the efficiency of cognitive resources or by improving cognitive resource management. Interface Specification The functional specification of decision aids implies the specification of algorithms, expert systems, and interfaces. The specification of these different components must be done as a whole. Interfaces cannot be specified independently of the algorithms, or vice versa. And the whole set of components cannot be specified independently of the definition of the working method: It is necessary to know in which context each tool will be operated, so as to optimize its specification. Using the cognitive model, the interface must be specified as (a) an information display, (b) a support to mental processing, (c) a source of cues that may trigger mental processing, and (d) a support to various inputs. Definition of a Logical Representation of the Model Some tools may require knowledge-based components. We need to combine different laboratory logics, seminormal default logic, fuzzy logic, and temporal logic, to build a logical tool adapted to formalize the controller's knowledge. Encoding Expert Systems or Knowledge-Based Systems The design of function defined during the third step may involve the use of knowledge-based systems that model large subsets of a controller's knowledge. The Design of Cognitive Tools These knowledge-based systems provide the cognitive tools with relevant data, so we have to face the problem of the integration of knowledgebased systems within real-time software. This is one of the reasons that led up to the transformation of initial expert systems into purely algorithmic knowledge-based systems. Evaluation, Verification, and Validation of the Joint Human-Machine System

Of course, each of the previous steps includes a local verification and/or validation phase. The results concern any of the previous steps, up to the cognitive model. This approach is necessarily iterative. The cognitive model is the spine of the project that guarantees its convergence. page_104 Page 105 The Case of Air Traffic Control The Cognitive Model of the Controller and the Assessment of Bottlenecks in Decision-Making Mechanisms Decision-making mechanisms can be described under four headings: the mental mechanisms directly involved in the management of the physical process (in our example, in detecting and resolving conflict situations between aircraft), the mental mechanisms involved in cooperation between different practitioners (in most countries two controllers are in charge of a control sector), the mental mechanisms involved in interface management, and the mental mechanisms involved in controllers' own resource management. Mental Mechanisms Involved in the Management of the Physical Process The following is a rapid overview of the controller's cognitive model as it is used in ERATO. What Really Makes the Task Difficult Tasks and objectives are not well defined and evolve very fast. Their definition is a very important part of a controller's activity. Risk is so important that the controller has to guard against errors of all the actors (including her or himself, the other controllers, the pilots, and all the machines) in the system. Controllers have to process data that depend on the time factor for: Their value. Their availability. All the data necessary to make a clear assessment of the situation are not available at a given time; some of them may be completely unobtainable. Very often the controller must take decisions in a state of partial ignorance. Their accuracy. When observing air traffic controllers, we found that they spend a lot of time and a lot of cognitive resources in eliminating ambiguity. A major reason why controllers are often unable to make a clear assessment of a situation is due to their representation of predicted time intervals: Unless we sink into pure fatalism, we do not anticipate that an event will happen at a given time but at about a given time. The difference is fraught with consequences for the operator: Decisions are always made in a fuzzy and uncertain context. page_105 Page 106 Their flow. Controllers must adapt to sudden transitions between situations characterized by lack of data to those involving data overflow. Their mental and perceptive activities may be interrupted at any time by pilots' calls, telephone calls, and so on. For the time being, data presentation is technology driven and needlessly bulky. Making Decisions in a State of Partial Ignorance The controller anticipates according to a ''normal" or "routine" behavior of the aircraft, called the default behavior, with reference to the "default logic" that models this kind of reasoning. This default behavior is illustrated by controllers when they use sentences such as, "Normally this aircraft going to Paris Orly will start its descent about 30 NM [nautical miles] before this fix." The controller does not know the top of the descent, but from his experience, he knows that "this will normally happen about here." So he will ignore all potential conflicts that might happen if the given aircraft should start descending earlier to focus all his activity on the most probable conflicts. This is an efficient means of narrowing the range of contingencies to be examined and to increase efficiency: All the aircraft are first processed as if their behavior will always remain consonant with the normal behavior. But to process exceptions, that is to guarantee safety, controllers monitor sentry parameters. As long as these parameters remain in a normal range, all the previous diagnoses or decisions that are inferred from the default world remain valid. But if a sentry parameter drifts outside the expected range, then all the previous plausible inferences have to be revised: Some additional conflicts can be created due to this abnormal behavior. In normal situations, this way of reasoning is an efficient and safe means to make decisions in a state of partial ignorance. But we can observe that, in very demanding situations, the monitoring task may no longer be performed by the controllers. Thus, when outside its validity domain, that is, in too demanding situations, this default mechanism may become a major source of errors. Making Decisions in a Fuzzy and Uncertain Environment At first, diagnosis does not rely on the real world but on a mental representation of it. Even when remaining in the default world, the controller has to deal with a large set of data. Most of them are fuzzy, some must be actively acquired, and she must take into account the errors inherent in the system (including her ability to extrapolate). The controller is often unable to make a decisive assessment of the situation. Typically, ambiguity may arise when considering such questions as "Will the separation between these page_106

Page 107 two aircraft be sufficient?" or "What will the best maneuver to solve this problem be?". Allowing her or himself to doubt is a luxury for the controller. The mastery of doubt is an art. The controller faces the absolute need to eliminate ambiguity by pointing out and monitoring a few relevant parameters. To avoid a scattering of resources, these parameters will remain the only ones monitored. All other parameters are pushed into the background. For example, a basic heuristic approach in conflict resolution is: "When two aircraft are converging towards a fix, the best solution is to vector the aircraft which will be the second to fly over the fix." If at any time the controller is unable to decide which one will be the second on the fix, all her monitoring activity regarding this conflict will be centered on this point and she will ignore all other data concerning these aircraft. This diagnosis mechanism is a means of organizing data functionally. It consists in a problem-driven and time-dependent organization of the raw data set coupled with mental processes in order to refine strategies iteratively by monitoring the only relevant parameters. It significantly reduces the amount of data to be processed and it modifies their organization. A sequential list of undifferentiated data is substituted by a list of conflicts, certain or potential, with the main characteristics of these conflicts, their resolution-context, and the relevant parameters enabling the controller to update this mental representation. As a consequence, the representation of the global situation is necessarily heterogenous regarding time. At any given time, the representation of the global situation is composed of several problems' representations, each of them triggering one or more resolution frames at different levels of abstraction. So the operator has to work simultaneously on different time scales. These frames result in the competition of data-acquisition tasks with different time spans. In addition to these tasks, new information from the system or requests from other operators may arise at any time and interrupt the current mental processes. The operator must shift from one task to another, from one time scale to another. This increases the cognitive cost of processing concomitant problems. Planning in an Uncertain and Highly Dynamic Context The previously described diagnosis mechanism enables the controller to determine the requirements of the situation and to organize the raw data set. These requirements are immediately transformed into goals and subgoals by the controller. In order to comply with a traffic requirement, the controller will have to act on the traffic so as to modify at least one of the trajectories. The question for him is to decide which aircraft to act upon, when, and how. This is the problem of real-time decision making. As in conflict detection, page_107 Page 108 the intention to act is not formed at one definite time but is the result of a process during which the mental representation of the problem will evolve from an abstract and schematic level to a level very close to the real world. During this process, the controller heuristically guides his activity toward the most promising directions by means of resolution frames. Figure 4.2 is an example of a resolution frame for a typical problem, a radar vectoring between two converging aircraft. The controller knows that the first aircraft (A/C1) will fly track ABC and that the second one (A/C2) will follow track DBE. The controller may not yet see the aircraft on the radar display. The only information available comes from the paper strips. The conflict is certain or potential. Considering only these prerequisites, any controller will state that "The radar solution will be: Either to vector A/C1 to the right (Arrow 1) and not to the left, or vector A/C2 to the left (Arrow 2) and not to the right. The choice depends on which one will be first over B (relevant parameter). This maneuver will be initiated when the selected aircraft is on the corresponding thick segment (it is very important to note that the right time to act is not a time, but a position on the flight path). The controller will have to monitor the position of the aircraft carefully, so as not to miss the correct space-time span for delivering proper control instructions. He will then have to make sure that the pilot complies with these instructions.

Fig. 4.2. Resolution frame for a radar vectoring of two converging aircraft. page_108 Page 109 He will then have to make sure that the maneuver is an effective resolution of the problem. Finally he will have to determine and monitor the end of the resolution in order to ask the pilot to resume his normal course. The course of development of a frame is as follows: 1. Frame triggering: Resolution frames are triggered only by the statement of the problem. But the same problem can trigger several frames (e. g., a level change vs. a radar vectoring). Most of the time the representation of the problem is initially ill-defined or inadequately defined. A part of the data-acquisition activity will be devoted to refining the representation, that is, choosing between several triggered frames. In the previous example, if one of the two aircraft is climbing, the relevant parameter required for choosing a frame is the rate of climb. If the aircraft climbs very fast or very slowly, an intermediate-level solution may be chosen; if it climbs at a medium rate, a radar solution will be appropriate. As long as the controller has not clearly made up her mind, the tasks corresponding to the instantiation of the different triggered frames have to be performed in parallel. As these different frames have different cognitive demands, the control and resources management mechanisms play a prominent role in this choice. Whereas the requirements of the situation are intrinsic to the default world, problem resolution depends on several personal factors. Isomorphic problems may not be processed in the same way by different subjects and even by the same subject on different occasions. A model of the controller cannot be deterministic. We now describe a whole frame processing, from the instantiation up to the execution of the maneuver, or up to its abandonment. 2. Frame instantiation: The activity of the controller regarding the previous example will be centered initially on deciding which aircraft to act upon. The only relevant parameter is to determine which aircraft will fly over B first. The subgoal "decide which aircraft to act upon" involves a well-specified data-acquisition task: "Compare the evolution of both aircraft's positions until determining which one will be first." Then he will have to instantiate the maneuver schema by defining more precisely the angle of deviation and the space-time span necessary to perform it. This is the end of the first phase, the decision-making phase. The second phase of frame execution then begins, in which the controller delivers control instructions to the aircraft so as to modify its trajectory. This corresponds to a top-down refinement strategy, which is well adapted to routine problem processing. It enables the controller to point out the relevant pieces of information and to acquire and process these data very economically. During the first phase, data acquisition from the real world is a page_109 Page 110 means of refining and instantiating the resolution frame in an opportunistic way. At the end of this phase, there is a profound conformity between the mental representation of the problem and the real problem. During the second phase, the controller checks that the real values observed or their extrapolations fall within the expected ranges. 3. Frame abandonment: A frame can be given up for any one of several reasons, such as (a) because an additional aircraft has changed the nature of the problem to be solved, (b) because of the effective values observed in the real world (e.g., the rate of climb has been modified, the level solution is no longer possible), (c) because the controller missed the right space-time span for performing a decisive action, or (d) because the pilot missed the maneuver. Of course, if a frame has to be given up, the controller has to shift to an alternative frame. As a conclusion, a resolution frame is a schematic and abstract representation that allows the controller to guide his or her activity and to structure the data set efficiently. We indicate two levels in a resolution frame, these two levels being tightly interwoven: the goals level, which describes the intentional aspect of the activity, and the data-acquisition tasks level. Frames are triggered by the problem statement: This implies that the aim of conflict detection is not only to indicate traffic requirements but also to produce an initial representation of the problem, so as to trigger the most promising resolution frames. Frames are refined, or abandoned from perceptional cues. To solve a problem, the controller can shift from one frame to another as necessary. This guarantees efficiency and flexibility in decision making. At any given time, the representation of the global situation is composed of several problem representations, each of them triggering one or more resolution frames at different levels of abstraction. These frames result in the competition of data-acquisition tasks with different time spans. In addition to these tasks, requests from pilots or from neighboring executive controllers may arise at any time and interrupt the current mental processes. The controller must shift from one task to another. This involves very important memorization problems and emphasizes control and resource management aspects. Memorization Problem The danger associated with forgetting a conflict situation, as well as the great number of data-acquisition processes and the rapid changes in the status of these processes as time goes by, make memory management a very demanding task for the controller. Controllers must keep in mind: (a) relevant traffic requirements so as to page_110

Page 111 be sure that their current activity complies with them, (b) the decisions to act, (c) the triggered frames, (d) the active goals, and (e) the associated data-acquisition tasks, as well as the targeted time spans to perform these tasks and their logical consequences. Data organization not only allows very efficient processing of information; it also improves chunking. Early studies on controllers' memory (Sperandio, 1969, 1974) show that experienced controllers are able to keep in mind a greater amount of data than beginners. Data relevant to conflict resolution are more easily memorized. We observed three major problems regarding memory: 1. Temporal deadline memorization: Controllers are very sensitive concerning the "right time" to perform actions on traffic (even if the right time is in fact the right place to act). It is easy to observe how an overly tardy action on traffic may transform a fairly difficult problem into a very difficult one. Controllers are unable to memorize time spans. To make sure that they do not miss the right time for delivering a control instruction, they very frequently monitor the exact position of the aircraft, until it enters the targeted area. Obviously this mechanism is very costly. When a maneuver has to be performed in a very acute time interval, monitoring the right time to act becomes a demanding task. The controller must shift frequently from one problem to another. At each shift he or she has to restore the resolution context. When conflicts are complex and subject to time pressure, this may become a critical task. This is very expensive in terms of cognitive resources, for it requires very frequent shifts from other pending problems. A subsidiary role of monitoring the system is to synchronize both the system's and the operator's internal "clocks". 2. Frequent goal shifting and context restoration: When controllers are confronted with a few simple and routine problems, chunking allows them to keep all the relevant information in mind. But when the situation becomes more demanding, when problems become more complex, controllers have to restore the context at each shift. Some problematic aircraft may be hidden among clusters of problem-free aircraft. Even for experienced controllers, recovering all these data under time pressure may become difficult. The efficiency of the mental processes also depends on the capability of the operator to focus his or her attention on the relevant problem at the right time, and to control the focus of attention, so as to avoid tunnel-vision effects. 3. Memory fading with time: The controller has to save sufficient cognitive resources to refresh all the previously stored data periodically. page_111 Page 112 Triggering the adequate knowledge into the working memory under time pressure has a cognitive cost that must be taken into account. Cooperation Most of the previous tasks can be performed by the two controllers, successively or in parallel. Mental mechanisms involved in cooperation are an essential part of the model. Efficient cooperation between the two controllers relies on three factors: They must share the same skills, knowledge, and training. They need to have consonant representations of effective traffic requirements. They must have simultaneously available cognitive resources to exchange information. When demand increases, these latter two conditions may decay so much that cooperation may no longer be effective. Numerous near misses have been reported that are due to cooperation failure in too demanding situations. One controller did not even know that some tasks were urgent and important whereas the other controller thought that these tasks had been normally performed. This points out the limits of cooperation based on implicit task delegation and implicit task allocation. Interface Management The interface can be thought of as a window through which the operator can get only a partial and distorted view of the real world. Mental mechanisms enable the controller to build the effective mental representation, that is, the representation that enables action on the world to be taken. The present data displays (strips and radar) are not well adapted to the controllers' mental activity. The executive controller organizes the strip rack according to the potential conflicts that he or she will have to solve. But we can observe that this is not a reliable means to exchange data between controllers: In demanding situations, when cooperation should be the most efficient, it becomes impossible to update the organization of the strips. This does not guarantee that both controllers have a relevant representation of the effective traffic requirements. This is the reason why a problem-driven information display seems to be necessary. This kind of tool will enhance the efficiency of the mental mechanisms and will improve cooperation between controllers without constraining their activity. It will be one of the main components of the electronic assistant. page_112

Page 113 Cognitive Resource Management The controllers' activity as described previously consists of: The creation of a representation of how the world will evolve over time, associated with parameter-monitoring processes to guarantee the soundness of this representation. Potential problem assessment so as to determine the requirements of the situation. Real-time decision processes. The monitoring of multiple relevant parameters so as to meet different goals during different time spans. To all these monitoring processes can be associated: A time range with loose boundaries or with a mandatory deadline; the boundaries as well as the deadlines are often conditional ones. A tempo that may vary over time according to the internal logic of the task or due to the consequences of cognitive resource management. This is the reason why (a) the representation of the world does not evolve continuously over time but in a discrete way, (b) the representations of each problem do not evolve at the same rate. All these processes are highly interactive. In demanding situations they may severely compete with and constrain each other. These multiple mental processes are often interrupted by events from the real world (pilots' requests, neighboring executive controllers' requests). The controller has to attribute limited cognitive resources to these multiple relevant goals. During the validation, we verified that the difficulty of a problem is not intrinsic to the problem but mainly depends on the context in which this problem has to be solved. The operator has to attribute limited cognitive resources to these multiple relevant goals. Central for the operator is the need to select the right task among several pending ones and to perform it in the right time span. Resource management depends, among several factors, on the shortterm taskload assessment: the number of tasks to be performed with their time span, their status, their technical difficulty, their critical dimension, and their coupling. The goal-switching difficulty depends on the number of shifts and on the number and complexity of context restorations. Resolution frames give an example of how operators plan their activity. As the operator has to divide his cognitive resources among all pending tasks, resource management mechanisms will strongly interfere with planning and control mechanisms. We can extend the previous notions to page_113 Page 114 cognitive resource management. Without trying to establish an exhaustive taxonomy of such strategies, significant changes over time in air traffic controllers' cognitive resource management can be observed easily. These changes may occur very suddenly. They mostly depend on the recent, present, and expected taskload assessment. These changes do not only concern the tempo of task completion but also significantly modify the current planning strategy as well as the resolution-frame policies or tactics. The cognitive cost of a resolution frame depends on these factors. Resolution frames give an example of how controllers plan their activity. As the controller has to divide his cognitive resources among all pending tasks, resource management mechanisms will strongly interfere with control mechanisms. Resource management depends on: The short-term situation assessment: the number of tasks to be performed with their time span, their status, their technical difficulty, and their coupling. The goal-switching difficulty depends on the number of shifts and on the number and complexity of each context restoration. The controller's representation of the working context (the neighboring executive controllers, the planning controller), which raises the problem of trust among operators. The controller's representation of his or her own capabilities. Depending on these factors, the executive controller divides his or her cognitive resources accordingly. For example, "I feel short of time, solve the urgent conflicts first, postpone conflict detection" or "expedite the resolution of Conflict A so as to have time to plan the resolution of Conflict B." This division gives rise to a philosophy that is used to plan and control each problem resolution. This philosophy is "be efficient first" for Problem A whereas it is "be elegant first" for Problem B. Let's consider the situation shown in Fig. 4.2, with A/C1 and A/C2 converging on fix B, and let's assume that A/C2 is flying at 29,000 ft (i.e., flight level 290), whereas A/C1 is taking off and wants to climb to 35,000 ft (i.e., flight level 350). Figure 4.3 shows the consequences of different cognitive resource management strategies at the goals level of the resolution frames: 1. Level 280 is called the safety level. 2. Monitoring a rate of climb is very demanding, as uncertainty on this parameter is very high. Its value may change suddenly. To avoid risk, the controller has to focus on this aircraft very often, which increases the number of shifts from one problem to another, and increases the cost of dynamic memorization processes. page_114

Page 115 Be elegant first I climb A/C1 initially to level 280 (1) Then monitor its rate of climb (2) If it climbs slowly, a little after B it will climb to level 350 If it climbs very fast, I climb it to level 350 and monitor carefully (3) Otherwise: I provide radar vectoring and climb it to level 350

Be efficient first I climb A/C1 initially to level 280 (1) I provide radar vectoring and climb it to level 350 (4)

Safety and nothing more I instruct A/C1 to climb to level 280 and maintain (5) FIG. 4.3. Different resolution frames according to cognitive resources management strategies. 3. As the resolution depends on an unreliable parameter, the controller has to monitor very carefully so as to take the appropriate decisions if necessary. 4. A radar vectoring, especially in a routine situation, is not very demanding. Even if it turns out to be unnecessary, the controller prefers this solution, which guarantees both safety and efficiency rather than spending a lot of time eliminating ambiguity. This clearly shows that the results of conflict detection mainly depend on cognitive resource management strategies! 5. This solution occurs in very demanding situations. As A/C1 remains below A/C2, the conflict is suppressed. This solution is the most economical for the controller but may be penalizing for the aircraft. Different philosophies also have noticeable consequences at the task level of the frames. Data-acquisition tasks are organized into a hierarchy. The data-acquisition tempo may change significantly. Some tasks may be postponed or canceled. For example, in very demanding situations, the relevant sentry-parameter monitoring tasks may be performed as background tasks. The executive controller may delegate some tasks either to pilots (rather than monitoring a parameter, the controller asks the pilot to do this: "report page_115 Page 116 when . . .'') or to the planning controller. In this domain, the most important mechanism is the implicit task delegation. According to their representation of the planning controller, that is, their confidence in the other operator, the executive controller may disregard less urgent or less important tasks. The planning controller will detect these tasks, monitor them, and advise the executive controller when a specific action is needed. Cooperation is also a function of cognitive resource management strategies. To summarize, a part of the activity of the controller is devoted to choosing the best frame. Each of these frames may be more or less demanding. In demanding situations the cognitive cost becomes a basic criterion in choosing a frame. Of course, while resolving a problem, the controller may have to shift from an inoperative frame to a more relevant one. According to the assessment of their workload, controllers can instantiate a resolution frame in a more or less efficient way. They can also abandon a more elegant frame to shift to a more efficient one: This is the consequence of their own resource management policy, according to the problems they have to face at any given time. All these mechanisms are a part of the real-time data process. This process results in a problem-driven organization of the raw data set, which enables large amounts of data to be processed. Mental mechanisms have a validity domain. It is easy to observe how their efficiency decays under stress, time pressure, or fatigue. For example, in demanding situations, the sentry parameters are monitored less and this may lead to errors when abnormal behavior is not detected soon enough. The assessment of a given conflict, including conflict detection and resolution assessment, needs a few seconds when the number of aircraft is low, whereas it can take 7 to 8 minutes in very demanding situations; in this case, the controller is confronted with problems associated with numerous shifts from this conflict to concomitant ones, as described earlier, and the risk of error (forgetting a relevant aircraft, choosing the wrong resolution frame, etc.) is high. The validity domain of the mental processes directly depends on the number of aircraft that have to be processed by the controller. This is the reason why we focused on a problem-driven presentation of the information. The Functional Specification of Decision Aids Guidelines For the next decade, the nature of the data to be processed by the controllers will not change significantly, only their volume. So, all the mechanisms that are inherent in the nature of data to be processed must be preserved in the new environment. page_116

Page 117 However, the cues that trigger mental processing are associated with the physical environment, so they will disappear. It is necessary to make sure that the new environment will enable the operator to obtain a relevant set of efficient cues. Cognitive tools can be specified (a) either to improve the efficiency of cognitive resources (or to economize cognitive resources), or (b) to manage them in a more efficient way. The justification of the tools is a key point of the approach. It explains the reasons behind the design of each function, and the improvements of the joint human-machine system that are expected. It also defines the criteria used in testing this system. At this level, there must be a profound symbiosis between theoretical work on the cognitive model, design, and validation. This implies that the design team must be multidisciplinary and multilevel, that is, include researchers and practitioners in each discipline. Improving the Efficiency of Cognitive Resources This can be achieved using information-filtering techniques or by providing an interface that comes as close as possible to satisfying cognitive needs. Task-Driven Data Presentation For any situation, we can identify the very few data that are useful for a given task. The electronic interface makes it possible to present only the relevant parts of the raw data set so as to show relevant data in a way that enable the controller to perform the task more efficiently. For example, to manage the flows of outbound traffic, planning controllers do not need all the data that are shown on the present flight progress strips. They need only 5 or 6 items, compared to the more than 20 that are available now. The flight progress strips are organized on a rack according to the needs of the executive controller. This organization does not meet the real needs of the planning controller. The electronic interface makes it possible to show planning controllers the exact subset of data that they need, organized in a way that provides an efficient support to their cognitive needs. Problem-Driven Data Presentation The aim of problem-driven information filtering is to reduce the number of aircraft to be considered at one time. By splitting a very demanding situation into several subsets of aircraft, we can expect that the controllers will be able to process these subsets of aircraft very efficiently. As we do not intend to provide the controllers with the results of automatic conflict detection and resolution, they will have to use all their mental mechanisms to assess the situation. page_117 Page 118 This should preserve their skills and their capability to deal efficently with any unanticipated situation. The expected gain is that, as they will be working on appropriate subsets of aircraft, these mental mechanisms will be much more efficient than at present. Thus, we have to verify that this human-machine cooperation philosophy enhances all those mental mechanisms that are inherent in the very nature of the data to be processed, as identified in the cognitive model: The way controllers anticipate in a state of partial ignorance. The associated sentry-parameter monitoring processes. The ambiguity elimination processes: The definite assessment of the situation should be made earlier and in a more acute way than now. The choice of the relevant resolution frame should be made earlier than now, and in a more "elegant" way. The cooperation between controllers should be improved. The information filtering is supposed to enhance the definition of the mental representation of traffic. Both controllers' mental representations of the situation should remain consistent over time, as they will be able to update them very easily. Meeting Cognitive Needs as Closely as Possible With the Interface The following is an example of how the cognitive model is used to specify the interface in ERATO. It is commonly admitted that operators spend a significant part of their activity in compensating for tool deficiencies. An ill-adapted interface can significantly devalue the results of information filtering. The extrapolation function of ERATO allows one to substitute a graphical representation for an alphanumeric one. Experiments have shown that most of the time the referential used by the controller is not a temporal one but a spatial one: The question "When will you act on this aircraft?" is answered "There." So the interface will enable the controller to drag an aircraft along its trajectory with the mouse; all the other aircraft will move accordingly. This interface really meets the way the controller anticipates. If this interface had had a temporal referential, the controller would have had to mentally convert distances into time intervals; in demanding situations this could represent a significant additional workload. Improving the Management of Cognitive Resources The problem-driven information filtering allows controllers to focus all their activity on well-formulated problems, so that they can operate all their mental mechanisms in a more efficient and creative way. This funcpage_118

Page 119 tion substitutes a set of easily manageable problems for the initial complex situation. The 1991 experiment has shown how difficult it may become for the controller to focus entirely on the right problem at the right time. The solution proposed in ERATO is a new function, the reminder. The reminder consists of a specific window of the electronic assistant where each problem will be tagged. A problem is defined as a conflict situation involving two or more aircraft. The labels are positioned according to the urgency of resolution. The display of the relative urgency of problems should enable the controller to avoid wasting cognitive resources on nonurgent and unimportant tasks while the short-term situation decays. In normal operations, this should allow the controller to objectively manage all cognitive resources and avoid tunnel-vision errors. The aim of the reminder is to show the two controllers what the traffic requirements are and their urgency. Thus, it should enhance cooperation between them. There are several ways to split a given situation into relevant problems. This variability can be observed for several different controllers, as well as for any given controller, according to his cognitive resource management philosophy. The more demanding the situation is perceived to be, the more the controller will split it into "little" problems and solve these problems in a very tactical way, with short-term solutions. If the controller feels that the situation is mastered, he will consider these elementary problems as parts of a whole and solve them in a more strategic way. Thus, the problems that are proposed by the machine must be considered as a draft by the controller. He can modify the labels to adapt them to the effective needs of the executive controller, and particularly, he can adjust the target resolution time. At resolution time, the relevant aircraft are highlighted on the radar display. The reminder should be used by both controllers as a safety net based on intentions of action. The Role of Expert Systems or Knowledge-Based Systems Expert Systems: Solving the Problem Versus Formulating the Problem Properly The role of expert systems or knowledge-based systems as defined in ERATO is not to solve the problem (detect conflicts and/or solve them). The problem-driven information filtering allows the controller to focus all her activity on well-formulated problems so that she can operate all her mental mechanisms in a more efficient and creative way. This function substitutes a set of easily manageable problems for the initial complex situation. The role of expert systems is "just" to assist the controller in formulating the problem in a more efficient way. Operators no longer feel page_119 Page 120 they are being progressively expelled from the decision-making loop, but that they are more powerful thanks to the machine. The Logical Representation As mentioned previously, two different logics need to be combined to formalize the different facets of the controller's reasoning patterns: a seminormal default logic to model how controllers anticipate in a state of partial ignorance, that is, from the normal behavior of any aircraft, and a fuzzy temporal logic to represent ambiguity elimination processes. The Knowledge-Based System and the Main Information-Filtering Function The role allotted to the knowledge-based system is to provide these electronic assistants with adequate data, to show (a) how to organize the raw data in a problem-driven way, and (b) what the traffic requirements are and their urgency. Description of the Knowledge-Based System The first version of the expert system included about 3,000 Prolog first-order rules. This expert system is no longer used by the system. Algorithms have been derived from the expert system and are encoded in C++. These algorithms process the same set of data as the controllers have to process now, that is, the information from the flight progress strips and, when available, the radar information. The knowledge-based system includes two main modules. The first one computes the default representation of each aircraft. From this representation, the second module associates with each aircraft its relevant environment, called the interfering aircraft subset (IAS). This environment is composed of: The subset of all conflicting aircraft. These conflicts may be certain or potential. This subset is not determined by means of a pure mathematical computation, but according to current expertise of controllers. The subset of all the aircraft that may interfere with a normal radar resolution of the conflict; that is, all aircraft that may constrain conflict resolution. A normal resolution is a solution that is consistent with the current know-how of controllers. The relevant environment of an aircraft is typically a problem-driven filtering of information. The IAS represents the relevant working context page_120

Page 121 associated with an aircraft. Such an environment embodies traffic requirements and all information that may be useful to fulfill these requirements. The number of rules is explained by the need to represent the updated skills and knowledge posessed by controllers to make sure that information filtering really meets the controller's needs. The definition of the relevant environment is: according to the traffic requirements, provided the EC works normally, he may need all, or a part of, the displayed data, but he will in no way need any other data. Information-filtering techniques are under dispute (De Keyser, 1987). The point is how to make sure that the operator won't need a piece of data that is hidden by the system. Such data retention would be an unacceptable source of error. Discussion The discussion on the exhaustiveness and the relevance of data filtered by the machine is central. The basic answer consists of providing the operator with functions that enable him or her to access extended sets of data, or even the whole set of data. This solution is not relevant when using a problem-driven filtering system. Specific points are as follows: The first answer consists of taking into account the default behavior of the aircraft in a more "prudent" way than the controller. This will result in the display of some aircraft that may not be relevant for the controller. In the most demanding situations encountered by controllers now (more than 30 aircraft in the sector), most IAS include fewer than 8 aircraft. If one or two additional aircraft are displayed this is not really a problem: In all cases, the number of aircraft displayed as a result of information filtering remains lower than the maximum efficient processing capability (about 15 aircraft), whereas the initial number was significantly above this figure. Then the system detects all potentially abnormal behavior of an aircraft to advise the controller as soon as possible and to update information filtering accordingly. In future versions, this mechanism should be performed using FMS/Data Link capabilities. But these first two answers do not really solve the problem. The knowledge elicited in the expert system defines a set of "normal behaviors" on the part of the controllers. But whatever the number of rules can be, it is impossible to represent the total knowledge of the controllers. To be able to do this, we should have to deal with controllers' errors or creativity. The solution defined in ERATO consists of considering the knowledge-based system as a default representation of the controllers. To guard against the consequences of human error or creativity (i.e., unexpected behavior), a monitoring process is associated; page_121 Page 122 this process is inspired by the natural sentry-parameter monitoring process of the controllers. This monitoring process will detect any discrepancy between the actual position of all aircraft and any of the possible positions that could result from a "normal" behavior of the controller. When necessary, this process will trigger an alarm so as to advise the controller that the previous information filtering is no longer relevant and has been updated. We have to make sure that this mechanism is efficient in demanding situations, and that the controller is not interrupted by the warnings too often. In other words, the knowledge-based system must be sufficiently accurate. This monitoring process linked to the knowledge-based system allows the electronic assistant to adapt very smoothly to operator error and creativity. Such information filtering is error tolerant. Validation of the Problem-Driven Filtering Algorithms This validation was carried out in 1993 using five very demanding traffic samples from five different upper sectors. These experiments involved 44 full-performance level controllers from the five French control centers. The protocol consisted of interviewing controllers at identified moments of the simulations, to ask them the following questions on target aircraft (about 25 per traffic sample): For each aircraft, describe what its behavior will be inside the sector. For each aircraft, describe all the conflicts (certain or possible). For each of these conflicts, describe the resolution frames that can be used. For each of these resolution frames, describe the aircraft that are, or may be, a constraint. Then, the results were merged and compared to the results of the algorithms. The algorithms were found to be generic to all French upper sectors, and needed very minor adjustments. Furthermore, the rate of filtering was correct. Despite the fact that the number of aircraft in the sector was between 30 and 40 (about twice the present peak of demand), on 122 target aircraft, there were only 4 IAS higher than 15 aircraft (15 aircraft is considered by controllers as their maximum efficient processing capability), whereas 92 IAS were fewer than 8 aircraft. page_122

Page 123 How the Controller's Electronic Assistant Uses the Outputs of Information Filtering The basic information filtering will be used by the following two functions: 1. Simulation functions: These functions will allow the controller to test different resolution frames and to answer questions such as "What would happen if I climbed this aircraft to . . . ?" or "Is it better to set course directly to . . . ?". The expert system will deliver the simulated information filtering. These answers will be updated until the controller has made his or her choice. For the time being the controllers have no tool that assists them in performing this task. 2. Memorization aids: The controller will have the capability to indicate the trajectory section where he or she intends to act on an aircraft. When the aircraft flies over this point (or abeam of it), a warning will be triggered. Then, after having consulted the filtered information, the controller will instantiate his or her decision. This should solve both problems of keeping in mind the "right time to act" and real-time contextresolution updating. Evaluation, Verification, and Validation of the Joint Human-Machine System Methodology Classically we define dependability as that property of a computing system that allows reliance to be justifiably placed on the service it delivers (Laprie, 1987). We can point out four classical methods regarding dependability-procurement or dependability-validation: fault avoidance, fault tolerance, fault removal, and fault forecasting. These definitions can be applied to a complex heterogeneous human-machine system such as the ATC system, as well as to any of its machine components. In the first case the users are the airlines (or their passengers), whereas in the second case the user is defined as the controller or any subsystem. The specification of decision aids relies on a philosophy of future human-machine cooperation, whether this philosophy is clearly defined or not. The central question is whether this cooperation fulfills the initial requirements regarding capacity and safety. To answer this question, we have to choose the right parameters to be evaluated, then we must determine the minimum set of experiments to get a significant amount of data (Sarter & Woods, 1992). Some basic questions must be answered about the page_123 Page 124 robustness of the joint human-machine system: Is it error tolerant (Foster, 1992)? Does its organization allow a quick and easy correction of errors (Reason, 1992). The design of decision aids implies an analysis, either implicit or explicit, of operator deficiencies and of the most effective means to compensate for these deficiencies. The ultimate step of the verification/validation process should be the verification of these initial assumptions (Hopkin, 1992). The first level of validation consists in testing both the working method and the interface so as to verify that they really improve the target bottleneck and to make sure that they do not adversely affect some sources of good performance. Then we will have to assess the validity domain of each function: Is it really efficient in situations where the controller needs an effective aid? Finally, we must assess the performance of the joint human-machine system, and answer questions such as: How well is this cooperation philosophy accepted by controllers? How will it modify their activity? Does it enable them to work in a more efficient and creative way? Does it produce a loss of vigilance or of skill? Does it improve the global performance, from the capacity and safety points of view? Does it enable a progressive and "soft" integration of technological advances in avionics? What are the consequences for training? The First Evaluation Campaign October 1994 April 1995 The Role of the Cognitive Model in Defining the Experimental Protocols The cognitive model provides a guideline for evaluating the joint human-machine system. It enables the transformation of high-level validation requirements into relevant criteria to test the joint human-machine system. It determines which aspects of the machine or of the human-machine interaction must be verified closely to guarantee an effective performance of the whole system or to prevent error. One can then determine or assess the gains in these aspects. We must verify that the new joint human-machine system preserves the sources of good performance and really improves the weak points from both a safety and a capacity point of view. This suggests that we must assess the performance of the new system with reference to the previous one in real conditions, that is, whatever the variability of the real world is, in demanding and very demanding situations. The experiments should page_124

Page 125 enable one to determine how the joint human-machine system evolves; how the bottlenecks in the operator's activity evolve, disappear, decay, or are created; what kind of problems are solved and created by the new system; and what the consequences are for operator training. The experimental protocol was based on the comparison of the performance of controllers in demanding or very demanding situations in the present environment and in the future one. The experiments involved nine teams of two controllers. Each team was confronted with four traffic simulations, two of them using a conventional environment (paper strips and a radar display), the two others using the electronic assistant. The average duration of a simulation was 45 minutes. A video record of the controllers' activity and a computer record of all the actions on the system was made. Afterwards, controllers had to fill in a questionnaire on the functions: For each function they had to answer questions on the relevance of the function (regarding safety, capacity, cooperative activity, etc.), its usability, the function as a (potential) source of error, and their opinions on planned improvements for each function. Lastly, they had to comment on their own activity in a semidirected way, using both the video replay and the computer replay of the simulation. The debriefing interview was orientated on the workload as it was felt by both controllers, and focused on the consequences for conflict detection, conflict resolution, and on cooperation, to get data on resource management and to compare with equivalent situations in a conventional environment. The average duration of the interviews was about 5 hours for each traffic simulation. The Role of the Cognitive Model in Training For operational reasons controllers were available for only 2 weeks. This was a serious constraint, because they had only 6 days to train on ERATO before the evaluation tests. To optimize training, we had to anticipate the problems that would be encountered by controllers, so as to focus on these points. To do so we used the cognitive model in order to determine plesiomorphic features and apomorphic features in controller activity. Plesiomorphism mainly concerns the physical process management (skills to detect and resolve conflicts), whereas apomorphism concerns all the physical and cognitive activity linked with the interface and cooperation. Obviously, the use of a mouse is a problem under real-time conditions. But the most difficult task for controllers consists in acquiring new skills to build a relevant representation of the real world through the new interface: What are the relevant cues? Where to sample them? How to interpret them? All the cues they are used to, and all the associated reflexes, depend on the present interface: They are no longer available. Controllers must learn how to restore an efficient visual scan on the interface, that is, acquire the ability to make efficient use of all the visual cues provided by the new system. page_125 Page 126 In the same way, present cooperative activity is supported by the interface. A pure electronic data transfer proves to be inefficient in demanding situations: Controllers have to learn how to preserve the rich multimodal cooperation in an electronic environment, how to make the tools improve this multimodal activity rather than sterilize it. Only the first day was dedicated to learning the logic of the machine and the basic handling of the interface. For the next 5 days, training was directed toward the acquisition of the apomorphic skills, always with reference to the present ones: The goal remains the same: building a robust mental representation of traffic. Only the way of doing it is different. Results Positive Results As shown in Fig. 4.1, the experiments provide input at all the levels of the project. Whenever a function is not satisfactory, it must be assessed whether it comes from the working method, the interface design, the algorithms, the specification itself, or bottleneck assessment. Whatever the reason is, we have to refine the cognitive model. Different opinions of controllers in the questionnaire were set against the present state of the cognitive model to improve it and to understand the genuine reasons behind those diverging opinions. A statistical analysis of actions on the interface, with reference to the number of aircraft, of problems, and so on, is cross-checked with the comments to analyze how each function is really used over time when the demand varies. Combined with the analysis of the video record and of the interviews, this statistical analysis enables us to understand how new tools will modify controller activity, to verify if the decision aids enable them to work in a more efficient and creative way without resulting in a loss of vigilance or of skill, and to make sure that they improve the global performance of the joint human-machine system, from capacity and safety points of view. The video analysis is not yet completed. However, initial results, based on debriefings, interviews, questionnaires, and statistical analysis, show that this automation philosophy is very well accepted by 15 controllers, rejected by 1, and that 2 controllers asked for additional tests. The controllers think that these decision aids will considerably decrease their stress, and thus will enable them to increase capacity and safety significantly. We can already consider that the operational concept is validated. Nevertheless, a lot remains to be done to improve the usability of all the functions. Some algorithms of the reminder have also to be modified. These experiments are the initial phase of an iterative process leading to final specification of the electronic assistant by mid-1997. Final experiments with this interface connected to the second version of the algopage_126

Page 127 rithms have been successfully carried out (September 1997-May 1998). These trials involved eight teams of two controllers, for 3 weeks each. Two weeks were dedicated to training and one for the evolution of the joint human-machine system. The next step is a shadow control sector in operational conditions by the end of 2001. The Reminder The reminder is the main factor in increasing productivity. But its efficiency relies on efficient cooperation between controllers. Three agents can act on the reminder: the algorithms and both controllers. The experiments showed that the role of each agent needed to be clarified. The refining of the reminder has been an exemplary illustration of the methodology used by the team. The starting point was the confidence that the reminder was central in building the mental representation of traffic and as a support to cooperation. From these initial assumptions we worked with controllers to determine what the most efficient working method with the reminder should be. From that working method, we inferred the specification of the second version of the reminder interface. A mock-up was designed and connected to the whole interface. This enabled us to test the working method and the interface under realistic conditions, and to refine both. The Cues The electronic environment deprives the controllers of all relevant cues that were familiar to them in the previous environment. This is not only a matter of nostalgia. These cues trigger all the mental processes that enable the controllers to build their mental representation of traffic. Building this representation is not a deterministic process; it is guided by the detection and the processing of these cues. So it is critical to verify that the interface provides relevant cues, and the controller can easily detect and process them. This task is central to the interface specification. It is made more complex in an electronic environment because of the saturation of the visual channel. Thus we have to define a global policy of data presentation on the interface, and in particular, a working method relying on relevant visual scanning of the interface. This definition process will make use of more advanced studies on attention. Integrating the Results The Cognitive Model and Rapid Prototyping The definition of the joint human-machine system is necessarily an iterative process. From the cognitive model, we can infer functions, and sketch out working methods and the associated interfaces. Experiments under realistic conditions make it possible to refine all of these. Then rapid prototyping techniques can be used to page_127 Page 128 analyze working methods step by step. Controllers are confronted with simulated traffic samples to analyze what the actual cognitive needs are for the building of an effective mental representation of the situation, and how the machine should assist the operator in this task. The main object of rapid prototyping is not the interface, but the working method. The interface is specified only when the working method is clearly defined. The Role of Users in a Multidisciplinary Team It is often difficult to accurately define the role of future users when specifying and evaluating a new working environment. The cognitive engineering approach makes it possible to solve this problem in an efficient way, thanks to the reference of the cognitive model. About 25 air traffic controllers attend working sessions with psychologists and/or artificial intelligence specialists and/or computer engineers, in teams of two or three. The behavior and the opinions of each controller is analyzed according to the cognitive model. This makes it possible to enrich it. Thanks to the cognitive model, the variability between people can be taken into account, not to find an unreachable consensus between opposite opinions, but to understand what different (and not directly formulated) cognitive needs lay behind those different opinions, so as to translate these cognitive needs into working methods and an interface specification. The specification of the tools is not directly driven by future users. The cognitive model is an irreplaceable level of abstraction between the users and the designers. Cognitive Engineering Is Ecological The cognitive model must be continuously amended, from observations of the real working context. Laboratory experiments, no matter how realistic, are not sufficient. The final experiment, before the operational deployment, will be held in operational conditions by end 2001. Real traffic will be controlled, using the ERATO environment, in a control sector protected by a conventional shadow sector. A lot is expected to be learned by observing how people really use the functions. The analysis of the discrepancies between what was expected and what really happens will be a major source of improvement for the cognitive model. How to Manage With ''External" Technological Advances The cognitive model is about the present system, including present operators. The evolution of the ATC system must include major technological advances such as Data-Link, precise trajectories computed by onboard computers (FMS), and advanced navigational means enabling very long direct tracks. The technical features are now well known, but very little is known about the consequences on the joint human-machine system. page_128

Page 129 One can easily imagine an ideal system within two or three decades, from a purely technological point of view, but what about the transition from the present system to the future one? Cognitive engineering seems to be a powerful means of mastering the evolutions of the system, as the cognitive model makes it possible to focus on relevant problems that will necessarily be met by practitioners in such an environment, and foster studies in critical areas. For example, an intensive use of Data-Link will put an end to the executive controller's monopoly of interaction with pilots, thus modifying all cooperation mechanisms between controllers. The elicitation of the present cooperation mechanisms, and how these mechanisms contribute to the building of the mental representation of traffic, makes it possible to anticipate how they will be modified, and to do experiments in this domain. Thanks to Data-Link, a very acurate trajectory may be downlinked to the ground. By consequence, the very nature of data that must be processed by controllers will change. This will involve tremendous changes in cognitive activity, default reasoning mechanisms, ambiguity elimination processes, plausible inference, data-acquisition mechanisms, and so on. This will be the case for those aircraft that are equipped, but not for all aircraft. In such a turbulent transition, the cognitive model provides the guidelines to the tools' designers, so they can master the different facets of the specification and evaluation of the future joint human-machine system. Conclusion The cognitive enginering approach applied to ATC has proven to be successful. The backbone of this approach is the cognitive model of air traffic controllers. The activity of the design team is driven by this model, either to infer the specification of the tools, or to search for relevant criteria to evaluate the new joint human-machine system, or to improve the cognitive model itself. As a consequence, the design team must be multidisciplinary, including psychologists, ergonomists, artificial intelligence specialists, humanmachine interaction specialists, computer engineers, and air traffic controllers. It must also be multilevel, including researchers and practitioners in each domain. There must be a continuous interaction between concrete problems and fundamental research inside the team. The approach must continue after the operational deployment to analyze how people really use the tools, that is, how the new joint humanmachine system really works, and to identify and interpret the differences between what was expected and what really happens. This phase is very important, both to enhance the cognitive model and to improve the design of the tools. page_129 Page 130 Identifying at the outset what is critical in the operators' activity makes it possible for the designer to focus on relevant questions during any validation phase. We have shown how this principle-driven design results in a far more efficent use of training, which is not thought about as a means of compensating for design inadequacies, but as the continuation of the design process. Both the cognitive model and the choices made during the design process provide guidelines for training. Identifying apomorphic and plesiomorphic features in the new joint human-machine system is of great interest in making training more efficient. This approach has been in place for a long time, about 15 years between the very first studies and the deployment of the operational version. But this duration is comparable to other major projects in ATC. At the beginning of the process, it seems costly, as the first mock-ups require a long time. However, in the final analysis, the cost-benefit ratio is very positive. References De Keyser, V. (1987). How can computer-based visual displays aid operators? International Journal of Man-Machine Studies, 27, 471 478. Foster, H. D. (1992). Resilience theory and system valuation. In J. A. Wise, V. D. Hopkin, & P. Stager (Eds.), Verification and validation of complex and integrated human-machine system (pp. 35 60). Vimeiro, Portugal: NATO Advanced Study Institute proceedings. Hollnagel, E. (1988). Information and reasoning in intelligent decision support systems. In E. Hollnagel, G. Mancini, & D. Woods (Eds.), Cognitive engineering in complex dynamic worlds (pp. 215 218). London: Academic Press. Hollnagel, E. (1991). The phenotype of erroneous actions: Implications for HCI design. In G. Weir & J. Alty (Eds.), Human-computer interaction and complex systems (pp. 73 121). London: Academic Press. Hopkin, V. D. (1992). Verification and validation: Concept issues and applications. In J. A. Wise, V. D. Hopkin, & P. Stager (Eds.), Verification and validation of complex and integrated human-machine systems (pp. 9 34). Vimeiro, Portugal: NATO Advanced Study Institute Proceedings. Laprie, J. C. (1987). Dependable computing and fault tolerance at LAAS: A summary. The evolution of fault-tolerant computing. In A. Avizienis, H. Kopetz, & J. C. Laprie (Eds.), Springer-Verlag Wien New York, 193 214. Reason, J. (1992). The identification of latent organizational failures in complex systems. In J. A. Wise, V. D. Hopkin, & P. Stager (Eds.), Verification and validation of complex and integrated human-machine systems (pp. 223 238). Vimeiro, Portugal: NATO Advanced Study Institute Proceedings. Woods, D. D., & Sarter, N. B. (1992). Field experiments for assessing the impact of new technology on human performance. In J. A. Wise, V. D. Hopkin, & P. Stager (Eds.), Verification and validation of complex and integrated human-machine systems (pp. 133 158). Vimeiro, Portugal: NATO Advanced Study Institute proceedings. page_130

Page 131

PART II USE(R)-CENTERED SYSTEM DESIGN AND TRAINING IN SUPPORT OF JOINT SYSTEM PERFORMANCE page_131 Page 133

Chapter 5 Task-Oriented Display Design: The Case of an Engine-Monitoring Display Terence S. Abbott National Aeronautics and Space Administration Computer-generated display technology has provided not only an enhanced means for presenting data on the flight deck, but also a capability to tailor those data into a representation that better serves the flight crew. Though numerous display formats have been developed that take advantage of these capabilities, the formal processes of display design (Banks, Hunter, & Noviski, 1985; Department of Defense [DOD], 1987; Frey, Sides, Hunt, & Rouse, 1984) have not. The display design process presented here focuses on providing information that is tailored to the user's task, which is enabled by advanced computational capabilities that allow displays to provide this task-oriented information. If the traditional approach to design is examined, it can be seen that display design is considered to have two distinct parts: defining the information content (an analysis phase) and describing the information form (a synthesis phase) (Banks et al., 1985; DOD, 1987; Frey et al. 1984). The definition of the information content usually includes a definition of the system objectives, a function analysis, a task analysis, and the identification of the information requirements. In this process, the system objectives generally describe the intent of the system. The function analysis then details what needs to be done to fulfill the system objectives. Next, a task analysis and decomposition are performed to define how to provide for the functions. Finally, all of the information that the user will need to perform the tasks is identified in an information requirements list. page_133 Page 134 The second part of the traditional design process is the description of the information form. This description begins by using the information requirements list as the primary specification for the selection of picture elements (e.g., text, a graph, table, or chart that conveys information to the user to support a task). After the picture elements have been defined, they are combined together to form a picture. The defined picture is then modified to conform to the identified implementation constraints. Compromises are frequently necessary for either the selection of a picture element or the organization of the picture as a whole. This process of selection and modification is repeated until all constraint conflicts are resolved. The final product of this iterative design process is a display specification. The approach taken in this new design process (Abbott, 1989) is to modify the traditional design process at two points. The first modification is at the point where the user's tasks are defined. At this point in the traditional design, the user's task is usually decomposed to a level where a data source can be identified. The modification proposed in this study is to decompose the user's task only to a level where relevant information can be identified. This relevant information, if not directly provided by the raw data from the system, should be provided by synthesis from the underlying data. By providing information at a more appropriate level of detail, a reduction of the user's cognitive workload associated with the use of this information should be possible. A second, complementary part of this proposed process deals with providing information in a form that is more appropriate to the user's task. Often, picture elements chosen to support a particular task are less than optimum, from a user's standpoint, for that task. Frequently, this lessthan-optimum choice is predicated on the characteristics of the available raw data. If a better picture element can be found, one that better supports the user's task, then data should be processed or synthesized to support this implementation. The goal of this design process, then, is to provide task-oriented information to the user, both in content and form, to support the user at a level more relevant to the user's task. To validate this concept, an aircraft engine display was developed and evaluated. This application area was chosen because it provides both a control task and a systems-monitoring task. It is believed that the general concepts being advocated will be applicable through a broad range of application areas. Traditional Design Practices In recent years, some of the most effective guidelines to the display design process have come from the DOD (1981, 1987) and the nuclear power community (Banks, Gilmore, Blackman, & Gertman, 1983; Banks et al., 1985; page_134

Page 135 Frey et al., 1984; Gilmore, 1985), the latter probably as a result of the Three Mile Island incident. As described in these documents, the display design process should be accomplished using a top-down, iterative approach with at least two distinct phases: analysis and synthesis. The purpose of the analysis phase is to define the use of the display system from the user's standpoint. As a minimum, this phase includes the definition of the requirements of the system to meet some overall objective and the information needed to fulfill those requirements. The product of the analysis phase is a list of the information and its characteristics required by the intended user of the display system. This list is then used as the primary specification for the synthesis phase. The synthesis phase is used to define the optimum display format, the picture. This picture is then transformed into an achievable display specification. The transformation process includes the identification of implementation constraints and the iteration of these constraints back into the design. The relationship of these phases is illustrated in Fig. 5.1. Analysis Phase It can be seen in Fig. 5.1 that the analysis phase is partitioned into four parts: the definition of the system objectives, a function analysis, a task analysis, and the identification and description of the information requirements (Banks et al., 1985; Frey et al., 1984). The analysis for a design, then, begins with the system objectives, which are used to describe what the system is to do, who will use the system, where it will be used, and when it will be used. For our example, a simplified summary of the system

Fig. 5.1. Traditional design process. page_135 Page 136 objectives is as follows: provide real-time information for the operation of two Pratt and Whitney JT8D-7 turbofan engines. The second part of the analysis phase is the function analysis. The function analysis is simply the decomposition of the system objectives into a set of functions required to meet the goals of these objectives. That is, a function is a fairly specific and detailed description on what needs to be done to fulfill some part of the system objectives. One major mechanism for defining the functions is through the use of functional flow diagrams (DOD, 1987). Using this technique, system requirements are iteratively decomposed from system or mission objectives into increasingly detailed functions. A functional flow diagram is generated for each level of detail in the decomposition. The decomposition continues until a level that identifies specific operator tasks is reached. Functional flows are constructed at each level by arranging the functions into a systematic, sequential arrangement by the proposed order of use. The direction of interaction or normal sequence of use of each function is then depicted by connecting, directional arrows on the diagram. Functional flow diagrams provide a traceable and relative easy technique for defining the functional requirements in the design process. An alternative mechanism for defining the functions allocated to the human is by using proposed or existing operator procedures (Frey et al., 1984), where a function will generally coincide with a procedure. If these procedures do not exist, then similar procedures may serve as models or candidate procedures may be generated. This particular technique is especially suited for retrofit situations or situations under which existing procedures will be used. Using this latter approach and expanding the procedures from the operator's handbook (The Boeing Company, 1973), the functional analysis for this engine display example yields two primary functions: a control function and a monitoring function. These functions are then further divided into subfunctions. It is noteworthy that the separation between these functions is not quite as distinct as implied. This is due largely to a cross-check requirement, a monitoring task, within the control task. The third portion of the analysis phase is the decomposition of the functions into tasks. A task is a description or definition of how to provide all or some portion of a function. That is, the task is a specific action that needs to be performed by the human to provide this function. From a display design standpoint, the aim of the task analysis is to identify the information required by the human to perform the tasks. The product of the task analysis is a complete list of all tasks that are needed to fulfill the functional requirements. To produce the task list, the task analysis and decomposition are repeated until all tasks can be determined by one of the following: page_136

Page 137 The need to read some particular instrumentation. That is, the "decomposition should be repeated as many times as necessary to arrive at a statement which yields the information needed at the level it is provided from the plant instrumentation" (Frey et al., 1984, p. 9-9). The need to use some particular job aid, such as a checklist procedure. The need to know some particular fact, relying on operator knowledge. Using this technique, the subfunctions of this engine display example produced 16 unique steps or tasks. These 16 tasks were then further decomposed until one of the three criteria, from the preceding list, was met. This decomposition produced 35 subtasks, with the first 3 shown in Table 5.1. The final portion of the analysis phase is the definition of the information requirements. This step requires the identification of all information that the operator will need to perform the tasks. The information requirements are then described, where the information is characterized so that it may be directly applied to the picture specification. That is, the properties (e.g., the required range of usage, the number of variables, the number of dimensions, the level of accuracy or precision, the intended use of the information) for each information item must be defined during this process. This information characterization is then used to select the most appropriate picture element to convey this information. A detailed analysis for this engine display example is provided in Abbott (1989). Synthesis Phase The second major part of the design process is the synthesis phase. In this phase, the optimum display format, the picture, is defined. This picture is then transformed into an achievable display specification based on implementation constraints identified during this process. TABLE 5.1 Subtask Examples Subtask

Source

1. Obtain takeoff EPR setting from the Takeoff EPR Chart for the airport pressure altitude and temperature

Chart

2. Set the EPR reference indicator (pointer) to the takeoff EPR setting (+/- 0.01)

Operator action

3. Advance or adjust power levers until the EPR value is the same as the reference EPR) (+/- 0.01)

EPR sensor & EPR reference

page_137 Page 138 The development of the picture begins with the selection of appropriate picture elements relative to the information requirements defined during the analysis phase. This picture element selection is based on the information characteristics and the intended use of the information. Though numerous guidelines are available to assist in this selection process (Banks et al., 1983, 1985; Danchak, 1981; DOD, 1981, 1987; Engel & Granda, 1975; Frey et al., 1984; U.S. Nuclear Regulatory Commission, 1981), some expertise is usually required in this selection. After the initial picture elements have been defined, they are grouped together to form the initial picture. This grouping may be based on functional relationships, frequency of use, criticality of information, existing convention, or sequence of use (Gilmore, 1985; Smith & Aucella, 1983). Additionally, consideration should be given to consistency and display density. Following the construction of the initial picture, a mock-up or prototype of the picture format should be created. This prototype is then evaluated with respect to the information requirements and human design considerations. Any deficiencies in the picture should be corrected at this time. In parallel with the synthesis phase, implementation constraints must be identified. These constraints should include the following: revision of existing operating procedures or practices, limited availability of display hardware, physical display size, compatibility and relationships with existing displays, signal or sensor availability, and physical compatibility with existing equipment. At this point in the design, it is not unusual that contention exists between these constraints and the information requirements. The defined picture must now be modified to conform to the identified constraints. Compromises are frequently necessary for either the selection of a picture element or the organization of the picture as a whole. The picture definition, constraint definition, and prototyping-evaluation process are then iterated until an acceptable design is produced. Task-Oriented Display Design An effective design process must consider not only the physical aspects of the system under design, but how that system interacts with the human and the operational environment (MacLeod & Taylor, 1994). To support this idea, the task-oriented display design process is aimed at providing information at a level that is more relevant to the user's needs than traditionally designed displays. The design product should provide information in a form that is more directly related to the user's task, thereby reducing the cognitive workload associated with the use of displayed information. This may require that raw data supplied by the system sensors be processed into a more appropriate representation or presented in a manner that permits easier assimilation. That is, information may be obtained from previously page_138

Page 139 stored data or synthesized from existing data and conveyed through forms that allow easy comprehension. The major focus of this design approach, then, deals with providing information that is appropriate to the task of the user: a task-oriented display design process. This new design approach begins in the traditional design process at the task analysis phase. In the traditional design process, the task analysis and decomposition are repeated until all tasks can be determined by one of the following: the need to read some particular instrumentation (sensor), the need to use a checklist, or the need to know some particular fact (operator knowledge). The key point to the proposed design approach is that the user's task should be decomposed only to a level where relevant information, information fitted for a particular task, can be identified. This relevant information, if not directly provided by the system, should be provided by synthesis from the underlying data of the system. The complementary part of this process deals with providing information in a form that is more appropriate to the user's task. Often, display elements chosen to support a particular task are less than optimum, from the user's perspective, for that task. Frequently, this less-thanoptimum choice is dictated by the characteristics of the available data. If a better display element choice is possible, then data should again be processed or synthesized to support this implementation. An illustration of the relationship of these phases is given in Fig. 5.2. The most significant step in this design process is in understanding the actual task that the user needs to perform. The analysis phase of the tra-

Fig. 5.2. Task-oriented design process. page_139 Page 140 ditional design process is modified, where the focus is now on providing information that more directly supports the user's task. Information Content For this example, EPR (engine pressure ratio) is the traditional, primary information parameter for the engine control task. Also, NN1, N2 (lowand high-pressure compressor rotational speeds, respectively), and EGT (exhaust gas temperature) parameters must be included into the control task during high-power operations to prevent overlimit conditions. The point, however, is that controlling EPR, N1, N2, or EGT is not the actual control task. The task requires the control of engine power (thrust), so controlling engine thrust is the appropriate level of description of the pilot's task (Way, Martin, Gilmour, Hornsby, & Edwards, 1987). Additionally, the monitoring requirements for N1, N2, and EGT overlimit conditions should be integrated into the design for the control display element. A similar approach may be taken with the monitoring task. For this task, the pilot must determine not only whether a system is operating within its normal limits, but also whether the system is operating within its limits but with degraded performance. Currently, this latter capability is based solely on pilot experience and training. To aid the pilot in this part of the monitoring task, the system should provide an estimate of the expected value of each parameter. By providing this estimate, a comparison of the actual value with the estimated value may be made. This ''expected" information should reduce the pilot's uncertainty regarding the performance of each parameter in the system. A comparison of the task decomposition endpoints is given in Table 5.2. Information Form The second half of this task-oriented concept deals with providing information in a form that is more appropriate to the user's task. Often, less than ideal information forms (picture or display elements) are dictated by TABLE 5.2 Task Decomposition Endpoints Traditional Design

Task-Oriented Design

The need to obtain information from the plant equipment

Relevant information can be identified

The need to use a job aid.

The need to use a (provided) job aid.

The need to know a fact.

The need to know a (provided) fact.

page_140 Page 141 the characteristics of the available data. An alternative display element may be more appropriate, relative to the user's task (how the information is to be used), but may not be a viable choice because of the characteristics of the data. The concept proposed for this part of the design process is to determine if the data can be manipulated to match the requirements of this more appropriate display element. At the start of the synthesis process, picture elements are selected in a manner similar to the traditional design approach. The emphasis during this selection, however, will be on choosing picture elements that best support the user's task, not the elements that best fit the data characteristics. If a candidate picture element is selected that is not supported by the data characteristics, the process goes back to the information requirements to determine if the data may be manipulated to support the picture element selection (Fig. 5.2). It should be noted that this selection may affect the task definition (the level in the task decomposition chain at which the lowest subtask is defined). That is, a picture element may provide the capability to present information at a higher, more relevant level in the task decomposition chain, much in the manner of the relevant information concept discussed previously. In this respect, the process is bottom-up, with the information form dictating the information characteristics as well as affecting the relative level of the task in the task decomposition chain. If the display elements from a traditional design were examined in the context of the monitoring task, it would be seen that there is usually an individual display element for each of the monitored parameters. However, for this task-oriented approach, it is noted that the pilot's primary monitoring task (which would appear earlier in the task decomposition chain) is to determine whether the engine, as a whole, is operating properly. With regard to the overall monitoring task, then, the selected display elements should aid the pilot in the rapid detection of existing failures and support the pilot in predicting potential problems. Additionally, it should be realized that although individual display elements may be of an optimum design, the effect of the integrated display may be more important than the effect of any individual element. Therefore, a large design payoff may come from a concerted optimization of a large number of display elements. To provide a rapid detection capability, status (binary) indicators are typically recommended. Status indicators, however, are not suitable for the prediction (trend) requirements generally associated with these parameters. What is really needed for this task is a display element or set of display elements that provide quantitative information in a form that may be cognitively processed in a qualitative manner. That is, the most appropriate form for this task may be some display element or elements that provide quantitative information but are presented in a manner that page_141 Page 142 takes advantage of the human's pattern recognition capabilities. By examining the existing literature for various graphical means of presenting multivariate data (Danchak, 1981; Jacob, 1978; Jacob, Egeth, & Bevan, 1976; Mahaffey, Horst, & Munson, 1986; Munson & Horst, 1986; Myers, 1981), several likely display elements were found, the most promising being the column deviation graph (Fig. 5.3), with the deviation being that from the estimated or expected value described earlier. For several reasons, the column deviation graph appears to be an advantageous display element for this monitoring task. First, this type of display element does allow for holistic processing (pattern recognition) by the human. That is, the reaction time for the detection of abnormal system status does not increase as the number of parameters is increased (Mahaffey et al., 1986). Second, the general form of presentation for each parameter is an analog column. Thus, quantitative data, and therefore predictive capabilities, are provided. Finally, the value that the deviation is based on may be the expected value (from the first part of this design process) for that parameter, thereby merging the content of the information with the form. Although the column deviation graph may seem to be an ideal presentation form for this monitoring task, it should be noted that this display element requires unidimensional data (single dimension, e.g., temperature) (Banks et al., 1985). However, the combined information characteristic for these parameters is multidimensional. By normalizing the deviation of each parameter with its maximum expected value (or range), it was found that this display element could be supported. Thus, the underlying data are processed to support this implementation. At this point, the overall concepts of the task-oriented design process have been described. In this process, the user's task is decomposed only to a level where relevant information can be identified (thrust instead of EPR). This is in contrast to the traditional process, where the user's task is

Fig. 5.3. Column deviation graph. page_142

Page 143 usually decomposed to a level where a raw data source can be identified. The second, complementary half of this proposed concept deals with providing information in a form that is more appropriate to the user's task. In doing so, it may be necessary to process or synthesize data to support this implementation. This new design process, then, is directed toward providing task-oriented information, both in content and form, to better support the needs of the user. In doing so, a reduction of the user's cognitive workload associated with the use of this information should be possible. Evaluation Method Task-Oriented Display The display format produced to demonstrate this task-oriented designed approach is the Engine Monitoring and Control System (E-MACS) display. The two major elements, for the control and monitoring tasks, are as follows: 1. The display element for engine control was the thrust indicator (see Fig. 5.4), with 100% defined as the maximum available thrust (MAT) without exceeding any engine limit. This MAT was a value computed from a simplified, "expected" engine model (the same model that provided the estimates for the monitoring task). This value was shown, in pounds, at the top of the thrust indicator. In addition, the following elements were part of the thrust indicator: Thrust warning limit: The thrust warning limit, which was the MAT, was shown by a red range marking on the thrust scale and always began at

Fig. 5.4. Thrust indicator. page_143 Page 144 100%. Under normal operations, no other engine parameter (N1, N2, or EGT) would be within a warning area unless the current thrust value was in the warning area. Thrust caution limit: The thrust caution limit is similar to the thrust warning limit, but was based on a computed maximum-continuous thrust value. Thrust reference pointer: For takeoff conditions, a thrust reference pointer was displayed on the thrust indicator. Thrust predictor: An estimate of the commanded thrust, based on current ambient conditions and control position, was computed from the expected engine model. This estimate was presented both as a predictor column and as a predictor pointer. The predictor pointer included a digital readout, in percent of MAT, of the predicted thrust. Current thrust: The current thrust, normalized by the MAT value, was displayed as a column on the thrust indicator. This design approach has two advantages. First, the position on the indicator for maximum allowable power always remained the same. This provided the pilot with a fixed, visual reference location, thereby reducing visual scan time. Second, the thrust predictor, based on the expected engine model, provided an independent check between commanded and actual engine power. 2. The major display element used for monitoring was a deviation indicator (see Fig. 5.5). In general, this indicator would show a difference between the actual value and the expected value for each engine parameter. Because this indicator presented the difference between actual and expected (or limit) conditions, the size of the column was a direct indica-

Fig. 5.5. Deviation indicator. page_144 Page 145 tion of the severity of the problem. The indicator itself was divided into normal, caution, and warning ranges for differences both above and below the estimate. As an additional cue, each column was color coded to the associated value of the column (green, yellow, and red for the normal, caution, and warning regions, respectively). Under nominal operating conditions, then, the height of a column usually showed the deviation or difference from the expected value for that parameter. However, conventional operating limitations should also be considered whenever any parameter approached an operating limit. For example, under very high thrust conditions the EGT may be operating in the conventional caution region (535 570 °C for this engine). If the engine is operating properly under these conditions, the actual EGT value and the expected EGT value would be roughly equal. Therefore, little or no deviation would exist. However, because the pilot needs to be aware that the EGT is operating in the conventional caution region, the limitation value was combined with the deviation value whenever a parameter approached any operating limit. In this example, the column representing EGT would just begin transitioning into the caution area as the EGT value reached 530 °C. Additionally, each deviation column element included a digital presentation of the actual value. This digital readout was displayed in the same color as the associated column. The overall integration of these display elements into the completed E-MACS display for a two-engine aircraft is shown in Fig. 5.6. This integration or grouping of display elements was based on the layout of an equivalent, traditional engine display. This traditional engine display, described in the next section, was used as a basis for comparison during the display concept evaluation. The comparable grouping of display elements in the E-MACS display was done to alleviate this grouping effect in the evaluation.

Fig. 5.6. E-MACS display. page_145 Page 146 Traditional Display To validate this task-oriented design concept, the E-MACS display was evaluated against a state-of-the-art electronic engine display format. This display format was based on the Boeing 757 Engine Indication and Crew Alerting System (EICAS) display (The Boeing Company, 1983; Broderson, 1984; Ropelewski, 1982). The EICAS display is based on traditional design practices and has proven to be superior to the conventional electromechanical instruments that it replaced (Parke, 1988). The implementation of this display was tailored for the aircraft engines used in this study. The most significant information parameter for this baseline display involves data relating to EPR. The EPR display element, shown in Fig. 5.7, includes the EPR reference, which was presented both as a digital value and as a pointer on the dial circumference. Similarly, the actual EPR value was presented digitally and by the pointer on the dial. The digital presentation provides the pilot with a precise indication of the EPR value, whereas the dial and pointer provide the pilot a means of estimating and predicting the EPR value during dynamic conditions.

In addition to the movement of the EPR pointer, an alternative means for estimating EPR was provided by the EPR predictor arc. This arc appeared on the display whenever the actual EPR value and the commanded EPR value were dissimilar. An EPR warning limit was shown by a red range marking on the EPR dial and was a continuously computed maximum limit based on current ambient conditions. An EPR caution limit, shown by a yellow range marking on the EPR dial, was provided in a similar manner. An additional cue was provided whenever the EPR was within either the warning or caution region. The digital EPR value, usually presented in a white color, was displayed in yellow or red during operations in these regions. The display element for EPR, then, furnished EPR reference information through a digital display element, providing an exact display of the EPR reference, and a reference pointer, which was used with the actual

Fig. 5.7. EPR display element. page_146 Page 147 EPR pointer. EPR trend information was provided implicitly by the motion of the actual EPR pointer and explicitly by an EPR predictor arc symbol. Precise EPR information was provided by a digital display element that could be used with the digital element for EPR reference to determine if the engine power was set correctly. Operating ranges were dynamically provided. Alert cueing was provided by color coding the digital element for actual EPR. The total integration of these features resulted in a sophisticated and easy-to-use display of EPR information. The dial portions of the display elements for N1, N2, EGT, and fuel flow (FF) were similar to the EPR dial, with the ranges appropriate for the particular parameter. As with EPR, a digital display element for the actual value of the parameter was provided. Warning and caution range markings (fixed values), were provided for N1, N2, and EGT. Like the EPR display element, the color of the digital element corresponded to the operating region of the parameter. Because of their generally stable characteristics, the oil system parameters were presented in a slightly different manner. Each of these parameters was presented by a combination of a linear scale with a moving pointer and a digital display element. The linear scale was partitioned into the appropriate normal, caution, and warning regions for the parameter. An example illustration, using the oil pressure parameter, is given in Fig. 5.8. The overall integration of these display elements into the baseline display is shown in Fig. 5.9. The display was physically presented on two CRTs (cathode-ray tubes) in a left-to-right arrangement. This particular left-to-right arrangement was a constraint imposed by the cockpit layout that was used in the experimental evaluation phase of this study. (The E-MACS format was arranged in a similar manner.) The original EICAS arrangement was slightly modified to conform to this layout. The actual EICAS implementation in the Boeing 757/767 aircraft is provided by two CRTs in a top-to-bottom arrangement.

Fig. 5.8. Oil pressure display element. page_147

Page 148

Fig. 5.9. Traditional engine display. Simulator The aircraft simulator used in this evaluation was a fixed-base cockpit configured as the research cockpit of the NASA (National Aeronautics and Space Administration) Transport Systems Research Vehicle airplane (Reeder, Schmitz, & Clark, 1979). The engine model included in this simulation was a nonlinear, engineering model of a Pratt and Whitney JT8D-7 turbofan engine. No additional alerting, except what was provided by the displays, was furnished. Subjects Sixteen pilot-subjects were used in this evaluation. All of the subjects were qualified in multiengine jet airplanes. Each subject was briefed prior to the simulation test with respect to the display formats, the aircraft cockpit systems, and the evaluation tasks. This briefing was followed by the subject taking a written quiz on the critical engine parameters for the aircraft engine used in this study. Procedure The simulator evaluation began after the pilot briefing. This evaluation included a 2-hour familiarization and a preliminary subjective rating of both formats. This familiarization was followed by two 15-minute quantitative tests. The evaluation was concluded with the completion of a final subjective questionnaire. Because no demands were placed on the subjects that were specific to the simulated aircraft, the simulator familiarization and preliminary evalpage_148 Page 149 uations were performed concurrently. Additionally, because all the subjects were generally familiar with the traditional format, all of the preliminary evaluations began with this format. For the preliminary evaluation of each display format, the subjects were provided with flight scenarios that included normal, out-of-tolerance, and degraded (within limits but incorrect) engine systems conditions. The majority of the scenarios involved a takeoff task, because this task is generally the most engine-system critical. The takeoff conditions included a wide range of aircraft weights and airport elevations. Again, it should be noted that no caution or alerting system, except what was provided by the E-MACS or traditional engine display, was available. Following the preliminary evaluations, a quantitative evaluation was performed for each of the two formats. In this quantitative evaluation, the subjects were required to detect out-of-tolerance and failure conditions. This evaluation was a within-subjects design blocked by display format, phase of flight, and failure condition. During this part of the overall evaluation, one half of the subjects began with the traditional format and the other half began with the E-MACS format. For each display format, the subjects were required to perform two takeoff and two inflight tasks. The subjects were advised that system failure scenarios would be randomly included in these tasks. In actuality, the order of the failure scenarios was random, but one failure and one nonfailure scenario were included in each task pair (takeoff and inflight). The scenarios used for this portion of the evaluation were similar to those used earlier with the following noteworthy exception: The displays were shown for only set periods of time; except for those time periods, the CRT displays were electronically blanked. The time periods used were based on a prior analysis of visual dwell-times obtained under simulated full-mission, full-workload conditions of similar scenarios. No scenarios were repeated for any one subject. The test was concluded with the completion of a final subjective evaluation questionnaire. Evaluation Results A six-question, comparative questionnaire was administered twice, once just prior to the quantitative evaluation (at the completion of the pilot training) and once immediately after this evaluation. The six questions were: 1. Overall, which display format did you find easier to use? 2. In which display format did you find engine control easier? 3. Which display format allowed the faster setting of engine power? page_149

Page 150 4. Which display format allowed the more accurate setting of engine power? 5. In which display format did you find engine monitoring easier? 6. Which display format allowed the faster detection of out-of-tolerance conditions? Differences in the subjective ratings of the displays were deemed experimentally significant only if the average rating was at least 20% to the left or right (favoring the traditional or the E-MACS display) of the center, ''no difference" rating. The 20% value was chosen prior to the data analysis as a level for practical significance and was equivalent to one block on the questionnaire response. The responses to the questionnaire administered at the end of the training showed a preference for the E-MACS display. A general preference, with regard to ease of use, was observed for this display with an average rating of 4.2 on a scale of 1 to 5 (where a rating of 1 was defined as a total preference for the traditional display and a rating of 5 was defined as a total preference for the E-MACS display). Preferences were also shown for the E-MACS display regarding the monitoring task (two questions), with ratings of 4.4 and 4.5. In examining the responses to the questionnaire administered after the quantitative evaluation, pilot preferences were again shown for the EMACS display. All of the responses were experimentally significant, with ratings of 4.7, 4.4, 4.2, 4.3, 4.8, and 4.9 for Questions 1 to 6 of the six-question questionnaire. It is assumed that forcing the subjects into time-critical situations, as was done for the quantitative evaluation, caused the change in subjective ratings relative to those collected after the preliminary trials. The analysis of the quantitative data substantiated the qualitative results. During the quantitative testing, a total of 32 degraded or out-oftolerance conditions was presented for each display. When the subjects were using the E-MACS display, all 32 failure cases were properly identified. With the traditional format, 14 failure cases were not identified; 4 of the cases were out-of-tolerance conditions and the remaining 10 were degraded conditions. The differences in the overall detection of failures, the detection of degraded conditions, and the detection of out-oftolerance conditions between the two displays were statistically significant at the 95% confidence level (where the hypothesis that there was no difference between the displays yielded a chi-square of 17.92, 14.55, and 4.57, respectively, where chi-square0.05;1 = 3.84). The overall results of this evaluation showed a favorable difference in both the user's subjective assessment and failure detection rate (and therefore a reduction in what is typically termed "operator error") for the task-oriented display. These results confirm the premise that providing inforpage_150 Page 151 mation that is tailored to the user's task, both in content and form, increases the user's ability to utilize that information. Summary The intent of this effort was to define and assess a display design process oriented toward providing information at a level that is more relevant to the user's task than traditionally designed displays. This concept is a modification of the traditional design process and was based on the premise that the capabilities provided by modern, graphics-based display systems should be exploited in the design process. The primary modification to the design process was to decompose the user's task only to a level where relevant information can be identified. This relevant information, if not directly provided by the system sensors, should be provided by synthesis from the underlying data of the system. A second, complementary part of this concept dealt with providing information in a form that is more appropriate to the user's task. Often, picture elements chosen to support a particular task are less than optimum, from a user's standpoint, for that task. Frequently, this less-thanoptimum choice is predicated on the characteristics of the available data. If a better picture element choice is possible, then data should be processed or synthesized to support this implementation. In this respect, the design process is bottom-up, with the information form dictating the information characteristics. A brief description of this concept with a design example was provided. This example was then evaluated against a functionally similar, traditional display. The results of this evaluation showed that a task-oriented approach to design is a viable concept with regard to reducing user error, increasing acceptance, and reducing cognitive workload. The goal of this design process, providing task-oriented information to the user, both in content and form, appears to be a feasible mechanism for increasing the overall performance of human-system interaction. References Abbott, T. S. (1989). Task-oriented display design: Concept and example (Report No. TM 101685). National Aeronautics and Space Administration, Washington, DC. Banks, W. W., Gilmore, W. E., Blackman, H. S., & Gertman, D. I. (1983). Human engineering design considerations for cathode ray tubegenerated displays (E. G. and G. Idaho, Inc., U.S. Nuclear Regulatory Commission Report No. NUREG/CR-3003). Idaho Falls: Idaho National Engineering Laboratory. Banks, W. W., Hunter, S. L., & Noviski, O. J. (1985). Human factors engineering: Display development guidelines (Lawrence Livermore National Laboratory, Report No. UCID-20560). Livermore, CA: Lawrence Livermore National Laboratory. page_151

Page 152 The Boeing Company. (1973). Model 737-100 operations manual (Vol. 1, Tech. Doc. No. D6-2737-100). Renton, WA: Author. The Boeing Company. (1983). Boeing 757-200 systems (Tech. Doc. No. D6-76549R5). Renton, WA: Author. Broderson, D. (1984). Living with EICASOperational experience to date on the 757 and 767 (SAE Paper No. 841506). Warrendale, PA: Society of Automotive Engineers. Danchak, M. M. (1981). Techniques for displaying multivariate data on cathode ray tubes with applications to nuclear process control (E. G. & G. Idaho, Inc., U.S. Nuclear Regulatory Commission Report No. NUREG/CR-2086). Hartford, CT: The Hartford Graduate Center. Department of Defense. (1981). Human engineering design criteria for military systems, equipment and facilities, military standard (No. MILSTD-1472C). Washington, DC: U.S. Government Printing Office. Department of Defense. (1987). Human engineering procedures guide, military handbook (No. DOD-HDBK-763). Washington, DC: U. S. Government Printing Office. Engel, S. E., & Granda, R. E. (1975). Guidelines for man/display interfaces (IBM Report No. TR 00.2720). Poughkeepsie, NY: International Business Machines. Frey, P. R., Sides, W. H., Hunt, R. M., & Rouse, W. B. (1984). Computer-generated display system guidelines: Vol. 1. Display design (EPRI Report No. NP-3701). Palo Alto, CA: Electric Power Research Institute. Gilmore, W. E. (1985). Human engineering guidelines for the evaluation and assessment of video display units (E. G. & G. Idaho, Inc., U.S. Nuclear Regulatory Commission Report No. NUREG/CR-4227). Idaho Falls, ID: Idaho National Engineering Laboratory. Jacob, R. J. K. (1978). Facial representations of multivariate data. Washington, DC: Naval Research Laboratory. Jacob, R. J. K., Egeth, H. E., & Bevan, W. (1976). The face as a data display. Human Factors, 18, 189 200. MacLeod, I. S., & Taylor, R. M. (1994). Does human cognition allow human factors (HF) certification of advanced aircrew systems? In J. A. Wise, V. D. Hopkin, & D. J. Garland (Eds.), Human factors certification of advanced aviation technologies (pp. 163 186). Daytona Beach, FL: Embry-Riddle Aeronautical University Press. Mahaffey, D. L., Horst, R. L., & Munson, R. C. (1986). Behavioral comparison of the efficacy of bar graphs and polar graphics for displays of system status. In IEEE Conference on Human Factors and Nuclear Safety (pp. 1514 1519). New York: IEEE. Munson, R. C., & Horst, R. L. (1986). Evidence for global processing of complex visual displays. In Proceedings of the Human Factors Society, 30th Annual Meeting (pp. 776 780). Santa Monica, CA: Human Factors Society. Myers, R. H. (1981). Methods for presentation and display of multivariate data (Report No. CR-165788). Washington, DC: National Aeronautics and Space Administration. Parke, R. B. (1988, July). New systems/new questions. Business & Commercial Aviation, pp. 65 69. Reeder, J. P., Schmitz, R. A., & Clark, L. V. (1979). Operational benefits from the terminal configured vehicle (Report No. TM 80046). Washington, DC: National Aeronautics and Space Administration. Smith, S. L., & Aucella, A. F. (1983). Design guidelines for the user interface to computer-based information systems (Report No. ESD-TR-83112, MTR-8857). McLean, VA: The Mitre Corp. U.S. Nuclear Regulatory Commission. (1981). Human factors acceptance criteria for the safety parameter display system (Report No. NUREG-0835). Washington, DC: Nuclear Regulatory Commission. Way, T. C., Martin, R. L., Gilmour, J. D., Hornsby, M. E., & Edwards, R. E. (1987). Multi-crew pictorial format display evaluation (Report No. AFWAL-TR-87-3047). Flight Dynamics Laboratory, Air Force Wright Aeronautical Laboratories. Wright-Patterson Air Force Base, OH. page_152 Page 153

Chapter 6 Cognitive Engineering: Designing for Situation Awareness John M. Flach Wright State University, Dayton, OH Jens Rasmussen HURECON, Denmark

The term situation awareness was coined by pilots to articulate the degree of adaptation between a pilot and a work environment. High situation awareness indicated that the pilot was well adapted to the demands of the dynamic work environmentthat the pilot had a full and accurate understanding of the task, that the pilot could see each element within the context of the overall mission, that each element fit into a coherent picture, and that the pilot was in synch with the demands of a dynamic task environment. Low situation awareness referred to an experience of being lost, an experience of a jumbled complex of elements with no apparent coherence, an experience of slipping behind and not being able to keep up with the demands of a rapidly changing task environment. The construct of situation awareness provides a good introduction to the field of cognitive engineering. A fundamental goal of cognitive engineering is to design systems that allow for adequate situation awareness. For the aviation domain, cognitive engineering considers how best to support pilots and the other humans (e.g., air traffic controllers) whose job it is to make the system function safely and efficiently. In order to provide the best support, cognitive engineers must understand both the "situation" and "awareness." For the cognitive engineer, situation refers to one side of an equation and awareness to another side. The goal is to bring the two sides of the equation into a stable, balanced configuration that meets the prescribed goals for the system (e.g., that transports passengers quickly, safely, and economically from one location to another). An implicit page_153 Page 154 assumption of cognitive engineering is that the human controller is well motivated. In other words, the assumption is made that the human's goals are congruent with the system goals. In this case, if the humans have adequate situation awarenessif they understand the situation and can anticipate the consequences of various actionsthen it is assumed that they will choose the actions that are most consistent with the system goals. Thus, the focus of cognitive engineering is on understanding with little consideration given to motivation. The first section of this chapter addresses the issue of situations. What is a situation and what are the best ways to represent the situation so that designers can fully appreciate the cognitive and performance requirements that must be satisfied for successful adaptation? The second section of the chapter addresses the issue of awareness. Here the ability, capacity, and predilections of the cognitive agent come into consideration. The final section discusses the process of analyzing distributed cognitive systems. Understanding Situations Most often the pilot uses visually perceived relationships between objects or indicators, with some auditory, kinesthetic, and vestibular cues. When one attempts to verbalize this type of information for purposes of analysis, the greatest danger occurs from the natural tendency to abstract. Verbal abstractions are easily carried to the point at which they lose touch with their referents and hence become nonoperational. . . . However, just as abstraction may cause the analyst to miss the real issues, so also a too specific description may result simply in endless enumeration of details at a sensorimotor level. It can be argued that what the pilot really needs to know is how to move the controls, when to move which control, in what direction how much, and how long. If he knew these things, then he would be able to make a flight. Description at the motor response level is possible, but it would be unproductive because it would completely ignore essential factors operating at more generalized descriptive levelsthings such as weather, the contour of land, and the purpose of the mission. The problem then is to discover the levels of description that are neither so abstract as to be uninformative at the operational level nor so specific as to miss factors operating as generalizations. (Williams, 1980, pp. 11 12, emphasis added) A task analysis is fundamental to any analysis of work. For repetitive manual activities, task analysis is generally implemented as time and motion studies in which each activity is broken down into fundamental elements (e.g., therbligs), and the distribution of these elements across space, time, and effectors (e.g., hands and feet) is analyzed to arrive at the distribution that maximizes efficiency. Human factors expanded the focus page_154 Page 155 of these analyses to include not only physical actions but also mental, information-processing activities (e.g., Berliner, Angell, & Shearer, 1964; also see Fleishman & Quaintance, 1984, for an extensive review of alternative perspectives on task analysis). Although task analysis was expanded to include cognitive activities, it has generally modeled situations in terms of trajectories of activities in much the same way as would be done in time and motion studies (e.g., Drury, Paramore, VanCott, Grey, & Corlett, 1987). Cognitive engineering, however, takes a very different perspective on situations as noted in the following passage from Marr (1982): Almost never can a complex system of any kind be understood as a simple extrapolation from the properties of its elementary components. Consider, for example, some gas in a bottle. A description of thermodynamic effectstemperature, pressure, density, and the relationships among these factorsis not formulated by using a large set of equations, one for each of the particles involved. Such effects are described at their own level, that of an enormous collection of particles; the effort is to show that in principle the microscopic and macroscopic descriptions are consistent with one another. If one hopes to achieve a full understanding of a system as complicated as a nervous system, a developing embryo, a set of metabolic pathways, a bottle of gas, or even a large computer program, then one must be prepared to contemplate different kinds of explanation at different levels of description that are linked, at least in principle, into a cohesive whole, even if linking the levels in complete detail is impractical. (pp. 19-20) Situations are not seen in terms of activities or components (i.e., humans and machines), but in terms of global constraints (e.g., stability). This shift in focus is analogous to the shift in physics from particle theories to field theories. For example, gravity can be modeled in terms of a pull between two particles or in terms of a gravitational field. As Feynman (1965) noted, the particle and field theories are equivalent mathematically, but are not equivalent in terms of "suggesting . . . guesses about what the laws may look like in a wider situation" (p. 53). Physics has discovered that field descriptions generally lead to better guesses about the laws of matter. Cognitive engineers take a similar position. The belief is that descriptions of situations in terms of constraints (e.g., safe field of travel) will lead to better guesses about "what matters" (Flach, 1994; Flach & Dominguez, 1994; Flach & Warren, 1995a). Marr (1982) suggested that constraints for an information-processing system might be described at three different levels of abstraction. Rasmussen (1986; Rasmussen, Pejtersen, & Goodstein, 1994) has suggested five levels for describing the constraints in complex work domains. In the following section, we attempt to emphasize the parallels in Marr's and Rasmussen's

page_155 Page 156 descriptions for the constraints that shape performance of complex systems. Although Marr focused on artificial and natural visual systems, we think that the idea of describing multiple levels of constraints as a mechanism for understanding a complex system has broad implications. Consistent with Marr we distinguish three levels to organize the following sections, but we use Rasmussen's levels to give further elaboration and differentiation within the three-level nested hierarchy. The top level represents the fundamental purpose-related constraints. This level represents the boundaries that are "given" at the start of the design process. It includes goals for the system and the natural laws that bound the space of solutions for those goals. The middle level includes the organizational constraints. This level shows how the system is organized in terms of functional components or steps. Each component represents a transformation on inputs to generate outputs. The lower level addresses the function allocation and hardware issues. Fundamental Constraints: The Problem "Givens" What is the goal of the computation, why is it appropriate, and what is the logic of the strategy by which it can be carried out? (Marr, 1982, p. 25) This level addresses the defining or essential properties of a problem. Here the question arises as to what is the function of the system. Why does it exist? For designed systems the question of why reflects the "intentionality" of the designer. Emphasis is on function. Rubin (1920) emphasized the importance of a functional perspective for understanding mechanical devices such as a camera. He found that consideration of purpose played a major role in the course of analysis. He conceived all the elements of the shutter in light of their function in the whole. Once their function was known, how they worked was immediately clear. The question of why encompasses more than just the intentionality of the system; it also requires that the lawful (both physical and logical) constraints that bound the space of possible solutions be considered. For example, Marr (1982) wrote: Trying to understand perception by studying only neurons is like trying to understand bird flight by studying only feathers: It just cannot be done. In order to understand bird flight, we have to understand aerodynamics; only then do the structure of feathers and the different shapes of birds' wings make sense. (p. 27) We would extend the argument to human flight. The decisions and behaviors of pilots make sense only in light of considerations of the lawful constraints (e.g., aerodynamics) that set boundary conditions on the space of possibilities. page_156 Page 157 Rasmussen differentiated two levels for understanding the essential properties of a problemfunctional purpose and abstract function. The functional purpose level describes the goals and values that constrain performance in a functional system. The goals are defining attributes of a system. Most complex systems have a few global goals that often pose conflicting demands on the humans within the system. In commercial aviation the goals might be to transport passengers from one location to another in a safe, convenient, comfortable, and profitable way while operating within the boundaries established by legislation, union agreements, and company strategy. In tactical aviation, the goals might be maximum damage to a target with minimal collateral damage to self and civilians. Obviously, the goals often come into conflict. The safest, most convenient, and most comfortable means of transporting passengers will not always be the most profitable. Thus, a value system provides the context for judgments about what is safe enough, convenient enough, comfortable enough, and profitable enough. In a similar way, combat pilots must weigh the probability of destroying targets against the risks to themselves and to civilians. Trade-offs among the various goals obviously must be considered in the design and management of the system (e.g., in determining regulations for minimum separations between aircraft within a terminal control area, or in determining rules of engagement for tactical aircraft). In addition, these goals and the related value systems provide an important context for every decision and action made within the system. For example, the pilot must weigh passenger safety against convenience and profit when deciding the appropriate response to threatening weather or an engine malfunction. It would be impossible to fully understand and evaluate a pilot's performance without some knowledge of the goals and value systems that constrain that performance. However, as just noted, knowledge of the goals and values is not sufficient to understand and evaluate performance. Performance is also bounded by physical laws. This is what Rasmussen referred to as abstract functional constraints. For aviation the physics of aerodynamics sets fundamental boundaries on performance. These laws are critical to defining the safe "field" of travel. For example, laws of aerodynamics specify the minimum air speeds to avoid stalls, the appropriate trim configurations for landing and taking off, the couplings between the control axes (e.g., between roll angle and change in heading), and so on. In addition to laws of aerodynamics, other physical laws create important constraints on what matters. For example, the physics of materials determines the maximum forces or strains that a wing can withstand; the biophysics of humans determines the maximum g-forces that a pilot can withstand; and the laws of communication theory might determine the bandwidth of a particular sensor channel including the human. page_157

Page 158 Together the functional purpose and abstract functional constraints determine the space of possibilities for a work domain. They determine what can be done and provide a normative framework for addressing questions of what ought to be done (e.g., questions of minimal and maximal criteria and optimality). Figure 6.1 illustrates how these constraints might come together to determine a safe field of travel for lowaltitude flight. In this diagram, the vertical axis represents altitude above ground level. The horizontal axis represents rate of change of altitude with the right half representing decreasing altitude and the left half representing increasing altitude. The lower bound on altitude is represented by the ground. The upper bound on altitude reflects the risks associated with detection by enemy radar. Contacting or passing through either boundary at high velocity is clearly undesirable. The curved path connecting the upper and lower altitude boundaries reflect simple equations of motion for an inertial system. Given this simple dynamic, then any point outside (to the right of the rightmost curve or to the left of the leftmost curve) of these boundaries means that collision with the ground or ceiling is inevitable. There is no action that will prevent a "crash." These boundaries give meaning to regions within the "state space." The dotted line represents psychophysical limits for distinguishing altitude and speed. These limits might increase with the magnitude of the judged variable according to Weber's law. Thus, in a single diagram the joint impact of values, physical laws, and information-processing constraints is represented.

Fig. 6.1. A slice of the state space for low-level flight. page_158 Page 159 Safe regions can be distinguished from dangerous regions. The boundaries illustrate "what matters." Certainly, Fig. 6.1 is a gross simplification of the constraints that determine the actual safe field of travel. A complete representation would have to include all six axes of motion and at least the first derivative for each of these. Building such a representation could be quite challenging. In fact, it would be impossible to completely survey all the physical laws that might be relevant within a domain such as aviation. But it is not necessary to know everything about aeronautics, materials, electronics, and so forth, to make smart choices about how to design effective systems. Approximations and lumped parameter descriptions will often be adequate. The particular functional goals for a system will often provide a context for determining what aspects of the physical laws are most relevant and for determining what approximations and lumped parameter descriptions are adequate. In this sense, the functional purpose of the system provides a context or filter for evaluating the many parameters that determine the abstract functional constraints. Smith and Hancock's (1995) state space description for collision avoidance is an example where a lump parameter description is used to represent the problem of collision avoidance. They used this representation as a normative context for evaluating situation awareness. It is interesting that Marr wrote that Gibson's (1966) functional approach was "the nearest anyone came to the level of computational theory" for perception (p. 29). Relative to Gibson, however, Marr chose a very narrow range of computational constraints to consider for understanding vision. Marr treated vision as an end. Thus, he tended to focus on constraints as reflected in issues such as stereopsis and structure from motion. Gibson, on the other hand, emphasized more global functions involved in adaption and survivalfinding food, finding a mate, avoiding predators, and control of locomotion. For Gibson, vision was not an end, but a meansa means that could be best understood in the context of the ends to which it was applied. Gibson thought it best to approach vision from the perspective of these more global functions. Thus, where Marr focused on a visual system, Gibson focused on a human-environment system, where vision played a critical role. For Gibson's approach, considerations such as the mode of adaptation (e.g., prey vs. predator) and/or the mode of locomotion (e.g., walking vs. flying) were critical constraints to consider when trying to understand vision. Marr placed much less emphasis on such constraints. Rasmussen's abstraction hierarchy has taken a perspective more similar to Gibson's than Marr's. Decomposing the system into perception and action subsystems each with particular goals (e.g., to see) will generally be inappropriate for understanding work domains like aviation. Such a decomposition will be more appropriate for lower levels of abstraction page_159

Page 160 (i.e., general function). At the functional-purpose level of description, perception and action are always coupled, in that function implies action, and controlled, purposeful action implies feedback (i.e., perception). A concise description of the essential functional constraints can be fundamental for understanding and predicting performance in complex domains. Kirlik's (1995) dissertation on modeling performance of a complex helicopter simulation provides a good example of how powerful such a description can be. In many cases, performance of a skilled operator will be almost completely determined by the computational constraints. The skilled operator becomes a mirror that reflects the task constraints (i.e., consistent mappings, invariants). Hutchins' (1995a, 1995b) analyses of ship navigation and of aviation cockpits also are good illustrations of the importance of considering the computational constraints when trying to model cognitive work. Also, Rasmussen et al. (1994) emphasized the role of constraints in their discussion of cognitive engineering (e.g., see their Figs. 6.3 & 6.4). Software: Organizational Constraints How can this computational theory be implemented? In particular, what is the representation for the input and output, and what is the algorithm for the transformation? (Marr, 1982, p. 25) Rasmussen referred to this level of constraint as the level of general function. At this level, focus is on the organizational constraints that determine the flow from input to output. For human-machine systems this flow is often described as a functional flow chart and is generally represented as a block diagram. Figure 6.2 shows a sketch of possible functional stages for a commercial flight. Each stage would then be evaluated in terms of the inputs and the outputs. For example, in the preflight planning phase important inputs would include information about the schedule, route, and destination; information about the weather; information about traffic; and information about the aircraft (e.g., fuel, weight and balance, etc.). Output might include a dressed map, way-point settings, to-do lists and written notes, adjustments to automated control systems, and so on. In the Approach to Landing stage inputs might include the flight instruments, the optical flow field (e.g., focus of expansion, h-angle, global opti-

Fig. 6.2. A sketch of possible functional stages for a commercial flight. page_160 Page 161 cal flow rate, perspective transformations of the runway, etc.), the sounds of the engines, the felt (tactile and vestibular) motion of the aircraft, instructions from air traffic control, and the like. Outputs might include verbal responses to air traffic control, adjustments to automated control systems, and/or direct manual adjustments to the flight controls. To better represent the inputs and outputs and the relations among them, each stage of the diagram in Fig. 6.2 might be exploded into more detailed block diagrams showing the couplings between the various sources of information and the outputs. For the Approach to Landing, this diagram would include many closed-loop paths. The exploding of the individual stages illustrating the microstructure within a stage is an example of a part-whole decomposition. The general function level best illustrates the organizational constraints within a complex system. In order to evaluate the organization (to address questions such as: Is the information complete? Or are the outputs appropriate?), the organization must be seen in the context of the computational theory. Thus, the situation assessment requires attention both to relations within levels of abstraction and to relations across levels of abstraction. See Vicente and Rasmussen (1990) or Bisantz and Vicente (1994) for discussions of how the relations across levels of abstraction contributed to the semantics of situations. Hardware Constraints How can be representation and algorithm be realized physically? (Marr, 1982, p. 25) Rasmussen distinguished two levels of abstraction relative to the hardwarephysical function and physical form. Physical function refers to the nature of the medium used to accomplish a particular function or computation. For example, many of the functional stages of flight can be accomplished manually by the human or by an automatic control system. These media bring very different constraints to the problem. They have different strengths and weaknesses and can succeed or fail in very different ways. For example, automated control systems tend to be precise, consistent, but not very robust (i.e., they will only work well in a limited range of situations in which the assumptions of the control program are met). Humans on the other hand tend to be less precise, more variable, but extremely robust (i.e., they can adapt to a wide range of unexpected events). Function allocation decisions reflect the physical function level of abstraction. What functions should be assigned to the pilot or copilot, to air traffic control, to automated systems? Questions about free flight (a shift in authorpage_161

Page 162 ity from air traffic control to the pilot), about intelligent artifacts (e.g., pilot's associate), and about crew size and team coordination are generally framed at this level of abstraction. But once again, evaluation of the adequacy or appropriateness of a particular allocation of function must reflect both the constraints of the medium and the normative constraints that are defined at higher levels of abstraction. Which medium can best satisfy the goals? Which medium is most sensitive to the lawful constraints? Which medium can best integrate the various of input? Which medium can best translate the input to determine the appropriate output? Which medium has the effectivities required to produce the necessary output? Also, the availability and constraints of the various media may have implications for the functional decomposition (at the general function level) that is appropriate. That is, the decomposition at the general function level may reflect the distribution of function across the media. This is not necessarily so, but may sometimes be useful. Again, it is important to be sensitive to the couplings both within and across levels of abstraction. Rasmussen's physical form level represents the hardware implementation and physical details of the work domain. The relative locations and appearances of the hardware are considered at this level. Properties such as physical ergonomics (e.g., the reach envelop, the field or regard, and field of view), the arrangement of displays and controls, the format of individual displays (e.g., circular or tape display of airspeed, head-up or head-down orientation) and controls (e.g., spring-centered or force stick; shape coding, etc.), and the spatial distribution of components within the aircraft (i.e., what is connected to what and what is near to what) are all considered at this level. In addition, the specific weather conditions, the geography of the flight area, and the topology of the airport are some of the important physical details to be considered. Again, it is important to note that properties of physical form take meaning in the context of the higher levels of abstraction. Hutchins (1995b) provided a nice example of how a simple physical attribute, the size of a marker on a display, can impact the computational demands within a cockpit. Summary: Assessing Situations These three levels are coupled, but only loosely. The choice of an algorithm is influenced for example, by what it has to do and by the hardware in which it must run. But there is a wide choice available at each level, and the explication of each level involves issues that are rather independent of the other two. (Marr, 1982, p. 25) Rasmussen's five levels of abstraction are illustrated in Fig. 6.3. It is important to realize that the different levels represent information about the same physical world. The information used for representation at the varpage_162 Page 163

Fig. 6.3. Any system can be described at several levels of abstraction. When moving from one level to the next higher level, the change in system properties is not merely removal of details of information on the physical or material properties. More fundamentally, information is added on higher level principles governing the cofunctioning of the various elements at the lower level. In human-made systems these higher level principles are naturally derived from the purpose of the system, that is, from the reasons for the configurations at the level considered. ious levels is chosen to serve as a set of links between the representation of the material work environment and its resources on one hand and the representation of the ultimate human goals and objectives on the other. Thus, the means-ends hierarchy is formed by a progressive set of conceptual transformations.

Figure 6.3 shows the different sources of regularity of system behavior underlying the representations at the various levels together with an indication of the directions of the propagation of changes. The higher levels of abstraction represent properties connected to the purposes and intentions governing the work system, whereas the lower levels represent the causal basis of its physical constituents. Consequently, perturbations of the system in terms of changes in organizational goals, management policy, or general market conditions will propagate downward through the levels, page_163 Page 164 giving ''rules of rightness" (Polanyi, 1958). In contrast, the effect of changes of the material resources, such as introduction of new tools and equipment or breakdown of major machinery, will propagate upward, being causes of change. Skill development might be a very appropriate metaphor for the process of cognitive task analysis. The bad news is that, like skill, cognitive task analysis is an asymptotic process that never reaches completion. Cognitive task analysis is never done; there are always opportunities for new discoveries and deeper understanding of a work domain. Plus, work domains are not static things, but dynamic processes that are in a continuous state of evolution. The good news is that there are enormous returns on the early investments in cognitive task analysis. Despite the continuing evolution of technologies and work domains, there is enormous transfer from one stage of evolution to the next. For example, most of the changes will occur at the levels of physical form and physical function. Constraints at the higher levels of abstraction tend to be fairly stable across generations of emerging technologies. A complete understanding of a situation requires that both the emergent properties specific to each level and the loose couplings across levels be considered. Of course, a complete comprehensive cognitive task analysis is only possible for very simple problem spaces (e.g., toy worlds such as those studied in classical artificial intelligence or part task simulations such as Vicente's, 1992, DURESS). For complex work domains such as aviation, the exercise of cognitive task analysis is never complete. This is due in part to the complexity of the distributed cognitive system involved and in part due to the dynamic, evolving nature of the work domain. For this reason, cognitive task analysis needs to be an iterative, ongoing process. It cannot be a task analysis that is completed at the front end of the design process and is then archived on completion. One of the biggest challenges for cognitive engineering is to produce dynamic frameworks for compiling, integrating, and disseminating the information about interacting constraints that is collected over the life of a work domain. Understanding Awareness In the previous section on understanding situations, we outlined levels of description for the problem space or for the problem constraints. In some sense that analysis provides the "lay of the land." The problem space constrains performance and cognition, but it does not determine it. Degrees of freedom remain. There are multiple possible paths across the landscape that will satisfy the functional purposes. In this section, we consider constraints that arise as a result of the resources and limitations of the dispage_164 Page 165 tributed cognitive process. These constraints will further bound the possible paths that will meet the functional goals of the system. Knowledge of these constraints will improve our ability to predict and shape performance of the joint cognitive system. The terms distributed cognitive process (e.g., Hutchins, 1995a, 1995b) and joint cognitive system (Woods, 1986) reflect a belief that "awareness" does not happen exclusively within one person's head. Awareness is a property of the system. It includes information that is distributed among human cognitive agents, but also includes information within other intelligent agents that contribute to the functional computations (e.g., automatic control systems, computers, checklists, maps, and Post-it® notes). Thus, for cognitive engineering the awareness side of the equation takes Hutchins' (1995a) "broader notion of cognition" that applies both to "the interaction of humans with artifacts and with other humans" and to "events that are entirely internal to individual persons'' (p. 118). Figure 6.4 represents a functional flow diagram that attempts to illustrate critical components of awareness. This diagram includes traditional stages of information processing. However, the diagram has been reorganized to emphasize aspects of awareness that have not been well represented in traditional approaches to information processing. Traditional views of information processing have used a communication channel metaphor that emphasizes the linear sequence of transformations with a fixed precedence relation among the processing stages. Most of these representations include a feedback link, but this link is represented as peripheral to the communication channel and the link has largely been ignored within cognitive research programs. In traditional information-processing diagrams, stimulus and response are represented as distinct and distant entities peripheral to the information-processing stream. Figure 6.4 emphasizes the circular, as opposed to linear, flow of information. In this circular flow there is an intimate link between perception and action. Thus, stimulus and response become the same line. Neisser (1976) recognized this circular flow of information in his attempts to make cognitive psychology more ecologically relevant. Recently, work on situation awareness has resulted in a deeper appreciation of Neisser's insights (e.g., Adams, Tenney, & Pew, 1995; Smith & Hancock, 1995). Figure 6.4 also emphasizes that there is no fixed precedence relationship among the processing stages. Rather, the cognitive system is an adaptive system capable of reorganizing and coordinating processes to reflect the constraints and resources within the task environment. The internal set of arrows symbolizes potential links between all nodes in the system. Note that these links are not necessary connections, but potential connections. A critical task for cognitive engineering is to discover the extent to which the utilization of potential links is effected by design decisions. page_165

Page 166

Fig. 6.4. The information-processing system is represented as a dynamic coordination where stimulus and response are intimately coupled and where the links between perception and action are not constrained by structure but are emergent properties of the dynamic. Also, Fig. 6.4 represents the workspace as existing both inside and outside the cognitive system. This emphasizes that the links between processing stages are often the artifacts within the workspace. Again, Hutchins' (1995a) analysis of navigation provides strong evidence that computations are distributed over humans and artifacts and that coordination is achieved within the workspace (as opposed to being accomplished exclusively within the head). The knowledge states shown in Rasmussen's (1986) decision ladder have not been included for simplicity. However, the presence of knowledge states is implied and these knowledge states can exist both in the head (i.e., knowledge of standard procedures, physical principles, etc.) and in the environment (i.e., instructions in a manual, checklists, written notes, graphical interfaces, etc.). Because of the flexibility of this system and the ability to shunt from one pathway to another, processing in this system is not absolutely conpage_166 Page 167 strained by "channel capacity" or the availability of "energetic type resources." The fundamental constraint is the ability to attune and synchronize to the sources of regularity and constraint within the work domain. Rasmussen (1986) characterized this in terms of a dynamic world model. This internal model reflects the largely tacit knowledge that the cognitive agent has about the invariant properties of the work environment. This attunement is constrained by the qualitatively different demands that govern the flow of information within this parallel distributed network. Rasmussen (1983, 1986) distinguished three qualitatively different types of attunement within distributed cognitive systemsskill based, rule based, and knowledge based. The following sections consider each of these qualitatively different types of processing. Skill-Based Processing In skill-based interactions there is a direct link between perception and action. Interaction is based on real-time, multivariable, and synchronous coordination of physical movements with a dynamic environment. Quantitative, time-space signals are continuously controlling movements, and patterns serve to adjust the world model and maintain synchronism with the environment. The performance at this level is typical of the master, or expert, and the smoothness and harmony of an expert craftsman has been fascinating to philosophers, artists, and psychologists throughout the ages. This type of information processing inspired Gibson's (1966) concepts of attunement and direct perception, to describe actors' abilities to utilize invariants to successfully adapt to the demands of their environment. It has also been referred to as "automatic" processing (e.g., Shiffrin & Schneider, 1977). At this level, processing has a reflexive-like quality. That is, the responses follow "automatically" from the stimulus. Automatic processing is typically fast. It is not limited by attentional resources. In other words, it is relatively impervious to interference from other processing activities. This has the positive impact of allowing multiple streams of input to be processed in parallel. It has the negative impact of being impervious to conflicting goals at higher levels of processing. Thus, an automatic process that is appropriate in one context may become activated in a context where it is inappropriate. For example, braking when a car in front of you on the highway slows down (and its brake lights come on) is an example of an automatic process. An inappropriate activation of this process might occur when you are a passenger in the car and you "automatically'' shift your foot to a nonexistent brake pedal. Such inappropriate activations of well-learned, "automatic" processes are called capture errors (Norman, 1981) or skill-based errors (Reason, 1990).

page_167 Page 168 Skill-based or automatic processing arises as the result of extended practice in consistent environments. Consistency (consistent mapping, Shiffrin & Schneider, 1977; or invariance, Gibson, 1966) appears to be a necessary condition for the development of skill-based processing, because extended practice in nonconsistent environments (variable mapping) does not lead to the development of automatic processes. In many respects consistency can be considered to be synonymous with constraint. Thus, skill-based processing reflects an information or computational processes that takes advantage of natural constraints (consistencies, invariants, consistent mappings). This reflects back to the analysis of the situation and reinforces the significance of understanding the domain constraints. This was an important theme for Gibson's (1979) ecological approach to skill. The first step, for Gibson, was an "ecological physics" to uncover the invariants that specified the functional opportunities for an actor. Gibson and others (e.g., Langeweishe, 1944; Lee, 1976) have identified numerous invariant structures in optical flow fields that support skill-based control of locomotion (see Flach & Warren, 1995b, for a review of optical invariants for control of low-altitude flight). Skill-based processing tends to develop most naturally in environments where the consistencies are represented in the space-time properties of continuous feedback that is tightly coupled in time to the control actions. Control of locomotion is a prototypical example where structure in the optical flow field provides a rich information medium that specifies the states needed for skilled control. Rasmussen (1983, 1986) used the term signal to emphasize that skill-based behavior develops when the consistencies are apparent in the space-time structure of the information medium. Tracking a glideslope using an optical flow field, a head-up "highway in the sky" graphic, or a standard head-down instrument landing system display are examples of skill-based processing where signals directly specify relations between actual and goal states. Discovering and attuning to the invariant space-time properties that allow skill-based interactions with an environment do not appear to happen through instructional practices aimed at intellectual understanding. As the Zen master exclaims, "Don't ask questions, practice!" "Do not think about what to do, do not speculate about how to do it. The shot is only proper if it surprises even the archer himself" (Herrigel, 1989). Research on expertise shows clearly that there are no shortcuts to expertise. Practice is the key. A common rule of thumb is the "ten year rule'' that estimates the minimum time for the development of expertise in a domain (e.g., Mayer, 1992). In aviation this has important implications for the use of simulators. On the positive side, simulators provide a relatively safe and inexpensive opportunity for lots of practice under a wide range of conditions. On the negative side, if the simulator does not preserve the critical "invariant" properties of page_168 Page 169 the actual work domain, then practice in the simulator may not translate to skill-based performance in the target environment. Simulations can misrepresent the work domain by including spurious invariants not available in the work domain or by failing to include constraints that are normally available in the work domain. Thus, accurate models of situations are fundamental to the design of effective simulators and training protocols. Similar considerations apply to display design. Graphical displays provide a rich opportunity for cognitive engineers to build representations where the situation constraints are represented in dynamic space-time transformations within the interface. Such representations provide support for skill-based processing. These representations do not cause skill-based processing. Rather, they allow skill-based processing to develop with practice. A major challenge in designing these graphical signal systems is the large number of interacting constraints at different levels of abstraction that could be represented. A number of recommendations have been made about how best to map dynamic geometries onto situation constraints to provide the best possible support for skill-based processing (e.g., Bennett & Flach, 1992; Bennett, Nagy, & Flach, in press; Flach & Bennett, in press; Flach & Vicente, 1989; Rasmussen & Vicente, 1989; Vicente, 1992; Woods, 1991). Rule-Based Processing Like skill-based processing, rule-based processing also depends on consistency. However, for rule-based processing the consistency is generally established through convention rather than through the space-time properties of a feedback signal. Rasmussen (1986) referred to these conventions as signs. Language and text can often function as signs. The icons used in graphical displays are also examples of signs. The spacetime properties of alphanumerics and icons do not correspond to dynamic constraints. However, through consistent association signs can elicit "automatic" type behaviors in which the sign is a direct trigger for an action. The Stroop Task is a classic example of automatic processing of text. Another example is Logan's (1988) work on mental arithmetic. This research suggests that with practice arithmetic operations shift from a controlled computation or counting operation (e.g., a young child counting out a sum on their fingers) to a direct memory retrieval or look-up operation. This shift is made possible due to the consistent mapping of answers to problems and the resulting behavior exhibits many of the properties of automatic processes discussed earlier. Consistency Is Fundamental to Good Cognitive Design When consistencies are present in the work environment (either as space-time properties of signals or as conventions associated with signs) humans will utilpage_169

Page 170 ize those consistencies to increase the efficiency of cognitive processing. Consistency allows the human to coordinate perception and action without direction from higher, more computationally intensive processes. However, in complex environments it is not always possible to maintain consistency. The proliferation of modes is an important challenge to consistency. For example, Rouse, Geddes, and Hammer (1990) reported that "in the F-18, there are over 40 radar modes, more than most pilots know how to use" (p. 38). When these multiple modes are coupled with a control that has a restricted number of possible actions (e.g., the pilot must interact with these modes through a limited number of switches on the control stick), the result is a situation where the same action can have different effects depending on the mode. This leads to what Sarter and Woods (1995; see also Woods, Johannesen, Cook, & Sarter, 1994) described as mode errors. An action is made that is consistent with the intention of the operator, but that is inappropriate for the current mode of operation. A common mode error is when a driver who normally drives a car with a manual transmission reaches for the clutch when operating a car with an automatic transmission. In a system where mode is changing dynamically, consistency will sometimes lead operators down a garden path toward catastrophic errors. To help prevent such errors, it is important to make changes in mode as salient as possible and to build in redundancies and tolerances so that the mode errors will be caught and corrected before they lead to catastrophic failures. Knowledge-Based Processing It is by definition impossible to ensure consistency for unanticipated faults. That is, when variables within a complex system interact in ways that the designers did not or could not predict, then it is not possible to ensure that the mapping from interface to appropriate control action will be consistent with the mapping under normal conditions. It is impossible to have conventions for unconventional events. In these situations, skill-based and rule-based processing will be inadequate. Such situations require knowledge-based processing. Knowledge-based processing will be utilized when there is no direct link between the situation as represented and the appropriate actions. Knowledge-based processing requires the operators to go beyond the surface of the interface. Knowledge-based processing involves interpretation. Thus, choosing the appropriate action requires that the operators use their understanding of a process to develop creative solutions to novel events. This type of processing often involves inferential leaps in the face of ambiguous information. It requires integration of information distributed in space and time. It requires context sensitivity. Knowledge-based processing allows the operator to complete the designto respond to those events and contingencies that were not anticpage_170 Page 171 ipated, appreciated, and/or fully understood by the system designers. Responding to these unanticipated events demands what Wertheimer (1959) called productive thinking. With skill-based and rule-based processing, the operator responds directly to the information presented. Knowledge-based processing requires going beyond the information presented. It requires re-presentation. The literature on problem solving (e.g., Mayer, 1992) shows quite clearly that the creative insight that leads to Aha! solutions to complex problems depends on the ability to discover the appropriate representation. Another important aspect of knowledge-based reasoning involves metacognition, that is, an ability to see the problem in terms of the larger picture that includes a realistic assessment of one's own capabilities and cognitive processes and a prioritization of constraints. As Rasmussen (1986) described: During emergency and major disturbances, an important control decision is to set up priorities by selecting the level of abstraction at which the task should be initially considered. In general, the highest priority will be related to the highest level of abstraction. First, judge overall consequences of the disturbances for the system function and safety in order to see whether the mode of operation should be switched to a safer state (e.g., standby or emergency shutdown). Next consider whether the situation can be counteracted by reconfiguration to use alternative functions and resources. This is a judgment at a lower level of function and equipment. Finally, the root cause of the disturbance is sought to determine how it can be corrected. This involves a search at the level of physical functioning of parts and components. Generally, this search for the physical disturbance is of lowest priority (in aviation, keep flyingdon't look for the lost lightbulb!). (p. 21) Amalberti and Deblon (1992) found that the preflight planning of combat pilots showed the importance of meta-cognitive processes. Pilots took their differential ability levels into account when planning a mission. Novice pilots chose larger, more easily identifiable navigation way points than did expert pilots. Amalberti and Deblon found that much of the knowledge-based processing involved careful preflight planning to avoid unexpected problems. In general, knowledge-based processing is demanding and difficult. An investment of knowledge-based processing in the planning phase of a mission can reduce the need for knowledge-based processing during more risky stages of the flight. For example, Hutchins (1995a) illustrated how the knowledge-based processing that goes into designing a map can allow latter computations to be accomplished using skill-based processing (i.e., drawing lines). Thus, conscious attention at the knowledge-based levels can run ahead to shape the flow of activities and to update the dynamic world model so that the resources for skill- and rule-based processing will be available. page_171 Page 172 The challenge for cognitive engineers is to provide tools that allow the operator to manipulate the problem representation in search of productive solutions. This is a tough nut! How can we know what will be productive for dealing with problems that have not yet been defined? Here work on general problem-solving strategies (e.g., Newell & Simon, 1972; Rasmussen, 1981, 1984, 1986) becomes relevant. The designer has to provide support for general problem-solving strategies that will help the operator to discover the task constraints not presented as signals or signs. In this context, the signals and signs function as symbols, whose deeper meaning must be derived or discovered. This is a particularly tough nut for aviation, because the pilots cannot shut the process down while they study the problem. They have to simultaneously diagnose and maintain the stability of the process. In control theory this is known as the problem of adaptive control or the dual control problem. Skill- and rule-based errors (including mode errors) have been characterized as errors of action (Norman, 1981; Reason, 1990). With these errors the operator has a correct intention; however, the actions are inappropriate to the intention. Knowledge-based errors have been called mistakes (Reason, 1990). These errors involve the formulation of an intention that is not appropriate. The resulting actions are consistent with intentions, but are inappropriate to the task constraints. This distinction between action errors (slips) and mistakes has important implications for the type of design intervention that will lead to improvements. Mistakes represent failures to understand.

Human Error Historically, human error has been a fundamental concern of human factors. A central goal has been the elimination of human error as a primary cause of system failure. It is important to note, however, that the general notion of errors as deviations from some "normal" or "correct" activity path is inconsistent with the field or constraint view being presented here. Within the cognitive engineering perspective on situation awareness, behavior emerges in the situation from interaction with the constraints as perceived in the light of the current goals. The perception and knowledge of constraints (e.g., the dynamic world model) evolves through continuous action and exploration. In this context, errors reflect a trade-off that emerges from exploration of boundary conditions. This trade-off happens at all three levels of interaction. In knowledge-based interactions, hypothesis testing is fundamental to successful problem solving. Ideally, hypothesis testing might be accompage_172 Page 173 plished by qualified personnel such as pilots and process operators through conceptual thought experiments. Mental simulations can be used to anticipate problems and to avoid adverse effects due to acts that may be hazardous and irreversible. Often, however, this is an unrealistic ideal. No explicit stop rule exists to decide when to terminate conceptual analysis and to start acting. Thus, complex, dynamic environments such as aviation, always involve a trade-off between missing the window of opportunity due to indecisiveness and making premature decisions. In rule-based interactions correlations (i.e., consistent mappings) that exist during normal operating conditions will lead to expert know-how and rules of thumb. Experts will know the flow of activity and the action alternatives by heart, and they need not consult the complete set of defining attributes before acting. Instead, they will follow the path of least resistance. They will seek no more information than is necessary for discrimination among the perceived alternatives for action in a particular situation. However, when situations change due to faults or disturbances in the system, the usual cues may no longer be valid. The expert operator may unknowingly follow these normally reliable cues down the garden path to disaster. In short, this is a natural result of the trade-off between a fast, automatic response to familiar cues and spending time on a normally superfluous situation analysis. For skill-based interactions, fine-tuning depends on a continuous updating of automated patterns of movement in relation to temporal and spatial features of the task environment. Updating requires miniexperiments in which test signals are occasionally inserted in order to update the dynamic world model with regard to dynamically changing constraints, for example, tapping the brakes when moving onto wet or slippery surfaces when driving or dithering the stick to test the responsiveness of the flight surfaces to a change in air mass. Thus, in a dynamic environment, attunement is not a steady state, but a dynamic equilibrium that depends on a balance between exploratory and performatory activities. Thus, "errors" are a necessary and natural consequence of the dynamic coupling between a creative, adaptive controller and a workspace. Situation awareness is a product of error. In a very real sense, an adaptive system learns from its mistakes. It discovers the boundaries of stable performance by occasionally contacting these boundaries. In designing complex systems, the focus should be on making the boundaries "touchable." That is, the boundaries should be made observable and the actions that reveal these boundaries should be reversible. To eliminate errors is to undercut the capacity for adaptation. The alternative to eliminating errors is to enrich the information coupling associated with the performance constraints so that the performance envelope is well specified and so that the errors are less likely to escalate into catastrophic events. page_173 Page 174 Awareness: Summary In general, the goal for the designer is to provide a complete representation of the task constraints. Such a representation should support skillbased processing to the extent that these constraints can be presented as space-time signals and rule-based processing to the extent that these constraints can be represented as signs. To the extent that this is possible, the well-trained operator can be trained to automatically respond appropriately to the task demands and there should be little need for knowledge-based processing. In complex, high-technology work domains like aviation, it can be surprising how far designers can go with creative applications of computers and graphical interfaces to minimize the need for knowledge-based processing. However, the need to support knowledge-based processing will never be completely designed out of these systems. For this reason, humans continue to be the last line of defense against catastrophic failures in these systems. A goal of cognitive engineering is to provide them the best tools possible to meet this challenge. Sometimes, information-processing approaches to human factors create the impression that the human is a collection of biases and processing limitations that greatly constrains performance of complex systems. The human is portrayed as the weak link in the system. The focus of human factors design, then, takes the perspective of protecting the system against human error. Cognitive engineering tends to view the human in a more positive light. In many cases, it is the creativity and insight of the human that makes these systems work. The air transportation system and tactical aviation systems work because of the pilots and other personnel, not in spite of them. In considering the knowledge and processing links that pilots contribute to make the system work, it is not just a question of amounthow much knowledge, how many links, and so on. There are important qualitative distinctions in terms of the type of knowledge needed for particular links. In the context of Fig. 6.4, the goal of cognitive engineering is to design systems so that the knowledge states are comprehensive and so that there are adequate links between processing stages to provide efficient and robust application of that knowledge. The goal is to engineer systems that leverage the unique capabilities for awareness that humans bring to these systems against the complex problems that arise. This is an important shift of focus for human factors. In the past, the emphasis has been on utilizing automation to protect the limited human processor from overload. For cognitive engineering the focus is shifted to providing the knowledge base (both explicit and tacit) so that the humans can scale up their processing capacities to meet the demands of the work. There are also important implications for how we approach the problems of system safety (e.g., Rasmussen, 1997, Rasmussen & Vicente, 1989). page_174

Page 175 Work in complex domains like aviation generally includes many degrees of freedom. Thus, error cannot be characterized simply as deviations from prescribed task trajectories. Also, operators will sometime be required to "complete the design" (i.e., solve problems that were not anticipated in the design of the system). This will require hypotheses and tests as the operators explore to discover the relevant task constraints. Errors will be a natural consequence of this search. The knowledge base is built up through this exploration process. In a very real sense, experts are people who survive their mistakes. Thus, safety of complex technological systems should not focus on eliminating human variability, but on making the system tolerant to this variability. Rather than constraining activity, the focus must shift to enhancing the information that specifies the boundaries of stable control. Cognitive Task Analysis As noted at the beginning of this chapter, whereas traditional task analysis has tended to characterize a work domain in terms of trajectories of activities (both observable physical actions and inferred mental operations), cognitive task analysis focuses on the constraints that shape these trajectories. Marr (1982) described these constraints at three levels of abstractioncomputational, algorithmic, and implementation. The first important point to appreciate about cognitive task analysis is that it will be difficult, if not impossible, to differentiate these three levels of constraint in terms of any particular workplace. Within a particular instantiation of a work domain, the different levels of constraints are so intimately coupled that it will be difficult to distinguish the essential, computational constraints from the constraints that arise from a particular algorithmic choice or from a particular implementation of an algorithm. The essential, computational constraints are the invariants common to all algorithmic and physical instantiations. It is generally necessary to examine several different solutions to the same problem in order to discover the essential attributes of the problem. Again, this is well instantiated by Hutchins' (1995a) analysis of navigation. To identify the computational constraints on navigation, Hutchins examined the historical evolution of navigation practice in the Western world and considered practices in other cultures. By examining navigation across historical and cultural boundaries, Hutchins was able to discover the essential computational constraints of navigation and to differentiate these from the constraints that arise from the particular algorithmic solutions that have been adopted by the U.S. Navy. Thus, to understand the computational constraints on civil aviation or on tactical aviation, analysis cannot be limited to a particular air transpage_175 Page 176 portation system (e.g., the Denver hub) or a particular aircraft (e.g., the F-15). These systems must be examined in their historical context. In addition, they must be compared and contrasted to other particular solutions (e.g., the Narita Hub or the Mirage Fighter) and to other general solutions (e.g., other transportation systemsthe highway system or other tactical systemsHannibal's campaigns). Thus, general sources on aviation, aerodynamics, transportation systems, tactics, and so on, should be consulted as part of a cognitive task analysis. To many this will seem an unrealistic demand. The list of sources is endless. It is an impossible task. Remember, however, that the goal is to understand the domainnot simply what is done, but what could and should be done. The general perspective on computational constraints provided by these sources will provide a normative framework against which to fully appreciate any particular solution to a work problem. The understanding will never be complete; the analyses of these general sources must be an integral component of an iterative analysis process that continues throughout the life cycle of a human-machine system. Other important components of this life cycle analysis include all of the traditional task analysis proceduresparticipant and field observations, extensive interviews and discussions with experts and novices within the work domain, walk-through-talk-throughs in which domain practitioners articulate their actions and the logic and reasoning behind these actions, tabletop analysis in which the training manuals, standard practices, regulations, and equipment specifications are examined, cases studies of successes and failures, and controlled simulator and laboratory experiments and studies. Any activity that leads to a better understanding of the domain can be included within the cognitive task analysis. Again, the goal is to understand the domain. There is no recipe, no single formalism, no yellow brick road that will lead to this understanding. Cognitive task analysis is not about ticking off boxes or meeting government regulations. It is not a linear, sequential process, anymore than design is such a process. Work domains are not designed and then used. Complex work domains, such as the air transportation system, are in a continuous iterative design process that continues throughout the life cycle. Cognitive engineering is a fundamental component of that iterative design process. General Conclusions Cognitive engineering is about situations and awareness. However, situations and awareness are not considered two distinct things. Rather, they are two perspectives on the same thing. Situations can only be described page_176 Page 177 relative to an agent. Awareness only has meaning relative to a situation. Situation and awareness are inextricably linked within a coordination. The goal of cognitive engineering is to develop an understanding of the workspace constraints that can be used to guide design decisions to facilitate that coordination. It is noteworthy that the terms coordination and constraint appear over and over again in Hutchins' (1995a) analysis of navigation. Flach and Dominguez (1995) suggested the term use-centered design as a way of emphasizing the focus on the relational properties of a coordination, as opposed to the distinct properties of users (user-centered design) and machines (environments). Rasmussen (1986; see also Rasmussen et. al., 1994) provided several conceptual tools (e.g., abstraction hierarchy, skills-rule-knowledge framework) for representing and thinking productively about the constraints that shape coordination in complex work domains. Acknowledgments John Flach was partially supported by a grant from AFOSR during preparation of this manuscript (Grant F49620-97-1-0231). References

Adams, M. J., Tenney, Y. J., & Pew, R. W. (1995). Situation awareness and the cognitive management of complex systems. Human Factors, 37, 85 104. Amalberti, R., & Deblon, F. (1992). Cognitive modeling of fighter aircraft process control: A step towards an intelligent on-board assistance system. International Journal of Man-Machine Studies, 36, 639 671. Bennett, K. B., & Flach, J. M. (1992). Graphical displays: Implications for divided attention, focused attention, and problem solving. Human Factors, 34, 513 533. Bennet, K. B., Nagy, A., & Flach, J. M. (1997). Display design. In G. Salvendy (Ed.), Handbook of human factors (2nd ed., pp. 659 696). New York: Wiley. Berliner, D. C., Angell, D., & Shearer, J. W. (1964, April). Behaviors, measures, and instruments for performance evaluation in simulated environments. Paper presented at a symposium and workshop on the quantification of human performance, Albuquerque, NM. Bisantz, A. M., & Vicente, K. J. (1994). Making the abstraction hierarchy concrete. International Journal of Human-Computer Studies, 40, 83 117. Drury, C. G., Paramore, B., VanCott, H. P., Grey, S. M., & Corlett, E. N. (1987). Task analysis. In G. Salvendy (Ed.), Handbook of human factors (pp. 370 401). New York: Wiley. Feynman, R. (1965). The character of physical law. Cambridge, MA: MIT Press. Flach, J. M. (1994). Ruminations on mind, matter, and what matters. In Proceedings of the Human Factors and Ergonomics Society 38th Annual Meeting (pp. 531 535). Santa Monica, CA: The Human Factors and Ergonomics Society. Flach, J. M., & Bennett, K. B. (1996). A theoretical framework for representational design. In R. Parasuraman & M. Mouloua (Eds.), Automation and human performance: Theory and application (pp. 65 87). Mahwah, NJ: Lawrence Erlbaum Associates. page_177 Page 178 Flach, J. M., & Dominguez, C. O. (1995, July). Use-centered design: Integrating the user, instrument, and goal. Ergonomics in Design, pp. 19 24. Flach, J. M., & Vicente, K. J. (1989). Complexity, difficulty, direct manipulation, and direct perception (Tech. Rep. No. EPRL-89-03). Urbana-Champaign: University of Illinois, Engineering Psychology Research Laboratory. Flach, J. M., & Warren, R. (1995a). Active psychophysics: The relation between mind and what matters. In J. M. Flach, P. A. Hancock, J. Caird, & K. Vicente (Eds.), Global perspectives on the ecology of human-machine systems (pp. 189 209). Hillsdale, NJ: Lawrence Erlbaum Associates. Flach, J. M., & Warren, R. (1995b). Low altitude flight. In P. A. Hancock, J. M. Flach, J. K. Caird, & K. J. Vicente (Eds.), Local applications of the ecological approach to human-machine systems (pp. 65 103). Hillsdale, NJ: Lawrence Erlbaum Associates. Fleishman, E. A., & Quaintance, M. K. (1984). Taxonomies of human performance. Orlando, FL: Academic Press. Gibson, J. J. (1966). The senses considered as perceptual systems. Boston: Houghton Mifflin. Gibson, J. J. (1979). The ecological approach to visual perception. Boston: Houghton Mifflin. Herringel, E. (1989). Zen in the Art of Archery. New York: Vintage. Hutchins, E. (1995a). Cognition in the wild. Cambridge, MA: MIT Press. Hutchins, E. (1995b). How a cockpit remembers its speeds. Cognitive Science, 19, 265 288. Kirlik, A. (1995). Requirements for psychological models to support design: Toward ecological task analysis. In J. M. Flach, P. A. Hancock, J. K. Caird, & K. J. Vicente (Eds.), Global perspectives on the ecology of human-machine systems (pp. 68 120). Hillsdale, NJ: Lawrence Erlbaum Associates. Langeweische, W. (1944). Stick and rudder. New York: McGraw-Hill. Lee, D. (1976). A theory of visual control of braking based on information about time to collision. Perception, 5, 437 459. Logan, G. D. (1988). Toward an instance theory of automatization. Psychological Review, 95, 492 527. Marr, D. (1982). Vision. New York: Freeman. Mayer, R. E. (1992). Thinking, problem solving, cognition. New York: Freeman. Neisser, U. (1976). Cognition and reality. San Francisco: Freeman. Newell, A., & Simon, H. A. (1972). Human problem solving. Englewood Cliffs, NJ: Prentice-Hall. Norman, D. A. (1981). Categorization of action slips. Psychological Review, 88, 1 15.

Polanyi, M. (1958). Personal knowledge: Towards a post-critical philosophy. Chicago: University of Chicago Press. Rasmussen, J. (1981). Models of mental strategies in process plant diagnosis. In J. Rasmussen & W. B. Rouse (Eds.), Human detection and diagnosis of system failures (pp. 241 258). New York: Plenum. Rasmussen, J. (1983). Skills, rules, and knowledge: Signals, signs, and symbols and other distinctions in human performance models. IEEE Transactions on Systems, Man, & Cybernetics, SMC-13, 257 266. Rasmussen, J. (1984). Strategies for state identification and diagnosis. In W. B. Rouse (Ed.), Advances in man-machine systems (Vol. 1, pp. 139 193). Greenwich, CT: JAI. Rasmussen, J. (1986). Information processing and human-machine interaction: An approach to cognitive engineering. New York: North Holland. Rasmussen, J. (1997). Risk management in a dynamic society: A modeling problem. Safety Science, 27, 183 213. Rasmussen, J., Pejtersen, A. M., & Goodstein, L. P. (1994). Cognitive systems engineering. New York: Wiley. Rasmussen, J., & Vicente, K. J. (1989). Coping with human errors through system design: Implications for ecological interface design. International Journal of Man-Machine Studies, 31, 517 534. page_178 Page 179 Reason, J. T. (1990). Human error. Cambridge, MA: Cambridge University Press. Rouse, W. B., Geddes, N. D., & Hammer, J. M. (1990, March). Computer-aided fighter pilots. IEEE Spectrum, pp. 38 41. Rubin, E. (1920). Vorteile der Zweckbetrachtung für die Erkenntnis [Advantages of functional analysis for understanding]. Zeitschrift für Psychcologie, 85, 210 233. Sarter, N. B., & Woods, D. D. (1995). How in the world did we ever get into that mode? Mode error and awareness in supervisory control. Human Factors, 37, 5 19. Shiffrin, R. M., & Schneider, W. (1977). Controlled and automatic information processing II: Perceptual learning, automatic attending, and a general theory. Psychological Review, 84, 127 190. Smith, K., & Hancock, P. A. (1995). Situation awareness is adaptive, externally directed consciousness. Human Factors, 37, 137 148. Vicente, K. J. (1992). Memory recall in a process control system: A measure of expertise and display effectiveness. Memory & Cognition, 20, 356 373. Vicente, K. J., & Rasmussen, J. (1990). The ecology of human-machine systems II: Mediating ''direct perception" in complex work domains. Ecological Psychology, 2, 207 250. Vicente, K. J., & Rasmussen, J. (1992). Ecological interface design: Theoretical foundations. IEEE Transactions on Systems, Man, & Cybernetics, SMC-22, 589 606. Wertheimer, M. (1959). Productive thinking. New York: Harper & Row. Williams, A. C., Jr. (1980). Discrimination and manipulation of flight. In S. N. Roscoe (Ed.), Aviation psychology (pp. 11 30). Ames: Iowa University Press. Woods, D. D. (1986). Paradigms for intelligent decision support. In E. Hollnagel, G. Mancini, & D. D. Woods (Eds.), Intelligent decision support in process environments (pp. 153 174). New York: Springer-Verlag. Woods, D. D. (1991). The cognitive engineering of problem representations. In G. R. S. Weir & J. L. Alty (Eds.), Human-computer interaction and complex systems (pp. 169 188). London: Academic Press. Woods, D. D., Johannesen, L., Cook, R. I., & Sarter, N. (1994). Behind human error: Cognitive systems, computers, and hindsight (State-ofthe-art report). Wright-Patterson Air Force Base, OH: Crew Systems Ergonomic Information and Analysis Center. page_179

Page 181

Chapter 7 Context Simulation: An Interactive Methodology for User-Centered System Design and Future Operator Behavior Validation Peter G. A. M. Jorna Netherlands Aerospace Laboratory NLR, Amsterdam Lessons Learned in Aviation The advent of highly automated aircraft with "glass cockpits" has extended the capabilities of the aircraft but also changed the nature and type of tasks that have to be performed by the crew. As has been duly noted, flight control assistance and flight management systems (FMS) have changed the pilot's role from that of a manual controller and navigator to a systems monitor and information manager. Information and resource management, task scheduling, and programming skills of onboard computers now complement the psychomotor skills of the pilot. The continuing expansion of air travel necessitates the use of even more advanced technologies in order to accommodate the expected levels of traffic while at the same time maintaining safety. Technologies like the digital datalink play a key role in realizing such advancement. New, or retrofitted, cockpit equipment and human-machine interfaces have to be used in a complex operational context that is characterized by a so-called theoretical "timeline." This timeline represents a mission profile specifying when, by whom, and in which order tasks should be performed. During the design process, timelines are used to assist cockpit design and define requirements for the input and display devices. The analysis is, however, theoretical and is burdened in reality by variations in equipment use and extended response times. The FMS interface, as an example, proved quite challenging for some (perhaps computer skills-limited) pilots, and its page_181 Page 182 introduction was accompanied by the admonition that the FMS was not to be used in the terminal areas. Other disturbances from the anticipated use of equipment depend on crew procedures, company policies, and unanticipated interruptions by, for instance, air traffic control (ATC), system messages, fellow crew members, and cabin staff. These trends in technology development have been accompanied by now well-documented problems in pilot-aircraft interaction. These problems have together combined to "peripheralize" the crew from direct control over the aircraft control surfaces, and placed them in a more indirect control, which they exercise by means of "instructing" and monitoring the automation. Maintaining "mode'' or "system" awareness under such conditions can be compromised. These trends (an extension on Billings by Jorna, 1996) are summarized in Fig. 7.1. The working conditions for crews have also changed and are quite varying in their particular task loading during the flights. Cruise flight is relatively boring as compared to the sometimes hectic terminal area operations. Maintaining high alertness is always difficult under lowtaskload conditions, so details can be missed. Under high-taskload conditions, stress can result in unexpected errors, as tasks must be performed under time pressure. The human-machine interface should support the crew adequately under all conditions, even distracting ones. An alert or annunciation that is perceived as adequate, or even annoying with respect to tone and sound level under low taskloading, can go totally unnoticed under high taskloading.

Fig. 7.1. Trends in "distancing" the pilot from the aircraft including future datalink gating, an auto load function of the FMS. page_182

Page 183 The development of the digital datalink allows potential benefits for the future by creating a more efficient airground information exchange. In terms of technology, many opportunities and options now exist for a radical change in aviation operations. Datalink can provide direct access to aircraft systems like the FMS, allowing in principle fully ground-controlled air traffic management (ATM). Crews, in that case, would monitor the progress and economics of the flight, evaluate ATC proposals, and provide their consent to the uplinked clearances. Such an integration of datalink with aircraft avionics is potentially able to reduce typing errors, but can also introduce new errors. Under time pressure, pilots could revert to a strategy of "accept first, think later." Other ATM solutions focus on "free flight" type of solutions emphasizing onboard equipment that allows aircraft to observe other aircraft in their vicinity on a cockpit traffic display. The consequences of such technologies for the operators in future systems are not yet fully understood and theoretical benefits should not be realized at the expense of (again) discovering unanticipated problems after ''fielding" such technology. One approach to overcoming the potential for human error in systems has been to simply design the human operator out of the system in question. According to such a "technology-centered" approach, full automation circumvents the possibility of any human error. This view fails to recognize, however, that injudicious applications of automation might simply replace errors of the human operator with those of the human designer. Proponents of a "human-centered" automation approach maintain, conversely, that it is not the human per se but the quality of the total system concept, the quality of information provided, and the effectiveness of the humanmachine interface that determines proneness to errors. The automation level itself is therefore not a threat to safety, but rather the transfer of information and the "awareness" of system states and environment as mentioned earlier. Such issues, in psychological terms often described as "feedback" and "task involvement" issues, are key targets to be dealt with in new designs. The nature of the associated tasks in modern and future aircraft is and will be predominantly cognitive. Pilotaircraft interaction consists largely of planning ahead, scanning displays, performing communication, and using input devices for instructing the aircraft. Who Should Solve the Problems? The principal users of airspace are the airlines. They need to generate profits in order to be able to provide resources for the airplane manufacturers to build aircraft and pay for the ground systems support. The "user charges" or landing fees are not negligible. Investments in cockpit technology for future ATM systems are typically evaluated in terms of their potential ecopage_183 Page 184 nomic benefits. Airlines are therefore reluctant to invest in new technologies without reasonable assurance of standardization and a return on investment. Any additional cockpit technology should earn its place on the flight deck by either an increase in revenues/safety or a reduction in costs. Improving existing aircraft by, for instance, retrofitting equipment is often performed after the aviation authorities have issued a mandatory requirement to do so. In case of the complex problems associated with the human factors of design, like "mode control panels" or "working procedures" with equipment, certification rules do not yet seem to cover all implications of certain modifications and therefore leave options for different solutions. The manufacturer (or the proposing airline) has to prove that a given solution is valid. Unfortunately, such a process is both labor-intensive and quite expensive. Economic criteria will therefore primarily drive overall strategy. Similarly, some options on improved cockpit equipment, offered voluntarily by the manufacturers, will not sell in sufficient numbers, as the customers will signal that there is no formal requirement of the authorities to implement them. The issue of which party is responsible for research on human factors is therefore unclear and will be at least fragmented over the many partners involved in the aviation community. In the development process of new aircraft, a similar apparent paradox has occurred. New technology applied to these aircraft will normally require the retraining of crews. The airlines nowadays do not seem to accept such a dependency. A current mantra among airline training professionals is that transitions between cockpit types should be accomplished with "zero training"; that is, pilots with a type rating on one version of an aircraft should be able to fly the update with no (or very little additional) training. "Trainability" of cockpit concepts and modifications is therefore an important driver for the design. Designing flight decks that both deal with new developments and incorporate lessons learned is complicated and hampered by these constraints and the net result could be a commercial design strategy of "no change." In the end, that strategy will be counterproductive as the market clearly needs improved and more reliable levels of performance for humanmachine systems. The Future Revisited Cognitive Engineering and User-Centered System Development Integration of components is a well-known issue in designing technical systems, but integrating the human has not always proven easy. A classic human factors topic is the problem of subject variability. Pilots not only differ in page_184

Page 185 qualification or experience (and personality), but also show variations in their behavior and strategies over time. Factors such as fatigue or emotional stress can create distractions. Pilots are also known to be creative for inventing new ways to accomplish their work by using equipment differently than intended by the original designer. Flight management system functions can also be used to depict turbulence areas on the displays during oceanic flights. The turbulence or problem area is depicted by entering a scratch pad route on the control display unit (CDU), and should therefore never be activated accidentally. Such systems as weather radars and traffic collision avoidance systems (TCAS), although perhaps very beneficial in terms of situational awareness, were never intended for actual navigation. The flexibility of human behavior has both positive and negative effects and its underlying principles need to be assessed and understood by realistic "human in-the-loop" testing before fielding. Sample sizes of subject pilots or crews should be large enough to draw valid conclusions for the total range of users involved and not only for test pilots or airline "aces." The measurements taken should be fine grained enough for assessing both system and human performance implications of the technology and the scenarios should invite the operator to modify and try different strategies. After sufficient understanding has been obtained, adequate and efficient procedures can be developed to optimize the benefits and minimize possible risks. Procedures are therefore an integrated part of the design process, but many airlines adopt their own. Ideally, testing of so-called "preoperational systems" is performed with the system as a whole, but costs will be enormous if all the technology has to be developed first. It is therefore critical to find or develop effective ways for testing the components of an envisaged system on their "feasibility of fit." Given the financial unfeasibility of validating only fully developed systems, a stepwise approach is needed to discover flaws and incorrect assumptions as early in the design process as possible. The risk of a technology-driven approach comes from addressing specific issues in isolation, such as cockpit layout, avionics, ATC tools, or specific procedures. Humanmachine interaction problems might well be overlooked, because the total context of work is not yet known or is ill considered. A basic requirement for any systematic approach is therefore the ability for pointing at possible unanticipated interactions between the partners in a system that could prove critical to system effectiveness and safety in a later stage. The T.E.S.T. Approach Ad hoc research on human factors safety issues that were discovered after fielding of the systems often showed unanticipated interactions and relationships between factors such as equipment design, the particular work page_185 Page 186 environments, and the responses of the human operators concerned. In many cases, additional effort (e.g., more extensive training or equipment upgrades) was required to make the system work. A mediating factor in this respect seems to be the particular focus of the engineering process. Industries providing products for flight decks have to sell systems or "boxes" and engineering is therefore often geared toward putting many attractive functions into one device. In practice, not all of these functions are used. In contrast with such a system-engineering perspective, human engineering starts from a task perspective. Executing a task can involve more than one system. The "technical" and "human" perspectives can lead to different results as is illustrated by the following simple example. Computer displays have a function for controlling the amount of light emitted. An electrical engineer will perfectly design such a function with the electronics available. A pilot, wanting to "turn up'' the flight display, can be baffled initially by the display suddenly going black. Looking more closely at the small print, the pilot discovers that the function was actually a "DIM" function. The pilot in this case expected a brightness control but was confronted with "more dim = less light." Such basic (culture-dependent) discrepancies in perspective occur regularly and should be identified and resolved, especially for the more safety-critical situations. The so-called "validation process" of cockpit and ATC equipment will have to deal with this interplay between multiple systems and multiple users differing in background, expectations, and so forth. The relevant human performance "shaping" factors can be summarized by the 'T.E.S. T.' approach (Jorna, 1993), as detailed in Table 7.1. Task In the design process it is task analysis that should provide a definition of actions and duties to be performed. Experience has taught that such an analysis is either not available or not carried out at the most effective level of detail. The human factors researcher confronted with an existing system to be evaluated or assessed is often required to perform an infield approximation of such analysis. In the course of initial validation, it is difficult but essential to incorporate all possible task levels for measuring the effects of task interactions on operator performance. TABLE 7.1 The T.E.S.T. Acronym Lists the Variables and Possible Mutual Influences (Interactions) That Have to Be Addressed or Controlled in Design and Validation T. = Task parameters that influence difficulty and limit human performance. E. = Environmental factors that complicate task execution or limit the operator's ability. S. = Subject characteristics that influence individual performance, acceptance, or availability. T. = Training and practice requirements. page_186

Page 187 Environment During short- and long-haul flight, interruptions of ongoing activities occur that can distract the crew and leave tasks unattended or unfinished, especially when the display formats do not indicate such omissions. The working conditions experienced during cruise flight are generally not very loading, leading to vigilance and alertness problems, this in contrast with the hectic terminal area operations during which crews are loaded with (too) many tasks. Additional environmental factors like noise, humidity, extreme time zone shifts, or G-forces (for military pilots) can all affect the mental fitness level of the crew. Subjects or Participants A classical pitfall in design or demonstrations is the use of highly skilled participants like test pilots or very experienced instructors. The effect will be twofold: If there is a negative transfer of old working habits to new designs, than the potential of the new design will be underestimated. Alternatively, a test pilot will not be fatigued, jet-lagged, bored, or otherwise impaired as with people who have to operate under normal daily life circumstances. Another bottleneck is that most task analysis methods will specify tasks as they are, meaning independently from the kind of operator, whereas cultural differences exist. Training Long-term exposure to a new design is typically not performed. Training changes the locus of the human limitations from conscious information processing, like cognition- or knowledge-based performance, to the limits of particular sensory or response capabilities that are associated with practiced, skill-based, and more "automatic" ways of performing, like the reliance on routine planning, data entry, or use of input devices. Often the words tasks and skills are used interchangeably, but there is a distinct difference. Performing the same task like "hammering a nail in a piece of wood" under different circumstances can involve totally different skills. Imagine hammering in the open air (no problem for most people) as compared to hammering under water by a diver (wood suddenly floats and it is a bit dark). In addition to such a factor, time restrictions also play a role in determining the required level of skill. When landing a general aviation aircraft, completing a "circuit" and performing downwind checks with a slow airplane requires different skills, or levels of skills, as compared to a fast(er) airplane. If the circuit cannot be extended for noise abatement reasons, time pressure will be imposed on all the checks and communications required. Planning and anticipation are suddenly even more critical than they are normally. As a rule of thumb, a skill can therefore only be defined if (a) the task to be executed is known, (b) the working environment and context, including other tasks, is known, and (c) the timing pattern required is known. page_187 Page 188 Cognitive engineering is a hybrid discipline that addresses new types of tasks or systems as evolved in aviation, not in isolation, but in their entire context to predict and assess strong and weak points of cockpit designs. The design of such systems therefore emphasizes exploiting the human capabilities, as opposed to designing around the human limitations. Context Simulation As a result of these developments, the National Aerospace Laboratory (NLR) developed an integrated methodology for the design, evaluation, and validation of crew interface concepts, work procedures, and flight deck/ATC design by adding special simulations that consider the possible operational contexts. The simulation scenario includes a multitask environment combined with operationally relevant environmental factors and uses a wide(r) range of subject pilots. These simulations are quite elaborate and are therefore performed after a selection process of identifying likely candidate solutions for the human-machine interface concerned. This process involves rapid prototyping by the so-called NADDES system (NLR Avionics Display and Design Evaluation System), with evaluations performed via "laboratory type" experiments. In both stages of development, the context factors as specified by T.E.S.T. are included, but they differ in scope and realism. Distractions are, as an example, generated in the laboratory experiments by using a standardized additional or dual task added to the work, whereas in the fullcontext simulation, events are used that could occur naturally under operational circumstances. Both context environments do, however, include a range of variations in task loading and working conditions and allow possible unanticipated interactions to occur. The pilots involved are not aces but rather regular line pilots from different cultural backgrounds with a range of experience from high to low. Extensive, computer-supported familiarization training is provided with the human-machine interfaces before starting the measurements. The importance of context for understanding pilot behavior is illustrated by a number of case studies, discussing the results of research performed by the methodology discussed. There are, however, some problems to be resolved first before the methodology can be applied. These are discussed to illustrate the technology requirements for context simulation. Scientific Standards A major disadvantage of using interactive simulations is that the participant can influence the actual simulation session. In the case of a flight deck simulation, the communication patterns and, indeed, even the actual route page_188

Page 189 flown can vary from crew to crew. Similarly, every control action taken by an air traffic controller can have a carry-on effect for the remainder of a given simulation session. It is therefore difficult to compare the results and observations across crews or controllers, as the actual flights can develop quite differently, leading to different working circumstances and/or traffic encountered. One crew strategy can make life easy, but another can result in difficult situations depending on its effectiveness. Next to similar experimental conditions, science requires sufficient numbers of repeated measurements in order to assess the relevance of the results with statistical testing. The solution to this problem was the definition of so-called "events" that can be inserted in the scenario by the experiment leader. The simplest example is an engine failure that can be initiated by an instructor in most of the flight simulators used for training purposes. More difficult is to ensure that the working context for initiating such events should also be comparable between crews. An instructor would be required to monitor all details consistently, to adhere to more scientific standards. Automatic monitoring of selected flight parameters and status of equipment resolved this issue. So, it is now possible to initiate an ATC event like a datalink uplink, at precisely the moment that the pilot not flying (PNF) is at a certain page of the CDU of the FMS. This particular test condition can be arranged for all crews involved. Using a conditional logic, events can also be triggered under different levels of workload by considering a particular combination or sequence of events, represented as, say, "IF this, AND that, initiate 'event,' ELSE do not trigger." An example of such an event-driven scenario is presented in Fig. 7.2. Simulation and Scenario Management The simulation facilities need to be equipped with more extensive and accurate control over the scenario. This requires the following: Control over presentation of the events, both in number and sequence. Monitoring of many system status parameters, like FMS page on top, or mode control panel settings, and so on, to allow triggering of events in relation to a predetermined initial condition. Recording of parameters with accurate time coding and inclusion of event codes for later identification and automatic computer processing of data. Extensive and accessible storage capacity. The so-called experiment manager facility developed for this purpose is a dedicated computer that contains a list of scripted events for the simulapage_189 Page 190

Fig. 7.2. Examples of events that can be initiated under full experimental control. tion computers to execute. These are initiated either automatically or manually when the required conditions happen to occur during that simulation. It therefore monitors a set of prescribed simulation parameters to allow adequate triggering of the required events. The experiment manager has a manual mode in which the experiment leader can work interactively whenever required. As an example, an event like "engine failure" can be scripted to occur twice in the scenario, once during communication with ATC, and once during a relaxed period in the flight. In this way it is possible to still allow the pilot to perform his or her duties under realistic circumstances, while also maintaining rigorous experimental control over the number and initial conditions of the events under investigation. The Human-Machine Cooperation "Air Traffic Management Test-Bed" Embedding Aircraft in Air Traffic Management

The future ATM environment needs to be updated in order to resolve present day delays and congestion, and to accommodate future projected traffic loads. The solutions envisaged all depend on an improved exchange of data between aircraft and/or ground equipment. The estabpage_190 Page 191 lishment of digital datalinks is a key technology for realizing such options. However, the working conditions of the crews and controllers can change drastically and the interactions that will occur between human-machine teams in the air and on the ground are still largely unknown. Experiments need to involve both parties in dynamic scenarios that allow these interactions to actually occur and study them for effectiveness and safety issues. For this reason, the simulation of experimental aircraft cockpits was expanded with reconfigurable controller working positions containing advanced tools for ATM. The experiment manager facility in that case controls events and monitors the status of two sophisticated simulations in full context. In addition, a full battery of measurements concerning human performance has been integrated. The resulting "ATM test-bed" is illustrated in Fig. 7.3. Human Data Measurements The following data are obtained to evaluate human performance, workload, and effort, situational awareness (operationalized as the ability to perceive current, and predict future, air traffic patterns), systems awareness, and user preferences:

Fig. 7.3. An ATM test-bed for designing, simulating, and studying human in-the-loop interactions, work procedures, and safety issues in experimental ATM environments. page_191 Page 192 1. Sampling of visual data on displays by "point of gaze" head-mounted eye trackers that are calibrated to the particular simulator in order to depict active use of the displayed information. The system provides the following information in real time, with a sampling rate of 50 Hz: Point of gaze, expressed in X and Y coordinates relative to the viewing plane. Fixation dwell time, in milliseconds. Millisecond-accurate time stamp (i.e., starting time of fixation), to permit referencing to simulation events. Transitions between display elements and other displays. Pupil diameter, which can be converted into millimeters. Surface identification, for translating predefined planar coordinates into viewing surfaces (e.g., separate dials of a simulated cockpit display). 2. Analyzing changes in heart rate to assure that the information "looked at" (fixated) is also actually processed by the crew or controller in order to make sure that information is also "seen." 3. Calculating heart rate variability to monitor the mental state and effort exerted during processing of the information.

4. Analyzing vocal communications within the crew or between controllers as well as communication outside. So-called voice keys (electronics that indicate both onset and duration of speech) are combined with "press-to-talk" switches to discriminate between communications inside and outside. 5. Recording respiration to control for breathing patterns that are known to influence heart rate, as well as to control for the occurrence of murmured speech not detected by voice keys. 6. A battery of questionnaires tailored to the given study, as well as standard workload ratings. Case Studies Cockpit Datalink Communication with Air Traffic Control Experimental Design The introduction of digital datalinks by means of ultrahigh frequency or mode-S, enables computer-to-computer communications between aircraft and ground systems. A well-known example is the familiar ACARS (ARINC Communications Addressing and Reporting Syspage_192 Page 193 tem) unit that is used for communicating with the airline. In the study discussed here, the possible application for communicating with ATC was investigated (van Gent, Bohnen, & Jorna, 1994). A realistic scenario was designed around oceanic routes, starting above the Atlantic, crossing the United Kingdom, and finishing with a full-stop landing at Schiphol airport. Three flight segments with different working conditions and time pressures were therefore included: oceanic, cruise flight, and descent. According to the concept of context simulation, several events were scripted including crossing and overtaking aircraft (also represented in the visual of the simulator) and thunderclouds to initiate route changes, and all communications were scripted as events like uplinks, downlinks, and so forth. This setup proved to be very efficient in realizing fine-grained analysis of crew behavior and strategies. Three cockpit datalink devices and respective human-machine interfaces were compared for effectiveness and acceptability: an interactive display unit (IDU), the CDU defined earlier, and a multifunction display (MFD). All crews flew with all interfaces in separate flights. Recorded data included: head tracking (to determine head-down vs. head-up time), heart rate, respiration, voice-key activity, questionnaire responses, and extensive system data (including all button and switches activity). Some of the results are discussed next. Results Crew procedures prescribe a task division between the crew members, with the pilot flying (PF) handling the aircraft primarily and the PNF handling the communications. In the case of datalink, this implies that the PNF will go head-down whereas the PF can remain head-up or headfront for scanning and checking. The measurements of head tracking proved otherwise as illustrated in Fig. 7.4.

Fig. 7.4. Percentage of time spent head-up or head-front for both crew members in case of composing a downlink message and receiving an uplink from air traffic control. page_193

Page 194 During the downlink, the PNF is head-down as expected in order to reach the input devices (IDU, CDU, or MFD). The PF essentially remains head-up in accordance with crew procedures. As the moment of transmission approaches, a trend toward head-down can be observed. However, when receiving an uplink from ATC, both crew members go head-down immediately, although the PF somewhat less so than the PNF. In cognitive engineering terms this can be easily understood, as humans are simply curious and want to be informed directly about anything of interest for executing their tasks. As a result of this study, synthetic speech applications were investigated in a Phase II study, to improve head-up times especially during the more critical flight phases (van Gent, 1996). Datalink transmissions may take considerable time to accomplish, and might be slower than RT (radio/telephony) communication. Concerns are even greater as the delay times are variable as a function of the particular medium used in the Aeronautical Telecommunications Network (ATN). These variations prevent the crews and controllers from anticipating the exact delay length, and can disrupt task-scheduling capabilities. From a cognitive engineering point of view, a consistent delay would be preferable to a variable delay, as they cause concern about the integrity of the system and require more feedback information concerning the actual status of the transmissions. Examples of such messages are "sending," "sent," and "received by ground system." With such information the crew has some insight if they are waiting for a slow controller or if there was a medium problem. In this study, the actual delays for acceptance of involved uplinks could be studied and replicated easily by using the ''event coding" of context simulation. The results are depicted in Fig. 7.5.

Fig. 7.5. Acceptance times for crews to uplinks with clearances and the like from air traffic control. Also results for a subset of uplinks, excluding meteo and free text, are included. page_194 Page 195 At first look, datalink communication seems much slower than voice communication. When the data is corrected for routine device interactions (which can vary by message type), however, these differences are reduced considerably. So for important communications, datalink in itself is not significantly slower than voice, provided that the communication interface does not require extensive manipulations to create an answer. The quality of the human-machine interface proved to be important in more than one respect. In addition to the time required for message and request composition, the interface support provided to the operator proved to contribute to the way the device is actually used. Quite unexpectedly, it was found that the worst device seemed to be used in a single-shot modethat is, once started, tasks were completed without interruption. For the other devices tasks were more often disrupted by external events. The number of such disruptions varied as a function of flight phase as illustrated in Fig. 7.6. The IDU, CDU, and MFD proved different with respect to this factor. Apparently, when a user interface provides some feedback on "where you are in the process," it is more easy and tempting to interrupt the task on hand as you can find your way back. The more critical interfaces should allow for such a strategy, enabling the pilots to become more flexible in their task scheduling. In that case it is critical that the interface indicates "unfinished business" very clearly! The differences between the tested interfaces are depicted in Fig. 7.7.

Fig. 7.6. Average number of procedure disruptions during use of the human-machine interfaces for datalinking. High time pressure increases the occurrences. page_195 Page 196

Fig. 7.7. Average number of task procedure disruptions during use of three human-machine interfaces for cockpit datalinking. Pilot Heart Rate Responses to Datalink Communication The purpose of this study was to investigate the feasibility of applying a particular heart rate analysis method to the assessment of humanmachine interface effectiveness in existing and advanced versions of the so-called glass cockpits (Jorna, 1997). The methodology proposed is event-related heart rate (EHR) as an indicator of the dynamic characteristics of human information processing during instrument and display scanning and the execution of discrete tasks. Its use is only possible within a context simulation with extended coding of events. Experimental Design The simulation study investigated the crew interactions with an improved cockpit datalink interface with two means for exchanging the message to the crew (van Gent, 1996). In the first case, datalink messages were displayed at an MFD, so the pilots(s) could read the message. The second display format was auditory, as the message was presented by means of synthetic speech. Both formats were tested under three levels of automation or "gating" facilities. Uplinks from ATC could be stored in the FMS directly for execution after pilot consent. The pilot was not required to retype all instructions. A second level was an extension of FMS gating with the automatic setting of the mode control panel (MCP) entries, called MCP gating. Both were compared with a full manual condition that served as a baseline, resulting in three levels of automation. EHR is a basic technique. In the scenario, certain stimulus events were presented to which a pilot response is anticipated. After the experiment, segments of heart rate were "cut" and averaged together. The reasoning is that all fluctuations that are not related to the specific event will averpage_196 Page 197 age out. The result is a net response of that subject linked to a particular event. Comparisons can be made between type of events, for example, different types of alerting systems, on the effectiveness of attracting the "pilot's attention." The advantage of this method is that the response of the pilot is close in time to the event of interest and therefore only the fast-responding parasympathetic nervous branch will be involved for the first 10-20 seconds after the event. Technology Requirements Heart rate should be recorded on digital equipment without tapes that have stretching problems and together with respiration to control for sighing, deep breaths, and so on. Breath holds can be extremely troublesome (both inside and outside the laboratory!), as they initiate a reflex that reduces heart rate. Artifact checking and correction facilities for missed beats and the like should be implemented. There must be an accurate linking with respect to real-time accuracy with the stimulus or mission events. These events should be stored, preferably in the same data file, to allow adequate inspection and selection of relevant heart rate segments. Software should be able to locate the selected events and cut a specified section of the recording. That section includes some time before the event and some time after the event in order to compare the change in response as a function of the event with initial preevent values. Heart rate is an asynchronous signal that has to be interpolated in order to enable the cut-and-paste function accurately over a certain time segment. Averaging software for segments is required to obtain a global heart rate profile that can typify the pilot response to the event. Comparisons can be made only if the number of events in certain conditions is similar, and their presentation order is counterbalanced in the scenario, according to normal scientific standards of the behavioral sciences. Graphing of combined profiles requires software that can determine the required scale to fit both, or more, profiles. That feature is typically not present in commercial software and is therefore included in noncommercial developments.

Data Recordings and Events The events in the datalink experiment (numbered for easy computerized detection) were controlled and recorded by means of the experiment manager facility, and are listed in Table 7.2. Results The analysis performed used the Event 253 (Aural alert from ATC uplink) as the event for selecting, cutting, and averaging of heart rate segments. Normally, that event will first attract the attention of the pilot. Subsequently, task elements will have to be completed such as: process the presented information, decide on the action required in coorpage_197 Page 198 TABLE 7.2 Events in the Datalink Experiment Event Code

Description

232

"Roger"

235

"WILCO"

237

Moderate turbulence on

238

Light turbulence

239

No turbulence

240

Destination, runway change ATC

243

Radio communication other traffic

245

Traffic modification messages

246

No auto land

247

Auto throttle disconnect

248

Autopilot disconnect

249

Comm. light switched off

250

Datalink light switched off

251

ACARS message

252

Urgent ATC uplink

253

Aural alert from ATC uplink

254

No aural alert from ATC uplink

dination with the fellow crew member, and finish with the initiation and execution of the response by means of a downlink message to ATC. In the case of datalink, all responses are made through selecting the standard reply "WILCO" from a menu presented on a display. The averaged segments were depicted with a running indication of the standard deviation at both the upper and lower level of the particular individual heart rate averages over time. Widespread varying heart rate values, as a consequence of between- or within-subject variability, will lead to a relatively wide range of these values, whereas a distinct and consistent response to the event led to restriction of this standard deviation band, as all numbers were closer. Manual Flight and Synthetic Speech for Air Traffic Control The analysis was successful in producing event-related heart rate profiles in such an operational, nonlaboratory environment. The profile obtained for the condition "manual flight and synthetic speech for ATC messages" is depicted in Fig. 7.8. The results show a distinct pattern of a linked response to this event as reflected in the averaged heart rate profile. Before the event, variations in heart rate were indeed averaged out, confirming uneventful conditions just prior to the triggering event for this analysis. It is, however, possible that other events occur just prior to selected events, depending on the separation in time between events in the scenario. The experiment manager can assure sufficient separation of events at will, and depending on the scenario. page_198

Page 199

Fig. 7.8. Event-related heart rate response, averaged over multiple events (n = 26) for a pilot not flying while handling communications tasks with air traffic control through datalink. The centered event was an ATC unplink (time zero) displayed by synthetic speech, which required a WILCO response later on. The occurrence of that response, as determined by independent measures of the time of selecting the WILCO button, is indicated. After the occurrence of the uplink, heart rate slows down briefly. This response is known from laboratory study experience and is often associated with information uptake. Heart rate increases subsequently when the pilot is mentally working to absorb the information (note the plotting convention in interbeat intervals, meaning heart rate goes down when the intervals increase!). The sequence is completed with a distinct decrease in heart rate as the WILCO response is, according to the independently recorded button activations, selected and executed. The distinct decrease of the profile can be associated with the required concentration of the pilot that can be strengthened as a result of possible breath holding associated with such concentration. Similar event-related averaging techniques could be applied to respiratory signals when required. Manual Flight and Displayed Text for Air Traffic Control The same pilot performed identical tasks under a different regime of experimental conditions. The ATC message could be spoken by means of synthetic speech as described before, or could be displayed as text on the navigation display. In this case reading was required as opposed to merely listening to the message. The results for this case are depicted in Fig. 7.9. In the case of reading from the display, a marked difference in response can be observed. After the alert, a short period of heart rate acceleration page_199 Page 200

Fig. 7.9. Event-related heart rate response, averaged over multiple events (n = 26) for a pilot not flying for handling communications tasks with air traffic control through datalink. The centered event was an ATC uplink (time zero) displayed as text on the navigation display, which required a WILCO response later on.

was observed, followed by a more distinct increase in heart rate as compared with the synthetic speech condition, apparently associated with "working though the text." After absorbing the information again, heart rate decelerated markedly during the selection and execution of the WILCO response. Response to Automation Failures To illustrate the response of a pilot to an automation failure in the case of FMS gating through advanced datalink, an "autopilot disconnect" event was selected for this analysis. These events naturally have a low frequency of occurrence to prevent pilots from being prepared for such failures. In the selected case, the autopilot disconnect occurred directly after handling an uplink from ATC as controlled by the experiment manager facility. The results obtained are depicted in Fig. 7.10 and demonstrate the occurrence of the apparently, typical WILCO response in heart rate also for this pilot, just before the surprising event of an autopilot disconnect. The profile illustrates that even subsequent events with short intervals between them can still cause distinct responses to be observed. Also, only three events in the average were sufficient to replicate the earlier results for the WILCO obtained with 26 events in the earlier average (also different subject pilot). The intuitive expectation of a pilot's response to an autopilot disconnect event would be a distinct rise in heart rate. The data, however, show a difpage_200 Page 201

Fig. 7.10. Event-related heart rate response, averaged over multiple events (n = 3) for a pilot confronted with an autopilot disconnect after accepting the FMS gating of an ATC uplink. The system disconnect was initiated automatically 10 seconds after the uplinks. ferent, more particular response. The heart acceleration following the completion of the communication task is followed by a decrease in heart rate, again apparently associated with the intake of information to determine the problem. No panic-related response is observed. Note the effect of the event on the standard deviation of the averages obtained. It is almost reduced to zero at the precise moment the pilot takes corrective actions. After the event, heart rate seems to stabilize to more normal levels. Discussion The aim of this study was to demonstrate the feasibility of using EHR measures to complement and assist studies into human-machine interaction in automated cockpits. These cockpits are particularly suited for this application, as the cockpit devices require many discrete tasks to be completed by the crew. The technical requirements for this technique are formidable with respect to the integration of both experimental control over simulation events and the associated data recordings with accurate synchronizing provisions over multiple data sources. The application of the techniques could be demonstrated and resulted in the detection of distinctive heart rate responses to particular events scheduled in the scenario. In this respect, this laboratory technique could be transferred successfully to the complex environment of dynamic full-mission simulation. With the EHR technique, a wealth of additional information seems to be accessible from complex simulations, improving the cost effectiveness of such studies. page_201

Page 202 Controller Interactions with Experimental Software Tools Early attempts to introduce automated functions in ATC have resulted in mixed success. Electronic flight strips and automatic conflict resolutions are examples of technologies that raised discussions within both the research and ATC community. With respect to the second example, major issues continue to be the reliability of computer advice and potential incompatibility with human information-processing strategies and working procedures. More effective and economic ATC performance is, however, necessary for the future and the challenge for (human factors-based) automation design is still there. In collaboration with European partners (Jorna & Nijhuis, 1996) and with NASA Ames, the applicability of advanced software tools for ATM was investigated. The development of such tools used to be driven by a "technology push" still based on the assumption that tasks had to be removed from the controller in order to reduce the workload and increase overall "reliability" of the provided services. However, without an effective human-machine interface, no success can be attained and some developments run the risk of being incompatible with human characteristics from a cognitive engineering point of view. Experimental Design The present study (Hilburn, Jorna, Byrne, & Parasuraman, 1996; Hilburn, Jorna, & Parasuraman, 1995) investigated the human use of possible tools in a future ATC scenario with present (low) and future (high) traffic loading. Arrival traffic approaching Amsterdam's Schiphol airport was displayed on an experimental plan view display (PVD; see Fig. 7.11). The PVD contained the following major elements: Timeline window: the controller must monitor this area for scheduling information if he or she is to ensure that the arrival sequence is as desired, and that ETA (expected time of arrival) and STA (scheduled time of arrival) agree. Traffic area: the region of the screen in which controlled aircraft appear, including both the aircraft location plots and the flight labels that display all relevant flight parameters. Datalink status panel: displays all recently uplinked messages, together with elapsed time since transmission, and whether the clearance has yet been acknowledged by the aircraft. Hand-off region: general area in which the PVD displays the plots and flight labels of aircraft around the time that they are handed off to Amsterdam approach (APP) control. page_202 Page 203

Fig. 7.11. Display layout of the plan view display with arrival scheduler at the left, aircraft hand-off area, and datalink status panel. The shaded areas are used by the pointof-gaze equipment to provide area-related data on eye scans, duration of use, transitions, and so on. Preacceptance region: the general PVD region that displays aircraft before they are accepted from the previous sector. Viewing this region provides the controller an indication of impending traffic load changes. Three levels of assistance with the aim of reducing workload were available: conflict detection by the machine, conflict resolution by the machine, and a "manual" baseline condition representing full controller work. Results The controller was equipped with point of gaze measurement facilities. The results of these measurements are depicted in Fig. 7.12.

Comparing the results in Fig. 7.12 gives an indication of how traffic load influenced the visual scanning of the task-relevant surfaces. It appears that average dwell times were slightly influenced by differences in traffic load. Surfaces 1, 2, and 4 (i.e., the timeline, traffic, and hand-off regions) showed a decrease of 0.8% to 1.3% from low- to high-traffic conditions, whereas increased dwell times were seen for the datalink (3.4%) and preacceptance (12.9%) regions. Fixation frequency, however, seemed much more sensitive to the effects of traffic load. The net change from low- to high-traffic conditions ranged page_203 Page 204

Fig. 7.12. Dwell time and fixation frequencies, for low (a) and high (b) traffic load. from -6.3% (for the preacceptance region) to -75.7% (for the timeline). The actual scanning could change dramatically as illustrated in Figs. 7.13 and 7.14. Automation Assistance and Workload Increases in mental workload have not only been associated with measures of heart rate but also with pupillary dilation. This measure is also available from the point of gaze equipment. Compared to either the light or focal length responses, however, the effect of mental activity on pupil diameter is quite small. Across

Fig. 7.13. Sample 120-second eye scan history trace, low traffic. page_204

Page 205

Fig. 7.14. Sample 120-second eye scan history trace, high traffic. subjects, pupil diameter was found to range from 2.72 mm to 7.20 mm, a surprisingly broad range given that the typical extremes of pupil diameter are believed to be 2 and 8 millimeters. Pupil diameter was greater under high traffic load. Average diameters of 4.63 mm and 5.31 mm were obtained under low and high traffic, respectively. It is worth noting that this pupillary response occurred in tandem with an increase in the number of onscreen elements and, therefore, the number of active screen pixels. That is, pupil diameter was seen to increase significantly with traffic load, even though higher traffic load coincided, in this study, with higher levels of background illumination. Apparently the tools seem to reduce workload as indicated by this measure. (See Fig. 7.15.) Heart rate variability (HRV) is a measure often used for the assessment of mental workload (see Jorna, 1992, for a review). The variations in heart rate rhythm tend to be reduced under mentally taxing conditions. The reduction in variability is plotted in Fig. 7.16, in an inverted value to serve as a more readily understandable indicator of the mental workload. Clearly, HRV was sensitive to levels of traffic load. This effect appeared across all levels of automation. Further, HRV patterns across automation levels clearly suggest that, especially under high-traffic conditions, mental workload was reduced by automation. This pattern is depicted in Fig. 7.16 for all three levels of automation, across the same four levels of traffic load. Subjective Ratings Controllers' subjective ratings underscored the effectiveness of the traffic load manipulation in terms of perceived workload (see Fig. 7.17). The ratings (collected periodically throughout each simulation session) show a trend contrary to the results of the more ''objective" data by indicating that workload is perceived as "higher" when more page_205 Page 206

Fig. 7.15. Pupil diameter, by traffic load and automation condition.

Fig. 7.16. Heart rate variability (.1 Hz), by traffic load and automation level (high values plotted to indicate high effort levels). automation assistance is added to the simulation. Other observations revealed that the controllers tend to revert to their old controlling methods under highly loading conditions. Training scenarios should emphasize the use of tools under these conditions more effectively to prevent "high-traffic panic." Objective and subjective performance and workload measures applied in such fine-grained studies often dissociate. Performance levels increased page_206 Page 207

Fig. 7.17. Subjective ratings on influence of automation support on perceived workload. and objective workload indices decreased when providing assistance from tools for conflict detection and resolution. Subjective ratings, however, indicated an increase representing a possible bias to "more tools must be more workload." These observations underscore the importance of using objective measurements and not solely rely on users' opinions. These can be influenced by many factors, but practice and extensive familiarization with advanced technologies seems crucial for user acceptance. Challenging Issues The results of context simulation studies provide valuable contributions to both the understanding of human behavior in advanced systems and strategies employed for the redesign of human-machine interfaces according to the lessons learned. Some of the major ones are: Expectations determine the main portion of information transfer and these expectations can only occur if the preoperational context is adequately represented. Humans actively use and seek out information confirming their actions. The deviations or "unexpected" actions by the machine are far less effectively detected and such awareness-related problems are often reported in the case of (uncommanded) mode changes. Alerting systems should therefore ideally understand what the context is in order to support the operator. Inevitably, human-machine interfaces will be used differently than anticipated in the design phase. Fine-grained measurements are essential to understand why, and what to do about it. page_207

Page 208 Ineffective tools will be dropped immediately when time pressures increases. The opposite should be achieved by applying cognitive engineering principles. Humans are curious and will go for information irrespective of what the procedures prescribe. Subjective ratings are never sufficient for validating a design or procedure, but can play an important and complementary role to objective data (especially in cases in which the successful introduction of new methods/tools relies on user acceptance). Extensive training and familiarization is essential for research into application and development of new technologies. Context simulations and their associated methodologies have proven to be a powerful tool for studying and understanding operator behavior. The most challenging forthcoming issues seem to be associated not only with technology development and applications but also with issues concerning "training and transitioning" from old to new technologies. A particularly interesting challenge will be the realization of so-called "free flight" ATM scenarios in which tasks are shared differently between the aircraft and ground control than is currently the case. Many opponents to such a concept state that it will be impossible. Others argue that it is the only solution to the present congestion of the aviation system while assuring the principle of free enterprise for all businesses involved. Context simulations with the human-machine co-operation ATM test-bed, seems to be the right way to go in order to provide more objective data on what can and cannot be done. References Hilburn, B., Jorna, P. G. A. M., Byrne, E. A., & Parasuraman, R. (1996, March). The effect of adaptive air traffic control (ATC) decision aiding on controller mental workload. Paper presented at the Second Automation Technology and Human Performance Conference, Daytona Beach, FL. Hilburn, B., Jorna, P. G. A. M., & Parasuraman, R. (1995). The effect of advanced ATC strategic decision aiding automation on mental workload and monitoring performance: An empirical investigation in simulated Dutch airspace. In Proceedings of the Eighth International Symposium on Aviation Psychology (pp. 387 391). Columbus: Ohio State University Press. Jorna, P. G. A. M. (1992). Spectral analysis of heart rate and psychological state: A review of its validity as a workload index. Biological Psychology, 34, 237 257. Jorna, P. G. A. M. (1993). The human component of system validation. In NATO ASI series: Verification and validation of complex systems: Human factors issues (pp. 281 304). Berlin: Springer-Verlag. page_208 Page 209 Jorna, P. G. A. M. (1996, March). Issues and trends in cockpit automation: The challenge for enhanced human performance. Paper presented at the Second Conference on Automation and Human Performance, Orlando, FL. Jorna, P. G. A. M. (1997). Pilot performance in automated cockpits: Event related heart rate responses to datalink applications. In Proceedings of the Ninth International Conference on Aviation Psychology (pp. 691 696). Columbus, OH: The Association of Aviation Psychologists. Jorna, P. G. A. M., & Nijhuis, H. B. (1996, March). Ground human machine interfaces (GHMI) for ATC automation technology: A European strategy towards coherent development and human factors validation. Paper presented at the Second Conference on Automation and Human Performance, Orlando, FL. van Gent, R. N. H. W. (1996). Human factors issues with airborne data link: Towards increased crew acceptance for both en-route and terminal flight operations (NLR Tech. Publ. No. TP 95666). Amsterdam: NLR. van Gent, R. N. H. W., Bohnen, H. G. B., & Jorna, P. G. A. M. (1994). Flight simulator evaluation of baseline crew performance with three data link interfaces (NLR Contract Report No. CR 94304L). Washington, DC: Federal Aviation Administration. page_209 Page 211

Chapter 8 Horizons in Pilot Training: Desktop Tutoring Systems Christine M. Mitchell Georgia Institute of Technology, Atlanta Airline training departments worldwide face the greatest peace-time pilot training challenge in history. Wiener (1989, p. 174)

Pilot training is an important and ongoing concern. Pilots working for major carriers often switch aircraft type (e.g., Boeing 757 to Airbus A320) and cockpit position, such as first officer to captain). They transition from traditional "steam-gauge" to state-of-the-art "glass-cockpit" airplanes and thus require extensive transition training to learn to operate new computer-based navigation and auto flight systems. Enhancements to existing aircraft, for example, glass-cockpit upgrades to older Boeing 727s, require training that extends significantly beyond the training that is currently provided. For example, one U.S. carrier plans to enhance its current fleet of DC-10 aircraft by adding MD-11 flight management systems (FMS) and associated displays to each DC-10, thereby creating a ''MD-10" hybrid. The proliferation of computer-based aviation systems sometimes causes pilots to be "surprised" by automation (Billings, 1997; Wiener, 1989). Automation surprises occur for a variety of reasons including rare or unforeseen situations that were not considered by software designers, software errors, or subtle changes as software is modified or upgraded. Pilot training is also expensive. Expenses include the cost of training personnel, loss of revenue while pilots are in training, and the training infrastructure, including simulators and training devices needed to create page_211 Page 212 an environment in which pilots acquire new knowledge and can practice new skills. Current training depends almost exclusively on expensive human instructors and high-fidelity simulators. Where computer-based training is used, it is often ineffective and almost always employed to teach low-level concepts, such as identifying data items on the numerous pages comprising the control and display unit (CDU), or rote skills, such as using the CDU keypad to input the programmed route. As early as 1989, Wiener noted that "auto-tutorial devices employed in training for advanced technology aircraft have not kept pace with the technology. . . . Students often fall asleep at the instructional stations" (p. 173). Historically, limitations on computerbased training included the cost of hardware and software and the lack of effective strategies for using emerging technology to teach. Increasingly powerful and inexpensive computer technology offers alternative educational media; and emerging research suggests new strategies to supplement conventional training methods (Regian & Shute, 1992). Such strategies exploit the power, flexibility, and comparatively inexpensive costs of desktop computers and the possibilities afforded by computer-based instructional software. Desktop computers can augment training in expensive, high-fidelity simulators with a simulated flight environment in which pilots can acquire and practice glass-cockpit navigation and flight management skills. Hardware for a desktop simulator may cost $4,000 versus the millions of dollars that higher fidelity training devices cost. Computer-based training systems and intelligent tutors (Burns & Capps, 1988; Wenger, 1987) potentially reduce dependence on human instructors while providing instruction that is tailored to the needs of an individual student. In addition, a desktop simulator and associated instructional material may be significantly more accessible, allowing access from anywhere in the world via the Internet or World Wide Web.1 This chapter describes three interrelated research programs that address pilot training. The first, VNAV Tutor, was designed for pilots transitioning from traditional to glass-cockpit aircraft. The VNAV Tutor teaches fundamental concepts and skills associated with the vertical navigation mode of sophisticated FMSs. The second program, GT-CATS (Georgia Tech Crew Activity Tracking System), explores a primary challenge in designing intelligent computer-based instructional systems: specification of expert and student models that give software the ability to offer expert instruction and to customize instruction to the evolving needs of an individual student. The third program, Case-Based Intelligent Tutoring Sys1 At this time, a major U.S. airline is planning to implement a certified training simulator that will run on Pentium-class hardware and will be accessible from anywhere in the world via the Internet. This simulator will be used to teach auto flight skills to MD-11 pilots. page_212 Page 213 tem (CB-ITS), builds on the experiences and contributions of the two preceding programs. CB-ITS is an intelligent computer-based instructional system that uses cases as the context for instruction. A case, an alternative to the full-mission scenarios used by airlines and the VNAV Tutor, provides a succinct context in which pilots can experience and learn to cope with specific situations that sometimes give rise to automation surprises. Case-based training can supplement existing classroom and simulator training by focusing on isolated, novel, or surprising situations that conventional training may be too time constrained to address. All three of these research programs use desktop simulators as the vehicle for instruction and practice. The VNAV Tutor Mode awareness in the cockpit, that is, the ability to monitor and understand the status and behavior of the auto flight system, is an increasingly important, but very demanding, task (Sarter & Woods, 1995). Control modes change due to pilot commands (manually) or in response to system events (uncommanded). In highly automated aircraft, mode confusion is often cited as a significant contributor to both incidents (Vakil, Hansman, Midkiff, & Vaneck, 1995) and accidents (Abbott, 1996; AV&SW, 1995; Mellor, 1994). Since 1989, four airline accidents have occurred in which mode problems were identified as contributing factors (Gopal, 1991; Mecham, 1994; Sparaco, 1994; Transport, 1990). In an extensive survey of commercial airline pilots, Wiener (1989) reported that automation occasionally surprises even experienced pilots. His famous characterization of pilots interacting with auto flight systems highlights this problem: Pilots ask, "What is it doing now? Why is it doing that? What will it do next?" More recently, Sarter and Woods (1992, 1994) gathered both survey and empirical data on pilot difficulties with understanding and operating auto flight systems. Their studies note that although pilots become proficient in standard flight management operations, in certain flight contexts even experienced pilots have difficulty monitoring the status and understanding the behavior of the FMS. These three studies by Wiener and Sarter and Woods all suggest that pilots identify vertical path navigation (VNAV) as a "troublesome" flight mode that all too frequently "surprises" them. Wiener (1989) asked pilots to describe in detail errors that they "made, or observed, in operating the automatic features of the 757 that could have led to an incident or violation'' (p. 100). Wiener categorized 35 reports as vertical navigation errors compared to 21, which he categorized as lateral navigation errors. In Sarter and Woods' (1992) survey, 63% of the reported problems were related to vertical navigation operation. Corroborating this evidence, Hanspage_213

Page 214 man and colleagues found that 74% of mode awareness incidents contained in the NASA Aviation Safety Reporting System (ASRS) involved vertical navigation (Hughes & Dornheim, 1995; Vakil, 1995). Effective use of the FMS, especially the vertical navigation mode, is very important, however. The FMS in general, and the vertical navigation mode in particular, supports smooth, fuel-efficient flight. As the data suggest, however, vertical navigation is problematic (e.g., Kantowitz & Campbell, 1996). It is not well supported by current pilot interfaces (Wiener, 1989), and pilots often receive little explicit training in its use. For example, ground instructors from at least one airline occasionally tell pilots that "they will learn VNAV operations on the line" (Wilson, personal communication, October 5, 1994). The VNAV Tutor is a computer-based training system that uses visualization, animation, and other inexpensive computer technologies to teach pilots transitioning to glass-cockpit aircraft about the vertical navigation mode and its associated submodes. The sections that follow provide a brief description of the VNAV Tutor and the empirical evaluation conducted to assess its effectiveness. More detail can be found in Chappell, Crowther, Mitchell, and Govindaraj (1997). The Flight Management System One of the major functions of the FMS is to provide efficient three-dimensional path navigation. The FMS divides navigation into two primary control modes: LNAV and VNAV. Lateral navigation (LNAV) controls the horizontal movement of the aircraft. Vertical navigation (VNAV) controls vertical movementaltitude and vertical speed. Pilots configure the FMS using the CDU and the mode control panel (MCP). The CDU consists of a general-purpose keypad, special-purpose function keys, and an alphanumeric display (Fig. 8.1). With associated function keys, pilots select pages that correspond to various phases of flight including climb (CLB), cruise (CRZ), and descent (DES). For a given page, pilots use the keypad to define the programmed path; they enter a set of points in space(x, y, z) coordinates or waypointsto specify the desired route. Figure 8.1 shows one of the LEGS pagesLEGS are segments of the horizontal flight plan. Once programmed, pilots use CDU pages to verify the programmed route and to monitor its execution during flight. Pilots use the MCP to activate various automatic flight navigation modes and to set protection limits on automatic flight. A MCP is depicted in Fig. 8.2. Buttons allow pilots to engage auto flight modes including LNAV, VNAV, and flight-level change (FL CH). Figure 8.2 highlights two alternative vertical modes: VNAV and altitude hold (ALT HOLD). Figure page_214 Page 215

Fig. 8.1. Control and display unit (CDU) containing many pages of information defining the programmed path. 8.2 also shows a MCP altitude constraint of 10,000 ft. During VNAV-controlled climb or descent, as the aircraft approaches the MCPspecified altitude, this setting constrains the flight path until pilots enter further commands.

Lateral Navigation The LNAV mode resembles the task of driving a car: LNAV controls horizontal direction. In addition to the CDU, pilots use a CRT-based (cathode-ray tube) graphics display, the horizontal situation indicator (HSI), to verify that they have correctly entered the path into the FMS (Fig. 8.3). The HSI provides a visualization of the programmed lateral path. In flight, pilots use the HSI to monitor the progress of the aircraft as it proceeds along the path and to ensure that the auto flight system executes the LNAV function correctly. page_215 Page 216

Fig. 8.2. Mode control panel (MCP) showing constraints on VNAV control and information concerning the interaction of modes. The altitude limit is 10,000 ft. Controls that activate two vertical navigation modes, VANAV and altitude hold (ALT HOLD), are highlighted. page_216 Page 217

Fig. 8.3. Horizontal situation indicator (HIS) shows the programmed horizontal paths and the position of the aircraft with respect to that path. Pilots have few problems with the LNAV mode of the FMS (Sarter & Woods, 1992; Wiener, 1989). In fact, when describing LNAV, flight instructors sometimes refer to it as "the magic" of the glass-cockpit airplane (Wiener, 1989, p. 172) and tell pilots transitioning to glass cockpits that "they will love it" (Duke, personal communication, September 25, 1994). The enthusiasm for LNAV may be due in part to the HSI display. The HSI is an intuitive, integrated, and dynamic display that pilots use easily to visualize, verify, and monitor both the programmed lateral path and the aircraft's position on that path. Vertical Navigation

VNAV is the other primary navigation mode of the FMS. VNAV is problematic for several reasons. First, the VNAV mode has several complex submodes; uncommanded transitions from one submode to another may surprise pilots. Second, unlike the lateral path, the vertical path tends to require frequent, real-time pilot corrections or overrides. Third, important information about VNAV operation is distributed across a set of cockpit displays. Finally, the primary information about the programmed path is contained on a collection of nonintegrated, alphanumeric CDU pages. Currently, cockpits do not contain a vertical equivalent of a HSIan integrated, pictorial, and dynamic representation of the aircraft in the vertical plane. page_217 Page 218 The number of VNAV modes available to pilots has advantages and disadvantages. The primary advantage is that the combination of the FMS and MCP provides a large set of modes and submodes from which pilots can specify and refine navigation automation. The disadvantage is that, at times, these two sets of controls seem to conflict, causing unexpected transitions from one mode to another. For example, if the aircraft is climbing along the path specified by the VNAV mode of the FMS and it encounters an altitude limit specified in the MCP, VNAV may automatically disengage and the aircraft will transition into altitude hold mode. Such uncommanded transitions are one source of automation surprise. As with the lateral path, pilots again use the CDU to "program" the vertical path. Before takeoff, pilots use several CDU pages to enter the complete vertical path including climb (CLB), cruise (CRZ), and descent (DES) pages. During flight, in addition to various CDU pages, pilots use the mode control panel (MCP) to set constraints on altitude, speed, and so on, for the programmed flight path. During all phases of flight, pilots concurrently monitor numerous displays to ensure that the combination of the MCP and FMS is controlling, and will continue to control, the aircraft in the desired and predicted manner. Displays include upwards of five pages in the CDU, which contains the only detailed information about the programmed vertical path (Fig. 8.1), the MCP, which shows the constraints on the programmed vertical path (Fig. 8.2), and the attitude direction indicator (ADI), depicted in Fig. 8.4, which displays mode annunciations including both engaged and active vertical modes, color coded to distinguish between them. The number of information sources, their location, and the display formats contribute to what Sarter and Woods (1992) called the opacity of the auto flight system: numerous, nonintegrated, predominantly alphanumeric displays that obscure system function and the interaction of its various subsystems. Examining these displays, it is no surprise to find that pilots have a great deal of difficulty understanding, using, and predicting the behavior of the auto flight system, particularly its vertical component. The "best" solution to the VNAV problem is undoubtedly to redesign cockpit displays and make it as easy for pilots to understand and manage the aircraft in the vertical plane as it is in the horizontal. As early as 1989, Wiener suggested that future cockpits might include such displays in response to observed problems. A change to cockpit displays, however, involves a process fraught with political, organizational, and engineering difficulties. Cockpit displays must be certified, thus change is expensive and slow. Furthermore, flight deck "real estate" is scarce and protected. Even an informal poll of line pilots failed to suggest a consensus on what information a vertical profile display could replace (Mitchell, personal communication, August 18, 1994). Finally, there is no consensus about an page_218 Page 219

Fig. 8.4. Attitude direction indicator (ADI) depicts engaged and active modes. In this case, the lateral mode is heading select (HDG SEL) and the vertical model is VNAV. VNAV SPD indicates that VNAV is in the vertical speed mode.

effective design for a vertical profile display. Over the years there have been several candidate approaches. As Wiener suggested, one approach is a display that complements the HSIa vertical situation indicator (VSI). This type of display might consist of a graphical map of the planned vertical route, current and target altitudes, and actual aircraft position. When evaluated, however, several candidate designs did not enhance pilot performance. An alternative to separate horizontal and vertical situation displays is to integrate the vertical and horizontal planes into a single three-dimensional depiction: a flight path in the sky. Emerging technology makes such displays possible and, discounting certification costs, affordable. Again, however, empirical studies have failed to show that proof-of-concept designs enhance pilot performance (e.g., Williams & Mitchell, 1993). Training is undoubtedly a "weak" response to VNAV problems. Though admittedly a stopgap measure, given the costs of adding or modifying cockpit displays, and until a design with broad endorsement by the aviation community and data that demonstrate enhanced performance, training appears to be the primary viable, short-term alternative. The VNAV Tutor explores this training alternative. It is a research effort designed to explore computer-based strategies to train pilots in VNAV page_219 Page 220 operations. The goal is to help pilots better understand and more effectively use VNAV modes both on the ground and in the air. Mitigating the Problem: VNAV Tutor The VNAV Tutor was designed specifically to remediate two major pilot concerns identified by Sarter and Woods (1992): pilot difficulty understanding and visualizing the vertical profile, and pilot difficulty conceptualizing the dynamic interaction of the MCP and the flight management computer during flight. The VNAV Tutor attempts to show pilots current modes, upcoming mode transitions, and control processes normally hidden by the FMS interface. That is, the VNAV Tutor tries to make abstract concepts and processes visible and understandable (Hollan, Hutchins, & Weitzman, 1984; Norman, 1988). In conjunction with a desktop simulator, the VNAV Tutor teaches pilots how to interact with the auto flight system including the MCP and the CDU. Integrating descriptive information and guided practice with VNAV modes during full-mission scenarios, the VNAV Tutor attempts to help pilots build a more robust conceptual model of VNAV operation and confidence in their skill to monitor, anticipate, and fine-tune VNAV submodes during flight. The Tutor has two sets of goals. The first is to help pilots learn normal VNAV operations and the interaction of VNAV submodes with other aspects of the aircraft. The second is to help pilots recognize and cope with inflight situations that require them to make use of specialized VNAV features. The Vertical Profile Display The heart of the VNAV Tutor is the vertical profile display, depicted in Fig. 8.5. The vertical profile display is added to the conventional cockpit displays as part of the VNAV Tutor training environment. This display provides an otherwise unavailable visual representation of the programmed vertical path and its interaction with other VNAV modes. Using the vertical profile display, the VNAV Tutor depicts current and predicted aircraft behavior in the vertical plane. The design of this display attempts to complement that of the HSI (Fig. 8.2). Like the HSI, the vertical profile display is based on the premise that "a picture is worth a thousand words": that is, a picture more adequately supports development and maintenance of a robust and accurate conceptual representation than a collection of alphanumeric displays such as those of the CDU. The vertical profile display graphically depicts the path programmed into the FMS. In flight, the display enables pilots to monitor the progress of the aircraft as it proceeds along the path and to ensure that the auto flight system executes the VNAV function correctly. The VNAV Tutor gathers data relevant to VNAV status and operation that are distributed throughout the cockpit, integrates them, and displays page_220 Page 221

Fig. 8.5. Vertical profile display during a VNAV climb. The current vertical control mode is VNAV speed. Altitude is constrained to a maximum of 10,000 ft.

the result in one placethe vertical profile display. Near the upper left corner, in Fig. 8.5, the display shows the currently active vertical control submodeVNAV SPD. In the cockpit, pilots obtain this information from the ADI (e.g., VNAV SPD is the engaged mode in Fig. 8.4). The vertical profile display shows waypoints, crossing restrictions, and other aspects of the vertical path such as transition altitudes, step climbs and descents, and VNAV points of inflection (e.g., top of climb and top of descent) that comprise the programmed path. In the cockpit, this information can only be obtained from CDU pages, including CLB, CRZ, and DES pages. The vertical profile display uses color coding and symbology analogous to that used on the HSI. For example, a magenta line with associated waypoints depicts the programmed path. A green horizontal line shows the upcoming altitude limit specified in the MCP: 10,000 ft in Fig. 8.5. Like the HSI, the vertical profile display is dynamic. As the aircraft flies, by highlighting and color-coding MCP constraints on upper altitude during climb and lower altitude during descent, the vertical profile display shows the relationship of the MCP altitude constraint to the VNAV path programmed in the FMS. The display also provides predictive information. Highlighting and color coding show the point in the future where, lacking further pilot input, the aircraft will transition to the altitude hold mode and level off at the altitude specified on the MCP. Figure 8.5 shows a vertical profile display depicting an aircraft during climb phase. Using heavy black lines in place of highlighting, the display shows current aircraft position and the predicted vertical path, including page_221 Page 222 the MCP altitude10,000 ftand where, without additional pilot input, the aircraft will transition from VNAV climb to altitude hold. VNAV Tutor Architecture Figure 8.6 shows the components that comprise the VNAV Tutor program. The VNAV Tutor uses the Georgia Tech Electronic Flight Instrument Research Tool (GT-EFIRT) as its simulator. GT-EFIRT (Williams & Mitchell, 1993) is a part-task flight simulator designed to evaluate training and aiding strategies for pilots of glass-cockpit aircraft. The simulator interface depicts the electronic flight instruments and the auto flight systems of a Boeing 757/767 (B-757) aircraft. The underlying simulation is based on a 3-df (degrees of freedom), point-mass model of the B-757. The simulator, cockpit displays, and VNAV Tutor are implemented in C and PHIGS, and run on a Sun SPARCstation 10 in a Unix environment. Students interact with the VNAV Tutor via a mouse and three 21-in. monitors equipped with touch screens. The left two monitors display the electronic flight instruments and mouse-activated controls of the GT-EFIRT simulator. The right monitor contains the vertical profile display and tutorial dialog. The VNAV Tutor teaches VNAV concepts and operations with four full-mission flight scenariosa type of training called line-oriented flight training (LOFT) by the airline industry. VNAV Tutor scenarios help students to understand the components that comprise the vertical profile, use the VNAV mode to execute the profile, study the interactions between

Fig. 8.6. Components comprising the VNAV Tutor. page_222

Page 223 the FMS and other VNAV modes, and use VNAV to complete various inflight maneuvers. The four scenarios are designed to be ''flown" in a fixed order. As students fly a scenario, the VNAV Tutor monitors the progress of the flight and coaches students in effective VNAV operations. One module containing a pedagogical component and a representation of student performance controls instruction and monitors for important eventsfor example, student errors or significant state changes. When an event is detected, the VNAV Tutor pauses the simulator and provides tutorial instruction. The Tutor also monitors for actions that students may omit. If it detects missed opportunities to use VNAV operations, improper use of the MCP altitude limit, or other events that affect the VNAV operational status, the Tutor intervenes with suggestions. Expert knowledge, that is, how to effectively use VNAV modes, resides in the domain knowledge base. The VNAV Tutor uses two media for instruction: text and audio. Text is displayed in a dialog box on the vertical profile display. When a student completes reading Tutor-generated descriptions or instructions, indicated by the completion of audio instruction and student acknowledgment in the dialog box, the simulated flight scenario continues. Evaluation An evaluation of the VNAV Tutor was conducted onsite at the training facility of a major U.S. airline. Participants were line pilots from this airline who were attending a Boeing 757/767 training program. Participants had little or no previous experience flying glass-cockpit aircraft; that is, they were transitioning to a glass cockpit. Five individuals, three captains and two first officers, participated in the study. Each had over 10,000 hours of flight time except one first officer who had 2,500 hours. Previous flight experience included Boeing 727, 737, 747 (no FMS); Douglas DC-9, -10; and Lockheed L-1011 aircraft. All participants were volunteers. Procedure Participants completed six 1-hour sessions. In Session 1, they filled out a written questionnaire. The questionnaire was used to assess a participant's background as well as initial knowledge and experience with VNAV operations. Next, the experimenter demonstrated how to "fly" the GT-EFIRT simulator. Following the demonstration, each participant practiced interacting with the simulator. Participants flews the four VNAV Tutor scenarios during the next four sessions. During each session, the VNAV Tutor functioned as a coach and the tutorial environment included the vertical profile display. In the sixth and final session, each participant flew an evaluation scenario. This scenario did not include the VNAV Tutor or the vertical profile display. The evaluation scenario was page_223 Page 224 the same for each participant, but was not one of the four VNAV Tutor training scenarios. During the evaluation scenario, performance data were collected. Measures assessed timely and correct execution of various VNAV tasks including VNAV mode activation, speed intervention, descend-now activation, and approach change operation. At the conclusion of the final session, participants completed a written questionnaire and answered scripted questions attempting to elicit their knowledge about overall VNAV operation. The questionnaire was similar in form and content to the questionnaire completed prior to VNAV Tutor training. The intent was to gauge the degree to which participants improved their knowledge of VNAV-related operations after completing the VNAV Tutor instructional program. The scripted questions also solicited pilot opinions about the advantages and disadvantages of the VNAV Tutor. Results Analysis of the data from the initial questionnaire showed that, prior to using the VNAV Tutor, participants had only limited knowledge about VNAV operations and its interaction with other auto flight functions. Although some participants knew about selected topics, none felt comfortable with their current level of B-757 VNAV knowledge. Figure 8.7 depicts initial participant responses. The question-and-answer data collected after the conclusion of the evaluation scenario are also depicted in Fig. 8.7. Comparison of before and after responses to questions about VNAV operations suggests that participants greatly increased their ability to explain various VNAV operations.

Fig. 8.7. Pilot responses to questions about VNAV-related operation before and after using the VNAV Tutor. page_224

Page 225 Performance data collected during the evaluation scenario provided further support for this conclusion. Figure 8.8 depicts a portion of these data. As Fig. 8.8 shows, at least 80% of the participants correctly performed all tasks in the various categories of VNAV operation. Overall, the data suggest that the VNAV Tutor was quite effective. After concluding training with the VNAV Tutor, participants could both correctly answer questions and effectively execute operations related to VNAV operation. Finally, participants, in response to scripted questions regarding the perceived usefulness of the VNAV Tutor, were very enthusiastic. Predictably, the initial suggestion was to include a version of the vertical profile display in the cockpit. Lacking an immediate change in cockpit displays, participants thought the VNAV Tutor made an important contribution to training and their knowledge about VNAV operations. Conclusions and Lessons Learned The VNAV Tutor research provides a number of highly instructional lessons for future research in aviation training. Though successful in its specified objectives, that is, demonstrating the effective use of computer technologies to provide inexpensive training for pilots having trouble

Fig. 8.8. Pilot performance on VNAV tasks during the evaluation scenario and after completing VNAV Tutor instructional program. page_225 Page 226 understanding and using VNAV modes, the evaluation of the VNAV Tutor revealed several real-world limitations. The first issue raised by the evaluation of the VNAV Tutor is that new strategies for automation training should probably focus training topics and training time after students conclude existing training programs. The goals of current training programs and certification requirements constrain potential enhancements that research might suggest. Current training curricula frequently have a fixed time in which training must be completed and fixed goals that training must address. It is not feasible in many cases to add material to the existing curriculum or extend the length of the training program to include additional topics. Constraints on training programs are not unique to aviation. This limitation applies to any training research whose application is within the context of a formal training curriculum, particularly one constrained by regulation or certified for adherence to formal standards. Many industries adhere to government regulations for operator training (e.g., nuclear power or military systems) and many other industries have formal examinations that operators must pass. It is no surprise to find that the primary training goal is to enable students to pass the required examinations. Pilot training is but a case in point. Consider the following. When U.S. pilots transition to a new aircraft type, the primary instructional goal is to enable students to pass the ground school examination and the check-ride. Both tests are specified by the Federal Aviation Administration (FAA) and administered by FAAcertified examiners. The written ground school test requires extensive declarative knowledge about aircraft systems, safety systems, flight controls, and so on, over and above knowledge about the auto flight system and related automation. The check-ride, conducted in an aircraft or full-motion simulator, requires a pilot to cope with numerous rarely encountered, but potentially catastrophic, situations such as the loss of an engine or an aborted takeoff. Even experienced pilots often describe training as "drinking from a fire hose": trying to absorb and integrate an enormous amount of data in a very short time. As such, adding training topics becomes problematic. Both instructors and students are hard pressed to suggest when or how new material, for example, additional VNAV training, can be added.

Although the data for VNAV Tutor suggest that the program is pedagogically sound, the stage in training for which it was designed is neither practical, nor in the long run, useful in the highly competitive commercial airline environment. The VNAV Tutor is intended for pilots who have completed ground school (i.e., passed the written FAA exam), but not yet begun flight training. When participants for the VNAV Tutor evaluation were sought, both pilots and training personnel were concerned that even page_226 Page 227 the 6-hour VNAV Tutor curriculum would overload students whose time and intellectual resources were already highly constrained. After passing the ground school exam, the training program next focuses on ensuring that students can pass the check-ride. Neither students nor instructors believe that the current training program allows time for additional VNAV instructionno matter how effective this instruction may be. The addition of VNAV training such as that illustrated by the VNAV Tutor necessitates that either the goals of the training program change, requiring a change in FAA certification requirementsa long, slow processor the length of the training program must be extended, unlikely given the costs. Moreover, as originally conceived, the VNAV Tutor is not easily used after the completion of formal training. Training is often not held at the location at which a pilot is stationed. After training, pilots quickly leave the training facility and return to their home base and normal flight operations. The VNAV Tutor, with its hardware and software requirements, requires the infrastructure of a training facility. Thus the second lesson of the VNAV Tutor is that additional or supplementary training is likely to be more useful if it is accessible after formal training and not dependent on a centralized or remote infrastructure. Third, and on the positive side, the VNAV Tutor highlighted clear training needs that research in aviation automation should address: These are areas not adequately covered by current programsparticularly for pilots in advanced-technology cockpits. Current programs typically do not include all necessary training or practice in skills that are needed in day-to-day operations. To ensure that pilots can pass required examinations, training programs spend what might be considered a disproportionate amount of time teaching descriptive knowledge and skills to "cope with disasters" when compared to the amount and type of knowledge needed for typical, day-to-day operations, particularly in economically attractive auto flight operations. The FAA and the aviation industry both acknowledge this limitation and, as a result, pilots new to an aircraft type or position fly with an instructor pilot in a two-pilot team during initial line operations. This period of time is designed to enhance pilot skills during normal operations. Fourth, the VNAV Tutor demonstrated the effectiveness of an alternative or supplement to on-the-job training for day-to-day operationsinexpensive computer technology for both instruction and desktop simulation. The VNAV Tutor evaluation showed that such a system could effectively teach needed concepts and allow pilots to practice important skills that are extensively addressed in the current curriculum. Knowledge acquired through instruction, such as computer-based instructionwhich includes a simulatoris likely to be more consistent and complete than that acquired in the relatively unstructured on-the-job training environment or over time page_227 Page 228 with line experience. More broadly, training provided by computer-based systems such as the VNAV Tutor could extend training to balance "disaster training" with skills acquired in day-to-day operations. The fifth lesson raised questions about effective content and context for computer-based instructional programs such as that characterized by the VNAV Tutor. Although the VNAV Tutor teaches important foundational, or generally applicable, knowledge about VNAV operation, ongoing research and field experience suggest that automation problems for experienced pilots may be as dependent on specific contexts and knowledge about how to cope with those situations as it is on general knowledge or situation-independent skills. Automation surprises may occur when general knowledge encounters idiosyncratic situations created by environmental conditions, automation software "glitches," or some combination of the two. Full-mission, or LOFT scenarios, though important in conventional airline training, may not be an effective way to fine-tune or refine the skills of pilots who, in many respects, are already experts. Although the GT-EFIRT simulator allows the tutor to fastforward through the cruise phase, the VNAV Tutor evaluation raises questions about whether the time required for full-mission scenarios is an effective use of student time. More focused scenarios, or flight segments, might better use student time. Finally, the VNAV Tutor has a very limited student representation. It corrects specific errors of omission or commission but lacks broad knowledge (i.e., intelligence) or an integrated representation with which to tailor instruction to the skills, learning style, or overall progress of an individual student. Taken together, these factors provide the groundwork for alternative strategies to train operators of complex systems. The next section describes a computational model, GT-CATS, that can predict and interpret operator actionsan activity-tracking system. This architecture offers one way to specify expert and student representations that an intelligent instructional system requires. The final section of the chapter describes a computational architecture for a case-based intelligent tutor. This project, still in development, builds on the lessons of the VNAV Tutor by using cases (or "gotchas") to situate instruction and uses computational models, similar to those of GT-CATS, to focus instruction on the needs of individual students. Georgia Tech Crew Activity Tracking System (GT-CATS) Breakdowns in human-system interaction have motivated a broad spectrum of research that explores the problem in three interrelated ways: improving the design of the human-system interface, improving operator page_228

Page 229 training, and devising ways to adaptively aid the operator and create error-tolerant systems. Adaptive aiding combines dynamic task allocation, that is, strategies to help operators "remain in the loop," with error-resistant, error-tolerant systems that help operators avoid making errors when possible, and detect and mitigate the effects of errors that do occur (Billings, 1997; Palmer, Hutchins, Ritter, & vanCleemput, 1991). One way to foster error tolerance and support dynamic task allocation is to develop intelligent operator aiding systems that monitor humansystem interaction and offer operators timely advice and reminders (e.g., Funk & Kim, 1995; Rubin, Jones, & Mitchell, 1988). An intelligent aiding system requires a representation that defines the knowledge the aid needs to monitor the system, to offer context-sensitive assistance, and to detect or mitigate possible errors. One means by which to construct these representations is by modeling operator intent. The GT-CATS research, and other similar projects, construct and maintain a dynamic, context-specific representation of what the operator is doingand will do in the near termand why. The GT-CATS research proposes a methodology for activity trackingmodeling operator intent by predicting and explaining operator activities. The methodology embodies a theory that first establishes conditions on the types of knowledge that must be available about a domain in order to support activity tracking. Specifically, the methodology applies to engineered systems in which information about the state of the system, goals of the operators, and standard operating procedures is available. Second, the theory underlying the GT-CATS activity-tracking method establishes an organizational structure for available domain knowledge. In particular it extends the operator function model (OFM) (Mitchell, 1987, 1996) with an explicit mode representation to reflect how operators use automation. Third, the methodology is founded on the assumption that it is possible to transform available knowledge of the state of the controlled system and goals of the operator into knowledge about how to predict operator activities as represented in the OFM-ACM. In run time, the GT-CATS methodology provides a means of constructing a set of expected operator activities and refining those expectations into explanations for observed actions. The GT-CATS research has several components. First, it proposes a theory of activity tracking. Next, it specifies a computational architecture that instantiates the theory. Third, it implements the architecture in proof-of-concept form for navigation of a Boeing 757 (B-757). Finally, it evaluates the effectiveness of the proof-of-concept application by assessing the extent to which pilot navigation and control actions can be explained. The sections that follow summarize the GT-CATS system, its implementation, and empirical evaluation. Further detail can be found in Callantine (1996) and Callantine, Mitchell, and Palmer (1997). page_229 Page 230 GT-CATS Architecture Five knowledge representations comprise the GT-CATS activity-tracking system (Fig. 8.9). The first is a static, task-analytic model of operator activitiesthe operator function model for systems with automatic control modes (OFM-ACM). During run time, two components represent dynamic knowledge: The state space represents constraints imposed by the state of the controlled system, for example, aircraft altitude, selected auto flight mode, and the limited operating envelope (LOE), which represents constraints imposed by the environment, including air traffic control (ATC) clearances and the flight plan. The fourth representation, dynamically updated OFM-ACM (DUO), is the run-time instantiation of the OFM-ACM. Finally, there is a set of context specifiers; context specifiers summarize system state, environmental information, and limiting operating envelope constraints. In run time, as the system changes and operators execute actions, context specifiers annotate DUO nodes to generate predictions about expected operator activities and to interpret actual operator actions. OFM-ACM: The Operator Function Model for Systems with Automatic Control Modes Knowledge about operator activities is represented in an explicit, task-analytic model that extends the operator function model (OFM) (Mitchell, 1987, 1996) with a mode representation. OFM-ACM specifies how operators use automatic modes to achieve desired performance. Like the OFM, the OFM-ACM is structured as a heterarchic-hierar-

Fig. 8.9. The Knowledge structures comprising GT-CATS. page_230

Page 231 chic network of nodes that represents operator activities at various levels of abstraction. The structure of the OFM-ACM provides a theoretical framework for organizing operational knowledge. For example, a control function is decomposed into mutually exclusive modes, each representing a control strategy available to the operator. Each mode is decomposed into activity "subtrees" that represent tasks, subtasks, and actions required to use the mode. Figure 8.10 depicts the general form as well as a portion of an OFM-ACM used to model navigation activities of B-757 pilots. The OFM-ACM decomposes the navigation task into phases, subphases, functions, mode selections, tasks, subtasks, and actions. The OFM and OFM-ACM are very similar. They are both normative models: They describe correct activities that operators can undertake to meet system objectives. Neither model represents incorrect behavior, that is, a buggy model. In addition, they are both nondeterministic models: They represent, where appropriate, alternative means by which operators can meet system objectives. There is, however, one significant difference between the OFM and the OFM-ACM: The latter adds "preference" to alternative mode choices. For a given situation, the OFM-ACM has a predicted, or "preferred," mode together with its associated activities. For example, if a vertical path is programmed into the FMS, the OFM-ACM might predict that pilots would use VNAV rather than flight-level change (FL CH) to meet vertical profile objectives. State Space: Representing the Controlled System The state space encapsulates relevant knowledge about the state of the controlled system. In aviation applications this includes the aircraft and its various systems. Dynamic updates to the state space must be sufficiently frequent to accurately reflect the current state. The fidelity of the state space is defined by

Fig. 8.10. OFM-ACM structure, showing mutually exclusive phases and subphases, mutually exclusive mode selections, possibly concurrent (heterarchical) activities (boxed) and sequential activities (arrows). page_231 Page 232 the granularity of state knowledge about the system along with how frequently it is updated. For navigation applications, state variables include speed, altitude, auto flight modes, and programmed route information. Limited Operating Envelope GT-CATS LOE summarizes the constraints placed on the controlled system derived from safety concerns, regulatory agencies, the operating organization, and the capabilities of the controlled system itself. Assuming well-trained and motivated operators, constraints on system operation are represented by the LOE and define operator objectives. The GT-CATS methodology is concerned with systems in which the state of the system and the goals of the operator change; thus, the LOE is dynamic and reflects constraint and state changes. The LOE for B757 navigation has constraints derived from three sources: ATC clearances, the route the aircraft is scheduled to fly (i.e., flight plan), and airline organizational guidelines for general operation (e.g., engage VNAV at 1,000 ft in the climb). Context Specifiers Each node in the OFM-ACM specifies the operational context in which the operator is expected to perform the associated activity. For example, if the cleared and actual aircraft headings are the same, a pilot might engage the heading hold mode. Context specifiers play a critical role in the GT-CATS methodology. They link dynamic knowledge from the representations of the environment and controlled system with operator activity knowledge represented in DUOthe computational instantiation of the OFM-ACM. In run time, context specifiers are activated, in most cases, by comparing information in the LOE to the values of state space variables. For the B-757 navigation application, context specifiers include Boolean variables such as heading-outside-of-limits and FMS-vertical-profile-programmed. Dynamically Updated OFM-ACM DUO is a computational instantiation of the OFM-ACM and as such it includes all of the static knowledge contained in the OFM-ACM. In run time, with dynamic updates, DUO models current operator interaction with the control automation. As the state changes and operators execute actions, context specifiers annotate DUO nodes with current knowledge to support real-time activity tracking and intent inferencing. Four processes comprise GT-CATS activity tracking. First, using DUO and context specifiers, GT-CATS creates expectations about what activities an operator will perform given the current operational setting. Second, as the operator executes actions, GT-CATS attempts to confirm its expectations. GT-CATS separates observed actions executed in real time into two cate-

page_232 Page 233 gories: expected and unexpected. The GT-CATS activity-tracking process confirms actions that are expected. Unexpected actions trigger the third process: revision. Recall that for a given operational context, the OFM-ACM and its run-time instantiation, DUO, represent a predicted mode as well as one or more alternative modes, for example, the choice of VNAV versus flight-level change (FL CH). Using alternative modes, the revision process attempts to determine if the observed action supports an alternative mode that will also meet the current goals. Actions that GT-CATS does not predict and cannot explain as supporting an alternative mode are potential errorserrors of commission. Finally, GT-CATS attempts to identify missed or late actions; these actions may constitute errors of omission. GT-CATS Proof-of-Concept Implementation A GT-CATS proof-of-concept implementation was designed to track the activities of B-757 pilots using auto flight modes under normal operating conditions The GT-CATS software was implemented in Lisp and runs on a Sun SPARCstation 20 with two 21-in. monitors. One monitor contains a graphical representation of DUO and is color coded as activities are predicted and pilots execute navigation and control actions. The second monitor allows the experimenter to issue real-time ATC commands as a pilot ''flies" the scenario. Like the VNAV Tutor, the GT-CATS research used GT-EFIRT, a part-task simulator of a B-757. Simulator hardware includes a Sun SPARCstation 10 with two 21-in. monitors. Pilot input was via a mouse and keyboard. Pilots "fly" GT-EFIRT while GT-CATS predicts and interprets activities. GT-CATS and GT-EFIRT communicate via Unix sockets. During a flight scenario, both GT-CATS and GT-EFIRT create data files. GT-CATS creates files that record predictions of mode selection and management, pilot actions, and when possible, an interpretation of each action. In addition, GT-CATS data files record actions that are expected, but not detected, that is, possible errors of omission. GT-EFIRT creates files in which state data are logged every 5 seconds; these data include aircraft state variables, ATC clearances, and operator actions. In this implementation, the GT-CATS DUO model had separate task-analytic representations for each phase and subphase of flight. For example, the climb phase was separated into three representations: climb to 1,000, climb to 3,000, and climb to cruise. Changes from one underlying DUO phase or subphase to the next were initiated by events such as aircraft state changes (e.g., 1,000-ft altitude). Moreover, in this implementation, GT-CATS schedules the revision process 20 seconds after it determines that a pilot action was not predicted. page_233 Page 234 Evaluation The evaluation of GT-CATS sought to assess the effectiveness of the GT-CATS activity-tracking method. Professional airline pilots flew scenarios on the GT-EFIRT B-757 part-task simulator. GT-CATS ran in parallel and attempted to interpret each action as the pilot executed. Prior to the formal evaluation, several B-757 type-rated line pilots tested GT-EFIRT to ensure that participants in the experiment would be likely to perform in a manner typical of line operations. Ten B-757 type-rated pilots participated in the formal study. All were line pilots with the same commercial airline. Two were captains, eight were first officers; all were volunteers. The mean number of years of reported experience on the B-757 was 3.2 years, with a minimum of 1 year and a maximum of 5 years. Four pilots transitioned to the B-757 from the B-737, four from the B-727, and two from the MD-88. Evaluation Configuration The evaluation for this GT-CATS system used GT-EFIRT, a workstation-based B-757 simulator, running on a Unix workstation. The pilot flew the simulator while sitting in front of two 21 in. monitors that comprised the major displays and for non-manual navigation and control running. GT-CATS ran on a separate Unix workstation connected to GT-EFIRT via Unix sockets. The experimenter monitored GT-CATS, which passively predicted pilot activities and attempted to interpret pilot actions. Finally, video equipment was set up to tape both the simulator that the pilots participating in the evaluation used as well as the display of GT-CATS. The configuration enabled the experimenter to observe pilot activities, as well as GT-CATS operation. Computer data were collected in files output by both the simulator and GT-CATS. Simulator files include state data (logged every 5 seconds), time-stamped ATC clearances, and time-stamped operator actions. GT-CATS output files contain time-stamped data that show when each prediction was generated, and how and when each operator action was interpreted. The data also show all activities that are predicted at the time when GT-CATS predicts or interprets an action. Videotape data were collected to assist in cases where the computer logs were ambiguous about how to interpret an action. Evaluation Tasks This study used five full-flight scenariosLOFTs. Flight scenarios were designed to require participants to make extensive use of the available automation. Each scenario is defined by a flight plan that is preprogrammed into the simulator's flight management computer before the flight, and a predefined set of ATC clearances issued during the flight. A scenario begins with a clearance issued while on the ground, page_234

Page 235 proceeds through takeoff, climb, cruise, and descent; a scenario ends when the final approach clearance is issued. To allow participants to fly scenarios in a reasonable amount of time, scenarios were designed to "fast-forward" through periods of inactivity in the cruise phase of flight. The scenarios incorporate departure and arrival procedures commonly used for the selected airports. Actual traffic conditions were exaggerated in light traffic areas to increase the need for ATC intervention. Detailed description of the scenarios can be found in Callantine (1996) and Callantine, Mitchell, and Palmer (1999). Each participant flew all scenarios in the same order. Before beginning, participants completed a survey describing their background. The experimenter then described the purpose of the study, explaining that the goal was to evaluate the performance of GT-CATS rather than that of the pilot. Pilots were asked to use cockpit automation as they normally would during line operations. The experimenter explained the features of the GT-EFIRT simulator and provided assistance as each participant flew a scenario to become oriented to the experimental configuration. Following the introduction, participants flew the five evaluation scenarios with GT-CATS tracking their activities in real time. Pilots were asked to verbalize their activities to the extent necessary to indicate why they performed a particular action in cases where it was not obvious; each scenario was recorded on videotape. Performance Measures This study was designed to evaluate the effectiveness of GT-CATS in tracking pilot navigation activities. Specifically, the goal was to measure the extent to which GT-CATS correctly interprets pilot actions and identifies possible errors of commission and omission. GT-CATS classifies each pilot action in one of two ways: correct or uninterpreted. A correct action is an observed action that is either predicted initially or interpreted as correct by the GT-CATS revision process. A predicted action, which is executed by the pilot, matches the anticipated, or preferred, mode specified in the OFM-ACM. An action that is executed by the pilot but not predicted is classified as correct because the revision process associates it with an alternative mode specified in OFM-ACM. GT-CATS classifies an action as uninterpreted when it is neither predicted nor able to be associated with an alternative mode. There are two types of GT-CATS errors: misclassifications and misinterpretations. If GT-CATS classified all actions accurately, all actions that are pilot errors would be classified as uninterpreted and all uninterpreted actions would be pilot errors. Recall GT-CATS used a normative model and as such does not represent erroneous activities. A misclassification error occurs when GT-CATS classifies a correct pilot action as uninterpreted or classifies an erroneous action as correct. A misinterpretation occurs when page_235 Page 236 GT-CATS classifies an action as correct but does so for the wrong reasonthat is, it associates the action with an inappropriate activity. Both types of errors are attributable to factors including misrepresentations of operator activities in the OFM-ACM or run-time errors in the GTCATS system. GT-CATS accuracy was judged by comparing its classifications and interpretations to those of domain experts. After participants flew the five evaluation scenarios, domain experts reviewed each pilot action in context and classified it as either correct or incorrect. Then, they associated each correct action with an activity appropriate in the current flight contexta reason. Results Participants flew a total of 50 scenarios that resulted in 2,089 pilot actions. GT-CATS classified 1,753 actions as correct; that is, 1,753 actions were either predicted or interpreted as correct by the revision process. GT-CATS classified the remaining 336 actions as uninterpreted. Domain experts classified 41 actions as pilot errors; the remaining 2,048 actions were classified as correct and associated with a reason appropriate in the flight context. As determined by comparing classification made by GT-CATS with that of domain experts, error identification was excellent. Both GT-CATS and domain experts flagged the same single error of omission. The 41 errors of commission identified by domain experts were actions GTCATS classified as uninterpretedthe appropriate classification for a normative model. GT-CATS, however, incorrectly classified 295 actions. These were actions that domain experts classified as correct, but GT-CATS was unable to interpretthat is, to associate with either a predicted or alternative activity. The second measure of GT-CATS accuracy is correctness of interpretation. Of the 1,753 actions that GT-CATS interpreted as correct, the reasonsthat is, the association with an upper-level activity in the DUO modelmatched those of the domain experts for 1,664 actions. There was a mismatch in interpretation for 89 actions. Thus, as depicted in Fig. 8.11, GT-CATS correctly interpreted 82% of pilot action1,705 actions out of a total of 2,089. These included actions that were interpreted correctly (1,664) and pilot errors that GT-CATS classified as uninterpreted (41 actions). Post Hoc Analysis The preceding analysis was based on data and GT-CATS classifications made in real time, as pilots flew scenarios and GT-CATS predicted activities and attempted to interpret observed actions. A microanalysis was performed post hoc to determine why GT-CATS either could not interpret an action (384 actions) or gave an interpretation that page_236

Page 237

Fig. 8.11. GT-CATS correctly interpreted 82% of pilot actions1705 actions out of a total of 2,089. These included actions that were interpreted correctly (1664) and pilot errors that GT-CATS classified as uninterpretable (41 actions). did not match that of domain experts (295 actions). Four basic error types were identified. The first error type involves the GT-CATS revision process for this implementation. When the pilot performs an action that is unpredicted, GTCATS schedules a revision process for that action 20 seconds later. In part, this was a design decision intended to allow aircraft systems time to reflect pilot actions and stabilize. For example, even sophisticated aircraft are known for the perceptible delay between when a pilot executes an FMS change and when the aircraft controls and displays reflect this change. In part, the 20-second delay was due to an error in the design of the communications process between the GT-EFIRT simulator and GT-CATS. The simulator only sent updates for state space and LOE variables every 5 seconds. When the pilot performed an action, information about the action was sent immediately, but it was not accompanied by state information. Thus, it was possible for the revision process to use information that was older and significantly different in an attempt to interpret an action. There were 117 actions performed in a context in which the mode changed very quickly after the pilot performed an action. As a result, when the revision process attempted to interpret the action, the current state, as opposed to the state at the time when the action was performed, caused the revision process to classify the action as uninterpreted. For each of these uninterpreted actions, the microanalysis showed that if the page_237 Page 238 revision process used the state and LOE at the time in which the action was performed, the revision process would have correctly interpreted the action. This type of error accounted for 30% of erroneous interpretations. The second error type involved how GT-CATS represented phases and subphases. Seven actions could not be interpreted because GT-CATS used only the current phase or subphase as the context in which to interpret actions. In these cases, between the time when the action was performed and the time when GT-CATS attempted to interpret the action, the phase or subphase changed. In the new context GT-CATS could not interpret the action. This situation accounted for 2% of actions that were either misclassified or unclassified. The third error type involved the manner in which GT-CATS coped with multi-action sequences. Misinterpretation of multiaction sequences relates to the specific processes that GT-CATS uses to predict and interpret actions. All 89 actions were interpreted, but for the wrong reason. The problem was related to how GT-CATS interpreted sequence of actions, particularly where mutually exclusive modes had actions in common, for example, dial the MCP to the cleared altitude. GT-CATS, as opposed to OFMspert, interprets actions as they occur. It does not have a mechanism to assess a collection of actions, or more specifically, several collections of actions that have one or more actions in common. OFMspert uses post-hoc assessments to disambiguate actions and sets of actions that could have been executed for one of several reasons. This type of misinterpretation occurred 89 times and accounts for 23% of GT-CATS errors. The error type consists of browsing activities. There were 171 actions of this type and they accounted for 45% of GT-CATS misclassifications. Browsing activities consist of actions that are not obviously motivated by external events, for example, a new clearance. They may be activities that pilots perform to test system response, keep themselves in the loop, or use the flight deck display and controls as an external memory aid; for example, many pilots, even when LNAV is controlling lateral aircraft movement, align the heading bug to the current heading. Browsing activities that operators perform to test system response and to keep themselves in the loop have been observed in other studies (e.g., Jones, Mitchell, & Rubin, 1999) and such actions are likely to be related to the highly desirable activity called "active monitoring" (Sheridan, 1992; Thurman & Mitchell, 1994). There are plausible and principled ways to modify GT-CATS to ameliorate the first three of these problem types. The last type, browsing activities, however, is much more problematic. The problems associated with immediate mode transitions can be fixed either by sending GTCATS a snapshot of the system as each action is performed or by increasing the frequency of system updates. Most aircraft simulators, for example, can page_238

Page 239 easily provide updates at 30 Hz. Associating a system snapshot with each operator action is commonly done in similar research and allows flexibility of interpretation. Problems associated with phase and subphase transitions can be addressed either by integrating these representations or adding procedures to the revision process so it that can examine uninterpreted actions in the context of recently completed phases or subphases. The separation into phases and subphases was due to computational limitations; new and inexpensive computational resources have eliminated this constraint. The interpretation of multiaction sequences is a more difficult. Because GT-CATS incorporates the notion of a predicted mode, when two modes appropriate in a given context include one or more identical actions, such as setting the MCP altitude, the action will be associated with the predicted rather than the actual mode. There are at least two ways of modifying GT-CATS to remove this problem type. One is to use a procedure similar to that of OFMspert (Rubin et al., 1988); the other is to modify the current GT-CATS revision process. For example, the revision process could search for recently interpreted actions that might also support an alternative activity. If a misclassified action is associated with a mode other than that selected by the pilot, the interpretation of the action can be changed to reflect its support of the actual rather than predicted mode. The fourth error type, browsing actions, is not easily rectified, as browsing actions are often not predictable. Pilots, and other operators, often perform actions that are not predicted, but are neither dangerous nor worrisome. Although creating a model category called browsing is straightforward; it is not particularly useful. The OFM-ACM is a normative model; as such, pilot errors, also uninterpretable, and actions categorized as browsing are not distinguishable. In order to separate browsing actions from errors of commission, the OFM-ACM must be extended to represent explicitly erroneous activities. The problem of modeling operator error at this level of granularity is a challenging avenue of research and one pursued in a limited form in the research described in the final section of this chapter. Figure 8.12 depicts the results after the GT-CATS evaluation and microanalysis. With the modification suggested earlier made, GT-CATS correctly interprets 92% of all actions performed in the study and also correctly detects the one error of omission. The browsing actions and pilot errors remain uninterpreted. Conclusion This study provides strong support for the feasibility of intent inferencing or activity tracking using a task-analytic model and the methodology embodied in GT-CATS. In aviation, it is one of the first studies that predicts and interprets mode activities and related actions, and page_239 Page 240

Fig. 8.12. After adjustments for software errors in the GT-CATS model, GT-CATS correctly interpreted 92% of the 2,089 pilot actions. empirically assesses the reslts. In particular, GT-CATS and its predecessors, OFMspert (Rubin et al., 1988), Ally (an implementation of OFMspert for aiding, Bushman, Mitchell, Jones, & Rubin, 1993), and MOCA (an implementation of OFMspert for human-computer collaboration Jones & Mitchell, 1995), provide one critical component, that is, semantic models of operational intelligence for the creation of viable aids, fault-tolerant systems, and computer-based instructional systems. The Case-Based Intelligent Tutoring System (CB-ITS)

CB-ITS is an architecture for computer-based training for operators of complex dynamic systems. Intended for individuals who have already completed formal training, the goal of the CB-ITS is to help operators enhance and maintain expertise. CB-ITS will provide experience with prototypical and unusual operational situations, cases. CB-ITS includes a simulator that allows a student to experience and practice cases under the page_240 Page 241 guidance of a computer-based tutor. The OFM, OFMspert, and GT-CATS define the intelligence and instructional control for this architecture. Training Operations of Complex Systems: Trained Novice Versus Expert Operator training in complex dynamic systems typically does not produce expert operators (Billings, 1997; Di Bello, 1997; Hutchins, 1995). Indeed, formal training is often designed such that operators receive only the training necessary to produce "competent" performance, for example, a performance level sufficient for safe system operation (Billings, 1997). Chu, Mitchell, and Jones (1995) suggested that operators of complex dynamic systems require three types of knowledge: declarative knowledge, procedural knowledge, and operational skill. Declarative knowledge is the fundamental, factual knowledge about the system, its components, controls, and functions. Procedural knowledge is rule-based knowledge about how to operate the system and perform specific tasks. Operational skill is the ability to integrate declarative and procedural knowledge in a multitask, time-constrained environment. Operational skill includes the ability to recognize when activities are required and how to coordinate them to meet the demands of real-time operations. Data show that "textbook" knowledge, such as declarative and procedural, may be poorly integrated and compartmentalized for operators with less experience. Two studies highlight this point. Operators with comparable test scores on exams but different levels of expertise exhibit significant differences in operational performance (Stokes, Kemper, & Kite, 1997). Each type of knowledge plays a significant role in achieving safe and effective system operation. In the second study, Funk and his colleagues (Chou, Madhavan, & Funk, 1996) analyzed extensively records of aviation accidents and incidents. They found that task management, rather than a lack of knowledge, was a major contributor in a surprising number of these situations. The most apparent difference between newly trained and expert operators is their ability to integrate declarative and procedural knowledge in real time. Formal training may produce a trained novice as opposed to an expert. During training an operator may learn only a portion of required knowledge and may also acquire potentially buggy explanations about system composition and operation. Declarative knowledge may be incomplete. Procedural knowledge may be both incomplete and loosely integrated. Operational skill is often the least developed. Operators develop expertise over time by performing in the work environment and experiencing a broad range of situations (Hutchins, 1995). Stokes et al. (1997), however, suggested that simply working in the domain for a period of time is not sufficient to build expertise. On-the-job trainpage_241 Page 242 ing has many drawbacks, including being constrained to fortuitous situations that may occur and the lack of instructional control over such experiences (Chu et al., 1995). This research program explores the design of a computer-based training system that presents situationscasesthat other operators find problematic. Its audience is trained novices. By using situations, that is, cases, and a simulated operations environment, it attempts to mitigate the gap between trained novices and experts. It permits students to experience a wide range of situations, observe how a situation is handled both incorrectly and correctly, and finally practice, in conjunction with the simulator, managing the situation themselves. The computer-based coach provides assistance where needed. Intelligent Tutoring Systems and Situated Learning Intelligent tutoring systems (ITS) typically entail four components: domain expert, student model, pedagogy, and tutor interface (Burns & Capps, 1988; Wenger, 1987). The domain expert is a model that contains knowledge that characterizes expert performance, including declarative and procedural knowledge, and operational skill. The student model represents the tutor's evolving knowledge of the student. An ITS is intelligent in that it tailors instruction to the needs of individual students. By monitoring student progress and comparing an individual student model with the domain expert, the ITS can detect when a student is having difficulty with certain material, thus requiring additional instruction or remediation, or when a student is ready to proceed to new material. The individual nature of such training helps tailor instruction to the pace and learning style of each student. The pedagogy contains the teaching strategies, for example, illustration, hints, coaching, and may control the progress of the tutor. Finally, the tutor interface defines the interaction between the tutor and the student. Systems that teach operational skill add an additional component, a simulated environment (Burns & Parlett, 1991; Chu et al., 1995). Simulators, or training devices at various levels of fidelity, are used for training in many safety-critical systems. A simulated environment allows students to practice system control in a wide range of operating conditions and to see the results of their actions (Hollan et al., 1984; Vasandani & Govindaraj, 1995). Figure 8.13 shows the components of this type of ITS. Situated learning is a pedagogical strategy that teaches new material in relevant contexts (Collins, 1991). Through situated learning, students learn environmental cues and effects of control actions. Cognitive apprenticeship is on-the-job training in which the student acquires cognitive skills such as task management and situation assessment. An ITS can provide a form of cognitive apprenticeship by demonstrating expert perpage_242

Page 243

Fig. 8.13. Components of an intelligent tutoring system (ITS) to train operators of complex dynamic systems. formance in context or coaching student activities through realistic task scenarios. Case-based teaching (Schank, 1991) is a similar approach. It uses stories to teach. A story (case) is a ''memorable" situation, which includes a context and a lesson. Cases or "war stories" are ubiquitous among system operators. Pilots, for example, often acquire useful knowledge through page_243 Page 244 "hangar flying"exchanging stories that have a point. War stories or gotchas constitute an unstructured form of case-based teaching. Computerbased training systems that structure and present stories relating important experiences of other experts may help operators, such as pilots, increase their knowledge or expertise after the conclusion of formal training. An Architecture for a Case-Based Intelligent Tutor The CB-ITS extends the design of GT-VITA (Chu et al., 1995). GT-VITA (the Georgia Tech Visual and Inspectable Tutor and Aid) is a software architecture that specifies how to construct an intelligent tutor for operators of complex dynamic systems. Implemented in proof-ofconcept form for operators of NASA near-earth satellites, GT-VITA was very successful in teaching declarative knowledge, procedural knowledge, and operational skill. First fielded in 1991, GT-VITA remains a required part of training for NASA Goddard Space Flight Center satellite operators. Like GT-VITA, the CB-ITS uses the OFM and OFMspert as its fundamental building blocks. GT-VITA extended OFMspert to provide additional functionality necessary for training. CB-ITS further extends the OFM and OFMspert, including the addition of many of the refinements that GT-CATS research contributed about knowledge representation and processing for real-time activity tracking. Operator Function Model and OFMspert

A version of the OFM for flight deck navigation is depicted in Fig. 8.14. The OFM is a heterarchic-hierarchic network of nodes that represents how a human operator manages multiple concurrent activities in a dynamic, event-driven environment (Mitchell, 1987, 1996). The hierarchy represents how operators decompose activities. Arcs between nodes represent system events or the results of operator actions that initiate new activities. The OFM is a normative and nondeterministic model of how a well-trained, well-motivated operator effectively manages concurrent activities in real time. As a nondeterministic model, the OFM represents alternative, acceptable strategies for carrying out an activity. An acceptable strategy is a correct strategy, though not necessarily one that is preferred or most likely. A nondeterministic representation reflects the flexibility in task domains that skilled personnel use extensively. As a normative model, the OFM does not represent potential operator errors. Figure 8.14 depicts many of the features of the OFM. Each node corresponds to an activity. An activity tree decomposes one node into the activities required to accomplish the higher level activity. One activity tree with gray shading is shown in Fig. 8.14. Dashed nodes indicate individual page_244 Page 245

Fig. 8.14. An operator function model (OFM) for flight deck navigation depicting activating and terminating conditions on activities as well as the lowest level modes, cognitive or physical actions. page_245 Page 246 physical or cognitive actions. Actions are the lowest level activities in an OFM. A decomposition may have nodes at the same level that are sequential or unconnected. Sequential nodes represent activities that must be performed in a prescribed order. Unconnected nodes at the same level are activities with no required order; however, all activities must be performed to complete the upper level activity and may be performed concurrently. Notice that event descriptions annotate some arcs. Events represent initiating or terminating conditions. Lower level nodes inherit initiating and terminating conditions from parent nodes. Activators, depicted by an , and terminators, or terminating conditions associated with a node, and are in addition to those inherited from parent nodes.

, indicate initiating

OFMspert is a computational implementation of the OFM. Like GT-CATS, OFMspert undertakes intent inferencing by predicting operator activities and attempting to interpret observed actions in real time. OFMspert postulates expectations about upcoming operations activities and associates observed actions with predictions to infer operator intent and identify possible errors. OFMspert has been implemented successfully numerous times, for example, as the intelligence for operator aids (Bushman et al., 1993; Jones & Mitchell, 1995) and for a tutor (Chu et al., 1995). GT-CATS is an extension of OFMspert; however, as noted in the previous section, there is a significant difference between the two. GT-CATS predicts a single expected or preferred set of activities and uses a revision process to accommodate alternative strategies. OFMspert uses a blackboard problem solving model (Nii, 1986a, 1986b) to implement explicitly the nondeterministic properties of the OFM. The blackboard model posts predictions about high-level activities the operator is likely to perform; the nondeterministic feature leaves temporarily unspecified the specific strategy that an operator will choose to achieve the high-level activity. Given observed actions, blackboard knowledge sources attempt to associate an action, or set of actions, with the higher level activities. OFMspert As the Specification of an Intelligent Tutoring Systems

Of the three core elements that comprise an ITS, domain expert, student model, and pedagogy, OFMspert directly provides capabilities for the first two. The OFM contains expert knowledge, that is, plans and activities that OFMspert posts on the blackboard as expectations for operator activity. As a student interacts with the simulated system, OFMspert posts student actions at the lowest blackboard level. By connecting expert-based expectations of activity to student actions, OFMspert implements an overlay form of a student model. VanLehn (1988) defined an overlay model as one that detects errors in student knowledge by superimposing (overlaying) a map of student knowledge onto a similar map of expert knowledge. Differences in the maps denote page_246 Page 247 gaps in student knowledge. Activities posted on the blackboard that are not connected with actions within an appropriate time interval can be identified as missed activities. Actions that remain unconnected may be errors. Hence, the evolving state of the OFMspert blackboard defines the student model. The CB-ITS will augment OFMspert's OFM with buggy activities. Burton (1982) suggested that a tutor can detect errors using a library of typical error sequences (bugs). When a tutor detects such activities, remediation can be provided. By adding erroneous activities to the task model, OFMspert can detect errors when a student executes associated actions. Pedagogy is the remaining element of CB-ITS architecture. Pedagogy is knowledge about how to teach. OFMspert lacks the pedagogical knowledge to support a full range of tutoring. GT-VITA added a pedagogy module to OFMspert that manages scheduling and control of the training process. Its pedagogy, based on cognitive apprenticeship, provides multiple strategies to define tutor-student interaction, depending on the type of material being presented and the proficiency of the student. An ITS requires knowledge to provide explanations, answer questions, and detect potential errors. This requires declarative and procedural knowledge and a representation of operational skill. OFMspert represents this knowledge in the current problem space, operations model, and blackboard. These components, through either static data structures or dynamically built representations of the current system state and expected operator activities, contain information that describes the system and its operation. Figure 8.15 depicts this knowledge in the gray boxes. Tutoring knowledge is added to OFMspert by extending the representation of activities. Declarative knowledge is available from two sources: the current problem space and the OFM in OFMspert's operations model. The current problem space state variables define important system components. The OFM, with its nodes and arcs, implicitly defines the declarative knowledge needed to perform an activity. Including declarative descriptions of pertinent system knowledge in the nodes makes much of the implicit knowledge explicit. Thus, declarative knowledge is linked to activities and contexts where it is used, "situating" it, and providing a more integrated view of the knowledge presented. The OFM mode is also the primary source of procedural and operational knowledge for training. As a task-analytic model, the nodes of the OFM define procedural knowledge. Transitions between nodes prescribe order and timing of activities as well as conditions that cue an operator to initiate or terminate an activity. "Reason" information, added to each node, describes the purpose and intended outcome of an activity; that is, it provides an explanation of when or why an activity is performed. page_247 Page 248

Fig. 8.15. GT-CB-ITS: Components of a case-based intelligent tutor for trained operators of a complex dynamic system. The OFMspert blackboard maintains an evolving set of expectations of operator activities. The state of the blackboard defines the current task context. Knowledge of the activities that are in progress enables a tutor to provide context-sensitive help, hints, or reminders. Implementation and Evaluation

The CB-ITS is being implemented in proof-of-concept form for pilots of the MD-11. As with many computer-based systems, the MD-11 sometimes surprises its operators. Cases or situations that extend beyond those addressed in formal training are being gathered and annotated to teach line pilots alternative strategies for unusual situations. An evaluation will explore the extent to which the CB-ITS can help pilots learn new skills for various situations and increase their knowledge and expertise as surprising situations manifest themselves in the wider community of skilled pilots flying the MD-11. Conclusions This chapter describes three related research programs that contribute to the current experience and knowledge about how to enhance training of operators of complex systemsspecifically systems that often have increasing, and changing, levels of automation. The data from the first two projects, the VNAV Tutor and GT-CATS, offer encouraging results about the possibility of designing desktop or Web-based training systems linked to a simulator that teaches requisite knowledge for expert operators. Overall, the research described in this chapter and related projects page_248 Page 249 offers hope that the research community can provide airlines with some assistance in developing new methods of training in general and pilot training in particular that is engaging and informative. Acknowledgments This research was made possible by the support, encouragement, and insightful "nudging" of Dr. Everett A. Palmer III, Technical Monitor, NASA Ames Research Center (including Grant NCC2-824). Many individuals contributed to these research programs. Todd J. Callantine and Alan R. Chappell undertook portions of the research described in this chapter as part of their doctoral research. Others helped our research team understand the application domain, design and implement the software, and assess the results. The participation of Ed Crowther, Jim Williams, and Bhagvan Kommandi are gratefully acknowledged. Dr. T. Govindaraj helped formulate our initial aviation program and focused the aspects addressing automation, aviation, and training. The editorial assistance of Dave Thurman, Alan Chappell, Michael Gray, and Rand Williams improved the overall readability of a highly compacted description of a large research program. Captains Jim Irving, Arnie Kraby, Alan Price, and Bill Jones provided insight into the domain and cues to relevant research topics, and helped ensure that the resulting efforts were meaningful to practitioners in the field. Finally, I would like to thank the management, pilots, and ground training personnel at the various U.S airlines who helped enrich these projects with access to the domain, insight, training, documentation, and participants in the evaluations. References Abbott, K. (1996). The interfaces between flightcrews and modern flight deck systems. Washington, DC: Federal Aviation Administration. AV&SW. (1995, February 5). Aiding mode awareness. Aviation Week and Space Technology, pp. 52 53. Billings, C. E. (1997). Aviation automation: The search for a human-centered approach. Mahwah, NJ: Lawrence Erlbaum Associates. Burns, H., & Capps, C. G. (1988). Foundations of intelligent tutoring systems: An introduction. In M. C. Polson & J. J. Richardson (Eds.), Foundations of intelligent tutoring systems (pp. 1 20). Hillsdale, NJ: Lawrence Erlbaum Associates. Burns, H., & Parlett, J. W. (1991). The evolution of intelligent tutoring systems: Dimensions of design. In H. Burns, J. W. Parlett, & C. L. Redfield (Eds.), Intelligent tutoring systems: Evolutions in design (pp. 1 20). Hillsdale, NJ: Lawrence Erlbaum Associates. Burton, R. R., & Brown, J. S. (1982). An investigation of computer coaching for informal learning activities. In D. Sleeman & J. S. Brown (Eds.), Intelligent tutoring systems (pp. 79 98). New York: Academic Press. page_249 Page 250 Bushman, J. B., Mitchell, C. M., Jones, P. M., & Rubin, K. S. (1993). ALLY. An operator's associate for cooperative supervisory control systems. IEEE Transactions on Systems, Man, and Cybernetics, 23(1), 111 128. Callantine, T. (1996). Tracking operator activities in complex systems. Unpublished doctoral thesis, Georgia Institute of Technology, Atlanta. Callantine, T.J., Mitchell, C. M., & Palmer, E. A. (1999). GT-CATS as a model of pilot behavior in the 'glass cockpit': An application and empirical evaluation. International Journal of Aviation Psychology. Chappell, A. R., Crowther, E. G., Mitchell, C. M., & Govindaraj, T. (1997). The VNAV Tutor: Addressing a mode awareness difficulty for pilots of glass cockpit aircraft. IEEE Transactions on System, Man, and Cybernetics, 27(3), 327 385. Chou, C.-D., Madhavan, D., & Funk, K. (1996). Studies of cockpit task management errors. International Journal of Aviation Psychology, 6 (4), 307 320. Chu, R. W., Mitchell, C. M., & Jones, P. M. (1995). Using the operator function model and OFMspert as the basis for an intelligent tutoring system: Towards the tutor/aid paradigm for operators of supervisory control systems. IEEE Transactions on System, Man, and Cybernetics, 25 (7), 1054 1075. Collins, A. (1991). Cognitive apprenticeship and instructional technology. In L. Idol & B. F. Jones (Eds.), Educational values and cognitive instruction: Implications for reform (pp. 121 138). Hillsdale, NJ: Lawrence Erlbaum Associates.

Di Bello, L. (1997). Exploring the relationship between activity and expertise: Paradigm shifts and decision defaults among workers learning material requirements planning. In C. E. Zsambok & G. Klein (Eds.), Naturalistic decision making (pp. 163 174). Mahwah, NJ: Lawrence Erlbaum Associates. Funk, I. K. H., & Kim, J. N. (1995). Agent-based aids to facilitate cockpit task management. In Proceedings of the 1995 IEEE Conference on Systems, Man, and Cybernetics (pp. 1521 1526). Vancouver, BC, Canada: IEEE. Gopal, B. S. R., C. R. S. (1991). Indian Airlines A-320 VT.EP (Report of the technical assessors to the court of inquiry).: Indian Government. Hollan, J. D., Hutchins, E. L., & Weitzman, L. (1984). Steamer: An interactive inspectable simulation-based training system. The AI Magazine, Summer, 15 27. Hughes, D., & Dornheim, M. A. (1995, January 30). Accidents direct focus on cockpit automation. Aviation Week and Space Technology, pp. 52 54. Hutchins, E. (1995). Cognition in the wild. Cambridge, MA: MIT Press. Jones, P. M., & Mitchell, C. M. (1995). Human-computer cooperative problem solving: Theory, design, and evaluation of an intelligent associate system. IEEE Transactions on Systems, Man, and Cybernetics, SMC-25(7), 1039 1053. Jones, P. M., Mitchell, C. M., & Rubin, K. S. (1990). Validation of intent inferencing by a model-based operator's associate. International Journal of Man-Machine Studies, 33, 177 202. Kantowitz, B. H., & Campbell, J. H. (1996). Pilot workload and flight-deck automation. In R. P. M. Mouloua (Ed.), Automation and human performance: Theory and applications (pp. 117 136). Mahwah, NJ: Lawrence Erlbaum Associates. Mecham, M. (1994). Autopilot go-around key to China Air Lines crash. Aviation Week & Space Technology, April June, 1 6. Mellor, P. (1994). CAD: Computer aided disasters. High Integrity Systems, 1(2), 101 156. Ministry of Transport. (1990). Air France Airbus A-320 F-GFCK. Mulhouse Habsheim, June 26, 1988. (Reprinted in Aviation Week & Space Technology, June 4, 1990). France, French Ministry of Planning, Housing, Transport and Maritime Affairs Investigation Commission. Mitchell, C. M. (1987). GT-MSOCC: A domain for modeling human-computer interaction and aiding decision making in supervisory control systems. IEEE Transactions on Systems, Man, and Cybernetics, 17(4), 553 572. page_250 Page 251 Mitchell, C. M. (1996). GT-MSOCC: Operator models, model-based displays, and intelligent aiding. In W. B. Rouse (Ed.), Human/ technology interaction in complex systems (Vol. 8, pp. 67 172). Greenwich, CT: JAI. Nii, H. P. (1986a). Blackboard systems: Part I. AI Magazine, 7(2), 38 53. Nii, H. P. (1986b). Blackboard systems: Part II. AI Magazine, 7(3), 82 110. Norman, D. A. (1988). The psychology of everyday things. New York: Basic Books. Palmer, E. A., Hutchins, E., Ritter, T., & vanCleemput, C. (1991). Altitude deviations: Breakdowns of an error tolerant system (NASA Tech. Memorandum No. 108788). Moffett Field, CA: NASA Ames Research Center. Regian, J. W., & Shute, V. J. (Eds.). (1992). Cognitive approaches to automated instruction. Hillsdale, NJ: Lawrence Erlbaum Associates. Rubin, K. S., Jones, P. M., & Mitchell, C. M. (1988). OFMspert: Inference of operator intentions in supervisory control using a blackboard architecture. IEEE Transactions on Systems, Man, and Cybernetics, 18(4), 618 637. Sarter, N. B., & Woods, D. D. (1992). Pilot interaction with cockpit automation I: Operational experiences with the flight management system. International Journal of Aviation Psychology, 2(4), 303 321. Sarter, N. B., & Woods, D. D. (1994). Pilot interaction with cockpit automation II: An experimental study of pilots' mental model and awareness of the flight management system (FMS). International Journal of Aviation Psychology, 4, 1 28. Sarter, N. B., & Woods, D. D. (1995). How in the world did we ever get in that mode? Mode error and awareness in supervisory control. Human Factors, 37(1), 5 19. Schank, R. C. (1991). Case-based teaching: Four experiences in educational software. Evanston, IL: Northwestern University, Institute for Learning Sciences. Sheridan, T. B. (1992). Telerobotics, automation, and human supervisory control. Cambridge, MA: MIT Press. Sparaco, P. (1994, January 3). Human factors cited in French A-320 crash. Aviation Week and Space Technology, pp. 30 31. Stokes, A. F., Kemper, K., & Kite, K. (1997). Aeronautical decision making, cue recognition, and expertise under time pressure. In C. E. Zsambok & G. Klein (Eds.), Naturalistic decision making (pp. 183 196). Mahwah, NJ: Lawrence Erlbaum Associates. Thurman, D. A., & Mitchell, C. M. (1994). A methodology for the design of interactive monitoring interfaces. In Proceedings of the 1994 IEEE International Conference on Systems, Man, and Cybernetics (pp. 1738 1744). San Antonio, TX: IEEE.

Transport, M. O. (1990). Air Force Airbus A-320 F-GFCK. Mulhouse Habsheim, June 26, 1988. (Reprinted in Aviation Week & Space Technology, June 4, 1990). French Ministry of Planning, Housing, Transport and Maritime Affairs Investigation Commission. Vakil, S. S., Hansman, R. J., Midkiff, A. H., & Vaneck, T. (1995). Mode awareness in advanced autoflight systems. In Proceedings of the 1995 IFAC/IFIP/IFOR/IEA Symposium on Analysis, Design, and Evaluation of Man-Machine System (pp. 15 19). Cambridge, MA: IFAC. VanLehn, K. (1988). Student modelling. In M. C. Polson & J. J. Richardson (Eds.), Foundations of intelligent tutoring systems (pp. 55 78). Mahwah, NJ: Lawrence Erlbaum Associates. Vasandani, V., & Govindaraj, T. (1995). Knowledge organization in intelligent tutoring systems for diagnostic problem solving in complex dynamic systems. IEEE Transactions on Systems, Man, and Cybernetics, SMC-25(7), 1076 1096. Wenger, E. (1987). Artificial intelligence and tutoring systems: Computational and cognitive approaches to the communication of knowledge. Los Altos, CA: Morgan Kaufman. Wiener, E. L. (1989). Human factors of advanced technology ("glass cockpit") transport aircraft (Tech. Rep. No. 117528). Moffett Field, CA: NASA Ames Research Center. Williams, J. A., & Mitchell, C. M. (1993). Effect of integrated flight and terrain displays on controlled flight into terrain. In Proceedings of the 1995 IEEE International Conference on Systems, Man, and Cybernetics (pp. 120 125). Le Touquet, France: IEEE. page_251 Page 253

Chapter 9 Aviation Safety Paradigms and Training Implications Jean Pariès Dédale Company, CdG CEDEX, France René Amalberti IMASSA, Brétigny-sur-Orge, France Why a Chapter about Training in a Book On Cognitive Engineering? Pilot training is practically as old as aviation. Whatever the "ecology" of the cockpit design, whatever the respect paid by operational procedures to the natural human cognitive processes, flying will never be a natural environment for humans. The flying heroes of the pioneering years quickly learned this hard lesson, and quickly understood the need for training. Flight simulators have been used as early as 1909. Training has always been a challenge, particularly in the periods of rapid change, whether the change was of technological or sociological nature. The historical safety data clearly show a strong "learning effect" during the introductory years of all major new sociotechnical concepts. In other words, the accident rate is significantly higher during the first years of introduction, as shown by the diagram in Fig. 9.1. Aviation history includes several examples of what can happen when transition periods are not properly mastered. A series of five Boeing 727 final-approach accidents occurred in the United States during the first two introductory years of that aircraft, before the customer airlines' training departments realized they had to address the specific flight dynamics of the jet engine combined with the swept wing design. A series of four "situation awareness" accidents similarly cast a shadow over the introductory period of the A320. And the training process itself has historically page_253 Page 254

Fig. 9.1. Evidence of the learning effect in aviation historical safety data. From Airbus Industry (1997). Reprinted by permission. had a high price: Flight-training accidents caused more crew losses during World War II than war operations themselves! Nowadays, the challenge is of a different nature. Concentrated training centers welcome trainees from all around the world, facing huge language and cultural barriers. The computer technology revolution has turned some experienced ''jurassic" aircraft captains into beginners. The global spread of Western-built aircraft has put five-member crew people or fighter pilots in a position to transition to two crew member fly-by-wire airliners in a matter of weeks! At the same time, fierce economic competition has pushed day after day for decreased training time. How is training efficiency maintained in the face of that continuous search for cost reduction, while also meeting the new requirements raised by highly automated aircraft, and addressing the cross-cultural issues revealed by the worldwide extension of the aviation system? How can we fill the gap that presently exists between industrialized and developing countries concerning qualified humanpower and appropriate resources? page_254 Page 255 Part of the answer to these questions depends on the understanding we have about the relationship between design, procedures, and training. Indeed, the aviation safety regulations progressively developed during the 1950s around the following three poles: Airworthiness: Is the aircraft designed and maintained to be fit to fly? Operational regulations: What is the best (safe) standard way to operate an aircraft? Crew qualification: How do we select and train people to be proficient crew members? These three poles are obviously not independent. First, they have a surface, peripheral dependence. A design feature inevitably bears in itself assumptions and consequences concerning the optimal procedure to be used and the skills of the end users. If a design feature is "poor," pilot training and/or specific procedures will have to compensate for its weakness. If pilots have been trained for years to fly aircraft a specific way, any new design bringing about a significant departure from that method will raise the need for a strong deconstruction/reconstruction of flight management skills. But systems design, procedures design, and pilot training are different worlds, with people of different expertise speaking different languages. They don't communicate very much. Consequently, a first objective of this chapter is to remind design people of a few basic things about the training world, so that they can hopefully refine their assumptions about the way humans will adapt to their design choices. Design, procedures, and training are also linked at a deeper level of interdependence. No training is suspended in a vacuum. Any training is based on a particular understanding of the skills and know-how that are needed to carry out the mission, as well as a particular understanding of the main risks and the main conditions influencing the safety of the mission. In other words, design, procedures, and training should ideally stem from a common "safety paradigm." When it comes to highly automated aircraft, the safety paradigm includes beliefs about what should be the respective role and freedom of human operators and automated systems in the conduct of a flight. Such a question obviously has strong implications for the design of a cockpit, as well as the objectives of a training process (what should a pilot know and understand about the systems?). This chapter therefore expands on the notion of safety paradigm, presents two opposite safety philosophies, traces the historical evolution of their implementation in the design versus the training world, and discusses their more recent implications. The chapter is divided into four sections. The first uses the introduction of the glass-cockpit-generation aircraft as a case study to present some facts about design-training interaction difficulties. It discusses the main difficulpage_255

Page 256 ties from the perspective of pilot adaptation. The second section discusses the historical evolution of the aviation safety paradigm and identifies its implications for design and training. The third section describes the evolution of aviation training from the perspective of learning theories. The final section discusses some aspects of the relationship between training and design, addressing both the impact of some design decisions on training and the consequences of some features of human learning on design decisions. The Glass-Cockpit Generation, and Some Associated Training Difficulties The Glass-Cockpit Generation The design of aircraft has experienced a huge revolution in the past decade. The new generation of aircraft, termed the glass-cockpit generation, show three major advances all related to the computer revolution. One is the extended capacity given to the crew to program the flight or part of the flight through a computer system termed flight management and guidance system (FMGS). Along with this invasion of computers in the interfacethe backward technical architecture of system commandshas come an invasion of computer technology that has progressively replaced cables and mechanical connections with software and electrical wire connections. Last, but not least, the computer revolution has introduced more intelligence into the machine, providing the operator with flight protections that were not previously available. These glass-cockpit aircraft have a real potential for improving safety. Although not in service long enough to understand their potential aging problems, it is worth noting that, up to now, their accident rate is three to four times lower than the previous generation of aircraft. (This rate applies equally in countries with less developed infrastructures, suggesting a general improvement in safety due to the cockpit design and other systemic features supporting the new aircraft.) That is not to say that glass-cockpit techniques have solved all human-machine interaction problems. As usual with new advances in technology, the new designs have reduced the occurrence and severity of some errors commonly made by crews, such as handling errors (stall is now almost impossible), but have simultaneously opened the door to new types of errors. Flying Glass-Cockpit Aircraft: Crew Difficulties The human factors problems associated with flying glass-cockpit aircraft can be divided into two categories. First, the transition from nonglass to glass cockpit is very demanding (see Pelegrin & Amalberti, 1993, for a page_256 Page 257 complete discussion of the problem). Most of these problems, however, tend to disappear with experience in the glass cockpit and with appropriate specific training, such as dedicated glass-cockpit crew resource management (CRM) training (see section entitled From Design to Training, and From Training to Design). However, recent experiences within airlines now indicate that transitioning from glass cockpit back to "jurassic" cockpits is also very challenging. Some persisting problems come from the new, more cognitive style of glass-cockpit instrument panel display, which delivers more and more textual (written or spoken) information (one could call them "class cockpits"), although a significant number of pilots around the world are poor English speakers. A study conducted within Airbus Training showed that the failure rate of pilots transitioning to the A310 or A320 was negatively correlated with the level of English, that is, the poorer the English proficiency, the higher the failure rate. This is basically a cultural problem, and it is probably one of the highest priorities. Providing the pilots with a proficient level of English or customizing both the interfaces and the documentation, are two main solutions that will help address the existing situation. But it seems a bit unrealistic to expect either a proper translation of all the information into all the existing languages, or to expect that all pilots reach a level of English enabling them to handle stressful situations as easily as if they used their mother tongue. Limiting the amount of textual information delivered in the cockpit, in favor of intuitive and cross-cultural symbology, may be a solution to prevent the recurrence of the same problem. Some difficulties also tend to persist after the initial adaptation phase. Flight management programming is both attractive and time consuming. Moreover, most pilots lack a fundamental grasp of the internal logic of automation and have difficulties with the gap between their expectations (governed by what they would do if they had manual control) and what the computer does. Woods, Johannesen, Cook, and Sarter (1994) and Sarter and Woods (1991, 1992, 1994, 1995) coined the term automation surprises to name these sudden and unexpected system behaviors, often but not exclusively due to autopilot mode reversions (see several chapters in this book, or Amalberti, in press, for an extended analysis). There is quite a paradox here. The new technology was primarily designed to protect the pilots against dangerous maneuvers, but the protection itself has turned out to be the source of rare but catastrophic misunderstandings from the crew, leading to inadequate reactions and loss of control (e.g., A300-600 accident at Nagoya Airport in 1994). Note that, as already mentioned, the global safety figures clearly show a lower rate of accident for glass-cockpit design. So glass-cockpit design has probably saved more situations than it spoiled, even if a lot of emphasis has been put on design pitfalls in the last 5 years. page_257

Page 258 So the question is not whether to step back and banish automation from future aircraft design. The question is rather how to improve the glasscockpit design, the associated procedures, and the training to avoid these rare catastrophic failures of pilot-automation interaction. As far as design issues are concerned, the answer is unclear up to now, although several directions have been discussed and tested (again, see the other chapters of this book). However, there is no such thing as "neutral" training, and whatever the design improvement, the question of how to optimize the training for such a design will still be valid. Further more, there are about 2,000 glass-cockpit aircraft flying worldwide, and over 5,000 more are expected to be built in the next decade with no significant change in the fundamental design. A large part of the solution consequently remains and resides on the training side. Some Challenges of Glass-Cockpit Crew Training Crews are still the ultimate component of the system providing the final efficiency and safety. They are expected to perceive the environment, to maintain a proper situation awareness, to anticipate the situation and make relevant decisions in normal as well as abnormal situations, to communicate with the surrounding system (the air traffic control [ATC], the airline staff, etc.), to set proper aircraft configurations, to control the dynamics of the flight, and to implement the relevant procedures. Because of the very nature of the glass-cockpit technology, calling for fewer interactions, more planning, more anticipation, and more comprehension, the fundamental training expectation has shifted from handling skills to management skills development. Safety depends more than ever on pilots' intelligence, their ability to perceive and understand the "situation," and to react promptly and properly. This is easy to identify, but difficult to achieve. Among the difficulties are two dominant problems. The first problem is that handling skills require a dominant routine-based cognitive control, whereas management skills require more of a rulebased and knowledge-based cognitive control. Crews cannot merely apply procedures, because procedures only provide a framework, a scheme for action. Crews are still expected to understand and evaluate the situation, to select the relevant procedure or validate the procedure that is proposed by the system (e.g., ECAM), to understand the procedure, to initiate the procedure with the relevant data and parameters, and to monitor the outcome. Furthermore, crews are still expected to compensate for most vulnerabilities of the system. But at the same time, the actual, material complexity of the aircraft, and particularly its computer technology, is now far beyond the knowledge capacity of any pilot around the world. page_258 Page 259 This paradoxical situation triggers the modern version of the traditional need-to-know/nice-to-know dispute. In several glass-cockpit accidents or serious incidents (e.g. Nagoya, 1996; Cali, 1996), the tragedy scenario started with an incorrect or limited understanding of the system behavior. Would a better crew understanding of the systems design improve their ability to maintain situation awareness, or would it encourage them to deviate from a strict adherence to procedures? It is still a matter of debate, and we come back to this point later in the chapter. The second problem is that management skills are much more affected by cultural variety than are handling skills. This raises a considerable problem at a time when Western aviation authorities (FAA & JAA) seek to control and maintain the same standards outside the United States and Europe as within. The same model of "democratic" teamwork is promoted all around the world, including identical principles of crew member roles, task sharing, leadership, challenge and response, cross-checks, not to mention the two-crew member complement. This model has been promoted as the standard in the United States, where it fits with the national culture concerning leadership and procedures, the aviation training tradition, the realities of manpower costs, and everything else. The design of aircraft has been adapted to the constraints and objectives of the overall social, technical, economic, and cultural system. Not surprisingly, the result in terms of safety and efficiency is high. It is also high (although lower) in regions that share most of these systemic features (e.g., Europe). It is rather poor, however, in regions that do not share most of these systemic features (e.g., Asia, Africa, and South America vary not only in terms of national culture but also in allocation of resources to aviation regulation and infrastructure; Johnston, 1993). It is reasonable to force that model into totally different socio-technical systems? All these questions challenge theoretical models concerning human learning and crew training. The next section expands on this. Training and Design: A Shared Safety Paradigm? The Safety Paradigm Shift A safety paradigm is a set of fundamental rules and principles that people believe to be both the definition of and the conditions for safety. Safety paradigms are not stable in time. They come within the scope of an historical move through a series of crises, generally triggered by a series of major accidents, or major changes in the socio-technical background. During the past 50 years, three elements in the comprehension of safety within the aviation community have particularly changed: page_259

Page 260 The time scale within which analysts search for an accident "cause": The time scale of analysis has been considerably extended, from realtime, hands-on interactions to long-term interactions, from front-line operators back to senior decision makers. The system size scale at which it is considered relevant to identify a "cause": from individual interactions (one pilot, one aircraft), to local interactions (one team, including cockpit crew, then cabin crew, ground staff, ATC), then to global interactions (an airline, up to the international aviation system), from individuals to large organizations. The depth of explanation at which people are satisfied that they understand the (human factors) "cause" of an event. The tendency has been to explore deeper and deeper: from actions to behavior, from behavior to attitudes, from attitudes to underlying governors of actions, with reference to emotional, cognitive, psycho-sociological, and sociological models. Cognitive engineering has been particularly instrumental during the last few years in providing the aviation community with the hows and whys of individual performance, whereas sociology and ethnology has provided cues about organizational and ethnographic cultures. This evolution represents a fundamental shift in the notion of cause: from hard, physical causality to "soft" causality; from direct, linear, realtime causality to remote, circular, asynchronous causality. That shift concerned both the training world and the design world. Its main steps can be simplified as shown in Table 9.1 with roughly decennial increments. Now how can we understand this historical evolution of the safety paradigm? Are we progressing toward any truth? It is argued in the next section that beyond that shift, there is a competition between two fundamental philosophies of safety: safety through invariance and safety through adaptation. Two Philosophies of Safety The first philosophy, safety through invariance, calls on invariant functional properties of the world (environment) to elaborate relevant operational responses (procedures). The ideal achievement is to design responses that are perfectly adapted to a situation demand. These solutions are then stored under the format of procedural knowledge (rules and skills) and implemented according to the situation. The main problem is then to remain within the frame of a known situation, and to stick to the solutions. Safety is impaired when the environment varies (de-adaptation) or when the standard solution is not adhered to (error or violation). The second philosophy, safety through adaptation, calls on a more generic, more flexible strategy. Operational responses are permanently page_260 Page 261 TABLE 9.1 Main Steps in the Aviation Safety Paradigm Shift Period 1960s

Perceived Accident Main Causality

Focus of Airline Safety Efforts

Focus of Manufacturer's Safety Efforts

Accidents result from individual pilot error, mainly attributed to a lack of basic flying skills.

Selection of appropriate psychomotor skills. Handling training oriented toward handling proficiency, particularly in failure situations and critical areas of flight envelope.

Designing more reliable and easy to fly aircraft.

1970s Accidents result from individual pilot error, mainly attributed to a lack of technical proficiency.

Selection of appropriate psychomotor and cognitive skills. Handling training oriented toward normal and abnormal procedures and drills. Stress on procedures. Intense use of (increasing fidelity) simulators.

Designing more reliable and easy to fly aircraft. Built in redundancy; fail safe and fail operational concepts. More automation assistance to flight control (AP, FD, ATHR); more instruments. Focus on crew workload.

1980s Accidents result from cockpit crew errors mainly attributed to team synergy failures and to a poor management of resources available in the cockpit.

Selection of "right stuff" with proper cooperation skills. Crew resource management training. Line Oriented Flight Training (LOFT) simulation.

Reducing pilot involvement in direct flight control actions (fly-by-wire stability, more and more autoflight capabilities, FMS); providing for more and more error protections (GPWS, flight envelope protections). Providing for situation awareness augmentation and decision aids (Nav Display, Centralized Monitoring, ECAM procedures).

1990s

Fourth- and fifth-generation CRM training: --situation awareness augmentation, error management strategies, and facilitation of metacognition. --Company Resource Management.

More automatic protections against consequences of undetected errors: EGPWs, TCAS, MSAW. Closer communication with airlines: -Prevention strategies. --Incident reporting systems. More air-ground links (Data Link, S mode radar, ACARS). Human Centered Automation design concept.

"Every accident is a failure or organization" (Prof. K. R. Andrews). Front line operator behavior is strongly (even if not totally) determined by systemic forces (selection, training, procedures, cultures, work conditions, organization structures). Human error is not a failure per se, but an intrinsic component of cognitive processes. Accidents result from a loss of control of the crew (and the larger team) on their error management process.

page_261 Page 262 imperfect, because they include latent, open solutions to different situations. They use procedural knowledge as well as declarative knowledge (more generic and abstract properties of the world). They include a monitoring of random or unforeseen variations both externally in the environment and internally in the operational responses (failures, errors, and deviations). Keeping control on these deviations is a process similar to biological immunity principles: Defenses are mainly based on pathogens recognition (identity paradigm) and therefore they need aggressors to develop. Table 9.2 summarizes the implications of these two philosophies when applied to aviation. So what are the consequences of these two different safety paradigms for both design and training? Several design issues (as discussed in the other chapters of this book) could be sorted according to this dual perspective, and matched with corresponding procedure design and training principles to compose a consistent crew-aircraft interaction philosophy. Table 9.3 shows a rudimentary illustration of what such a process could be concerning design and training for auto flight systems. As a precursor to further discussion about the interactions between training and design, the next section presents the main human-learning models. Aviation Training and Learning Models Why Train a Pilot? Why train a pilot? What do we expect a crew member to be able to do at the end of a training process? The answer to such questions may seem commonplace stuff at first glance. No one would argue against the idea that we need pilots to be able to understand the situation, to make appropriate decisions, and to act accurately through a proper implementation of standard operational procedures (SOPs). Nor would one, after 15 years of CRM training in the airline industry, challenge the need for a solid ability to work as a team, to communicate with the other crew members (as well as with all the operational people around the aircraft), and to properly manage the available technical and human resources. Well, what does that mean? When do we consider the goal is achieved? To discuss the issue further, we must refer to the underlying governors of a training program. Any operator-training program is implicitly or explicitly based on the combination of several "models": A model of the skills and know-how that are needed to do the job properly. A model of what the operator must learn (the gap to be filled between initial and target capabilities). A model of the operator learning process (theory of learning). page_262 Page 263 TABLE 9.2 Two Safety Philosophies Philosophy 1

Philosophy 2

Aviation operations can be entirely specified through standardized procedures, programs, schedules, rules, nominal tasks, certification, selection, norms, etc.

Aviation operations cannot be entirely specified through standardized procedures. programs, and the life. One reason is it includes humans.

Safety improvement will result from more specification (more extensive, comprehensive, and detailed procedures, . . . ) and more discipline from the operators.

Safety improvement will result from a better respect of the "ecology" of the system and a better acknowledgment of its selfprotection mechanisms.

Deviations from nominal operation are both a cause of lower performance, and the main threat for safety.

Deviation from nominal operation are both a necessity for adaptation to random dimension of real life, and a potential threat for safety.

Human operators are ultimately the only unpredictable and unspecifiable components of the system. They are the main source of deviation.

Human operators are up to now the only intelligent, flexible, and real-time adaptable component of the system. They are a deposit and source of safety.

Automation, whenever feasible and reliable, will decrease deviation rate and therefore improve both performance and safety.

Automation will increase reliability, improve performance, make the operation more rigid. As long as Humans are kept in the system, automation will also make their environment more complex, and create new problems in man-machine coupling.

Errors are nonintentional but regrettable deviations from standard actions. Errors are unfortunately inevitable.

Errors are deviations from operator's intentions, but at the same time they are part of the normal process of achieving intentions. Errors are necessary.

Errors are just as negative for safety as any other deviation. Every effort should be made to reduce the number of errors.

Uncorrected errors may be a threat for safety. However, self-error awareness is a critical governor of operator's behavior and food for risk management processes (regulator of confidence level).

The human operator is one more "black box" coupled through inputs (perceived data) that are transformed into outputs (actions) according to specified targets (goals) using adequate transfer functions (procedures, skills, . . . ).

Human operators are auto-organized structures, coupled through recursive processes of self-regulation, and ultimately governed by their internal intentions.

(conditioning paradigm)

(freedom paradigm)

A model of the risks associated with the anticipated "failures of the human to perform as expected." However, in the real world of aviation, not many airline training departments or pilot training schools have really developed their training syllabi on the basis of such an analysis. Regulatory requirements to systematically analyze the skills and know-how that are needed to do the job page_263 Page 264 TABLE 9.3 Safety Philosophies, Design, and Training Implications for Autoflight Systems First Philosophy Human machine role distribution

Machine human communication

Second Philosophy

increase the automation domain whenever feasible

limit the full-automation domain to shortterm high-frequency control loops

increase aircraft autonomy/ authority whenever the system is technically reliable

limit automation autonomy as far as possible

train the crew to use automated systems whenever available

organize a multilayer automation hierarchy according to natural human planning

train the crew to strictly adhere to procedures; punish violations

train the crew to decide the proper automation level according to the situation

train the crew to trust but monitor automated systems

train the crew to assess the automation reliability

train the crew to recover through manual operation in case of automated systems failure

train the crew to keep their own intentions and planning alive

develop functional modes taxonomy and display with reference to computer's capabilities and computer's logic

simplify functional modes taxonomy and display with reference to pilot's dynamic control limitations and logic (phase of flight, main concern, priorities)

display main modes (hidden modes accepted)

show the functional logic hierarchy of the automated process to use (e.g., dominant modes, links between V/NAV and L/ NAV)

display all available data

show the triggering factors of autonomous behavior (mode reversion)

train the crew to memorize the behavior of all modes in all situations

reject hidden modes

train the crew to monitor active modes and call out changes

display all useful data train the crew to understand the relevant functional logic adapted to generic situations train the crew to monitor active logic

Human machine communication

design error-resistant controls

design error-tolerant controls

design hard domain limitations

optimize the visibility of control errors

train the crew to prevent errors

design soft domain limitations

train the crew to detect (checks and cross-checks) errors as soon as possible

educate the crew about cognitive control on errors

Use repetitive training for design/ procedure pitfalls

train the crew to use their errors to assess their cognitive control train the crew to manage the consequences of their errors discuss and demonstrate design/ procedure pitfalls

page_264 Page 265 properly have only recently been introduced (e.g., systematic task analysis for the development of an advanced qualification program; FAA, 1991). Training has been mainly governed by empirical evolutions of previous training programs, taking into account the lessons of experience, particularly the lesson from accidents and incidents, and certainly the lessons from economy as well. To keep it brief, training is mainly governed by the search for lower costs, softened by a model of the associated risk. However, the four models mentioned previously are not independent from each other. It would be difficult to refer to completely different cognitive models to describe the operator expertise and the learning process. The operator cannot be considered as a dumb robot by the designer, then as a smart problem solver during training (or vice versa). Furthermore, the skills and know-how necessary to do the job also refer to a specific understanding of the potential failures of the human action, and its associated risks. Consequently, there must be some consistency between a philosophy of design, a philosophy of training, and a philosophy of safety. Consistency between training and design implies that designers understand the consequences of their design decisions on training, and share with training people a common understanding of what a learning process is about, particularly as far as human factors are concerned. Consequently, the next paragraphs discuss the integration of human factors and management skills training into basic training. Technical Training Versus Resource Management Training Aviation training has been oriented toward technical and operational skills since the beginning of aviation. The then dominant safety paradigm could be stated as follows: Pilot competence plus technical reliability equals flight safety. Most accidents were understood as a result of individual pilot error, mainly attributed to a lack of basic flying skills. Selection and training were aiming at handling proficiency, particularly in failure situations and critical areas of the flight domain. But it so happened that the 1970s were marked by the occurrence of several accidents ''instigated" by good crews (experienced, properly qualified, well considered) flying "good condition" aircraft (without any failure or only minor ones). The 1972 Eastern Airlines crash into the Everglades swamp is prototypic of these accidents. The concept of CRM emerged in the late 1970s, because such accidents were not understandable within the framework of the safety paradigm, and raised the question: How can skilled operators perform so poorly that they kill themselves and their passengers? A first generic answer to this question emerged as follows: A crew, or a team, is not an addition of individuals, but an interaction between indipage_265 Page 266 viduals. So personalities, attitudes, and lack of communication skills can lead to poor interaction. Pilots should, therefore, be informed about personalities, attitudes, and cooperative behaviors that are considered desirable. This was the objective of the first CRM generation. It was sometimes resisted and rejected by pilots as psychological "claptrap." Aggressive questioning of personalities was abandoned in most cases, and issues such as the following were progressively tackled both from an individual and team perspective: Updating of situation awareness. Decision-making strategies. Crew-aircraft interaction, with special mention to automation. Error management (prevention, detection, correction). Interaction with the other teams (cabin crew, ATC, ground staff). Coping with the environment (time pressure, stress, etc.). So the focus has shifted from affective and emotional aspects of cooperation to management of all available resources, from crew resource management to crew resource management. We can find in CRM programs the mirror evolution of the aforementioned safety paradigm shift (Paries & Amalberti, 1994). Human error is no longer seen as failure per se, but as an intrinsic component of cognitive processes. Accidents are understood as resulting from a loss of control by the crew (and the larger team) of their error-management process. Later generations of CRM have started to expand their scope to include all the dimensions (including cognitive ones), all the interactions (including the human-machine one), and all the people (company resource management). Front-line operator behavior is acknowledged to be strongly (if not totally) determined by systemic forces (selection, training, procedures, cultures, work conditions, organization structures). So, every accident is now seen as a failure of organization (Andrews, cited in Johnston, 1996). Fourth- and fifth-generation CRM training currently include the following goals: Situation awareness augmentation. Error-management strategies. Facilitation of metacognition. Company resource management. However, aviation training is still mainly a divided process instead of an integrated one. "Technical" and "human factors" issues tend to remain separated: CRM training is still in most cases an isolated island amid a sea of operational training. Furthermore, the traditional aviation training page_266

Page 267 process is also divided into a sequence of rather isolated teaching steps, starting with theory- and knowledge-based learning, and finishing with practical (hands-on) skills. For example, an aircraft-type transition course would start with an extensive use of computer-based training (CBT) to teach what is considered to be the minimum "need to know" about the aircraft systems and performances, would then continue with an intensive learning and manipulative practice of procedures in a procedural trainer (PT), would go on with a broad use of high-fidelity simulation to address the actual aircraft dynamic behavior, and would then finish with a transfer to actual airline environment through line operations adaptation training. But are these linear sequential steps and principles really meeting training needs? Johnston (1997) challenged the implicit assumption underlying the type of training just outlinedthat pilots will have little problem in applying various constituent technical, human factors, and CRM training competencies when faced with real-world operational problemsand argued that the training and development of applied expertise in human factors skills should take place in operationally realistic contexts, and that the traditional "building block" approach should give way to the HARI (holistic, applied, realistic, and integrated) training principles. Johnston stated: By holistic it is meant that training will at all stages take the totality of domain expertise and task demands into accountas distinct from decontextualized and sequential knowledge or skills . . . ; by applied, it is meant that training will involve hands on practice, or the active doing of appropriately representative tasks . . . ; by realistic, it is meant that . . . each training unit or scenario must be perceived as credible by the trainees for the designated training task . . . ; by integrated, it is meant that technical and procedural training (aircraft systems, operating procedures, etc.) will be fully integrated with non technical (human factors and cockpit management) training . . . . (pp. 141 143) Line operational simulation (LOS) and Line-oriented flight training (LOFT) are among the currently available techniques to conduct integrated training within a realistic social, technical, and operational environment. However, the design of the scenarios in use, and the nature of the briefings and debriefings by the instructors, are crucial to a successful integration of technical and human factors aspects of flight management training. A major challenge from this perspective is the education of simulator instructors and flight instructors, as well as check airmen, to understand and evaluate the human factors issues of a flight or a training session, in order to be able to debrief it adequately. Instruments to help trained page_267 Page 268 observers collect data on the line about crew behavior have already been developed and used successfully. An example is the line LOS checklist (LLC) developed at the University of Texas in cooperation with the Federal Aviation Administration (FAA), National Transportation Safety Board (NTSB), NASA, and several airlines (Helmreich, Butler, Taggart, & Wilhem, 1994). The LLC allows for the assessment of both specific and general behavioral skills, selected because of their implication in past accidents, during the different phases of flight. However, a generalized use of CRM skills assessment by nonexpert instructors remains both a difficult challenge for instructor education and a controversial issue with pilot unions. Several research programs, such as the European Notech program and Jartel program, are currently exploring what scientific grounds can be provided for CRM skills judgment. Decision-Making Education Decision making has long been recognized as a major factor affecting flight safety. Jensen and Benel (1977) found that decision errors contributed to more than one third of all accidents and to 52% of fatal accidents for general aviation in the United States for the period 1970 1974. They also argued that decision making can be trained. Diehl (1991) reported similar results for airline accidents for the period 1987 1989 and confirmed that decision skills can be enhanced through appropriate training. This idea, that decision making can be enhanced through appropriate and specific training, represented a major change in the aviation community's common belief that good decisions are a kind of natural "quality" granted to "good pilots" through experience. That belief was based on the assumption that good pilots try their best to make the safest decision and therefore learn with experience, noting and memorizing the course of action when it turns out to be appropriate in a wide variety of circumstances. Berlin et al. (1982) recognized that pilots may have hazardous attitudes and identified five basic unsafe attitudes: antiauthority, machismo, impulsivity, invulnerability, and fatalism. Other ''biases" and "irrational" aspects of human decision were also identified and were considered as weaknesses affecting the outcomes of the rational (computer-like) part of the human decision process. The training response to these findings was to provide pilots with a structured method for making decisions. Prescriptive models of decision making such as the DECIDE model (Benner, 1975) advocated pilots be trained to organize rational steps for the decision process and to protect it against the effects of "irrational" factors. Whatever the benefits of such training, the conceptual change implied by the prescriptive decision training model is limited within the framework of a behavioral perspecpage_268

Page 269 tive. The decision process is still considered as the selection of a relevant response in a given situation, at the end of an analytical computational process generating all the options, weighting each of them, and selecting the one with the best "benefit to cost" ratio. Rasmussen's (1985) model acknowledged and described a much more complex relationship between situation diagnosis and the selection of a course of action. Klein and others (Klein, Orasanu, Calderwood, & Zsambok, 1993; Orasanu & Connolly, 1993) identified the main features of "naturalistic" decisions, as made by real humans in the real world. They acknowledged the pressure of time, the dynamics of the situation leading to changing diagnostics and shifting goals, the high risks, the ambiguous or missing data, the role of feedback loops, the team dimension, and the role of expertise. Modern decision theories stress the role of "decision strategies," based on a management of both internal risk (related to operator's know-how) and external risk (related to the objective features of the situation), and acknowledge that people can make good decisions without comparing several courses of action, through their experience and situation assessment. Current pilot training does not seem to take these recent naturalistic approaches to decision making very much into account. They rarely address the mechanisms of decision making as such, nor do they discuss the available decision strategies. Decision-making training is still a side effect of repeatedly making decisions in real or simulated situations (engine failure, low fuel, system failures, etc.) where preidentified options have to be comparatively evaluated before one is selected with the support of (conditional) procedures. Procedures are, of course, one of the big words when addressing decision making in aviation. Many procedures are decision organizers. They provide the relevant issues for situation assessment; they describe the proven solutions; they tell the precautions to be taken before actions, and the checks to be performed. After a poor decision, it is not uncommon for the crew to face that simple question: "But why didn't you just follow the SOP?". And of course, they can hardly give a satisfactory answer to such a question, because the question itself implies that crews could and should always stick to the procedure. Glass-cockpit aircraft have modified the decision environment because they have introduced new dimensions in the complexity of the situation to be assessed. Due to the massive exchange of data between the onboard computers, it is now impossible for the crew to understand and forecast all the interactions between the aircraft components, as well as understand and forecast all the consequences of their actions. Sticking to standard and abnormal procedures has become an even more critical condition for safe operations. Electronic checklists and do-lists (e.g., Airbus ECAM) provide the crew with very effective assistance. But they raise the problem of page_269 Page 270 confidence. Indeed, they cannot and should not be trusted 100%. They do not cover all the situations because the aircraft sensors cannot detect all the flight conditions and all the aircraft status. Conditioning Versus Learning Training in aviation has long been dominated by the acquisition of handling skills and the search for adherence to procedures. This practical strategy was driven by the classic Skinnerian or conditioning approach to training (Skinner, 1950). According to B. F. Skinner, training is a modification of behavior produced by environmental stimuli. Training lies in the progressive strength of the association between stimuli and responses in memory, when the association has proven to be successful. A training system should reinforce positive associations between specific environment stimuli and good responses from the trainee, instead of using negative reinforcement or punishment. Such training is based on time and repetition: It should allow for practice until the trainee's performance has reached the standard. A Skinnerian training approach, therefore, assumes that the world is non-chaotic, and is stable and repetitive enough to allow humans to reproduce learned patterns of responses as such. From that perspective, the whole aviation history has been a fight against chaos, a relentless effort to control environmental conditions, to identify and specify the relevant responses through standardized procedures, rules, nominal tasks, norms, and the like. The background safety paradigm is that more specifications (more extensive, comprehensive, and detailed procedures, etc.) and more discipline from the operators will bring about safer operations. This approach, coupled with the intensive use of simulation and the constant improvement of flight-handling qualities, has been particularly successful during the past decades to train handling skills. However, some accidents are still caused by "airmanship shortcomings," most of the time in conjunction with unusual conditions (such as wind shear, severe icing, pitch upset) but also sometimes in normal conditions (e.g., China Airlines Flight accident in Taipei, February 1998). This refers to the limits of repetition in aviation training. Whatever the training duration and the recurrence rate, it is never long enough, and the number of repetitions is never high enough to reach the asymptotic part of the learning curve for all the typical actions. This means that even for psychomotor skills, the learning process will continue during the line experience. For the most frequent ones, overlearning will occur: Although no further progress in performance can be detected, the skill will become more robust, more resistant to disturbing factors, and less likely to be lost through lack of practice. For the less frequent ones, linked to abnormal situations, the skills will be lost. page_270 Page 271 But the main weaknesses of current aviation safety programs probably lie on the procedural side. According to all the reviews of airline accident causation, departure from SOPs is the leading contributor. In most cases, the crew qualification and training have not been considered significant factors. In other words, the crew members were qualified to implement the proper procedure. But they failed to implement it. This initially led the aviation community to add a new layer of training to the existing ones, to address the problem of getting well-trained crew members to "actually perform what they are potentially able to do." The first generation of CRM training was born as an independent additional training, aiming at complementing traditional technical skills with team management skills. First CRM generations were still consistent with the framework of the Skinnerian approach. But later generations of CRM were influenced by both different learning theories and different models of the operator expertise. They are now much more an error-management training, and they include references to mental resource management, risk management, situation awareness, decision making, and so on (Paries & Amalberti, 1994). The Gestalt theory views strongly opposed the behaviorist approach, providing models for intelligent learning (Wertheimer, 1945). The main idea is that problem solving is not the result of simple conditioning (not a matter of reinforcement of links between stimulus and response), but lies in the capacity of humans to rearrange the data of a problem. In general, the "solution" appears suddenly, as an "insight," when the reordering of the data eventually makes sense. The Gestaltists have conducted a series of experiments to show that people can be trained to improve their capacity to rearrange the data and solve unknown problems (learning to learn, learning set, adaptive thinking). There have been several attempts to assess whether this approach is efficient and traceable with front-line operators within the industrial field. For example, Rouse (1981) tried to improve operators' context-free problem-solving skills in trouble-shooting situations. One must acknowledge, however, that the results published in the literature

for these techniques are globally not as good as expected, and the suitable content of such courses is still a matter of discussion. However, this training paradigm continues to be investigated because it seems to have some potential to fix several drawbacks of the conditioning approach to training, particularly to reduce the training time and to improve the operator adaptability to unknown situations. In a different way, cognitive approaches (see later discussion) also raise objections to the Skinnerian views. They describe the evolution of the nature of behavioral control throughout the training process, from knowledge-based, through rule-based, to skill-based behavior. They note the structuring role of operational mental models (of the process to be controlled) to facilitate the acquisition of controlling skills. page_271 Page 272 A third perspective on training is provided by anthropological approaches to learning, related to the social dimensions of the learning process, to group training and group thinking. Russian psychologist L. S. Vygotsky (1896 1934) pioneered the idea that mental activities and intelligence are mainly a result of permanent social interactions between humans, particularly during childhood. This approach has been rediscovered and developed from several perspectives of cooperative learning (see, e.g., Bandura, 1986) during the last decade. The role played by imitation, motivation, and self-image has been described and acknowledged. Cognitive and social processes are not considered to be separable, and the learning process is always considered to be a kind of apprenticeship. Even confrontation interactions leading to "sociocognitive" conflicts have been recognized as strong learning facilitators (Perret-Clermont, 1979). A free confrontation of solutions asserted and argued by the trainees themselves has been proved to be more efficient for the final performance of the trainees than a solution brought about by the instructor. This is typically the principle of CRM workshops, which are now a standard in aviation training. During these workshops, crews have opportunities to discuss their individual experience and challenge their views about aviation safety conditions, including the ability to work as a team and manage disagreements. Finally, cognitive approaches to training include two aspects: 1. Cognitive psychology provides models about the learning process itself, addressing perception, memory, the nature of knowledge, the interaction between declarative knowledge and operational knowledge, the role of error, mental representations, problem-solving strategies, and so on. Since the 1960s, these cognitive models have considerably changed the traditional vision of a learning process as a progressive addition of new material. The learning process is now understood through long-term memory features: The aggregation of new data to the existing knowledge is understood as an integration, a transformation process much more than a transfer (from an instructor to a trainee) process. This implies a partial "deconstruction" of existing knowledge and know-how, which can be resisted by the trainees and then cause major training difficulties. A study conducted within Airbus Training (Pelegrin & Amalberti, 1993) showed that the failure rate of pilots transitioning to the A310 or A320 was strongly correlated to their experience on the previous aircraft type and to the technology gap between the previous and the new type. Ten thousand hours in the DC8 turned out to be a critical situation! 2. Cognitive psychology provides tools for improving the quality of the management of the cognitive process itself. Cognitive management training aims at teaching the crews strategies to remain in control of the situation, using a realistic self-evaluation of risk and trust. The model is based page_272 Page 273 on the modern theory of the control of cognition. There have been several attempts in the 1980s to model the dynamic control of risk (Dörner, 1980; Fuller, 1984; Naatanen & Summala, 1976; Wilde, 1976). These models, whether they considered that humans were seeking a permanent level of risk or a no-risk level, have all pointed out the importance of dynamic subjective evaluation of risk by the operator, based on motivations, drives, and past experience. Ecological safety is a continuation of these models, integrating Gibson's old idea of safe field of travel (Gibson & Crooks, 1938), and several new approaches on the modeling of contextual cognitive control of cognition and of situation awareness (Endsley, 1996; Hollnagel, 1993; Sarter & Woods, 1994). The concepts of ecological safety relate to all cognitive capacities, strategies, and know-how that humans use to avoid failure and to remain in control of risk. Within this concept, human errors are only cues among others, such as the signs of progress toward the goal. They are important to consider for the operator, not because they would be directly connected to performance or safety, but because they allow the operator to grasp and self-assess the status of the cognitive control. The findings of a series of experiments show that errors are largely under the control of cognition and are integral to that control. Seventy percent to 80% of errors are recovered quite soon after production. Expert operators also control the effects of most of the errors that they do not recover. Findings show that these unrecovered errors have far fewer safety consequences with experts than with novice operators. This suggests that expert operators take these errors into account, but do not want to spend time in recovering them because they know their impact on safety is negligible or under control (Wioland, 1997). The mapping of human performance also shows that the approach to the loss of control of the situation is protected by the emergence of cognitive signals (Rasmussen, 1997; Wioland & Amalberti, 1996). Operators seek these signals, and use them both to refrain from transgressing these limits, and, paradoxically, to remain in control thanks to a higher cognitive feedback. This management of selfconfidence, meta-knowledge, and risk can be trained. New training paradigms stress the need for recurrent situation assessment. So, the next section expands on the acquisition of trust through training and experience. Modeling Pilot Acquisition of Trust and Expertise Associated Paradoxes A general three-stage model of expertise and trust acquisition is supporting most of the new need to enhance situation awareness (Anderson, 1983, and for an application to aviation, see Amalberti, in press). The first stage of the model is the knowledge available at the end of the transition course. At this stage, pilots are aware that they page_273

Page 274 still have to discover most of the system. They use the system without routines. Anderson termed this stage the cognitive stage. Then, pilots use (fly) the system and enter into the second stage. They expand their knowledge until they've flown 700 to 800 flight hours (roughly 1 2 years). They learn multiple solutions to carry out the job with the system and they gain confidence in themselves. And finally, they stop expanding the knowledge when they consider that they know enough to carry out their job (positive confidence level based on meta-knowledge). However, because of the complexity of the system, the exploration and the knowledge acquisition are not homogeneous for all subsystems. Pilots can become specialists of certain subfunctions of the FMS, while almost ignoring neighboring functions. Training practices tend to contribute to such results. The third stage of the model is a retraction of the expertise to an operative subset of knowledge and skills suitable for daily operations. The margins generated by this retraction provide pilots with an estimation of the level of risk associated with their own know-how (metaknowledge). It is easy to understand how little or no practice in manual flight will not generate self-confidence, even when the procedures are formally well known. As far as psychomotor skills are concerned, the natural process of self-confidence building is highly sensitive. Skills are more affected by the lack of practice. The less the practice, the greater the retraction. But at the same time, one easily feels that retraction, so self-confidence will be lowered. The natural tuning of self-confidence is, therefore, rather faithful for psychomotor skills. But declarative knowledge is both more robust regarding lack of practice and more difficult to self-evaluate. Consequently, a residual formal knowledge may more easily hide the amplitude of the retraction concerning automation management skills. A confidence bias often results from this asymmetrical meta-knowledge. Pilots become increasingly hesitant to switch to a manual procedure (where they feel uneasy). They tend to keep the automated system active by any means when something is wrong. They improvise, reset circuit breakers, without a clear view of the procedure, and sometimes without any procedure (see Plat & Amalberti, chap. 10, this volume). On the other hand, crews may have enough flexibility to accommodate unknown situations provided they have enough time to set up a new mental plan of action, and provided the cooperation between the two crew members is effective. Consequently, another lesson of experience is the extreme sensitivity of glass cockpits to interhuman relationships (conflicts), especially when intuitive and noneducated cooperation is required. This is another strong reason why cockpit resource management is important in modern training courses. page_274 Page 275 From Design to Training, and from Training to Design The Context Before being related to a common cognitive or psycho-sociological approach, the interaction between design and training is an economic relationship. A main objective is shared by the design department and the training departments: Reduce the training costs. Because the use of high-fidelity simulation has almost reached its maximum benefit (zero flight time), the main component of that cost is now the cost of nonrevenue flights and the cost of withdrawing crews from production time. So the objective is to reduce the training time. "Easy to learn" has become a major selling argument in the fierce competition between manufacturers. Manufacturers are committed to design short-transition training courses to demonstrate low training cost to their customers, at a time when the introduction of the computer revolution and the extension of sales to developing countries would, on the contrary, demand an increased training time. Anticipating the consequences of a new design on the training process, or the implications of a current or anticipated training process for design is a hazardous job. Anticipated fears and certainties are often challenged by real life. An illustration of that challenge is offered by the workload assessment focus in the certification of the glass-cockpit generation during the first years. Glass-cockpit generation brought a drastic change to the previous pilot environment, including two-crew design, computer-generated displays, sophisticated automated flight controls, and flight management computers. These changes implied a lot of challenges to pilots, such as autopilot active mode awareness, total energy awareness, crew communication, automation overreliance, and computer interface problems. But in practice, one single question surpassed anything else: the workload question. It is not the intention here to minimize the importance of workload and minimum crew evaluation, but only to suggest that the perceived importance of a new design feature is partially subjective, and potentially influenced by politically sensitive issues. Reading through the literature is not necessarily more enlightening for designers. Former NTSB member J. K. Lauber is quoted as describing ambient confusion about the effects of automation with some humor: Comments from a number of periodicals, papers, journals and other documents show that: cockpit automation increases, decreases, and redistributes workload. It enhances situational awareness, takes pilots out of the loop, page_275 Page 276 increases head-down time, frees the pilot to scan more often, reduces training requirements, increases training requirements, makes a pilot's job easier, increases fatigue, changes the role of the pilot, has not changed the role, makes things less expensive, more expensive, is highly reliable, minimizes human error, leads to error, changes the nature of human error, tunes out small errors, raises likelihood of gross errors, is desired by pilots, is not trusted, leads to boredom, frees pilot from the mundane, and finally increases air safety and has an adverse effect on safety. (cited in Bent, in press) A temptation to escape from such a confusion is to refer to common sense and "obvious truths," such as: "the more proficient, the less error prone"; "the simpler the system, the faster the learning"; "less deviations, safer operation''; "less human actions, safer operations"; and "easy to learn, safe to operate." While referring to the models presented in the previous paragraphs, the following paragraphs discuss the interaction between design and training from two perspectives: What can designers derive from a better understanding of a training process, and how can designers understand the potential consequences of their decisions on training? Some Consequences of Training-Learning Features for Design

Several features of the human learning process have consequences for design. Humans have the ability to detect regularities in the world and to infer general rules from these regularities. During a training period, and even more after a training period, as they gain experience, operators use this ability to simplify their mental representation of the world (the aircraft, the environment) that they have to control. While learning their native language, young children make such simplifications when they systematically apply a grammatical rule (like adding "ed" to a verb to obtain the past tense in English), despite the exceptions (e.g., irregular verbs). Pilots also make such simplifications as they gain expertise. They generalize to different contexts, properties, and procedures that have been learned for a specific context, although they are not applicable. They forget or disregard exceptions to a rule, especially if the frequency of implementation of that rule is very low. They simplify the triggering conditions of a rule when some of its possible conditions are very unlikely. Sarter and Woods described pilots/automation interaction problems arising on the B737-300 (Sarter & Woods, 1992, 1994) and the A320 (Sarter & Woods, 1995), particularly when experienced pilots are facing a situation representing an exception. For example, pilots receive aborted takeoff simulator training in the most critical situation (speed close to V1, the decision page_276 Page 277 speed). On all aircraft, the procedure to abort takeoff at high speed is to quickly retard the thrust levers and trigger the reverse thrust command. This will disengage the autothrottle (A/THR). On the B737-300, the A/THR is in a different mode below 64 kts, and will not disengage when the levers are retarded. Consequently, the procedure in case of aborted takeoff is to first disengage the A/THR using a specific switch, then retard. Experience shows that such oddities lead to a high probability of an incorrect action sequence and conflict between the pilot and the automation. Several similar inconsistent "exceptions" to an intuitive generalized rule can be found in the commands or the displays of all existing aircraft. They mainly concern the logic of the flight mode behavior in relation to the context of the flight (e.g., on all aircraft ALT HOLD behavior is different with G/S mode activated), and the logic of the flight mode indications on the flight mode annunciator (FMA), when the flight mode indications are not isomorphic to the actual mode status and functionality (e.g., ALT HOLD can mean V/S = 0 on the A320). Because of the very nature of expertise, and because of the training time constraints, there is no efficient training for these kinds of exceptions. The true solution is a design one. Javaux (1998) suggested that the feedback to the pilots on the conditions that are true most of the time when the rule is activated should be particularly salient when the condition is false; and that the feedback to the pilots on the conditions that are false most of the time when the rule is activated should be particularly salient when the condition is true. Another issue raised by the nature of the human learning process concerns the validity of the design evaluation. One of the main tools currently in use to evaluate the acceptability of a new design in terms of human factors is test pilot judgment. This judgment is based on extrapolations from expertise gained on previous designs to the new one. Furthermore, as new designs must be submitted to evaluation well before a prototype aircraft is built, that evaluation often has to be exercised in a simulated environment. What we have seen previously about the human learning process suggests that such an assessment methodology may be affected by several biases: Test pilot judgment is based on the assumption that the experience of test pilots on previous aircraft is transferable and can be extrapolated to the new ones. We have seen that this may not be true for major evolutions in human-machine interface design, because a de-construction of previous expertise will be needed. We have seen that learning is a reconstruction of preexisting mental representations, and also that declarative knowledge has an important role in structuring procedural knowledge. From this perspective, test page_277 Page 278 pilots are not a representative sample of the airline pilot population. They have a very specific and deep declarative knowledge of the aircraft, which is maintained and increased as a result of their flight test time. This leads to different mental models of the new aircraft for test pilots and airline pilots, and therefore the cognitive processes (and their failure modes) involved at the crew-aircraft interface are very unlikely to be the same for test pilots and for airline pilots, who share routine operations and the associated constraints. The individual exposure time of test pilots on the new type is typically a few hundred hours. We have seen that cognitive behaviors evolve a great deal during the first year of experience on a glass-cockpit aircraft. During this period, most of the knowledge shifts from declarative knowledge to procedural knowledge, the tuning of trust and self-confidence is modified, the risk management strategies change, as well as the nature of the errors, and the relationship between errors and incidents. The average experience needed for the training process to reach a maturity stage and stabilize the cognitive behavior is about 800 hours. This is a figure that few test pilots will reach during a typical test period with a new type of aircraft. Test pilot judgment will therefore be exercised within a cognitive frame which is significantly different from the average airline pilot situation. As a consequence, the types of errors associated will be different, and the conclusions reached through some of the certification process may not be valid for line operations. Test pilots and designers ideally refer to the behavior of an "average pilot." But what is average pilot behavior? Sherman, Helmreich, and Merritt (1997), for example, have shown large differences in attitudes toward automation among pilots from Europe, America, and Asia. Some pilots turn on the automation when they are in trouble, while others turn it off. The rapid global growth of the aviation industry reveals the extent of these cultural differences. In the 1970s, 80% of the world market and all major manufacturers were located in the United States. The next millennium could see 60% of the market and major manufacturers in Asia. Several methods can be envisaged to counteract the aforementioned biases. Specific documented tests could be conducted at different milestones in the design process, early enough to allow for modifications. Documenting the objectives, assumptions, and results of these tests would help to support and keep track of the design decisions. The participation of airline pilots in "operational" tests has often been presented as a basic condition for efficiency, which is probably true. However, experience indicates that poor design can result from airline pilot judgment just as well as from test pilot judgment. How to better organize the participation of airline page_278

Page 279 pilots is still difficult to know. What pilot population should be involved? How should the individuals be selected? What should be expected from them: guinea-pig performance or active opinion? When should they be involved in the design process? The answer is unclear. Furthermore, nowadays operational "route proving" experimental flights provide the opportunity to evaluate the aircraft in airline-type environments, including "natural" and artificially induced failures, with crews composed of airline pilots and test pilots. Such programs have included more than 100 flights on some occasions. But most of the time they can only lead to modifications in the procedures or the training, because the design is already frozen and any design modification at that stage will have a huge cost. Some Consequences of Design for Training We have seen that the introduction of glass-cockpit technology has raised new cognitive demands for operators, calling for less hands-on interaction and more planning, anticipation, and comprehension. The fundamental goal of training, therefore, has shifted from handling skills to management skills. That shift has several implications for training: First, cognitive and management skills are much more difficult to evaluate, both by the subject him or herself and by a check airman, than manual skills. It is, therefore, tempting to consider that acquiring management skills is a side effect of technical skills training, and that the time needed to acquire management and cognitive skills is shorter than the time needed to acquire manual skills. Then if the technical skills training time can be shortened (glass cockpit, fly-by-wire), the total training time can be shortened as well. However, the inservice experience tends to demonstrate that the stabilization of management and cognitive skills is longer that it is for manual skills. Second, a subtle consequence of design on training is related to the sociological dimensions of the learning process. The role played in training by imitation, motivation, and self-image has been discussed previously. Confrontation leading to socio-cognitive conflicts has been recognized as a learning facilitator. As a consequence, when a design feature significantly modifies the socio-cognitive structure of the operating team, then the learning and training process will be affected. This happened directly when the two-crew-member design replaced the traditional three-crew-member design. This also happens indirectly every time a technological revolution induces significant changes in the conditions of expertise. The glass-cockpit/FMS generation granted a "bonus" to computer interface literacy. It suddenly was rather an advantage to be a young inexperienced page_279 Page 280 first officer and a disadvantage to be an experienced captain. This deeply modified both the authority gradient in the cockpit and the "learning structure" of a typical crew, both during the transition course and during the first period (year) of line operations. Even if captains are not supposed to be instructors, they are, as is any real leader, a model for imitation. This can augment individual skills variance and contribute to the heterogeneity of knowledge acquisition discussed earlier. CRM training can help to identify, discuss, and control this kind of effect. Third, management skills are asking for a higher level of control of cognition. They require more of a rule-based and knowledge-based cognitive control. They are also more emotion driven: Risk management is a form of emotion management. They therefore reach beyond any pure procedural behavior. More than ever, crews cannot just blindly implement procedures. They are still expected to understand and evaluate the situation, to select the relevant procedure or validate the procedure that is proposed by the system (e.g., ECAM), to understand the procedure, to initiate the procedure with the relevant data and parameters, and to monitor the outcome. They are still expected to compensate for most vulnerabilities within the system. The previous acknowledgment implies that the crew must be trained to understand, and trained to manage available resources. But paradoxically, the more resource management skills a crew member possesses, the less he or she can be expected to systematically adhere to procedures. It is easy to appreciate the controversial effect of such a statement in a system where procedures are the ultimate protections. Furthermore, at the same time, the physical complexity of the aircraft, particularly because of all the connections and interactions between computers, is now far beyond the knowledge capacity of any pilot around the world. This paradoxical situation triggers the modern version of the traditional need-to-know/nice-to-know dispute. How do we train for (growing) design complexity? Would a deeper understanding of the systems by the crew improve their ability to maintain situation awareness, or would it encourage them to deviate from a strict adherence to procedures. We know that declarative knowledge cannot be used for real-time control, because it massively mobilizes attentional mental resources and consequently behaves like a slow and fallible single-channel process. But we also know that experts use recognition processes that are governed by structured mental schemas, in other words structured mental models of the behavior of the systems to be controlled. The structure of that knowledge speeds up the acquisition of the relevant controlling skills, increases the reliability and the robustness of the skills, and facilitates a proper understanding of the situation, which is required to select a relevant procedure, implement it properly, and monitor the page_280 Page 281 outcome. Furthermore, the fundamental mechanism of ecological safety (the capacity of humans to reach a certain level of safety) relies on metacognitive monitoring, and consequently on the accuracy of meta-knowledge (Amalberti, 1996). Some requirements concerning the main goals of a training process can then be anticipated: 1. Training should provide crews with a global grasp of the system's architecture and functional features so that an overall, but faithful, mental "big picture" of the situation can be generated and maintained in case of failure, in order to support the understanding of the rationale behind a procedure, facilitate priority setting, and guide information search control. This should include a grasp of: Main logic of auto flight modes behavior and coupling between auto flight modes (e.g., thrust and pitch, vertical nav and lateral nav). Main design principles of auto flight systems: hierarchy of automation levels, flight domain protection philosophy, redundancies, information feedback philosophy, and so on. All exceptions to basic design principles. General symmetry or asymmetry of main functional networks: thrust, fuel system, electrical generation, hydraulic system, pressurization, flight controls, auto flight channels, and so on (what happens when an engine is lost?).

Main interconnections and dependency links between functional networks. General hierarchy (what are the upstream providerselectricity, hydraulics, fuel, air, dataand what are the downstream consumers?) within main functional networks. Main redundancies and main losses of redundancy. Furthermore, the stability of this basic functional architecture should be maintained as far as possible through different aircraft types. The "family" concept developed by Airbus (thanks to fly-by-wire) can obviously facilitate the acquisition by regular Airbus crews of a robust model of the aircraft, provided the transition time is not shortened too much. On the other hand, the family concept will make the transition between different aircraft manufacturers more difficult if there is no standardization. Some hope may be put in the use of operative models of system architecture instead of prescriptive models during the transition course. Prescriptive models are dominant in the current aviation training courseware and materials (operation manuals, CBT presentations). They aim at describpage_281 Page 282 ing the functioning of a process in a way that facilitates its comprehension for the operator. Such models merge faithful but simplified representations of the physical systems and a description of their functional properties. They typically include textual descriptions and synoptic graphics showing components with their schematic relationships. They reformat the physical system into a more understandable form. Operative models attempt to capture and integrate both the specificity of a functional process and the goals of the operator. These models deviate from a close replication of the technical world. They filter the real world from the perspective of an action plan within a specific situation. They can be "metaphoric" and may distort real physical features to augment operational comprehension. Some successful examples have been developed, but much work is left to be credible to the industry. 2. Training should also help pilots learn how to be more accurate in estimating what they know and what they do not know, in order to better tune their cognitive control and risk management process. There is a tendency in the aviation community (perhaps inherited from the flying hero mentality, and certainly fueled by liability threats) to both overestimate and deny human limitations. Human error is at the same time tabooed out of the cockpits and pointed out with fatalism as the universal culprit of accidents. Training is not completely spared this inclination. A statement that qualified pilots do not know all they are supposed to know, and do not have the skills to face all situations, would still be highly controversial in most airline training departments, especially at the management level. However, safety would benefit from a realistic approach to pilot expertise: Pilots do have knowledge and airmanship shortcomings. A main difference between experienced and novice pilots is that these shortcomings are of a different nature. In both cases, safety does not result from the absence of shortcomings, but from a proper management of the resulting limitations. Special attention should be paid to pilots transitioning for the first time to glass-cockpit aircraft. Pairing inexperienced pilots in glass cockpits should be carefully avoided. 3. Training should also provide trainees with generic, safe, and simple solutions to recover the control of the situation, when necessary. Deficiencies in flight crew proficiency include both inappropriate handling and flight management issues. Because the basic aircraft is easy to fly and very reliable, glass-cockpit crews should receive extra initial and recurrent training time in order to gain and maintain manual flying expertise when recovering from abnormal situations. Long-range glass-cockpit aircraft should receive special attention. Airlines should take advantage of the family concept and cross-crew-qualification concept to allow long-range glass-cockpit aircraft pilots to practice their handling skills on a mixed-fleet (long range and short-range) roster. CRM can also contribute by propage_282 Page 283 viding trainees with generic, safe, and simple solutions to recover from a loss of cognitive control of the situation. CRM is more important than ever in glass-cockpit aircraft because of the need for more coordination, clear task sharing, and conflict avoidance. CRM should mainly be an error-management education tool. Conditioning the pilots to blindly repeat the SOPs, then adding 2-day CRM workshops to remind them that they should work as a team, make relevant decisions, and keep a good situation awareness, won't do the job. Error-management education implies that a coherent philosophy of error, from cockpit design to procedures, can be demonstrated to the crews. Conclusion A major shift in the aviation safety paradigm can be observed since the last world war. The focus has moved from reactive to proactive safety, from front-line operators to senior decision makers, from individuals to organizations. This paradigm shift is traceable in training. It affects what we think are the skills and abilities required in a cockpit for more efficient and safer flights: from psychomotor handling skills, to technical and operating skills, to resource management and cognitive management skills. It affects the way we understand the adult learning process, from sequential construction of knowledge to a permanent rearrangement of existing knowledge through socio-cognitive experience. It affects what we think to be the source of risk and the means of protection: from error eradication to error management, from need-to-know to need-to-(meta) know. So pilot training has changed and is still thrusted to change by opposite challenges: the pressure of cost reduction, the revolution in cockpit design brought by computerized automation, the rapid extension of aviation toward developing nations and cultural diversity. But the move is not free from paradoxes and philosophical challenges. The more resource management skills, the less systematic adherence to procedures, whereas adherence to procedures remains the fundamental safety paradigm. Furthermore, at the same time, the physical complexity of modern aircraft is far beyond the knowledge capacity of any pilot around the world. This paradoxical situation raises the modern version of the traditional need-to-know/nice-to-know dispute. How to train for growing complexity? We know that declarative knowledge cannot be used for real-time control, because knowledge-based behavior is like a slow and fallible single-channel process. But we also know that experts use recognition processes that are governed by structured mental models. We know that structuring knowledge speeds up the acquisition and increases the robustness of the

page_283 Page 284 skills, and facilitates a proper understanding of the situation, which is needed to select a relevant procedure, implement it properly, and monitor the outcome. Furthermore, the fundamental mechanism of ecological safety relies on meta-cognitive monitoring. So, despite some claims, the glass-cockpit generation has actually increased rather than decreased the need-to-know requirements. Training should provide the crews with well-structured mental models of the behavior of the systems to be controlled, and design should provide intuitive behavior. Because of the time and cost pressure, the training system is now facing a huge challenge. But the training system is not isolated. The learning process is a systemic one. When the transition course-training time is reduced below what is really needed, training continues during line operations. And everybody must learn, not only the pilots. As mentioned in the introduction, a significant increase in the accident rate clearly marked all the new-generation technologies' introductory period. That learning curve effected the aviation system as a whole. In an ideal world, when designing a new system, one would therefore increment three parallel and interactive processes (equipment, procedures, and training design), with a shared reference to a same model of efficient and safe human-machine interaction. A design decision would be documented within a global framework, including the associated procedure and the relevant assumptions about crew capacity. In an ideal world, one would also allow operators, equipment designers, procedure designers, and training people to analyze incidents from a global perspective through a systemic feedback process. But imperfect humans know how elusive ideal worlds are. References Airbus Industry. (1997). HANGAR Flying, 2. Amalberti, R. (1996). La conduite de systèmes à risques [The control of systems at risk]. Paris: Presses Universitaires de France. Amalberti, R. (1998). Automation in aviation: A human factors perspective. In D. J. Garland, J. Wise, & D. Hopkin (Eds.), Aviation human factors (pp. 173 192). Mahwah, NJ: Lawrence Erlbaum Associates. Anderson, J. R. (1983). The architecture of cognition. Hillsdale, NJ: Lawrence Erlbaum Associates. Bandura, A. (1986). Social foundations of thought and action. Englewood Cliffs, NJ: Prentice-Hall. Benner, L. (1975). DECIDE in the hazardous material emergencies. Fire Journal, 69(4), 13 18. Berlin, J. I., Gruber, E. V., Holmes, C. W., Jensen, K., Lau, J. R., Mills, J. W., & OíKane, J. M. (1982). Pilot judgment training and evaluation (DOT/FAACT-82/56). Daytona Beach, FL: Embry Riddle Aeronautical University. Bent, J. (in press). Lessons from new technology. In Proceedings of the Australian Aviation Symposium, Manly, March 1998. page_284 Page 285 Diehl, A. E. (1991). The effectiveness of training programs for preventing crew errors. In Proceedings of the Sixth International Symposium of Aviation Psychology (pp. 640 655). Columbus: Ohio State University Press. Dörner, D. (1980). On the difficulties people have in dealing with difficulty. Simulation & Games, 11(1), 87 106. Endsley, M. (1996). Situation awareness in aircraft. In B. Hayward & A. Lowe (Eds.), Applied aviation psychology: Achievement, change and challenge (pp. 403 416). Aldershot, England: Avebury Aviation. Federal Aviation Administration. (1991). Advanced qualification program (Advisory Circular No. 120 54). Washington, DC: Author. Fuller, R. (1984). A conceptualization of driving behavior as threat avoidance. Ergonomics, 27(11), 1139 1155. Gibson, J., & Crooks, L. (1938). A theoretical field analysis of automobile-driving. American Journal of Psychology, 51, 453 471. Helmreich, R. L., Butler, R. E., Taggart, W. R., & Wilhem, J. A. (1994). The NASA/UT/FAA line LOS checklist: A behavioral markerbased checklist for CRM skills assessment (NASA/UT/FAA Tech. Manual 91-2a). Austin: University of Texas. Hollnagel, E. (1993). Human reliability analysis, context and control. London: Academic Press. Javaux, D. (1998). Explaining Sarter & Woods classical results: The cognitive complexity of pilot-autopilot interaction on the Boeing 737 EFIS (Report on a SFACT DGAC Research). Paris: DGAC. Jensen, R. S., & Benel, R. (1977). Judgement evaluation and instruction in civil pilot training (FAA Report No. N-FAA-Rd-78-24). Savoy: University of Illinois Aviation Research Laboratory. Johnston, A. N. (1993). CRM: Cross-cultural perspectives. In E. Wiener, B. Kanke, & R. Helmreich (Eds.), Cockpit research management (pp. 367 398). San Diego, CA: Academic Press. Johnston, A. N. (1996). Blame, punishment, and risk management. In Hood & D. K. C. Jones (Eds.), Accident in design: Contemporary debates in risk management. London: UCL Press. Johnston, A. N. (1997). Teaching human factors for airline operations. In G. J. F. Hunt (Ed.), Designing instruction for human factors training in aviation (pp. 127 160). Aldershot, England: Avebury Aviation. Klein, G. A, Orasanu, J., Calderwood, R., & Zsambok, C. E. (Eds.). (1993). Decision making in action: Models and methods. Norwood, NJ: Ablex.

Naatanen, R., & Summala, H. (1976). A model for the role of motivational factors in drivers' decision making. Accident Analysis & Prevention, 6, 243 261. Orasanu, J., & Connolly, T. (1993). Reinventing decision making. In G. Klein, J. Orasanu, R. Calderwood, & C. Zsambok (Eds.), Decision making in action: Models and methods (pp. ). Norwood, NJ: Ablex. Paries, J., & Amalberti, R. (1994). Recent trends in aviation safety (Muster Program, European Commission, H. Andersen, Ed.). Denmark: Risø National Laboratory. Pelegrin, C., & Amalberti, R. (1993). Pilots' strategies of crew coordination in advanced glass-cockpits; a matter of expertise and culture. In Proceedings of the ICAO Human Factors Seminar, Washington, DC (pp. 12 15, Circular No. OACI 217-AN/12). Montreal: ICAO. Perret-Clermont, A. N. (1979). La construction de l'intelligence dans l'interaction sociale [The construction of intelligence in social interaction]. Bern: Peter Lang. Rasmussen, J. (1985). The role of hierarchical knowledge representation in decision making and system management. IEEE Transactions on Systems, Man and Cybernetics, 15(2), 234 243. Rasmussen, J. (1997). Risk management in a dynamic society: A modeling problem. Safety Science, 27(2/3), 183 214. Rouse, W. (1981). Experimental studies and mathematical models of human problem solving performance in fault diagnosis task. In J. Rasmussen & W. Rouse (Eds.), Human detecpage_285 Page 286 tion and diagnosis of system failures (pp. 199 216, NATO conference series: human factors). New York: Plenum. Sarter, N. B., & Woods, D. D. (1991). Situational awareness: A critical but ill-defined phenomenon. International Journal of Aviation Psychology, 1, 45 57. Sarter, N., & Woods, D. D. (1992). Pilot interaction with cockpit automation: Operational experiences with the flight management system. International Journal of Aviation Psychology, 2, 303 321. Sarter, N., & Woods, D. D. (1994). Pilot interaction with cockpit automation: An experimental study of pilots mental model and awareness of the flight management system. International Journal of Aviation Psychology, 4, 1 28. Sarter, N., & Woods, D. D. (1995). Strong, silent, and out of the loop (CSEL Report No. 95-TR-01). Columbus: The Ohio State University. Sherman, P. J., Helmreich, R. L., & Merritt, A. C. (1997). National culture and flightdeck automation: Results of a multination survey. International Journal of Aviation Psychology, 7(4), 311 329. Skinner, B. F. (1950). Are theories of learning necessary? Psychology Review, 57, 193 216. Wertheimer, M. (1945). Productive thinking. New York: Harper. Wilde, G. (1976). Social interaction patterns in driver behavior: An introductory review. Human Factors, 18(5), 477 492. Wioland, L. (1997). Etude des mécanismes de protection et de détection des erreurs, contribution à un modèle de sécurité écologique [The study of error protection and detection mechanisms and their contribution to an ecological safety model]. Unpublished doctoral dissertation, University of Paris. Wioland, L., & Amalberti, R. (1996, November). When errors serve safety: Towards a model of ecological safety. Paper presented at the Cognitive Systems Engineering in Process Control conference, Kyoto, Japan. Woods, D., Johannesen, D., Cook, R., & Sarter, N. (1994). Behind human error. Dayton, OH: CSERIAC, WPAFB. page_286 Page 287

Chapter 10 Experimental Crew Training to Deal with Automation Surprises Marielle Plat René Amalberti IMASSA, Brétigny-sur-Orge, France The Glass-Cockpit Generation Modern glass-cockpit aircraft are characterized by their sophisticated level of automation for flight guidance and management and by the presentation of information through cathode-ray tubes (CRTs) or liquid-crystal displays (LCDs). Beside these visible signals (for the crew), another essential hidden characteristic of these aircraft is the growing number of computers, and therefore of software components. The fly-bywire technology is the ultimate illustration of such computer-based architecture.

There is no doubt that this latest aircraft generation is the safest of all existing generations of aircraft. Nevertheless, the few accidents that have occurred with this generation of aircraft1 have revealed new vulnerabilities and new potential accident causes. It is not a surprise because it seems to be a law that any new technology that solves old vulnerabilities may displace the core problems to a new area. Although the global result is beneficial for performance and safety, research then has to be redirected to the new vulnerabilities. 1 The total number of glass-cockpit accidents is less than 20 at the end of 1996 (exclusive of sabotage, and including the following types: A300-600, A310, A320, A330, A340, MD11, MD80 and extensions, B767-57, B737-300-400-500-600, B747-400, B777). Of course, a greater number of automation-induced incidents exist. page_287 Page 288 It is important to recognize that this new focus of research is needed, just as much as it is important to acknowledge the global safety gain of the new generation of aircraft. Automation Surprises Motivate New Directions for Human Factors Research One of the most significant vulnerabilities revealed by automation-induced incidents/accidents is the growing inability of the crew to understand the system dynamics. The oldest jet generation had a tendency to impose too much workload. The new generation has a tendency to trap the crews' situation awareness. The human factors problems of pilots flying glass cockpits can be divided into two categories. On the one hand, the initial transition course from nonglass to glass cockpit is very demanding (see Pelegrin & Amalberti, 1993; or see Amalberti, 1994, for a complete discussion of the problem). Most problems tend to disappear with experience on advanced glass cockpit and with appropriate training, namely dedicated glass-cockpit crew-resource management courses (see Wiener, Kanki, & Helmreich, 1993). On the other hand, some drawbacks tend to persist even after initial adaptation to the novelties. System planning is both attractive and time consuming. Moreover, most pilots lack a fundamental grasp of the internal logic of automation. They can only evaluate the differences between their expectations (governed by what they would do if they were at the controls) and what the automation did. This analysis is sufficient in most cases, but can rapidly become precarious if the chasm widens between the action plan and the behavior of the machine. This is frequently observed when using highly coupled autopilot modes that combine or follow one another automatically, without any action by the pilot (automatic reversion modes). Sarter and Woods (1991, 1992, 1995), in a series of studies about autopilot mode confusion, have shown the limitations of human understanding of such reversions in dynamic situations. Woods, Johannesen, Cook, and Sarter (1994) used the term automation surprises to refer to these sudden unpredicted changes in system states. Note that in most cases, the system status is consistent with what the crew asked for (or with the actual situation requirements), but the problem is that the crew did not have the right mental model to predict this status. Moreover, in many cases, crew error increased the difficulty with understanding system status. Beside accidents, there is also a long list of incidents where crews have been trapped by computer/software malfunctions or by their own errors page_288 Page 289 when interacting with computers.2 The main characteristics of these software malfunctions or human mistakes in handling computers are threefold. First, most of these failures, or pilot-induced malfunctions, are unique in the history of the aircraft and the life of the pilot. There is an infinite number of possible cases. Second, there is no warning caution, nor message given by the electronic assistance systemthe system does not recognize its failure. Third, there is no specific or generic crew training for these computer malfunctions (or pilot-induced malfunctions). As a follow-on action of this safety analysis, the French Civil Aviation Authorities (DGAC-Direction Générale de l'Aviation Civile) decided, within the national plan for aviation human factors, to fund a research dedicated toward crews experiencing computer malfunctions. The goal was twofold: first, measuring and understanding crew reaction time and strategies when experiencing LOFT (line-oriented flight training) scenarios, using simulators emulating computer bugs; second, taking lessons from the results to improve crew training on advanced glasscockpit aircraft. Provided the new training method is recognized as efficient, another aspect of the study remains to assess the pilots' potential loss of trust in the aircraft, resulting from crews experiencing repetitive computer bugs or equivalent pilot-induced malfunctions. This study is a good demonstration of a new cognitive engineering approach to training for three reasons. First, it proposes a new approach to safety, focusing on extremely rare and strange events surprising pilots (probability of occurrence below 10-9) that are normally out of the scope of regular safety analysis. This new approach is consistent with considering that the aviation safety level is installed on a long-term plateau with a rate of accident close to 10-6. One can hypothesize that the traditional safety-related methodologies used to attain this level have reached their limits and therefore need to be complemented by new approaches and new safety logic. Second, the use of a flight simulator as proposed in this chapter is really new because the simulator is emulating a new type of failure, reproducing unusual system behavior. Third, the focus on results is cognitively oriented as are the recommendations for design and training. It is a good example of an industry-oriented cognitive analysis of system evaluation, using a large set of process-tracing methods. These methods are extremely effective, although they are simple enough to be used by those not specializing in human factors, provided they have been given a minimum of training. 2 Lists of significant incidents are available in several publications, for example, Funk, Lyall, and Riley (1995); Abbott, Slotte, and Stimson (1996). Special issues of ASRS incident database are also available. page_289

Page 290 Method The study was conducted by the DGAC Human Factors bureau, starting late 1995 and finishing late 1996, with the assistance of two external collaborators hired for 6 months (a cognitive ergonomics PhD student, first author of this chapter, and a young unemployed ATPL pilot). For facility reasons (simulator availability, easiness of technical modifications), the aircraft chosen for the experiment was a representative European glass cockpit. The study was conducted in three phases: first, modification of the glass-cockpit full-flight simulator capacities by a simulator manufacturer; second, the preparation of the experiment in cooperation with a large European airline training department; third, the experiment itself. Modification of Flight Simulator Capacities The modification of an already existing full-flight simulator (FFS) is sensitive. FFSs are certified to emulate the precise sensations of the reference aircraft. The logic of implemented failures is a logic of subsystems failing, with a list of failures corresponding to the manufacturers' expectations. For most of these failures, the caution system is a warning, and an abnormal procedure is suggested through a diagnostic and abnormal procedure support system (e.g., the ECAM system in the Airbus family and the EICAS system in the Boeing family). The current generation of FFS does not provide instructors with the possibility of installing computer bugs. The modification of the simulator therefore started with the selection of a series of computer bugs with two objectives: first, being technically compatible with the current certification of the FFS, which means a total and easy reversion (removal capacity) of simulator software from the new capacities to normal and already certified capacities; second, being representative of computer malfunctions and human-induced malfunctions. A study of inservice experience of glass-cockpit aircraft gave us some ideas of the potential failures, bugs, or pilot-induced malfunctions that should be implemented. The failures selected for the experiment are similar but not the same as those experienced in real incidents. They may be unlikely to occur in the real environment but are rather experimentally induced failures in the interest of studying crew responses to such unexpected situations. The final choice has been to concentrate modifications and failures to a unique part of the instrument panel (the FCUflight control unit) responsible for immediate orders given to the autopilot: speed and altitude manual selection, preset functions to the same variables, and autopilot mode selection of descent. For technical reasons (cost and difficulty of reversion to normal FFS), the team abandoned the possibilities of a bug related to input to the mid- and long-term planning system (the multicontrol display unit or MCDU) and the software management information page_290 Page 291 of master displays (the primary flight display [PFD] and navigation display [ND]). Table 10.1 summarizes the nature of the programmed computer malfunctions used in the LOFT session of the experiment (the total modifications made on the simulator is greater than this list). The list of computer malfunctions was inserted into a page of the menu of the FFS instructor's position. The failure selection by the instructor followed the same procedure as any other failure in the FFS. Design of Line-Oriented Flight Training Scenarios Two LOFT scenarios, including computer malfunctions, were designed by an instructor's team made up of representatives of the authorities and of the company supporting the experiment. The two scenarios depart from Lyon (France) and ask for a landing at Madrid (Spain). Scenario 1 is characterized by a series of computer malfunctions intertwined with a few standard failures (termed dedicated loft); Scenario 2 is more representative of a recurrent session, in that it mixes standard failures with only one computer malfunction (termed enhanced standard loft). The contrast between the two scenarios is intended to evaluate the crews' reactions and the benefit of dedicated LOFT scenarios for training versus a simple representation of actual recurrent LOFTs (for details of the scenarios, see Table 10.2). Table 10.1 List and Effect of Selected Computer Malfunctions Nature

Visualization

Effect on Flight

Speed corruption

The selected speed on FCU is not consistent with the speed displayed on the PFD.

The effective speed is the speed displayed on the PFD.

Mach corruption

The selected mach on FCU is not consistent with the mach displayed on the PFD.

The effective mach is the mach displayed on the PFD.

Altitude corruption

The selected altitude on FCU is not consistent with the altitude displayed on the PFD.

The effective altitude is the altitude displayed on the PFD.

Altitude preset ineffective

The preset function is ineffective.

The altitude given to the preset functions is immediately considered as active by the system.

Automatic reversion of descent mode between heading-vertical speed (Hdg-Vs) and track-flightpath angle (TK-FPA) and vice versa.

The selection and activation of one of the two available descent mode: Hdg-Vs and TKFPA leads immediately to the engagement of the other mode.

The system reverts to the nonselected mode (in terms of rate and profile of descent), But continues to display on PFD consistent assistance with the selected mode.

page_291 Page 292 Table 10.2 Flight Scenarios Loft 1Dedicated LOFT

Loft 2Enhanced Standard LOFT

Two MEL ITEMS before departure (PACK 2 inoperative (max flight level 310). Spoilers 2 & 4 inoperative).

Two MEL ITEMS before departure (PACK 2 inoperative (max flight level 310). Spoilers 2 & 4 inoperative).

Preflight time pressure, passenger missing.

Preflight time pressure, passenger missing.

Takeoff

Takeoff

Standard International Departure (SID)

Standard International Departure (SID) Bleed 1 fault 1,500 ft

Climb (air-traffic control)

Climb (air-traffic control)

ATC requests direct navigation to another waypoint-SID is interrupted

ATC requests direct navigation to another waypoint-SID is interrupted

Ground proximity warning system (unknown cause).

Ground proximity warning system (unknown cause).

ATC requests maintain level 210 due to traffic. ATC requests maintain level 210 due to traffic. Cabin pressure system 1 fault. ATC requests flight level 350 (impossible due to MEL item). End of climb at flight level 310.

ATC requests flight level 350 (impossible due to MEL item). End of climb variable.

Cruise

Cruise

ATC requests to speed up to MACH 0.81.

Cabin pressure system 2 fault. Manual regulation of pressurization required.

Erroneous selected MACH a few minutes later. Auto thrust fault. Descent

Descent

Altitude preset inoperative. Radar regulation by ATC.

Radar regulation by ATC.

After 15 sec

After 15 sec

Reversion of descent mode.

Reversion of descent mode.

Hdg-Vs/Tk-FPA

Hdg-Vs/Tk-FPA

Erroneous selected Speed. Approach and Landing

Approach and Landing

Go around due to adverse wind conditions

Go around due to adverse wind conditions.

Flaps jam in position 1.

Gear/nose wheel not up, locked (recovered) after procedure.

Second approach and landing

Second approach and landing.

Note. Standard failures and important events are in bold. Computer malfunctions are in bold and italics. page_292

Page 293 Experimental Setting, Personnel Involved, and Data-Recording Process The crews participating in the experiment were volunteers, and the sessions were completed in standard recurrent training conditions. Crews came to the simulator for a half-day period of training. They received the flight briefing and prepared the flight with free access to all necessary documents. They then went to the simulator and carried out the flight. Finally they debriefed with the instructor afterward. A short interview was added to the final debriefing to gather their opinions of the experiment. The total duration of each session was about 5 hours. The simulator was equipped with a fixed camera that videotaped the first officer's instrument panel. Four persons were in the simulator: the two crew members, the instructor, and an air traffic controller whose role was to emulate realistic and real-time shared communication simulation. Two persons were outside the simulator: the PhD student and the young pilot. They had an online copy of the instrument panel's video (also videotaped) and a sound connection with the instructor to get the failure. These two persons assessed the scientific value of data gathering, and conducted observations of flight preparation and crew briefings (before flight) and debriefings (after flight). For technical reasons, some failures were missing in certain scenarios: GPWS is missing for Crews 3 and 8, erroneous MACH is missing for Crew 1, and altitude preset is missing for Crews 1 and 2. Crews' Characteristics Ten crews participated in the experiment, 6 flying the first LOFT scenario, and 4 flying the second LOFT scenario. The number of crews was initially planned to be balanced between the two conditions, but two last-minute cancellations and heavy booking of the simulator limited the number of crews flying the second LOFT to four. The pilots' average experience was 3 years ± 1.61 (3.25 years for captains, 2.8 years for first officers). Results Raw Data All sessions were videotaped. Briefings and debriefings were recorded and later transcribed. Written protocols include all significant changes of situation and system status plus a literal transcription of the crew members' page_293 Page 294 conversation and remarks. A timebase is associated with the written protocols. Detection Time The detection times of system failures are presented in Table 10.3. Detection times are measured from the initial appearance of the failure on the instrument panel to the first verbal or physical reaction linked to this failure by one of the two crew members. Note that this measure does not capture those cases where one or both crew members have seen the problem, but, because of context or higher priority actions, have postponed the first reaction to the problem. The detection time is longer with software bugs, which is not surprising because there are no alerting systems associated with them. The more significant finding is that detection time and standard deviation are extremely dependent on the workload level. In high-workload conditions, when crews detect the problem, they react relatively promptly, even though the reaction time tends to be longer than in quiet conditions. However, in some cases, the crew, due to concurrent actions and goals, have taken much longer time to detect or react to (see earlier remark) the problem (3.5 minutes for one case of mode reversion). TABLE 10.3 Detection Times (Seconds) as a Matter of Failures Type and Context (Workload) GPWS

Climb & Cruise (medium and low workload)

Descent and Final Approach (medium and high workload)

Standard Failures Alerting System Active

Softward Bugs No Alerting System

n=8

n = 14 Cab Press Syst 1 fault Cab Press Syst 2 fault ATHR fault

n=9 Mach corruption Altitude preset inop

Mean = 1.38 sec

Mean = 1.57 sec

Mean = 2.22 sec

Max = 2 sec

Max = 4 sec

Max = 10 sec

Min = 1 sec

Min = 1 sec

Min = 1 sec

n = 10 n = 16 Flap jam Mode reversion Nose wheel not up, locked speed corruption Mean = 16.1 sec

Mean = 17 sec

Max = 78 sec

Max = 214 sec

Min = 1 sec

Min = 1 sec

Note. The n indicated for each case the number of measures, for example, for software bugs during climb and cruise, five crews experienced a mach corruption and four crews experienced an altitude preset, therefore n = 9. page_294 Page 295 Closure Time The closure time corresponds to the total time the crew is concerned with the failure, either by discussing the consequences or the causes of it, or by conducting tests or recovery actions. The closure times are presented in Table 10.4. These closure times are good indicators of the mental concerns induced by the failure. They show that all failures require many minutes to mentally and/or effectively control their consequences. Often the failure occurs at the end of the flight (due to induced workload overlapping with other problems and landing concerns), and so the closure time is longer. Coping Strategies General Findings When no procedure is recommended by the electronic assistance system, the general tendency of crews experiencing failures is to test and confirm the problem several times by turning the system on/off, then recovering it by resetting the appropriate subfunction. In some cases, an intermediate recovery strategy consists of resetting a dedicated circuit breaker instead of the global function, for example, resetting the autothrust circuit breaker instead of resetting the entire flight management system. In 7 cases (out of a total of 27 failures without any electronic assistance support, 26%), this test-retest was repeated long after the initial diagnoTABLE 10.4 Closure Times (in Minutes) LOFT 1 GPWS

4. ±1.5

Mach corruption

4.1 ± 1.5

Altitude preset inop

6.25 ± 3.3

ATR

7.8 ± 2.7

Reversion Hdg/TK/Vs

6.8 ± 4

Speed corruption

5.1 ±2.9

Flaps retraction jam

13.7 ± 5.5

LOFT 2 GPWS

1

Cab. Press 1 fault

8.25 ± 4.2

Cab. Press 2 fault

29 ± 6.06

Reversion Hdg TK/Vs

19.5 ± 1

Gear nose wheel not up-locked

3.6 ± 2 page_295 Page 296

sis and the decision to turn off the system. The crew considered the failure was sufficiently uncertain that there was some advantage in retesting its effectiveness. The number of tests, reset actions, and search for circuit breakers are indicated in Table 10.5. Two failures have been more thoroughly analyzed (because of their significance) for the purpose of the study. The first is the autothrust fault in LOFT 1 and the second is the mode reversion in LOFTs 1 and 2. Coping with the Autothrust Failure This failure is interesting because there is no circuit breaker reset or other reset action possible, and therefore, there is no documentation concerning a recovery procedure. However, most crews think that there must be some solution to the problem. Some of them enter into a long document search to find out the corresponding circuit breaker, whereas some others try to figure out the best possible reset action to carry out. This is good evidence that, in case of nondocumented failures, there should be an explicit mention that they are not documented. Another interesting result is related to the specific autotest sequence of the autothrust when it is turned on. This sequence begins with a message displayed in the FMA (flight mode annunciator) showing that the autothrust is active. This message remains on while the autothrust logic is undergoing the test; then the message turns off if the test is negative. The message is ambiguous enough to make some crews think that the autothrust is reacting to the command (see following excerpts of verbal protocols as examples of system behavior-induced belief):

Crew 3: Captain: Press again for a second, I saw it, the start of information. Give it another try. TABLE 10.5 Number of Tests, Rest Actions, and Search for Breakers When No Specific Procedure is Indicated Through the Electronic Assistance System

Number of Crews

Average Number of TestsTurnOn/Turn-Off

MACH corruption

5 LOFT 1

1.4 ± 0.5

Reversion Hdg/Vs

10 LOFT 1 & 2

2.2 ± 1

SPEED corruption

6 LOFT 1

1 ± 0.55

ATHR fault

6 LOFT 1

2.16 ± 1.32

Average Number of TestsGlobal System Off-On

Average Control or Search of Breakers

0.9 ± 0.56

0.5 ± 0.54

0.5 ± 0.54

page_296 Page 297 The First Officer restarted but nothing happened Captain: No, I thought I saw the start of some information but . . . If it's not in the book, I don't think why I should see it from here eh, if I haven't got a breaker in the book . . . If not there is . . . you give a bit of TOGA [take off-go around maximum thrust] and you come back, sometimes it restarts? Crew 6: First Officer: Yes . . . we can perhaps try to restart the autothrust as well just to see (the captain tries to restart the autothrust) . . . it still doesn't show up? Captain: No. First Officer: It's funny because now it's taking the . . . the signal is lighting? Captain: It's coming and going? Half of the crews experiencing this failure came to the conclusion that the system was perhaps not failing (because it was still reacting to commands), but that it was incapacitated by the hidden failure of another subsystem (e.g., a computer). When experiencing a repeated failure of the system, they tried again to explain the failure based on the initial false belief, thus entering into a spiral of false interpretations. It is worthwhile noting how much a minor detail in the functional architecture of a system can lead to ''magic" thinking and beliefs, with the potential of severe misrepresentation of the system. However, most of these beliefs are so common to humans that they might be easily foreseen with the use of existing cognitive models, and partially controlled either by a suitable design or by an explicit training scenario. In most cases, this control is not carried out by the aviation industry, not because of the cost or technical inability to do it, but because of the false assumption that pilots are so professional that they do not behave like all other humans. This, of course, is a false assumption, especially when pilots are experiencing nonstandard situations. Coping with Mode Reversions This failure is interesting because it occurs late in the flight, in the context of an accumulation of problems. In LOFT 1, all crews are flying with manual thrust and selected speed. In LOFT 2, the double cabin pressure fault was really demanding and caught page_297 Page 298 the crews' attention. Moreover, the reversion occurs in the final portion of descent where workload is very high. The problem of this failure has not been its detection per se, but the diagnosis and action after failure. Only one crew took a long time to react because their course of action required a priority decision for the approach phase at the same time they got the failure. The failure created an extremely confusing pattern on the instrument panel: If the command on the flight control unit was X (one of the two modes of descent), the figures and symbols on the primary flight display were consistent with the Y mode, and the effective mode in the logic of systems was the X one. That means that, if pilots wanted to control the flight with some specific symbols attached to the selected mode, they had to ask for the opposite, or, if they wanted to fly a specific flight pattern, they had to ask for the opposite mode but without any means of getting the associated feedback. No causal diagnosis was possible online, and therefore, it was expected that all crews would turn off the autopilot promptly in order to escape the problem. Surprisingly, the range of crew strategies in coping with the mode reversion is the widest observed in the experiment. Five crews decided to turn off the autopilot whereas another five crews decided to fly through the failure entirely or temporarily. For the ones flying through the failure, one crew was so busy that they had no time to check and control the problem. They were just accommodating the failure. The four other crews decided that it was more beneficial to remain on autopilot definitely or temporarily for workload management purposes. They felt that the autopilot had to be monitored more closely. The extent of taking control of the aircraft depended on the self-confidence that crews had in their understanding of the failure. Unfortunately, the more confident crews were the ones that made the most inappropriate assumptions about the cause of the problem (see following excerpt of transcript):

Crew 4 (debriefing): Captain: Well, in heading mode, the button used to change course doesn't work! But when you press this little button, which allows the change from choice of route to choice of course, it works! The aircraft followed the route and course it was given. So every time I displayed something and it didn't work, I give a little tap on the Track/FPA and it came back to. (laughter) Observer: Did you know this beforehand? Captain: No!, no!, just fiddled about. page_298 Page 299 Observer: Or you just took a chance. First Officer: I was on manual at the time, I tapped about a bit and I said, "ah, it works." Observer: It was just like that, just a coincidence then! Captain: Yes, just a coincidence, a little like on a . . . on a microcomputer. We are beginning to have the same reflexes as on a micro, we reset. We do things that are somewhat off the subject, but which in fact make things work without us knowing why! The following long excerpt shows how the crew evaluates the situation online; then, based on the impression that they understand the problem sufficiently, they decide to keep flying with the failure and invent a procedure to do so safely. This 5-minute sequence can be clearly divided into a logical pattern of action (detection, test, diagnosis, decision, action), which shows that this crew, regardless of the correctness of their conclusion, is applying a professional scheme and is always feeling that they have control of the situation. To reinforce this vision, it is worth noticing that this crew reached the final destination and landed without further problems. During the debriefing, they persisted in their view that they made the right choice. They stated they knew enough about the problem to consider it safer to remain in control with the autopilot on, instead of risking a manual approach in windy conditions and high airport traffic density. This case was a perfect demonstration of the importance of the online setup of a cognitive compromise and risk-taking strategies that often explain why pilots are deviating from standard operating procedures (SOPs) or from expected behaviors: Crew 9 (mode reversiononline diagnosis of failure): 1- Detection and Test. Captain: Well, did you see, what's rather funny is that I have track here which corresponds to FD track (FD: flight director), but with heading information (the captain manipulates the press button of the FCU to illustrate his explication to the first officer), do you agree? And when I put heading, I get FD heading but I have information track, and it takes a track, . . . therefore it would be better, eh, . . . we are on the course, so I would rather have a FMA HDG indication, what do you think? No? What do you think? First Officer: Here it's on track, and it has taken the reference track . . . page_299 Page 300 Captain: Here it has taken the track, so it's a nuisance . . . First Officer: With the heading . . . , yes . . . Captain: Therefore what I would prefer is to put heading to get heading . . . ATC: Flight XX, left heading 275. First Officer: Left heading 275, Flight XX (the captain puts the course index on 275). Captain: OK, if you agree, I propose to keep the Track-FPA information here . . . First Officer: Yes. Captain: You have the FMA heading information, eh, heading which is taken effectively by eh . . . no it is not taken eh . . . it's heading over that way . . . , it's not heading? First Officer: 275. 2- Diagnosis. Captain: Good track (he pressed the button) with a DV which is like that heading and 275. OK, we are going to take course. Check the security, 10,000 feet for the moment, no problem. Right now let's resume: HDG-VS 272 which is confirmed here and the course taken is 275 with a track information which is not up to standard . . . and if I show up track with this switch (he pressed the button) I get HDG and it will search . . . for the 272 which is displayed. I am not so confident when we have to turn . . . but it works . . . 3- Action.

Captain: Right, I propose my earlier solution with the heading (he pressed the button). I suggest to keep heading on, and to turn off the autopilot when we have to turn, otherwise we turn on the autopilot and use the heading mode with the track symbology. That should work. Crew Cooperation Crew cooperation was studied through verbal protocols analysis (see Tables 10.6 & 10.7). Most of the crews handled the situation as a fairly effective team. Only two conflicts occurred between the page_300 Page 301 TABLE 10.6 Dominant Type of Cooperation During Failure Diagnosis and Recovery n = 32 52.4% Collaborative work: common goals, common focus. Pilots try to solve the problem together. Distributed work: common goal, distributed subtasks. Pilots explore separately the problem and confront results. They synchronize (sometimes) for tests.

n = 27 44.3%

Conflict: the first officer disagrees with the analysis and the decision made by the captain.

n=2

3.3%

Note. n = 61 failures

TABLE 10.7 Presence or Absence of Callouts n = 27

44.3% 27.8%

Good call-outs, before action Mix of call-outs, before and after actions

n = 17

Call-out after action

n=2

3.3%

No call-out

n = 15

24.6%

Note. n = 61 failures captain and the first officer during the experiment. The captain was the decision maker in 91.8% of cases, which meant that he became the decision maker whether his position was pilot flying (PF) or pilot not flying (PNF). Note that the balance between the captain being PF and the captain being PNF was almost perfect before failures. The fairly good cooperation in the decision-making process was not observed at the action level. Only half of the standard call-outs were made properly. It seems that the situation was so demanding and so far from standard expectations that crews invested their time in understanding and managing short-term decisions to the detriment of standard procedures. In other words, such rare and uncommon situations are rather destructive for standard cooperative routines. A "new deal" is required in the collaboration between copilot and captain. Most of the crews succeeded in finding this new deal online, but two crews experienced a conflict. Indepth Analysis of Verbal Protocols This section goes beyond factual results in order to assess more global cognitive variables, for example, crew situation awareness, selfconfidence, and trust in systems. page_301 Page 302 Situation Awareness Situation awareness was studied by means of two different analyses: first, a thorough analysis of initial crew understanding and hypotheses of failure causes (to measure the accuracy of representation and knowledge), and second, an assessment of "surprises" after the diagnosis and decision have been made (which would indicate that the crews did not have the right mental model to control the situation). Note first that all the computer and software failures emulated on the simulator were constructed to be totally isolated and to have no propagation through other subsystems. The total number of recorded failures or incidents for the 10 crews (inclusive of all categories) was 61. Half of these incidents (30) corresponded to documented events for which a procedure was formally available. In these 30 incidents, incorrect knowledge was exhibited only once by a crew.

Conversely, for the 31 poorly or nondocumented incidents (including the autothrust fault and all the software bugs), 16 false hypotheses or falsely assumed relations between subsystems have been recorded. These 16 false hypotheses or assumptions can be divided into three main categories. The first and most important category (10 of 16 cases) included several system-induced misinterpretations. For example, three crews thought that the autothrust was working properly because they have misinterpreted transitory messages on the FMA (see excerpt of verbal protocol presented before). With the hypothesis in mind that the system was working, these crews have made false inferences concerning the source of the problem, and one concluded it necessary to reset the FMGS, which really was not connected to the current problem. The second category corresponds to a few cases where crews found a trick to bypass the failure by chance. For example, Crew 1 managed the mode reversion in such a "magic" way that they deduced that a link must exist between the Autothrust problem and the reversion failure (which was not only incorrect but almost impossible according to system architecture). The third and last category is represented by two cases where the crew exhibited obviously false knowledge. For example, Crew 4 was so confused about the source of the problem that they doubted even the most basic knowledge. For example, they questioned whether the autothrust system was connected with the autopilot. This can be considered an example of the effect of stress. Revisions of the initial diagnosis and decision making were quite rareit occurred in only six cases, most of which were triggered by new events. For example, in two cases, the crew reconsidered their initial decision to fly through the failure when the next failure (speed corruption) occurred. In these cases, the crews assumed that the autopilot had to be turned off, due to the progressive disruption of autopilot functions. page_302 Page 303 The conclusion of these investigations is that the crews' level of situation awareness was quite acceptable except for the fact that crews had a tendency to misinterpret subsystem connections due to system complexity. Most of the crews considered that they had the situation under control and that no risk was likely to occur for the rest of the flight with the means they had chosen to solve the problem. It is worth noticing that most crews had a good awareness of their incomplete understanding that led them to make sophisticated cognitive and safety compromises in order to remain in control. Note also that most of these crews persisted with that feeling even after debriefing and comments from the observers. These figures illustrate that the primary and driving element of situation awareness is the feeling of whether one is in control of the present and future situation for achievement of the goal, rather than the objective perception or comprehension of the world (see Amalberti, 1998). Trust and Debriefing Another important goal of the experiment was to assess the impact of this training on crew confidence in systems. Trust was evaluated based on an interview at the end of the session. Seven crews found the session overall more demanding than a normal recurrent session. Four of the six crews flying the LOFT 1 found this session extremely demanding for workload management. Only one crew found the session easy. Seven crews were very positive about the new LOFT and said that this experience will enable them to manage equivalent situations in the future. Tow other crews considered the LOFT as medium or poor training due to the unrealistic combination of failures. The last crew had reservations about the interest in this training. The captain stated that "if the aircraft is so unreliable to require this type of training, it should be grounded." This captain also said that he had been an opponent of automation and of the aircraft itself for a long time. General Discussion Summary of Results All crews were able to land safely. Most of them had an overall feeling of high or extreme workload. The detection time of software failures ranged from 2 seconds to 3 minutes, depending on the workload level and the course of action at the moment of the failure. All crews showed a tendency to cycle the failing system several times to test the failure before trying to reset the system in order to recover it (resetting fuse, proceeding the global function reset, e.g., resetting FMGS). page_303 Page 304 Such intuitive reset actions can trap the crews when no reset action exists for the failing system. Many crews were also tempted to reset again a few minutes after an initial failing procedure, therefore proving that software malfunctions are often inexplicable to pilots. Five of the crews decided to revert to manual control when experiencing software bugs. Conversely five crews decided to fly through the failure, maintaining the remaining automation functions in order to manage workload. A thorough analysis of crews' mental representation and situation awareness via verbal protocols analysis show a series of unexpected magic thinking on subsystem organization and interrelations. Positive and Negative Outcomes Improving the Accuracy of the Model of Crews Flying Advanced Glass-Cockpit Aircraft Most of the results obtained in this experiment are not surprising to the aviation human factors community. In 1987 Bainbridge articulated the irony of automation: Although automation reduces workload, humans are needed more than ever because they are the last barrier when the automation fails. The experiment is a good demonstration of this irony. Lee and Moray (1994) showed with a computer game that any time an automatic system is partially failing, humans have a tendency, in high-workload conditions, to maintain the system on and to reinforce the controls instead of turning off the automation. This experiment confirms that results obtained in laboratory with computer games have good validity for the real world.

Rogalski, Samurcay, and Amalberti (1994), Wanner and Leconte (1989), and Wiener et al. (1991) have demonstrated that the standard crew cooperation items (call-outs, SOPs) are impaired anytime the situation awareness of the crew is being impoverished. Again, this is the case in this experiment. The complexity of the situation refocuses cooperation around negotiations, to the detriment of the respect of standard procedures. Basic and intuitive collaborative human behavior overrides educated behaviors. Last, Billings (1997), Sarter and Woods (1991, 1992, 1995), Valot and Amalberti (1992), and Wiener (1988) have all pointed to the incorrect mental model that crews may develop concerning system architecture. Another study on LOFT for glass cockpits, funded within the French National Plan for Human Factors (Aw, 1997), has shown similar crew strategies to reset systems and circuit breakers. Fortunately, crews also have a rather good estimate of the potential incorrectness of their conclusions and control the risk by a careful change in strategy and goals (more checks, online recomposition of task sharing) that compensates for page_304 Page 305 their incomplete or inaccurate knowledge. They can, however, be trapped if the system architecture is not robust to these reset actions. This is not specific to any manufacturer but merely an effect of system complexity, and to some extent an effect of the training need for an easy-tocarry, simplified, and operative model of system architecture. Most of these points have already led to recommendations (Abbott et al., 1966). These various crew behaviors are consistent enough to point out general traits of pilots flying glass-cockpit aircraft. The knowledge of these traits and tendencies are central for future aircraft design and for the development of training programs. Among the principal traits is the spontaneous tendency to improvise, reset circuit breakers or higher functions, and make (incorrect) inferences anytime the system becomes difficult to understand. However, crews have enough flexibility to accommodate unknown situations, provided they have enough time to set up a new plan of action and they cooperate effectively. A further lesson is the extreme sensitivity of glass cockpits to interhuman conflicts, especially when intuitive and nontrained cooperation is required. Risks and Benefits of Crew Training on Software Bugs As mentioned in the introduction, glass-cockpit aircraft are considered to be the safest generation of aircraft. Still, some new vulnerabilities are associated with this new technology. Software deficiencies are one of these new vulnerabilities. They are not frequent, nor catastrophic by themselves, thanks to the software design quality assurance and the redundancies introduced into the system architecture. Moreover, most of the computer bugs will manifest themselves only once in the life of the aircraft. There is also a general feeling that teaching crews how to react to bugs is a form of recognition that bugs are frequent and may lead to uncontrolled fears and incorrect beliefs. However, because the number of potential bugs is infinite, many crews will experience one or more of them in their career. Moreover, pilots can induce by means of unwanted or uncontrolled interactions with the system, some situations that are not so different from the effect of software bugs in terms of results: They will be surprised by the system reactions. One knows that every time these bugs and surprises occur, they will be extremely confusing for crews, regardless of the vulnerabilities arising from a real system failure, errors caused by human manipulation of data input, or mode selection. It could therefore be useful for the future to demystify the risk of software bugs, and to train crews concerning the occurrence of this risk. The selection of software bugs should be based on their representativity and their potential for training generic coping strategies. The present study is page_305 Page 306 an excellent attempt to conduct such training. Of course, today there is a high associated cost for such training (simulator modification), but this cost should be lowered if the practice become mandatory. In case a specific simulator is not available, it remains important to teach at least a basic and simple strategy to cope with abnormal or undocumented inflight problems as well as to teach a philosophy concerning reset actions in order to standardize behavior. Conclusion This experiment was conducted with 10 crews experiencing software bugs in two dedicated LOFT sessions. The findings concerning crew reactions go beyond the strict interest of aviation safety and of specific training programs. The similarity of results obtained in several other fields (e.g., in Hollnagel, 1993, or Woods et al., 1994) indicates that the crew behavior identified in this study is typical of the relationship between human cognition and system complexity. The more complex the system, the larger the heterogeneity of cognition with islands of remarkable subsystem knowledge neighboring dramatic beliefs and false knowledge of system architecture (for a more extensive discussion, see Amalberti, 1996). This structure of cognition is a consequence of the conflicting dimensions of cognition (logic of least effort, search for a good performance). The point that is less obvious is that the risk to system safety does not result primarily from the lack of knowledge but merely from the incorrect estimation of what is known and unknown and the absence of generic strategy when facing unknown situations. Therefore, it is probably naive to think that more theoretical system learning could control the observed cognitive weaknesses. It is also important to teach crews how to assess their own knowledge and to generally cope with the infinite number of potential unknown situations. Acknowledgments The ideas expressed in this chapter only reflect the opinion of the authors and must not be considered as official views from any national or international authorities or official bodies to which the author belongs. This work has been subsidized and managed by DGAC-SFACT as an action of the First National Plan for Aviation Human Factors. The authors thank the crews and the company staff for their enthusiastic participation and support of the experiment. The authors also thank Ron Pearson from CAA UK for his helpful suggestions and text revision.

page_306 Page 307 References Abbott, C., Slotte, S., & Stimson, D. (Eds.). (1996). The interfaces between flight crews and modern flight desks systems (FAA human factors team report). Washington, DC: FAA. Amalberti, R. (Ed.). (1994). Briefings, a human factors course for professional pilots. Paris: IFSA-DEDALE. Amalberti, R. (1996). La conduite de systèmes à risques [The control of systems at risk]. Paris: PUF. Amalberti, R. (1998). Automation in aviation: A human factors perspective. In D. Garland, J. Wise, and D. Hopkin (Eds.), Aviation human factors. Mahwah, NJ: Lawrence Erlbaum Associates. Aw, A. (1997). Intermediary report on the experiment ARCHIMEDE 3 (APSYS Research Rep. No. 97.13). Paris: Apsys. Bainbridge, L. (1987). Ironies of automation. In J. Rasmussen, J. Duncan, & J. Leplat (Eds.), New technology and human errors (pp. 271 286). New York: Wiley. Billings, C. (1997). Human-centered aviation automation. Mahwah, NJ: Lawrence Erlbaum Associates. Funk, K., Lyall, B., & Riley, V. (1995, April). Flight deck automation problems. Paper presented at the 8th International Symposium on Aviation Psychology, Columbus, OH. Hollnagel, E. (1993). Human reliability analysis, context and control. London: Academic Press. Lee, J., & Moray, N. (1994). Trust, selfconfidence, and operator's adaptation to automation. International Journal of Human-Computer Studies, 40, 153 184. Pelegrin, C., & Amalberti, R. (1993, April). Pilot's strategies of crew coordination in advanced glass-cockpits; a matter of expertise and culture. Paper presented at the ICAO Human Factors seminar, Washington, DC. Rogalski, J., Samurcay, R., & Amalberti, R. (1994). Coordination et communication dans les cockpits automatisés [Coordination and communication in advanced glass cockpit]. Brétigny sur Orge, France: IMASSA-CERMA. Sarter, N., & Woods, D. (1991). Situation awareness: A critical but ill-defined phenomenon. International Journal of Aviation Psychology, 1 (1), 45 57. Sarter, N., & Woods, D. (1992). Pilot interaction with cockpit automation: Operational experiences with the flight management system. International Journal of Aviation Psychology, 2(4), 303 321. Sarter, N., & Woods, D. (1995). Strong, silent and ''out-of-the-loop"; properties of advanced automation and their impact on human automation interaction (CSEL Report No. 95-TR-01). Colombus: Ohio State University Press. Valot, C., & Amalberti, R. (1992). Metaknowledge for time and reliability. Reliability Engineering and Systems Safety, 36, 199 206. Wanner, J. C., & Leconte, P. (1989). Etude Rachel-Archimède [Rachel-Archimède Study] (Report No. DGAC 89-52016). Paris: DGAC. Wiener, E. (1988). Cockpit automation. In E. Wiener & D. Nagel (Eds.), Human factors in aviation (pp. 433 461). New York: Academic Press. Wiener, E., Chidester, T., Kanki, B., Parmer, E., Curry, R., & Gregorich, S. (1991). The impact of cockpit automation on crew co-ordination and communication 1Overview, LOFT evaluations, error, severity and questionnaire data (NASA Scientific Report No. 177587). Moffet Field: NASA. Wiener, E., Kanki, B., & Helmreich, R. (1993). Cockpit resources management. New York: Academic Press. Woods, D., Johannesen, D., Cook, R., & Sarter, N. (1994). Behind human error. Wright-Patterson Air Force Base, OH: CSERIAC. page_307 Page 309

Chapter 11 A Cognitive Engineering Perspective on Maintenance Errors James Reason University of Manchester, England Cognitive engineering (CE) is intimately linked to new technology. Its most notable achievements have been the description and analysis of the human-machine mismatches that arise when designers fail to take adequate account of the cognitive needs and capabilities of the end users. The main focus of CE has been on the problems created by the provision of automated control systems made possible by rapid advances in computational power and flexibility. Within aviation and elsewhere, this has led, naturally enough, to an almost exclusive concern with the difficulties experienced by the "front-line" system operators: flight crews, air traffic controllers, control room operators, anesthetists, and the like.

One of the inevitable consequences of automation is that it reduces the amount of hands-on contact demanded of system controllers. This is acknowledged in the cognitive part of the CE label. Taking human controllers out of the loop reduces the likelihood of slips, lapses, trips, and fumbles, but places greater demands on the higher cognitive processes. When these are impeded by "clumsy" automation, controllers can lose situational awareness and succumb to mode errors, sometimes with fatal consequences (Sarter & Woods, 1995; Woods, Johannesen, Cook, & Sarter, 1994). These important issues are dealt with by other contributors to this volume and are not discussed further here. This chapter deals with the otherdirect contactend of the hands-on dimension, with the maintenance-related activities that are still carried out even in the most modern systems. At first glance, it might appear that page_309 Page 310 this type of work falls outside the scope of CE, as it is described by Sarter and Amalberti in the Introduction to this volume, and belongs more properly in the sphere of traditional human factors. Although maintenance lapses are clearly a human factors issue, a strong case can be made for their relevance to the cognitive engineer as well. CE is concerned with the analysis and remediation of human-system mismatches. There are few such mismatches as profound and as dangerous as the one described later, even though it does not directly involve automated supervisory control. The rapid technological advances in aviation have not only meant the replacement of human control by computers; they have also brought about very substantial improvements in the reliability of equipment and components. This has been achieved by the use of better manufacturing processes and materials, as well as through the widespread availability of sophisticated diagnostic techniques. But the maintenance schedule for a modern aircraft still demands the repeated disassembly, inspection, and replacement of millions of removable parts over its long working life. Thirty or even 20 years ago, these inspections would have resulted in the frequent detection and replacement of failed components. Then, the risks of inflight failure due to intrinsic engineering defects probably outweighed the dangers associated with allowing legions of fallible people access to the vulnerable entrails of the aircraft. But now the balance has tipped the other way. The greatest hazard facing a modern aircraftaside from gravitycomes from people, and most particularly from the well-intentioned but often unnecessary physical contact demanded by outdated maintenance schedules. Before this claim is dismissed as mere provocation, consider the following data from Boeing (1994). Listed next are the top seven causes of 276 inflight engine shutdowns: Incomplete installation (33%). Damaged on installation (14.5%). Improper installation (11%). Equipment not installed or missing (11%). Foreign object damage (6.5%). Improper fault isolation, inspection, test (6%). Equipment not activated or deactivated (4%). Because it adds some weight to the present argument, it is worth pointing out that quite the opposite situation holds for the 13 or so prestigious but elderly Concorde supersonic transports still in service. For the most part, they are kept operational by the loving care and attention of engineers who deal almost exclusively with this aircraft. But Concorde has been page_310 Page 311 flying since the 1960s and these dedicated maintenance cohorts will soon be reaching retirement age. Without their detailed knowledge of its 1950s technology, it is hard to see how Concorde can continue to operate safely. In stark contrast, it is difficult to foresee any substantial improvements in aviation safety if the latest generation of aircraft and their successors continue to be exposed to close encounters with the human hand at the same high frequency as are now required by the manufacturers. In the next section, the case is presented for classifying human reliability problems by activities. Of these, omissions associated with installation during maintenance-related work probably constitute the largest single category of human error, even in very advanced technological systems such as nuclear power plants and modern aircraft. Maintenance-related failures of one kind or another are so frequently implicated in accidents and incidents that it has been suggested (K. Sasou, personal communication, 1996) that one of the main functions of human supervisory controllers in largely automated technologies is to restore the system to a safe state after it has succumbed to undiscovered maintenance defects. Universal Activities in High-Technology Systems There are many ways of classifying human performance and its associated errors, each one having its uses and limitations. Some cognitive psychologists, for example, follow Rasmussen (1983) in distinguishing performance levels according to both the dominant mode of action controlconscious or automaticand the degree to which the situation is either routine or problematic. This generates the now familiar performance levelsskill based (SB), rule based (RB), and knowledge based (KB)and allows them to be coupled with various error types: SB slips and lapses, RB mistakes, and KB mistakes (Reason, 1990). Such a causal taxonomy is helpful in locating the underlying mental processes, but it suffers from the considerable disadvantage of being difficult for nonspecialists to use in a real-world domain. Left to their own devices, engineers and quality inspectors are much more likely to classify human performance problems according to their consequences for the system (e.g., missing fastenings, improper installation, tools left in cowling, and the like). Though it may obscure the underlying cognitive mechanisms, this kind of information is both widely available and easy to interpret.

One of the great advantages of these consequential (rather than causal) classifications is that there is little doubt as to the kind of activity the individual was engaged in when the error occurred. Such breakdowns of performance problems by activity can be very revealing, as is shown later. page_311 Page 312 And, as Freud (1922) pointed out, it is often better to work with what is readily availablein his case, the slips and lapses of everyday lifethan to strive for data that are hard to get and sometimes impossible to understand. Although our main focus here is on the aviation, it is but one of many comparable domains involving hazardous and complex socio-technical systems with multiple defences, barriers, and safeguards. Much has been gained by focusing on the common elements of these domains rather than on their distinguishing features. It is therefore useful, when considering the varieties of human performance, to start with a set of activities that are carried out within all of these low-risk, high-hazard domains. A preliminary list is set out next: Control under normal conditions. Control under abnormal or emergency conditions. Maintenance, calibration, and testing. To this list, we should properly add the preparation and application of procedures, documentation, rules, regulations, and administrative controls. For our present purposes, though, it is sufficient to limit our attention to the three "sharp end" activities in the preceding list. Activities and Their Relative Likelihood of Performance Problems From this list of universal human activities, it is possible to make a preliminary assessment of their relative likelihood of yielding human performance problems. To do this, we can apply three key questions: The hands-on question: What activities involve the most direct human contact with the system and thus offer the greatest opportunity for any active failures (errors and violations) to have an adverse effect on the system? The criticality question: What activities, if performed less than adequately, pose the greatest risks to the safety of the system? The frequency question: How often are these activities performed in the day-to-day operation of the system as a whole? It would be reasonable to expect that an activity scoring "high" on all three of these questions is the one most likely to be associated with human performance problems. The results of this analysis are summarized in Table 11.1. page_312 Page 313 TABLE 11.1 Assessing the Relative Likelihood of Human Performance Problems in the Universal Human Activities Activity

Hands on

Criticality Frequency

Normal control

Low

Moderate

Abnormal states

Moderate

High

Low

High

High

High

Maintenance-related

High

It is clear from this analysis that maintenance-related work emerges as the activity most likely to generate human performance problems of one kind or another. To what extent is this prediction borne out by the available data? This is examined in the next section. Performance Problems by Activity: The Data The most relevant data come from nuclear power operations. Table 11.2 shows a compilation of the results of three surveys, two carried out by the Institute of Nuclear Power Operations (INPO, 1984, 1985) in Atlanta, and one conducted by the Central Research Institute for the Electrical Power Industry (CRIEPI) in Tokyo (K. Takano, personal communication, 1996). The inputs for the INPO investigation were significant event reports filed by U.S. nuclear utilities. In the first INPO study, 87 significant event reports yielded 182 root causes. In the second INPO study, 387 root causes were identified from 180 significant event reports. The data for the Japanese study came from 104 standardized event reports from the CRIEPI-associated utilities.

TABLE 11.2 A Compilation of the Results of Three Studies Showing the Relationship Between Activities and Performance Problems Activities

Mean Proportions of Performance problems (Percentage of Total)

Ranges (Percentage)

Maintenance-related

60

55 65

Normal operations

16

8 22

Emergency operations

5

28 page_313 Page 314

These data bear out the earlier analysis. In all three studies, more than half of all the identified performance problems were associated with maintenance, testing, and calibration activities. The Vulnerability of Installation The next question concerns what aspect of maintenance, testing, and calibration is most likely to be associated with less-than-adequate human performance. Regardless of domain, all maintenance-related activities require the removal of fastenings and the disassembly of components, followed by their reassembly and installation. Thus, a large part of maintenance-related activity falls into the categories of either disassembly or installation. Once again, there are a priori grounds for identifying one of these tasksinstallationas being the most likely to attract human performance problems. The reasons for this are made clearer by reference to Fig. 11.1, showing a bolt with eight marked nuts attached to it. This represents the maintenance task in miniature. Here, the requirement is to remove the nuts and to replace them in some predetermined order. For the most part, there is only one way to remove the nuts, with each step being naturally cued by the preceding one. The task is one where all the necessary knowledge is in the world rather than in the head (Norman, 1980). In the case of installation, however, there are over 40,000 ways in which the nuts can be reassembled in the wrong order (factorial 8). And this takes no account of any possible omissions. Moreover, the likelihood of error is further compounded by the fact that many possible omissions and misorderings may be concealed during the reassembly process. Thus, the probability of making errors during installation is very much greater than during disassembly, whereas the chances of detecting and correcting them is very much less.

Fig. 11.1. The bolt-and-nuts example. page_314 Page 315 The available evidence supports the prediction that installation will be especially vulnerable to errors. The Boeing inflight shutdown data, presented earlier, showed that various forms of faulty installation were the top four most frequent causal categories, together comprising over 70% of all contributing factors. Comparable findings were obtained by Pratt and Whitney (1992) in their survey of 120 inflight shutdowns occurring on Boeing 747s in 1991. Here, the top three contributing factors were missing parts, incorrect parts, and incorrect installation. In a UK Civil Aviation Authority survey (UKCAA, 1992) of maintenance deficiencies of all kinds, the most frequent problem was the incorrect installation of components, followed by the fitting of wrong parts, electrical wiring discrepancies, and loose objects (tools, etc.) left in the aircraft. The Prevalence of Omissions What type of error is most likely to occur during maintenance-related activities and most especially during the installation task? As noted earlier, the answer is omissions: the failure to carry out necessary parts of the task. Omissions can involve either the failure to replace some component, or the failure to remove foreign objects (tools, rags, etc.) before leaving the job. Rasmussen (1980) analyzed 200 significant event reports published in Nuclear Power Experience, and identified the top five error types as follows: Omission of functionally isolated acts (34%). Latent conditions not considered (10%).

Other omissions (9%). Side effect(s) not considered (8%). Manual variability, lack of precision (5%). He also identified the activities most often associated with omissions, as listed next: Repair and modification (41%). Test and calibration (33%). Inventory control (9%). Manual operation and control (6%). The INPO (1984) investigation, again of nuclear power plant significant events, found that 60% of all human performance root causes involved omissions, and that 64.5% of the errors in maintenance-related page_315 Page 316 activities were omissions. This study also observed that 96% of deficient procedures involved omissions of one kind or another. Reason (1993) analyzed the reports of 122 maintenance lapses occurring within a major airline over a 3-year period. A preliminary classification yielded the following proportions of error types: Omissions (56%). Incorrect installations (30%). Wrong parts (8%). Other (6%). What gets omitted? A closer analysis of the omission errors produced the following results: Fastenings undone/incomplete (22%). Items left locked/pins not removed (13%). Caps loose or missing (11%). Items left loose or disconnected (10%). Items missing (10%). Tools/spare fastenings not removed (10%). Lack of lubrication (7%). Panels left off (3%). It does not seem necessary to labor the point any further. Omissions represent the largest category of maintenance-related errors, and maintenance-related errors constitute the most numerous class of human performance problems in nuclear power plants, and probably in aviation as wellthough there are no comparable data to support this view as yet. Omission-Prone Task Features From an analytical point of view, there are at least two approaches toward a better understanding of maintenance omissions, one seeking the underlying cognitive mechanisms, the other trying to determine what aspects of a task cause it to be especially omission-prone. The former route is made difficult by the fact that an omission can arise within a number of cognitive processes concerned with planning and executing an action, as summarized in Table 11.3. Even when the omission is one's own, the underlying mechanisms are not easy to establish, but when the omission is made by another at some time in the past, the underlying reasons may be impospage_316

Page 317 TABLE 11.3 Summarizing the Possible Cognitive processes Involved in Omitting Necessary Steps From a Task Level of Failure

Planning

Nature of Failure

Failure Type

(a) A necessary item is unwittingly overlooked.

Mistake

(b) The item is deliberately left out of action plan.

Violation

Intention storage The intention to carry out the action(s) is not recalled at the appropriate time.

Lapse

Execution

The actions do not proceed as intended and a necessary item is unwittingly omitted from the sequence.

Slip

Monitoring

The actor neither detects or corrects the prior omission.

Slip

sible to discover. The task analysis route, on the other hand, is more promising. It is also more in keeping with the contextual concerns of CE (see Hollnagel, chap. 3, this volume). An everyday illustration of omission-prone task steps is provided by the job of duplicating a loose-leaf document on a simple photocopying machine (see Fig. 11.2). Both common experience and a recent survey (Reason, 1996) show that the most likely omission is to leave the last page of the original under the lid when departing with the copy and the remainder of the original pages. There are at least four distinct task factors contributing to the high likelihood of leaving the last page of the original behind: The step is functionally isolated from the preceding actions. Before, the step of removing the previously copied page had been cued by the need to replace it with the next page. In this instance, there is no next page.

Fig. 11.2. A simple photocopier in which there is a strong likelihood of failing to remove the last page of the original. page_317 Page 318 The need to remove the last page of the original occurs after the main goal of the activity has been achievedobtaining a complete copy of the documentbut before the task itself is complete. The step occurs near to the end of the task. Natural history studies of absent-minded slips have shown that such ''premature exits" are a common form of omission (Reason, 1979). These errors can be prompted by preoccupation with the next task. In aircraft maintenance, however, there is no guarantee that the individual who starts on a job will be the one expected to complete it. And even when the same person performs the whole task, there is always the possibility that he or she may be called away or distracted before the task is finished. The last page of the original is concealed under the lid of the photocopierthe out-of-sight-out-of-mind phenomenon (see Fischhoff, Slovic, & Lichtenstein, 1978). To this list can be added several other features that, if present within a given task step, can summate to increase the probability that the step will be omitted. Other omission-provoking features include the following: Steps involving actions or items not required in other very similar tasks. Steps involving recently introduced changes to previous practice. Steps involving recursions of previous actions, depending on local conditions. Steps involving the installation of multiple items (e.g., fastenings, bushes, washes, spacers, etc.) Steps that are conditional on some former action, condition, or state. Steps that are not always required in the performance of this particular task.

Maintenance activities are highly proceduralized. It is therefore possible, in principle, to identify in advance those steps most vulnerable to omissions by establishing the number of omission-provoking features that each discrete step possesses. Having identified error-prone steps, remedial actions can then be taken to reduce the likelihood of these steps being left out. The Characteristics of a Good Reminder Although there are a variety of cognitive processes that could contribute to an omission, and their precise nature is often opaque to both the actor and the outside observer, the means of limiting their future occurrence page_318 Page 319 can be relatively straightforward and easy to apply, once the error-prone steps have been identified. The simplest countermeasure is an appropriate reminder. What characteristics should a good reminder possess? Following are some suggestions: A good reminder should be able to attract the actor's attention at the critical time (conspicuous). A good reminder should be located as closely as possible in both time and distance to the to-be-remembered (TBR) task step (contiguous). A good reminder should provide sufficient information about when and where the TBR step should be carried out (context). A good reminder should inform the actor about what has to be done (content). A good reminder should allow the actor to check off the number of discrete actions or items that need to be included in the correct performance of the task (check). The five characteristics just listed could be regarded as universal criteria for a good reminder. They are applicable in nearly all situations. There are, however, a number of secondary criteria that could also apply in many situations: A good reminder should work effectively for a wide range of TBR steps (comprehensive). A good reminder should (when warranted or possible) block further progress until a necessary prior step has been completed (compel). A good reminder should help the actor to establish that the necessary steps have been completed. In other words, it should continue to exist and be visible after the time for the performance of the step has passed (confirm). A good reminder should be readily removable once the time for the action and its checking have passedone does not, for example, want to send more than one Christmas card to the same person (conclude). As we see from the case study that follows, the presence of reminders is not a guaranteed solution to the omission problem. Butin the spirit of kaizenit will certainly help to bring about a substantial reduction in their numbers. Consider, for example, what the impact of the reminder shown in Fig. 11.3 might be on your likelihood of leaving behind the last page of the original. page_319 Page 320

Fig. 11.3. An example of a simple reminder to minimize the last-page omission. In aircraft maintenance, any such reduction in the largest single category of maintenance lapses could have substantial benefits, both in lives and in costs. According to a Boeing analysis (Davis, 1993), maintenance and inspection failures ranked second only to controlled flight into terrain in the list of factors contributing to onboard fatalities, causing the deaths of 1,481 people in 47 accidents between 1982 and 1991. However, the costs of maintenance failures are more likely to be counted in terms of money rather than casualties. Such losses can be very high. One major airline has estimated its annual losses due to maintenance lapses at around $38 million dollars. Graeber (1996) reported that an inflight engine shutdown, for example, can cost up to $500,000 in lost income and repairs; each flight cancellation can cost up to $50,000; each hour of delay on the ramp can cost $10,000.

It should be noted that the reminders described earlier are not a CE solution to the omission problem. They are at best first-aid measures to cope with the difficulties experienced in the present generation of aircraftwhose working lives will run for many years into the future. A genuine CE solution would be to design aircraft parts so that they can only be installed in the correct way. Another would be to make the onboard engineering computer sensitive to missing parts and for it to disable the aircraft until these parts have been fitted. A third and more fundamental solution would be to design out the need for hands-on human contact during maintenance inspections. Putting Maintenance Omissions into Their System Context: A Case Study Analysis On March 1, 1994, a Northwest Airlines (NWA) Boeing 747-251B dropped and then dragged its Number 1 engine during the landing rollout at New Tokyo International Airport, Narita. The immediate page_320 Page 321 cause of this accident was the fracture of the upper link fuse pin within the engine pylon. This, in turn, was due to the failure(s) to secure the fastenings of the aft diagonal brace fuse pin, causing it to come free some time after a Category "C" check1 at NWA's Minneapolis/St. Paul maintenance facility. The engine had been opened at that time to permit the nondestructive testing of the various fuse pins. The appropriate fastenings were later found in the hangar in an unmarked cloth bag concealed by a piece of wooden board on an underwing work stand. The findings of the National Transport Safety Board's investigation (NTSB, 1995) offer a fascinating insight into the ways that situations, work practices, and organizational factors can combine to provoke a set of installation omissions and to thwart the various barriers and safeguards. The human and systemic contributions to this accident are summarized next using the investigative model described by Maurino, Reason, Johnston, and Lee (1995). This model works backwards from the adverse outcome to consider the following questions: What defences failed? What unsafe acts (active failures) were committed? What were the contextual factors that provoked these unsafe acts? What were the organizational factors that gave rise to these error-provoking local conditions? It is inevitable that the brief account that follows will fail to do full justice to the complexity of the actual events: Failed Defences. The computer-generated work card outlining the steps for the nondestructive testing of the fuse pins was wrongly stamped "N/A" (not applicable) on those steps covering the replacement of the fastenings. A red tag, indicating a nonroutine disassembly of a vital part, was required to be attached in the vicinity of the work. No one recalled seeing this tag. The "OK to Close" inspection consisted of a quick scan for rags and other foreign objects. The absence of the fastenings was neither expected nor detected by the inspector. The lack of an organized method of storing removed parts prevented their physical presence from alerting personnel to the possibility that they had not been reinstalled. 1 A major overhaul occurring after 1,000 flight cycles, 5,290 hours, or 450 days. The overhaul may last from 14 to 35 days. page_321 Page 322 Active Failures. The primary and secondary retainers for the aft diagonal brace fuse pin on the Number 1 engine pylon were removed but not replaced. It has not been established who carried out the removal of the primary retainers. A bag containing Number 4 engine's fuse pin retainers was found after the inspection of Number 1 engine was completed. The Number 4 engine retainers were subsequently replaced, but this did not alert personnel to the possibility that similar retainers could still be missing from Number 1 pylon. Error-Producing Conditions. Poor illumination and dangerous scaffolding hampered the inspector's scrutiny of the Number 1 engine assembly before it was closed. The mechanics who work on the weekend shifts have a low level of experience. Aircraft usually enter or leave the hangar on the weekend. The white cloth bag containing the Number 1 engine fuse pin retainers was not labeled and was concealed by poor local housekeeping. Personnel had differing interpretations of the airline's red tag policythe alerting device or reminder. The mechanic tasked with removing the secondary fuse pin retainers understood that red tags need only be posted when specified in the work card. No such specification was present on the work card, so it is unlikely that any red tag was displayed. The quality of the instruction provided by the computer-generated work cards was inadequate. The card in question did not specify the type of fuse pin present on that particular pylon (there were many variations within the same fleet) or whether secondary retainers were required to be present. Organizational and Systemic Factors.

The computer-based procedure (CITEXT) for generating work cards was inherited by NWA from a prior merger and was judged by NTSB to be inadequate in many respects. It lacked pertinent information contained in the FAA-approved maintenance manual. It did not follow the procedures laid down in the airline's General Engineering and Maintenance Manual. It did not contain instructions specific for work carried out on the 747's Number 1 engine pylon. It was widely distrusted by the workforce. page_322 Page 323 Training deficiencies resulted in failures by the workforce to understand the application of CITEXT and the red tag system for critical maintenance. At that time, the position of Director of Training was vacant and the duties temporarily assigned to an acting director. Maintenance supervisors and managers of NWA failed to ensure that work practices complied with the airline's FAA-approved maintenance manual. FAA regulatory oversight of the maintenance facility failed to detect the frequent deviations from the airline's red tag policy. It also failed to apply FAA-developed human factors procedures, and allowed an inadequate work environment to exist within the hangar. Migration of fuse pins from B-747 engine pylons had been reported on five occasions prior to the NWA Narita accident. One had resulted in an accident similar to that at Narita. All were attributed to improper installationthough design defects must surely have played their part. These incidents led Boeing to require the addition of secondary fuse pin retainers. At the time of the accident, seven of NWA's fleet of 41 B747s had these secondary retainers installed on the aft diagonal braces. It is likely that this variety of fastenings contributed to the misunderstandings and procedural confusions that subsequently allowed the installation errors to go undetected. This analysis highlights the causal complexities behind what appears at first sight to be just another omission error, one among the many that plague the aviation industry. It is clear that there is no one solution to these problems. Effective error management requires tackling different error-provoking factors with different countermeasures targeted at the individual, the work group, the error-affordances of the tasks, the workplace, the organization, and the aviation system at large. Conclusions This chapter has adopted an activity-oriented approach to identifying what still remain, even in these days of advanced automation, a very large category of human performance problems in aviation. A CE perspective is appropriate because, for the most part, many of these difficulties need not occur. They arise from what one hopes is a temporary mismatch between the perceptions of system designers and the capabilities of their downstream human agents. This activity-oriented approach has led us through a succession of increasingly finer grained analyses, using cognitively crude but widely page_323 Page 324 available data. We began by establishing maintenance-related activities as the largest source of human performance problems among the "universal" activities carried out human beings in complex technologies. Within maintenance, calibration, and testing, we identified installation and reassembly as the most likely tasks to be less than adequately performed. And within these tasks, the omission of necessary steps was shown to be the most likely error form. At the next and most detailed level, we noted a number of contextual features that could render particular task steps particularly prone to being omitted. It was suggested that simple reminders could represent an interim solution to many of these problems. However, the case study analysis of the Narita accident indicated that omission-provoking factors occur at many different levels of the system, and not all of them are amenable to such easy-to-deliver nostrums. A more fundamental remedy would entail a substantial reduction in the amount of hands-on contact between maintainers and aircraft. This would require a greater sensitivity on the part of aircraft designers to the varieties of human fallibility and the error-provoking nature of large parts of the maintenance activity. Finally, a word for the cognitive engineers who might still doubt the relevance of this topic. That these commonplace maintenance omissions are committed by manual workers rather than by supervisory system controllers should not take them beyond what sometimes appear to be the rather lofty concerns of CE. That many of them may be absent-minded lapses does not alter the fact that such errors have complex cognitive origins that are still little understood. And there can be no doubt that they happen within an engineering context that is both dynamic and complex, even if this is more likely to be associated with torque wrenches than with computing wizardry. But, perhaps most important, it should be recognized that they occur as the direct result of a failure on the part of system designers to appreciate the error-provoking nature of the activity, the strengths and limitations of the people who perform it, andabove allthe dangers created by this largely unnecessary combination of hazards. The study of such mismatches and the provision of recommendations for their correction are surely the very essence of CE. References Boeing. (1994). Maintenance error decision aid. Seattle: Author. Davis, W. A. (1993, October). Human factors in the global marketplace. Keynote address presented at the Human Factors & Ergonomics Society, annual meeting, Seattle. Fischhoff, B., Slovic, P., & Lichtenstein, S. (1978). Fault trees: Sensitivity of estimated failure probabilities to problem representation. Journal of Experimental Psychology: Human Perception and Performance, 4, 330 334. page_324

Page 325 Freud, S. (1922). Introductory lectures on psychoanalysis. London: George Allen & Unwin. Graeber, R. C. (1996, May). The value of human factors awareness for airline management. Paper presented at the Royal Aeronautical Society conference Human Factors for Aerospace Leaders, London. INPO. (1984). An analysis of root causes in 1983 significant event reports (INPO Report No. 84 027). Atlanta: Author. INPO. (1985). An analysis of root causes in 1983 and 1984 significant event reports (INPO Report No. 85 027). Atlanta: Author. Maurino, D., Reason, J., Johnston, N., & Lee, R. (1995). Beyond aviation human factors. Aldershot, England: Avebury Aviation. Norman, D. (1980). The psychology of everyday things. New York: Basic Books. NTSB. (1995). Maintenance anomaly resulting in dragged engine during landing rollout, Northwest Airlines Flight 18, New Tokyo International Airport, March 1, 1994 (NTSB/SIR-94/02). Washington, DC: Author. Pratt & Whitney. (1992). Open cowl, March issue. Rasmussen, J. (1980). What can be learned from human error reports? In K. Duncan, M. Gruneberg, & D. Wallis (Eds.), Changes in working life. London: Wiley. Rasmussen, J. (1983). Skills, rules, knowledge: Signals, signs and symbols and other distinctions in human performance models. IEEE Transactions: Systems, Man & Cybernetics, 13, 257 267. Reason, J. (1979). Actions not as planned: The price of automatization. In G. Underwood & R. Stevens (Eds.), Aspects of consciousness: Vol. 1. Psychological issues. London: Wiley. Reason, J. (1990). Human error. New York: Cambridge University Press. Reason, J. (1993). Comprehensive error management in aircraft engineering: A manager's guide. Heathrow: British Airways Engineering. Reason, J. (1996, September). How necessary steps in a task get omitted: Reviving old ideas to combat a persistent problem. Paper presented at the British Psychology Society's Annual Meeting of the Cognitive Section, Keele, England. Sarter, N., & Woods, D. (1995). How in the world did we ever get into that mode? Mode error and awareness in supervisory control. Human Factors, 37, 5 19. Woods, D., Johannesen, L., Cook, R., & Sarter, N. (1994). Behind human error: Cognitive systems, computers and hindsight (CSERIAC stateof-the-art report). Dayton, OH: Wright-Patterson Air Force Base. UKCAA. (1992). Maintenance error. Asia Pacific Air Safety, September issue. page_325 Page 327

Chapter 12 Learning from Automation Surprises and "Going Sour" Accidents David D. Woods Nadine B. Sarter Institute for Ergonomics The Ohio State University Advances in technology and new levels of automation on commercial jet transports have had many effects. There have been positive effects from both an economic and a safety point of view. The technology changes on the flight deck also have had reverberating effects on many other aspects of the aviation system and different aspects of human performance. Operational experience, research investigations, incidents, and occasionally accidents have shown that new and sometimes surprising problems have arisen as well (Fig. 12.1). What are these problems with cockpit automation, and what should we learn from them? Do they represent overautomation or human error? Or instead perhaps there is a third possibilitythey represent coordination breakdowns between operators and the automation. Are the problems just a series of small independent glitches revealed by specific accidents or near misses? Do these glitches represent a few small areas where there are cracks to be patched in what is otherwise a record of outstanding designs and systems? Or do these problems provide us with evidence about deeper factors that we need to address if we are to maintain and improve aviation safety in a changing world? page_327

Page 328

Fig. 12.1. Reverberations of technology change on the flight deck for human performance. page_328 Page 329 How do the reverberations of technology change on the flight deck provide insight into generic issues about developing humancentered technologies and systems (Winograd & Woods, 1997)? Based on a series of investigations of pilot interaction with cockpit automation (Sarter & Woods, 1992, 1994, 1995, 1997, in press), supplemented by surveys, operational experience, and incident data from other studies (e.g., Degani, Shafto, & Kirlik, 1995; Eldredge, Dodd, & Mangold, 1991; Tenney, Rogers, & Pew, 1995; Wiener, 1989), we have found that the problems that surround crew interaction with automation are more than a series of individual glitches. These difficulties are symptoms that indicate deeper patterns and phenomena concerning humanmachine cooperation and paths toward disaster. In addition, we find the same kinds of patterns behind results from studies of physician interaction with computer-based systems in critical-care medicine (e.g., Cook & Woods, 1996; Moll van Charante, Cook, Woods, Yue, & Howie, 1993; Obradovich & Woods, 1996). Many of the results and implications of this kind of research are synthesized and discussed in two comprehensive volumes, Billings (1996) and Woods, Johannesen, Cook, and Sarter (1994). This chapter summarizes the pattern that has emerged from our research, related research, incident reports, and accident investigations. It uses this new understanding of why problems arise to point to new investment strategies that can help us deal with the perceived ''human error" problem, make automation more of a team player, and maintain and improve safety. The ability to step back and assess the implications of the research results was facilitated tremendously by our participation in a FAA team that examined the interface between flight crews and modern flight deck systems (Abbott et al., 1996). In this project, we were able to discuss the implications of observed difficulties with crew-automation coordination for investments to improve safety with a broad range of stakeholders in the aviation domain, including carrier organizations, line pilots, training managers, manufacturers, and industry groups. This effort helped us step back and assess the implications of the research for future investments to maintain and enhance aviation safety and safety in other related areas where new investments in automation are changing the roles of operational personnel. Impact of Technology Change on Cognition and Collaboration One way to recognize the pattern that underlies automation and human error is to listen to the voices we heard in our investigations. In these studies we interacted with many different operational people and organizations: page_329

Page 330 Directly in conversations about the impact of automation. Through their judgments as expressed in surveys about cockpit automation. Through their reported behavior in incidents that occurred on the line. Through their performance in simulator studies that examined the coordination between crew and automated systems in specific flight contexts. We summarize the results of the multiple converging studies by adopting the point of view of different stakeholders and by expressing the research results and issues in their words. The statements are paraphrases of actual statements made to us in different contexts. Automation Surprises: Coordination Breakdowns between Crews and Automation Pilots and instructors described and revealed the clumsiness and complexity of many modern cockpit systems. They described aspects of cockpit automation that were strong but sometimes silent and difficult to direct when time is short. We saw and heard how pilots face new challenges imposed by the tools that are supposed to serve them and provide "added functionality." The users' perspective on the current generation of automated systems is best expressed by the questions they pose in describing incidents (extended from Wiener, 1989): What is it doing now? What will it do next? How did I get into this mode? Why did it do this? Stop interrupting me while I am busy. I know there is some way to get it to do what I want. How do I stop this machine from doing this? Unless you stare at it, changes can creep in. These questions and statements illustrate why one observer of human-computer interaction defined the term agent as "A computer program whose user interface is so obscure that the user must think of it as a quirky, but powerful, person . . ." (Lanir, 1995, p. 68). Questions and statements like these point to automation surprises (Sarter, Woods, & Billings, 1997), that is, situations where crews are surprised by page_330 Page 331 actions taken (or not taken) by the autoflight system. Automation surprises begin with miscommunication and misassessments between the automation and users that lead to a gap between the user's understanding of what the automated systems are set up to do, what they are doing, and what they are going to do. The initial trigger for such a mismatch can arise from several sources, for example, erroneous inputs such as mode errors or indirect mode changes where the system autonomously changes its status and behavior based on its interpretation of pilot inputs, its internal logic, and sensed environmental conditions (Sarter & Woods, 1995, 1997a). The gap results in the crew being surprised later when the aircraft's behavior does not match the crew's expectations. This is where questions like, "Why won't it do what I want?" "How did I get into this mode?" arise. It seems that the crew generally does not notice their misassessment from displays of data about the state or activities of the automated systems. The misassessment is detected, and thus the point of surprise is reached, in most cases based on observations of unexpected and sometimes undesirable aircraft behavior. Once the crew has detected the gap between expected and actual aircraft behavior, they can begin to respond to or recover from the situation. The problem is that this detection generally occurs when the aircraft behaves in an unexpected mannerflying past the top of descent point without initiating the descent, or flying through a target altitude without leveling off. If the detection of a problem is based on actual aircraft behavior, it may not leave a sufficient recovery interval before an undesired result occurs. Unfortunately, there have been accidents where the misunderstanding persisted too long to avoid disaster (cf. Billings, 1996). The evidence shows strongly that the potential for automation surprises is greatest when three factors converge: 1. Automated systems act on their own without immediately preceding directions from their human partner. 2. There are gaps in users' mental models of how their machine partners work in different situations. 3. The feedback is weak about the activities and future behavior of the agent relative to the state of the world. Automation surprises are one kind of breakdown in the coordination between crews and automated systems. Our investigations revealed a "funnel" of evidence about these kinds of coordination breakdowns. If we observe crews interacting with cockpit automation in fullmission simulations, we find direct evidence of a variety of performance problems linked to the design of automation and to the training users receive. The probpage_331

Page 332 lems observed are sometimes the result of "classic" human-computer interface design characteristics that lead to certain predictable forms of human error. If we look at operational experience we find that these coordination breakdowns and errors occur occasionally, but, in most cases, with no significant consequences. Unfortunately, we also have a small number of near misses or accidents where these same coordination breakdowns between crew and automation are a significant contributor to the sequence of events. In other words, there is a chain where: Characteristics of the interface between automated systems and flight crews affect human performance in predictable and sometimes negative ways. There are precursor events where these performance problems occur but in innocuous circumstances or where the sequence of events is later redirected away from bad outcomes. Occasionally, these problems occur in the context of more vulnerable circumstances, with other contributors present, and events spiral toward disaster. The "Going Sour" Accident These breakdowns in coordination between crew and automation create the potential for a particular kind of accident sequencethe going sour accident (originally based on results from studying operating room incidents; Cook, Woods, & McDonald, 1991). In this general class of accidents, an event occurs or a set of circumstances come together that appear to be minor and unproblematic, at least when viewed in isolation or from hindsight. This event triggers an evolving situation that is, in principle, possible to recover from. But through a series of commissions and omissions, misassessments and miscommunications, the human-automation team manages the situation into a serious and risky incident or even accident. In effect, the situation is managed into hazard. Several recent accidents involving automation surprises show this signature. Although they are classically referred to in aviation as controlled flight into terrain, some of these cases may better be described as managed flight into terrain because the automated systems are handling the aircraft and the flight crew is supervising the automation (for a brief overview of one vivid example of managed flight into terrain, see Sarter et al., 1997). The going sour scenario seems to be a side effect of complexity. Research and incident data raise the concern that new technology, when developed in a technology-driven rather than human-centered way, is increasing the operational complexity and increasing the potential for the going sour signature (Billings, 1996). page_332 Page 333 After-the-fact, going sour incidents look mysterious and dreadful to outsiders who have complete knowledge of the actual state of affairs (Woods et al., 1994). Because the system is managed into hazard, in hindsight, it is easy to see opportunities to break the progression toward disaster. The benefits of hindsight allow reviewers to comment (Woods et al., 1994): "How could they have missed X, it was the critical piece of information?" "How could they have misunderstood Y, it is so logical to us?" "Why didn't they understand that X would lead to Y, given the inputs, past instructions, and internal logic of the system?" In fact, one test for whether an incident is a going sour scenario is to ask whether reviewers, with the advantage of hindsight, make comments such as, "All of the necessary data were available, why was no one able to put them all together to see what they meant?" The lesson learned from recent accidents involving breakdowns in the coordination between the automation and the flight crew is: The going sour scenario is an important general kind of accident category. There is a concern that this category represents a significant portion of the residual risks in aviation. Only future data and events will reveal whether this is a growing part of the risk. Investments in turning cockpit automation into a team player and in training crews to better manage automated resources in a wide range of circumstances produce payoffs by guarding against this type of accident scenario. Luckily, going sour accidents are relatively rare even in very complex systems. The going sour progression is usually blocked because of two factors: The expertise embodied in operational systems and personnel allows practitioners to avoid or stop the incident progression. The problems that can erode human expertise and trigger this kind of scenario are significant only when a collection of factors or exceptional circumstances come together. Human Expertise and Technology-Induced Complexity In our investigations we heard a great deal about how operators' expertise usually compensates for the features of automation that contribute to coordination breakdowns. We heard about how training departments, line page_333

Page 334 organizations, and individuals develop ways (through policies, procedures, team strategies, individual tactics, and tricks) to get the job done successfully despite the clumsiness of some automated systems for some situations. Some of these are simply cautionary notes to pilots reminding them to "be careful, it can burn you." Some are workarounds embodied in recipes. Some are strategies for teamwork. Many are ways to restrict the use of portions of the suite of automation in general or in particularly difficult situations. In other words, deficiencies in the design of the automation from a human factors point of view produce so few bad consequences because of human expertise and adaptation (Woods et al., 1994). Overall, operational people and organizations tailor their behavior to manage the technology as a resource to get their job done, but there are limits on their ability to do this. Crew training is one of the primary tools for developing strategies and skills for managing automated systems as a set of resources (e.g., transition training as pilots move to a new glass-cockpit aircraft and recurrent training). But there are many constraints that limit the amount and range of training experiences pilots can receive. When we talked to training managers, we heard: "They're building a system that takes more time than we have for training people." "There is more to knowhow it works, but especially how to work the system in different situations." "The most important thing to learn is when to click it off." "We need more chances to explore how it works and how to use it." "Well, we don't use those features or capabilities." "We've handled that problem with a policy." "We are forced to rely on recipe training much more than anyone likes." "We teach them [a certain number of] basic modes in training, they learn the rest of the system on the line." Economic and competitive factors produce great pressure to reduce the training investment (e.g., shrink the training footprint or match a competitor's training footprint). When there are improvements in training, these same forces lead people to take the benefit in productivity (the same level of proficiency in less time) rather than in quality (better training in the same time). People seem to believe that greater investments in automation promise lower expenditures on developing human expertise. However, the data consistently show that the impact of new levels and types of automation is new knowledge requirements for people in the system as their role changes to more of a manager and anomaly handler page_334 Page 335 (e.g., Sarter et al., 1997). The goal of enhanced safety requires that we expand, not shrink, our investment in human expertise. Complexity The second reason why we see only a few accidents with the going sour signature is that breakdowns in coordination between human and automation are significant only when a collection of factors or exceptional circumstances come together. For example: Human performance is eroded due to local factors (fatigue) or systemic factors (training and practice investments). Crew coordination is weak. The flight circumstances are unusual and not well matched with training experiences. Transfer of control between crew and automation is late or bumpy. Small, seemingly recoverable erroneous actions occur, interact, and add up. Because there are always multiple contributors to a going sour incident and because these incidents evolve over time and a series of stages, it is easy to identify a host of places where a small change in human, team, or machine behavior could have redirected the sequence away from any trouble. Focusing on any one of these points in isolation can lead to very local and manageable changesjust shift the display slightly, modify a checklist, issue a bulletin to remind crews of how X works in circumstance Y, reinforce a policy, add some remedial training. Although these changes may be constructive in small ways, they miss the larger lessons of this incident signature. When people and automation seem to mismanage a minor occurrence or nonroutine situation into larger trouble, it is a symptom of overall system complexity. It is a symptom that all of the contributors to successful flight deck performancedesign, training, operational policies and procedures, certificationneed to be better coordinated. The Escalation Principle An underlying contributor to problems in human-automation coordination is the escalation principle (Woods & Patterson, in press). There is a fundamental relationship where the greater the trouble in the underlying process or the higher the tempo of operations, the greater the information-processing activities required to cope with the trouble or pace of activities. For page_335

Page 336 example, demands for monitoring, attentional control, information, and communication among team members (including human-machine communication) all tend to go up with the unusualness (situations at or beyond margins of normality or beyond textbook situations), tempo, and criticality of situations. If workload or other burdens are associated with using a computer interface or with interacting with an autonomous or intelligent machine agent, these burdens tend to be concentrated at the very times when the practitioner can least afford new tasks, new memory demands, or diversions of his or her attention away from the job at hand to the interface per se. This is the essential trap of clumsy automation (Wiener, 1989). Designer Reactions to Coordination Breakdowns: Erratic Human Behavior Listen to how designers respond when they are confronted with evidence of a breakdown in the coordination between people and automation: The hardware/software system "performed as designed" (crashes of "trouble free" aircraft). "Erratic" human behavior (variations on this theme are "diabolic" human behavior; "brain burps," i.e., some quasi-random degradations in otherwise skillful human performance; irrational human behavior). The hardware/software system is "effective in general and logical to us, some other people just don't understand it" (e.g., those who are too old, too computer phobic, or too set in their old ways). Those people or organizations or countries "have trouble with modern technology." "We only provided what the customer asked for!" (or "we tried to talk them out of it, but we have to be customer centered"). "I wanted to go further but . . ."I was constrained bycompatibility with the previous design, supplier's standard designs, cost control, time pressure, regulations. Other parts of the industry "haven't kept up" with the advanced capabilities of our systems (e.g., air traffic control (ATC) does not accommodate the advanced capabilities and characteristics of the newer aircraft or ATC does not recognize what is difficult to do with highly automated aircraft under time pressure). Some of these comments reflect real and serious pressures and constraints in the design world (e.g., design for multicultural users, economic pressures, very complex arrival and departure procedures). page_336 Page 337 Escaping from Attributions of Human Error Versus Overautomation Overall, these kinds of comments from developers show how we remain locked into a mindset of thinking that technology and people are independent componentseither this electronic box failed or that human box failed. Too many reviewers and stakeholders, after the fact, attribute going sour incidents either to human error ("clear misuse of automation . . . contributed to crashes of trouble free aircraft," La Burthe, 1997) or to overautomation (" . . . statements made by . . . Human Factors specialists against automation 'per se'," La Burthe, 1997). This opposition is a profound misunderstanding of the factors that influence human performance. One commentator on human-computer interaction made this point by defining the term interface as "an arbitrary line of demarcation set up in order to apportion the blame for malfunctions" (Kelly-Bootle, 1995, p. 101). The primary lesson from careful analysis of incidents and disasters in a large number of industries is that going sour accidents represent a breakdown in coordination between people and technology (e.g., Norman, 1990). People cannot be thought about separately from the technological devices that are supposed to assist them. Technological artifacts can enhance human expertise or degrade it, "make us smart" or "make us dumb" (Norman, 1993). The bottom line of recent research is that technology cannot be considered in isolation from the people who use and adapt it (e.g., Hutchins, 1995b). Automation and people have to coordinate as a joint system, a single team (Billings, 1996; Hutchins, 1995a; Sarter, 1996). Breakdowns in this team's coordination is an important path toward disaster. The real lessons of this type of scenario and the potential for constructive progress comes from developing better ways to coordinate the human and machine teamhuman-centered design (Winograd & Woods, 1997). Accident analyses suggest that breakdowns in human performance are a contributor to about 70% or 75% of aviation mishaps. Similar tabulations in other industries come up with about the same percentage. This should be interpreted as a motivation for paying increased attention to human factors. But some view these statistics superficially as an indication of a human error problem, and, as a result, they want to eliminate the human element, provide remedial training, or dictate all pilot action through expanded procedures. However, research on the human contribution to safety and risk has found that human error is a symptom of deeper issues (Woods et al., 1994). To learn about these issues and constructively improve the system in which people function, these researchers have found that we need to go behind page_337

Page 338 the label human error to identify and analyze the factors that influence human performance. In other words, there are organizational, training, and design factors that influence human performance in predictable ways. One simple and classic example of a kind of design-induced error is the case of mode errors. Mode errors occur when an operator executes an intention in a way that would be appropriate if the device were in one configuration (one mode) when it is, in fact, in a different configuration. Note that mode errors are not simply just human error or a machine failure. Mode errors are a kind of humanmachine system breakdown in that it takes both a user who loses track of the current system configuration, and a system that interprets user input differently depending on the current mode of operation (Sarter & Woods, 1995; Woods et al., 1994). The potential for mode error increases as a consequence of a proliferation of modes and interactions across modes without changes to improve the feedback about system state and activities. The resulting coupling, complexity, and opacity of the automated system make it difficult to train operators adequately for monitoring and managing these systems especially given resource limits for training. The result is gaps and misconceptions in users' mental models of the automated system. In this example as in others, human, technological, and organizational factors interact, each affecting and being affected by the others. Human factors began and has always been concerned with the identification of design-induced error (ways in which things make us dumb) as one of its fundamental contributions to improved system design (e.g., Fitts, 1946, 1951; Fitts & Jones, 1947, in the aviation domain). However, it is a profound misunderstanding of the research results to think that this implies a shift from "the incident was caused by pilot error or operator error"to "the incident was caused by manager or designer error." We make no progress if we trade pilot error for designer or manager error (Woods et al., 1994). There are always multiple contributors to failure, each necessary but only jointly sufficient. Design and organizational factors often are a part of the set of contributors. But again, the potential for progress comes from understanding the factors that lead designers or managers inadvertently to shape human performance toward predictable forms of error through the clumsy use of technology or through inappropriate organizational pressures. Strategies for Human-Centered Design If diagnoses such as human error (be it operator, designer, or manager) or overautomation are misleading and unproductive, then how do we make progress? page_338 Page 339 Human-Centered Design Is . . . A necessary first step is to adopt human-centered approaches to research and design (Billings, 1996). This perspective can be characterized in terms of three basic attributes: Human-centered design is problem driven, activity centered, and context bound (Winograd & Woods, 1997): 1. Human-centered research and design is problem driven. A problem-driven approach begins with an investment in understanding and modeling the basis for error and expertise in that field of practice. What are the difficulties and challenges that can arise? How do people use artifacts to meet these demands? What is the nature of collaborative and coordinated activity across people in routine and exceptional situations? 2. Human-centered research and design is activity centered. In building and studying technologies for human use, researchers and designers often see the problem in terms of two separate systems (the human and the computer) with aspects of interaction between them. This focuses attention on the people or the technology in isolation, de-emphasizing the activity that brings them together. In human-centered design we try to make new technology sensitive to the constraints and pressures operating in the actual field of activity (Ehn, 1988; Flach & Dominguez, 1995). New possibilities emerge when the focus of analysis shifts to the activities of people in a field of practice. These activities do or will involve interacting with computers in different ways, but the focus becomes the practitioner's goals and activities in the underlying task domain. The question then becomes (a) how do computer-based and other artifacts shape the cognitive and coordinative activities of people in the pursuit of their goals and task context and (b) how do practitioners adapt artifacts so that they function as tools in that field of activity (Woods, 1998). 3. Human-centered research and design is context bound. Human cognition, collaboration, and performance depend on context. A classic example is the representation effecta fundamental and much reproduced finding in cognitive science. How a problem is represented influences the cognitive work needed to solve that problem, either improving or degrading performance (e.g., Zhang & Norman, 1994). In other words, the same problem from a formal description, when represented differently, can lead to different cognitive work and therefore different levels of performance. Another example is the data overload problem. At the heart of this problem is not so much the amount of data to be sifted through. Rather, this problem is hard because what data are informative depends on the context in which they appear. Even worse, the context consists of more than just the state of other related pieces of data; the context also page_339 Page 340 includes the state of the problem-solving process and the goals and expectations of the people acting in that situation. Meeting these three criteria is central to a human-centered approach to design. Well-intentioned developers feel their work is human centered simply because they predict the new system will lead to improvements in cognition and performance and because eventually they address the usability of the system developed (Sarter et al., 1997; Winograd & Woods, 1997; Woods, 1998). Despite such good intentions, design usually remains fundamentally technology centered because developing the technology in itself is the primary activity around which all else is organized. The focus is pushing the technological frontier or creating the technological system, albeit a technology that seems to hold promise to influence human cognition, collaboration, and activity. Eventually, interfaces are built that connect the technology to users. These interfaces typically undergo some usability testing and usability engineering to make the technology accessible to potential users. Knowledge of humancomputer interaction and usability come into play, if at all, only at this later stage. However, there is a gap between designers' intentions to be user centered and their actual practice that does not meet the aforementioned three criteria and that results in operational complexities like those on the automated flight deck. In other words, ''the road to technology-centered systems is paved with user-centered intentions" (see Sarter et al., 1997). Progress Depends On . . .

At the broadest level, researchers have identified a few basic human-centered strategies that organizations can follow in an effort to increase the human contribution to safety: Increase the system's tolerance to errors. Avoid excess operational complexity. Evaluate changes in technology and training in terms of their potential to create specific kinds of human error. Increase skill at error detection by improving the observability of state, activities, and intentions. Invest in human expertise. To improve the human contribution to safety several steps are needed. Design, operational, research, and regulatory organizations must all work together to adopt methods for error analysis and use them as part of page_340 Page 341 design and certification. This creates a challenge to the human factors communityto work with industry to turn research results into practical methods (valid but resource economical) that test for effective error tolerance and detection. The goal is to improve the ability to detect and eliminate design and other factors that create predictable errors. Avoid Excess Operational Complexity Avoiding excess operational complexity is a difficult issue because no single person or organization decides to make systems complex. But in the pursuit of local improvements or in trying to accommodate multiple customers, systems gradually get more and more complex as additional features, modes, and options accumulate. The cost center for this increase in complexity is the user who must try to manage all of these features, modes, and options across a diversity of operational circumstances. Failures to manage this complexity are categorized as "human error." But the source of the problem is not inside the person. The source is the accumulated complexity from an operational point of view. Trying to eliminate "erratic" behavior through remedial training will not change the basic vulnerabilities created by the complexity. Neither will banishing people associated with failures. Instead human error is a symptom of systemic factors. The solutions are system fixes that will involve coordination of multiple parties in the industry. This coordinated system approach must start with meaningful information about the factors that predictably affect human performance. Mode simplification is illustrative of the need for change and the difficulties involved. Not all modes are used by all pilots or carriers due to variations in operations and preferences. Still they are all available and contribute to complexity. Not all modes are taught in transition training; only a set of "basic" modes is taught, and different carriers define different modes as "basic." Which modes represent excess complexity and which are essential for safe and efficient operation? Another indication of the disarray in this area is that modes that achieve the same purpose have different names on different flight decks. Making progress in simplifying requires coordination across an international, multiparty industry that is competitive in many ways but needs to be collaborative in others. One place where mode simplification is of very great importance is the interaction across modes (indirect mode changes or mode reversions). Indirect mode changes have been identified as a major factor in breakdowns in teamwork between pilots and automation. Simplifying these transitions and making transitions better fit pilot models is another very high priority area for improvement. page_341 Page 342 Error Detection through Improved Feedback Research has shown that a very important aspect of high reliability humanmachine systems is effective error detection. Error detection is improved by providing better feedback, especially feedback about the future behavior of the aircraft, its systems, or the automation. In general, increasing complexity can be balanced with improved feedback. Improving feedback is a critical investment area for improving human performance and guarding against going sour scenarios. But where and how to invest in better feedback? One area of need is improved feedback about the current and future behavior of the automated systems. As technological change increases machines' autonomy, authority, and complexity, there is a concomitant need to increase observability through new forms of feedback emphasizing an integrated dynamic picture of the current situation, agent activities, and how these may evolve in the future. Increasing autonomy and authority of machine agents without an increase in observability leads to automation surprises. As discussed earlier, data on automation surprises have shown that crews generally do not detect their miscommunications with the automation from displays about the automated system's state, but rather only when aircraft behavior becomes sufficiently abnormal. This result is symptomatic of low observability where observability is the technical term that refers to the cognitive work needed to extract meaning from available data. This term captures the relationship among data, observer, and context of observation that is fundamental to effective feedback. Observability is distinct from data availability, which refers to the mere presence of data in some form in some location. For human perception, "it is not sufficient to have something in front of your eyes to see it" (O'Regan, 1992, p. 475). Observability refers to processes involved in extracting useful information. it results from the interplay between a human user knowing when to look for what information at what point in time and a system that structures data to support attentional guidance (see Rasmussen, 1985; Sarter et al., 1997). The critical test of observability is when the display suite helps practitioners notice more than what they were specifically looking for or expecting (Sarter & Woods, 1997a).

One example of displays with very low observability on the current generation of flight decks is the flight mode annunciations on the primary flight display. These crude indications of automation activities contribute to reported problems with tracking mode transitions. As one pilot mentioned to us, "changes can always sneak in unless you stare at it." Simple injunctions for pilots to look closely at or call out changes in these indipage_342 Page 343 cations generally are not effective ways to redirect attention in a changing environment. Minor tuning of the current mode annunciations is not very likely to provide any significant improvement in feedback. Researchers and industry need to cooperate to develop, test, and adopt fundamentally new approaches to inform crews about automation activities. The new concepts need to be: Transition orientedthey need to provide better feedback about events and transitions. Future orientedthe current approach generally captures only the current configuration; the goal is to highlight operationally significant sequences and reveal what should happen next and when. Pattern basedpilots should be able to scan at a glance and quickly pick up possible unexpected or abnormal conditions rather than have to read and integrate each individual piece of data to make an overall assessment. For example, making vertical navigation modes more comprehensible and usable is likely to require some form of vertical profile display. The moving map display for horizontal navigation is a tremendous example of the desired targetan integrated display that provides a big picture of the current situation and especially the future developments in a way that supports quick check reading and trouble detection. However, developing displays to support vertical navigation based on the previous criteria is much more difficult because it is inherently a fourdimensional problem. The industry as a whole needs to develop and test new display concepts to support pilot management of vertical navigation automation. Going sour incidents and accidents provide evidence that improved feedback is needed. Despite the conflict with economic pressures, prudence demands that we begin to make progress on what is better feedback to support better error detection and recovery. To do this we need a collaborative process among manufacturers, carriers, regulators, and researchers to prototype, test in context, and adopt new innovations to aid awareness and monitoring. We need to move forward on this to ensure that, when the next window of opportunity opens up, we are ready to provide more observable and comprehensible automation. How to Provide Better Feedback: Bumpy Transfer of Control Let us look at one example of a coordination breakdown between crews and flight deck automation. Automation can compensate for trouble silently (Norman, 1990). Crews can remain unaware of the developing trouble page_343 Page 344 until the automation nears the limits of its authority or capability to compensate. The crew may take over too late or be unprepared to handle the disturbance once they take over, resulting in a bumpy transfer of control and significant control excursions. This general problem has been a part of several incident and accident scenarios. One example of this is asymmetric lift conditions caused by icing or engine trouble. In contrast, in a well-coordinated human team, the active partner would comment on the unusual difficulty or increasing effort needed to keep the relevant parameters on target. Or, in an open environment, the supervisor could notice the extra work or effort exerted by his or her partner and ask about the difficulty, investigate the problem, or intervene to achieve overall safety goals. How can we use the analogy to a well-coordinated human team working in an open, visible environment to guide how we can provide more effective feedback and better coordination between human and machine partners? For the set of feedback problems that arise when automation is working at the extreme ends of its envelope or authority, improved displays and warnings need to indicate: When the automation is having trouble handling the situation (e.g., turbulence). When the automation is taking extreme action or moving toward the extreme end of its range of authority. When agents are in competition for control of a flight surface. This specifies a performance target. The design question is: How do we make the system smart enough to communicate this intelligently? How do we define what are "extreme" regions of authority in a context-sensitive way? When is an agent having trouble in performing a function, but not yet failing to perform? How and when does one effectively communicate moving toward a limit rather than just invoking a thresholdcrossing alarm? From experience and research we know some constraints on the answers to these questions. Threshold-crossing indications (simple alarms) are not smart enoughthresholds are often set too late or too early. We need a more gradual escalation or staged shift in level or kind of feedback. An auditory warning that sounds whenever the automation is active (e.g., an auditory signal for trim-in-motion) may very well say too much. We want to indicate trouble in performing the function or extreme action to accomplish the function, not simply any action. We know from experiences in other domains and with similar systems that certain errors can occur in designing feedback. These include: page_344

Page 345 Nuisance communication such as voice alerts that talk too much in the wrong situations. Excessive false alarms. Distracting indications when more serious tasks are being handled (e.g., a constant trim warning or a warning that comes on at a high noise level during a difficult situation"silence that thing!"). In other words, misdesigned feedback can talk too much, too soon or it can be too silent, speaking up too little, too late as automation moves toward authority limits. Should the feedback occur visually or through the auditory channel or through multiple indications? Should this be a separate new indication or integrated into existing displays? Should the indication be of very high perceptual salience; in other words, how strongly should the signal capture pilot attention? Working out these design decisions requires developing prototypes and adjusting the indications in terms of: Perceptual salience relative to the large context of other possible events and signals. Along a temporal dimension (when to communicate relative to the priority of other issues or activities going on then). Along a strength dimension (how much or how little to say and at what level of abstraction relative to ongoing activities) and adjusting these attributes based on data on crew performance. Developing effective feedback about automation activities requires thinking about the new signals or indications in the context of other possible signals. One cannot improve feedback or increase observability by adding a new indication or alarm to address each case one at a time as they arise. A piecemeal approach will generate more displays, more symbolic codings on displays, more sounds, more alarms. More data will be available, but this will not be effective feedback because it challenges the crew's ability to focus on and digest what is relevant in a particular situation. Instead, we need to look at coherent sets and subsets of problems that all point to the need for improved feedback to devise an integrated solution. Our analysis of this one example has identified the relevant human-machine performance targets, identified relevant scenarios for design and testing, set some bounds on effective solutions, identified some trade-offs that must be balanced in design, and mentioned some of the factors that will need to be explored in detail through prototypes and user testing. The example illustrates the complexity of designing for observability. page_345 Page 346 Mechanisms to Manage Automated Resources Giving users visibility into the machine agent's reasoning processes is only one side of the coin in making machine agents into team players. Without also giving the users the ability to direct the machine agent as a resource in their reasoning processes, the users are not in a significantly improved position. They might be able to say what's wrong with the machine's solution, but remain powerless to influence it in any way other than through manual takeover. The computational power of machine agents provides a great potential advantage, that is, to free users from much of the mundane legwork involved in working through large problems, thus allowing them to focus on more critical high-level decisions. However, in order to make use of this potential, the users need to be given the authority and capabilities to make those decisions. This means giving them control over the problem solution process. A commonly proposed remedy for this is to allow users to interrupt the automated agent and take over the problem in its entirety in situations where users determine that the machine agent is not solving a problem adequately. Thus, the human is cast into the role of critiquing the machine, and the joint system operates in essentially two modesfully automatic or fully manual. The system is a joint system only in the sense that either a human agent or a machine agent can be asked to deal with the problem, not in the more productive sense of the human and machine agents cooperating in the process of solving the problem. This method, which is like having the automated agent say "either you do it or I'll do it," has many obvious drawbacks. Either the machine does the entire job without benefiting from the practitioner's information and knowledge, and despite the brittleness of the machine agents; or the user takes over in the middle of a deteriorating or challenging situation without the support of cognitive tools. Previous work in several domains (space operations, electronic troubleshooting, aviation) and with different types of machine agents (expert systems, cockpit automation, flight path planning algorithms) has shown that this is a poor cooperative architecture. Instead, users need to be able to continue to work with the automated agents in a cooperative manner by taking control of the automated agents. Using the machine agent as a resource may mean various things. In terms of observability, one of the main challenges is to determine what levels and modes of interaction will be meaningful to users. In some cases, the users may want to take very detailed control of some portion of a problem, specifying exactly what decisions are made and in what sequence, whereas in others the users may want only to make very general, high-level correcpage_346

Page 347 tions to the course of the solution in progress. Accommodating all of these possibilities is difficult and requires very careful iterative analysis of the interactions between user goals, situational factors, and the nature of the machine agent. However, this process is crucial if the joint system is to perform effectively in the broadest possible range of scenarios. Enhancing Human Expertise The last area for investment in the interest of improving the human contribution to safety is human expertise. It is ironic that the aviation industry seems to be reducing this investment at the very time when it points to human performance as a dominant contributor to accidents. This reflects one of the myths about the impact of automation on human performance; that is, as investment in automation increases, less investment is needed in human expertise. In fact, many sources have shown how increased automation creates new and different knowledge and skill requirements. In our investigations, we heard operational personnel say that the complexity of the automated flight deck means that pilots need new knowledge about how the different automated subsystems and modes function. We heard about investigations that show how the complexity of the automated flight deck makes it easy for pilots to develop oversimplified or erroneous mental models of the tangled web of automation modes and transition logics. We heard from training departments struggling to teach crews how to manage the automated systems as a resource in differing flight situations. Many sources offered incidents where pilots were having trouble getting a particular mode or level of automation to work successfully, where they persisted too long trying to get this mode of automation to carry out their intentions instead of switching to another means or a more direct means to accomplish their flight path management goals. For example, someone may ask, "Why didn't you turn it off?" Response: "It didn't do what it was supposed to, so I tried to get it to do what I had programmed it to do." We heard how the new knowledge and skill demands are most relevant in relatively rare situations where different kinds of factors push events beyond the routinejust those circumstances that are most vulnerable to going sour through a progression of misassessments and miscommunications. This increases the need to practice those kinds of situations. For training managers and departments, the result is a great deal of training demands that must be fit into a small and shrinking training footprint. The combination of new roles, knowledge, and skills as a result of new levels of automation with economic pressures creates a training double bind. page_347 Page 348 We heard about many tactics that have been developed to cope with this mismatch. For example, one tactic is to focus transition training on just a basic set of modes and leaving the remainder to be learned on the line. This can create the ironic situation that training focuses on those parts of managing automated systems that are the easiest to learn, while deferring the most complicated parts for individuals to learn later on their own. This tactic works: If the basics provide a coherent base that aids learning the more difficult parts or for coordinating the automation in more difficult circumstances. If there is an environment that encourages, supports, and checks continued learning beyond minimum requirements. Another tactic used to cope with this training double bind is to teach recipes. It is a time-efficient tactic and helps prevent students from being overwhelmed by the complexity of the automated systems. Still, instructors and training managers acknowledge the limits of this approach and try to go beyond recipes as much as their time and resources limits allowed. All spoke of the need for pilots to practice what they have learned in realistic operational settings through line-oriented simulation and line-oriented flight-training scenarios, although the scope of this training is limited by the economic and competitive forces squeezing training time. We saw evidence of an industry struggling to get better utilization of limited transition training time and limited recurrent checks. As the training footprint shrinks, one response is to identify and focus in on the highest priority training needs. The U.S. industry has increased freedom to do so under new programs with the FAA (the advanced qualification program or AQP). However, laudable as this is, it can inadvertently reduce resources for training and practice even further. Economic pressure means that the benefits of improvements will be taken in productivity (reaching the same goal faster) rather than in quality (more effective training). Trying to squeeze more yield from a shrinking investment in human expertise will not help prevent the kinds of incidents and accidents that we label human error after the fact. Escaping from this double bind is essential. A first step is to recognize the limits of minimum requirements. Instead, we should produce a culture oriented toward continuous learning. Initial or transition training should produce an initial proficiency for managing the automated flight deck. This training should serve as the platform for mechanisms that support continued growth of expertise. An emphasis on continuous improvement beyond initial proficiency is needed, because with highly automated systems we see an increase in knowledge requirements and the range of sitpage_348

Page 349 uations that pilots must be able to master. Developing accurate and useful mental models that can be applied effectively across a wide range of possible conditions depends on part-task or full-mission practice in line-oriented situations. The question then becomes how can we expand the opportunities to practice the management of automated resources across a wide variety of situations throughout a pilot's career? In many ways, the aviation industry is well prepared to adopt this approach. Pilots, in general, want to improve their knowledge and skills as evidenced by pilot-created guides to the automation that we noticed in several training centers. The industry already has invested heavily in line-oriented training. New training technology in the form of less expensive but high-fidelity, parttask training devices is being utilized more. Progress through Coordination These comments also illustrate a general theme that emerges from research on human factors problems in industries with demands for very high levels of performance. Representatives of each segment of industry are under constraints and pressures (fit it all into this training footprint, minimize the changes from the previous flight deck, etc.). Each group knows that they are doing the best job possible given the constraints placed on them. So when evidence of glitches arises, it is natural that they look for solutions in other areas that contribute to flight deck performance, for example: Trainers may advocate redesigning the system so that we can train people to use it within this limited resource window. Designers may advocate efforts to get ATC to accommodate our automation's idiosyncrasies and capabilities. Designers may encourage others to provide better training to enable people to cope with the large set of interconnected features designed as a result of multiple market demands. Trainers may lobby for modified regulations so they are not forced to spend precious training time on items of lower priority for glass cockpit aircraft. None of these solutions is wrong in detailall of these areas can be improved in isolation. But there is a deeper reading to these messages. This kind of circular reaction to evidence of glitches is symptomatic of a deeper need for coordination across areas that traditionally have functioned mostly autonomouslytraining, design, operational procedures, certification. Each one of them, when considered alone, has improved a page_349 Page 350 great deal, and this has created the generally extremely high safety levels in the aviation industry. However, the risk of failure exemplified by the going sour scenario involves the interaction or coupling between these individual areas. In fact, increasing the level of automation increases the coupling between these areas. For example, many recognize how automation designers, in part, specify an operational philosophy. We have heard many people comment on the inadequacy of a ''throw-it-over-the-wall" linkage between design and training or between manufacturer and operator (and develop means to try to reduce this). There needs to be a closer integration of these multiple perspectives, in part, because of the advanced technology on new aircraft. This example of coupling can be extended to show how many other areas have become more interrelated with increased flight deck automationATC and advanced aircraft, safety and economics. Though improvements are still possible and desirable in each area as an isolated entity, progress in general demands the integration of multiple perspectives. In part, this is due to the fact that all parts of the system are under intense economic pressure. This means that training no longer has the room to make up for design deficiencies. Design for learnability becomes another constraint on designers. ATC demands interact with the capabilities and the limits of managing advanced aircraft, yet ATC is a system undergoing change in the face of economic and performance pressures as well. A complex departure procedure may seem to increase throughput, at least on paper, but it may exact a price in terms of managing a clumsy team memberthe automationand erode safety margins to some degree. Coordination is needed precisely because change in any one part of the aviation system has significant effects for other parts of the system. Conclusion Overall, there are broad patterns behind the details of particular incidents and accidents. We need to better guard against the kind of incident where people and the automation seem to mismanage a minor occurrence or nonroutine situation into larger troublethe going sour scenario. This scenario is a symptom of breakdowns in coordination between people and machines that in turn are a symptom of overall system complexity, at both operational and organizational levels (Woods, 1996). Second, we can tame needed complexity: Through better feedback to operational personnel. Through more practice at managing automated resources in a wide range of circumstances. page_350

Page 351 By making the automation function as a team player. By creating "intuitive" automation designs that can be learned quickly, through better mechanisms to detect or predict where automation design will produce predictable kinds of human performance problems. In general, we can act by first trying to limit the growth in complexity through checking for excess complexity, valuing simplicity of operation, increasing coordination between coupled areas. Meeting the challenges of going sour scenarios in a coordinated manner is extremely difficult because any change will exact costs on the parties involved. Because the benefits are at a system level, it is easy for each party to claim that they should not pay the costs, but that some other part of the industry should. Because the aggregate safety level is very high (actuarial risk is low), it is easy to ignore the threat of the going sour scenario and argue that the status quo is sufficient. This is particularly easy because going sour incidents by definition involve several local contributing factors. Each case looks like a unique combination of events with the dominant common factor being human error. The certification and legal climate have produced a climate where change creates exposure to financial and competitive risk. This leads to minimum standards based on past practices ("you approved this before"; "it was safe enough before") and progress crawls to a halt. Yet progress, despite its pains, is exactly what is demanded if observed difficulties such as the going sour scenario are to be addressed. The question for regulators, manufacturers, and operators then is how to build the collaborative environment that can enable constructive forward movement. The goal of our research has been to point out specific areas for constructive continuing progress and more general directions that may help create a collaborative environment where progress is possible. Acknowledgments The research on which this assessment is based was sponsored by NASA Ames Research Center (under Cooperative Agreement NCC 2-592; Technical Monitors Dr. Everett Palmer and Dr. Kevin Corker) and NASA Langley Research Center (Grant NCC 1-209; Technical Monitor Dr. Kathy Abbott). We wish to thank the many pilots, instructors, and designers who contributed to our specific investigations and who shared their views and experiences with us in many different ways. We are indebted to our fellow members on the FAA team that examined the interface between flight crews and modern flight deck systemsthe discussions and debates they page_351 Page 352 sparked were critical to our reflections on the implications of the research results. References Abbott, K., Slotte, S., Stimson, D., Bollin, E., Hecht, S., Imrich, T., Lalley, R., Lyddane, G., Thiel, G., Amalberti, R., Fabre, F., Newman, T., Pearson, R., Tigchelaar, H., Sarter, N., Helmreich, R., & Woods, D. (1996). The interface between flightcrews and modern flight deck systems. Washington, DC: Federal Aviation Administration. Billings, C. E. (1996). Aviation automation: The search for a human-centered approach. Mahwah, NJ: Lawrence Erlbaum Associates. Cook, R. I., & Woods, D. D. (1996). Implications of automation surprises in aviation for the future of total intravenous anesthesia (TIVA). Journal of Clinical Anesthesia, 8, 29s 37s. Cook, R. I., Woods, D. D., & McDonald, J. S. (1991). Human performance in anesthesia: A corpus of cases (Cognitive Systems Engineering Laboratory Report, prepared for Anesthesia Patient Safety Foundation). Columbus, OH: The Ohio State University. Degani, A., Shafto, M., & Kirlik, A. (1995). Mode usage in automated cockpits: Some initial observations. In T. B. Sheridan (Ed.), Proceedings of the International Federation of Automatic Control; Man-Machine Systems (IFAC-MMS) conference. Boston: IFAC. Ehn, P. (1988). Work-oriented design of computer artifacts. Stockholm, Sweden: Arbetslivscentrum. Eldredge, D., Dodd, R. S., & Mangold, S. J. (1991). A review and discussion of flight management system incidents reported to the Aviation Safety Reporting System. (Battelle Report, prepared for the Department of Transportation). Columbus, OH: Volpe National Transportation Systems Center. Fitts, P. M. (1946). Psychological requirements in aviation equipment design. Journal of Aviation Medicine, 17(3), 270 285. Fitts, P. M. (1951). Engineering psychology and equipment design. In S. S. Stevens (Ed.), Handbook of experimental psychology (pp. 1287 1340). New York: Wiley. Fitts, P. M., & Jones, R. E. (1947). Analysis of factors contributing to 460 "pilot-error" experiences in operating aircraft controls (Memorandum Report No. TSEAA-694-12). Dayton, OH: Aero Medical Laboratory, Air Materiel Command. Flach, J. M., & Dominguez, C. O. (1995, July). Use-centered design: Integrating the user, instrument, and goal. Ergonomics in Design, pp. 19 24. Hutchins, E. (1995a). Cognition in the wild. Cambridge, MA: MIT Press. Hutchins, E. (1995b). How a cockpit remembers its speeds. Cognitive Science, 19, 265 288. Hutchins, E. (1996). The integrated mode management interface (Tech. Rep.). San Diego: University of California, Department of Cognitive Science. Kelly-Bootle, S. (1995). The computer contradictionary (2nd ed.). Cambridge, MA: MIT Press.

La Burthe, C. (1997, January). Human factors perspective at Airbus Industrie. Presentation at the International Conference on Aviation Safety and Security in the 21st Century, Washington, DC. Lanir, J. (1995, July). Agents of alienation. Interactions, pp. 66 72. Moll van Charante, E., Cook, R. I., Woods, D. D., Yue, L., & Howie, M. B. (1993). Human-computer interaction in context: Physician interaction with automated intravenous controllers in the heart room. In H. G. Stassen (Ed.), Analysis, design and evaluation of man-machine systems 1992 (pp. 263 274). New York: Pergamon. Norman, D. A. (1990). The "problem" of automation: Inappropriate feedback and interaction, not "over-automation." Philosophical Transactions of the Royal Society of London, B 327, 585 593. page_352 Page 353 Norman, D. A. (1993). Things that make us smart. Reading, MA: Addison-Wesley. Obradovich, J. H., & Woods, D. D. (1996). Users as designers: How people cope with poor HCI design in computer-based medical devices. Human Factors, 38(4), 574 592. O'Regan, J. K. (1992). Solving the "real" mysteries of visual perception: The world as an outside memory. Canadian Journal of Psychology, 46, 461 488. Rasmussen, J. (1985). Trends in human reliability analysis. Ergonomics, 28(8), 1185 1196. Sarter, N. B. (1996). From quantity to quality, from individual pilot to multiple agents: Trends in research on cockpit automation. In R. Parasuraman & M. Mouloua (Eds.), Automation and human performance (pp. 267 280). Mahwah, NJ: Lawrence Erlbaum Associates. Sarter, N. B., & Woods, D. D. (1992). Pilot interaction with cockpit automation I: Operational experiences with the flight management system. International Journal of Aviation Psychology, 2, 303 321. Sarter, N. B., & Woods, D. D. (1994). Pilot interaction with cockpit automation II: An experimental study of pilot's model and awareness of the flight management system. International Journal of Aviation Psychology, 4, 1 28. Sarter, N. B., & Woods, D. D. (1995). "How in the world did we get into that mode?" Mode error and awareness in supervisory control. Human Factors, 37, 5 19. Sarter, N. B., & Woods, D. D. (1997). Teamplay with a powerful and independent agent: A corpus of operational experiences and automation surprises on the Airbus A-320. Human Factors, 39(4), 553 569. Sarter, N. B., & Woods, D. D. (in press). Team play with a powerful and independent agent: A full mission simulation. Human Factors. Sarter, N. B., Woods, D. D., & Billings, C. (1997). Automation surprises. In G. Salvendy (Ed.), Handbook of human factors/ergonomics (2nd ed., pp. 1926 1943). New York: Wiley. Tenney, Y.J., Rogers, W. H., & Pew, R. W. (1995). Pilot opinions on high level flight deck automation issues: Toward the development of a design philosophy (NASA Contractor Report No. 4669). Hampton, VA: NASA Langley Research Center. Wiener, E. L. (1989). Human factors of advanced technology ("glass cockpit") transport aircraft (NASA Contractor Report No. 177528). Moffett Field, CA: NASA-Ames Research Center. Winograd, T., & Woods, D. D. (1997). Challenges for human-centered design. In J. Flanagan, T. Huang, P. Jones, & S. Kasif (Eds.), Human-centered systems: Information, interactivity, and intelligence (pp. 61 89). Washington, DC: National Science Foundation. Woods, D. D. (1996). Decomposing automation: Apparent simplicity, real complexity. In R. Parasuraman & M. Mouloua (Eds.), Automation technology and human performance (pp. 3 18). Mahwah, NJ: Lawrence Erlbaum Associates. Woods, D. D. (in press). Designs are hypotheses about how artifacts shape cognition and collaboration. Ergonomics. Woods, D. D., Johannesen, L., Cook, R. I., & Sarter, N. B. (1994). Behind human error: Cognitive systems, computers and hindsight. Dayton, OH: WPAFB, Crew Systems Ergonomic Information and Analysis Center. Woods, D. D., & Patterson, E. S. (in press). How unexpected events produce an escalation of cognitive and coordinative demands. In P.A. Hancock & P. Desmond (Eds.), Stress, workload, and fatigue. Mahwah, NJ: Lawrence Erlbaum Associates. Zhang, J., & Norman, D. A. (1994). Representations in distributed cognitive tasks. Cognitive Science, 18, 87 122. page_353

Page 355

AUTHOR INDEX A Abbott, K., 2, 8, 213, 249, 305, 307, 329, 352 Abbott, T. S., 134, 137, 151 Adams, M. J., 165, 177 Aldrich, T. B., 31, 40 Allport, F. H., 66, 96 Amalberti, R., 6, 8, 45, 46, 61, 73, 79, 96, 171, 177, 256, 266, 271, 272, 273, 274, 281, 284, 285, 286, 288, 304, 306, 307 Anderson, J. R., 273, 284 Angell, D., 155, 177 Ashby, W. R., 78, 95, 96 Atencio, A., 22, 40 Aucella, A. F., 138, 152 Aw, A., 304, 307 B Baddeley, A. D., 24, 41 Bainbridge, L., 3, 8, 94, 96, 304, 307 Banda, C., 22, 40 Bandura, A., 272, 284 Banks, W. W., 133, 134, 135, 138, 142, 151 Baron, S., 20, 41 Bartlett, F. C., 24, 41 Bellorini, A., 45, 61 Benel, R., 268, 285 Benner, L., 268, 284 Bennett, K. B., 169, 177 Bent, J., 276, 284 Berlin, J. I., 268, 284 Berliner, D. C., 155, 177 Bettman, J. R., 27, 41 Bevan, W., 142, 152 Bierbaum, C. R., 31, 40 Billings, C. E., 5, 8, 18, 19, 41, 211, 229, 241, 249, 304, 307, 329, 330, 331, 332, 335, 337, 339, 340, 342, 352, 353 Bisantz, A. M., 161, 177 Blackman, H. S., 134, 138, 151 Blake, R. R., 7, 8 Bohnen, H. G. B., 193, 209

Bollin, E., 8 Boreham, N., 67, 97 Brehmer, B., 46, 61 Brirmingham, H. P., 19, 41 Broadbent, D. E., 66, 75, 96 Broderson, D., 146, 152 Brown, J. S., 247, 249 Buckley, W., 66, 96 Burns, H., 212, 242, 249 Burton, R. R., 247, 249 Bushman, J. B., 240, 246, 250 Butler, R. E., 268, 285 Byrne, E. A., 202, 208 C Cacciabue, P. C., 65, 72, 86, 94, 96, 97 Calderwood, R., 6, 9, 269, 285 Callantine, T. J., 229, 235, 250 Campbell, J. H., 214, 250 Capps, C. G., 212, 242, 249 Card, S. K., 47, 61 Caro, P. W., 83, 96 Cashion, P., 36, 37, 41 Chappell, A. R., 54, 62, 214, 250 Chidester T., 304, 307 Chou, C. D., 241, 250 page_355 Page 356 Chu, R. W., 241, 242, 244, 246, 250 Clark, L. V., 148, 152 Cojazzi, G., 94, 96 Collins, A., 242, 250 Comber, T., 48, 61 Conant, R. C., 95, 96 Connolly, T., 269, 285 Cook, R. I., 4, 9, 170, 179, 257, 286, 288, 306, 307, 309, 325, 329, 332, 333, 334, 335, 337, 338, 352, 353 Cooper, G. E., 7, 8 Corker, K. M., 20, 21, 32, 33, 38, 41, 48, 62, 93, 96 Corlett, E. N., 155, 177 Coularis, G., 14, 41

Craik, K., 13, 18, 19, 41, 65, 74, 96 Crooks, L., 6, 9, 273, 285 Crowther, E. G., 214, 250 Curry, R., 304, 307 D Danchak, M. M., 138, 142, 152 Davis, F., 320, 324 De Keyser, V., 46, 62, 101, 121, 130 De Montmollin, M., 101, 130 Deblon, F., 73, 79, 96, 171, 177 Decortis, F., 45, 61, 86, 96 Degani, A., 54, 62, 329, 352 Di Bello, L., 241, 250 Diehl, A. E., 268, 285 Dodd, R. S., 329, 352 Dominguez, C., 6, 8, 155, 177, 178, 339, 352 Donders, F. C., 67, 96 Dörner, D., 273, 285 Dornheim, M. A., 214, 250 Dorsky, S., 14, 41 Drøivoldsmo, A., 48, 62 Drury, C. G., 155, 177 Duncker, K., 65, 96 E Edwards, R. E., 140, 152 Egeth, H. E., 142, 152 Ehn, P., 339, 352 Eldredge, D., 329, 352 Endsley, M., 273, 285 Engel, S. E., 138, 152 Erzberger, H., 28, 41 F Fabre, F., 8 Faverge, J. M., 44, 62 Ferrell, W. R., 19, 42 Feynman, R., 155, 177 Firby, R. J., 26, 41 Fischhoff, B., 90, 96, 318, 324 Fitts, P. M., 3, 8, 338, 352

Flach, J. M., 6, 8, 155, 168, 169, 177, 178, 339, 352 Fleishman, E. A., 155, 178 Følleso, K., 48, 62 Foster, G., 124, 130 Fragola, J., 83, 97 French, R. M., 45, 56, 62 Freud, S., 312, 325 Frey, P. R., 133, 135, 136, 137, 138, 152 Fujimoto, J., 93, 98 Fuller, R., 273, 285 Funk, K., 229, 241, 250, 289, 307 G Galanter, E., 66, 97 Gansler, J. S., 16, 41 Geddes, N. D., 170, 179 Gertman, D. I., 134, 138, 151 Gibson, J. J., 6, 9, 159, 167, 168, 178, 273, 285 Gilmore, W. E., 134, 135, 138, 151, 152 Gilmour, J. D., 140, 152 Goodstein, L., 1, 9, 155, 160, 177, 178 Govindaraj, T., 39, 41, 214, 242, 250, 251 Graeber, R. C., 320, 325 Granda, R. E., 138, 152 Gregorich S., 304, 307 Grey, S. M., 155, 177 Gruber, E. V., 268, 284 page_356 Page 357 H Hall, R. E., 83, 97 Hammer, J. M., 170, 179 Hancock, P. A., 159, 165, 179 Hannaman, G. W., 94, 97 Hansman, R. J., 213, 214, 251 Hart, S. G., 45, 62 Hecht, S., 8 Helmreich, R. L., 8, 268, 278, 285, 286, 288, 307 Herringel, E., 168, 178 Hilburn, B., 202, 208

Hitch, G. J., 24, 41 Hoc, J. M., 46, 62, 65, 97 Hollan, J. D., 220, 242, 250 Hollagel, E., 3, 6, 9, 65, 70, 71, 72, 74, 75, 94, 97, 101, 130, 273, 285, 306, 307 Holmes, C. W., 268, 284 Hopkin, D., 124, 130 Hornsby, M. E., 140, 152 Horst, R. L., 142, 152 Howie, M. B., 329, 352 Hughes, D., 214, 250 Hunt, R. M., 133, 135, 136, 137, 138, 152 Hunter, S. L., 133, 134, 135, 138, 142, 151 Hutchins, E. L., 60, 62, 160, 162, 165, 166, 171, 175, 177, 178, 220, 229, 241, 242, 250, 251, 337, 352 I Imrich, T., 8 Irving, J. E., 49, 62 Irving, S., 49, 62 Iwai, S., 93, 98 Izguierdo-Rocha, J. M., 93, 97 J Jacob, R. J. K., 142, 152 Javau, D., 48, 62, 277, 285 Jensen, K., 268, 284 Jensen, R. S., 268, 285 Je, H. R. 19, 41 Johannesen, L., 4, 9, 170, 179, 257, 286, 288, 306, 307, 309, 325, 329, 333, 334, 335, 337, 338, 353 John, B. E., 47, 62 Johnson, E. J., 27, 41 Johnson-Laird, P. N., 66, 97 Johnston, A. N., 259, 266, 267, 285 Johnston, N., 321, 325 Jones, L., 67, 97 Jones, P. M., 229, 238, 239, 240, 241, 242, 244, 246, 250, 251 Jones, R. E., 338, 352 Jorna, P. G. A. M., 182, 186, 193, 196, 202, 205, 208, 209 K Kaarstad, M., 48, 62 Kanki B., 288, 304, 307 Kantowitz, B. H., 214, 250

Kelly-Bootle, S., 337, 352 Kemper, K., 241, 251 Kieras, D. E., 39, 41, 47, 48, 62 Kim, J. N., 229, 250 Kirlik, A., 54, 62, 160, 178, 329, 352 Kite, K., 241, 251 Klausen T., 60, 62 Klein, G., 6, 9, 269, 285 Krendal, E. S., 19, 41 L La Burthe, C., 337, 352 Lalley, R., 8 Langeweische, W., 168, 178 Lanir, J., 330, 352 Laprie, J. C., 123, 130 Lau, J. R., 268, 284 Lauber, J. K., 7, 8 Leconte P., 304, 307 Lee, D., 168, 178 Lee, J., 304, 307 Lee, R., 321, 325 Lichtenstein, S., 318, 324 page_357 Page 358 Lind, M. 77, 97 Logan, G. D., 169, 178 Logan, M., 21, 42 Lozito, S. 36, 37, 41 Lyall B. 289, 307 Lyddane, G., 8 M Mackintosh, M., 36, 37, 41 MacLeod, I.. S., 138, 152 Madhavan, D., 241, 250 Mahaffey, D. L., 142, 152 Maier, N. R. F., 65, 97 Maltby, J. R., 48, 61 Mangold, S. J., 329, 352 Marr, D., 155, 156, 160, 161, 162, 175, 178

Martin, R. L., 140, 152 Maurino, D., 321, 325 Mavor, A., 17, 24, 27, 41, 42 Mayer, R. E., 168, 171, 178 McDonald, J. S., 332, 352 McGann, A., 36, 37, 41 McGee, J., 24, 27, 42 McRuer, D. T., 19, 41 Mecham, M., 213, 250 Mellor, P., 213, 250 Merritt, A. C., 278, 286 Meyer, D. E., 39, 41, 48, 62 Midkiff, A. H., 213, 214, 251 Miller, J. G., 85, 97 Miller, T. E., 71, 97 Miller, G. A., 44, 58, 62, 66, 97 Mills, J. W., 268, 284 Mitchell, C., 54, 62, 214, 219, 222, 229, 230, 235, 238, 239, 240, 241, 242, 244, 246, 250, 251 Moll van Charante, E., 329, 352 Monnier, A., 45, 62 Moran, T. P., 47, 61 Moray, N., 38, 41, 66, 97, 304, 307 Moulton, C., 67, 97 Mouton, J. S., 7, 8 Munson, R. C., 142, 152 Myers, R. H., 142, 152 N Naatanen, R., 273, 285 Nagy, A., 169, 177 Neisser, U., 71, 75, 78, 86, 97, 165, 178 Neukom, C., 21, 42 Newell, A., 47, 61, 66, 97, 172, 178 Newman, T., 8 Nii, H. P., 246, 251 Nijhuis, H. b., 202, 209 Norman, D. A., 53, 62, 66, 97, 167, 172, 178, 220, 251, 314, 325, 337, 339, 343, 352, 353 Noviski, O. J., 133, 134, 135, 138, 142, 151 Nygren, T. E., 45, 63 O OíRegan, J. K., 342, 353

Obradovich, J. H. 329, 352, 353 OÍKane, J. M. 268, 284 Oranasu, J. 6, 9, 269, 285 P-Q Paeilli, R. A., 28, 41 Palmer, E. A., 229, 235, 250, 251 Paramore, B., 155, 177 Parasuraman, R., 27, 42, 202, 208 Paries, J., 266, 271, 285 Parke, R. B., 146, 152 Parlett, J. W., 242, 249 Parmer E., 304, 307 Payne, J. W., 27, 41 Pearson, R., 8 Pedrali, M., 94, 96 Pejtersen, A. M., 1, 9, 155, 160, 177, 178 Pelegrin, C., 256, 272, 285, 288, 307 Perret-Clermont, A. N., 272, 285 Pew, R. W., 17, 41, 165, 177, 329, 353 Piaget, J., 65, 97 Pisanich, G. M., 32, 33, 38, 41, 48, 62 Plat, M., 274, 285 page_358 Page 359 Polanyi, M., 164, 178 Polson, P. G., 47, 49, 62 Poturalski, R., 39, 41 Pribram, K. H., 66, 97 Quaintance, M. K., 155, 178 R Rasmussen, J., 1, 3, 6, 9, 26, 42, 80, 96, 98, 101, 130, 155, 160, 161, 166, 167, 168, 169, 171, 172, 174, 177, 178, 179, 269, 273, 285, 311, 315, 325, 342, 353 Reason, J., 8, 9, 21, 42, 45, 63, 80, 94, 95, 98, 124, 130, 167, 172, 179, 311, 316, 317, 318, 321, 325 Reeder, J. P., 148, 152 Regian, J. W., 212, 251 Reid, G. B., 45, 63 Riley V., 289, 307 Ritter, S., 229, 251 Rogalski J., 304, 307

Rogers, W. H., 329, 353 Ropelewski, R. R., 146, 152 Rouse, W. B., 66, 98, 133, 135, 136, 137, 138, 152, 170, 179, 271, 285 Rubin, E., 156, 179 Rubin, K. S., 229, 238, 239, 240, 246, 250, 251 S Samurcay R., 304, 307 S·nchez-Perea, M., 93, 97 Sarter, N. B., 3, 4, 8, 9, 50, 52, 63, 83, 98, 123, 130, 170, 179, 213, 217, 218, 220, 251, 257, 273, 276, 286, 288, 304, 306, 307, 309, 325, 329335, 337, 338, 340, 342, 353 Sasou, K., 93, 98 Schank, R. C., 243, 251 Schmitz, R. A., 148, 152 Schneider, W., 167, 168, 179 Shafto, M., 329, 352 Shankar, R., 22, 40 Shannon, R., 44, 63 Shearer, J. W., 155, 177 Sheridan, T. B., 19, 42, 49, 63, 238, 251 Sherman, P. J., 278, 286 Shiffrin, R. M., 167, 168, 179 Shively, R. J., 21, 22, 40, 42 Shute, V. J., 212, 251 Sides, W. H., 133, 135, 136, 137, 138, 152 Simon, H. A., 66, 68, 97, 98, 172, 178 Skinner, B. F., 270, 286 Slotte, S., 8, 305, 307 Slovic, P., 318, 324 Smith, B. R., 21, 41, 93, 96 Smith, K., 159, 165, 179 Smith, S. L., 138, 152 Sorkin, R. D., 87, 98 Sougné, J., 45, 56, 63 Sparaco, P., 213, 251 Sperandio, J. C., 45, 63, 111, 130 Sperling, G. A., 66, 98 Staveland, L. E., 45, 62 Sternberg, R. J., 45, 63 Stimson, D., 8, 305, 307 Stokes, A. F., 241, 251

Summala, H., 273, 285 Szabo, S. M., 31, 40 T Taggart, W. R., 268, 285 Takano, K., 93, 98 Tamais, G., 22, 40 Taylor, F. V., 19, 41 Taylor, R. M., 138, 152 Tenney, Y. J., 165, 177, 329, 353 Thiel, G., 8 Thurman, D. A., 238, 251 Tigchelaar, H., 8 Tullis, T. S., 48, 63 Tyler, S., 21, 42 V Vakil, S.S., 213, 214, 251 Valot C., 304, 307 page_359 Page 360 Van Daele, A., 46, 63 vanGent, R. N. H. W., 193, 194, 196, 209 vanCleemput, 229, 251 VanCott, H. P., 155, 177 Vaneck, T., 213, 214, 251 VanLehn, K., 246, 251 Vasandani, V., 242, 251 Vicente, K. J., 96, 98, 161, 164, 169, 174, 177, 178, 179 Vikmanis, M., 39, 41 W Wagner, R. K., 45, 63 Wanner, J. C., 304, 307 Ward, S., 39, 41 Warren, R., 155, 168, 178 Way, T. C., 140, 152 Weaver, W., 44, 63 Weitzman, L., 220, 242, 250 Wenger, E., 212, 242, 251 Wertheimer, M., 171, 179, 271, 286 White, M. D., 7, 8

Wickens, C. D., 24, 27, 42 Wiener, E. L., 83, 98, 211, 212, 213, 214, 217, 251, 288, 304, 307, 329, 330, 336, 353 Wilde, G., 273, 286 Wilhem, J. A., 268, 285 Williams, A. C., Jr., 154, 179 Williams, J. A., 219, 222, 251 Winograd, T., 329, 337, 339, 340, 353 Wioland, L., 273, 286 Wood, S., 39, 41 Woods, D. D., 3, 4, 8, 9, 19, 41, 46, 50, 52, 63, 70, 71, 74, 83, 87, 97, 98, 123, 130, 165, 169, 170, 179, 213, 217, 218, 220, 251, 257, 273, 276, 286, 288, 304, 306, 307, 309, 325, 329-335, 337, 338, 339, 340, 342, 350, 352, 353 Worledge, D. H., 94, 97 Wreathall, J., 83, 97 Y Yoshimura, S., 93, 98 Yue, L., 329, 352 Yufik, Y. M., 49, 63 Z Zhang, J., 339, 353 Zsambok, C. E., 6, 9, 269, 285 page_360 Page 361

SUBJECT INDEX A abstraction hierarchy, 159, 177 activity tracking, 229, 239 adaptive control, 172 ASRS (Aviation Safety Reporting System), 214 ATC (Air Traffic Control), 99, 105, 129 ATM (Air Traffic Management), 3, 17, 18, 20, 27, 183, 190, 202 attention, 111 selective attention, 66 attention control, 26, 45, 336 automation, 99 automation aiding, 15 automation, clumsy, 309, 336 automation failures, 200 automation management, 346

automation surprise, 211, 213, 257, 287, 288, 327, 330 autopilot modes, 52, 57, 288 aviation accidents/incidents Cali, 259 Mont St. Odile, 45 Moscow, 57 Nagoya, 57, 257, 259 Taipei, 270 C case-based teaching, 243 CDTI (Cockpit Display of Traffic Information), 31 cognitive complexity, 46, 47, 51, 59 cognitive model, 13, 16, 40, 102, 103, 104, 118, 128 cognitive resource management, 113, 114, 115, 119 complexity, 332, 335, 341 computational model, 49 computer malfunctions, 290 context simulation, 188 contextual control model, 76, 83, 84, 86, 93 cooperation, 112, 116, 119, 129, 300 coupling, 281, 338 CRM (Cockpit Resource Management), 7, 15, 83, 257, 262, 265, 288 D data availability, 342 data overflow, 106 datalink, 13, 33, 37, 99, 121, 128, 129, 181, 183, 189, 194 datalink gating, 196 decision making, 26, 66, 67, 77, 102, 104, 105, 107, 120 design cycle, 16, 46 direct perception, 167 distributed decision systems, 15, 18 E ERATO (En-Route Air Traffic Organizer), 101, 105, 118, 119 H human error, 21, 45, 94, 100, 106, 116, 172, 174, 183, 265, 266, 282, 329, 332, 337, 338, 348 error detection, 342 error management, 266, 271 error tolerant systems, 229 error, capture, 167

page_361 Page 362 error, knowledge-based, 172 error, mode, 170, 309, 338 error, of commission, 233 error, of omission, 233, 315, 316 error recovery, 61 error, skill-based, 167 escalation principle, 335 expert systems, 119 expertise, 333, 337, 347 F feedback, 87, 88, 342 fly-by-wire, 254, 287 FMA (Flight Mode Annunciation), 53, 57, 277, 342 FMS (Flight Management System), 30, 49, 50, 69, 99, 121, 128, 181, 183, 189, 211, 212, 213, 214, 220, 256, 274 free flight, 13, 14, 17, 27, 161, 183 full mission simulation, 13, 36 function analysis, 133 functional flow diagrams, 134, 160, 165 G Gestalt theory, 271 glass cockpit, 211, 287 goal switching, 114 gulf of execution, 53 H hindsight bias, 90 holistic processing, 142 human reliability analysis, 94 human-centered design, 338, 339 I information filtering, 117, 118, 120, 123 information overload, 85, 86 information theory, 44 intelligent agent, 14, 165, 336 intelligent tutor, 212, 240, 241 K-L knowledge-based processing/control, 170, 280 knowledge-based systems, 104, 119, 120

latent failures, 45 M-N means-end hierarchy, 163 memory, 24, 45, 66, 110, 111, 272, 336 mental models, 48, 66 mental workload, 43, 52, 58, 59, 60, 61 metacognition, 171 metaknowledge, 273, 274, 281 MIDAS, 21, 48, 58, 59 (Man-Machine Integration, Design, and Analysis System) mode awareness, 53, 182, 213, 214, 275 mode reversion, 54, 257, 297, 331 monitoring, 107, 122, 134, 142, 218, 262, 336 NASA TLX (Task Load Index), 45, 52 O-P observability, 342 OFM (Operator Function Model), 231, 244 opacity, 218, 338 optimal control model, 20, 39 perceptual cycle, 71, 86, 165 process control, 48 process tracing, 289 R rapid prototyping, 127 representation effect, 339 risk, 105, 273, 280 rule-based processing/control, 169, 280 page_362