International Civil Aviation Organization

World-wide CNS/ATM Systems

Implementation Conference

Rio de Janeiro, 11 – 15 May 1998

WW/IMP–WP/30

11/5/98

Item 6.2

Agenda Item 6:	Training needs

6.2	Human factors issues

HUMAN FACTORS ISSUES IN CNS/ATM

(Presented by the Secretariat)

Information Paper

SUMMARY

This supporting paper provides a description of ICAO's proactive approach towards the management of Human Factors issues in CNS//ATM systems. The success of CNS/ATM systems will to a large degree depend upon the effective implementation of the concept into operational environments. The effectiveness of the implementation will be affected by a number of variables. One such variable is the adoption of a systemic approach which focuses beyond the ad hoc deployment of technology and instead considers all foreseeable interactions among components of CNS/ATM systems. Within this systemic approach, and in order to realize CNS/ATM systems potential, consideration of Human Factors issues should be included early in the design stage, before the systems achieve operational status.

1.	Introduction

1.1	Human error underlies most safety breakdowns and deficiencies in modern production systems, including air transportation. Traditionally, remedial measures to contain the adverse consequences of human error in aviation have followed a two-pronged approach. One prong is based upon the development of new technology designed to reduce direct and active human involvement in systems operation. The second prong is based upon training aimed at the human element, to the front-line operators of the technology, in order to develop the necessary skills and knowledge to safely and efficiently operate the new technology. Supporting regulations underlie the implementation of new technology and the design and delivery of training. The contribution of improved technology to aviation safety and efficiency remains unparalleled with comparable contemporary production industries. However, in spite of the positive effects of new technology - both from a safety and economic point of view - and the attention given to the human element in the system over the last ten years, incidents and occasionally accidents have continued to show that new and sometimes surprising problems still exist.

1.2	From a broad perspective, two reasons explain these problems. First, the absence of a systemic, integrated approach to the implementation of technological and Human Factors solutions. Technology and Human Factors have functioned mostly autonomously, with little co-ordination between system designers and Human Factors practitioners. The industry has produced fine technology which has not fully delivered its potential because of deficiencies in its interface with the human operator. This piecemeal approach, known as "technology-centered automation", is being gradually phased-out in favour of ICAO's-supported "human- centred automation". In it, human capabilities and limitations are fully taken into account and integrated with technology during system and procedures design. CNS/ATM systems safety and effectiveness would be maximally enhanced if their design and implementation observes a systemic approach which integrates human performance and technology. This obviously requires high degree of co-ordination and co-operation among stakeholders.

1.3	Second, Human Factors knowledge has historically been applied in a reactive mode, after investigations of accidents and incidents document flaws in human performance which may either be due to inherent human limitations or - more to the subject of this paper - fostered by deficient human-technology interfaces. Reactive approaches tend to focus on immediate rather than on root causes of problems because of the emotional contexts within which they take place. This "band-aid" application of Human Factors knowledge has fought a losing battle against latent systemic failures - of which deficient human-technology interfaces are a prime example - and has limited progress towards optimum system safety.

1.4	How to identify and eliminate latent failures in production systems is not a new problem, but the massive introduction of high technology in aviation, where people must closely interact with technology to achieve the system production goals, has added a new dimension to the challenge. Improving this situation will require - among other prevention strategies - the proactive application of Human Factors knowledge, in order to identify, assess and minimise the negative consequences of human error and deploy countermeasures to maintain the aviation system's inherent hazards and risks at its lowest possible level.

2.	Discussion

2.1	CNS/ATM systems are technology-intensive, and their safest and most efficient performance is predicated upon the correct utilization of technology, as intended by its designers. Automation of tasks through the introduction of technology is an attempt to increase the production of a system by replacing human functioning by machine functioning, while maintaining or enhancing existing levels of safety and protection against harm and damage.

2.2	Aviation is not alone in the quest for increased production through automation, and similar endeavours have been attempted in other industries, including nuclear power generation, petrochemical, medicine and banking. Automation of tasks through new technology should allow for increased safety through the reduction of human error and increased efficiency by enabling operational personnel to "do more with less". Nonetheless, aviation as well as other industries have watched with consternation how huge investments in technology - technology which during its design stage appeared sound and appropriate to meet these objectives - did not deliver as expected when transported into the operational context, when interfaced with daily operations.

2.3	Technology can not then be easily changed because of claims that incidents or accidents involving it were due to design flaws which encourage the possibility of human error. Such claims - no matter how well- founded they might be - assert their proponents a prerogative to re-design not only the technology but also the jobs and responsibilities of operational personnel, and they involve astronomical costs which production industries are hardly in a position to take lightly. The implication of the above is clear: technology design should be context-conscious and human-centred from its inception.

2.4	Furthermore, piecemeal introduction of new technology carries potentially serious implications. First, it is a matter of record that designers automate what the existing state of knowledge allows to automate, leaving those tasks which can not be automated to be performed by humans. Critical in this approach is the assumption that the human operator will take and restore effective control of the system in "runaway" conditions; in unexpected operational conditions which controlling computers cannot "understand" because designers did not anticipate such operational conditions could emerge. The problem with this approach is that humans are expected to monitor the automated system and take over manually to restore the system to safety when facing operational conditions not forecasted by design and for which they are neither trained nor prepared. The need to revise this practice - dubbed the "irony of automation" - is obvious.

2.5	Second, there has been a tendency to automate what designers believed should be automated in order to better assist operational personnel. More often than not, this was accomplished without the benefit of feedback from the final users of the technology, without proper understanding of the potential operational consequences. Due consideration to potential inter-relationships between the automated system and the operational context limitations is fundamental, and one essential way to recognize the patterns which underlie automation and human error is to listen to the voices of the users. From a technology-centred point of view, incidents and accidents involving high technology systems appear to be mis-operations of technological systems that are otherwise fully functional, and are therefore labelled as human error. The typical belief is that the human element is separate from the technology, and that problems reside therefore either in the human or in the technical part of the system. This view ignores, among other things, the role of human capabilities and limitations, and the pressures that the system's production objectives impose upon operational personnel.

2.6	Lastly, the role of technology in fostering human error has been often overlooked. The attribution of error is a judgement about human performance, applied only when a process (i.e., the operation of technology) has a bad outcome (i.e., an accident or incident), and usually with the benefit of hindsight about the outcome. The limitations of human performance vis-à-vis the use of new technology have not always been fully appreciated. Seldom the problem lies with the technology design in itself. Most frequently, problems are a result of mismatches between the technology, its users and the operational context. It is only in the examination of these deeper issues that it is possible to learn how to improve the integrated performance of large and complex systems, of which CNS/ATM systems are a prime example, and how to incorporate these lessons proactively during design of technology.

3.	Proposal

3.1	There is already significant experience within the aviation industry vis-à-vis the introduction of new technology, and such experience should guide CNS/ATM endeavours. In particular, the experience obtained - often at considerable expense - during the introduction of advanced-technology flight deck aircraft (commonly referred to as "glass cockpits") is of special relevance and application to further CNS/ATM systems.

3.2	The early introduction of "glass cockpits" was plagued by problems, in particular regarding human-technology interaction. The extent of these problems was such that it eventually fostered a perception of "design-induced" accidents. The initial solutions proposed were just small changes in technology or procedures: shift a display, modify a checklist, issue a bulletin, reinforce a policy, provide remedial training. While these changes were constructive in small ways, they missed the larger "footprint" of the problems. It was only after research supported by a significant amount of operational feedback was available that the implications of human-technology interface problems were identified in operational terms.

3.3	Two important lessons were then learned: first, there was nothing inherently wrong with technology design by and in itself (or with humans, for that matter); most of the problems with human- technology interaction were essentially problems of deficient interfaces. Second, and as a consequence of this, it became obvious that the time to address human-technology interface considerations should be during the processes of design and certification of the technology. Both lessons are readily transferable to CNS/ATM systems.

3.4	The most important Human Factors issue in regards to human-technology interface is the ability of the human operator to maintain situational/system awareness. It is a matter of historic record that human- technology interfaces have not always been intuitive. Non-intuitive, opaque interfaces lead to operational complexity which often forces the operator to allocate increased attention to maintain an adequate mental model of the situation/system status. This becomes the breeding grounds for loss of situational awareness, decreased system performance and eventually human error and safety breakdowns.

3.5	The most cited example of degraded situational awareness is the mode error. Mode error is a problem which can only exist at the intersection of people and technology when the interface linking them is not friendly. It occurs when the same action or indication means different things to the human and to the machine. The person then losses track of the current context. It is mistaken to consider mode error as just human or machine failure. Mode errors are joint human-machine system breakdowns, since it takes a person to lose track of the current machine configuration, and a machine which interprets the person's input differently from that intended. If the "joint person-machine system" is duly considered, mode errors can be proactively anticipated and taken care of during design.

3.6	When new technology is introduced there is potential for safety breakdowns within the system in question, and the longstanding hobbyhorses of aviation - training and regulations - are not sufficient to support change. Technological change is an intervention into an ongoing field of activity. Developing and introducing new technology does not preserve the old ways of doing business in the ongoing field of activity, with the simple substitution of one tool for another (i.e, replacing a typewriter for a personal computer). It represents entirely new ways of doing things, including the composition of working teams and a shift in the human role within the joint human-technology system. Failures in automated systems produce considerable more side effects than in manual systems. Symptoms of faults may seem unrelated to the process taking place, making management and diagnosis more difficult and changing the kind of failures operational personnel would expect to see. All this leads to operational complexity. Trying to eliminate or improve "erratic" operational personnel behaviour through remedial training will not change the basic person-machine vulnerability created by the complexity. Neither will regulations banishing people associated with failures. An integrated approach is essential.

3.7	There are two possible alternatives to address human-technology interface design issues: during the design stage of the system; or after system implementation in the operation context. If following the first alternative, the tools are (1) technology design which is mindful of Human Factors issues, and (2) standard operating procedures which reflect the needs and constraints of the operational context where the technology is going to be deployed. If following the second alternative, the tools are (1) technology re-design (a very rare situation since costs are usually be prohibitive), and (2) training, to adapt human behaviour to cope with less- than-optimum interfaces. The second alternative has been traditionally favoured by aviation, and within this alternative training has been the tool most frequently resorted to, since it is apparently cheaper than re-design.

3.8	The decision of which alternative to pursue has significant financial implications, beyond the obvious safety-based considerations. Involving Human Factors expertise during technology design might incur additional expenses, but the costs are paid only once in the system's lifetime. Furthermore, in the medium- to long-term, initial costs will be recovered through the most efficient system performance (which will demand, inter alia, less training). On the opposite side, coping with flawed human-technology interfaces through training means incurring added expenses throughout the entire operational life of the system: not only increased training will be necessary, but every time that an interface shortcoming which was ignored or unforeseen during design is identified through operational feedback, additional modules of training will be necessary. This means constantly paying for more training on routine basis. Furthermore, training becomes the dumping grounds for poor interface design.

3.9	ICAO supports a proactive approach to the management of Human Factors issues in CNS/ATM systems. To this effect, and under the activities of its Flight Safety and Human Factors Programme, it has developed Human Factors Standards and Recommended Practices (SARPs) for inclusion in the Annexes to the Chicago Convention. These SARPs dictate the requirement to proactively address Human Factors issues during the certification processes of equipment, procedures and personnel.

3.10	To summarise, if new technology is to be successfully implemented, the following must be considered during design other than the technology's inherent properties:

the operational context in which the technology will be deployed,

the human performance-shaping potential which technology carries, since it creates the potential for new forms of error and failure,

the fact that use of technology will be shared by interacting people (i.e., teams),

the organizational context with its constraints, dilemmas, trade-offs, double and multiple binds and competing goals, and

the role of human performance factors which - if ignored - may turn otherwise efficient into "clumsy" technology.

Technology and human performance must in fact be considered as a joint human-machine system. Designing technology without consideration of the above will yield compromise rather than optimum benefits, and may indeed squander the tremendous safety and economic potential of CNS/ATM systems.

4.	Conclusion

4.1	Human Factors issues relevant to CNS/ATM systems are essentially human-technology interface issues. Historically, Human Factors issues in aviation have been dealt with in a reactive manner, following identification of shortcomings on human performance leading to accidents and incidents. This usually led to remedial actions, such as increasing training or developing further regulations. In a way, this can be likened to re-enforcing the stable door after the horse has run away. It is suggested that pursuing this avenue in regards to CNS/ATM systems will squander the significant benefits which these systems can bring to aviation.

4.2	In order to maximise safety and cost-effectiveness of CNS/ATM systems, the proactive management of Human Factors issues should be a normal component of the processes followed by designers, providers and users of these systems. The time to address Human Factors issues is during technology design, before technology is deployed into operational contexts. This is the proactive avenue, which will allow us to anticipate the negative consequences of human error rather than regret its consequences. Furthermore, flight deck operational experience shows that, once technology is deployed, it is too late to address Human Factors issues arising from flawed human-technology interfaces, and such issues become endemic, hindering safety and efficiency of the system.

4.3	Training has a fundamental role to play in CNS/ATM systems, as extensively discussed under the TRAINAIR Programme. Training for CNS/ATM systems should not, however, be used as a mediator of flawed or less-than-optimum human-technology interface design.

– END –