HumanFactorsinAviationSafety12-13November2018,HiltonLondonGatwickAirport

Presenters’abstracts

Monday12November2018 09:30 Openingthoughts:Arewedoingtherightaviationhumanfactorsresearch,andarewe

doingitright?BarryKirwan,Eurocontrol

Attheendof2018,twomajorreportsappearedintheareaofaviationsafetyresearch.ThefirstwasthefinalEuropeanCommissionfundedfour-yearOPTICSreviewof243safetyresearchprojects,toseehowfartheyaremovingustowardsaferflightforEuropeancitizensandbusinessusers.ThesecondwasaEuropeanCommissionreportonthetoptenchallengesandwaysforwardforasaferfutureinaviation.HumanFactorsfeaturedheavilyinbothreports.TheOPTICSreportshowedthatHumanFactorsappearedtobeanareawherethereis‘lowhangingfruit.’Thismeansthatmuchoftheresearchisreadytobebroughtintoindustrialisation,andhencecanhavearealimpactonoperationalsafety.However,italsoappearedthatinmanycasesthiswasnothappening,andthatresearchwas

‘recycled’,sothatitwasdoneagainandagain,eachtimematuringbutstillnotleadingtodeploymentinindustry.OPTICSfoundthatalthoughthequalityofresearchinHumanFactorswasgood,theresearch,andthecommunityitself,wereseenbyindustryasbeingfragmented,andtherewasagenerallackofconsolidationofresearch,sothattherewasnotaclearpictureofwhathasbeenachieved,alsoleadingtosimilarprojectsbeingcarriedoutatdifferentresearchmaturitylevels.OPTICSnotedthatintheUS,HumanFactorsappearstoplayamorestrategicroleinaviationsafetyresearch,comparedtoEurope.

OPTICSsingledoutHumanCentredAutomationasanareathatwasripeforsupportingindustry,andcalledfora‘harvester’projecttobringtheaccruedresearchknowledgetobearonindustrialdevelopments.

TheAviationSafetydocumentsimilarlyreviewed160researchprojects,includingHumanFactors,andagainfoundthatwhilstHumanFactorsisclearlystrategicandcriticalinresolvingcertainkeyriskssuchasthecurrenttopriskinEurope,knownasFlightUpset(formerlyLossofControlinflight),thatHumanFactorsresearchwasnotbeingusedinthisway.Instead,aswithOPTICS,HumanFactorswasoftenseenbyindustryasanadd-onratherthanasakeypartnerinresolvingkeycurrentandemergentrisks.TherecommendationwasforHumanfactorstobeusedinmoreflagshipresearchprogrammessuchasFutureSkySafety,aswellasbeingembeddedinverylargeindustrialresearchprogrammessuchasSESAR,sothattherecanbemoreuptakeofHumanFactorsresearch.TheAviationSafetydocumentincluded‘HarnessingHumanFactors’asoneofitstopten

strategicwaysforwardforimprovingsafetyinEuropeanaviation.Thepresentationwillfocusonthedetailedfindingsfromthesetwobroad-basedandindependentstudies,anddiscusstheimplicationsforthewaywedoHumanFactorsresearchinaviation.

Session1:Remotetoweroperations

10:35 Investigatingandidentifyingindividualvisualscanpatternintowercontrol-anempiriceyetrackingstudyatLinköpingAirportusingaverbalcodingtechnique.LotharMeyer1,ÅsaSvensson2,BillyJosefsson1,JonasLundberg21LFV,2LinköpingUniversitetetCurrentLFVactivitiesinSwedenfocusonthedeploymentofthedigitaltower,providing

Europe as a global aviation safety player

Reduction of Key Risks in the Portfolio

Risk InformedR&I Strategy

Safety Cultureacross the

AviationCommunity

Sharing of SafetyData &

Intelligence

HarnessingHuman Factors

Improving Survivability

Agile SMS for new

systems & players

CollaborativeSafety

& Security

New Safety Solutions

Stra

tegi

c Ad

viso

ry G

roup

s, F

lags

hip

Proj

ects

, Vi

rtual

Cen

tres

of E

xper

tise,

Fas

t-tra

ck R

&I C

apab

ility M

ore joined-up EC, national & international safety R

&IAnnualAviationSafetyR&

IConference

controlservicesonseveralairportsinSweden.There-designofthetowercontrolworkingpositioninvolvesthevideopresentationasOut-The-Window-ViewsubstituteandautomaticassistancesystemsinanintegratedplatformsolutionfromSAAB.Basedonthreeyearsoperationalexperience,itisassumedthatpossibleeffectsontheworkingbehavioroftowercontrollersmayarisefromthefactthatvideotechniqueandvisualizationdeviatesignificantlyfromthe“insitu”perceivedpictureinaconventionaltower.Thedesignoftheworkingpositioninaconventionaltowerisusuallyoptimizedtothelocaldistinctivecharacteroftheairfieldandrelatedvicinity.Thedigitaltowerworkingpositionrathertendstounifytheworkingpositionandoperationalmanualforharmonizingrequirementsacrossdigitalcontrolledairports.Animpactontheworkefficiencyandcapacitybytheharmonizationisthereforealsoassumed.In2017,projectDIGITstartedwiththeobjectivetoverifytheimplicationsforworkefficiencybyinvestigatingthetransitionprocessfromaconventionaltoadigitaltowerattheexampleofLinköpingSAABTowerandthreetowercontrollers.Asaprinciplemethodofmeasuringtheadaptionprocess,thebaselineofdirectingvisualattentioninLinköpingtowerwasmeasuredbymeansofeye-trackingequipment.Forcombiningvisualattentionandintention,thetowercontrollersappliedaverbalcodingtechniqueduringtherecordingsessions.Itallowedustoassociatetheactualtaskandtheobservedactivitiesofvisuallyscanningtherunway,searchingforaircraftsontherunwayandairspaceaswellassearchingforbirds.TheanalysisincludedArea-of-Interestandrelateddwelltime-sharesthatindicatecharacteristicsignaturesofbehaviorduringvisualfirstcontact,landingandtake-offclearance.Weidentifiedcleardistinctionsbetweentowercontrollersofgatheringinformationintermsofthetimeandeffortsspentonspecificcontrolactivitiesandtherelatedsequence.Moreover,wefoundanindividualtrade-offbetweentheplanningandprioritizationofmovementsusingtherunway,positionfetchingusingradarandthewindow-viewaswellasoccasionalmonitoringofunexpectedobstaclesonornearbytherunway.

11:00 Optimisingvisualidentificationforthedesignofoutthewindowviewsforcontingencyremotetowermodules.Wen-ChenLi1PeterMoore2andYuanWang11SchoolofAerospace,TransportandManufacturing,CranfieldUniversity,UK2JerseyAirport,PortsofJerseyIntroductionThecostsofAirtrafficmanagement(ATM)arecontinuingtoincreaseandtheindustryfacesproblemswithaginginfrastructureandAirtrafficcontrolofficer(ATCO)shortages.RemoteTowertechnologynowhastheabilitytosignificantlyreducethesecoststotheairportauthority.Therefore,byoptimisingsingleandcontingencyremotetowermodulesthereisthepotentialopportunitytofurtherreducecostsbyapplyingthismethodologytoamultipleremotetoweroperation.Theaimofcurrentresearchistoinvestigatehuman-computerinteraction(HCI)ontheOutofWindowview(OTW)todesignacontingencyremotetowermodule.Workingwithinnovativesystems,ATCOsnotonlyhavetomonitormultipledisplayswithefficientdistributedattention,buttheymustalsointerveneifpotentialconflictsdevelopandrelocatetheirattentiontothearearequiringimmediateattention(Bruder,Eibfeldt,Maschke,&Hasse,2014).ThepathofATCOs’fixationsisassociatedwithselectiveattentionandaccuratejudgmentsforperceptualtargets(Henderson,2003).Saccadiceyemovementsarecontrolledbytop-downvisualprocesses,whicharecoordinatedcloselywith

perceptualattention(Zhao,Gersch,Schnitzer,Dosher,&Kowler,2012),andsaccadicpathsareintentionalandmeaningfulrelatedtothetaskandtrajectorypredictiontothenearfuture(Kowler,2011). Thedurationofhumanvisualscanningismorerelatedtoprocessingcomplexitythantovisualsearchefficiency(Robinski&Stein,2013).Thehuman-centreddesignofcontingencyremotetoweroperationsshallbaseonastrategic,collaborativeandautomatedconceptofoperations(Schuster&Ochieng,2014).ItisimportanttoenhanceATCO’smonitoringperformanceusingadvancedtechnologytodevelopremotetowermodule.ThekeyobjectivesofATMsystemdesignshouldbetoenablethecontrollertointegrateexistinginformationwiththeevolvingtrafficstateattheairfield,andidentifyrapidchangesinatimelyapproach(Wickens,Miller&Tham,1996,Yuetal.,2016). MethodTherewere15qualifiedATCOswhoparticipatedinthisresearchconsistingof3femalesand12males.Theagesoftheparticipantswasbetween31and58yearsold(M=42.07,SD=8.12),andtheworkingexperienceswerebetween2and39years(M=16.33,SD=10.98).Tocaptureobjectiveeyemovementmetrics,aPupilLabs“PupilPro”eyetrackingdevicewasused.ThisdevicehasaWorldCameramountedinthecentreofglassesshowingtheorientationandviewofthewearer’shead.Asecondcamera,theEyeCamera,ismountedoffsettotherightandlow.Thispartofthedevicetracksthewearer’srighteyepupil(Kassner,Patera,&Bulling,2014).Thecameraalgorithmislockedonandtracksthepupilwhilesearchingfortargetsonthevisualfieldonthemock-upofOTW(Figure1).Therewere30differentpre-definedtargetsontheOTWpresentedonboth43inchand55inchscreens.Eachparticipanthadtoweartheeyetrackerandidentifythe30targetspresentedonbothsizesofOTW.ThemeasurementofATCOs’responsetimetodetectthedifferenttargetsonbothscreenswasrecorded,theintervalbetweeneachtargetwas5secondsbyapre-grogramaudioplayer.TheexperimentprocesswasreviewedandapprovedbytheCranfieldUniversityResearchEthicsSystem(CURES),referencenumberCURES/2471/2017.

Figure1.ATCOwearingeyetrackeridentifyingtargetspresentontheOTW

ResultsTherewasasignificantdifferenceonthefixationnumbersbetweenthe55inchand43inchOTWscreensonthecontrollerworkingposition.ATCOs’fixationnumbersweresignificantly

higheronthebiggerscreens(M=378.76,SD=80.01)comparedwiththesmallerscreen(M=348.53,SD=61.25). Therewerenosignificantdifferencesonthefixationduration,pupilsizeandsaccadeamplitudeduetothesmallnumbersofparticipants.Furthermore,theresponsetimeofidentifying30targetsbetweenthebiggerscreen(55inch)andsmallerscreen(43inch)shows8targetswithsignificantdifferences(table1).ATCOs’responsetimeweresignificantlyquickerwheninteractingwiththesmallerscreenscomparedtobiggerscreenson8targets.ThesewereaPA31ParkedonStand20(target-2),RoccoTower(target-11),26Glidepathaerial(target-21),StOuenMill(target-22),AirbusBoardingRamp(target-24),08Threshold(target-26)andaBoeing737onStand18(target-27).Table1.TheT-testshownsignificantdifferencesonresponsetimeoftargetidentificationsbetweenbiggerscreens(55inches)andsmallerscreens(43inches)forOTW

Targets on OTW

Mean Std. Deviation t df

p-level

Pair 2 .68 1.11 2.380 14 .032

Pair 11 .73 1.13 2.522 14 .024

Pair 18 .56 .95 2.285 14 .038

Pair 21 .55 .55 3.841 14 .002

Pair 22 .74 .99 2.901 14 .012

Pair 24 .63 1.03 2.380 14 .032

Pair 26 .43 .76 2.222 14 .043

Pair 27 .80 .98 3.165 14 .007

DiscussionIncreasingtheefficiencyofATCOsvisualscanpatternsandresponsetimesonaremotetowercontrollerworkingposition(CWP)isakeyfactorinincreasingATCOsperformanceandthereforetheamountoftraffictheycansafelyhandle.ItwasessentialtoexamineATCO’svisualbehaviourswhileinteractingwithOTWinordertovalidatetheHCIframeworkforcertification.ThisstudyanalysedtheattentiondistributionofATCOs,whilstinteractingwithdifferentscreensizes.TheresultsdemonstratedthatsmallerscreensofOTWoptimisetheATCOs’visualsearchingandtargetidentification.ThefrequencyoffixationsindicatesthatthesizeoftheAreaofInterest(AOI)directlyimpactedtotaskperformance.TheATCOs’responsetimeontargetidentifications,providesinsightintotheuseoffixationtimesasinformationacquisitionindicatorstoidentifythetrafficsituation.ThebiggerscreensinducedlongerfixationtimeswhilstATCOsweresearchingfortargetsaroundtheairfield.ItalsoprolongedATCOs’responsetimeduetotheenlargedsearchareacomparedwithsmallerscreens.ForthisreasonATCOs’hadquickerresponsetimewhenidentifying8targetsonthesmallersizeofscreens.Furtherresearchconcludedthatthe8targetsonthe43inchscreenswithsignificantquickerresponsetimeswerealllocatedonthemarginsofthescreen.ATCOsdidn’thavetomovetheirheadtosearchthesetargetscomparedwithsearchingonthe55inchscreenswhichrequiredre-positionedfixationsforsearchingtargets(figure2).ThisresearchdemonstratedthatATCOsresponsetimestoidentifytargetswerequickerwith43inchOTWscreenscomparedwith55inch.Thisresultdiffersfrompeople’sinitialexpectation,whichpresumedthebiggerscreenswouldbebetterforidentifyingtargets.

Whilstbeforethetestthemajorityofcontrollerspreferredthe55inchscreensthisviewwassubjective.Theexperimentdemonstratedobjectivelythat15controllerswerequickeridentifyingtargetsusingthe43inchscreens.

Figure2.ATCO’seyemovementpatternswhilesearchingtargetsontheOTW

ConclusionTheremotetowermoduleisequippedwithPanTiltZoomcameras(PTZs)toallowATCOstoaugmenttheirviewoffsettingtheneedforlargerscreens.AcriticalissueishowtointegrateHuman-ComputerInteractionswiththePTZstoincreasehumanperformanceonremotetoweroperations.ATCOs’visualattentionisaninitialstepinthecognitiveprocessrelatedtotaskperformance.TheresultsdemonstratedthatATCOs’responsetimewerequickerwhilstsearchingfortargetsonsmallerscreensandtheseviewscanbeaugmentedwiththeuseofPTZcameras.Thedistributionofacontroller’svisualattentionamongdisplaysystemsisakeyhuman-computerinteractionissueinmonitoringtasksforremotetoweroperations.InformationpresentationontheremotetowermoduleandinformationinterpretationbytheATCOarecrucialelementsinassuringaviationsafetyandoptimisinghumanperformance.CurrentOTWandCWPontheRTMdemonstratethateffectivehuman-centreddesigninrelationtoinformationpresentationcansimplifyATCOs’cognitiveprocessesbyreducingthevolumeofvisualsearchingtherebyalleviatingcognitiveload.Furthermore,innovativeremotetowertechnologywillfacilitatestaffingandequipmentcost-efficienciesincludingCommunications,Navigation,SurveillanceandFlightDataProcessingSystems.

Session2:Eyetracking

12:00 TheuseofeyetrackingforATMtrainingandresearch.MichaelaSchwarz,AustroControlGmbHEyetrackingisawidelyrecognisedmethodinergonomicstogaininsightsintocognitiveprocesses.InATMeyetrackinghasbeensuccessfullyusedtoassessmentalworkloadinATCactivity(Brookingsetal.,1996;Ahlstrometal.,2006),understandemotioneffectsondecisionmaking(Causseetal.2012),investigatescanningtechniques(Steinetal.,1989)andmonitorwakefulness.Recentstudiesevaluatehead-freeeyetrackingasinputdeviceforair

trafficcontrol(Alonsoetal.2013).OnereasonthatmakeseyetrackingsoattractiveforuseinATCisthatitisrelativelyunobtrusiveandeasytousecomparedtootherpsychophysiologicalmeasurements(e.g.heartrate,brainactivity).DespitetheobviousbenefitsonlyfewANSPsuseeyetrackingforresearchortrainingpurposes.Reasonsreportedincludelackofexpertisetoanalysethedata,lackofresourcetopurchaseeyetrackingequipmentandconcernsofstaffunionsregardingthepotential(mis)useofpersonaldata.Method:ThepaperisbasedonaliteraturereviewofempiricalstudiesusingeyetrackinginATM.Results:ResultswillincludeasummaryofthestateoftheartineyetrackingresearchinATM(mainareasofapplicationandbenefits)aswellasacriticalreviewofeyetrackingequipmentandassociatedanalysisavailableonthemarket.Conclusionsandpracticalimplications:ThepaperaimstoprovideargumentsforchoosingeyetrackingforATMtrainingandresearchpurposes.

12:25 Eyetrackinginairtrafficcontrol.RhianWilliams-Skingley,CourtneyJaeger,NATSThevisualsystemplaysakeyelementoftheroleofanairtrafficcontroller.Whetherthey'reinthetower,lookingoutattherunway,orinadigitaltowerroom,lookingat12HDscreens,thevisualsystemisthestartingpointofrapidlyassimilatingandprocessinginformation,buildingandconstantlyupdatingtheirmentalpictureofthetrafficsituation.

Whenitcomestoconductingpracticalresearchinairtrafficcontrol(ATC),HumanFactorspractitionersroutinelycollectsubjectivemeasuresofhumanperformance.Thismethodologywhilstsimpletoapplycontainswell-knownshortfalls,inthatitreliesoncontrollersbeingabletoaccuratelyrecallspecificscenarios,whatdecisionstheymade,whereandwhytheyscannedinformationanddatasources.Observersduringtheseexercisesareunabletogaininsightintocontrollerdecisionmakingandthoughtprocessing.Muchofwhatcontrollersdoisautomatic,quickthinking,addingtothedifficultyinrecallingandsubjectivelyratingthecognitivefeaturestriggeredbydifferentATCsystems.

Usingthelatesteyetrackingtechnology,practitionersareabletogatherdataallowingforgreaterinsightinto:

• Thedistributionofcontroller'sattention;• Wherethecontrollerislookingat,andforhowlong;• Theorderofacontroller'sscan;• Heatmapsandfrequentlyscannedareasofthedisplay.

Thelistaboveisjustthebeginningofanewmethodologyofobjectivehumanperformancemeasurement.HumanFactorshasbeguntouseeyetrackingtechnologytoembarkonawiderangeofprojectsacrosstheNATSestate.

Projectsincludetheutilisationofeyetrackingdatatosupportthetransitionoftraineesfromthecollege,paperbasedsystemstoliveoperationalsystems,wherethetechnologyintroducesgreateramountsofautomationrequiringdifferentvisualscanningskillsandhabitstobebuilt.

Throughoutthesummer,HumanFactorspractitionerswillbecollectingeyetrackingdatafromcontrollersatoneofthebusiestAirTrafficControlTowersintheUKandatbothofourenroutefacilitiesinordertogaingreaterinsightintothescanningbehavioursofcontrollers,asawaytoproactivelyidentifypotentialareasofrisk.

Aswellascollectingobjectivedata,NATShavedeliveredanumberofworkshopsandcoursesonVisualScanningandDecisionMaking.WorkshopshavebeendevelopedandhonedtoindividualneedsandrequirementsacrossallaspectsoftheATCsystem.

Pullinguponbothpsychologicaltheoriesandpracticalexample,theworkshopsintroducethePsychologybehindperception,memoryanddecisionmaking,andexplorewhywemissinformationthat'srightinfrontofus.

BythetimetheCIEHF'sAviationconferencecomesroundinNovember,NATS'HumanFactorsteamwillhavearangeofdatatopresentanddiscusswithdelegates,illustratingthevaluethismethodologyofhumanperformancedatacollectioninthesafetycriticalindustryofaviationbrings.

12:50 Integratedeyetrackingtechnologyfordigitalflightdeckdesign.ThomasRobert1,VincentFerrari1,Wen-ChenLi2andMudassirLone21FrenchAirForceResearchCenter,2SchoolofAerospace,TransportandManufacturing,CranfieldUniversity,UK

IntroductionPilots’visualparameterscanbepreciselyanalysedbyeye-trackingtechnologywhileinteractedwithaspecificinstrumentwhichisassociatedtoattentiondistribution,situationawareness(SA)anddecision-makingprocessesintheflightdeck.Pilots’fixationdurationmeasuringhowlongtheysustainattentiononaninstrumenttodiagnoseanabnormalsituation;saccadeamplitudewhichisrelatedtoattentionshiftsamonginstrumentsforgainingsituationawareness;andpupilsizewhichisoneofthemeasuresusedtoassesspilots’workload.Eyescanpatternisoneofthemostpowerfulmethodsforassessinghumanbeings’cognitiveprocessesinhuman–ComputerInteraction(HCI).Thisstudywouldliketoinvestigateinterfacedesignswhichtendtobewidelyused,andhavebecomestandardintheframeworkofdigitalaviation.Itbringstolightthelinkbetweensituationalawareness,mentalworkload,reactiontimeandflightdeckdesign.Eyetrackingtechnologyisanobjectivesolutiontomeasuresituationalawareness,andfixationsandsaccadeareindicatorsofattentionthatreflectapilot’sSA.

MethodParticipant:Atotalof19pilotsparticipatedinthisresearch.Theagesofparticipantsarebetween22and65yearsold(M=36,SD=14,27),flightexperiencevarybetween39hoursofflightto4000hours(M=1044,SD=1298).TheapparatusisCranfieldEFS500flightsimulatorsimulatingtheflightdecksettingofCessnaC172(figure1).TherearefiveAOIsincludingAirspeed(AOI-1),Heading(AOI-2),RPM(AOI-3),Altitude(AOI-4),InterfaceDisplay(AOI-5).ThePupilLabEyeTrackerwasappliedtocollectandanalyzedparticipants’visualparameters,asitisanopensourcePlatformforpervasiveeyetrackingandmobilegaze-

basedinteraction(Kassner,Patera,&Bulling,2014).Inordertoevaluatetherelationshipofinterfacedesignandsituationalawareness,allparticipantshavetocompletetheSART-10Devaluationform(Taylor,1990).

Figure1.CranfieldEFS500flightsimulatorsimulatingtheflightdeckofCessnaC172recordingbyPupilLabEyeTracker

TherearetwodifferentscenariosofinterfacedesignintheC172simulator.Theoperationalenvironmentalofthescenariosarethesame,landingtheCessnawithafixedgearand10°offlapinHonkKongAirport(VHHH),runwayoriented080°.Participantsweretoldtoflareataspeedof65kt.TheonlydifferenceisthepositionofadditionaldisplayshowingthecriticalmessagesthatrequiredtheparticipantstorespondbetweenscenarioA(bottomrightcorner)andscenarioB(HUDposition)(figure2).Ontheadditionaldisplay,picturesweredemonstratedfor5secondsandfollowedbya10secondsblackscreen,exceptforthe“GlideSlope”audiosignalwhichwas9secondslongandfollowedbya6secondsblackscreen.Thisistoactivatethealarmofdescentalwaysatthe90secondsofflightforallparticipants.

Figure2.ScenarioAshownasleft-handside,andScenarioBshownasright-handside

ResultsAllparticipants’eyemovementareanalysedfor300secondsforscenarioAandB,eachscenarioincludingbefore-and-afteralarmofglideslope.Thevisualparametersareincludingpupilsize(PS),fixationcount(FC),fixationduration(FD),saccadeamplitude(SA).TheresultsdemonstratedthatthereisasignificantdifferenceonsaccadeamplitudebetweenscenarioAandB,F(0.14,0.116)=8.517,p<.01,𝜂"# = .126.Pilots’saccadeamplitudeisbiggeronscenarioAthanscenarioB.Thereisasignificantdifferenceonfixationdurationbetween

scenarioAandB,F(27483.7,129572.7)=4.715,p<.05,𝜂"# = .300.Pilots’fixationdurationislongeronscenarioBthanscenarioA.Furthermore,thereisasignificantdifferenceonfixationdurationbefore-afterglideslopealarmactivation,F(1.943,0.790)=7.293,p=0.009,𝜂"# = .108.Pilots’fixationdurationisshorterafterthealarmactivatedcomparedwithbeforealarmactivation(table1)

Table1.Thevisualparametersbetweenscenariosandbefore-afteralarmofglideslope

VisualParameters

ScenarioAM(SD)

ScenarioBM(SD)

BeforealarmM(SD)

AfteralarmM(SD)

PS 124.17(33.60) 122.94(30.00) 124.37(31.20) 122.71(32.37)FC 4.60(1.42) 4.91(1.35) 4.65(1.23) 4.87(1.54)FD 1004.13(478.00

) 1129.19(397.70) 1212.12(458.39) 925.23(373.82)

SA 0.214(0.12) 0.127(0.11) 0.146(0.12) 0.191(0.11)

DiscussionApotentialbenefitofapplyingeyetrackingtechnologyasanindicatorofcognitiveprocessingisthatitprovidesforthepossibilityofcapturingfluctuationsinpilots’attention.Thisresearchshowsthatthepositionofinformationpresentationneardirectvisualcontact(scenarioB)hassmallersaccadeamplitude(0.214vs0.127)andlongerfixationduration(1129.19vs1004.13).ThefindingsareconsistentwithproximitycompatibilityprincipleproposedbyWickens(2009).Saccadedefinedasrapideyemovementbetweenfixations-generallydeclinesasafunctionofincreasedmentalworkload,andthepupildiameterincreasesasafunctionofcognitivedemandswhicharecoordinatedcloselywithperceptualattention(Komogortsev&Karpov,2013;McColeman&Blair,2013;Remington,Wu,&Pashler,2011).PilotshavebiggersaccadeamplitudeonscenarioAthanscenarioB,itmightbethelocationofdisplayforcedpilotstomovetheirheadtoidentifytheinformation.PositioninscenarioBdecreasedheadoreyesmovements,butmighttriggerlongerfixationdurationtoprocesstheinformation(Karar&Ghosh,2014;Wickens&Alexander,2009;Yuetal.,2016).Thealarmofglideslopewasnotonlyanaudiosignal,butalsorequiredseveralactionsfromthepilot.Pilots’fixationdurationdecreasesafteralarmsothatpilotscouldbeabletoscanmoreparametersinatimecriticalsituation.Thisshiftinscanningpatterniscorrelatedwiththescenario.Theshiftingattentioniscombinedwithshorterfixationsdurationtothepresentinformationonthedisplay.Attentionisredirectedandreallocatedduetotheaudioalarm(V.Ahlstrom&Panjwani,2003;Dehaisetal.,2014;Kearney,Li,&Lin,2016).Eyescanpatternisoneofthemostpowerfulmethodsforassessinghumanbeings’cognitiveprocessesinhuman–ComputerInteraction(HCI).Furthermore,eyemovementsmayserveasawindowtoassesstheprocessofpilot’smechanismofsituationawarenessanddecision-making.Eyemovementsarecloselylinkedwithvisualattentionandabletoinvestigatepilot’sattentiondistribution,situationawarenessanddecision-makingrelatetooperatingtasks(PF)andmonitoringtasks(PM)intheflightdeck.Thepurposesofthisresearcharetoaddressthelimitationsofcurrentaccidentinvestigation,dueinparttothelackofapilot’svisualparameterstoreflecttotherecordedparametersfromFDR.

ConclusionsThisstudydemonstratedthatthepositionofinformationpresentationandtypesofalarm

didhaveimpactedtohumaninformationprocessing.Regardingaudioalertcombinedwithavisualalert,itraisessituationawarenessandspeed-upscanningpatterntoidentifythetargetinformation.However,thequickresponsetimemightcometogetherwithacostofincreasingpilot’stask-load.Suchresultscouldhelpdesignerstocreateafriendlierinterfaceforhumancomputerinteractionintheflightdeck.Byapplyingeyetrackingtechnologyintheflightdeck,thecomplicatedhumanfactorsissuesregardingpilots’attentiondistribution,situationawarenessandcognitiveinformationprocessing.Authorswouldliketoproposeasoundsolutionbydevelopingeyetrackingtechnologyinthecockpit,anditwillnotonlyassistaccidentinvestigation,butalsobenefittopilottraining,provideappropriatesupportstodealwithurgentsituations,andfacilitateflightdeckdesign.Theutilityofvisualparametersisenormous,andthepotentialforreducingthelikelihoodofasituationescalatingtowardsanaccidentisapositiveeffectofunderstandingtheroleofhumanfactorsinthedigitalflightdeck.

Session3:Wellbeing

14:30 Consideringfatigueriskwhenmakingoperationalchangesinaviation.SarahBooth1,NinaMcGrath2,AlexHolmes11ClockworkResearch,2CathayPacific

Pilotfatiguecontributestoaviationaccidentsandincidents,mostrecentlyin2016whenthepilotsofanaircraftinDenmarkattemptedtotake-offwhenlinedupwiththeedgeoftherunway,ratherthanthecentreline,causingdamagetotheaircraft1.Pilotfatiguewascitedasoneofthecausalfactorswhichcontributedtothesequenceofevents.

Long-haul flying involvesmany factorswhich, if not appropriatelymanaged,may result inincreased pilot fatigue. Long-haul crew cross time-zones, fly during their body clock nighttime,andmayneedtobeawakeforextendedperiods.Onewaythatfatigueismanagedonlong-haul flight is by having one or two additional pilots to act as relief pilots during thecruise period, enabling the operating pilots to rest in bunk facilities away from the flightdeck.When determining the number of pilots whowill be assigned to a long-haul flight,operators balance multiple factors such as legal requirements including flight timelimitations,safetyandfinancialconsiderations.

Thiscasestudydescribesamanagementofchangeprocessundertakentodetermineiflong-haultripsbetweenLondonHeathrowandHongKong,historicallyundertakenbyfourpilots,couldbeoperatedbythreepilots,whilstmaintaininganacceptableleveloffatiguerisk.ThechangewasconsideredafteranupdatetotheHongKongFlightandDutyTime limitationswhichincreasedthethree-crewmaximumFlightDutyPeriod.

TheairlineoperatessixflightsadaybetweenLondonandHongKong,atdifferenttimesofday, and utilise both London- and Hong Kong-based crew to operate the flights. Crewoperateanoutbound flight,andstayat thedestination (LondonorHongKong) foroneortwolocalnightsbeforeoperatingthereturnflight.

1https://www.skybrary.aero/index.php/AT72,_Karup_Denmark,_2016

Themanagementofchangeprocessthatwasfollowedisoutlinedbelow:

1. Proposed changes: Flight Operations proposed a phased trial of three-crewoperations

2. Union agreement: Agreement reached with union for the trial to be carried withexternal validation and oversight by the Fatigue Risk Management SystemCommittee(FRMSC)

3. Predictivebio-mathematicalfatiguemodellingofdifferenttripdesignswiththreeorfourcrew

4. Selectionoftripsforfurtherstudywhenoperatedbythree-crew5. Collectionofdata fromcrewworking selected trips (532pilotsprovided sleep logs

andsubjectivefatiguescores)6. Assessmentoffatiguereportformsassociatedwithselectedtrips7. Evidence-baseddecisionmakingbytheFRMSC8. Communicationwithcrewthroughoutprocessandoffinaldecisions

The outcome of the process was the decision by the FRMSC that some trips could beoperatedbythreepilots,whilstmaintaininganacceptableleveloffatiguerisk,dependingonthefollowingfactors:

• flighttiming–bodyclockdaytimeforbothoutboundandreturnflights• dutystarttime–nottooearly,tomaximisesleeppriortoduty• layoversleepenvironment–highstandardtoenablecrewtoobtainmaximumsleep

Themanagementofchangeprocessdescribedinthiscasestudycouldbeappliedtoenableoperators to consider fatigue risk whenmaking operational changes, such as operating anewroute,orchangingaflightpatternordutyschedule.Fatigueriskshouldbeconsideredaspartoftheproactiveriskassessmentprocessthattakesplacepriortooperationalchange,ratherthanasaboltedon‘extra’,orafterthechangehasbeenmade.

Session4:Cybersecurity

15:35 Cybersecurityinaviation:humanfactorsconsiderations.RobBecker,BAESystemsCybersecurityisamodern-daynecessity.Thedigitalagehasmadeinformationstorageandtransmissioneasierthaneverbefore.However,ascyberinfrastructurebecomesmorecomplex,thethreatofmanipulation,degradationordestructionbyhostileactorsbecomesmoreprobable.Civilaviationmakesapproximately$2.7trillionperyear.Thesystemsusedtomaintainitssecurity,safetyandprofitabilityarelargelygroundedindigitalinfrastructure.FrombiometricpassportscannerstoAirTrafficControlnetworks,animmenseamountofcomputingpowerisrequiredtoeffectivelyregulatetheindustry.Numerousinstancesofcyber-attacksinthissectorhavebeenreported,fromthetheftof48,000personnelprofilesfromFAAcomputersystemsin2009toa2015AirTrafficControloutageinthreeairportsacrossSweden.Avitalyetsomewhatoverlookedpartofthecybersecurityecosystemisthehumanuser.AccordingtoIBM,73%ofallbreachesincybersecuritycanbetracedbackto‘usererror’eitherthroughmisconfigurationofprogrammesormisuse.Thispresentationwillconsiderthemainthreatstothecivilanddefenceaviationsectorsincyberspace.Thiswillbeexploredfurther,byconsideringwhetheritispossibletopredicthumanbehaviourorprotectagainstmaliciousactsbeforetheyarecarriedoutthroughcarefulmodellingofhuman-madevulnerabilitiesandconsiderationofadversarialmotivations.

16:00 Keynote:Whataviationcybersecurityneedsfromhumanfactors.ChrisJohnson,UniversityofGlasgowAbstracttofollow.

HumanFactorsinAviationSafetyProvisionalprogramme

Tuesday13November2018 Session5:Digitalaviation

09:00 Keynote:Designinggracefuldegradationintoairtrafficcontrolsystems:Interactionsbetweencausesofdegradationandassociatedmitigationstrategies.TamsynEdwards,SanJoseStateUniversity/NASAAmesWithintheairtrafficdomain,initiativessuchastheUS-focusedNextGenandtheSingleEuropeanSkyActionResearch(SESAR)programinEuropeareenablingsignificantchangeinairtrafficmanagementoperations.Withsuchfundamentalchangetotheairtrafficmanagementsystemexpectedinthenearfuture,systemsafetyandresilienceisacriticalconcern.Animportantelementofmaintainingsystemsafetyandresilienceinairtrafficistheabilityofsystemsto‘degradegracefully’.Oftheavailablegracefuldegradationresearch,amajorityofstudieshavefocusedprimarilyontheimpactoftechnologicalcausesofdegradationandtheabilityoftechnologytopreventdegradation.Althoughtheseresearchareashaveprovidedexcellentinsightintotheroleoftechnologyingracefullydegradation,non-technologicalcausesofdegradation(suchasthosearisingfromanon-optimalenvironmentorfromhumanoperators),aswellascontributionstodegradationpreventionorrecovery,havebeenrelativelyneglected(Edwards&Lee,2017).Afterasystematicreviewofliteraturerelatingtogracefuldegradationincomplexsystems,(Edwards&Lee,2017)revealedthatcausesofdegradationcouldbebroadlycategorizedintotechnologicalfaultorfailure,theenvironment,orhumanoperators.Thereviewidentifiedthatresearchwithineachofthesecategoriesishighlyindependentanddidnotcrossdomains.Asaresult,thepotentialinteractionbetweenthecausesofdegradation,andtheresultingpossiblecompoundeffectontheentiresystem,wasunder-researched.Thecurrentresearchaimedtocontributefurtherunderstandingtoresearchgapsidentifiedby(Edwards&Lee,2017).MethodAtotalof12retiredTRACONanden-routecontrollersparticipatedintwoqualitativeexercises,totaling2.5hours.Thefirstexercisewasasemi-structuredinterviewrelatingtothecontrollers’previousexperience,lastingonehourinlength.Thesecondexerciseutilizedasemi-structuredinterviewmethodology,althoughthistimeresponsesweretargetedtospecificscenarios.Theobjectiveofthisexercisewastounderstandtheoccurrenceandimpactofinteractionsbetweentriggersofdegradation.Interviewsweretranscribedorthographically.Thematicanalysiswasselectedastheanalysisstrategy.ResultsanddiscussionFindingsidentifiedfrequentlyreportedcausesofdegradation,andpreventionandmitigationstrategiesintheATCsystem,basedoncontrollers’experience.ReportedfindingshaveimplicationsfordesignersoffutureATCtoolsandsystems,aswellriskassessmentandvalidationoffuturetechnologies.Severalofthefindingsthatarediscussedbelowcanbe

arguedtobe‘commonsense’,orthatarecolloquiallyknown,suchastheimportanceoftheroleoftheATCOinachievinggracefuldegradationofthesystem,orthatothercausesofdegradationapartfromtechnologicalcausescannegativelyimpacttheATCsystem.However,thespecificsofsuchfindingshavebeenunderrepresentedintheresearchliterature,enablingthecurrentstudytoaddresstheseresearchgapsbyspecifyingthedegradationcauses,andmechanismsbywhichcontrollerspreventandmitigatedegradationintheATCsystemandtherequirementsforthesestrategiestobeimplemented.Categoriesofcausesofdegradation.Findingsconfirmedthatmanycausesofdegradationcanbecategorizedintothebroadcategoriesoftechnologyrelatedcauses,environmentrelatedcausesandhuman-relatedcauses.Thisresulthighlightstheimportanceofrecognizingcausesofdegradationineachcategory(ratherthanfocusingonlyonone,suchastechnologyfailure)inordertogainanecologicallyvalidandcomprehensiveunderstandingofdegradationinATC.Subsequently,inordertopredictandmitigatecausesofdegradation,causesfromallthreecategoriesmustbeidentified,aswellastheinteractionsbetweenthem.Therelationshipbetweencauseandsystemeffect.TherelationshipbetweendegradationcauseandeffectontheATCsystemwasconfirmedtobemoderatedbymanyvariables.Theoccurrenceofonecausecouldresultinnoeffect,orseparateeffectswithdifferingseverities.Moderatingvariablethatwerereportedincludedtheenvironmentalcontextofthecauseofdegradation,includingtheairspacecharacteristics,characteristicsofthesurroundingairspaceofthecontrolledsector,andtrafficlevel.Thesefindingsemphasizedthatthepotentialcausesofdegradationmustbeinterpretedwithincontextinordertopredictandmitigatetheoverallimpactinthesystem.Furtherresearchshouldbecompletedtoidentifyadditionalcontextualfactors,aswellasonlinemonitoringofthesefactorstopredictwhenasystemimpactismostlikelybasedonthecausespresent.Thisfindinghasimportantimplicationsforsystemdesigners.Byutilizinginformationregardingenvironmentalandhumanoperatormoderatorsandcomplexityfactors,itispossibletoidentifywhensystemsaremostvulnerabletosystemdecline.Designerscouldaccountforthiswithinadesigntradespace,forexample,byensuringthattoolsarenotvulnerabletosuchcomplexityfactors,orthattoolsshouldbeusedwithspecifictrafficcountsthatareappropriateforallsectorsandtrafficlevels.Theimplicationsofthisfindingarealsoimportantfortheriskassessmentprocessoftechnology,andvalidationspecialists.Testingandriskassessmentshouldconsiderpotentialhazardsandoutcomeswithinreal-worldcontexts,ofdifferentsectortypes,airspacecharacteristics,trafficlevelsandtype,andoff-nominaleventsthatcanco-occur,orrelatetoadditionaloff-nominalevents.Withouttakingintoaccountthewidercontext,technologyvulnerabilitiesandriskscanbeoverlooked.Controllerspreventandmitigatedegradation.Theimportanceoftheroleofthecontrollerinmodifyingtherelationshipbetweendegradationcauseandsystemeffectthroughpreventionandmitigationwasrepeatedlyhighlightedinthefindings.Ingeneral,potentialdegradationcausesthatareknownandexpectedhavealreadybeenmitigated,suchashardwarebackupsfortechnologyfailures.Controllersthereforemaintainsystemsafetybyidentifyingandrespondingtooftenunpredictable,dynamicevents.Theroleofthecontrollerinpreventingsystemdegradationiscritical.Thishasseveralimplicationsfor

systemdesign.Causesofdegradationthatcouldrelatetoperformanceinfluencingfactorssuchasworkloadshouldbeprevented,potentiallythroughtheapplicationofhuman-cantereddesignprocesses.Inaddition,timeandairspaceflexibilitywereidentifiedascriticalfeaturesthatenabledcontrollerstoadapttodynamicchangesinthecontrolenvironmentandrespondwithmitigationstrategies.Itiscriticalthatfuturesystemsaredesignedtosupportcontrollersinrespondingtothesedynamicsituations,bydesigningintheflexibilitythatisrequired.Forexample,infuturetrajectorybasedoperations(TBO),trafficefficiencywillbeincreasedthroughincreasedprecisionandreducedflexibility.However,maximumutilizationofthesystemintermsoftrafficloadingcouldremovetherequiredflexibilityandtimeneededbycontrollerstoimplementadifferentcontrolstrategy.Therefore,anoptimumleveloftrafficmustbeidentifiedandimplementedinsystemdesignwhichallowsforincreasedtrafficandefficiency,butstillincludesbuffersthatgivethecontrollerenoughtimeandflexibilityoftheairspacetorespondtodynamiceventsorrisks.Interactionsoccurbetweencausesofdegradation.Anovelfindingfocusedonthespecificationoftherelationshipsandpotentialinteractionsbetweencausesofdegradation,andthesubsequentassociationwithcontrollerperformanceandsystemimpact.Interactionscouldoccurasaresultofco-occurrenceorassociation.Identificationandunderstandingofinteractionsbetweensystemelements,andtheassociatedeffectoncontrollerandsystemperformanceiscriticalforthedesignofasystemthatcangracefullydegrade.Systemriskortolerancescannotbefullyunderstoodwithouttheconsiderationofinteractionsbetweencausesandpreventionmechanisms,andasaresult,cannotbemitigatedorprevented.Byfurtherunderstandingtherelationshipsthatcanoccur,predictionscanbemaderegardingwhendegradationismostlikely.Findingsfromthisstudyprovidedaninitialsteptoexploretherelationshipsbetweenthesecausesofdegradation.Futureresearchshouldfurtherinvestigateinteractionsandrelationshipsbetweendegradationcausesandassociationwithcontrollerperformanceandsystemeffect.Theconceptoffunctionalfailure.Anexampleofthepotentialconsequencesofinteractionrelationshipswastermedas‘functionalfailure’ofATCtools.Thisterminologydescriedasituationinwhichthetoolwasoperational,butduetointeractionswithothersystemsorvariables,thefunctionandpurposeofthetoolwasinhibited.Functionalfailurehasthesamepotentialconsequencesasactualfailureofthetool(asthefunctionisremoved)butwithoutthevisibilityofthetoolactivelyfailing.Potentially,mitigationsorcontingencyplansmaynotbeimplemented.Thisisimportant,ascontrollerscouldthenneedtocontrolwithoutthetool,withlevelsoftrafficthatarecalculatedbasedontheassumptionthatthetoolisfunctional.Dependingonthefunctionofthetool,andthebenefitsthatitprovides(suchasreducingworkload),functionalfailuremayhaveanegativeimpactoncontrollerorsystemperformance.Functionalfailuremaybepreventedthroughprioridentificationofthepotentialinteractionsthatcouldinhibitatool’sfunction.However,thepotentialoffunctionalfailurecanonlybeidentifiedthroughtheassessmentofinteractionsbetweenthetoolandothervariablesintechnology,theenvironmentandhumanoperator.Assessmentmethodsdonotoftentakeintoaccountsuchinteractions,resultinginalackofidentificationandguidanceofpotentialissuesresultingfrominteractions.Futureresearchshouldprovideguidanceforsystemdesignersandassessorstoidentifypotentialinteractionsthatcouldresultin‘functionalfailure’sothattheseoccurrencescanbe

prevented,ormitigatedthroughcontingencyplans.Systemenvelopeandimplications.Theimplicationsofinteractionsbetweendegradationcausesontheoverallsystemwererepresentedusingtheconceptofasystemtoleranceenvelope.Therepresentationhasnotbeenvalidatedandisonlyintendedtobeusedasavisualizationoffindings;however,itprovidesapresentationoftheassociationbetweeninteractionrelationshipsandtheoveralleffectonthesystem.Theconceptsuggeststhatasinglecomponentfailure,unlesscriticaltotheprovisionofcontrol,isunlikelytocreateasystemimpacttotheextentthatsystemlimits,ortolerances,arereached.However,thecombinationofseveral‘failures’,ordegradationcauses,cancombinetopotentiallycreateacompoundeffect,potentiallypushingsystemperformanceto,orbeyond,tolerancelimits.Futureresearchshouldcontinuetoinvestigateinteractionrelationships,andprovidespecificationofthelimitsofeachcomponent:technology,environment,andhumanperformanceenvelope,aswellassystemtolerancelimits.Furtheridentificationoftheseinteractionrelationships,andsystemtolerancelimits,couldallowthedesignofatradespacefordesignerssothatsystemperformanceremainswithinenvelopelimits,regardlessofthecontextofthecontrolsituation.FuturesystemdesignmusttakeintoaccounttheoveralltoleranceenvelopeoftheATCsystemtoguidedesignerstocreatetheabilityforgracefuldegradationandresilienceoffutureATCsystems.

09:40 Howdopilotsrespondtoafullytouchscreencockpit?Aninnovativehuman-centredapproachforassessingtheimpactofnewtechnologiesonhumanperformanceandoperationalsafety.VanessaArrigoni1,DanieleRuscio1,JimNixon2,RebeccaCharles2,MatthiasWies3,SylvainHourlier4,AliaLemkadden5,BarryKirwan61DeepBluesrl,2CranfieldUniversity,3DLR,4Thales,5CSEM,6EurocontrolTheintroductionofdigitalaviationinthecockpitisachallengingareaofresearch.InnovativeHumanFactorsapproachesarerequiredforadeepunderstandingofthehumanperformanceandsafetyimpactofnewautomationandinterfaces.Thepresentresearchproposesamixed-methodsapproachtoassesstheimpactofnewtechnologiesbylookingatacomplexandinteractingsetofhumanfactors.Whenassessingacceptanceofcomplextechnology-drivenmodifications,traditionalsingle-methodresearchdesignscangeneratefragmented,equivocaldatathatareoftendifficulttosummariseinacoherentandfunctionalway.Inthepresentresearch,aspecificmixed-methoddesignhasbeendevelopedandapplied,inordertogenerateamoreholisticunderstandingoftheimpactofnewtechnologiesonpilotperceptionandperformance.WithinProject6oftheEuropeanHorizon2020ResearchandInnovationProgramme“FutureSkySafety”(FSS),theusabilityandpotentialsafetyimpactofacompletelytouchscreencockpitwasassessed.OneoftheobjectivesoftheprojectwastoconductaseriesofflightsimulatorexperimentsinordertoidentifyperformanceboundariesusingtheHumanPerformanceEnvelope(HPE)framework.Ratherthanfocusingonasinglefactor,theHPEconceptcombinesasetofinterdependentfactors,aimingatimprovingunderstandingofhowthedifferentfactors,aloneorincombination,influencepilots’performanceand,inturn,thesafetyofflightoperation.Theprincipalfactorsselectedforanalysisontheprojectwerestress,workloadandsituationawareness.Thesefactorsareallregardedasimportantacrossaviationoperations.

TovalidatethemixedmethodapproachwithintheHPEframework,aseriesofexperimentaltrialsweresetupusinganovelcockpitinterface,developedbyThales.

Thenoveldesignisbasedonaninnovativeoperationalconceptandmakesextensiveuseoftouchscreentechnologiesforflightmonitoringandplanning.Challengingscenariosweredevelopedandtestedondifferentconfigurationsofthecockpitinterface(HMI)–current,augmentedandadvanced–inordertomeasureHPEvariationsandthustheimpactonpilotperformanceandoperationalsafety.Thetwomainexperiments–oneusingaconventionalmovingflightsimulator,theotheranadvancedcockpitsimulator–eachlastedtwoweeksandoverallinvolvedatotalofthirtyA320FirstOfficersfromamajorEuropeaninternationalcarrier.Amongthedifferentmeasurescollectedduringtheexperiments,eye-trackingdata(Figure1),physiologicaldata(Figure2)andusabilityquestionnaires(Figure3)werecombinedusingamixedapproachdesign.

Figure1:Heatmapbasedoneye-trackingdata

Figure2:RRintervalscalculatedbythesmartvestvsbiopacsystem

Figure3:PerceivedimpactonSAresultedfromtheusabilityquestionnaireTheresultsshowedthebenefitsofusingqualitativedatatointegrate,complementandconnectthequantitativedatadescribingthedifferentHPEfactorsininteractionwiththenewcockpit.Forinstance,thetimespentbythepilotslookingattheSystemDisplay(SD)wassignificantlyaffectedbythedifferentconfigurationsoftheHMI,andthequestionnaireshowedwhichelementsoftheSDactuallysupportedthepilotperformanceandwhichinterferedwithit.ThecombinationofthequalitativeandquantitativedatahighlightedtheimpactofthedifferentHPEfactorsandpilots’performance,aswellasleadingtousableinsightsforthedesignofthenewHMI.Theapplicationofthisinnovativemixedapproachwassuccessful,resultinginapromisingapproachforfutureevaluationofpilots’situationawareness,workloadandacceptanceofadvancedHMI,andmoregenerallyfortheassessmentoftheimpactofdigitalaviationonhumanperformance.Anenrichmentofthemixedapproachcouldbeusedtoaddressthetransitiontohighertechnologyandautomationlevelsinaviation,byaddressing,analysingandmitigatingitsimpactontheassociatedfactorsoftheHumanPerformanceEnvelope.

10:05 Drivingautomationversusaviationautomation:Whatcanwelearn?VictoriaBanks,KatherinePlant,KatieParnell,NevilleStanton,UniversityofSouthamptonTheaviationindustryhastraditionallybeenattheforefrontoftechnologicalinnovationintotheuseofautomatedsystems.However,inmorerecentyears,significantprogresshasbeenmadeinthefieldofdrivingautomation,leavingmanyquestioningifthereareanycrosssectorallessonstobelearnt.Itistimelytobringtogethertheknowledgegleanedfromaviationanddrivingresearchinanattempttoconsolidateourunderstandingofthehumanfactorsimplicationsofautomationimplementationacrossdomains.Historically,automationwasviewedasameanstoreduceoperatorworkload,thusleadingtoimprovementsinsafetyandefficiency(aswellasreducingthecrew).Initially,automatedsolutionstargetedthephysicalaspectsofatask(e.g.automationofphysicalcontrols).Itthensoughttoautomatemoreofthetactical(e.g.respondingtoevents)andstrategicaspectsofthetask(e.g.determiningdestination,seeWalkeretal.2017).Regardless,themainintentionofautomatedtechnologieswastosupporttheroleofthehumanoperator.However,therehasbeenashiftinhowautomationhasbeenutilisedintheautomotivedomain.Automationisnowseenasameanstorevolutionisethedrivingexperience,asitshowspotentialtoimproveproductivitytimeandincreasesocialmobility.However,itisimportanttorememberthat‘safety’wasalsotheoriginalreasonforintroducingautomationintothedrivingdomain.InEurope,thiswasdrivenbytheEuropeanNewCarAssessmentProgramme(EuroNCAP)whichencouragedmanufacturerstoexceedminimalsafetyrequirementsrequiredbylaw.EuroNCAPhaveaninternationallyrecognisedFiveStarRatingSchemethataimstoprovidenewcustomerswithtransparentsafetyinformation.Itwasrecognisedthattheconsumermarketplacemaybeinfluencedbysuchratingsandasaconsequence,significantprogresswasmadeasindividualmanufacturerspushedtoachieveaFiveStarrating.Despiteclearoperationaldifferences,itispossiblethataviationmaynowlearnfromthelessonslearnedwithintheautomateddrivingfield.Forexample,theunderlyingdesignphilosophysurroundingimplementationdiffersbetweenthetwodomains.Withinaviation,therearetwocorephilosophies:‘soft’and‘hard’automation.‘Hardautomation’essentiallypreventshumanerrorbecausethesystemcanoverridehumaninputs(Youngetal.2007)whereas‘softautomation’canbeoverriddenbythehumanoperator.Bothstrategiesusethesamesetofsensorsandcontroldevicesbuttoverydifferentends(Youngetal.2007).Drivingontheotherhandutilisesacompletelydifferentapproach.AccordingtotheNationalHighwayTrafficandSafetyAdministration(2013),technologiescanbeconsideredtobeboth‘soft’and‘hard’.Forexample,abasicLanekeepingAssistwillpreventunintendedlanedeviationsbygentlynudgingdriversbackintothelane.Driversareabletooverridethisatanypointandisthereforerepresentativeofa‘soft’system.TheAutonomousEmergencyBrakesystemontheotherhandrepresentsaformofhardautomation,asitwillautomaticallytriggeroncecollisionthresholdshavebeenmet.Whilstthereareanumberofdesignphilosophiesinwhichautomatedsystemsmaybedesigned(e.g.theleftoverprincipleorthecompensatoryprinciple),inrecentyearsthereappearstohavebeenmuchmoreemphasisplaceduponthecomplementarity,or‘sharedcontrol’approach.‘Sharedcontrol’isbasedupontheideathatthehumanoperatorandautomated

systemcanworkcooperativelytogether(Groteetal.1995;Hollnagel,2003).Thisisparticularlyrelevanttotheintermediatephasesofautomationindrivingwherebythehumanoperatorremainsacriticalcomponentwithinthesystem.However,italsoappearstobeparticularlyrelevanttotheaviationdomain,giventhatBillings(1997)arguesthatthehumanoperatorremainsthepinnacleofthecontrolhierarchy.Interestinglyhowever,thereislimitedliteratureavailableonsharedcontrolwithintheaviationdomain(anotableexceptionincludesGoodrichetal.,2008).Further,fromatheoreticalviewpoint,researchintodrivingautomationhasplacedparticularemphasisuponthesociotechnicalaspectsofthesystem,inrecognitionthatmultiplesubsystemsoperatesimultaneouslytoachieveasharedcommongoal.Typically,researchhasfocusedonoperationsinvolvingmultipleoperatorsandafunctionalsubsystem(e.g.thecrewandflightdeck)butthisonlyprovidesameso-levelaccountofthesystem.Instead,Banksetal.(2017)arguethatwecanalsoanalyseasystematamicro-level(i.e.focusuponoperationsbetweentheoperatorandspecificsubsystem)andatamacro-level(i.e.focusuponoperationsbetweenallactorsinvolvedinthesystem).This‘levelsofanalysis’approachisparticularlyrelevanttoaviationbecauseitprovideameanstoexploretheimpactofnewproceduresandoperations,aswellastheknockoneffects,ontheentiretyofasystemratheranindividualcomponentsinisolation.Thepurposeofthispaperistofurtherexplorewhatmaynowbegleanedfrominnovationswithintheautomateddrivingdomain.

Session6:Improvingnon-technicalskills

11:00 Passivesidesticksandhardlandings–istherealink?FlorisWolfert,MichaelBromfield,SteveScott,AlexStedmon,CoventryUniversityOverthepast10years,thenumberofcommercialaircraftequippedwithpassivesidestickshasincreasedbyover250%(ACAS2018,CAPA2018).However,apassivesidestickmakesitdifficultforthePilotMonitoring(PM)toperceivetheflightcontrolinputsbythePilotFlying(PF)andlimitseffectivemonitoring.AspartofaprogrammeofresearchintoLossofControlInflight(LoC-I)focusingontheeffectsofactivecoupledsidesticksonpilotworkload,performanceandsituationawareness,thisstudyinvestigatedaccident/incidentreportsforhardlandingsinvolvingjetaircraftfittedwithconventionalcoupledcontrolinceptors(yokes)andpassivesidesticks.Hardlandingsthatoccurredduetomechanicalfailuresorcontributingweatherareexcludedinthisstudyresultingin47accidentreports,publishedby22differentaccidentinvestigationauthorities.Theseaccidentswerecomparedtotheirapproximatenumberofflightcyclestoaccountfortheirexposure.Theresultsshowedthatcommercialaircraftwithpassivesidesticksaresignificantlyoverrepresentedinthehardlandingaccidentdata.Whilepassivesidestickaircraftrepresented31%ofthetotalflightcycles,theywereassociatedwith47%ofhardlandings.Withrespecttopilotexperience(totalhoursontype)asignificantdifferencebetweenthetwogroupsassociatedwithconventionalandsidestickaircraftwasobserved.Hardlandingswithpassivesidestickaircraftoccurredmorefrequentlywithlessexperiencedpilotscomparedtopilotswithsimilarexperiencelevelsonaircraftwithconventionalflightcontrols.Thesedifferenceswerealsoapparentduringunstableapproaches,oftenapre-cursortoahardlanding(IATA2016,Matthewsetal.2004).Theresultsshowonly26%ofthehardlandingswithpassive

sidestickaircraftwerecausedbyanunstableapproachcomparedto74%oftheaccidentswithconventionalflightcontrolledaircraft.Theseresultssupportthecurrentliteraturebytheremovalofthephysicallinkagesbetweentheflightcontrolsthatthenremovesoneofthelinesinwhichpilotscommunicate.Thishasproventobeessentialforthedevelopmentofflyingskills,especiallyforinexperiencedpilots(ReesandHarris1995,Uehara2014).Fromthisresearch,thereisaclearindicationthatpassivesidesticksincommercialaircraftmaybeintroducingcomplexhumanfactorsissuesofuserinteractionandcrewresourcemanagement.Thesewillbeexpandedanddiscussedinthefullpaperandpresentationastheyprovideabasisfortheresearchthatfollows.

11:25 Whenhumanfactorsandsafetywalktogether:amultidisciplinaryexperience.LuisBallesteros-Sánchez,MiguelCapoteFernández,MaríadelPilarReyesMoreno,TatianaRuedaMartínez,FelipeSaizMonsalve,InecoINTRODUCTIONANDOBJECTIVESINECOisanengineeringandconsultancyfirminvolvedindevelopingasafeandsustainableinfrastructureintransportation.Inparticular,therailwayandairnavigationsafetyareashavebeenworkingformanyyearsincarryingoutsystemriskassessments,ensuringtheyaresafeforoperation,asanessentialaspectofchangemanagement.Humanfactorsrelatedissuesarethecauseofmostaccidentsintransportation.Thisfact,andourneedforfurtherevolutioninsafetymanagement,hasmovedInecotoaddressthehumanelementmorethoroughlyandexplicitlyinsafetyassessmentsinordertomakesystemdesignmorefittohumanneeds.Whenanalysingthehumanelementwithinriskassessment,ourexperienceprovedthattheresultingsafetyrequirementswereoftentoogeneric.Ourobjectivewastoobtainmoredetailedrequirementsabletoimprovehumanperformance.Forsuchpurpose,weanalysedvalidatedHumanFactorsmethodologiesandtechniqueslikeHEART(HumanErrorAssessmentandReductionTechnique)(6),whichwerenotusuallylinkedwithsafetystudies,inordertoextract,simplifyandintegratetheminoursafetyassessmentprocess,makingittransversalandapplicabletoanytransportsector.ACHIEVEMENTSANDRESULTSSince2016,Inecohasworkedinseverallinesofactiontoachievetheseobjectives,includingself-fundedinnovationprojects(1),multidisciplinarycoordinationbetweenrailway/airnavigationareasanduniversities,traininginHumanFactorsandparticipationincongresses(2)(3).FromathoroughanalysisofHumanFactorsscienceandmethodologies,westartedtoextractdifferenttoolsandtechniquesandapplythemtocasestudies,makingadaptationsandsimplificationswhereneeded,anddevelopingaswellourowntoolsandtechniques.AgenericmethodologyforHumanFactorsIntegrationinSafetyAssessmenthasbeendesignedandincorporatedtotheinternalprocedures.

Sincemostsafetyassessmentsarefailure-centric,identifyinghazardstomitigatetheirrisks,theapproachtakenonhumanfactorsfocusesonhumanerror,fullyaligningtheanalysiswiththesafetyassessment.WehavedesignedaprocessthatincludesanadaptedHumanReliabilityAssessment(HRA)tobeexecutedinparalleltothesafetyassessment,matchingeachstageinanintegratedandtraceablemanner.Taskanalysisbroadensthesystemdescription,identifyingalltherelevanthumaninterventionsandwhereerrorscanoccur.Itiscrosscheckedwiththehazardslist,andHumanErrorfailuremodesaredeterminedbymeansofHumanHAZOP,inlinewiththeusualhazardidentificationtechniques.Wehaveintroducedataskclassificationaccordingtoparameters,insteadofHEART’sgenerictasktypes,providinganoverallweightforeachtask,indicatingitspotentialforhumanerror.Toconnectwiththesafetyassessment,cause/effectanalysishelpsunderstandingthecontributionoftheidentifiederrorstosafetyhazardsandtheircriticalityorrisklevel.ThelistsofErrorProducingConditions(EPCs)usedinHEARThavealsobeenadaptedinordertoproduceamoreusablelistofgenericPerformanceShapingFactors(PSF)affectingthehumanperformance.Fortaskparameterweighting,PSFidentificationandassessmentwehavetestedtechniquessuchasquestionnairesorworkshopsessions,alwaysfoundingtheanalysisonexperts’judgment.Combiningthethreeaspects–taskpotentialforerror,errorcriticalityandperformanceshapingfactors–weareabletoestablishordersofprioritiesforthehumanerrorreductionprocess.Initially,measuresweredeterminedusingtheNARA(NuclearActionReliabilityAssessment)approach(7).Inalaterstageofmaturity,InecohasdevelopedFARHRA(FeasibleActionRulesforHumanReliabilityAssessment),providingabroadersetofgenericmeasuresandmorealignedwiththesystemviewinsafetyassessment.CONCLUSIONSANDFURTHERWORKIneconowhasthecapabilitytointegrateknownHumanFactorstechniquesintoastandardsafetyassessment,inamannereasilyapplicablebysafetypractitioners.Newtechniqueshavebeendeveloped,likeFARHRA,forabetterintegration.Inaddition,severaltoolssuchasHAZOPsessions,interviews,focusedsurveysorquestionnaires,areusedandcustomizedtoobtainthemostoutofexperts’opinion,themaininputfortheseanalyses.Thenextstepwillbetheimplementationofourknowledgeandexpertiseinthisareainsafetycasesforaviation,railwayorothersectorsinordertoverifyitsinternalandexternalconsistencyandreliability.Thefinalresultwillbeanenhancedsystemdesignderivingspecificrequirementstoimprovehumanperformance,increasingsafetylevelsandaddingvalueandrecognitiontothehumanrole.

11:50• Keynote:Theparadoxofintuition.• LaurieEarl,JimSheffield,NewZealandCivilAviationAuthority•

OnJanuary15,2009,USAirwaysFlight1549hitgeeseshortlyaftertakeofffromLaGuardiaAirportinNewYorkCity.Bothengineslostpower,andthecrewquicklydecidedthatthebestactionwasanemergencylandingintheHudsonRiver(Eisen&Savel,2009).IntestimonybeforetheNTSB,CaptainSullenbergermaintainedthattherehadbeennotimetobringtheplanetoanyairport,andthatattemptingtodosowouldlikelyhavekilledthoseonboardandmoreontheground.Exactly3mins28secshadelapsedfromthetimeofthebirdstriketolandingonthewater-thecrewhadmadeasplitseconddecisioninahighlyvolatilemoment.TheBoardultimatelyruledthatSullenbergerhadmadethecorrectdecision(Atkins,2210)Astechnologymovedfromanalogouscockpitstoflybywiretechnologytheaviationindustrybegantoseemanymoresuch‘blackswan’events–thatiseventsthatwereunusual,thatsurprisedthecrew,orthathadneverhappenedbeforesocouldn’tbetrainedfor(Wickens,2009).Thispaperexploreshowpilotsmakedecisionsincomplexsituations,whentheycan’trelyonproceduresandwheregeneratingmultipleoptionsdoesn’talwaysmakesense.Primarilyweexaminehowemotions–asopposedtorationalthinking–influencedecisionmakingandwhytacitknowledgeplaysamoreimportantpartthanoriginallythought.Tacitknowledgebeingthatpieceoftheicebergthat’sbelowthesurface–wedon’tnoticeitandwecan’teasilydescribeit(p35).Inotherwords-“Howwethinkanddecideintheworldofshadows,theworldofambiguity”(Klein,2011)Wedisputetheassumptionofhumanrationalityandconsiderhowemotionalimpulsessecretlyeffectjudgementandtheinfluenceofexperienceandknowledgeondecisionsmadeunderextremecircumstances.Thisdiscourseexamineshowtheexperthasbuiltuparepertoireofpatternsthataren’tbasedonfactsorrulesorprocedures.Insteadtheyarebuiltonalltheeventsandexperiencestheyhavelivedthroughandheardabout.Thisisthebasisforintuition(Klein,2011).Assuchweneedtobedirectingpilottrainingtodiscover,recogniseandplanforadverseevents.Currentlyweareintentonreducingerrorsandnotenoughonbuildingexpertise(Klein,2011).Theparadoxofintuitionisthatemotion(‘gutfeelings’)mustinformreason(cognition)andreasonmustinformemotion.Weexplorethisparadoxthroughthelensviaaresearchframework(thedual-processmodel)whichplaysanimportantintegratingroleinthecurrentbehaviouraldecisionmakingliterature(Evans&Stanovich,2013;Kahneman,2011).Whiletheterminologyandapplicationdomainsofthedual-processanddual-systemsmodelsvary,thereisconsensusoncoreconcepts.Evans&Stanovich(2013)statethat:“Ourpreferredtheoreticalapproachisoneinwhichrapidautonomousprocesses(Type1)areassumedtoyielddefaultresponsesunlessintervenedonbydistinctivehigherorderreasoningprocesses(Type2).WhatdefinesthedifferenceisthatType2processingsupportshypotheticalthinkingandloadsheavilyonworkingmemory.”Applicationdomainsofthedual-processmodelincludeaviation,themilitary,andhealth.

Croskerry(2009)observesthatdual-processtheorysupportssimplifiedmodelsthatcanbereadilytaughttolearnersacrossawiderangeofdisciplines.Inparticular,“anunderstandingofthemodelallowsformorefocusedmetacognitioni.e.thedecisionmakercanidentifywhichsystemtheyarecurrentlyusinganddeterminetheappropriatenessandtherelativebenefitsofremaininginthatmodeversusswitchingtotheother.”Thedual-processmodelcomplementsmoredetailedapproachessuchasneuroergonomics(Parasuraman&Rizzo,2007).Itisbasedonassociativeprocessesinintuitivejudgment(Kahneman&Klein,2009;Morewedge&Kahneman,2010)andneurologicalprocesses(i.e.,emotionvsreason)thatareexperiencedbydecisionmakers(Kahneman&Klein,2010;Sheffield&Margetts,2016)innaturalisticsettings(Klein,2008).Trainingbasedonthedual-processmodelmayincludedecisionscenariospresentedintheformof‘serious’videogames(Morewedge,2015)andchecklists(Gawande,2009).‘Metacognitivemoments’embeddedincomplexdecisionprocesses(Gawande,2009;Sheffieldetal,2017)serveastheoccasionbothforpossibletransitionsbetweensystem1andsystem2,andforcriticalreflectiononhowcognitivebiasesmayreducesituationawareness.(Figure1)Essentiallythispaperexploreshowthehumanmindmakesdecisionsandhowtomakethosedecisionsbetterinacomplexaviationenvironmentwhereaccidentsarebecominglesspredictable.Weexplorewhytheseintuitivedecisionsaresometimeswrong(AF447),butoftenright(QF32,HudsonRiverlanding,AlHaynes).Lehrer(2009,p4)arguesthat“Thereisathinlinebetweenagooddecisionandabaddecision.”Thispaperisaboutthatline.

Session7:Groundhandling

13:30 Advancingsafetyculture–asharedapproachataUKairport.AnamParand1,TomReader1,BarryKirwan2,SianBlanchard31LondonSchoolofEconomics,2Eurocontrol,3easyJetIntroduction:theproblemcontextWhentalkingofchangemanagement,thereisan‘elephantintheroom’,aconstantdriverforchangeinaviation,namelycostpressure.Itisahighlycompetitiveindustry,asevidencedbyairlinesgoingbankruptandoccasionallybeingrescued(oratleastpartly)bylegacyornewand

leanerlowcostairlines.Indeed,thelowcostmodelthreatenslegacyairlines,andsomearguethatthese‘newbies’arenotonlymoreefficientandmoreinnovative,butarealso–sofar–justassafeastheirlonger-standingcounterparts.Buteveryoneworriesthattheremustbesomeunknownandpossiblyunknowablesafety‘redline’thatwillonedaybecrossed,leadingtoaccidents.Insuchhardtimes,itistemptingforsomecompaniestoadoptanisolationistmentalityandguardtheirwell-earnedsafetydataandpractices,andwaitforothercompaniestoslipup.YetthisgoesagainstanotherdriverinEurope,namelytheEuropeansafetyregulator’s(EASA’s)mandatetocollectsafetydatafromallaviationcompaniesinordertolearngenerallessonsforsafetyacrosstheEuropeanspectrum.Thequestionthen,isasimpleone:howtopersuadeaviationcompaniestosharesafetydataandlearning,insuchacompetitiveenvironment?Thispaperfollowsathreadofsafetycultureworkthathasdeliveredoneanswertothisconundrum,viawhathasbecomeknownastheSafetyStackapproach,outlinedbelow.TheresearchavenueResearchhasestablishedalinkbetweenanorganisation’spoorsafetycultureanditspropensityforaccidents1.Inresponsetothislink,theaviationindustryhasstartedtointroducemeasurestoassessthesharedsafety-relatednorms,values,andpracticesthatmakeupsafetyculture2.Thesemeasurestendtofocusonthecultureofoneindividualorganisationusingonemethodofassessment.Yet,aviationorganisationsarepartofawidercomplexnetworkor‘stack’ofgroupsandcompaniesthatworksidebysideonadailybasistoprovidesafesystemsandservicesforstaffandcustomers.Aviationrisks,therefore,inevitablycrossorganisationalboundaries.Ourresearch,fundedbytheEuropeanCommissionaspartofthe‘FutureSkySafety’initiative,suggestsamorefruitfulapproachtotheexaminationofsafetycultureinaviation.WepresentthisintheformofacasestudyinvolvingsixcompaniesallworkingatoneairportintheUK.MethodThestudyemployedasequentialmixed-methodsdesignthatconsistedofthreephases.Thefirstphasecomprisedaquestionnairemeasuringorganisationalsafetyculture,distributedbothelectronicallyandinprintedform,vianewsletterandemailpromotions.ThequestionnairewasadaptedfromapreviouslyvalidatedEUROCONTROLsafetyculturesurveyusedinAirTrafficManagement3.Thiswastailoredtoallthedemographicgroupsworkingacrosstheairport.Themeasurecontainedatotalof50itemscoveringeightsafetyculturedimensions:ManagementCommitmenttoSafety;Collaboration&Involvement;JustCulture&IncidentReporting;Communication&Learning;ColleagueCommitmenttoSafety;RiskHandling;Procedures&Training;andFatiguemanagement.Anadditional‘inter-group’sectionwasincluded,whichelicitedopinionsonstafffromotherworkgroupsandcompanies.Demographicquestionsincludedjobrole,tenureandcontracttype.Thesecondphaseofthestudyinvolvedeightqualitativefocusgroupsattendedbyaselectionofstaffrolesthatrepresentedthosethathadparticipatedinthesurvey.Thisaimedtoconfirm,explainandexemplifyresponsestothesurvey.Thefinalfocusgroupbroughtallparticipatingorganisationstogethertoshowthemthecollectiveresults.Finally,Phase3involvedacontinuousprocessof1-2dayworkshopseverythreemonths,connectingseniorstakeholdersfromeachoftheparticipatingcompanies.Sevenworkshops

havesincebeenheld,andthecurrentmembershiphasgrowntofifteenorganisationsatLutonAirport.ResultsIntotal,therewere594questionnaireresponses(34.6%responserate)fromtheairport,airline,groundhandling,airtrafficcontrol,fire-servicesandde-icing.Theresultsshowedsomecommonsafetyculturetrendsamongthedifferentpartnersofthestack.However,AnalysisofVariance(ANOVA)testsshowedsignificantdifferencesacrossorganisationsforallsafetyculturedimensions,withtheexceptionoffatiguemanagement.Presentationoftheseresults,alongsiderationaleprovidedbythefocusgroups,enabledstack-widediscussionsthatfacilitatedinter-organisationallearning.Duringthisfirstmeeting,allsixorganisationsdecidedtodeclaretheirconfidentialresultstooneanother,becausetheywantedtoknowwhatwasbeingdonebetterbytheirbusinesspartners.Oncethiswasdone,thesepartnersquicklydecidedthatthiswasnotaone-off,andthattheyshouldcontinuetoworktogetheronsafetyandsafetycultureatLutonAirport.TheStackprocesshasresultedinpracticalimprovementsandaseriesofsafety-relatedgoals,suchasharmonisedgroundhandlingprocedures,asharedsafetydashboardandasafety‘App’tospreadinstantkeymessagesacrosstheairport,asafetyleadershiptrainingandcertificationapproachacrosstheorganisations,andworkonharmonisingJustCultureacrosstheorganisationsisongoing.Inparticular,companiesarebeginningtosharedata,andreportingthatnotonlyaretheyfindingsafersolutionsquicker,butthatsuchsolutionsappeartoleadtoefficiencyimprovementsatthesametime.TheapproachiscurrentlybeingrecognisedandheldinhighregardbyIATAforotherairports,asarolemodelandwayforward.ConcludingcommentWhetherotherairportswouldalsoneedasafetycultureinterventionorprogrammeinordertoachieveastack-likesafety-sharingsystem,remainsanopenquestion.ThehopeisthattheStack‘experiment’willmigratetootherairports,andsomeairportshavealreadyshownearlyinterest.Inthecurrenteconomicclimate,itisunlikelythatacademicargumentsalonewillpersuadeseniormanagementofaviationorganisationstotreadsuchapath,andlowertheir‘safetydatadrawbridge’.ButtheaccumulatingevidencefromLutonthat‘better-cheaper-safer’isactuallypossibleviasuchasafety-sharingapproach,isgatheringmomentum.

13:55 AnalyticalapplicationoftheSystematicHumanErrorReductionandPredictionApproach(SHERPA)topredictandreducehumanerrorsinaircraftpushbackoperation.NgYangSiong1,HamadRashid21ChangiAirportGroup,Singapore,2UniversityofSharjah,UAEThereisanincreasingtrendinrampaccidentsworldwide,buttheresearchconductedtodateinthisareaisstillquitelimitedandnotasextensivecomparedtothatofflightandaircraftmaintenancesafety.Therelevantexistingstudiesfocusmoreonrampsafetyholistically,anddonotgointothedetailsofhowsafetyofarampoperationcanbeimproved.Assuch,thisstudyappliesahumanerroridentification(HEI)techniqueknownasSystematicHumanErrorReductionandPredictionApproach(SHERPA)tolookattheair-craftpushbackoperationstopredicthumanerrors,particularlythoseassociatedwiththeteamworkoftheheadsetoperatorandtugdriver,whichoccurwhencarryingoutthepushbackoperation.Pastrampaccidentreportswerealsocompiledandreviewedtoprovidemorein-depthinsightstotheproblem.SomeofthekeyerrorsidentifiedfromtheSHERPAanalysisrelatetotheabilitytocheckthatthe

pushbackpathisclearofobstructions,howthetugmanoeuvresthepushback,andthecommunicationbetweentheheadsetopera-torandtugdriver.Severalbestpracticesweresimilarlyidentifiedwithintheparticipantgroundhandlingagent(GHA).Basedonitsfindings,thisstudyproposesanewtechnologicalconceptthatcanhelpenhancingthesafetyofaircraftpushbackoperations.Italsoprovidedagenericmethodologicalapproachtoimprovesafetycriticaloperationswithinhigh-riskindustries.

Session8:Implementingchange

14:50 Softsystems,hardtalk-whataviationmiddlemanagersreallythinkaboutsafetyandhumanfactors.BarryKirwan,CorinneBeider,TizianaC.Callari,andBeatriceBettignies-ThiebauX,Eurocontrol,ENAC,&TrinityCollegeDublinWhilethereismuchwrittenonhowtopexecutivescanleadsafetyinhighriskorganisations,andevenmoreonhowtomotivatepeopleatthe‘sharpend’onsafety,almostnothinghasfocusedonmiddlemanagers.Yetethpeopleatthisintermediatelayer,whoserveasverticalandhorizontalintegrators,transmittingtheBoard’sstrategyandobjectivesintoactionsandcollatingandfeedingkeymessagesupwards,arecriticalindeterminingthecoherenceofsafetycultureinorganisations.Putsimply,staffdocarewhattheCEOthinksandsays,buttheycaremoreaboutwhattheirbossandhisorherbossthinksandsaysaboutit.InseveralsafetyculturesurveysintheEuropeanairtrafficdomain,itwasfoundthatsafetycultureeffortscouldbecomedilutedoreventhwartedatthismiddlelayer,despitestrongsafetydirectionfromaboveandsterlingcommitmentdownbelow.TheFutureSkySafetyproject,focusingonhowtoimproveorganizationalsafety,thereforedecidedtoaddressthisrarelybreachedarea,whichwecalledtheundiscoveredcountry.MiddleManagersweredefinedasmanagerswhowerenotatBoard(director)level,butonlyhadothermanagersreportingtothem.Thisruledoutsupervisors,forexample(whohavebeenwell-addressedintheliterature),andinsteadfocusedonthoseinthemiddleandupperlayersoforganisations.Aninterviewapproachwasdevelopedintwostages,and48middlemanagersfromnineaviationorganisations,includingairlines,anairport,airtrafficorganisations,andairframemanufacturers,wereinterviewedconfidentially,eachinterviewtakingapproximatelyonehour.Thesewerenotsafetymanagers,butallofthemwouldhavetooccasionallyaddresssafetyintheirday-to-daybusiness.Acodingsystemfortheresponsesandinsightswasdevelopedandvalidatediteratively,andtheresultsweresynthesizedintobothadescriptiveandanexplanatorymodel.Thecurrentphaseoftheworkisdistillationoftheinsightsintoashort‘reflectiontraining’workshop,soastohelpmiddlemanagersseehowtheirroleandbehaviorcanshapeandleadsafety.Whattheyseeinthisworkshopishowmiddlemanagersfromotherorganisationsconsiderandleadsafety,whetheringatheringinformationormakingdecisions.Oneofthecriticalaspectsfromthisresearchhasfocusedonthemiddlemanagers’mindset,inotherwords,whathasledthemtoconsidersafetyinthewaytheydo.Oftenthismindsetisformedearlyon,andmayhavelittletodowiththeircurrentjob.Theinterviewsalsoaskedwhatmiddlemanagersneededfromabovetosupportthemwhentheyneedtoputsafetyaboveothercommercialconsiderations,andwhethertheyreceivedsuchsupport.TheinsightsrelatetoHumanFactorsintwoways.Firstly,thishasbeena‘softsystems’

approachtoexploringtheenhancementofsafetyleadershipandsafetyculture,andhasyieldedvaluableinformationwhichcanserveas‘levers’toimprovesafetyintheorganisationsandthereforeaviationasawhole.Secondly,althoughmostmiddlemanagerswerestronglyfocusedonpeopleissues,theroleofHumanFactorswasnotalwaysevident.ThisleadstoaneedforHumanfactorstoreflectonhowitis‘speaking’tothiscriticallayerinbusinesses,whetheraviationorotherwise.

15:15 Managingthesafetyimpactofchange–AnapplicationofIRiSinthegroundATMenvironment.AndrewKilner,MartaLlobetLopez,IanCrook,EurocontrolIRiS(theIntegratedRiskPictureforEurope)isawebbasedframeworkthathostsasetofATMriskmodels.Theriskmodelsdescribethedifferenthumanandsystemcontributorstosafetyintheformofabarriermodelfordifferentaccidentcategories;mid-aircollision,runwaycollision,runwayexcursion,controlledflightintoterrainetc.IRiSwasbuiltusingincidentinvestigationsfrom13AirNavigationServiceProvider(ANSP)partnersinEuropeandrepresentsasummaryofover300occurrences(themajorityhavinghumancentredcauses).TheIRiSmodelsshowthehumanandtechnicalcomponentsofbarriersthatmitigateriskanddescribetypicalsafetyrisks(humanperformancefailuresandhumanperformancestrengths)experiencedinEurope.Themodelscanbepopulatedwithlocaldata(asingleairportoranentireANSP/FAB),oruseapre-existingECACquantificationtoprovideaquantitativevalueofriskandANSPexperiences.ThequestionwasposedbyanANSP:givenabaselineofrisk(aquantifiedIRiSmodel),isitpossibleto“feedin”changestotheoperationandshowareciprocalshiftinsafetyrisk?Atrialwasthereforearrangedforamajordualrunwayairportairtrafficmanagementoperation,andfocussedontheuseoftheIRiSrunwaycollisionmodel.Threechangeswereassessedforsafetyimpacts:

• Revisedgatepositioning(Echogate)• Newhelicopterprocedures(Heli)• Newrunwaystatuslights(Stop)

TheIRiSRunwayCollisionModelwastailoredqualitativelytothelocalairportoperationbyreviewingthemodelagainstaseriesofrunwayincursionandotherrunwaycentricincidents.TheimpactofthechangeswerethenassessedusingtheIRiSplatforminaprocessknownasafocussedscoringsessionby23participantsataworkshopinattheairport.ThewholeprocessisknownassafetyimpactassessmentandprovidesafirstpassatestimatingthesafetyriskimpactofmultiplechangesonanATMoperation.Theresultsofthetrialshowedthedifferenceinsafetyimpactforeachofthethreechangesandforcombinationsofchanges.i.e.themosteffectivecombinationofoperationalchangesforsafetycanbederived.UsingtheIRiSframeworkalsoshowedhowdifferentsafetyimpactscouldbeexpectedatdifferentATMbarriers.Thefiguresbelowshowthepredictedchangeinfrequencyofrunwayconflictsandrunwayincursionin‘eventsexpectedperyear’.

Figure1:Changeinfrequencyofrunwayconflicts

Figure2:Changeinfrequencyofrunwayincursions

IRiSalsoallowsanestimateofthenaturalincreaseinriskarisingfromtrafficgrowth(moretraffic,morerisk).Thismeansthatforeachoperationalchange,itsbenefitsareerodedovertimeuntilnaturalrisk‘eats’allthesafetybenefit.IRiSprovidesauniqueviewofwhennaturalriskincreasesandnewoperationalinterventionsarerequiredtomaintainsafety.Figure3belowshowsforhowlongthesafetybenefitofeachoperationalchangeorcombinationofchanges(thereductioninRunwayIncursion[RWYINC]andRunwayConflicts[RWYConf])willbesustainedbeforebeingerodedbytraffichazardincrease.Thelineendswhenthebenefitofthechangeiseffectivelyreducedtozero(incomparisontothebaseline)bytrafficincrease.

Figure3:IRiSpresentationofsafetyimprovement&riskevolutionforoperationalchangecombinations

TheoutcomeofthetrialshowedthattheIRiSapproach:• Providedamechanismforhighlightingandcollatingtheexpertopinionofdifferent

operationalpeople(Controllers,vehicledrivers,pilots,safetyexperts,managers,etc.)ontheimpactofoperationalchangesonsafetyrisk.

• Showedthatdifferentsafetyprioritiescouldbeestablishedduringthescoringsessions,andthatdifferentpopulationsofusershaddifferentopinionsontheextentofoperationalsafetyimpacts.

• Illustratedhowtheplatformprovidedalinkbetweenthestructureofthemodelandtheincidentsexperiencedlocally,byshowingforeachincidentwhichbarriersarechallengedandwhichsafetydefencespreventincidentsdevelopingfurther.

• Clearlyshowsthehumancontributiontooperationalsafetyandhowchangesinoperationalprocedureswillimpactonhumanperformanceandthehumancomponentofsafety.

RWYConfRWYInc

RWYConfRWYInc

RWYConfRWYInc

RWYConfRWYInc

RWYConfRWYInc

RWYConfRWYInc

RWYConfRWYInc

ECHO+HELI

ECHO+STOP

HELI+STOP

ALLOI

2021 2022 2023 2024 2025

STOPOnly

HELIOnly

2016 2017 2018 2019 2020

ECHOOnly

• Confirmedthatafurtherlinkbetweenthemodelcanbeestablishedinthequantificationofelementsofthemodelbydirectlyconsideringtheincidents,theirinitiationandpropagationtoatopleveleventwithinthelocallytailoredIRiSModel.

InlightoftheforthcomingECregulation2017/373IRiSmayoffernotonlyameansofdemonstratingthesafetyimpactofchange,butalsoapotentialmeansofmeetingthecommonrequirementintermsoflinkingoperationalsafetywithsafetyassessmentofchange,safetycriteriaandsafetyproxies.

Posters

ThevalueofhumanperformanceinATMsystemsimplementation.JonathanTwigger,ThinkResearchLtdCaseStudySummary:Projectdate:May2017-May2018Client:BULATSA(AirNavigationServiceProviderforBulgaria)Location:Sofia,BulgariaConcept:Cross-borderarrivalmanager(XMAN)systemExercisetype:Real-timeSimulation(RTS)BackgroundTheimminentcompletionofwhatwillbecometheworld’slargestairport(LTFM)inIstanbulhaspromptedBULATSAtotakeproactivemeasurestomaximisetheefficiencyofIstanbularrivalsthroughtheirairspace,inanticipationforheavilyincreasedtrafficvolume,Turkeyhavealreadyimplementedanarrivalmanager(AMAN)systemtoimprovetheefficiencyofarrivalsequencingintotheirairports.Inordertoenhancethesebenefits,theXMANconceptextendsthehorizonofthissystemtoalsocovertheSofiaFIR.TheXMANsequenceispresentedtothecontrollerasatimelineviewofflightstrips,eachrepresentinganapproachingaircraft.Acolour-codeddelaytimeoneachstripshowsthetimethattheaircraftmustgainorloseinordertomeetitsscheduledtimeforcrossingtheboundaryintoTurkishairspace.ApproachInordertoestablishwhetherthisconceptis‘fitfor-purpose’,avalidationprocesswasneededtodeterminetheXMAN’ssuitabilityforimplementationatBULASTA.Forthisvalidationexercise,anRTSmethodwasselectedduetothehighmaturityoftheconceptandthebenefitsofhaving‘humans-in-the-loop’.ItwasunderstoodthateachofKPAscoveredbythevalidationobjectivesareinherentlylinkedtothecontrollers’abilitytocarryouttheirtasks.Therefore,ifacceptableHumanPerformanceisnotassured,theexpectedperformancebenefitscannotberealised.AlthoughHumanPerformancewasnottheclient’sfocusforthisproject,itisprobablythesinglemostimportantenablerforsuccessfulimplementation.Theappropriatesimulatedairspaceandnumberofparticipantsweresetandamatchedexperimentaldesignwasselectedbasedonthetimeandparticipantsampleavailable.SixsimulationscenariosweredesignedinamannerwhichenabledcomparisonbetweenconditionswithandwithouttheXMANsysteminuse.DataCollectionPreparationBULATSA’strainingfacilitieswerechosentohosttheRTS,somethingthattheirplatformhadneverbeenusedfor.Thedata-loggingcapabilitiesoftheplatformweretakenadvantageofwhenplanningtheHPassessmentsothatallexpectedbenefitscouldbesuitablyvalidated.ThefollowingmethodswereutilisedtoprovidethenecessarydataforassessmentagainsttheHumanPerformancevalidationobjectivesuccesscriteria:•Tablet-basedPost-RunQuestionnairesmainlycomprisedofindustrystandardmethodologiese.g.NASATLX,SHAPE;•Paper-basedPost-SimulationQuestionnaire;•Tablet-basedInstantaneousSelf-Assessment(iSA)ofworkload;•Recordedobservationsanddebriefcomments;•PlatformLoggeddatae.g.RToccupancy,no.ofinstructionsissued,interactionswithHMI.Thesemethodswereselectedinordertomaximiseengagementandinputfromtheparticipants.

OutcomeTheexercisewascarriedoutsuccessfullyandyieldedvaluablesubjectiveandobjectivedata.Thiswasdeliveredbacktotheclientasavalidationreportfollowingathree-monthanalysisandreportingphase.BULATSAwereshownthattheirtrainingplatformiscapableofsupportinglarge-scalereal-timesimulationsandthecontrollerswerepleasedtobeofferedsignificantinputintothevalidationprocess.Byconductingthisvalidationexerciseon-siteandusingexistingequipment,thevalueforBULATSAwasfargreaterthaniftheyhadapproacheda3rdpartyfacilityasisthenorm.TheHumanPerformancemeasuresselectedforthisexercisewerelow-costbutprovidedintegralfindingsthatformedthebasisoftheconclusionspresentedtotheclient.FullconsiderationoftheimpactofchangeonHumanPerformanceisessentialthroughoutthisprocesstoprovidethebestchanceofsuccessfulconceptimplementation.Withoutadequateuseracceptanceandperformance,anyotherexpectedbenefitsarenullified.HumanPerformanceisalsocrucialinmaintainingoperationalsafety.AstheSESAR2020programmelaunchesintoitsindustrialresearchphase,manynewconceptswillrequireextensivevalidationinordertothenbedeployedintovariousenvironmentsaroundEurope.ProperHumanPerformanceassessmentwillplayakeyroleinensuringthattheseeffortsaresuccessful.Safetyandhumanperformanceassessingmultipleremotetowers.MartaLlobetLopez,RenéePelchen-Medwed,LauraCarbo,DanaBotezan,EurocontrolOneofthekeyelementstoensuresafetyoftheoperationalserviceinATMliesonthemanagementanduseofsystemsbyhumanoperators.Safetycannotbeguaranteedbyonlyfocusingonthetechnicalequipmentandensuringitdeliversintendedfunctionsinareliableway;therelationshipbetweentheelementsofthesystem(people,equipmentandprocedures)mustfacilitateareliabledeliveryofsafety.Safetydependsamongstotherthingsontheactionsofhumanoperators(controllers,engineersandallotherrelatedhumanactors)whichcanbedeliveredreliably,withthedesiredoutcomeandwithintherequiredtimeframe.Hencedeliveringsafetydependsonensuringhumanperformance.Whenaddressingremotetoweroperationshumanperformanceaspectsareessential.ThisisparticularlyevidentinmultipleremotetowerswherethecontrolleroperatesinthecoreofthesystembydeliveringATCservicestonotonebutseveralaerodromesatthesametime.TheoperationsbeingaddressedinS2020focusonremotelyprovidingAirTrafficServicesforuptothreeairports.Inthiscontext,thesafetyassessmentforthedesignofmultipleremotetowersaimstodeliverthecompletesetofspecificationrequirementsensuringthat:thesystem–includingthecontroller–hassufficientsafetyfunctionalityandperformancetodelivertheservice;thatitworksproperlyunderallnormalandabnormalconditions;andthatfailureconditionscansafelybemanaged.Concurrently,thehumanaspectofthisspecificationisaddressedthroughthehumanperformanceassessment,whichensuresthattheroleofthehumanactorsinthesystemisconsistentwithhumancapabilitiesandcharacteristics,andthatthecontributionofthehumanwithinthesystemsupportstheexpectedsystemperformanceandbehaviour,includingsafety.Coordinationbetweenthesetwoprocessesisessentialtodeliveracoherentfinalsetofspecificationrequirementsandensuringthattheyarerealisticforimplementation.Forthehumanoperatorthismeans:thattheworkingmethodsarefeasible;thatthetaskdesign,andsystemsupportresultsinoptimisedhumanperformance;thatallsignificanthumanperformancevariabilityhasbeenidentifiedthroughappropriatesystemdesignandthatitcanbedemonstrated.Asshowninthefigure,thiscoordinationistobedoneatdifferentstepsofeachprocess,addressingalltheconditionsinwhichremotetowerATSisprovidedtothoseaerodromes.

Followingthiscoordinatedapproach,somemainitemsbeingevaluatedinthescopeoftheassessmentsformultipleremotetowersare(1)situationalawarenesslinkedtocommunication(2)informationdisplay(3)provisionofserviceindegradedconditions:(1)Ensuringthatthecontrollersareawareofwhichairporttheycommunicatewith(inandout),whichtrafficandvehiclesunderhis/herresponsibilityandalsoairportpersonnel.•(2)Thepotentialneedofadvancedfeaturesimprovingtheinformationprovidedonthe‘outofthewindow’screens,e.g.visualorradartrackingsupportingthedetectionofrelevantobjectsenablingcontinuousmonitoring,andotherfunctionalitieswhichcouldbecomesafetynetsforthepreventionofrunwayincursions.•(3)ThecontrollercapabilitytoprovideATCservicesindegradedconditions,e.g.relatedtoemergencysituationsinoneaerodromeortechnicalfailures.Thisincludesthedefinitionofspecificprocedures,information,tools,etc.,neededbythecontrollerinordertomanagesituationsaswellasensuringthatservicesarestillsafelyprovidedtoallaerodromes.Initialresultsshowthattherearenomainissuesforthefeasibilityoftheconcept,butfurtherinvestigationneedstobedone,inparticularwithrespecttodifferenttypesandamountoftraffic.Controllers’performanceisverysensitivetotheircapacitytoplantasks;henceawarenessofincomingtrafficintheshort/mediumtermisakeyaspecttobeaddressed.Forthesamereason,thecapabilityofthecontrollerinmanagingabnormalandunexpectedsituationswillbeakeyelementindefiningthetypeofaerodromes(withtheirrespectivetrafficcharacteristicsandlevels)thatcanberemotelycontrolledatthesametimefromamultipleremotetowerposition.Themultipleremotetowerconceptisbeingassessedfromasafetyperspectivefollowingasystemengineeringprocess,inwhichATCtowerserviceprovidedtoairspaceusersdrivesthedefinitionofsafetyrequirementsinahierarchicalmanner.Theprocessspecifieswhatisexpectedonsafetyintermsoftrafficrisk(e.g.runwayincursions,airprox,etc.)andwhatisexpectedtobedeliveredbyeachoftheelementsofthesystemandhow:e.g.informationprovidedtothecontrolleronthevisualpresentation(OTW

screen),capabilityofthecontrollertodetecthazardoussituations,reliabilityoftheseveraltechnicalsystems.Simultaneouslyhumanperformanceaccomplishesamoretransversalanalysisfocusingonhumanfactorssuchassituationalawareness,workload,usabilityandutility.Thecombinationofthesetwocomplementaryprocessesallowtoobtainacompleteandcoherentspecificationofthemultipleremotetowersystemensuringthatthetowerservicetoseveralaerodromeswillbesafelyprovidedashumancapabilitieshavebeentakenintoaccount.