# Designing sociotechnical systems: a CWA-based method for dynamic function allocation

Philippe Rauffet, Christine Chauvin, Gael Morel, Pascal Berruet

► To cite this version:

Philippe Rauffet, Christine Chauvin, Gael Morel, Pascal Berruet. Designing sociotechnical systems: a CWA-based method for dynamic function allocation. 33rd European Conference on Cognitive Ergonomics, ECCE, Jul 2015, Warsaw, Poland. hal-01217271

HAL Id: hal-01217271

https://hal.science/hal-01217271

Submitted on 27 Jun 2016

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Designing sociotechnical systems: a CWA-based method for dynamic function allocation

**Philippe Rauffet**

Université Bretagne-Sud,
Lab-STICC
UMR CNRS 6285
Lorient, France

philippe.rauffet@univ-ubs.fr

**Christine Chauvin**

Université Bretagne-Sud,
Lab-STICC
UMR CNRS 6285
Lorient, France

christine.chauvin@univ-ubs.fr

**Gael Morel**

Université Bretagne-Sud,
Lab-STICC
UMR CNRS 6285
Lorient, France

gael.morel@univ-ubs.fr

**Pascal Berruet**

Université Bretagne-Sud,
Lab-STICC
UMR CNRS 6285
Lorient, France

pascal.berruet@univ-ubs.fr

## ABSTRACT

Dynamic function allocation (between human agents or between human and technical agents) is a crucial issue in complex sociotechnical systems, particularly in changing or demanding situations. This issue has not yet been explicitly addressed in the Cognitive Work Analysis framework. This paper presents a conceptual and methodological proposal for designers that supplements the existing CWA tools. The new tool is integrated into the Social Organization and Cooperation Analysis (SOCA) stage. It formalizes different kinds of associations between work functions and elementary work situations and between resources and work functions. It enables the identification of conflicts (impossible allocations) when examining a complex situation resulting from the conjunction of several elementary situations. When conflicts are resolved, it is possible to choose the best configuration among a set of possible associations between resources and work functions. This proposal is illustrated with the case study of an electric pedal-assist bike.

## Author Keywords

Cognitive Work Analysis; Design method and tools; Social Organization and Cooperation Analysis; Dynamic Function Allocation.

## ACM Classification Keywords

H.1.2 User/Machine Systems (Human factors).

I.5.2 Design Methodology

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from Permissions@acm.org.

ECCE 2015, July 01 - 03, 2015, Warsaw, Poland
© 2015 ACM. ISBN 978-1-4503-3612-3/15/07...$15.00

DOI: http://dx.doi.org/10.1145/2788412.2788433

## INTRODUCTION

Socio-Technical Systems Engineering (STSE) focuses on the design of complex systems with interconnected human, technical, and organizational components (Baxter &

Sommerville, 2011). In particular, this approach raises the issue of the role of operators faced with increasingly autonomous technical systems in dynamic, risky, and sometimes unforeseen situations.

The distribution of activities between humans and machines is a central process in Socio-Technical System (STS) design and operation (Challenger et al., 2013). Function allocation and, more precisely, dynamic function allocation (DFA), can help a system maintain a satisfying performance in complex situations. This issue must be taken into account as early as the preliminary design phase of a project (MOD, 1989; Goom, 1996).

Several methods have been proposed to design sociotechnical systems. Among them, Cognitive Work Analysis (CWA), proposed by Rasmussen (1986), Rasmussen, Pejtersen, and Goodstein (1994) and further developed and codified by Vicente (1999), appears as one of the most comprehensive. It combines the contributions of engineering and human factors to provide designers with a powerful framework for STS design. As depicted on table 1, it is a formative constraint-based approach, consisting of five successive stages: a) Work Domain Analysis (WDA), b) Control Task Analysis (ConTA), c) Strategies Analysis (StrA), d) Social Organization and Cooperation Analysis (SOCA), and e) Worker Competencies Analysis (WCA).

The issue of function allocation is addressed at the fourth stage, namely SOCA. This issue is a crucial one, but the exploration of the social and organisation phase has received less attention than the application of the WDA or ConTA (Jenkins, Stanton, Salmon, Walker, & Young, 2008).

SOCA does not deal explicitly with the dynamic distribution of functions between humans and machines (Chauvin & Hoc, 2014). No modelling tools existed for this stage before the recent proposals made by Jenkins et al. (2008) or Stanton and Bessell (2014). In this paper, we propose to make up for these weaknesses.

This paper aims at improving the SOCA stage and at integrating explicitly DFA into the CWA framework. It proposes a tool for designers that will enable them to verify
that a particular solution will meet the purpose of the system, regardless of the work situation.

It is divided in three parts. The first one presents, among the CWA levels and associated tools, those that provide useful

data for function allocation; it also shows the limits of the existing tools. The second part introduces the methodological proposal. The last part provides a case study in order to illustrate and discuss the anticipated benefits.

<table><caption>Table 1: CWA methodology summary (adapted from Jenkins et al., 2008 and Stanton and Bessell, 2014)</caption><thead><tr><th>WHY</th><th>WHAT</th><th>HOW</th></tr></thead><tbody><tr><td>CONSTRAINTS IDENTIFICATION</td><td>PHASES OF CWA</td><td>DATA ACQUISITION</td><td>REPRESENTATION</td></tr><tr><td>System Functional Constraints</td><td>Work Domain Analysis (WDA)</td><td>Document Analysis, Reviews by SME</td><td>Abstraction Hierarchy (AH), Abstraction Decomposition Space (ADS)</td></tr><tr><td>Decisional and Situational Constraints</td><td>Control Task Analysis (ConTA)</td><td>Cognitive Walkthrough, Study of Work Practices</td><td>Decision Ladder (DL), Contextual Activity Template (CAT)</td></tr><tr><td>Strategy Constraints to Achieve System Goals</td><td>Strategies Analysis (StrA)</td><td>Critical Decision Methods, Interaction Analysis, Verbal Protocol Analysis</td><td>Information Flow Map (IFM)</td></tr><tr><td>Functional Allocation Constraints</td><td>Social Organization &amp; Cooperation Analysis (SOCA)</td><td>Communication Analysis, Interaction Analysis</td><td>Color Codes applied dynamically on all of the above (SOCA-ADSSOCA-CAT, SOCA-DL, SOCA-IFM)</td></tr><tr><td>Functional Competency Constraints</td><td>Worker Competencies Analysis (WCA)</td><td>Repertory Grid Analysis, Review of Decision Ladder</td><td>Skills Rules Knowledge (SRK), Functional Matrix</td></tr></tbody></table>

## DEFINING FUNCTION ALLOCATION WITH THE EXISTING CWA MODELS

Dynamic function allocation (DFA) requires knowing the work functions that should be allocated (what), the situations in which they may be allocated (when and where), and the resources that could be associated with a given function (who). Three phases of the CWA (WDA, ConTA, and SOCA) provide these data through two main existing tools: the Abstraction Hierarchy (AH) and the Contextual Activity Template (CAT).

WDA deals with the constraints that are placed on actors by the functional structure of the field or environment in which the work occurs (Naikar, 2013). This phase is associated with a modelling tool, the AH. This tool enables the description of a work domain in terms of five levels of abstraction: functional purpose (the purpose of the work domain, its "raison d'être"), value and priority measures (the criteria ensuring that the system progresses toward the functional purpose), purpose-related functions (the general functions that are performed in order to achieve the functional purpose), object-related processes (processes and capabilities characterising the objects used by the general functions), and physical objects.

ConTA is related to the activity required for achieving a system's purpose with a set of specific resources. Naikar, Moylan, and Pearce (2006) and Naikar (2013) propose to characterize this activity as a set of recurring work situations, work functions, or control tasks. These authors introduce the CAT for modelling activities in work systems. This template highlights the contextual relationships between the various elements of ConTA and graphically illustrates all of the combinations of work situations, work functions, and control tasks that are possible.

Naikar et al. (2006) explain that the decomposition of activity into work situations is appropriate in systems where

work is segmented according to time and space (in hospitals or schools for example), whereas activity is better characterized by its content, independently of its temporal of spatial characteristics, in other systems. In those cases, it is appropriate to decompose activity into a set of work functions. Work functions are related to functions to be performed in a work system. They are defined at the purpose-related functions level or at the object-related processes level in the AH (Jenkins et al., 2008). In a research laboratory, activity is divided into work functions such as writing papers, conducting experiments, and reading.

The CAT is designed to represent activity both in terms of work situations and work functions. A graphical code is used to distinguish work situations in which a work function can occur and those in which a work function will typically occur. According to Stanton and Bessell (2014) and as depicted in Figure 1, a work function - in a given situation - may be qualified as *expected* (it can occur and typically occurs), *optional* (it can occur but does not typically occur), or *impossible* (it never occurs).

<figure><img src="image_2.png" /><figcaption>Figure 1: CAT Layout (from Bessell and Stanton, 2014)</figcaption></figure>

The decision ladder is then used to decompose activity into a set of control tasks for each work situation and/or work functions.
SOCA addresses the constraints governing how the team communicates and cooperation (Jenkins et al., 2008). It aims to determine the distribution of work demands, communication, and cooperation amongst the actors (i.e. the different resources of the system under investigation).

Jenkins et al. (2008) propose to map actors (represented by means of a colour code) onto the AH and more precisely onto the functions described at the levels of the purpose-related function and of the object-related processes (SOCA-AH). In the same way, they map actors onto the CAT in order to show where these can have an influence on the system (SOCA-CAT). They take into account, at this stage, the actors' capability to perform a certain work function during a certain work situation. Cells occupied by more than one actor indicate that either or all of the identified actors can support the activity. According to these authors, this representation of constraints helps to identify and evaluate potential combinations of working practices in order to determine optimal practices. This analysis may be carried out according to Rasmussen et al.'s (1994) six criteria: (a) actor competencies, (b) access to information and means of action, (c) coordination demands, (d) workload, (e) safety and reliability, and (f) existing regulations. These criteria are either input data to model DFA problems (e.g. actor competencies) or evaluation criteria to choose allocations (e.g. workload).

The existing tools of the CWA enable the identification of potential allocations of resources to work functions. However, they do not provide the means to evaluate and optimize these according to the work situation characteristics and, most importantly, according to the work situation variations.

## SOLVING DYNAMIC FUNCTION ALLOCATION PROBLEMS WITH CWA

Defining a dynamic function allocation entails taking dynamic situations and resource availability into account. For that purpose, designers need a definition of work situations and a modelling of resource constraints adapted to the specific problem, as well as a method used to formalize and to evaluate the STS according to different complex situations.

The notion of work situation seems to be very useful to deal with the question of DFA although its “modern” definition (Naikar et al., 2006, used in the works of Jenkins et al., 2008; Stanton & Bessell, 2014) was not originally thought to model this specific problem. The use of this concept for DFA problems raises therefore new questions:

**Are time and location sufficiently detailed to distinguish all the work situations?** According to Naikar et al. (2006), work situations are characterized by some absolute or relative constants of time or location (work can occur at a specific place or at a specific distance of a moving position, and work can occur at a specific moment or just before or after a mission phase). For instance, in the context of

aircraft system analysis, Naikar et al. (2006) described five different situations fitting with mission phases (“on ground not in aircraft”, “on ground in aircraft”, “enroute to station”, “on station”, “enroute to base”). However, could the situation “flying in bad weather conditions” be considered as a spatio-temporal situation? This kind of work situation can occur at any place and any time, as there is no unit of time and place, or relationship with a mission phase or a moving place. Cuny and Chauvin (2009) remind that "in ergonomic psychology, the situation theoretically includes all variables forming a system of potential interactions with the activity as its operational framework". Work situations can be therefore more generally influenced and characterized by the external and internal conditions of the system (the information level or the nature of the system environment, temporal pressure, etc.). "When" and "where" questions should be thus completed or replaced by the question "In which internal and external conditions does the system operate?" so as to define work situations.

**Do work situations include incidental or critical situations?** The recent applications of the CAT (Jenkins et al., 2008; Stanton & Bessell, 2014) are centred on nominal phases of the mission. However, the dynamic function allocation could also take some degraded situations into account (the failure of some system components, uncertainty or absence of knowledge regarding information relative to the mission, etc.).

**Are work situations independent from each other?** The different work situations are independent from each other if they are defined according to time or location. However, if we also consider work situations according to internal and external conditions, the situations « enroute to station » and « flying in bad weather conditions » could occur in parallel.

**What is the granularity of the modelling of work situations?** Naikar et al. (2006) assert that the decomposition of activity into work situations and work functions can be done at different levels of detail or granularity. They provide an example of this granularity issue. Situations such as “On ground not in aircraft”, “On ground in aircraft”, and the “in the air” situations (“enroute to station” and “enroute to base”) are typically the conjunction of two elementary situations, defined by the location of the activity in relation to the plane and to the ground (“on ground” versus “in the air”, “in aircraft” versus “not in aircraft”). The different elements of internal and external conditions could therefore be a unit of description of work situations.

**How can forgetting work situations and a combinatorial explosion of situations be avoided?** The number of situations could increase very fast if numerous conditions are considered and combined. For instance, taking into account the weather conditions (cloudy or sunny), tactical conditions (in fight zone, not in fight zone) and system capacity conditions (full tank of fuel, almost empty tank) and the five situations given by Naikar et al. (2006) results
in having to consider and model 40 different situations. Complex situations should be considered as the result of the conjunction of several elementary situations that are not always independent from each other.

The modelling of resource availability in dynamic situations is also a crucial question for dealing with DFA issues. Jenkins et al. (2008) and Stanton and Bessell (2014) propose to map resources and actors, especially on the AH and CAT. However, they do not formalize in detail the constraints that can occur between these resources in dynamic situations, which is necessary to define the DFA problem. Selecting to allocate a resource to a function could be dependent on the use of this resource or another one for another function. This relation of dependence among resources can be expressed at the design stage (modelled in SOCA-AH) or in the case of a situation that creates some unavailability or dependence (modelled in SOCA-CAT). The following list represents an attempt to model these constraints: a) binary constraints: a resource can be allocated or not to a function; b) disjunctive constraints: one or several resources can be allocated to the same function; c) exclusive constraints: two resources cannot work in parallel on the same or on different functions; d) capacity constraints: the number of functions allocated to one resource or both resources is limited; e) conditional constraints: a resource can be allocated to a function only if one or several resources are allocated to one or several functions; f) antecedence constraints: this is a special case of conditional constraints to which a temporal dimension has been added; a resource may be allocated to a function only if one or several resources were previously allocated to one or several functions.

Using these elements of detail or adaptation of CWA leads to proposing a method using SOCA-AH and SOCA-CAT models and SOCA criteria so as to formalize and solve the DFA problem.

**SOCA-AH is centred on the analysis of functions and resources and would be used to assess the choices made by the designers regarding the composition of the system.** The model provides a means of assessing whether a function is statically allocated to a resource (only one resource is planned in the system to carry out the function: there is only one coloured actor in a box of AH) or whether a function is admissible for dynamic allocation to a resource (several resources are planned and some of them

could carry out the function: there are at least two coloured actors in a box of AH).

**SOCA-CAT is centred on the analysis of situated functions and resources and would be used to assess the choices made by the designers regarding the functioning of the system in dynamic situations.** The model provides a means to assess the potential risks of the DFA in different complex situations and to find, when it is possible, the best system configuration to deal with situations. The SOCA-CAT is composed of the designers' choices that are represented by different types of functions actionable in a given elementary situation. A function can be “expected” (a function with a bar inside a dotted box can occur and typically occurs), “optional” (a function inside a dotted box without a bar can occur but does not typically occur) or “impossible” (a function outside the dotted box can never occur). Moreover, some functions are designed with different allocation possibilities (different resources or configurations of resources can carry out the function).

When complex situations are considered, namely when the conjunction of several elementary situations is examined, designers should check whether there is no conflict between the choices made for the elementary situations. They must look for functions that are “expected” in an elementary situation and that are “impossible” for all resources of the system in other elementary situations. Let us consider situation S* as the conjunction of elementary situations Si and Sj. SOCA-CAT would be useful to model:

* a minimal configuration list MinConfig(S*) of functions that can be allocated to a resource and are “expected” in a complex situation. The list is composed of the function-resource couples, noted Fi-Ri, that are at least considered once as “expected” in situation Si and Sj.

* a list Pot(S*) representing all the functions that can be allocated to a resource and are “possible” (i.e. “expected” or “optional”) in a complex situation. The list is composed of the Fi-Ri couples that are considered in all situations Si and Sj as “expected” or “optional”.

From these two lists, the designers could first check whether there are any design conflicts between concurrent elementary situations modelled with SOCA-CAT, i.e. whether MinConf(S*) is included in Pot(S*). Hence, they deal with a decision problem, depicted in Figure 2, which can be written as: `{MinConf(S*) | Pot(S*)} = TRUE?

<figure><img src="image_3.png" /><figcaption>Figure 2: Decision problem of function allocation</figcaption></figure>
If the answer to the decision problem is positive, that is, if there is no design conflict, the designers could then deal with an optimization problem. They look for the best configuration in the list Pot(S*) that minimizes a criterion of dynamic function allocation defined in SOCA (e.g. the workload of some resources). This problem can be written as:

$$ \forall S*, \text{minimize } \text{DFA\_Criterion}(\text{Solution}(S*)), \\ \text{with } \text{MinConf}(S*) \subset \text{Solution}(S*) \subset \text{Pot}(S*). $$

The following section presents an implementation of this method on a case study.

## EXAMPLE OF APPLICATION

The proposed CWA-based DFA method was applied on a small human-machine system composed of technical components (an electric pedal-assist bike, a GPS navigation system, physiological sensors, a battery gauge) and a human agent (a cyclist). The system can be considered as an instance of STS. It is both an intentional and a causal system: the system reacts to the variations on the road due to actions of other road users and to the laws of nature. This “simple” case study was chosen to illustrate the method proposed in this paper. The application example must therefore be considered as a first proof of concept. It simulates a design problem inspired by the new needs resulting from the recent popularization of pedal-assist bikes and the development and integration of new technologies.

Indeed, new uses have appeared: cyclists want to avoid daily battery recharging, or they wish to integrate unplanned routes to their usual routine without having to do without power assist on the final slopes before arriving home. Hence, the assist capacities of electric bikes need to be better adapted to the cyclists’ individual goals (such as duration and length of trips) and to dynamic situations (ascents, wind, road traffic). Adaptation also involves improved battery use and assistance optimization any time

on the route while securing the bikers’ safety. Furthermore new technologies enable adding physical and software devices onto the electric bikes so as to guarantee bikers a safe and effective ride. Designers thus need to be given a method to evaluate whether the resources and the dynamic function allocation are sufficient to meet these objectives of safety and performance.

## Defining function allocation with the existing CWA tools

CWA modelling tools were used to model the functional constraints (AH), the situational constraints (CAT), and the resource constraints related to the DFA problem.

### Work Domain Analysis (Abstraction Hierarchy)

The functional purpose of the system is to guarantee a safe and effective ride towards a desired destination.

Meeting this objective entails that the system must comply with some values and priorities related to performance and safety, shown in Figure 3 from left to right. The safety priorities from the smallest to the largest scale of the system are the following ones: minimal battery level for cyclists’ safety; system integrity; adaptation of the system to the road; adaptation of the system to the road management system. The performance priorities are related to the management of the location objective (the system must help the cyclists reach the desired destination), the management of the path duration, and the management of the cyclists’ tiredness. Consideration should be given to the human-machine cooperation issue, in terms of the following purpose-related functions, which can be cognitive and motor functions: supplying propulsion to ride the bike and to reach the location objective; route planning means regularly geolocating the system and choosing an adapted path; controlling system capacities to monitor internal conditions (in this case, the energetic states of human and technical components of the system that could result in an accident or underperformance); controlling the environment (i.e. monitoring external conditions such as the weather, road grade and quality, stop signs, etc).

<figure><img src="image_4.png" /><figcaption>Figure 3: Abstraction Hierarchy and SOCA-AH</figcaption></figure>
The object-related processes and the physical objects are
defined in relation to the hybrid nature of the human-
machine system. The human actor is situated within the
system; hence, the physical objects can be defined in terms
of human capacity (for instance muscles or the nervous
system) and technical capacity (for instance motor or
sensors). This dichotomy between human and technical
parts will be used in the SOCA phase to categorize the
resources to which the functions could be allocated.

Control Task Analysis (Contextual Activity Template)

The work situations were modelled with different internal
and external conditions, as indicated in the proposal of the

method (see Figure 4). As in the example given by Naikar
et al. (2006), some situations (S2 to S5) could result from
the conjunction of elementary conditions (knowledge level
of the cyclists on the path to reach their destination, and
difficulty level resulting from the road quality, grade, and
traffic). Other situations depend on only one condition
 speed, GPS signal access). The distinction between
 "expected", "optional", and "impossible" situation-related
 functions was examined in this CWA phase and then
 refined in SOCA-CAT. The detailed design choices of this
 function classification are explained in the following
 paragraphs dealing with SOCA.

<figure><img src="image_5.png" /><figcaption>Figure 4: Contextual Activity Template and SOCA-CAT</figcaption></figure>

Social-Organization and Cooperation Analysis (reuse of previous
models)

Only two resources (actors) were considered to investigate
this DFA within a human-machine system. In Figures 3 and
4, the functions allocated to human were coloured in blue
(they will be noted Fi-H in the following paragraphs, with i
as index), and those allocated to machine were coloured in
green (noted Fi-M). The AH and the CAT were therefore
coloured according to functional and situational design
choices, providing what Jenkins et al. (2008) call SOCA-
AH and SOCA-CAT models.

The SOCA-AH model shows that the function F4 is chosen
by designers to be achieved by human (it is therefore a
static allocation).

The SOCA-CAT model enables designers to refine the
situational design choices according to human and technical
resources. Some functions can be “expected” for human
and “optional” for machine in certain conditions (in the
good situation S4, the cyclists typically pedal, and electric
assist is not typically activated, even if it is possible), or
they can be “expected” for both human and machine (in the
difficult situation S2, electric assist is typically activated).
Some functions can also be « impossible » for human or
machine in certain conditions. For instance, when the speed

exceeds 30 km/h, the electric assist cannot be activated;
when the battery is low, a design choice could be the
deactivation of the GPS receiver and physiological sensors
power for the benefit of the sole electric propulsion power;
or when the cyclists know the route or when they are tired,
they never planned the path to the desired destination.

Some other constraints – resource constraints – have to be
considered on the SOCA-AH and SOCA-CAT. The system
under investigation is a “pedal-assist” bike, i.e. the electric
motor would be activated only if the cyclists pedal (this is a
conditional constraint: F1-M can be allocated only if F1-H
is allocated). The system is also not equipped with sensors
able to monitor the road environment (so F4-M is
“impossible” and only F4-H can exist). Moreover, the other
functions are ruled by a disjunctive constraint: functions
must be allocated to at least one of the two resources.

Solving a dynamic function allocation problem with CWA

The use of previous CWA modelling tools would help
designers assess whether their function- and situation-
dependent choices of resources generate conflicts
threatening the safety or the performance of the activity of
bike riding, and would allow them choosing an optimal
situated function allocation when there is no conflict.
In Figure 4 only eight «elementary» or «simple» situations were defined, arising from the consideration of six variables of internal or external conditions (speed, road difficulty, knowledge of route, GPS signal access, user tiredness, and battery level). The proposed method entails verifying whether the function allocation choices onto the eight modelled elementary situations can deal with complex situations (i.e. the different conjunctions of the elementary situations), instead of considering and modelling all the combinations of the six condition variables. In the latter case, if only two modalities were considered for each variable (e.g. difficult or easy road conditions), up to 64 situations should be completely examined and defined by the designers. The proposal seeks to deal with this combinatorial explosion and to reduce this number by stressing the conflictual conjunctions that should be modelled in addition to these eight elementary situations.

Let us consider two cases: S*=S1US4US6, a rather favorable conjunction of elementary situations (Speed>30km/h, known route, easy road conditions, no GPS cover), and S**=S2US7US8, a difficult complex situation (unknown route, difficult road conditions, tired user, and low battery). The notation Fi-H and Fi-M explained in the proposal is kept for dealing with these examples.

* MinConfig is the list of all the Fi-H and Fi-M that are “expected” (with circle and whiskers) in at least one elementary situation composing the complex situation. For this minimal list, it should be noted that only one resource is sometimes sufficient to allocate to a function like F2 or F3 (this is therefore an exclusive constraint noted XOR). Moreover, for the specific case of F1 (ruled by a conditional constraints of F1-H on F1-M), F1-M is expected as well as F1-H in S2, S3 or S7.

In the complex situation S*, F4-H is expected in S1, both F1-H and F4-H are expected in S4 and in S6, so **MinConf(S*)**={**F1-H**, **F4-H**}. In the complex situation S**, all modeled Fi-H and Fi-M of SOCA-CAT are expected in S2. So **MinConf(S**)**={**F1-H**; **F1-M**; **F2-H** XOR **F2-M**; **F3-H** XOR **F3-M**; **F4-H**}.

* Pot is the list of all the Fi-H and Fi-M that are not “impossible” (not outside dotted boxes) in every elementary situation composing the complex situation (i.e. the list of all the Fi-H and Fi-M that are “expected” or “optional” in every considered elementary situation). For this maximal list of potential Fi-H and Fi-M, two resources can be allocated separately or together to the same functions: they are therefore both included in the list. Moreover, the conditional constraints are taken into account (e.g. for the specific case of F1, the constraint will be noted F1-M if F1-H). In the case of S*, F2-M is impossible in S6, F2-H and F3-H are both impossible in S4. So **Pot(S**)=**{F1-H**; **F1-M** if **F1-H**; **F3-M**; **F4-H**}.

In the case S**, F2-H is impossible in S7, and both F2-M and F3-M are impossible in S8, whereas all the Fi-H and

Fi-M are possible in S2. So **Pot(S**)**={**F1-H**; **F1-M** if **F1-H**; **F3-H**; **F4-H**}.

First the problem decision must be solved: **"{MinConf(S*) (Pot(S*)} = TRUE?"**

* If the answer is negative, there exist a design conflict, and there is no admissible solution to the problem of dynamic function allocation in the situation under investigation. This happens in the case S**, where neither F2-H nor F2-M are present in Pot(S**) whereas they were in MinConf(S**) under the form F2-H XOR F2-M: MinConf(S**) is not included in Pot(S**). This design conflict is represented in Figure 4, in purple.

* If the answer is positive, there is at least one admissible allocation in the complex situation that meets the system functional purpose. This happens in the case S*, where MinConf(S*) is included in Pot(S*).

When possible, an optimization problem can then be solved with DFA criteria. For instance, let us consider the physical and mental workload of the cyclist, or the consumed power of the machine (i.e. the allocation of functions must be minimal respectively on the human or on the machine). The solutions of DFA in S* are thus:

* **Solution(S*, min cyclist workload)**={**F1-H**; **F1-M**; **F4-H**}: electric assist must be implemented to decrease the physical workload, and the automated monitoring of system capacities F3-M is deactivated to avoid an information overload.

* **Solution(S*, min energy consumption)**={**F1-H**; **F4-H**}: the machine can be completely deactivated for propulsion and information processing, so as to keep enough battery to help the cyclist in hard road conditions.

## DISCUSSION

At the theoretical level, this paper proposes a method that follows the formative nature and the focus on constraints modelling of CWA so as to deal with the DFA issue. This contribution aims at continuing the work made on SOCA around the DFA question (Jenkins et al., 2008; Stanton and Bessell, 2014) by considering: a) SOCA-AH as a means to examine the constraints relative to the design choice of resources in terms of static function allocation (one sole resource for one function) or potential dynamic function allocation (several separate resources for one function); b) SOCA-CAT as a means to examine the constraints relative to the activation of resources in different situations that would influence the possibility and the choice of dynamic function allocation. This last consideration especially involved revisiting the concept of work situation defined by Naikar et al. (2006) relative to the specific question of DFA by characterizing it in terms of external and internal conditions.

At the methodological level, the proposal is intended to help designers deal with the combinatorial explosion resulting from the combination of the different conditions
that form complex situations. Instead of modelling all these complex situations, designers would be able to simply add new condition variables to the previously examined elementary situations and to observe the DFA properties of emergent situations. The analysis of the conjunctions of elementary situations in SOCA-CAT would then enable them to detect design conflicts. In this case, these conflictual complex situations should be completely defined and modelled by designers. Otherwise, that means the dynamic function allocation works in these complex situations, and the DFA problem can be considered as a local optimization problem (the best configuration is looked for in each situation according to specific criteria).

In terms of future perspectives, the proposed method could be further developed by integrating the temporal dimension: in the early design stages, situational constraints could be tested according to baseline scenarios to help designers assess the quality and the influence of their choices on the safety and the performance of the system in realistic situations. The number of design conflicts or the total cost generated from the DFA criteria could then be calculated to assess different design solutions. Considering the temporal dimension is also a way of thinking of a DFA problem not only as a local optimization but also as a global optimization problem (i.e. over entire scenarios).

Moreover, it would also be necessary to take into account the constraints modelled at other stages of CWA, such as the decisional constraints and the strategic constraints respectively defined in SOCA-DL (Decision Ladder in ConTA) and SOCA-IFM (Information Flow Map in StrA). Different cognitive styles could be distinguished that influence DFA (for instance the consideration of a person who always uses the GPS, even if this use is optional in certain situations).

## REFERENCES

1. Baxter, G. & Sommerville, I. (2011). Socio-technical systems: From design methods to systems engineering. *Interacting with Computers*, 23, 4-17.

2. Challenger, R., Clegg, C. W., & Shepherd, C. (2013). Function allocation in complex systems: reframing an old problem. *Ergonomics*, 56:7, 1051-1069.

3. Chauvin, C., & Hoc, J. M. (2014). Integration of Ergonomics in the Design of Human-Machine Systems. in P. Millot (Ed.) *Designing Human-Machine Cooperation Systems*, 43-86.

4. Cuny, X., & Chauvin, C. (2009). Decision-making in controlling development of driving/piloting situations. *Safety Science*, 47(9), 1201-1204.

5. Goom, M. K. (1996). Function allocation and MANPRINT. In D. BEEVIS, P. ESSENS & H. SCHUFFEL, Eds.. Improving function allocation for integrated systems design, pp. 45-61. Technical Report CSERIAC SOAR 96-01. Crew Systems Ergonomics

Information Analysis Centre, Wright-Patterson Airforce Base, OH, USA.

6. Jenkins, D.P., Stanton, N.A., Salmon, P.M., Walker, G.H., Young, M.S. (2008). Using cognitive work analysis to explore activity allocation within military domains. *Ergonomics*, 51(6), 798-815.

7. MOD (1989). Defence Standard 00-25. *Human Factors for Designers of Equipment. Part 12: Systems*. UK Ministry of Defence.

8. Naikar, N., Moylan, A., & Pearce, B. (2006). Analysing activity in complex systems with cognitive work analysis: concepts, guidelines and case study for control task analysis. *Theoretical Issues in Ergonomics Science*, 7(4), 371-394.

9. Naikar, N. (2013). Work domain analysis: Concepts, guidelines, and cases. CRC Press.

10. Rasmussen, J. (1986). Information Processing and Human-machine Interaction. Amsterdam, North Holland: Elsevier.

11. Rasmussen, J., Pejtersen, A.M., & Goodstein, L.P. (1994). Cognitive Systems engineering. New York: Wiley.

12. Stanton, N. A., & Bessell, K. (2014). How a submarine returns to periscope depth: Analysing complex socio-technical systems using Cognitive Work Analysis. *Applied ergonomics*, 45(1), 110-125.

13. Vicente, K.J. (1999). Cognitive work analysis: Toward safe, productive, and healthy computer-based work. Mahwah, NJ: Erlbaum.