ENRI Int’l Workshop on ATM/CNS
6 March 2009
Tokyo, Japan

Human-Machine Collaboration for
Safety and Comfort
T. Inagaki
Department of Risk Engineering
University of Tsukuba
Email: inagaki@risk.tsukuba.ac.jp
http://www.css.risk.tsukuba.ac.jp(Boeing, 2008)

Mismatches between humans and smart machines• Intelligent machines can:– sense and analyze situations,– decide what must be done, and– implement control actions

loss of situation awareness,over-trust in automation,
automation surprises(FAA, 1995)

Situation awareness (SA)Level 1 SA:- perceiving critical factors in the environment
Level 2 SA:- understanding what those critical factors mean,
particularly when integrated together in relation tothe person’s goal
Level 3 SA:- understanding of what will happen with the systemin the near future(Endsley, 1995)

Loss of Level 1 SA
3,300 ft/min

vertical speed mode

3.3-degreeflight path angle
mode

5,000ft

2,620 ft

RWY
SPEEDFPA

TRK

CAT

2

AP1DH

100

A / THRSPEED

FD1V/SHDGCAT

2AP1DH100

A / THR

FD13000

20180FPA
3.3 °

3000

V/S

20180＞ 015＞ 015

3300 ft

101016013F200080160

20F14014071010202030

13 00＞ 010
10／min8030＞ 010

10120120790

OM

790
33

TBN
109．30
4．7 NM

03132

3334

3TBN
109．30
4．7 NM1020
QNH

03132

33

34

31020
QNH

Loss of Level 2 SA
When task A is needed,
it would be better to do task B
at the same time.

What thehell is goingon?
automation
surpriseControlled
process

task B++task A(ordered)Loss of Level 3 SA
• Automation was put into theG/A mode inadvertently• PF tried to make the aircraft
descend by pushing the control
column forwardly

automation’sgoal

automation
human’sgoal

human pilot

aircraft• Control inputs are disturbances whenhuman’s goal

automation’s goal

Which aspect can be supported by machines and how?

dynamically changing
environment
Informationacquisition

Information
analysis

Decision &action
selection

Actionimplementation(Parasuraman et al., 2000)

Traffic alert and Collision Avoidance System (TCAS)
Informationacquisition

Information
analysisinterrogations

Decision &action
selection

Actionimplementation

replies

Position and altitude of
nearby aircraft can be known

Traffic alert and Collision Avoidance System (TCAS)
Informationacquisition

range test
altitude test

Information
analysis⇒ threat ?

Decision &action
selection

Actionimplementation

Traffic alert and Collision Avoidance System (TCAS)
Informationacquisition

Information
analysis

Decision &action
selection

Actionimplementation

Climb, Climb

TCAS
Resolution advisory(RA)

threatTraffic alert and Collision Avoidance System (TCAS)
Informationacquisition

15:54:34 TCAS issued a“Descend” RA

Information
analysis

Decision &action
selection

15:54:35 TCAS issued a“Climb” RA
15:54:27 ATCordered to descend

Actionimplementation

TCAS does not perform
any collision avoidancemaneuver.
Human pilot may
disregard the RA.

Near mid-air collision
over Yaizu, Japan(January 31, 2001)

Human-centered aviation automation
The human bears the ultimate responsibility for safety of aviation system.
Therefore:•

The human must be in command.

•

To command effectively, the human must be involved.

•

To be involved, the human must be informed.

•

Functions must be automated only if there is a good reason for doing so.

•

The human must be able to monitor the automated system.

•Automated systems must, therefore, be predictable.

•Automated systems must be able to monitor the human operator.

•

Each element of the system must have knowledge of the others’ intent.

•

Automation must be designed to be simple to learn and operate.

(ICAO, 1998)

Human-centered aviation automation
The human bears the ultimate responsibility for safety of aviation system.
Therefore:• The human must be in command.
• To command effectively, the human must be involved.
• To be involved, the human must be informed.

• At all times and on every occasion?

• Functions must be automated only if there is a good reason for doing so.
• The human must be able to monitor the automated system.
• Automated systems must, therefore, be predictable.
• Automated systems must be able to monitor the human operator.
• Each element of the system must have knowledge of the others’ intent.
• Automation must
be designed
to be simple
to learnshould
and operate.
• Whatthe automatedsystems
dowhen they detected improper behaviors of thehuman operator?

Control action in a given situation
human’s control action
Actionallowed in thesituation

Actionneeded in thesituation

computer’s
judgment“Action isdetected”

Action not
appropriate
in the situation

BA“Action is notdetected”

What the computer should or may do?
human’s control action

computer’sjudgment

Actionneeded in thesituation“Action isdetected”“Action is notdetected”

Actionallowed in thesituation

Action not
appropriate
in the situation

BA

Which is more appropriate:“The PF is too late inperforming a control
action needed in thesituation.”- setting off a warning?
- initiating a control action?

Automatic ground collision avoidance system(Auto-GCAS)
If the pilot does not respond to the “pull-up” warning,
the computer takes control back from the pilot andexecutes an automatic collision avoidance maneuver.

(Scott, 1999)

What the computer should or may do?
human’s control action

computer’s
judgment

Actionneeded in thesituation“Action isdetected”“Action is notdetected”

Actionallowed in thesituation

Action not
appropriate
in the situation

B“The PF misunderstands
a given situation and hiscontrol action does not
fit to the situation.”A

Which is more appropriate:- setting off a warning?
- initiating a control action?

Although “Climb” was necessary in the situation…
15:54:34 TCAS issued a“Descend” RA

15:54:35 TCAS issued a“Climb” RA
15:54:27 ATCordered to descend

Adapted from (Asahi, 31 January 2001)

Advanced TCAS
would automatically maneuver the aircraft away from apotential mid-air threat without input from the flight crew

(Flight International, 22 March 2006)