Cogn Tech Work (2006) 8: 161–167
DOI 10.1007/s10111-006-0034-z

O R I GI N A L A R T IC L E

T. Inagaki

Design of human–machine interactions in light of domain-dependenceof human-centered automation

Received: 7 November 2005 / Accepted: 13 March 2006 / Published online: 4 April 2006
 Springer-Verlag London Limited 2006

Abstract This paper discusses that human-centeredautomation for traﬃc safety can vary depending ontransportation mode. Quality of human operators andtime-criticality are factors characterizing the domaindependence. The questions asked in this paper are: (1)Does the statement that, ‘‘The human must be in command,’’ have to hold at all times and on every occasion,and in every transportation mode? and (2) What the
automation may do when it detected the human’s
inappropriate behavior or performance while monitoring the human? Is it allowed only to give some warnings?
Or, is it allowed to act autonomously to resolve thedetected problem? This paper also argues that humancentered automation must be multi-layered, by taking
into account not only enhancement of situation awareness but also trading of authority between humans andmachines.
Keywords Authority and responsibility Æ
Human-centered automation Æ Levels of automation Æ
Human interface Æ Transportation

1 Introduction
Today’s machines can sense and analyze situations, decide what must be done, and implement control actions.
The intelligent and autonomous machines have been
contributing considerably to improve safety, eﬃciency,
and comfort of transportation vehicles, such as aircraft,
automobile, railroad, and marine vessels. However, humans working with smart machines sometimes suﬀer
negative consequences of automation, such as the outof-the-loop performance problem, loss of situation
T. Inagaki
Department of Risk Engineering, University of Tsukuba,
Tsukuba 305-8573, Japan
E-mail: inagaki@risk.tsukuba.ac.jp
Tel.: +81-29-8535537
Fax: +81-29-8535537

awareness, complacency or over-trust, automation surprises (see, e.g., Woods 1989; Wickens 1994; Endsley
and Kiris 1995; Sarter and Woods 1995; Parasuraman
and Riley 1997; Sarter et al. 1997; Inagaki and Stahre
2004; Hollnagel and Woods 2005). Appropriate guidelines or methodologies have been called for to resolvethese problems. Proposal of human-centered automation is among those eﬀorts (see, e.g., Woods 1989; Billings 1992, 1997; Sheridan 2002; Cacciabue 2004;
Wickens et al. 2004).
Human-centered automation is an approach to realize work environment in which humans and machinescollaborate cooperatively. However, in spite of popularity, there seems to be some ambiguity on what human-centered automation really means: Sheridan (2002)
distinguishes ten diﬀerent meanings of human-centeredautomation, and argues that contradictions can befound in those ‘‘deﬁnitions.’’ Among various application
domains, it may be aviation for which human-centeredautomation is deﬁned in the most detailed manner.
Aviation has a long history of automation, and has
experienced both its beneﬁts and costs (see, e.g., Billings
1997; Orlady and Orlady 1999). The concept of humancentered automation, shown in Table 1, has resulted
from studies to resolve the costs of automation (Billings
1997; ICAO 1998).
This paper argues that human-centered automation
can be domain-dependent and thus must be establishedproperly for each transportation mode: e.g., ‘‘humancentered automation for automobile’’ can be quite
diﬀerent from ‘‘human-centered automation for aviation system’’ deﬁned in Table 1. Quality of humanoperators and time-criticality characterize domaindependence of human-centered automation. This paper
focuses its attention on the following two questions: (1)Does the statement that, ‘‘The human must be incommand,’’ have to hold at all times and on every
occasion, and in every transportation mode? (2) What
the automation may do when it detected the human’s
inappropriate behavior or performance while monitoring
the human? Is it allowed only to give some warnings?

162
Table 1 Principles of human-centered automation
The human bears the ultimate responsibility for safetyof aviation system
Therefore: The human must be in command To command eﬀectively, the human must be involved
 To be involved, the human must be informed
 Functions must be automated only if there is a goodreason for doing so
 The human must be able to monitor the automated system
 Automated systems must, therefore, be predictable Automated systems must be able to monitor the humanoperator
 Each element of the system must have knowledgeof the others’ intent
 Automation must be designed to be simple to learn and operate

and the other is to put it into a standby state. It is hard
to tell which design is better than the other. Loss ofmode awareness or automation surprises can occur ineither type, but in a diﬀerent way. Inagaki and Kunioka(2002) conducted an experiment with a PC-based driving
simulator where no information was displayed regarding
the state of the ACC. Subjects were requested to carryout procedures of perception, decision-making, andaction implementation based on their mental models.
Even after training or experience with the ACC systems
on the simulator, loss of mode awareness and automation surprises were observed, which reﬂect over-trust in
and distrust of automation, and inertness of mental
models.

After Billings (1997) and ICAO (1998)

2.2 Time criticality
Or, is it allowed to act autonomously to resolve thedetected problem? It is also argued that human-centeredoperator support must be multi-layered by taking into
account operator characteristics and circumstantial
contexts, in which (1) enhancement of situation
awareness and (2) trading of authority are importantdesign aspects.

2 Factors contributing to domain dependence
Domain-dependence of human-centered automation
may come from quality of human operators and timecriticality.
2.1 Quality of human operators
Quality of human operators varies depending on whether they are professional or non-professional. Professional operators, such as airline pilots, are trained
thoroughly and continually so that their knowledge andskill are perfect enough to use smart and sometimes
complicated machines properly. On the other hand, incases of non-professional operators, such as private car
drivers, it would not be sensible to assume that theirlevels of knowledge and skill are high. Their understanding of machine functionalities can be incomplete,or even incorrect.
Example 1: The adaptive cruise control (ACC) systems are designed to reduce the driver’s workload byfreeing him or her from frequent acceleration anddeceleration. Sometimes they may be diﬀerentiated into
two classes: high-speed range ACC and low-speed range
ACC. When there is a preceding vehicle to follow, both
ACC systems control the speed of the own vehicle sothat the time gap to the target vehicle may be maintained. Suppose the sensor lost sight of the target vehicle, the high-speed range ACC continues to stay in its
active state. In cases of the low-speed ACC, its behavior
diﬀers depending on control logic design. Two designs
are possible: one is to let the ACC stay in its active state,

Time criticality diﬀers appreciably depending on thetransportation mode. Consider the following examples
in which an automated warning system is available forthe operator.
Example 2: Traﬃc alert and collision avoidance system (TCAS) is a family of airborne devices designed tohelp pilots to avoid a mid-air collision. Its functionalities
are described as follows (US Department of Transportation & FAA 2000): TCAS sends interrogations at
1,030 MHz to which transponders on nearby aircraft
respond at 1,090 MHz. By decoding the replies, theposition and altitude of the nearby aircraft are identiﬁed.
Based on the range, altitude, and bearing of nearby
aircraft, TCAS performs range and altitude tests todetermine whether the aircraft is a threat or not. Whenthe nearby aircraft is declared a threat, TCAS selects an
avoidance maneuver (to climb or descend) that will
provide adequate vertical miss distance from the threat.
If the threat is also a TCAS-equipped aircraft, theavoidance maneuvers will be coordinated between the
two TCAS systems so that one aircraft climbs andthe other descends. TCAS then issues a resolution advisory(RA) to let the pilot know the appropriate avoidance
maneuver. The estimated time to the closest point ofapproach is 15–35 s. The pilots are supposed to respondto the RA within 5 s.
Example 3: The enhanced ground proximity warning
system (EGPWS) is designed to help pilots to avoid aground collision (Bresley and Egilsrud 1997). EGPWS
collects air data, radio altitude, barometric altitude, andairplane position through some other systems, such as
ﬂight management system, GPS, and the airplane air
data system. Receiving these data, EGPWS determines
potential terrain conﬂict by use of its self-contained
worldwide airport and terrain databases. EGPWS displays the terrain in dotted patterns with colors indicating
the height of the terrain relative to the current airplane
altitude. EGPWS continuously computes terrain clearance envelopes ahead of the airplane. If these envelopes
conﬂict with data in the terrain database, EGPWS setsoﬀ alerts. A caution-level alert is issued approximately

163

40–60 s before a potential terrain conﬂict, and a warning-level alert is set oﬀ approximately 20–30 s before a
conﬂict.
Example 4: Nowadays, some types of automobiles areequipped with a forward vehicle collision warning system. The system detects the forward vehicle and measures its speed and the distance to it by a distance radar(mostly, a laser radar or a millimeter-wave radar) sensor
mounted on the own vehicle. When there is a possibilityof collision against the preceding vehicle, the system setsoﬀ a collision warning. The estimated time to collision is
at most a few seconds.
As can be seen in Examples 2 and 3, if the collision
warning were against another aircraft or terrain, enoughamount of time would be available for the pilot to grasp
the situation, validate the given warning, and initiate acollision avoidance maneuver. In case of the automobile,
however, time criticality is extremely high, and little time
may be left for the driver, as can be seen in Example 4.

3 Operator support must be multi-layered
How can we design functionalities for assisting humanoperators appropriately? Discussions may be made on
two aspects: (1) enhancement of situation awareness and(2) trading of authority.
3.1 Enhancement of situation awarenessDriving requires a continuous process of perception,
decision-making, and operation. Understanding of thecurrent situation determines what action needs to bedone (Hollnagel and Bye 2000). Once situation-diagnostic
decision is made, action selection decision is usuallystraightforward (Klein 1993). Various intelligent functionalities have thus been proposed to assist driver’s situation-diagnostic decision. Human interface design iscentral for enhancing driver’s situation awareness,
assisting diagnosis on the situation, avoiding automation

Fig. 1 Automation surprises
caused by the adaptive cruise
control (ACC) systemsurprises, and establishing appropriate trust in automation. The human interface must enable the human to: (1)understand the rationale why the automation thinks so,(2) recognize intention of the automation, (3) share thesituation recognition with the automation, and (4) perceive limitations of automation’s functional abilities.
Example 5: Traditional GPWS sometimes failed toshare situation awareness with pilots. GPWS could set
oﬀ false alarms and no eﬀective measures were available
for the pilots to validate the alarms. In some controlled
ﬂight into terrain (CFIT) accidents, it is known thatpilots disregarded correct pull-up warnings. Pilots
sometimes trusted the GPWS overly, however, eventhough its capability to detect conﬂict against terrain
was not perfect. Currently available EGPWS seems to be
successful in sharing situation awareness with pilots byvirtue of its capability to display the terrain in dotted
patterns with colors indicating the height of the terrain
relative to the own aircraft altitude. Also, when a pull up
warning was issued, the pilots can see clearly why thewarning was set oﬀ. The pilots may be able to predict a
warning before it is actually set oﬀ.
Example 6: When driving a car equipped with an
ACC system, we sometimes experience automation surprises. Figure 1 depicts two of such cases. In Case 1, theown vehicle accelerates by trying to follow a fastervehicle driving on the adjacent lane, while the driver
expected deceleration when he or she noticed that thevehicle ahead on the same lane was slowing down. This
type of failure in understanding the ACC’s intention
may be mainly due to insuﬃcient information feedback
regarding the target vehicle. The ACC displays a visual
symbol indicating that it has detected a preceding vehicle
and is following it as the target vehicle. However, evenwhen the target was replaced by another vehicle, currently available human interface does not usually informthe driver. Also, as shown in Case 2, even though thedriver noticed a cutting-in vehicle and expected the ACC
would slow down the own vehicle, the ACC may
accelerate the own vehicle to catch up with the preceding
vehicle, failing to detect the cutting-in vehicle. This type

Case 1

Why does ACC
accelerate now?

Case 2Why does not
ACC decelerate?

164

of automation surprise may be due to driver’s failure insharing situation recognition with the ACC, as well as
failure in understanding limitations of functional abilities of the ACC (or its detection sensor).
3.2 Trading of authority
The enhancement of human operator’s situation
awareness are essential in realizing human-centeredautomation, in which ‘‘the human bears the ultimate
responsibility for safety’’ and ‘‘the human must be incommand’’ (see Table 1). However, humans may notalways be able to cope with the given situation, as shownin the following example.
Example 7: ITARDA (Institute for Traﬃc Accident
Research and Data Analysis) analyzed data of automobile accidents occurred in Japan during the period of
1993–2001. Among all accidents of four-wheel vehicles,
they extracted 359 head-on or rear-end collisions forwhich microscopic data are available on the following
items: vehicle’s speed and location at which the driverperceived a possible danger, vehicle’s speed right before
the collision, and vehicle’s speed at the collision. They
found: 13.9% of drivers tried to avoid collisions withsteering and braking, 42.6% with braking only, and5.6% with steering only. Surprisingly, 37.9% of drivers
did neither steer the wheel nor apply the brakes(ITARDA 2003).
How can we design a system that assists the driverwhen a collision may be imminent? Consider the following two types of pre-crash safety system.
Example 8 (Pre-crash safety system of type 1): The
radar sensor monitors the preceding vehicle. When thesystem judges, based on distance and relative speed of thepreceding vehicle, that a collision might be anticipated, it
gives a warning to the driver and retracts the seatbelts.
Example 9 (Pre-crash safety system of type 2): Whenthe system judges that a collision might be anticipated, it
gives a warning to the driver and retracts the seatbelts,
as in the case of type 1. When the system determines thata collision is imminent and that the driver is late in
responding to the situation, it retracts the seatbelts
ﬁrmly and applies an automatic emergency brake.
The pre-crash safety system of type 1 is to enhancethe driver’s situation awareness. If the driver applies thebrakes fast enough, no collision may occur. However, if
the driver failed to respond to the situation, the systemgives no active help, and therefore the collision shall be
inevitable.
The pre-crash safety system of type 2 has two layersof assistance: enhancement of the driver’s situation
awareness, and trading of authority in emergency.
Trading of authority in this case is to support action
implementation when the driver failed to take the action
at a right time. Note that the system applies the emergency brakes, not based on the driver’s directive, but
based on its own decision. One of the principles in Table 1, ‘‘the human must be in command,’’ is violated.

However, that does not necessarily mean that the precrash safety system of type 2 should not be allowed. On
the contrary, Example 7 suggests the need for systeminitiated trading of authority in emergencies.
Professional operators may also fail to respond
appropriately to the situation encountered, as shown in
the following two examples.
Example 10: An analysis of CFIT accidents of commercial jet airplanes during the period of 1987–1996
found that 30% of the accidents occurred while theground proximity warning system (GPWS) failed todetect terrain ahead, and 38% were due to late warningof the GPWS or improper pilot response (Bresley andEgilsrud 1997). Problems of ‘‘no warning’’ or ‘‘latewarning’’ may be resolved by introducing EGPWS thatcan enhance pilot’s understanding of the height of terrain relative to the aircraft altitude. Problem of ‘‘pilot’s
late response’’ might not be resolved fully by EGPWS,
since it is the human pilot that is responsible for a collision avoidance maneuver. However, there is a system
in which a collision avoidance maneuver may be initiated by automation. The automatic ground collision
avoidance system (Auto-GCAS) for a combat aircraft issuch an example (Scott 1999). When a collision against
the terrain is anticipated, the system gives a pull-up
warning. If the pilot takes a collision avoidance action
aggressively, then the system will not step in any further.
If the pilot did not respond to the warning, the systemtakes over control from the pilot and executes an automatic collision avoidance maneuver. When no threatening terrain is found any more, the system returns
control back to the pilot. Thus, the Auto-GCAS determines when to intervene and when to return theauthority back to the pilot.
Example 11: A 41,507-ton container vessel collided
with a 19-ton ﬁshing boat about 40 km oﬀ Hokkaido,
Japan’s northern island on 28 September 2005, causing
the ﬁshing boat capsized. It is reported, ‘‘The secondclass navigator and the lookout failed to take necessary
measures to prevent the collision even though an alarm
warning of a collision with another vessel went oﬀ on thecontainer ship’’ (Mainichi Daily News 2005). In order tolessen such an accident, a collision avoidance support
system is under development with the aid of the Ministryof Land, Infrastructure and Transport, Government ofJapan (Kayano et al. 2004). The system has functionalities not only for enhancement of situation awarenessbut also for trading of authority. By using automatic
identiﬁcation system (AIS) and a multi-image sensor
system, the system detects vessels and displays them on ahead-up display for the oﬃcer of the watch. When theown ship encountered a collision danger, the system
displays the oﬃcer the most feasible collision evasionroute. If the oﬃcer approves the route, the system controls the own ship according to the plan. If the oﬃcer
failed to take any proper collision avoidance maneuver,
the system takes over control, when a certain condition
is met, and applies an automatic collision avoidance
maneuver to keep the predeﬁned safety margin.

165

4 Levels of automation
In the Section 1, the following questions have beenraised: (1) Does the statement that, ‘‘The human must be
in command,’’ have to hold at all times and on every
occasion, and in every transportation mode? and (2)What the automation may do when it detected thehuman’s inappropriate behavior or performance while
monitoring the human? Is it allowed only to give somewarnings? Or, is it allowed to act autonomously to resolve the detected problem?
As we have already seen in the previous examples,
human may fail to recognize or respond to the given
situation appropriately. Even when the situation wasunderstood correctly, the human may not be able to takenecessary actions in emergencies. Some automatic decision-making and action implementation may be needed
for transportation safety. Now the question becomes:
How can the human and the automation share authority
and responsibility for transportation safety?
One useful tool in discussing the issue is the level ofautomation (LOA). Table 2 gives an expanded version
in which one LOA comes between levels 6 and 7 in theoriginal list by Sheridan (1992). The added LOA, called
level 6.5, has been introduced by the author (Inagaki
et al. 1998) to reduce automation surprises induced byan automatic action, as well as to make the actioneﬀective in emergencies. The pre-crash system in
Example 9 is one of real-world examples with level 6.5.
As long as the LOA is positioned at level 5 or lower, thehuman is maintained as the ﬁnal authority. If the LOA is
positioned at level 6 or higher, however, the human may
not be in command.
In terms of LOA, the last question in the above may
be rephrased as: Which LOA has to be chosen fortransportation safety? Simply stated, the answer to thequestion is: An appropriate LOA is situation-dependent(where ‘‘situation’’ includes ‘‘context’’ and ‘‘transportation mode’’) and it may change from one level to another in a dynamically changing environment, which iscalled the situation-adaptive autonomy (Inagaki 1993,
Table 2 Scales of levels of automation
1
2
3
4
5
6
6.5
7
8
9
10

The computer oﬀers no assistance; human must do it all
The computer oﬀers a complete set of action alternatives,andNarrows the selection down to a few, or
Suggests one, andExecutes that suggestion if the human approves, orAllows the human a restricted time to veto before automatic execution, or
Executes automatically upon telling the human what it isgoing to do, or
Executes automatically, then necessarily informs humans
Informs him after execution only if he asks
Informs him after execution if it, the computer, decides to
The computer decides everything and acts autonomously,
ignoring the human

After Sheridan (1992), Inagaki et al. (1998), and Inagaki and
Furukawa (2004)

1999). In case of the Auto-GCAS in Example 10, LOA
changes dynamically: if the pilot takes a collision
avoidance maneuver aggressively upon receiving a pullup warning, the Auto-GCAS will not step in any further(LOA stays at level 4). If the pilot did not respond to thewarning, the Auto-GCAS takes control back from thepilot and executes an automatic collision avoidance action (LOA goes up to level 6). It would also be easy tosee in Example 11 that the system chooses levels 4 and 6
according to circumstances.

5 Which LOA is appropriate?
Three approaches are available for choosing an appropriate LOA. Each approach is illustrated with an
example.
Example 12 (Mathematical analysis): Suppose anengine fails while an aircraft is making a takeoﬀ roll.
The standard decision rule for the case is simple: (a)abort the takeoﬀ if the aircraft speed is below V1, and(b) continue the takeoﬀ if V1 has already beenachieved, where V1 is the takeoﬀ decision speed (viz.,the maximum speed at which the pilot can initiate rejected takeoﬀ maneuver to stop the aircraft safely
within the remaining ﬁeld length, and the minimum
speed to continue a one-engine out takeoﬀ to attain aheight of 35 ft at the end of the runway). That thedecision rule is simple does not necessarily mean thatthe decision can be made easily and correctly. An
analysis of rejected takeoﬀ overrun accidents during theperiod of 1959–1990 has found that 58% of the overrun accidents were due to inappropriate rejection of
takeoﬀs in excess of V1 (FAA 1992). Inagaki (1997,
2000) has proven mathematically using a probability
model with various parameters, such as reliability ofengine failure warnings, reliability of human judgment(hesitation in decision-making has been investigated aswell as hit, correct rejection, false alarm, and missed
detection in the signal detection theory), expected loss
because of incorrect judgment, or delay in decision.
The conclusion was that Go/NoGo decision should
neither be fully automated nor left always to the human pilot: (1) the human pilot must be in authority
when the aircraft speed is far below V1, where LOA is
set at level 4; (2) the computer must be in authority if
aircraft is almost at V1 and if there is a possibility thatthe pilot may hesitate to judge whether the given
warning was correct or not, where LOA is set at level 6
or higher; and (3) when the aircraft speed is between(1) and (2), which agent must be in command depends
on the situation. Another important conclusion wasthat, for a human pilot to be in command at all times
and in every occasion, human interface needs to bechanged so that a more direct message, such as ‘‘go’’ or‘‘abort,’’ can be given to the pilot, instead of just givingan ‘‘engine failure’’ warning, because ‘‘engine failure’’alert is ambiguous in the sense that it means Go incases of after V1, and NoGo before V1.

166

Example 13 (Experimental approach): In order toexamine the mathematical ﬁndings described in
Example 12, a ﬂight simulator of a two-engine aircraft
has been implemented, and an experiment with a factorial design, mapping onto (Control mode) · (Phase) · (Human interface design) was conducted(Inagaki et al. 1999). For the control mode, the manualmode and the situation-adaptive autonomy (SAA)
mode were distinguished. In the manual control mode,
LOA was set at level 4. In the SAA-mode, the computer changes LOA dynamically within the range oflevels 4 to 6, and may take over control for continuing
the takeoﬀ when it determines that it is impossible forthe human to initiate rejected takeoﬀ maneuver before
V1 is achieved. It has been observed in the experimentthat the new interface (that tells ‘‘go’’ or ‘‘abort’’) can
reduce overrun accidents signiﬁcantly compared to theconventional interface (that gives an ‘‘engine failure’’
warning). However, even with the new interface, overrun accidents did occur under the manual control
mode. In the SAA-mode, on the contrary, no overrun
accidents were observed, which proved the eﬃcacy ofsystem-initiated trading of control.
Example 14 (Computer simulation): This approach
may be useful for investigating human-automationinteraction under possibility of human’s over-trust in
automation. Consider a driving with the ACC system atwork. While observing the ACC behaves properly again
and again, the driver may begin to place excessive trustin automation sometime along the line, and may eventually fail to allocate attention to the driving environment. With an ordinary brake, the ACC can cope up toa certain rate of deceleration of the forward vehicle.
Suppose the ACC recognized a preceding vehicle’s
excessive deceleration. Which is reasonable among thefollowing design alternatives for assuring safety in thiscase? (1) ACC gives an emergency-braking alert tellingthe driver to apply the brakes hard enough to avoid acollision, in which LOA is set at level 4; (2) ACC gives
an emergency-braking alert, and if the driver does not
respond within a pre-speciﬁed time, it applies an automatic emergency brake, in which LOA is positioned at
level 6; and (3) ACC applies its automatic emergency
brake simultaneously when it issues an emergencybraking alert, in which LOA is set at level 6.5. Based ona discrete-event model of dynamic transition of driver’s
psychological states (distinguishing ﬁve states, from a
subnormal and inactive state to a hyper normal andexcited state), 3,000 Monte Carlo simulations were
performed for various driving scenarios with diﬀerent
degrees of ‘‘peacefulness’’ (Inagaki and Furukawa 2004).
It has been observed that, when the driving was peacefuland the ACC continued to be successful in its longitudinal control, the driver was likely to rely on the ACC,
and his or her vigilance degraded. When the target
vehicle made a rapid deceleration in such circumstances,the driver might not be able to cope with the situation ina timely manner, even with the aid of an emergencybraking alert. The number of rear-end collisions against

the preceding vehicle was signiﬁcantly larger under design (1) than either of those under (2) or (3), and no
accident was observed under (3), which shows the needof high LOA for assuring car safety under time stress,
especially when the driver may be inattentive.

6 Toward more precise understandingof human-centered automation
This paper has discussed how human-centered automation may vary depending on transportation modes.
For more than two decades, human-centered automation concept has been investigated and practiced
most extensively in aviation. In spite of the success,principles of human-centered automation for aviation
systems may not always be applicable to other transportation modes in a straightforward manner. Eﬀorts
are needed to establish a ‘‘human-centered automation’’ for each transportation mode. Especially, morethorough investigations are necessary to answer whether the human must be in command at all times andon every occasion, or whether the automation may beallowed to initiate trading of authority from human toautomation.
Whether trading of authority must be human-initiated or system-initiated has been a crucial research issue
in adaptive automation (Rouse 1988; Parasuraman et al.
1992; Scerbo 1996; Inagaki 2003), because trading ofauthority is essential in function allocation in a
dynamically changing environment. Although human
may not be in command in case of system-initiatedtrading of control, such autonomous decision-making or
action implementation are sometimes indispensable toassure traﬃc safety, especially for automobile with not
fully trained drivers.
If human-centered automation is to ‘‘realize work
environment in which humans and machines collaborate
cooperatively,’’ automation may be allowed to takecountermeasure actions at its own discretion to help
humans in diﬃcult circumstances in which little resources are left for the humans to give directives to themachines. Billings (1992) said, in one of his pioneering
work on the human-centered automation, ‘‘it (automation) should never assume command.’’ The sentence waspreceded, however, by the phrase, ‘‘Except in pre-deﬁned situations’’ (Billings 1992). It has not yet beenclariﬁed fully by this time what are ‘‘pre-deﬁned situations.’’ It would be time for us to work on the issue
extensively to make the human-centered automation
concept more precise and more promising.
Acknowledgement This work has been partially supported by the
Ministry of Education, Culture, Sports, Science and Technology,
Government of Japan, with the Special Coordination Funds for
Promoting Science and Technology–Research and Development
Program for Resolving Critical Issues. Since 2004 the author has
been the leader of 3-year project, ‘‘Situation and Intention Recognition for Risk Finding and Avoidance: Human-CenteredTechnology for Transportation Safety.’’ The research project
aims at developing adaptive automation for automobile and its

167
associated technologies, in which authority of control is traded
between a driver and automation dynamically depending on thedriver’s psychological/physiological state, time-criticality, and risksof the situation in the traﬃc environment.

References
Billings CE (1992) Human-centered aircraft automation: a concept
and guidelines (NASA Techn. Mem. 103885). NASA Ames
Research Center
Billings CE (1997) Aviation automation—the search for a humancentered approach. LEA
Bresley B, Egilsrud J (1997) Enhanced ground proximity warning
system. Boeing Airliner, July–September 1997, 1–13
Cacciabue PC (2004) Guide to applying human factors methods:
human error and accident management in safety critical systems. Springer, Berlin Heidelberg New York
Endsley MR, Kiris EO (1995) The out-of-the-loop performance
problem and the level of control in automation. Hum Factors
37(2):3181–3194
FAA (1992) Takeoﬀ safety training aid
Hollnagel E, Bye A (2000) Principles for modeling function allocation. Int J Hum Comput Stud 52:253–265
Hollnagel E, Woods DD (2005) Joint cognitive systems: foundations of cognitive systems engineering. CRC Press, Boca Raton
ICAO (1998) Human factors training manual. Doc 9683-AN/950
Inagaki T (1993) Situation-adaptive degree of automation forsystem safety. Proceedings of the 2nd IEEE international
workshop on robot and human communication, 231–236
Inagaki T (1997) To go no not to go: decision under time-criticality
and situation-adaptive autonomy for takeoﬀ safety. Proceedings of the IASTED international conference on applied modelling and simulation, 144–147
Inagaki T (1999) Situation-adaptive autonomy: trading control of
authority in human-machine systems. Automation technology
and human performance: current research and trends, pp 154–
159, LEA
Inagaki T (2000) Situation-adaptive autonomy for time-criticaltakeoﬀ decisions. Int J Model Simul 20(2):175–180
Inagaki T (2003) Adaptive automation: Sharing and trading ofcontrol. In: Hollnagel E (ed) Handbook of cognitive task design. LEA, pp. 147–169
Inagaki T, Kunioka T (2002) Possible automation surprises in the
low-speed range adaptive cruise control system. IASTEDInternational Conference on Appl Model Simul, pp 335–340
Inagaki T, Furukawa H (2004) Computer simulation for the designof authority in the adaptive cruise control systems under possibility of driver’s over-trust in automation. Proceedings of theIEEE SMC conference, 3932–3937
Inagaki T, Stahre J (2004) Human supervision and control inengineering and music: similarities, dissimilarities, and theirimplications. Proc IEEE 92(4):589–600
Inagaki T, Moray N, Itoh M (1998) Trust self-conﬁdence andauthority in human-machine systems. Proceedings of the IFAC
man-machine systems, 431–436

Inagaki T, Takae Y, Moray N (1999) Automation and humaninterface for takeoﬀ safety. Proceedings of the 10th international symposium on aviation psychology, 402–407
ITARDA (2003) Anecdotal report on traﬃc accident investigations
and analyses (in Japanese). ITARDA
Kayano J, Fukuto J, Imazu H, Igarashi K (2004) On a collision
avoidance support system for one-person bridge operation.
Proceedings of the 3rd international conference on collision andgrounding of ships (ICCGS), 81–86
Klein G (1993) A recognition-primed decision (RPD) model of
rapid decision making. In: Klein G et al (eds) Decision making
in action. Ablex, 138–147
Mainichi Daily News (2005) Captain, crewmembers of Israeli shiparrested over fatal collision. (2005, October 24) http://
www.mdn.mainichi-msn.co.jp/national/news/
p20051024p2a00m0na007000c.html
Orlady HW, Orlady LM (1999) Human factors in multi-crew ﬂight
operations. Ashgate
Parasuraman R, Riley V (1997) Humans and automation: use,
misuse, disuse, abuse. Hum Factors 39(2):230–253
Parasuraman R, Bhari T, Deaton JE, Morrison JG, Barnes M(1992) Theory and design of adaptive automation in aviation
systems (Progress Report No. NAWCADWAR-92033-60).
Naval air development center aircraft division
Rouse WB (1988) Adaptive aiding for human/computer control.
Hum Factors 30(4):431–443
Sarter NB, Woods DD (1995) How in the world did we ever get
into that mode? Mode error and awareness in supervisory
control. Hum Factors 37(1):5–19
Sarter NB, Woods DD, Billings CE (1997) Automation surprises.
In: Salvendy G (ed) Handbook of human factors and ergonomics, 2nd edn. Wiley, London, 1926–1943
Scerbo MW (1996) Theoretical perspectives on adaptive automation. In: Parasuraman R, Mouloua M (eds) Automation andhuman performance. LEA, pp 37–63
Scott WB (1999) Automatic GCAS: ‘‘You can’t ﬂy any lower.’’
Aviat Week Space Technol 150(5):76–79
Sheridan TB (1992) Telerobotics, automation, and human supervisory control. MIT Press, Cambridge
Sheridan TB (2002) Humans and automation: system design andresearch issues. Human factors and ergonomics society & Wiley
US Department of Transportation & FAA (2000) Introduction to
TCAS II version 7
Wickens CD (1994) Designing for situation awareness and trust in
automation. Proceedings of IFAC integrated systems engineering, 77–82
Wickens CD, Lee JD, Liu Y, Becker SEG (2004) An introduction
to human factors engineering, 2nd edn. Prentice-Hall, Englewood Cliﬀs
Woods D (1989) The eﬀects of automation on human’s role:
experience from non-aviation industries. In: Norman S, Orlady
H (eds) Flight deck automation: promises and realities (NASACR-10036, pp.61-85). NASA Ames Research Center