AIR COMMAND AND STAFF COLLEGE

AIR UNIVERSITY

Identifying and Mitigating the

Risks of Cockpit Automation

WESLEY A. OLSON

Major, USAF

Air Command and Staff College

Wright Flyer Paper No. 14

MAXWELL AIR FORCE BASE, ALABAMA

June 2001
Disclaimer

Opinions, conclusions, and recommendations expressed or implied within 

solely those of the author and do not necessarily represent the views of Air 

versity, the United States Air Force, the Department of Defense, or any othe

government agency. Cleared for public release: distribution unlimited.

ii

This Wright Flyer Paper and others in the series ar

available electronically at the Air University Research

Web site http://research.maxwell.af.mil under “Re

search Papers” then “Special Collections.”
Foreword

It is my great pleasure to present another of the Wri

Flyer Papers series. In this series, Air Command and S

College (ACSC) recognizes and publishes the “best of 

best” student research projects from the prior academ

year. The ACSC research program encourages our s

dents to move beyond the school’s core curriculum in th

own professional development and in “advancing ae

space power.” The series title reflects our desire to perp

uate the pioneering spirit embodied in earlier generati

of airmen. Projects selected for publication combine so

research, innovative thought, and lucid presentation in 

ploring war at the operational level. With this broad p

spective, the Wright Flyer Papers engage an eclectic ra

of doctrinal, technological, organizational, and operatio

questions. Some of these studies provide new solutions 

familiar problems. Others encourage us to leave the fam

iar behind in pursuing new possibilities. By making th

research studies available in the Wright Flyer Pape

ACSC hopes to encourage critical examination of the fi

ings and to stimulate further research in these areas.

John T. Sheridan, Brig Gen (Sel), US

Commandant

iii
Preface

This paper provides a brief summary of the direct co

associated with automation. It also provides a framew

for designers, managers, and pilots in implementing me

ures to mitigate these costs. Safety improvements are 

the province of any one of these groups. Instead, an in

grated effort between these communities is necessary 

promote aviation safety. I have assumed that the rea

has a working knowledge of glass cockpit aircraft as w

as a basic understanding of human factors issues. T

scope of this project is narrowed to focus exclusively 

automation issues arising from studies of transport 

craft. In spite of this specific focus on aviation, the iss

raised here apply across a wide range of highly automa

domains. I thank Lt Col Steven A. Kimbrell for his adv

and assistance on this project.

v
Abstract

Cockpit automation has delivered many promised be

fits, such as improved system safety and efficiency; h

ever, at the same time it has imposed system costs that 

often manifest in the forms of mode confusion, errors 

omission, and automation surprises. An understanding 

the nature of these costs as well as associated influenc

factors is necessary to design adequately the future au

mated systems that will be required for Air Mobility Co

mand aircraft to operate in the future air traffic envir

ment. This paper reviews and synthesizes human fact

research on the costs of cockpit automation. These resu

are interpreted by modeling the automated cockpit a

supervisory control system in which the pilot works w

but is not replaced by, automated systems. From t

viewpoint, pilot roles in the automated cockpit provide n

opportunities for error in instructing, monitoring, and 

tervening in automated systems behavior. These oppor

nities for error are exacerbated by the limited machine 

ordination capabilities, limits on human coordinat

capabilities, and properties of machine systems that pl

new attention and knowledge demands on the human 

erator. In order to mitigate the risks posed by these kno

opportunities for error and associated influencing facto

a system of defenses in depth is required involving in

grated innovations in design, procedures, and traini

The issues raised in this paper are not specific to transp

aircraft or the broader aviation domain but apply to 

current and future highly automated military systems.

vii
Background

The laws that govern the behavior of human-mach

systems are, in many ways, analogous to the laws t

govern our physical world. Actions that affect any one s

tem component invariably have ripple effects and som

times unforeseen interactions with other system com

nents. For example, while the evolution of power

automated cockpit systems has allowed for the curr

high levels of safety and efficiency in the aviation syste

it has also resulted in new types of potentially serious s

tem failures in the form of breakdowns in human-mach

coordination. Observed performance problems in 

human-machine cockpit team are discussed in this pap

The goal is to provide Air Mobility Command’s (AMC) 

signers, administrators, and operators an understand

of the known risks associated with the automated cock

systems that will be required to operate in the future 

traffic environment. Based on this assessment of kno

risks, an integrated set of measures can be developed 

mitigate the risks associated with the introduction of th

automated systems.

The evolution of highly capable automated cockpit s

tems has provided substantial benefits to the aviation s

tem. Automated cockpit systems are the driving force 

hind the safe, precise, and economical operations t

have allowed the aviation system capacity to increase d

matically over the last 50 years while providing corresp

ding increases in safety and economy. Studies indic

that air travel is one of the safest transportation mediu

with an accident rate of less than two per million dep

tures.1 Additionally, the introduction of automated navi

tion systems and the flight management computer (FM

has provided substantial fuel savings and—in combinat

with automated system controllers—has allowed for 

elimination of the navigator and flight engineer, thus 

ducing training and personnel costs. 

Reports estimate that over the next 10 years aviat

traffic growth will continue at a 5 percent yearly ra

Since the world aviation system is already nearing cap

ity, significant system changes will be necessary to fac

tate this anticipated growth. New and increasingly pow

1
ful automated systems will be required to implement 

future air traffic environment. For example, “free flight

one proposal currently under development to increase 

efficiency and capacity of the aviation system by allow

pilots to fly random routes and altitudes. This implem

tation will require the addition of automated cockpit pl

ning and collision avoidance aids.3 Although many A

aircraft are currently undergoing extensive cockpit 

grades, they will likely require further upgrades to com

with the requirements of the future air traffic environme

In spite of these substantial observed and potential b

efits, cockpit automation also imposes costs on the av

tion system. These costs are frequently expressed in 

form of accidents and incidents attributed to the bre

downs in coordination between the pilot and automa

systems. While the overall rate of aviation accidents h

declined dramatically over the last 30 years, little impro

ment has been seen over the last 15 years despite the c

tinued evolution and improvement of automated cock

systems such as the Ground Proximity Warning Syst

(GPWS) and Traffic Collision Avoidance System (TCAS)

closer examination of the aircraft accident data indica

that human error accounts for between 65 and 85 perc

of all accidents. In many cases, this causal human er

can be attributed to inappropriate human interaction w

automated systems.5

For example, on 24 April 1994 an Airbus 300-6

crashed while on approach to Nagoya, Japan. During 

approach the copilot inadvertently engaged the aircra

“go-around mode,” which caused the automated syste

to attempt to fly away from the ground using the airc

pitch trim system, while the pilots attempted to contin

the landing approach via input to the elevator. The pil

were unable to determine that the pitch trim input of 

autopilot system was causing difficulties controlling 

aircraft. Additionally, the design of the A300 autopilot 

that time) did not allow the pilots to override the autop

by use of opposing control stick pressure. Thus, the pil

and automated systems continued to struggle for cont

with the aircraft eventually pitching up to near verti

stalling, and crashing on the approach end of the ru

way—killing 264 passengers and crew.6
This accident illustrates a phenomenon that human f

tors researchers refer to as automation surprises (i.e., f

ures of the human operator to track, monitor, or anticip

the actions of automated systems leading to unintend

system behavior).7 A better understanding of the fact

that contribute to these automation surprises will al

AMC to determine and counteract the risks that may ar

from implementation of new automated cockpit system

This paper discusses the human role in automated s

tems and reviews the factors that research has shown m

influence breakdowns in coordination between human a

machine systems. Based on these findings, I discuss c

siderations for an integrated systems approach to count

act these risks. Since the focus is on automation upgra

to AMC aircraft, I concentrate specifically on cockpit 

tomation in transport aircraft. However, these findings 

also applicable to the broader aviation domain, as well 

other highly automated systems necessary to implem

the armed services’ joint vision that will be installed i

wide variety of military systems.

Human Role in Automated Systems

In order to understand the risks of automation, we m

first understand the relationship between humans and 

tomated systems. While it is tempting to assume that 

tomated systems function independently of the human 

erator, this is not the case. As Nehemiah Jordan first no

in 1963—more than 35 years ago—humans and machi

are not independent but instead are complementary.8 T

must work together to achieve desired system perfor

ance. Even the most highly automated systems still 

quire the presence of a human operator to monitor syst

performance and intervene in the case of system abn

malities and emergencies.9 In order for humans and m

chines to work together to achieve system goals, they n

to develop or engage in processes and activities that 

sure coordination and avoid conflict. The roles of 

human operator in highly automated systems provide n

opportunities for errors and undesired system perfor
ance associated with the introduction of automated s

tems.

Prior to the introduction of automated cockpit system

the primary role of the pilot was to directly control airc

performance by continuous inputs via the flight contr

and throttle(s). As automated systems have become m

powerful, they have gradually assumed direct contro

aircraft performance, while the pilot’s role has shifted t

monitor of automated system performance. For examp

other than takeoff and (usually) landing, most of the dir

aircraft control in a modern transport aircraft is delega

to automated systems—a control scheme known as sup

visory control.10

While this shift in roles has led to more precise and e

nomical control of aircraft performance, it has also led 

a change in the nature of observed system errors. In g

eral, since automated systems directly control aircraft p

formance, errors of commission—incorrect control action

have decreased. However, errors of omission—failures 

the pilot to act and intervene when required—have 

creased.11 In order to better understand the reasons 

hind this trend and to predict the errors that may be 

served with the introduction of future automated system

the following section examines in detail the human roles 

supervisory control systems and discusses the types of 

rors that may arise during each role.

Figure 1 depicts a general supervisory control system

In this type of system, the human operator provides hig

level goals to the automated system through interact

with what is known as a human interactive compu

(HIC). The HIC supplies the means for the operator to g

control instructions and monitor system behavior. For 

ample, on the modern flight deck pilots provide headi

altitude, and routing targets through both the FMC a

the autopilot Mode Control Panel (MCP). They receive fe

back on aircraft performance through the primary fli

display (PFD), Navigation Display (ND), and engine indi

tions depicted on the Engine Indication and Crew Alert

System (EICAS). (For those unfamiliar with glass cock

aircraft, see the appendix for a brief description.) T

HICs, in turn, interpret these pilot inputs and (based 

environmental conditions/aircraft performance) prov
inputs to the servos that actually control aircraft perfor

ance through what is termed task interactive comput

(TIC).

Human Operator

Displays Controls

Human Interactive

Computer System

Task Interactive

Computer System

Sensors Actuators

Task

A closer examination of human responsibilities a

tasks in supervisory control systems reveals poten

problems for the operator’s ability to coordinate hum

and machine performance. Thomas Sheridan identifies 

basic human roles in supervisory control: planning, tea

ing, monitoring, intervening, and learning.13

First, in the planning role the operator decides wh

variables to manipulate, develops criteria to assess syst

actions, and determines constraints on activities. T

planning process provides the basis for instructing au

mated systems and monitoring subsequent system beh

ior. For example, upon receipt of an Air Traffic Con

(ATC) clearance, the crew plans by determining which 

Figure 1. Human Roles in Supervisory Control
topilot mode and FMC or MCP input will be required to 

ecute that clearance. Second, once a plan is developed, 

pilot teaches the automated systems by providing the 

propriate targets or instructions to automated system

Third, after providing input to the automated systems, 

pilot then monitors system performance to ensure the s

tem is performing as expected. Monitoring refers to all 

tivities involved in adjusting system performance in 

sponse to small deviations (trimming), as well as fa

detection and diagnosis. In the current cockpit, the p

relies primarily on information presented on the PFD a

ND to monitor system performance. These instrume

give indications of aircraft attitude, altitude, airspeed, a

heading, as well as active aircraft mode(s) and comma

targets. Fourth, the pilot determines whether and whe

is necessary to intervene with machine performance (d

to, for example, task completion, machine requests for 

sistance, or undesired system performance). Fifth, ba

on the given plan, inputs to the system, system behav

and interventions (if any), the pilot learns lessons that m

be applied to system control in future situations.

Errors can occur at each of these five steps. During 

planning stage, errors occur when the pilot develops an 

appropriate plan for providing data to the automated s

tems. These errors have two general causes. First (as 

also the case in nonautomated systems), errors can oc

when pilots fail to consider all available information (su

as fuel state or existing weather) when developing the pl

Second, they may occur when pilots do not understa

how the automated systems will respond to the pl

These failures may be due either to an inadequate men

model of system operation or to a failure to understand 

current operating mode of the aircraft. Research indica

that due to the complexity of automated systems, pil

frequently possess a faulty knowledge of automated s

tem action, with a majority of pilots surveyed indicat

that they have been surprised by automated system 

tions.14 Also, pilots may possess the relevant knowle

but may be unable to apply that knowledge in the curr

context—a phenomenon known as inert knowledge.15 

example, although pilots may have been trained on p

gramming holding patterns into the FMC database, t
may be unable to retrieve and apply that information wh

called upon to do so during flight. Research indicates t

inert knowledge is a frequent problem in automated s

tems, especially when the required actions are only in

quently performed.16 Finally, pilots may develop an in

propriate plan due to a lack of knowledge regarding 

operating mode of the aircraft—a phenomenon known 

mode error. This problem is particularly critical since 

some cases, the same operator input will result in dra

cally different system behavior depending on the operat

mode of the aircraft. For example, an A320 crashed on 

proach to Strasbourg, France, in January 1992 when 

crew attempted to program the aircraft to fly a 3.0-deg

glide path. However, due to the active autopilot mode, 

input was interpreted as a command to fly a 3,300-foot 

minute descent rate. As a result, the aircraft crashed s

eral miles short of the runway. Mode error is a comp

problem; however, it is often tied to the failure of cock

mode indications to capture pilot attention as well as 

occurrence of automatic, or uncommanded, mode tran

tions dictated by system software.17

Errors can also occur in the teaching role. These err

generally take the form of data input errors—often the 

correct entry of altitude or navigation information. T

type of error is a common cause of deviations from ATC 

structions. While incorrect data entry is generally cons

ered easier to detect than the development of an incorr

plan,18 the frequent presence of a time delay between d

entry and system impact can act against error detecti

For example, navigation data entered prior to taxi may 

affect aircraft performance until many hours into flig

The 1983 Korean Air Lines shootdown over Russian 

space may have been caused by such a data entry erro

Errors also arise during pilot monitoring. These err

are failure to detect deviations from desired performan

These deviations from desired performance may arise fr

inappropriate plans, incorrect data entry, automated s

tem malfunctions, or in response to changes in the t

situation (variations in temperature or wind, system f

ures, etc.). Basic psychological research indicates that h

mans are relatively poor monitors and often fail to det

critical events.20 Flight simulator studies confirm that o
tasks have been delegated to automated systems, hum

monitoring is often insufficient to detect problems.21

Beyond human monitoring limitations, there are two 

ditional reasons for this relatively poor monitoring p

formance. First, in highly automated cockpits, resea

shows that pilots have gone away from a general inst

ment scan towards an expectations-based monitor

strategy in which they check specific cockpit indications 

confirm that the system is performing as expected. As a 

sult, pilots are less likely to detect automated system 

tions that go beyond pilot expectations.22 The logic in so

FMCs dictates that when a change is made to the land

runway, all current vertical constraints are deleted 

cause they may no longer be appropriate. Since this d

tion is not expected, research indicates that pilots often 

not check for, and thus do not detect, this situation.23 S

ond, automated systems often provide feedback that is 

sufficiently salient to attract pilot attention. One featur

automated systems is that they present more informat

than the pilot can process in the time available (inform

tion overload).24 In the absence of salient indications (i

flashing lights, color changes, etc.), pilots often do not p

attention to potentially relevant information. One simu

tor study found that nearly 25 percent of pilots who 

cessed a particular FMC page containing information 

quired to detect an error failed to detect the error due 

the poor layout of the FMC page (a cluttered display ful

numbers of similar appearance).25 In a related manner, 

design of the FMC also provides barriers to detecting u

desired performance. The FMC contains a wealth of p

formance and environmental data but can only show 

very small portion of that data at any one time. This f

ture is referred to as the keyhole property and places 

ditional demands on pilots in that they must not only 

alize that they need a particular piece of information 

must also remember where that piece of information is 

cated in the FMC menu structure.26

Even if errors are detected, they must still be correc

to prevent undesired system performance. In order to s

cessfully intervene in undesired system behavior, the p

must correctly assess the nature of the problem and 

termine an appropriate strategy for correcting the proble
It must be realized that in many situations (e.g., when 

quired performance is beyond human capabilities—as i

category III instrument landing system [ILS] approach), 

pilot cannot simply assume manual control but must p

vide additional instructions to automated systems to c

rect the problem. Intervention errors occur when the p

is unable to take corrective action or understand wh

problem has occurred or what to do to correct it. In 

previously cited Nagoya crash, the pilots were unable 

determine why the system was exhibiting the observed 

havior (inadvertent selection of the go-around mode), w

unable to determine the correct action (disengage the 

topilot), and were prevented by system design from ov

riding system actions. Research indicates that pilots of

fail to understand system operation and often do not u

derstand available methods of correcting undesired syst

behavior.27 In addition to these findings, the growing 

ability of operators to override system action due to 

creased machine authority is particularly troubling. 

essence, since pilots may lack the authority to overr

system actions they (or the designers) must be able to u

derstand beforehand the implications of selecting a gi

course of action—something that may be difficult or 

possible, particularly if aircraft designers have failed 

consider a given possibility. The 1988 crash of an A3

while on a demonstration flight in France was caused 

the inability of the pilot to understand and override p

programmed flight limits during a low-altitude, low-sp

pass unforeseen by system designers.28

Errors may occur in the learning process when pil

learn the wrong lessons or fail to learn from past exp

ences with automated systems. This will result in the 

mation and perpetuation of an inaccurate mental mode

system activity, thus creating difficulties in future pl

ning, monitoring, and intervening with automated syste

(table 1).

Human-Machine Coordination

In addition to the general opportunities for error t

arise from the supervisory control process, human a
Table 1

Human Roles and Opportunities

for Error in Supervisory Control

Human General Difficulty Caused By Contributin

Role Factors

Monitoring Inappropriate plan 1. Failure to consider (a) Inadequ

developed 1. relevant information (a) mental

(a) model

2. Failure to under- (b) Inert

2. stand automated (b) knowled

2. system (c) Mode er

Teaching Improper data 1. Wrong data/ (b)Time del

entry 1. incorrect location

Monitoring Failure to detect 1. Human monitoring (a) Inadequ

the need to 1. limits (a) mental

intervene 2. Expectation-based (a) models

2. monitoring (b) Informa

3. Inadequate feedback (b) overload

(c) Lack of

(c) salient

(c) indicatio

(d) Keyhole

(d) property 

(d) FMC

Intervening Missed/incorrect 1. Inability to under- (a) Inadequ

intervention in 1. stand why the (a) mental

undesired system 1. problem occurred (a) models

behavior 1. or what to do (b) Complex

1. to correct it (b) systems

2. Unable to correct

Learning Failure to learn (b) Inadequ

from experiences (b) mental

(b) model 

machine coordination abilities and requirements also c

ate automation-induced performance costs. This sect

defines and describes coordination and describes inher

human-machine coordination problems.

Coordination Theory was developed at the Massach

setts Institute of Technology Sloan School of Managem

to describe coordination and cooperation across a bro

range of activities and can be used as a theoretical fram

work for understanding human-machine coordination. 
cording to this theory, coordination is defined as the “m

agement of dependencies” between the activities and go

of actors.29 These dependencies, or potential conflicts, c

take many forms—including constraints on shared 

sources, time availability and scheduling, restrictions 

simultaneous operations, as well as incompatibilities 

tween different task and subtask elements.30 In simp

terms, human-machine coordination entails the proces

required to detect and resolve conflicts between the go

and actions of pilots and automated systems.

The variety and multiple sources of goals and actions 

a typical flight complicate cockpit coordination. For exa

ple, pilot goals may include navigating from airport A 

airport B, following ATC directives, following prescrib

procedures, et cetera. Automated systems also hold a w

variety of goals. The pilots provide most of these goals su

as heading, airspeed, and altitude targets. The aircraft 

signers, however, provide some goals. For example, 

topilots (and even aircraft control software in the most 

vanced aircraft) are programmed to fly above a minim

airspeed and below a maximum airspeed at all times. 

addition to goals provided by the operator or design

some machine goals may be provided by other human 

machine agents. Data link will allow for direct commu

cation between cockpit automation and ground-ba

human and machine agents.31 Since pilots may be l

aware of the goals provided by designers and outs

agents, coordination of these goals and actions may 

particularly difficult. 

In human-human teams, coordination is a coopera

endeavor in which all parties share information on ongo

tasks and goals and actively seek to resolve misund

standings or ambiguities. Unfortunately, automated co

pit systems possess limited communication and inferen

abilities that severely constrain true cooperation amo

human and machine agents.32 As a result automated s

tems are unable to share the responsibility for coordin

ing intentions and actions due to limited machine abili

as well as the dynamic nature of the aviation doma

Therefore, pilots are primarily responsible for detect

and resolving present and future conflicts between hum

and machine goals and actions. This responsibility imp
that pilots must understand not only machine goals a

actions but must understand how automated systems 

interpret pilot actions as well. As in the Nagoya cra

human-machine coordination ceased when the pilots w

unable to ascertain autopilot goals (to climb away from 

ground) and actions (autopilot induced nose-up trim 

puts). Additionally, when the pilots recognized that som

thing was wrong, attempts to resolve the conflict were u

successful because they did not realize that because 

autopilot was engaged in the go-around mode, it would 

correctly interpret their corrective actions (in the 

around mode, the trim system locked out pilot nose-do

trim inputs). 

Research indicates four major machine communicat

and design factors that contribute to breakdowns 

human-machine coordination—an inability to sense op

ator goals, an inability to communicate machine goals, 

inability to communicate a lack of clear understanding 

operator inputs, and an inability to communicate prox

ity to the limits of automated system capabilities. Fi

machines generally lack an ability to sense opera

goals.33 Thus, designers are forced to make (sometim

faulty) assumptions about pilot intentions and proba

actions. This inability to sense goals has been shown 

lead to a variety of potential breakdowns in coordinati

For example, when a pilot changes the designated land

runway in the FMC,34 the machine does not know—a

cannot ask—whether or not this runway change will a

require a change to the previously constructed vert

profile. Then the system design is forced to make an 

sumption about pilot intent. Since in many cases a cha

in runway often results in a landing in the opposite dir

tion, the system design assumes the pilot will want to c

struct a new vertical profile and thus deletes the sto

vertical profile. However, this design feature leads to pr

lems when the change in runway is merely a side step t

parallel runway. In this case, ATC expects the pilot to 

tain the vertical constraints automatically deleted by 

FMC. If the pilot does not realize the constraints have b

deleted (as research shows is quite often the case), the 

sult is a failure to meet an assigned altitude restriction
Second, automatic systems do not always clearly co

municate their own goals. Automated systems often p

vide a great deal of feedback on what actions they are t

ing but little information on why they are taking th

actions.35 Feedback on machine goals is especially imp

tant because machine actions can result not only fr

goals provided by the pilot but also from goals provided 

system designers and other agents. As demonstrated 

the Nagoya crash, pilots may be unable to resolve confl

without knowledge of the machine goals that led to the 

served discrepant behavior. 

Third, unlike human crew members, automated syste

often lack the ability to clarify ambiguous or misunderst

instructions. This is especially true when full understand

requires knowledge of other pilot goals and intentions.36 

example, in the 1995 crash of a B757 en route to C

Colombia, the crew was cleared to proceed directly to a po

named “Rozo.” Due to crew confusion over waypoint de

nators, the crew entered “R” into the FMC instead of the 

quired Rozo. Unfortunately the point “R” corresponded t

nondirectional radio beacon (NDB) located near Bogota, 

proximately 100 miles in the opposite direction of inten

landing. Since the FMC was unable to detect the ambigu

inherent in a command to turn in the opposite direction 

the landing airport, the FMC dutifully followed this comma

and executed a nearly 180-degree course reversal while 

scending in mountainous terrain, resulting in a fatal imp

with terrain.37

Fourth, automated systems do not give clear indicati

when they are approaching the limits of their capabilit

While human performance often degrades gradually, th

giving other team members time to detect and compens

for impending failure, machine systems often give up s

denly without warning. As a result, pilots may have ins

ficient time to plan and compensate for machine failu

For example, a China Air Lines B747 experienced eng

failure above three-engine altitude cruise altitude off 

coast of San Francisco. While the aircraft slowly dece

ated, the autopilot was forced to provide increasing con

force to keep the wings level. Since the indications of 

topilot effort were difficult to determine, when the cr

disengaged the autopilot they were caught off guard by 
control inputs required to hold level flight, resulting i

30,000-foot altitude loss and structural damage prior 

recovery.39

Due to limited machine inferential and communicat

abilities, machines cannot share the responsibility for 

ordinating human and machine actions. As a result, 

need to coordinate the actions of automated syste

places additional knowledge and attentional demands 

the human operator. In other words, the human opera

is responsible for knowing how a machine will act in 

given situation but must be able to monitor for pend

conflicts with or between the large number of automa

cockpit systems. Many of these conflicts arise due to 

herently limited machine communication and inferen

abilities that cause automated systems to misinterpret 

make incorrect inferences regarding human intentions

Factors Affecting Human

Coordination Activities

Effective integration of automated systems requires 

understanding of the factors that may serve to limit 

pilot’s capacity to meet the demands of coordinat

human and machine actions. In general, research in

cates that most breakdowns in human-machine coordi

tion occur in high workload, high time pressure, and u

familiar situations.40

Workload 

The amount of cognitive workload imposed by au

mated systems affects the pilot’s ability to program, mo

tor, and intervene with automated systems. The relati

ship between human performance and workload gener

follows an inverted U-shaped function known as 

Yerkes–Dodson law.41 In general, human performance 

poor in conditions of both low and high workload, with 

timum performance occurring at moderate levels. Th

workload can harm human performance in two ways—

raising or lowering pilot workload away from optimum l

els. When workload is too low, boredom decreases 

pilot’s ability to monitor automated systems. Convers
when workload is too high, a phenomenon known as c

nitive tunneling is likely to occur, which serves to li

human performance.42 Under cognitive tunneling, huma

tend to focus on a relatively small number of salient c

and ignore other information sources. As a result, pil

may fail to detect the need to intervene in automated s

tem performance, or may be unable to consider the fact

required to adequately program automated systems. C

nitive tunneling is one explanation for the 1972 crash of 

Eastern Airlines L-1011 in the Florida everglades in wh

preoccupation with a burned-out landing gear indica

prevented the crew from detecting a gradual descent i

the terrain.43

While automated systems are often intended to red

pilot workload, research indicates that the introduction 

glass cockpit aircraft has had little effect on overall p

workload. The introduction of automated systems tends 

redistribute, rather than reduce, pilot workload.44 The g

eral trend for cockpit automation is to reduce workload wh

it is already low (at cruise) and increase workload when i

already high (during departure and arrival), a phenomen

known as “clumsy automation.”45 This workload distribut

is due, in large part, to the high cognitive demands impo

by planning and instructing automated systems (i.e., the 

mands of data entry associated with the frequent route a

altitude changes occurring in the terminal area). 

Time Pressure

The previously described crash of a B757 en route 

Cali, Colombia, illustrates the effects of time pressure 

the pilot’s ability to instruct and monitor automated s

tems. In this case, the crew was under considerable ti

pressure due to pilot acceptance of an unanticipated cle

ance to fly a straight-in approach to the south (as oppo

to overflying the field for an approach to the north). Wh

the automated systems were mistakenly programmed to 

direct to the Romeo NDB (as opposed to Rozo), it took 

crew almost one minute to realize that they were proce

ing almost 180 degrees off of the desired course.46

Time pressure has several effects on the pilot’s ability 

interact with automated systems. A review of judgments a
decision making under time pressure found that as t

pressure increases: (1) people tend to use less information 

use available information in a more shallow manner, (2) m

important sources of information are given increas

weight, (3) people tend to lock in on one strategy and, as a 

sult, (4) performance decreases.47 In general, these stud

suggest that as time pressure increases, pilots will consi

less of the available evidence when instructing, monitori

and intervening with automated systems and may also s

less cognitively demanding methods of arriving at these d

sions—which may lead to breakdowns in human-mach

coordination. For example, a 1999 simulator study fou

that time pressure significantly reduced pilots’ ability to 

tect problems with the automated implementation of da

link ATC clearances.48

Situational Awareness

In order to anticipate the actions of automated system

the pilot must have good situational awareness (i

knowledge of the current and projected aircraft state a

associated variables). Since automated systems—and 

the pilot—actually control the aircraft, the pilot may fai

develop an accurate mental picture of aircraft state a

important information needed to control the aircraft. Th

the introduction of automated systems can lead to p

situational awareness resulting in problems instructi

monitoring, and intervening in automated systems. Th

will be discussed in turn. 

Poor situational awareness can lead to problems 

structing automated systems. For example, problems 

mode error (i.e., pilot actions inappropriate for the gi

aircraft mode such as the previously described Strasbo

accident) can contribute to poor situational awarenes

Second, as indicated previously, pilot monitoring in au

mated aircraft is based primarily on expectations of 

craft performance.50 A lack of situational awareness 

garding aircraft state or the presence of potential thre

can lead to the failure to detect the need to intervene. 

example, problems with situational awareness contribu

to the previously described Cali crash. Due, in part, to 

automated removal of certain navigation informat
shown on the cockpit displays following a change in w

points, as well as a reliance on the autopilot/FMC for n

igation, the crew was unsure of aircraft position, as wel

the position of nearby waypoints. As a result, the crew w

unaware of the close proximity of steeply rising terrain

Poor situational awareness can also lead to proble

with successfully intervening in automated system 

tions—a phenomenon known as “out of the loop s

drome.”52 The 1999 simulator study also found that the 

troduction of an automated system that automatic

loaded data-link clearances into the FMC and MCP 

sulted in a decreased pilot knowledge of current airc

state, thus delaying actions to intervene in undesired p

formance. In this study, pilots using this automated s

tem were less likely to detect a clearance to descend to 

altitude above the current altitude. When the problem 

unexpected climb) was encountered, the lack of knowle

of current altitude resulted in delayed or misdirected 

tervention (e.g., attempts to troubleshoot a presum

faulty autopilot).53

Since automated systems assume the role of dire

controlling aircraft performance, pilots may encoun

problems developing the situational awareness required 

instruct, monitor, and intervene in system performan

However, the introduction of automated systems does 

always lead to decreased situational awareness. Instead

appears that the effects on situational awareness depe

on the interaction with changes in pilot workload. Stud

involving failure detection during autopilot coupled w

instrument approaches shows that automation may 

prove pilot performance to the extent that it decrea

workload while not detracting from the system feedb

available to the pilot.54 Other research suggests that 

introduction of automated systems may allow pilots to 

velop a better awareness of the strategic situation (kno

edge of the general route of flight in relation to other w

points or hazards) because the automated systems free 

pilot from concentrating on the tactical details of cont

ling system operation.55

The bottom line is that the introduction of automated s

tems may either help or hurt pilot performance, depend

on the tradeoff between reductions in pilot workload and 
tential decreases in pilot awareness of system operatio

Additionally, the introduction of automated control syste

may allow for reduced pilot awareness of the details of s

tems operations, but the reduction in workload associa

with automated system control may free the pilot to focus 

tention on higher-level problems. In order to assess the p

itive or negative effects of automation on human perfor

ance, system designers and operators must consider 

effects of automation on pilot workload, as well as the c

sequences for—and relative importance of—tactical a

strategic situational awareness.

Machine Factors Affecting

Human-Machine Coordination

In addition to the factors that have a direct effect on p

performance, research also indicates that many features 

modern automated systems also contribute to breakdow

in human-machine coordination. Automated systems h

evolved from simple systems that carried out relatively 

complicated functions (e.g., early autopilot systems did li

more than hold heading and altitude) into very powe

agent-like systems that carry out multiple functions and p

sue complicated goal-oriented tasks (e.g., the modern 

topilot or FMC can plan and execute complicated flight p

trajectories). Research indicates that these highly capa

modern systems possess several attributes—authority, 

tonomy, complexity, coupling, and low observability—t

contribute to breakdowns in human-machine coordination

A better understanding of the impact of these factors 

allow for designers and operators to make better inform

design decisions regarding those factors that can be c

trolled and to implement more effective measures to con

the risks posed by those factors that cannot be designed 

of future automated systems.

Authority

Authority describes the ability of the automated syst

to override or block human input.57 Automated system 

thority is often intended to prevent unsafe operation (e

systems that prevent over speed or under speed con
tions) or is intended to prevent human actions from int

fering with automated systems operation (e.g., trim s

tems that lock out pilot input while the autopilot is 

gaged). However, high levels of system authority may a

prevent the pilot from intervening in the case of undesi

system operation. As noted in the previously describ

A320 crash during a flight demonstration, the pilot co

not override the preprogrammed flight limits when suc

response was required to prevent impact with 

ground.58

At a general level, high levels of machine authority m

place the pilot in what is known as the responsibility-

thority double bind. This situation occurs when 

human operator has the responsibility for system ope

tion but does not have the authority to take all necess

control actions.59 Research across a range of doma

shows that this split between authority and responsibi

leads to poor system operation.60 In the case of the m

ern cockpit, the pilot in command has the legal and mo

responsibility for ensuring safe and effective operatio

yet in some cases, he may lack the ability to override 

actions of automated systems. This lack of autho

means that in order to coordinate human and machine 

tions, the pilot must anticipate some conflicts before t

occur since he or she may not be able to intervene after 

fact. Given the complexity of automated systems, hum

cognitive limits, the dynamic nature of the environme

and the possibility of machine malfunction, it will be 

possible for the pilot to anticipate machine actions in 

situations. While good system design can minimize 

number of situations in which pilots may have a legitim

reason to override machine actions, analysis indicates t

designers cannot anticipate every possible situation.61

There are three general ways in which machines may li

pilot authority. First, the most obvious situation occurs wh

pilots are physically unable to override machine actions. 

example, most fly-by-wire aircraft incorporate features t

prevent over speeding or overstressing the airframe. Seco

pilot authority is also limited when the human effort requi

to override machine systems exceeds his or her capabilitie

For example, automated decision-making aids may us

pilot authority when the complexity of their decis
processes exceeds the capacity of the human operator to 

sess accurately the validity of the decision. One study of p

interaction with a complex cockpit flight planning aid show

that pilots often followed risky flight planning suggesti

when the automated system failed to consider the projec

track of hazardous weather.63 Third, relative difficulties 

programming automated systems can also limit pilot auth

ity. A study of glass cockpit pilots found that more than 

percent of reported problems overriding automated syste

dealt with difficulties reprogramming automated syste

rather than difficulties assuming manual control.64

Autonomy

Autonomy refers to the capability of automated syste

to operate for long periods of time with minimal opera

input.65 For example, once programmed during pretaxi 

erations, the FMC can provide navigational guidance 

the duration of the flight. System autonomy creates pr

lems by increasing the time delay between control in

and associated systems response. As this time delay 

creases, the probability of error detection decreases.66 

cause human memory decays with time, it becomes 

creasingly difficult for the operator to generate 

expectations required to monitor system performance 

fectively. This problem is exacerbated in long-haul flig

in which relief crew members swap out during flight. 

this case, the relief crew members monitor system beh

ior that may be the result of inputs made by a differ

crew member. That input may perhaps be incorrect or m

use techniques not desired by the present crew. 

Complexity

As automated systems grow more powerful, they 

also more complex both in terms of the number of au

mated components as well as the calculations required 

produce system behavior.67 This complexity makes it d

cult or impossible for the pilot to understand and pred

system behavior. Since an appropriate mental model of 

tomated system operations is required for instructi

monitoring, and intervening in system behavior, syst

complexity can lead to problems in each of these are
Surveys indicate that pilots often do not completely und

stand the operation of automated systems, often leading 

instances of undesired system behavior.68 The effects 

complexity on the pilot’s ability to control system behav

may interact with pilot experience. A 1999 study fou

that pilots with 600–1,500 hours in the current airfra

were least likely to detect the inappropriate behavior of 

automated data-link system. This may be due to a rela

inability to generate an adequate set of expectations 

garding system behavior as a result of a limited basis 

personal experience which is not sufficient to compens

for lessons forgotten since going through initial trainin

Coupling

Closely related to complexity, coupling refers to int

connections between system components.70 Many au

mated systems components receive inputs from and g

commands to a number of interrelated subsystems. Fig

2 indicates the relation of the FMC to other cockpit s

tems. Coupling contributes to breakdowns in human-m

chine systems by limiting the pilot’s ability to generate 

accurate mental model of automated system actions. T

situation interferes with instructing, monitoring, and 

tervening with automated systems. This is especially t

since coupling often leads to automated systems do

more than expected by pilots—a situation that is parti

larly difficult to detect. Research shows that since pil

monitor systems primarily on the basis of their expec

tions of system behavior, pilots often do not monitor 

and thus do not detect these situations.71

Low Observability

Automated systems often provide inadequate feedb

regarding their actions. The problem is not that indicati

do not exist, rather the problem is that the indications t

do exist require an excessive amount of effort for the p

to monitor and process—a phenomenon known as low 

servability.72 It is not enough to merely present inform

tion; instead, given the large amount of information av

able to the operator, the system must draw opera

attention to the information and present it in a man
FMC

Autopilot

Air Data

Computer

Flight

Displays

Inertial

Reference Clock

Faul

Indicati

Weight 

Balan

Flight Control

Computer

Database

Fuel

System

ADF

DME

VOR

ILS

ADF––automatic direction finder/finding

DME––direct machine environment

ILS––instrument landing system

VOR––voice-operated recorder

Figure 2. Systems Coupled to the Flight Management Co

puter

that is clear and easy to understand. In the Air China 

cident, the information required to allow pilots to det

mine that the autopilot was reaching the limits of its c

trol authority was available to the pilots, but it was 

observable. Since the cockpit displays did not draw p

attention to the relevant information, the pilots had to 

only realize the need to check the data but also had to 

member where the information was displayed. The pil

would have had to take the additional step of compar

actual indications to their memory of the autopilot lim

since the display did not indicate the limits of autopilot 

thority.
In addition to monitoring difficulties, low observabi

can also lead to problems instructing and intervening 

automated system behavior. In the instruction pha

mode errors often occur when pilots are not aware of 

current aircraft mode as pointed out by the previously 

scribed Strasbourg crash.73 Additionally, as pointed out 

the Nagoya crash, the inability to determine the curr

mode status can lead to an inability to successfully int

vene in automated system behavior.

The attributes of many highly capable automated s

tems can contribute to problems instructing, monitori

and intervening in automated system action. These fact

all work against the pilot’s ability to develop an accur

mental model of system behavior and make it difficult 

predict future behavior. While low observability can be c

rected through the application of appropriate human f

tors principles, system design is less able to limit the 

fects of coupling, complexity, autonomy, and authority 

automated systems. Instead, a design decision must 

made whether the risks associated with a given system c

be sufficiently countered by a systematic attempt to c

trol the risks associated with implementing new au

mated systems.

Mitigating the Risk of Automated System

There is no silver bullet in the effort to mitigate the ri

posed by automated systems. Since accidents and in

dents are not isolated actions, but instead the product o

chain of events, preventive efforts must focus on a vari

of actions. James T. Reason’s model of system failures a

defenses in depth provides a useful means of visualiz

this process. Figure 3 depicts accidents and incidents 

the process in which managerial decisions (budgeting, p

orities, and hiring practices) serve as enabling conditi

for unsafe acts which are expressed as accidents wh

they pierce weaknesses and failures in a series of syst

defenses (design, training, procedures, etc.) designed 

guard against system failures.74 Accidents and incide

result when a chain of actions form a vector that pe

trates these defenses.
Unsafe Acts

Defenses in Depth

Failures

at Various

Managerial

Levels

Figure 3. Defenses in Depth

Since a complete treatment of this model is beyond 

scope of this paper, the author focuses on the defenses 

depth rather than decisions made at various manage

levels. The defenses in depth can be thought of as featu

of design, procedures, and training, which are aimed 

mitigating the risks previously identified. 

Difficulties in Human-Machine Coordination 

This paper identifies four basic problems with hum

machine coordination activities: machines cannot (a) se

operator goals, (b) communicate their own goals, (c) iden

or correct misunderstandings, and (d) communicate wh

approaching the limits of their capability. A series of ov

lapping design, procedural, and training measures must 

employed to counteract these coordination problems. 

Current research in cockpit automation addresses 

sign solutions to these problems. In order for automa

systems to share the responsibility for coordinat
human and machine actions, they must possess a be

knowledge of pilot goals and actions. The “agenda m

ager” is one effort in this direction.75 This system uses 

formation about pilot statements and actions to infer p

goals. It then compares these goals to the goals and 

tions of automated systems to detect conflicts and iden

potential misunderstandings. While this effort is only p

tially successful to date, it represents an important dir

tion for future design.

Flight procedures must also compensate for the ina

ity of machine systems to participate in the coordinat

process. Procedures that require the second crew mem

to confirm inputs to automated systems are one step 

this direction. However, research indicates that since b

crew members share a similar awareness of the envir

ment and the automated system, relatively few errors 

caught by the second crew member.76 Therefore, pro

dures must consider the contribution made by other co

ponents of the aviation system such as air traffic c

trollers and dispatchers. 

Training must emphasize and demonstrate the limits 

machine coordination and communication abilities. In or

to train pilots on these machine limits, they must be 

posed to these situations in a realistic manner. Unfor

nately, since simulator time is limited (and expensive), i

often impossible to provide this training in the simula

Often, it is assumed that pilots will learn this knowle

during line operations. As an alternative, the technology 

ists to replicate important cockpit control systems on an 

teractive desktop part-task trainer. Using this technolo

pilots could learn machine coordination limitations via a 

of predefined illustrative scenarios flown on desktop co

puters in flying units or at home on personal computers

Human Limitations

This paper identifies three major limitations to 

human’s ability to control automated systems—time pr

sure, workload, and situational awareness. From a des

standpoint, care must be taken to look not only at the 

fects on overall workload but also on workload distri

tion. Workload should not be allowed to concentrate 
areas that are already effort intensive. Displays must a

be designed to support situational awareness by indicat

elements of current and future aircraft performance. 

search in mode error indicates the relative importance 

highlighting performance and mode changes.77 Procedu

must also be designed to compensate for known hum

limitations. For example, since human performance 

substantially degraded under time pressure, procedu

should be designed to promote adequate time available 

program, monitor, and intervene with automated system

Additionally, since monitoring is often ineffective in dete

ing the need to intervene in automated system action

procedures should focus attention on fostering error 

tection during the instruction process. Finally, train

must stress and demonstrate the importance of time a

workload management. 

Machine Factors 

The autonomy, authority, complexity, coupling, and 

observability of many automated systems make it diffic

for the pilot to develop an accurate mental model of au

mated systems. From a design point of view, the probl

with automation is “inappropriate feedback and inter

tion, not overautomation.”79 Automated systems often 

not provide adequate feedback on their actions or int

tions. As a result, the pilot cannot develop an adequ

mental model of system operations required to instru

monitor, and intervene in system activities. Inappropri

interaction occurs when automated systems do not s

port pilot efforts to coordinate or override automated 

tions. Often automated systems must be complex, c

pled, and autonomous in order to accomplish th

intended roles. As a result, design efforts should focus 

system observability (feedback) and coordinative abili

(authority).

There are three general approaches to address proble

with system observability, all of which seek to minimize 

effort required to interpret displayed information. Fi

automated systems must communicate both what they 

doing and why they are doing it. For example, the devel

ment of vertical situation displays will allow pilots to b
ter understand and visualize vertical path information

Also, given the autonomy and authority of automated s

tems that may prevent or deter pilot intervention after 

fact, feedback must be provided on the future intenti

and actions of automated systems, especially in regards 

mode changes.81

Second, feedback must also be designed to reduce 

effort required to detect relevant information and ascert

its importance. Automated systems must draw pilot in

mation to the relevant information by changes in color, 

tensity, auditory alerts, et cetera. This is especially crit

when access to the relevant information is likely to requ

pilot-activated display changes to view the informat

(e.g., information on the EICAS or in the FMC). Additi

ally, information should be formatted to allow easy p

cessing. When integration of several parameters is 

quired (such as evaluating a given vertical path), nume

information is often more difficult to process than 

graphic depiction of the same data.82

Third, design must also carefully consider any lim

tions on pilot authority. As discussed previously, th

limits may be either due to the physical inability to ov

ride automated systems or may arise when pilot overrid

possible but limited by difficulties in understanding m

chine actions or determining the desired method of alt

ing machine performance. When pilots cannot adequat

assess the acceptability of machine actions, they will lik

either blindly accept machine actions or inappropriat

intervene in correct machine behavior. In order to addr

these problems, design (and test and evaluation) m

identify and minimize limits to pilot authority. When p

authority is limited, the benefits (i.e., stall preventi

must outweigh the potential costs. Once limitations 

pilot authority have been identified, procedures and tra

ing should be developed to identify and preclude int

tional operation in these regions.

Conclusion

While the introduction of the exceedingly capable au

mated cockpit has provided important contributions to s
tem safety, precision, and efficiency, it has also imposed s

tem costs in the forms of new opportunities for error that 

expressed as breakdowns in human-machine coordinati

With the introduction of automated systems, the role of 

pilot has changed from system controller to system supe

sor responsible for instructing, monitoring, and interven

with automated systems. An analysis of these roles as wel

the capabilities, limitations, and characteristics of hum

and machine members of the cockpit team reveals the ar

of greatest risk to system safety and performance that m

be associated with the introduction of automated cock

systems required for AMC aircraft to operate in the future 

traffic environment. 

In general, problems arise from the growing power—

limited coordination and communication abilities—of c

rent automated systems. As a result, the human opera

is solely responsible for ensuring cooperation and reso

ing conflict between human and machine intentions a

actions. Time pressure, workload, and problems with si

ational awareness can reduce the pilot’s ability to exec

these coordination responsibilities. Additionally, the 

tonomy, authority, complexity, coupling, and low obse

ability of automated systems make it difficult for the p

to understand and anticipate machine intentions and 

tions. In order to compensate for these known risks of 

tomated systems, AMC must implement a system of 

fenses in depth utilizing design, training, and procedu

solutions aimed at controlling the previously identified r

factors.

The issues addressed in this paper are not unique 

transport aircraft or the broader aviation domain, but 

stead generalize to any system that incorporates hig

powerful, agent-like automated systems. One large area 

future concern is the armed services’ joint vision, wh

will require the integration of information technology i

a host of military systems.83 This integration will depe

heavily on automation to integrate, manage, process, a

synthesize large volumes of information. The issues id

tified here provide an important first step for ensuring t

we realize the advantages of these systems while mitig

ing the new opportunities for error that will be inheren

the information revolution.
Notes

1. Statistical Summary of Commercial Jet Airplane Accidents, W

Wide Operations 1959–1997 (Seattle, Wash.: Boeing Commercial Airp

Group, 1998), 13.

2. Charles E. Billings, Aviation Automation: The Search For a Hum

Centered Approach (Hillsdale, N.J.: Lawrence Erlbaum Associates, 19

19.

3. Radio Technical Commission for Aeronautics (RTCA), Report of 

RTCA Board of Directors’ Select Committee on Free Flight (Washing

D.C.: RTCA, 1995).

4. Statistical Summary of Commercial Jet Airplane Accidents, 13.

5. Billings, 4–5.

6. Eiichiro Sekigawa and Michael Mecham, “Pilots, A300 Syst

Cited in Nagoya Crash,” Aviation Week and Space Technology, 29 

1996, 36–37.

7. Nadine B. Sarter, David D. Woods, and Charles E. Billings, 

tomation Surprises,” in Handbook of Human Factors and Ergonomics

Gavriel Salvendy (New York: John Wiley and Sons, 1997), 1930.

8. Nehemiah Jordan, “Allocation of Functions between Man and 

chines in Automated Systems,” Journal of Applied Psychology 47, n

(1963): 161–65.

9. Penelope M. Sanderson, “The Human Planning and Scheduling 

in Advanced Manufacturing Systems: An Emerging Human Factors R

Human Factors 31 (1989): 635–66.

10. Neville Moray, “Monitoring Behavior and Supervisory Control

Handbook of Perception and Performance, vol. 2, Cognitive Processes 

Performance, ed. K. Boff, L. Kaufman, and J. Thomas (New York: J

Wiley and Sons, 1986), 40.1–40.51.

11. Nadine B. Sarter and David D. Woods, “Teamplay with a Powe

and Independent Agent: A Corpus of Operational Experiences and 

tomation Surprises on the Airbus A-320,” Human Factors 39, n

(1997): 553–69.

12. Moray.

13. Thomas Sheridan, “Supervisory Control,” in Handbook of Hu

Factors and Ergonomics, ed. Gavriel Salvendy (New York: John Wiley 

Sons, 1997), 1299.

14. Nadine B. Sarter and David D. Woods, “Pilot Interaction with C

pit Automation: Operational Experiences with the Flight Managem

System,” International Journal of Aviation Psychology 2, no. 4 (19

303–21.

15. David D. Woods et al., Behind Human Error: Cognitive Syste

Computers, and Hindsight, State-of-the-Art Report 94-01 (Wright–Pa

son AFB, Ohio: Crew System Ergonomic Information Analysis Ce

1994), 60.

16. Ibid.

17. Billings, 316.

18. James T. Reason, Human Error (New York: Cambridge Univer

Press, 1990), 9.

19. Billings, 307.
20. Moray.

21. Kathy L. Mosier, Linda J. Skitka, and K. J. Korte, “Cognitive and 

cial Issues in Flight Crew/Automation Interaction,” in Human Performa

in Automated Systems: Current Research and Trends, ed. M. Mouloua 

R. Parasuraman (Hillsdale, N.J.: Lawrence Erlbaum Associates, 19

191–97.

22. Sarter and Woods, “Teamplay with a Powerful and Independ

Agent.” 

23. Wesley A. Olson, “Supporting Coordination in Widely Distribu

Cognitive Systems: The Role of Conflict Type, Time Pressure, Display 

sign, and Trust” (PhD diss., University of Illinois, 1999).

24. Woods et al.

25. Olson.

26. Woods et al., 136.

27. Sarter and Woods, “Pilot Interaction with Cockpit Automation

28. Billings, 310.

29. Thomas Malone and K. Crowston, “What Is Coordination Th

and How Can It Help Design Cooperative Work Systems?” Proceeding

the ACM Conference on Computer-Supported Cooperative Work, Oct

1990, 357–70.

30. Thomas Malone and K. Crowston, “The Interdisciplinary Stud

Coordination,” ACM Computing Surveys 26, no.1 (1993): 87–119.

31. Tyler Prevot, Ev Palmer, and B. Crane, “Flight Crew Suppor

Automated Negotiation of Descent and Arrival Clearances,” Proceeding

the 7th International Symposium on Aviation Psychology (Columbus, O

Ohio State University, 1997), 697–702.

32. Donald A. Norman, “The ‘Problem’ of Automation: Inappropr

Feedback and Interaction, Not ‘Over-automation,’ ” Philosophical Tr

actions of the Royal Society of London, B327, 1990, 585–93.

33. Lucy A. Suchman, Plans and Situated Actions: The Problem 

Human-Machine Communication (New York: Cambridge University Pr

1987).

34. In this case a B757 but a functionality shared by many other B

ing products.

35. Norman, 585–93.

36. Suchman, 121.

37. Aircraft Accident Report: Controlled Flight into Terrain, Amer

Airlines Flight 965 Boeing 757-223, N651AA near Cali, Colombia, Dec

ber 20, 1995 (Santafe de Bogota, D.C. Colombia: Aeronautica Civil of 

Republic of Colombia, 1996).

38. Billings, 249.

39. Ibid., 308.

40. Sarter, Woods, and Billings, 1926–43.

41. Christopher D. Wickens, “Process Control and Automation,” E

neering Psychology and Human Performance (New York: HarperCol

1992), 504–51.

42. Christopher D. Wickens, “Attention in Perception and Dis

Space,” Engineering Psychology and Human Performance (New Y

HarperCollins, 1992), 74–115.

43. Billings, 301.
44. Earl L. Wiener, Human Factors of Advanced Technology (“G

Cockpit”) Transport Aircraft, NASA Technical Report No. 177528 (Mo

Field, Calif.: NASA Ames Research Center, 1989).

45. Woods et al., 114. 

46. Aircraft Accident Report.

47. A. Edland and O. Svenson, “Judgment and Decision Making Un

Time Pressure,” in Decision Making in Action: Models and Methods

G. A. Klein et al. (Norwood, N.J.: Ablex, 1993), 27–40.

48. Olson.

49. Nadine B. Sarter and David D. Woods, “How in the World Did 

Ever Get into That Mode? Mode Error Awareness in Supervisory Cont

Human Factors 37, no. 1 (1995): 5–19.

50. Sarter and Woods, “Teamplay with a Powerful and Independ

Agent.” 

51. Aircraft Accident Report.

52. Wickens, “Process Control and Automation.” 

53. Olson. 

54. Christopher D. Wickens and Colin Kessel, “Processing Resou

Demands of Failure Detection in Dynamic Systems,” Journal of Ex

mental Psychology, Human Perception, and Performance 6, 1980, 564

55. Edward C. Hahn and R. John Hansman, Experimental Studie

the Effect of Automation on Pilot Situational Awareness in the Datalink 

Environment, Society of Automotive Engineers (SAE) Technical Report 

851956 (Warrendale, Pa.: SAE, 1992).

56. Sarter, Woods, and Billings, 1926–43.

57. Woods et al., 87–88.

58. Billings, 310.

59. Woods et al., 87.

60. Ibid., 87-88.

61. Terry Winograd and Fernando Flores, Understanding Compu

and Cognition: A New Foundation for Design (New York: Addison–Wes

1986), 166.

62. Billings.

63. Charles Layton, Phillip J. Smith, and Elaine McCoy, “The De

of a Cooperative Problem Solving System for En route Flight Planning

Empirical Evaluation,” Human Factors 36, no.1 (1994): 94–119.

64. Wesley A. Olson and Nadine B. Sarter, “ ‘As Long as I’m in Con

. . .’: Pilot Preferences for and Experiences with Different Approache

Automation Management,” Proceedings of the 4th Symposium on Hu

Interaction with Complex Systems, Institute of Electrical and Electro

Engineers, 1998, 63–72.

65. David D. Woods, “Decomposing Automation: Apparent Simpli

Real Complexity,” in Automation and Human Performance Theory and 

plications, ed. R. Parasuraman and M. Mouloua (Hillsdale, N.J.: Lawre

Erlbaum Associates, 1996), 3–18.

66. Reason, 171.

67. Woods et al., 146–47.

68. Sarter and Woods, “Pilot Interaction with Cockpit Automation

69. Olson. 

70. Woods et al., 210.
71. Olson.

72. Woods et al., 23.

73. Billings, 316.

74. Reason, 199.

75. W. Cha and Ken Funk, “Recognizing Pilots’ Goals to Facili

Agenda Management,” Proceedings of the Ninth International Sympos

on Aviation Psychology (Columbus, Ohio: Ohio State University, 19

268–73.

76. Kathy L. Mosier and Linda J. Skitka, “Automation Bias and Err

Are Teams Better Than Individuals?” Proceedings of the Human Fac

and Ergonomics Society, 42nd Annual Meeting (Santa Monica, C

Human Factors Society, 1998), 201–5.

77. Sarter, Woods, and Billings, 1926–43.

78. Mosier, Skitka, and Korte, 191–97.

79. Norman, 585–93.

80. Billings, 89.

81. Sarter, Woods, and Billings, 1926–43.

82. Christopher D. Wickens and C. M. Carswell, “The Proximity C

patibility Principle: Its Psychological Foundation and Relevance to 

play Design, Human Factors 37, no. 3 (1995): 473–94.

83. Joint Vision 2010, Washington, D.C.: Joint Chiefs of Staff, 19

13–15.
Appendix

Flight Management Computer (FMC)

The FMC Control Display Unit (FMC CDU) is the pil

interface with a multifunction computer system (FMC) t

allows the pilot to plan, navigate, and control the aircr

Through interconnections with a number of onboard s

tems and sensors, FMC planning features provide the p

with weather (winds and temperature), fuel, timing, a

performance data (optimal altitudes, takeoff and land

speeds, etc.). The FMC also contains a worldwide datab

of navigational and instrument approach data that, wh

combined with satellite or inertial position information, 

lows the pilot to determine aircraft position as well as 

relative position of other navigational waypoints. Fina

interfaces with the autopilot and automatic throttle s

tems allow the FMC (depending on mode) to provide ste

ing, altitude, and speed commands to these systems.

The FMC CDU allows the pilot to input or review data 

a menu driven architecture. Figure 4 represents the F

CDU similar to the one in the Boeing B757 aircraft. D

presentation is limited to approximately 12 lines of d

arranged on either side of the display unit. In order to s

port the wide range of functions available, the FMC e

ploys a branching menu structure in which pilots can 

cess by selecting the appropriate function key (legs, rou

cruise, etc.) on the associated data entry panel. Onc

given function is selected, the pilot can navigate throu

the associated menu pages by using the “prev page” a

“next page” buttons. Although there are several differ

manufacturers, the underlying architecture, controls, a

visual presentation are highly similar across different F

CDU units. 

The FMC CDU allows the pilot to input a desired ro

of flight, vertical profile, and speed profile. Route of fli

information may be entered as waypoints (each fligh

composed of a set of many waypoints) on the appropri

page of the FMC CDU via either manual keyboard entry 

selection of prestored database options via the line se

keys adjacent to the display screen. Altitude constrai

(either cruise altitude or a restriction to cross a horizon

waypoint or altitude at a given airspeed) may also be 

tered in the same manner. Aircraft speed may be control

35
36

FMC CDU

Line Select

Keys

Line Select

Keys

Function

Keys

Alphanumeric

Data Entry Keys
by either directly entering a speed value on the approp

ate page, or by selecting a default speed profile (based 

fuel economy or range considerations). 

Mode Control Panel (MCP)

The FMC CDU is not the only means by which the p

can control aircraft speed, heading, and altitude. The M

(fig. 5) allows the pilot to control autothrottle and auto

lot modes, as well as to provide heading, altitude, airspe

and vertical speed targets to these systems. Autopilot a

autothrottle modes are selected by depressing the app

priate buttons (e.g., LNAV [lateral navigation], VNAV [ve

cal navigation], FLCH [flight level change], etc.), while 

speed, altitude, heading, and vertical speed values 

entered into the appropriate window via the associated 

lector knob. Although the distinction is not perfect, 

FMC CDU is considered a “strategic” interface while 

MCP is considered a “tactical” interface.1 The FMC CDU 

often used to implement actions that will take place or c

tinue relatively far into the future (e.g., entering changes 

the route of flight), while the MCP is often used to imp

ment more immediate actions such as flying an assign

heading or climbing to a given altitude. Like the FM

there are differences among manufacturers and mod

However, at a conceptual level most MCP functions 

very similar. 

In order to control aircraft performance via the MCP, 

desired target(s) must be entered into the appropriate w

dow(s), and the appropriate mode(s) must be selected. 

example, in order to comply with the clearance “fly he

ing 180o,” the pilot must set 180 in the heading wind

and select the heading mode by depressing the top of 

heading selector knob. There is a significant degree of c

pling between the FMC and MCP, as well as between 

topilot modes. Some autopilot and autothrottle modes 

tomatically activate other associated modes, while so

information entered into the FMC will not be acted up

unless the appropriate autopilot mode is selected on 

MCP. For example, LNAV and VNAV modes must be 

lected on the MCP in order for the autopilot to follow 

37
38

Speed

Selector

Heading

Selector

Rate of

DescentSelector

Altitude

Selector

Autopilot

on/off Buttons

Vertical Modes Lateral Modes Approach Modes Autothrottle Modes

Figure 5. A Typical Mode Control Panel
horizontal and vertical guidance commands entered i

the FMC. Additionally, in some cases system behavior 

pends on the values set in both the FMC and MCP. For 

ample, when descending in the VNAV autopilot mode, 

controlling altitude will be the highest of either the altitu

set in the MCP or an altitude restriction set in the FMC

Notes

1. Charles E. Billings, Aviation Automation: The Search for a Hum

Centered Approach (Hillsdale, N.J.: Lawrence Erlbaum Associates, 19

39