HUMAN FACTORS TRAINING MANUAL

Doc 9683iAN/950

FIRST EDITION - 1998

 The issue of amendments is announced regularly in the ICAO Jouml and in the monthly
Supplement to the Catalogue of ICAO Publications and Audio-visual Training Aids, which
holders of this publication should consult, The space below is provided to keep a record
of such amendments.

RECORD OF AMENDMENTS AND CORRIGENDA

1 30/09/03 24/8/06 TN TT

2 31/5/05 24/8/06 TN TT
 . FOREWORD

Safety of the civil aviation system is the major objective primarily for use by States to increase the awareness of
of the International civil Aviation Organization. Consider- tbeir personnel of the influence of human performance on
abie progress has been made, but additional improvements safety.
are needed and can be achieved. It has long been known
that some three out of four accidents result froni less than The digests were aimed at the managers of both civil
optimum human performance, indicating that any advance aviation administrations and the airline industry, including
in this field can be expected to have a significant impact airline operational and training managers. The target
on the improvement of flight safety. audience also included regulatory bodies, safety and
investigation agencies and training establishments, as well
This was recognized by the ICAO Assembly, which in as senior and middle non-operational airline management.
1986 adopted Resolution A26-9 on Flight Safety and
Human Factors. As a follow-up to the Assembly Resol- This manual is essentially an edited compilation of the
ution, the Air Navigation Commission formulated the series of ICAO Human Factors digests. Its target audience
following objective for the task: includes senior training, operational and safety personnel
in industry and regulatory bodies. It comprises two parts:
"To improve safety in aviation by making States more
aware and responsive to the importance of human fact- Part I - General introduces the concept of aviation
ors in civil aviation operations through the provision Human Factors, presents a systemic and contemporary
of practical human factors material and measures view of aviation safety, outlirres the basic principles of
developed on the basis of experience in States, and by workstation design and reviews the fundamental
developing and recommending appropriate amend- Human Factors issues in various aviation domains,
ments to existing materials in Annexes and other docu- including air traffic control and maintenance.
ments with regard to the role of human factors in the
present and future operational environments. Special Part 2 - Training Programmes for Operational
emphasis will be directed to the human factors issues Personnel outlines Human Factors training issues and
that may influence the design, transition and in-service proposes the contents of sample training curricula for
use of the [future] ICAO CNSIATM systems." pilots, air traffic controllers and accident investigators.

One of the methods chosen to implement Assembly This manual is intended to be kept up to date. It will
Resolution A26-9 was the publication of a series of digests be amended periodically as new research becomes avail-
which addressed various aspects of Human Factors and its able to reflect increased knowledge on Human Factors
impact on flight safety. These digests were intended training for operational personnel.
 TABLE OF CONTENTS

Page Page

PART 1 . GENERAL Chapter 4 . Ergonomics ..................

Chapter 1 . Fundamental Human Factors 4.1 Introduction . . . . . . . . . . . . . . . . . . . . .
Concepts ................................ 1-1-1 4.2 Basic facts about ergonomics . . . . . . .
4.3 Human capabilities . . . . . . . . . . . . . . .
1.1 Introduction . . . . . . . . . . . . . . . . . . . . . 1-1-1 4.4 Human information processing . . . . . .
1.2 The meaning of Human Factors . . . . . 1-1-1 4.5 Human dimensions . . . . . . . . . . . . . . .
1.3 The industry need for Human 4.6 Displays, controls and flight
Factors . . . . . . . . . . . . . . . . . . . . . . . . . 1-1-5 deck design . . . . . . . . . . . . . . . . . . . . .
1.4 Human Factors applications in 4.7 The environment . . . . . . . . . . . . . . . . .
aviation operations . . . . . . . . . . . . . . . 1-1-8
List of references . . . . . . . . . . . . . . . . . . . . . .
List of references ...................... 1-1-16

.
Chapter 5 Human Factors issues in
.
Chapter 2 Human Factors. Management air traffic control ........................
and Organization ........................ 1-2-1
5.1 Introduction . . . . . . . . . . . . . . . . . . . . .
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . 1-2-1 5.2 Human Factors within systems. . . . . .
2.2 From individuals to organizations . . . 1-2-2 5.3 Automation in air traffic control . . . .
2.3 Safe and unsafe organizations . . . . . . 1-2-6 5.4 The selection and training of
2.4 Allocation of resources . . . . . . . . . . . . 1-2-11 air traffic controllers . . . . . . . . . . . . . .
2.5 Management's contribution 5.5 The human element - specific
to safety . . . . . . . . . . . . . . . . . . . . . . . . 1-2-15 attributes . . . . . . . . . . . . . . . . . . . . . . .

List of references . . . . . . . . . . . . . . . . . . .
.
Chapter 3 Human Factors issues in the
development and implementation of Communications Appendix to Chapter 5 . . . . . . . . . . . . . . .
Navigation and SurveillanceJAir Traffic
Management (CNSJATM) systems 1-3-1..........
.
Chapter 6 Human Factors in aircraft
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . 1-3-1 maintenance and inspection ...............
3.2 The ICAO CNSIATM concept . . . . . . 1-3-3
3.3 Automation in advanced aviation systems 1-3-6 6.1 Introduction . . . . . . . . . . . . . . . . . . . . .
3.4 Human-centred technology . . . . . . . . . 1-3-12 6.2 Human Factors - aircraft
3.5 Principles of human-centred maintenance and inspection . . . . . . . .
automation . . . . . . . . . . . . . . . . . . . . . . 1-3-15 6.3 Human error in aircraft maintenance
3.6 Qualities of human-centred and inspection: an organizational
automation . . . . . . . . . . . . . . . . . . . . . . 1-3-19 perspective. . . . . . . . . . . . . . . . . . . . . .
6.4 Human Factors issues affecting
List of references . . . . . . . . . . . . . . . . . . . . . . 1-3-24 aircraft maintenance . . . . . . . . . . . . . .
fvi) Human Factors Training Manual

Page Page

6.5 Teams and organizational issues in .

Chapter 2 Crew resource management
aircraft maintenance . . . . . . . . . . . . . . 1-6- 16 (CRM) training .......................... 2-2-1
6.6 Automation and advanced technology
systems . . . . . . . . . . . . . . . . . . . . . . . . 1-6-18 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . 2-2- 1
6.7 Error prevention considerations 2.2 Crew resource management
and strategies . . . . . . . . . . . . . . . . . . . . 1-6-20 (CRM) training . . . . . . . . . . . . . . . . . . 2-2-1
2.3 Threat and error management
List of references . . . . . . . . . . . . . . . . . . . . . . 1-6-24 (TEM) training . . . . . . . . . . . . . . . . . . 2-2-8
2.4 Guidance for integrating TEM into
CRM . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2-12
2.5 Line-oriented flight training (LOFT) . 2-2-20
.
PART 2 TRAINING PROGRAMMES
FOR OPERATIONAL PERSONNEL List of recommended reading . . . . . . . . . . . . 2-2-27

.
Chapter 1 Basic human performance training
programmes for operational personnel ...... 2-1-1 .
Chapter 3 Training issues in automation
and advanced technology flight decks .......
Introduction . . . . . . . . . . . . . . . . . . . . . 2- 1.1
Human Factors training for 3.1 Introduction . . . . . . . . . . . . . . . . . . . . .
operational personnel: an 3.2 An introduction to automation . . . . . .
introduction and overview . . . . . . . . . 2- 1-2 3.3 Issues and concerns in automation . . .
The prior situation. . . . . . . . . . . . . . . . 2-1-2 3.4 Training for automation . . . . . . . . . . .
Human Factors highlights . . . . . . . . . . 2-1-3 3.5 Management techniques and
The SHEL Model . . . . . . . . . . . . . . . . 2-1-5 coping strategies . . . . . . . . . . . . . . . . .
The implications of the provisions from
Annexes 1 and 6. Part I . . . . . . . . . . . 2-1-5 List of recommended reading ............
Human performance training
cuniculum: an ICAO proposal . . . . . . 2-1-7 Appendix 1 to Chapter 3 . . . . . . . . . . . . . . . .
Human performance training Appendix 2 to Chapter 3 . . . . . . . . . . . . . . . .
curriculum for pilots . . . . . . . . . . . . . . 2- 1-7 Appendix 3 to Chapter 3 . . . . . . . . . . . . . . . .
The skill requirement . . . . . . . . . . . . . 2- 1-10
Human performance training
curriculum for air traffic controllers. . 2- 1-11 .
Chapter 4 Human Factors training for
Human performance training for safety investigators .......................
maintenance technicians . . . . . . . . . . . 2-1- 14
Considerations in training 4.1 Introduction . . . . . . . . . . . . . . . . . . . . .
implementation and curriculum 4.2 Need for and purpose of
development . . . . . . . . . . . . . . . . . . . . 2- 1-14 Human Factors investigation . . . . . . .
Training philosophy and objectives . . 2-1-15 4.3 Conduct of the investigation. . . . . . . .
Skill development. operational 4.4 Reporting and preventive action. . . . .
personnel assessment and training
course evaluation. . . . . . . . . . . . . . . . . 2-1- 17 Appendix 1 to Chapter 4 ................
Human performance training curriculum Appendix 2 to Chapter 4 ................
for aircraft maintenance engineers . . . 2-1-17 Appendix 3 to Chapter 4 ................
Appendix 4 to Chapter 4 ................
Appendix 1 to Chapter 1 . . . . . . . . . . . . . . . . 2-1-23 Appendix 5 to Chapter 4 ................
Appendix 2 to Chapter 1 . . . . . . . . . . . . . . . . 2-1-25
Appendix 3 to Chapter 1 . . . . . . . . . . . . . . . . 2-1-29 Notes
PART 1

GENERAL
 CHAPTER 1
FUNDAMENTAL HUlMAN FACTORS CONCEPTS

1.1 JNTRODUCTION 1.15 The recognition that basic Human Factors

education was needed throughout the industry led to
1.1.1 Human performance is cited as a causd factor various approaches to formal training in different
in the majority of aircraft accidents. If the accident rate is countries. This recognition, tragically emphasized by the
to be decreased, Human Factors issues in aviation must be investigation of a number of accidents resulting almost
better understood and Human Factors knowledge more entirely from deficiencies in the application of Human
broadly and proactively applied. By proaction it is meant Factors, led ICAO to implement Human Factors training
that Human Factors knowledge should be applied and requirements into the training and licensing requirements
integrated during the systems design and certification included in Annex 1 (1989) and Annex 6 (1995), as well
stages, as well as during the operational personnel cenifi- as into the process of accident investigations included in
cation process, before the systems and the people become Annex 13 (1994).
operational. The expansion of Human Factors awareness
presents the internationaf aviation community with the 1.1.6 The 1976 agreement between the United States
single most significant opportunity to make aviation both Federal Aviation Adminiseation (FAA) and the National
safer and more efficient. The purpose of this chapter is to Aeronautics and Space Administration (NASA) to estab-
present an overview of the various components which lish a voluntary. non-punitive, confidential Aviation Safety
constitute Human Factors and to ciarify its meaning. Reporting System (ASRS) constituted official recognition
that adequate information for analysis of human behaviour
1.1.2 Ever since humans began to make took, and errors in human performance is best obtained by elim-
thousands of years ago. the application of elementary inating the threat of punitive action against the person
ergonomics has improved work efficiency. But it is only making the report. Similar schemes were later set up in the
during the last hundred years that the modem evolution of United Kingdom (CHIRP), Canada (CASRP) and Australia
ergonomics towards Human Factors has begun. (CAIR).

1.1.3 The need during the First World War to opti- 1.1.7 This chapter outlines:
mize factory production and to assign thousands of recruits
more effectively to military duties, and the fact that during 1) the meaning and definition of Human Factors, a
the Second World War sophisticated equipment was conceptual model of it, and clarification of
surpassing human capability to operate it with maximum common misconceptions;
effectiveness provided further stimulus to Human Factors
progress. Selection and training of staff, too, began t o be 2) the industry need for Human Factors; and
approached more scientifically. However, it might be
argued that the renewed interest in Human Factors contri- 3) a brief overview of the application of Human
bution to aviation safety was a reactive response to tech- Factors in flight operations.
noiogical limitations prevailing at the time. Therefore,
human capabilities were extended to their maximum
through the application of Human Factors knowledge,
sometimes at the cost of overlooking human limitations. 1.2 THE MEANING OF
HUMAN FACTORS
1.1.4 The institutionalization of Human Factors
occurred with the founding of several organizations such 1.2.1 Human Factors as a term has to be clearly
as the Ergonomics Research Society in 1949. the Human defined because when these words are used in the vern-
Factors Society (now Human Factors and Ergonomics acular tbey are often applied to any factor related to
Society) in 1957 and the International Ergonomics humans. The human element is the most flexible. adapt-
Association (IEA) in 1959. able and valuable part of the aviation system. but it is also
 1-1-2 Human Factors Training Manual

the most vulnerable to influences which can adversely selection, training and checking and in accident prevention
affect its performance. Throughout the years, some three and investigation.
out of four accidents have resulted from less than optimum
human performance. This has commonly been classified as 1.2.5 Human Factors is multidisciplinary in nature.
human error. For example, information is drawn from psychology to
understand how people process information and make
1.2.2 The term "human error" is of no help in decisions. From psychology and physiology comes an
accident prevention because although it may indicate understanding of sensory processes as the means of
WHERE in the system a breakdown occurs, it provides no detecting and transmitting information on the world about
guidance as to WHY it occurs. An error attributed to us. The measures and movements of the body -essential
humans in the system may have been design-induced or in optimizing the design and layout of controls, and other
stimulated by inadequate training, badly designed '
workplace characteristics of the flight deck and cabin -
procedures or the poor concept or layout of checklists or call upon anthropometry and biomechanics. Biology and
manuals. Further, the term "human error" allows conceal- its increasingly important sub-discipline, chronobiobgy,
ment of the underlying factors which must be brought to are needed to understand the nature of the body's rhythms
the fore if accidents are to be prevented. in fact, contemp- and sleep, and their effects in night flying and time-zone
orary safety-thinking argues that human error should be changes. No proper analysis or presentation of data from
the starting point rather than the stop-rule in accident surveys or studies is possible without some basic under-
investigation and prevention. standing of statistics. While utilizing these academic
sources of knowledge, Human Factors is essentially
concerned with solving practical problems in the real
1-23 An understanding of the predictable human world. Human Factors is practical in nature; it is problem-
capabilities and limitations and the application of this oriented rather than discipline-centred.
understanding are the primary concerns of Human Factors.
Human Factors has been progressively developed, refined 1.2.6 Human Factors is about people in their living
and institutionalized since the end of the last century, and and working situations; about their relationship with
is now backed by a vast store of knowledge which can be machines, with procedures and with the environment about
used by those concerned with enhancing the safety of the them; and also about their relationships with other people.
complex system which is today's civil aviation. Through- One definition of Human Factors, as proposed by
out this manual capital initial letters are used for the term Professor Edwards, declares that "Human Factors is
"Human Factors". The terms "human aspects" and "human concerned to optimize the relationship between people and
elements" in common usage are helpful alternatives to their activities, by the systematic application of human
avoid ambiguity and aid comprehension. sciences, integrated within the framework of systems
engineering". Its objectives can be seen as effectiveness of
the system, which includes safety and efficiency, and the
The discipIines of well-being of the individual. Professor Edwards further
Human Factors elaborates that "activities" indicates an interest in
communication between individuals and in the behaviour
1.2.4 Many of the early concerns in aviation were of individuals and groups. Lately, this has been expanded
related to the effects on people of noise, vibration, heat, upon to include the interactions among individuals and
cold and acceleration forces. Usually, the person nearest at groups and the organizations to which they belong, and to
hand with a knowledge of physiology was a physician; the interactions among the organizations that constitute the
this may have generated one of the more persistent mis- aviation system. The human sciences study the structure
conceptions about Human Factors, the belief that it is and nature of human beings, their capabilities and Iirnita-
somehow a branch of medicine. Yet half a century ago tions, and their behaviours both singly and in groups. The
work was expanding on the more cognitive aspects of notion of integration within systems engineering refers to
aviation tasks and this trend has continued and is outside the Human Factors practitioner's attempts to understand
the scope of medicine. Optimizing the role of people in the goals and methods as well as the difficulties and
this complex working environment involves all aspects of constraints under which people working in interrelated
human performance: decision-making and other cognitive areas of engineering must make decisions. Human Factors
processes; the design of displays and controls and flight uses this information based on its relevance to practical
deck and cabin layout: communication and computer soft- problems.
ware; maps and charts: and the field of documentation
such as aircraft operating manuals, checklists, etc. Human 12.7 The term "ergonomics" derives from the Greek
Factors knowledge is also increasingly used in staff words 'ergon" (work) and "nomos" (natural law). It is
Chapter 1. Fundamental H u m Factors concepts 1-1-3

defined as "the study of the efficiency of persons in their (machine), software (procedures, symbology, etc.), and
working environment". In some States, the term ergo- environment (the situation in which the LH-S system
nomics is used sirictly to refer to the study of human- must function). This building block diagram does not
machine system design issues. Chapter 3 introduces a cover the interfaces which are outside Human Factors
discussion on ergonomics. (hardware-hardware; hardware-environment; software-
hardware) and is only intended as a basic aid to under-
standing Human Factors.
A '&nceptual model of Human Factors
1.2.9 Liveware. In the centre of the model is a
1.2.8 It is helpful to use a model to aid in the person, the most critical as well as the most flexible
understanding of Human Factors, as this allows a gradual component in the system. Yet people are subject to
approach to comprehension. One practical diagram to considerable variations in performance and suffer many
illustrate this conceptual model uses blocks to represent limitations, most of which are now predictable in general
the different components of Human Factors. The model terms. The edges of this block are not simple and straight,
can then be built up one block at a time, with a pictoria? and so the other components of the system must be care-
impression being given of the need for matching the fully matched to them if stress in the system and eventual
components. The SHEL concept (the name being derived breakdown are to be avoided.
from the initial letters of its components, Software,
Hardware, Environment, Liveware) was first developed by 1.2.10 In order to achieve this matching, an under-
Edwards in 1972, with a modified diagram to illustrate the standing of the characteristics of this central component is
model developed by Hawkins in 1975. The following essential. Some of the more important characteristics are
interpretations are suggested: liveware (human), hardware the following:

Software (procedures, symbology, etc.) In this model the match or mismatch of the
Hardware (machine) blocks (interface) is just as important as the
Environment characteristics of the blocks themselves. A
Liveware (human) mismatch can be a source of human error.

The-SHEL model as modified by Hawkins

 Human Factors Training Manual

a) Physical size and shape. In the design of any 1.21 1 Liveware-Hardware. This interface is the one
workplace and most equipment, a vital role is most commonly considered when speaking of human-
played by body measurements and movements, machine systems: design of seats to fit the sitting
which will vary according to age and ethnic and characteristics of the human body, of displays to match the
gender groups. Decisions must be made at an sensory and information processing characteristics of the
early stage in the design process, and the data user, of controls with proper movement, coding and
for these decisions are available from anthro- location. The user may never be aware of an L-H
pometry and biomechanics. deficiency, even where it finally leads to disaster, because
the natural human characteristic of adapting to L-H mis-
b) Physical needs. People's requirements for food. matches will mask such a deficiency, but will not remove
water and oxygen are available from physiology its existence. 'Ihis constitutes a potential hazard to which
and biology. designers should be ale& W1th the introduction of
computers and advanced automated systems, this interface
C) Input characteristics. Humans have been has repositioned itself at the forefront of Human Factors
provided with a sensory system for collecting endeavours.
information from the world around them,
enabling them to respond to external events and 1.2.12 Liveware-Software. This encompasses
to cany out the required task. But all senses are humans and the non-physical aspects of the system such
subject to degradation far one reason or another, as procedures, manual and checklist layout, -symbology
and the sources of knowledge here are physi- and computer programmes. Liveware-software problems
ology, psychology and biology. are conspicuous in accident reports, but they are often
difficult to observe and are consequently more difficult to
resolve (for example, misinterpretation of checklists or
d) Information processing. These human capabili- symboiogy, non-compliance with procedures, etc.).
ties have severe limitations. Poor instrument and
warning system design has frequently resulted
from a failure to take into account the capabili- 1.2.1 3 Liveware-Environment. The human-
tics and limitations of the human information environment interface was one of the earliest recognized
processing system. Short- and long-term memory in flying. Initially, the measures taken all aimed at
are involved, as well as motivation and stress. adapting Ute human to the environment (helmets, flying
Psychology is the source of background suits, oxygen masks. anti-G suits). Later, the trend was to
knowledge here. reverse this process by adapting the environment to match
human requirements (pressurization and air-conditioning
systems, soundproofing). Today, new challenges have
e) Output characteristics. Once information is
arisen, notably ozone concentrations and radiation hazards
sensed and processed, messages are sent to the
at high flight levels and the problems associated with
muscles to initiate the desired response, whether
disturbed biological rhythms and elated sleep disturbance
it be a physical control movement or the initia-
and deprivation as a consequence of the increased speed
tion of some form of communication. Accept-
of transmeridian travel. Since illusions and disorientation
able control forces and direction of movement
are at the root of many aviation accidents the L-E inter-
have to be known, and biomechanics, physiol-
face must consider perceptual errors induced by environ-
ogy and psychology provide such knowledge.
mental conditions, for example, illusions during approach
and landing phases. The aviation system also operates
f) Environmental tolerances. Temperature, pressure, within the context of broad political and economical
humidity, noise, time of day, fght and darkness constraints, and those aspects of the environment will
can all be reflected in performance and also in interact in this interface. Although the possibility of
well-being. Heights, enclosed spaces and a modifying these influences is sometimes beyond Human
boring or stressful working environment can also Factors practitioners, their incidence is central and should
be expected to influence performance. Informa- be properly considered and addressed by those in manage-
tion is provided here by physiology, biology and ment with the possibility to do so. This topic is fully
psychology. developed in Chapter 2.

The Livcware is the hub of the SHEL model of Human 1.2.14 Liveware-Liveware. This is the interface
Factors. The remaining components must be adapted and between people. Training and proficiency testing have
matched to this central component. traditionslly been done on an individual basis. If each
 C h a ~ l e rI . Fumhmenfal Human Facrors conceDts

individual team member was proficient, then it was logical follow-up is to ensure a proper level of Human
assumed that the team consisting of these individuals Factors knowledge throughout the industry.
would also be proficient and effective. This is not always
the cast, however, and for many years attention has 1.3.3 The industry need for Human Factors is based
increasingly turned to the breakdown of teamwork. Right on its impact on two broad areas, which interrelate so
crews, air traffic controllers, maintenance technicians and closely that in many cases their influences overlap and
other operational personnel function as groups and group factors affecting one may also affect the other. These areas
influences play a role in determining behaviour and are:
performance. In this interface, we are concerned with
leadership, crew co-operation, teamwork and personality Effectiveness of the system
interactions. Staffimanagement relationships are also
within the scope of this interface, as corporate culture, - safety
corporate climate and company operating pressures can - efficiency
significantly affect human performance. Part 2 of this
manual describes current industry approaches to Human Well-being of operational persdinnel.
Factors training programmes for operational personnel.

Effectiveness of the system

1.3 THE INDUSTRY NEED FOR Safety

HUMAN FACTORS
1.3.4 The best way to iflustrate the effect of Human
1.3.1 Admiral Donald Engen, the former Adminis- Factors issues on aviation safety is through the exampie of
trator of the United States Federal Aviation Adminis- accidents. A few accidents in which aspects of Human
tration, has been quoted as saying (1986): "We spent over Factors triggered the attention of the aviation community
fifty years on the hardware, which is now pretty reliable. and paved the way to the proliferation of Human Factors
Now it's time to work with people." This declaration endeavours in aviation are described here as examples.
somehow sets the foundation upon which the industry
need for Human Factors can be assessed. Curiously 1) In the same month - December 1972 - an
enough, we retain a lawyer for advice about a Iegal LlOl 1 crashed in the Florida Everglades
problem, or hire an architect to build a house, or consult (NTSBIAAR 73-14) and a 3-737 crashed at
a physician when trying to establish the diagnosis of a Midway Airport in Chicago (NTSBIAAR 73-
medical problem, but when it comes to solving Human 16). In the first case, duties were not properly
Factors problems. we have adopted an intuitive and in allocated and the whole flight crew became
many cases perfunctory approach, even though many lives preoccupied with a landing gear indicator light
may depend on the outcome. A background of many years bulb. In the second case, the captain - as a
of industry experience or thousands of flying hours may -
leader did not properly manage the resources
have little or no significance when looking for the which were available to him.
resolution of problems which only a thorough under-
standing of Human Factors can provide. 2) In 1974, a B-707 crashed during approach at
Pago-Pago in Samoa, with a loss of 96 iives. A
1.3.2 This is of special significance because, as visuai illusion related to the black-hole
already mentioned, it has long been known that some three phenomenon was a cause factor (NTSBIAAR
out of four accidents result from performance e m r s made 74- 15).
by apparently healthy and properly certificated individuals.
The sources of some of these e m r s may be traced to poor 3) In 1974, a DC-10 crashed after take-off because
equipment or procedure design or to inadequate training or a cargo door failed (it opened and blew out).
operating instructions. But whatever the origin, the The force applied by a cargo handler to close
question of human performance capabilities and limitations the cargo door, the door design and an
and human behaviour is central to the technology of incomplete application of a service bulletin were
Human Factors. The cost, both in human and financial cited as factors (ICAO Circular 2 3 2 - M 3 ) .
terms, of less than optimum human performance has
become so great that a makeshift or intuitive approach to 4) In 1974, a B-727 approaching Dulles Airport in
Human Factors is no tonger appropriate. Safety being the Washington crashed into Mount Weather, wiih
ultimate objective of all those involved in aviation, its a loss of 92 lives. Lack of clarity and
 Human Factors Training Manual

inadequacies in air traffic control procedures and Factors knowledge. For instance, neglect of Human
regulations led to the accident. The absence of Factors in flight operations can be expected to cause less
timely action of the regulatory body to resolve than optimum performance of tasks. The following para-
a known problem in air traffic terminology was graphs are intended as an overview of particular applica-
also listed as a factor (NTSBIAAR 75-16). tions of Human Factors knowledge which relate to
efficiency,
5) In 1977, two B-747s collided while on the
runway at Tenerife, with a loss of 583 lives. A 1.3.6 Motivation can be explained as reflecting the
breakdown in normal communication procedures difference between what a person can and actually will do;
and misinterpretation of verbal messages were motivated individuals perform with greater effectiveness
considered factors (ICAO Circular 153-ANl98). than unmotivated individuals. Human error and its conse-
quences in aviation can be controlled by Human Factors
6) In 1979, a DC-I0 crashed into Mount Erebus in technology, thus improving effectiveness.
Antarctica. Information transfer and data entry
errors played a role in the accident (Accident 1.3.7 The proper layout of displays and controls in
Report No. 791139, New Zealand). the flight deck promotes and enhances effectiveness.
Properly trained and supervised crew members are iikely
7) In 1982, a B-737 crashed after take-off in icing to perform more efficiently. From the perspective of
conditions in Washington. Erroneous engine efficiency, standard operating procedures (SOPS), which
thrust readings (higher than actual), and the co- are developed to provide the most effective methods of
pilot's lack of assertiveness in communicating operations, should be regarded as a means of measuring
his concern and comments about aircraft the performance of crew members.
performance during the take-off run were among
the factors cited (NTSBIAAR 82-08). 1.3.8 Application of group interaction principles
enhances the managerial position of the captain, whose
8) The report of a 1983 A300 accident in Kuala leadership role is essential to the integration of a team and
Lumpur suggests that variations in panel layout thus to more effective performance. The relationship
amongst the aircraft in the fleet had adversely between cabin attendants and passengers is also important.
affected crew performance. (The aircraft was on Cabin crew members should have an understanding of
a dry lease.) (Accident Report No. W83, passenger behaviour and the emotions they can expect to
Malaysia). encounter on board, as well as how to manage emotional
situations.
9) In 1984, a DC-10 overran the runway at John F.
Kennedy Airport in New York. Excessive
reliance on automation was noted in the accident Well-being of operational personnel
repon (NTSBIAAR 84-15). Excessive reliance
on automation was also listed as a factor in a 1.3.9 Three of the many factors which may
loss of control incident in 1985, in which a influence the well-being of operational personnel are
B-747 lost 20 000 feet in less than two minutes fatigue, body rhythm disturbance, and sleep deprivation or
and sustained structural damage (NTSBIAAR disturbance. These are briefly explained below. Other
86-03). factors affecting physiological or psychological well-being
include temperature, noise, humidity, light. vibration.
10) In 1987 an MD-80 crashed on take-off in workstation design and seat comfort.
Detroit. The pilots had not set the flaps, thus
violating standard operating procedures. Also,
the take-off configuration warning did not Fatigue
sound, for undetermined reasons (NTSBJAAR
88-05). 1.3.10 Fatigue may be considered to he a condition
reflecting inadequate rest, as well as a collection of
symptoms associated with displaced or disturfxd biological
Efficiency rhythms. Acute fatigue is induced by long duty periods or
by a string of particularly demanding tasks performed in
1.3.5 The-need for application of Human Factors is a short tern. Chronic fatigue is induced by the cumulati~e
not limited to flight safcty. Efficiency is also radically effects of fatigue over the longer term. Mental fatigue may
influenced by the application of, or the lack of. Hurlian result from cniotional stress, cven with norniai physical
 C h a ~ f e rI . Fundamental Hurnun Factors conce~ts

rest. Like the disturbance of body rhythms, fatigue may with the body rhythms, it is called primary insomnia.
lead to potentially unsafe situations and a deterioration in Circadian rhythm sleep disorder refers to difficulty in
efficiency and well-being. Hypoxia and noise are contri- sleeping in particular situations where biological rhythms
buting factors. are disturbed, and is the one we are concerned a b u t in
long-range transmeridian flying.

Body rhythm disturbance 1.3.15 The use of drugs such as hypnotics, sedatives
(including antihistamines with a sedative effect) and
1.3.1 1 The most commonly recognized of the body's tranquilizers to induce sleep is usually inappropriate, as
rhythms is the circadian, or 24-hour rhythm, which is they have an adverse effect on performance when taken in
related to the earth's rotation time. This cycle is therapeutic doses for up to 36 hours after administration.
maintained by several agents: the most powerful are light Alcohol is a depressant of the nervous system. It has a
and darkness, but meals and physical and social activities soporific effect, but it disturbs normal sleep patterns and
also have an influence on the body's systems. Safety, entails poor quality of sleep. The effects persist after it has
efficiency and well-being are affected by the disturbed disappeared from the blood ("hangover"). Ingestion of
pattern of biological rhythms typical of today's long-range hypnotics in combination with alcohol can have bizarre
flights. The impact of circadian dysrhythmia is relevant consequences. Caffeine in coffee, tea and various soft
not only to long-distance transmeridian flying - short- drinks incrcases alertness and normally reduces reaction
haul operators (couriers and freight carriers, for instance) times, but it is also likely to disturb sleep. Amphetamines,
flying on irregular or night schedules can suffer from when used to maintain the level of performance during
reduced performance produced by circadian dysrhythmia. slecp deprivation, only postpone the effects of sleep loss.
Air traffic controllers and maintenance [cchnicians with
frequently changing shift schedules can suffer a similar 1.3.16 Sleep has a restorative function, and is
deterioration in their pcrfonnancc. essential for mental performance. Sleep deprivation and
disturbance can reduce alertness and attention. When this
I .3.12 Jet lag is the common term for disturbance or phenomenon is recognized, alertness and attention can at
desynchronization of body rhythms, and refers to the lack least be partly restored by the application of extra effort.
of well-being experienced after long-distance transmeridian The relevance of this phenomenon to safety is obvious.-
air travel. Symptoms include sleep disturbance and disrup-
tion of eating and elimination habits, as well as lassitude, 1.3.17 The resolution of the problem of sleep
anxiety, irritability and depression. Objective evidence disturbance or deprivation includes:
shows slowed reaction and decision-making times, loss of
or inaccurate memory of recent events, errors in computa- - scheduling crews with due consideration to
tion and a tendency to accept lower standards of opera- circadian rhythms and fatigue resulting from
tional performance. sleep deprivation and disturbance;

- adapting the diet, understanding the importance

Sleep of meal times, and adopting other measures in
relation to lightldarkness, rest/activity schedules
1.3.13 .The most common physical symptoms and social interaction;
associated with long-range flying result from disturbance
of the normal sleep pattern, which may in some cases - recognizing the adverse long-term effect of
involve an over-all sleep deprivation. Adults usually take drugs (including caffeine and alcohol);
sleep in one long period each day; where this pattern has
been established it becomes a natural rhythm of the brain, - optimizing the sleeping environment; and
even when prolonged waking is imposed. Wide differences
are found amongst individuals in their ability to sleep out - learning relaxation techniques.
of phase with their biological rhythms. Tolerance to sleep
disturbance varies between crew members and is mainly
related to body chemistry and, in some cases. to emotional Health and performance
stress factors.
1.3.18 Certain pathological conditions - gastro-
1.3.14 Insomnia defines a condition where a person intestinal disorders, heart attacks, etc. -
have caused
has difficulty sleeping or when the quality of sleep is poor. sudden pilot incapacitation and in rare cases have
When occurring under normal conditions and in phase contributed to accidents. While total incapacitation is
 Human Factors Training Manual

usually quickly detected by other crew members, a reduc- errors can be fundamentally different; and the conse-
tion in capacity or partial incapacitation - produced by quences of similar errors can also be significantly
fatigue, stress, sleep, rhythm disturbances, medication, different. While some errors are due lo carelessness,
certain mild pathological conditions may go undetected, negligence or poor judgement, others may be induced by
even by the person affected. poorly designed equipment or may result from a normal
reaction of a person to a particular situation. The latter
1.3.19 Although no conclusivc evidence is available, kind of error is likely to be repeated and its occurrence
physical fitness may have a direct relationship to mental can be anticipated.
performance and health. Improved fitness reduces tension
and anxiety and increases self-esteem. It has favourable
cffects on emotions, which affect motivation, and is Errors at the model interfaces
believed to increase resistance to fatigue. Factors having
a known influence on fitness include diet, exercise, stress 1.4.2 Each of the interfaces in the SHEL model has
levels and the use of tobacco, alcohol or drugs. a potential of error where there is a mismatch between its
components. For example:

Stress - The interface between Liveware and Hardware

(human and machine) is a frequent source of
1.3.20 Stress can be found in many jobs, and the error: knobs and levers which are poorly located
aviation environment is particularly rich in potential or lack of proper coding create mismatches at
stressors. Of main interest is the effect of stress on this interface.
pcrformance. In the early days of aviation. sucssors were
created by the environment: noise, vibration, temperature, - In the Liveware-Software interface, delays and
humidity, acceleration forces. ctc.. and were mainly errors may occur while seeking vital information
physiological in nature. Today, some of these have been from confusing, misleading or excessively clut-
replaced by new sources of stress: irregular working and tered documentation and charts.
resting patterns and disturbed circadian rhythms associated
with long-range, irregular or night-time flying. - Errors associated with the Liveware-
Environment interface are caused by environ-
1-3-21 Strcss is also associated with life events, such mental factors (noise, heat. lighting and
as family separation, and with situations such as periodic vibration) and by the disturbance of biological
mcdical and proficiency checks. Even positive life events. rhythms in long-range flying resulting from
such as a wedding or the birth of a child, can induce stress irregular working/sleeping patterns.
in normal life. Likewise. in situations where mental work-
load becomes very high, such as during take-off. landins - In the Liveware-Liveware interface. the focus is
or an in-flight emergency, mental strcss may appcar. on the interaction between people because this
process affects crew effectiveness. This inter-
1.3.22 Individuals differ in their responses to stress. action also includes leadership and command.
For example, flight in a thunderstoh area may be and shortcomings at this interface reduce oper-
challenging for one individual but stressful for another. ational efficiency and cause misunderstandings
The same stressor (thc thunderstorm) produces different and errors.
responses in different individuals. and any resulting
damage should bc attributed to the response rather than to
the stressor itself. Information processing

1.4.3 Before a person can react to information. it

1.4 HUMAN FACTORS APPLIC.4TIONS IN must first be sensed; there is a potential for error here,
AVIATION OPERATIOSS because the scnsory systems function on& within narrow
ranges. Once information is sensed. it makes its way to the
brain. \\.here it is processed. and a conclusion is dnwn
Control of human error about the nature and mc,ming of the message received.
This interprctativc activity is called perception and is a
1.4.1 To contain and control human error. one must breeding gmund for errors. Expectation. experience. atti-
first undersrand its nature. There are basic concepts tude, moti\.gioi and arousal all have a definite influence
associated xvith the nature of human emr: the origins of on perception and are possiblc sources of errors.
Chapter I . Fundamental H w ~ Factors
n concepts

1.4.4 After conclusions have been formed about the will reduce the number of errors (the total elimination of
meaning of a message, decision-making begins. Many human error is a difficult goal, since errors are a normal
factors may lead to erroneous decisions: training or past part of human behaviour). The second avenue to the
experience; emotional or commercial considerations; cuntroi of hmnan error is to rertuce the consequences of
fatigue, medication, motivation and physical or psycho- the remaining errors by cross-monitoring and crew co-
logical disorders. Action (or inaction) follows decision. operation. Equipment design which makes errors reversibk
This is another stage with potential for error, because if and equipment which can monitor or complement and
equipment is designed in such a way that it can &e support human performance aiso contribute to the
operated wrongly, sooner or later it will be. Once action limitation of errors or their consequences.
has been taken, a feedback mechanism starts to work.
Deficiencies in this mechanism may also generate
errors. Training and evaiuation

Controlling human error 1.4.6 The purpose of this section is to illustrate how
Human Factors applies to the design of methods of opera-
1.4.5 The control of human error requires two differ- tional training.
ent approaches. First, it is necessary to minimize the
occurrence of errors by: ensuring high levels of staff 1.4.7 Education and training are seen here as two
competence; designing controls so that they match human different aspects of the teaching process. Education
characteristics; providing proper checklists, procedures, encompasses a broad-based set of knowledge, values, atti-
manuals, maps, charts, SOPS, etc.; and reducing noise, tudes and skills required as a background upon which
vibration, temperature extremes and other stressful more specific job abilities can be acquired later. Training
conditions. Training p r o g r a m s aimed at increasing the is a process aimed at developing specific skills, knowledge
co-operation and communication between crew members or attitudes for a job or a task. Proper and effective train-

PLAIN TALK
Because of the high cost of aviation gasoline, a private pilot once wrote to his aviation administration and
asked if he codd mix kerosene in his aircraft fuel. He received the following reply:

"Utilization of kerosene involves major uncertainties/probabilities respecting shaft

output and melal longevity where application pertains to aeronautical internal
combustion power plants."

The pilot sent the following cable:

"Thanks for the information. Will start using kerosene next week."

He then received the following urgent letter:

"Regrettably decision involves uncertainties. Kerosene utilization consequences

questionable, with respect to metalloferrous components and power production."

This prompted another cable from the pilot:

"Thanks again. It will sure cut my fuel bill."

The same day he finally received a clear message:

"DON'T USE KEROSENE. IT COULD KILL THE ENGINE - AND YOU TOO!"
 Human Factors Training Manual

ing cannot take place unless the foundations for the devel- 1.4.13 There are two major types of training
opment of those skills, knowledge or attitudes have been devices: training aids (such as slides, videographs, black-
laid by previous education. boards. wall charts), which heIp the teacher present a sub-
ject and training equipment (such as the flight simulator),
1.4.8 A skill is an organized and co-ordinated which provides for active participation and practice by the
pattern of psychomotor, social, linguistic and intellectual trainee. The development of simulators is based on the
activity. Teaching is a skill in its own right, and the need to provide practical training in as realistic an
possession of a skill in a particular activity does not environment as possible, at low cost and risk, and with a
necessarily indicate skill in teaching that activity to others. high degree of efficiency. To obtain approval from certify-
This is an important consideration in the selection of flight ing authorities, the simulator's fidelity must be high
instructors, check pilots, or anyone connected with a enough to develop the proficiency and performance which
teaching activity. are expected in real life situations.

1.4.9 Skills, knowledge or attitudes gained in one 1.4.14 It is often assumed that to achieve the best
situation can often be used in another. This is called training results it is necessary to incorporate the highest
positive transfer. Negative transfer occurs when previous degree of fidelity in the training situation. Fidelity is
learning interferes with new learning. It is important to expensive, however, and it should be cost-effective.
identify the elements of training which can induce nega- Motion, control loading, sound and visual systems, and
tive transfer since a return to earlier learned practices may specific equipment simulation (radar - built-in test
occur in conditions of stress. equipment - flight management computers, etc.) involve
considerable expenditure. At the upper limits of simula-
1.4.10 Learning is an internal process and training tion, a very small increase in fidelity becomes very
is the control of this process. The success or failure of expensive - this .is especially relevant since available
training must be determined by the changes in perform- evidence supports the fact that a good return of training
ance or behaviour which the learning produces. Since transfer is often obtained from moderate levels of fidelity.
learning is accomplished by the student and not by the It is the specialist's task to determine the degree of fidelity
teacher, the student must be an active rather than a passive needed to meet specific training requirements for a parti-
participant. Memory is relevant to learning - short-term cular situation. High fidelity is required in a training
memory (STM) refers to the storage of information which device when the student must learn to make discrimina-
will be stored and quickly forgotten, while long-term tions when selecting switches or controls and where the
memory (LTM) allows the storage of information for responses required are difficult to make or critical to the
extended periods of time. STM is limited to a few items operation. Low fidelity in the equipment is acceptable
of information during a few seconds. Tbrough repetition, when procedures are first being learned, in order to avoid
information is transferred into LTM. While there is a very confusion and not overload the beginner. As the training
large capacity in LTM and fewer storage problems, there progresses, increased fidelity is generally required for user
are certainly retrieval problems, as exemplified by the acceptance.
problems of witness recollections of past events.

1.4.1 1 A number of factors can interfere with the Leadership

success of a training programme - obvious ones like
sickness, fatigue or discomfort as well as others like 1-5-15 A leader is a person whose ideas and actions
anxiety, low motivation, poor quality instruction, an influence the thought and the behaviour of others. Through
unsuitable instructor, inadequate learning techniques or the use of example and persuasion, and an understanding
inadequate communication. of the goals and desires of the group, the leader becomes
a means of change and influence.
' 1.4.12 It is cost-effective to observe a systems
approach to training. Its first step is to determine the 1-4-16 It is important to establish the difference
training needs, possibly through job task analyses. The between leadership, which is acquired, and authority,
second step provides a clear job description and analysis. which is assigned. An optimal situation exists when the
The objective of the training a n then be formulated, and two arc combined. Leadership involves teamwork, and the
criteria can be established for tbe selection of the trainees. quality of a leader depends on the success of the leader's
Next. the course content is determined, and the course relationship with the team. Leadership skills should be
imptemented. Different methods include: lestures, lessons, developed for all through proper training; such training is
discussions. tutorials, audio-visuals. programmed instruc- essential in aircraft operations where junior crew members
tion. and computer-ba. training. are sometimes called u p n to adopt a leadership role
Chapter I . Fundamental Human Factors concepts 1-1-11

0 0 Q

"Oh,I believe in resource management all right. .. t

you're Ute resource and I'm the management?"

!

Reprinted from Air Line Pilot. April 1988.

 Human Factors Training Manual

throughout the normal performance of their duties. This change in personality through routine training, or captaincy
may occur when the co-pilot must take over from an or management training. The initial screening and selection
absent or incapacitated captain, or when a junior flight process are the place and time to take appropriate action.
attendant must control the passengers in a particular cabin On the other hand, attitudes are more susceptible to
section. change through training. The effectiveness of the training
depends on the strength of the attitude(s) which are to be
1.4.17 Skilled leadership may be needed to under- modified. To this end, some States have demonstrated the
stand and handle various situations. For instance, person- safety benefits - particularly for singlepilot operations
ality and attitude clashes within a crew complicate the task -of programmes for improving the pilot decision-making
of a leader and can influence both safety and efficiency. process by identifying hazardous thought patterns. Modify-
Aircraft accident and incident investigations have demon- ing attitudes or behaviour patterns through persuasion is
strated that personality differences influencethe behaviour also of direct relevance to safety and efficiency. Crew
and performance of crew members. Other situationsrequir- bulletins, staff notices and advertising are examples of
ing skilled leadership may be rooted in the frustrations of persuasion.
first officers over slow promotions, or of pilots who are
employed as flight engineers.
Communication

Personality and attitudes 1.4.22 Effective communication, which includes all

transfer of information, is essential for the safe operation
1.4.1 8 Personality traits and attitudes influence the of flight. The message might be transferred by s k h , by
way we conduct our lives at home and at work. Person- the written word, by a variety of symbols and displays
ality traits are innate or acquired at early stages of life. (e.g. instruments, CRT, maps) or by non-verbal means
They are deep-rooted characteristics which define a such as gestures and body language. The quality and
person, and they are very stable and resistant to change. effectiveness of communication is determined by its intel-
Traits such as aggression, ambition and dominance may be ligibility: thc degree to which the intended message is
seen as reflections of personality. understood by the receiver.

1.4.19 Attitudes are learned and enduring tendencies 1,423 There are several hazards which reduce the
or predispositions, more or less predictable, to respond quality of communications:
favourably or unfavourably to people, organizations, deci-
sions, etc. An attitude is a predisposition to respond in a - failures during the transmitting process (e.g. the
certain way; the response is the behaviour itself. It is sending of unclear or ambiguous messages,
believed that our attitudes provide some sort of cognitive language problems);
organization of the world in which we live, allowing us to
make rapid decisions on what to do when facing certain - difficulties caused by the medium of trans-
situations. mission (e-g. background noises or distortion of
the information);
1.4.20 Accidents have been caused by inadequate
performance by people who had the capacity to perform - failures'during receiving (e-g. the expectation of
effectively and yet failed to do so. Reports from the another message, wrong interpretation of the
Confidential Human Factors Reporting Programme arriving message or even its disregard);
(CHfRP) and the Aviation Safety Reporting System
(ASRS) support the view that attitudes and behaviour play - failures due to interference between the rational
a significant role in flight safety: This indicates the need and emotional levels of communication (e.g.
for more research into desirable and undesirable person- arguments);
ality characteristics in crew members, and the importance
of an effective assessment of personality during crew - physical problems in listening or speaking (e.g.
selection. If personality or attitude differences on the Aight impaired hearing o r wearing of the oxygen
deck have indeed been cited as the cause of accidents and mask);
incidents, then we should also look at the extent to which
it may be possible to influence attitudes through training. - use of English among native and non-native
. speakers; and
1.4.21 The difference between personality and atti-
tudes is relevant, because it is unrealistic to expect a
 Chapter 1. Fundamental Human Fadors concepts 1-1-13

1.4.24 It is the task of Human Factors training to Motivation

prevent communication errors. This task includes the
explanation of common communication problems as well 1.4.28 Motivation reflects the difference between
as the reinforcement of a standard of language to ensure what a person can do and actually will do, and is what
the enor-free fransmission of a message and its correct drives or induces a person to behave in a particular
interpretation. Ambiguous, misleading, inappropriate or fashion. Clearly, people are different and driven by differ-
poorly constructed communication, combined with expect- ent motivational forces. Even when selection, training and
ancy, have been listed as elements of many accidents. the checking ensure capability to perform. it is motivation that
most notorious one being the double B747 disaster in determines whether a penon will do so in a given situation.
Tenerife (March 1977).
1.4.29 There is a relationship between expectancy
and reward as motivators, since the utility of a reward and
Crew coordination the subjective probability of its achievement determine the
level of effort which will be applied to obtain the reward.
1.4.25 Crew co-ordination is the advantage of team- This effort must be accompanied by the proper skills. It is
work over a collection of highly skilled individuals. Its important for high performers to see that they are in a
prominent benefits are: better position than p r performers to achieve a reward,
otherwise motivation may decline. Job satisfaction motiv-
- an increase in safety by redundancy to detect ates people to higher performance.
and remedy individual errors; and
1.4.30 Modifying behaviour and performance
- an increase in efficiency by the organized use of through rewards is called positive reinforcement;
all existing resources. which improves the in- discouraging undesirable behaviour by use of penalties or
flight management. punishment is called negative reinforcement. Even though
positive reinforcement can be more effective in improving
1.4.26 The basic variables determining the extent of performance, both must be available to management.
crew co-ordination are the altitudes, motivation and train- Different responses are to be expected from different
ing of the team members. Especially under stress (physi- individuals in relation to positive and negative reinforcers.
cal. emotional or managerial). there is a high risk that Care should be taken not to generate an effect which is
crew co-ordination will break down. The results are a opposite from that which is intended.
decrease in communication (marginal or no exchange of
information), an increase in enors (e.g. wrong decisions)
and a lower probability of correcting deviations either Documentation
from standard operating procedures or the desired flight
path. Additionally. emotional conflicts in the cockpit may 1.4.3 1 Inadequacies in aviation documentation have
result. . a twofold impact: there is a monetary aspect associated
with increased time or the impossibility of performing a
1.4.27 The high risks associated with a breakdown paicular task and there is also a safety aspect With
of crew co-ordination show the urgent need for Crew -
reference to documentation including electronic flight
-
documentation displayed on screen some basic aspects
Resource Management training, discussed in Part 2 of the
manual. This kind of training ensures that: require Human Factors optimization: 1l
- the pilot has the maximum capacity for the pri-
a) written language, which involves not only
vocabulary and grammar, but also the manner in
mary task of flying the aircraft and making deci- I
which they are used;
sions;
b) typography. including the form of letters and
- the workload is equally distributed among the printing and the layout, has a significant impact
crew members, so that excessive workload for on the comprehension of the written material:
any individual is avoided: and
c) the use of photograph diagrams, charts or tables
- a coordinated cooperation -including the replacing long descriptive text is advantageous to
exchange of information, the support of fellow help comprehension and maintain interest The
crew members and the monitoring of each use of colour in illustrations reduces 'the
other's performance -will be maintained under discrimination workload and has a motivational
both normal and abnormal conditions. effect;
1-1-14 Human Factors Trainina Manual
 Chapter I . Fundamenral H u m Factors concepts 1-1-15

d) the working environment in which the document ible, guide them to the appropriate corrective action.
is going to be used has to be considered when System reliability is vital, since credibility will be lost if
print and page size are determined (for example, false warnings proliferate, as was the case with earlier
an airport chart which is too small may induce generations of ground proximity waming systems. In the
error during taxiing). event of a technical failure of the display system, the user
should not be presented with unreliable information. Such
information must be removed from sight or clearly
Workstation design flagged. For example, unreliable Bight director command
bars should disappear. Invalid guidance information which
1A.32 For design purposes, the flight deck should remained on display has been a factor in accidents.
be considered as a system, as opposed to a collection of
particular aspects or systems such as hydraulic, electrical 1.4.37 A eontrol is a means of transmitting discrete
or pressurization. Expertise should be applied towards or continuous information or energy from the operator to
matching the characteristics of these systems to those of some device or system. Control devices include push
humans. with due consideration to the job to be per- buttons, toggle or rotary switches, detented levers. rotary
formed. Proper matching of working areas to human knobs, thumbs wheels, small levers or cranks and keypads.
dimensions and characteristics is important -for instance, The type of device to be used depends on functional
size. shape and movements of the body provide data used requirements and the manipulation force required. Several
to ensure adequate visibility in the flight deck, location design features apply to controls:
and design of conmls and displays, and seat design.
a) location;
1.4.33 The importance of the standardization of
panel layout relates to safety, since there are numerous b) conml-display ratio (conml movement related to
reports of errors arising from inconsistent panel layouts. that of the moving element of the associated
involving inadvertent reversion to an operating practice display);
appropriate to an aircraff flown previously. Seat design
considerations include seat controls. headrests, seat c) direction of movement of the control relative to
cushion and fabric, lumbar support, thigh support, etc. the display:

1.4.34 A display is any means of presenting infor- d) control resistance;

mation directly to the operator. Displays use the visual,
aural or tactile senses. The transfer of information from a e) control coding, by means of shape, size, colour.
display to the brain requires that information is filtered. labelling and location: and
stored and processed, a requirement which can cause prob-
lems. Thii is a major consideration in the design of flight f) protection against inadvertent actuation.
deck displays. The information should be presented in
such a way as to assist the processing task, not only under 1.4.38 The application of automation to flight deck
normal circumstances. but also when performance is displays and controls may breed complacency and over-
impaired by stress or fatigue. reliance on the automated system, which have been
suggested as factors in accidents and incidents. If the
1.4.35 A fundamental consideration in display Human Factors-related issues (e.g. the limited performance
design is to determine how, in what circumstances, and by of the human as monitor and effects on motivation) are
whom the display is going to be used. Other considera- properly addressed, there may be a justification for auto-
tions include the characteristics of visual displays and mation. It may conuibute to improved aircraft and system
aural signals; light requirements; the selection of analogue performance and over-all efficiency of the operation. It
or digital alternatives: the applicability of LEDs (light- may relieve the crew of cenain tasks so as to reduce
emitting diodes), LCDs (liquid-crystal displays) and CRTs workload in phases of flight where it reaches the limit of
(cathode-ray tubes): the angle at which the display is to be operational acceptability.
viewed and its related parallax: viewing distance, and
possible ambiguity of the information.
Cabin design
1.4.36 Three fundamental operational objectives
apply to the design of waming, alerting and advisory 14.39 Human Factors considerations for the cabin
systems: they should alert the crew and draw their atten- include aspects of workspace and layout as well as inform-
tion. report the nature of the condition. and. ahen poss- ation on human behaviour and performance.
 Human Factors Training Manual

1.4.40 Human size and shape are relevant in the associated with visual illusions in flight operations is the
design of cabin equipment (toilets, galleys, meal carts and recognition through training that visual illusions are a
overhead bins); emergency equipment design (lifejackets, natural phenomenon. Training should also help in under-
life-rafts, emergency exits, oxygen masks); seats and standing that the circumstances in which they occur are
furnishings (including in-flight entertainment); jump seats often predictable. The use of additional information
and rear-facing seats. Knowledge of the user's height and sources to supplement visual cues (radar, attitude displays,
reach determines location of equipment and controls. radio altimeters, VASIs, DMEs, etc.) is the most effective
Proper access and room to work must be provided in protective measure against disorientation and illusions. To
cargo compartments. The estimation of human forces some extent the risk from visual illusions may be allevi-
required to operate doors, hatches and cargo equipment ated by design features such as high optid quality wind-
have to be realistic. Anthropometry (the study of human shield glass, adequate visibility, eye position guidance,
dimensions) and biomechanics (smdy of the movement of .
effective windshield rain and ice protection, etc.
parts of the body and the forces which they can apply) are
the sources of the required information for those purposes.

1.4.41 Due consideration has to be given to handling LIST OF REFERENCES

special passengers: the physically handicapped, the intoxi-
cated, and the fearful. Passenger behaviour, including
group influences, and expected human behaviour when Journals
facing a crisis are of relevance here.
Ergonomics; United Kingdom; Taylor and Francis;
1.4.42 Recent accidents and incidents have docu- monthly; official journal of the International
mented the need for Human Factors information for those Ergonomics Association and Ergonomics Society.
involved in ground operations, such as maintenance and Human Factors; United States; Human Factors and
inspection managers, flight line supervisors and others. Ergonomics Society; quarterly, the journal of the
Similarly, persons involved in the design of aircraft Human Factors and Ergonomics Society.
systems should recognize human limits in maintaining, The I n t e ~ ~ o nJountal
al of Aviation Psychology; United
inspecting and servicing aircraft. Such factors as training, States; quarterly, Lawrence Erlbaum Associates,
work environment, communication methods, physiological Hillsdale, New York
limitations and human engineering of equipment should be
considered. Bulletins

Cabin Crew Safety Bulletin; Flight Safety Foundation;

Viual performance and United States; bi-monthly.
collision avoidance Human Factors Bulletin; Right Safety Foundation; United
States; periodically.
3-4-43 A proper understanding of how the visual
system works helps in the determination of optimum Incident reporting systems
working conditions. The characteristics and measurement
of light, the perception of colour, the physiology of the C a l l W , United States; NASA-Ames; monthly; bulletin
eyes and the way the visual system works are relevant in of the ASRS.
this area. Also important are factors involved in the ability ARSR Quarterly Reports; United States; NASA-Ames;
to detect other aircraft at a distance, either in daytime or quarterly; summaries and analyses.
at night, or to identify outside objects in the presence of ASRS Contractor Reports; United States; NASA-Ames;
rain or other contamination on the windscreen. periodically; ASRS data analyses.
Feedback; United Kingdom; Institute of Aviation
1.4.44 Visual illusions and disorientation in flight Medicine; trimonthly; bulletin of the CKlRP.
operations may be directly related to safety. During ali
phases of flight, but in particular during approach and Books -Recommended reading
landing, visual illusions are believed to have played a
significant role in accidents for which it is difficult to find Campbell, R.D., and M. Bagshaw. Human performance
any other explanation. Factors of specific consideration and linlitations in aviation. BSP Professional Books.
here include sloping terrain, runway width, lighting Green, R.G., H. Muir, M. James, D. GradweIi, and
intensity. the "black hole*' phenomenon and lack of run- RL. Green, H u n w Factors for pilots. Averbury
way texture. An effective step in reducing the risks Technical.
Chopter I. Fundomental Human Factors concepts

Hawkins. Frank H. Human Factors in Flight. Gower. Maurino. D., J. Reason, N. Jonston. and R. Lee. Beyond
Hunt R.. and Hunt L.R. (eds.). Pilot Error (2nd ed.). Aviation Human Factors. Averbury Aviation.
Granada. Nance, JJ. Blind Trust: The H~wnanFoctors of Air line
Jensen, R.S. (4.). Aviation Psychology. Gower. Accidents; Morrow.
Jensen, R.S. Pilot Judgement and Crew Resoume @Hare, D., and S. Roscoe. Flightdeck performance: The
Mmgemenr. Averbury Aviation. Human Factors. Iowa Slate Univenity Press.
Johnston. A.N.. N. McDonald, and R. Fuller (eds.). Reason, J.. and K. Mycielska. Absent Minded; Prentice-Hall.
Aviation Psychology in Practice. Averbuy Technical. Reason. J. Human error. Cambridge Univenity Press.
Johnston, A.N., N. McDonald, and R. Fuller. (eds.). Sloan. S.J., and C.L. Cooper. Pilots under stress.
Applicotions of Psychology to the Aviation System. Routledge & Kegan Paul.
Averbury Aviation. Telfer. Ross A. Aviation Insmtion and Training. Ashgate.
Johnston, A.N., N. McDonald, and R. Fuller,. (4s.). Trollip, S.R., and R.S. Jensen. Human Factorsfor general
Aviation Psychology: Training andSelection. Averbury aviation. Jeppesen Sanderson Inc.
Aviation. Wiener, E.L.. B.G. Kanki, and R.L. Helmreich, (eds.)
Johnston. A.N.. N. McDonald, and R. Fuller, (eds.). Cockpit Resource Management Academic Press.
Human Factors in Aviation Operations. Averbury Wiener. Earl, and David C. Nagel. Human Factors in
Aviation. Aviation. Academic.
 CHAPTER 2
HUMAN FACTORS, MANAGEMENT
AND ORGANIZATION

2.1 INTRODUCTION accidents a s processes, with multiple interacting chains,

which often go back over considerable periods of time and
2.1.1 Since the beginning of aviation. human error involve many different components of the over-all system.
has been recognized as a major factor in accidents and
incidents. Indeed. one of aviation's biggest challenges has 2.1.4 The investigation of major catastrophes in
-
been -and will continue to be human error avoidance large-scale, high-technology systems has revealed these
and conml. Traditionally, human error in aviation has accidents to have been caused by a combination of many
been closely related to operational personnel, such as factors, whose origins could be found in the lack of
pilots, controllers, mcchanics. dispatchers. etc. Contemp- Human Factors considerations during the design and
orary safety vicws argue for a broadened perspective operating stages of the system rather than in operational
which focuses on safety deficiencies in the system rather personnel error. Examples of such catastrophes include the
than in individual performance. Evidence provided by accidents at the Three Mile Island (F'ennsylvania, USA,
analysis from this perspective has allowed the identifica- 28 March 1979) and Chemobyl (Ukraine. USSR, 26 April
tion of managerial deficiencies at all operating stages of 1986) nuclear power plants, the Challenger space shuttle
the aviation system as imponant conuibuting factors to (Florida, USA, 28 January 1986). the double B-747
accidents and incidents. disaster at Tenerife (Canary Islands, Spain, 27 March
1977) and the Bhopal (Bhopal, India, 3 December 1984)
2.1.2 During the early years, aviation safety efforts chemical plant. Large-scale, high-technology systems like
were directed towards improving the technology, with the nuclear power generation and aviation have been called
main focus on operational and engineering methods for sociotechnical sysrems, in reference to the complex inter-
combating hazards. With admirable success. they sustained actions between their human and technological com-
a reduced accident rate. When it became apparent that ponents. Managementfactors and organizational accidents
human error was capable of circumventing even the most are key concepts in sociotechnical systems' safety. The
advanced safety devices, effow were then directed to the terms system accidenr and organitarional accident reflect
human element in the system. The late 70s and 80s will the fact that certain inherent characteristics of socio-
undoubtedly be remembered for the prevailing enthusiasm technical systems, such as their complexity and the
regarding aviation Human Factors. Cockpit (and then unexpected interaction of multiple failures, will inevitably
Crew) Resource Management (CRM), Line-Oriented Flight produce safety breakdowns. In sociotechnical systems,
Training (LOFT). Human Factors mining programmes, remedial action based on safety findings goes beyond
attitudedevelopment programmes and similar effow have those who had the last opportunity to prevent the accident.
multiplied, and a campaign to incrcase the awareness of i.e. the operational personnel, to include the influence of
the pemasivcness of human error in aviation safety has the designers and managers. as well as the structure or
been initiated. Human error, however. continues to be at architecture of the system. In this approach, the objective
the forefront of accident statistics. is to find wllat. rather than wlro, is wrong.

2.1.3 Statistics can be misleading in understanding 2.1.5 Consider the probable cause statement in the
thc nature of accidents and devising prevention measures. aircraft accident repon following a twin jetliner crash
Statistics reflect accidents as a series o i cause and effect during an attempted take-off in icing conditions:
relationships _grouped into discrete categories (flight crew.
1
maintenance. weather, ATC. etc.). Errors are not registered 'The National Transponation Safety Board determines
as such hut some of their effects are: controlled Risht into that the prohable causes of this accident were the
terrain. ahoned takc-off ovcrmn. etc. Statisucs then failure of the airline industry and the Federal Aviation
provide thc answers when it is tcm late. They fail to reveal Administration to provide flight crews with proced-
 1-2-2 Human Factors Traininla Manual

failure of the airline industry and the Federal Aviation - examples of how system deficiencies whose roots
Administration to provide flight crews with proced- can be found far away from the site contribute to
ures, requirements and criteria compatible with depart- accidents and introduces the concept of safe and
ure delays in conditions conducive to airframe icing unsafe organizations.
and the decision by the flight crew to take off without
positive assurance that the airplane wings were free of - a "how to" to help decision-makers recognize why
ice accumulation after 35 minutes of exposure to they should act upon safety; it provides details on
precipitation following deicing. The ice contamination and examples of what decision-makers can do to
on the wings resulted in an aerodynamic stall and loss contribute to safety.
of control after liftoff. Contributing to the cause of the
accident were the inappropriate procedures used by,
and inadequate coordination between, the flight crew
that led to a rotation at a lower than prescribed
2.2 FROM INDIVIDUALS
airspeed."'
TO ORGANIZATIONS

While acbwledging the role the operational personnel "At 01:24 on Saturday, 26 April 1986, two explosions
played in triggering the accident, the analysis looks for blew off the 1000-tonne concrete cap sealing the
system deficiencies and recognizes that the root causes of Chernobyl-4 reactor, releasing molten core fragments into
the accident can be traced back to flaws in the aviation the immediate vicinity and fission products into the
system design and operation. atmosphere. This was the worst accident in the history of
commercial nuclear power generation. It has so far cost
2.1.6 This chapter, therefore, addresses the influence over 30 lives, contaminated some 400 square miles of land
of management factors in aviation safety, from the around the Ukrainian plant, and significantly increased the
perspective of organizational accidents. Its contents, like risk of cancer deaths over a wide area of Scandinavia and
any changes or new approaches in aviation, are evolu- Western Europe ... There are two immediate questions:
tionary rather than revolutionary. Management factors in (1) How and why did a group of well-intentioned, highly
accident prevention go back to some of the earliest indust- motivated and (by other accounts at least) competent
rial safety texts, forty or more years ago; they have been operators commit just the right blend of errors and safety
the subject of prevention courses for over thirty years violations necessary to blow this apparently safe reactor?
(Advanced Safety Management and System Safety Factors, (2) Could something like it happen herer"
C.O. Miller. University of Southern California, 1965). The
objective of this chapter is to provide the participants in 2.2.1 The first step in answering these questions is
the decision-making process in the aviation industry - recognizing that operational personnel do not act in isola-
including corporate management, regulatory authorities, tion, but plan and execute their actions within a social
manufacturers and professional associations - with an milieu. They are part of an organization and, functioning
awareness of the impact of their actions or inactions on on a continuous basis and through a division of labour and
aviation safety. Throughout the chapter, numerous a hierarchy of authority, seek to achieve an objective or a
examples are included for clarification purposes. The set of obje~tives.~ Operational personnel are organized,
examples are excerpted from accident investigationreports which implies the existence of task distribution, co-
produced by relatively few States and their inclusion ordination, synchronization, shared objectives and accept-
should by no means be construed as a negative reflection ance of a common authority. Furthermore, operational
on the safety record of those States or as an unwarranted personneI do not operate in a vacuum. Their actions and
criticism of their administrations or aviation systems. On attitudes are a reflection on those who employ and repre-
the contrary, it is an implicit recognition of a progressive sent them. For example, an attitude of disrespect for ihe
artitude towards safety, since by virtue of W i g pioneers disciplined application of procedures does not develop
in the application of the perspective advanced by this overnight; it develops after prolonged exposure to an
chapter, ibose States are among those at the leading edge atmosphere of indifference?
of the international community's safety endeavours.
22.2 The second step involves the recognition that
2.1.7 This chapter comprises the following: during the second half of the twentieth century, farge-
scaie, technically-based systems and organizations have
- an introduction to contemporary safety thinking. become firmly established duting what is sometimes called
presenting the shift from individuals to the "second industrial revolution"? The term so&-
organizations. technical systems, coined in 1960, refers to organizations
 Chnprer 2. H u r m Factors, management and organization

which use high technology on a large scale. The aerospace tions in 1.1. When viewed from the perspective of socio-
industry, nuclear power generation. marine and railroad technical systems' safety, it is obvious the ingredients for
transportation and the chemical processing industry are the Chernobyi disaster were present at many levels. There
examples of sociotechnical systems. The organizations in was a sociery committed to the production of energy
these systems bring together two components to achieve through large-scale power plants; there was a system that
their objectives: the technical component (technology) and w u complex (is. with many control parameten that could
the human component (people). These two components potentially interact), potentially hazardous. tightly coupled
interact with each other at every human-machine intelface. (i.e. with relatively few ways of achieving particular
Both components are highly interdependent and operate goals). opaque (i.e. with many unfamiliar or unintended
under joint causation; that is, both humans and machines feedback loops) and operating in borderline conditions;
are affected by the same causal events in their surrounding there was a management structure that was monolithic.
envir~nment.~ Organizations in sociotechnical systems remote and slow to respond; and there were operators who
pursue production goals: transportation of people and possessed only a limited understanding of the inter-
goods in aerospace. marine and railroad systems; energy dependences of the system they were controlling and who.
in nuclear power generation, etc. It is characteristic that in any case, were assigned a task that made violations
the consequences of safety breakdowns in organizations inevitable9. These factors are not unique to any particular
within sociotechnical systems are camstrophic in terms of State or to nuclear power generation. By substituting a few
loss of life and property, since they involve high-riskhigh- t e r n , the description becomes a framework applicable to
hazard activities. Likewise, in large-scale technological aviation accidenfs anywhere in the world aviation
systems, potential hazards arc concentrated in single sites community, as the following example illustrates.
under the centralized control of relatively few operational
personnel: the control room operators in a nuclear power 2.2.5 On 1 February 1991. a Boeing 737 collided
plant; the flight crew in an aircraft. etc7 Within the with a SA-227-AC (Fairchild Meuoliner) while the 737
aviation system. organizations include airlines and other was landing.on runway 24 left at Los Angeles Inter-
operators. manufacturers, airports, air lraffic conlrol, national Airpon (a sociery committed to the production of
weather services, civil aviation authorities, safety large-scale, high-technology transponafion). The Meme
investigation agencies, international organizations (ICAO, liner was positioned on the runway, at an intersection.
JAA. EUROCOPTIROL, etc.) and professional associations awaiting clearance for cake-off. The glare from the apron
(IATA. IFALPA, IFATCA, ISASI. etc.). lighting made the aircraft inconspicuous and difficult to
see from the control tower (qsrem operating in bonlerline
2.2.3 As a consequence of the close interdependence conditions). Both aircraft were destroyed and 34 persons
between people and technology, complex and often- fatally injured. The probable cause statement reads as
overlooked changes in sociotechnical systems may occur follows (text in italics added):
over time. Therefore, when pursuing safety in these
systems, it is narrow and restrictive to look for 'The National Transportation Safety Board determines
explanations for accidenls or safety deficiencies in that the probable cause of the accident was the failure
exclusively technical terms or purely from the perspective of the Los Angeles Air Traf%cFacility Management to
of h e behavioural sciences, i.e. human e m . Analysis of implement procedures that pmvided redundancy
major accidents in technological systems has clearly comparable to the requirements contained in the
indicated that the preconditions to disasters can be traced National Operational Position Standardsand the failure
back to identifiable organizationaldeficiencies. It is typical of the FAA Air Traffic Service to pmvide.adequate
to find that a number of undesirable events. all of which policy direction and oversight to its air MIC control
may contribute to an accident, define an "incubation facility managers [management structure slow to
period" which is often measured in terms of years, until a respona. These failures created an environment in the
mgger event, such as an abnormal operating condition, Los Angeles Air TrafIic Control tower that ultimately
precipitates a disaster. Funhermore. accident prevention led to the failure of the local conuvller 2 (LC2)to
activities in sociotechnical systems recognize that major maintain an awareness of the traftic situation, culm-
d e t y problems do not belong exclusively to either the inating in the inappropriate clearances and subsequent
human or the technical components. Rather. they emerge collision ... [operator wit11a linrited understanding of
from as yet little understood interactions between people the Vstem she was corrtrolling and set to a task that
and technology8. The environment in which these inter- made violario~~s irrevituble; ?stem opaque]. Contri-
actions take place further influences their complexity. buting to the accident was the failure of the FAA to
provide effectivequality assurance of the ATC system
2.2.4 With these basic concepts at hand, let us [nrunuyernenr strr~ctr~reslaw ro respond: Fsrem
sttempt to many thcory to practice and answer the qucs- tiyhtl?-coupled. Irazardous, ~ o n r ~ l e x ] . " ' ~
 1-2-4 Human Factors Training Manual

2.2.6 This analysis lakes into consideration all the position to undertake remedial actions, i.e. who can
components described in the previous paragraphs. It looks provide the greatest contribution to safety. Had they
into the human and technical elements, recognizing their survived, the flight crew could have improved their future
interdependence and interaction, thus observing the performance as the last safety valve in the system through
-
principle of joint causation. It goes beyond although it increased training and re-certification. personal improve-
does not ignore -the actions of the operational personnel ment, etc. Focusing remedial action around improved per-
(the air traffic controller and the pilots). It acknowledges formance by this particular crew would enhance safety at
that operational personnel do not operate in isolation and the individual level, that is, only as far as this crew is
it looks into the organizational deficiencies and manage- concerned. However, the door would remain open for
ment factors involved in the *incubation period" of the many other flight crews operating in the same unimproved
accident. In this broadened view, system safety deficien- system to make errors invited by imperfect system design.
cies are crystal clear, as are the remedial actions necessary - The major contribution must then originate at the decision-
to correct them. Most importantIy, by determining why the making Ievels, those who have the ultimate power to intro-
accident occurred, it indicates what is wrong in the system duce radical changes and modify - system-wide - the
and should be corrected rather than who made a mistake architecture, design and operation of the system.
and should be punished. Blame and punishment have. in
themselves, limited value as prevention tools. 2.2.9 In general terms, there are three levels of
action decision-makers can choose in pursuing the safety
2.2.7 On 10 March 1989, a Fokker F-28 Mk-1000 recommendations from analyses such as those exemplified
crashed after take-off from Dryden Municipal Airport in in the previous paragraphs:'2
Dryden, Ontario, Canada. A total of 24 persons died as a
consequence of the crash and the accompanying fire. The The first level of action is to eliminate the halard,
final report of the Commission of Inquiry recognizes that thereby preventing a future accident. In the case of
take-off was attempted with snow and ice 'contaminating the runway collision accident, for example, a
the wings, a fact which eventually led to the accident. decision could be made that in airports having
However, in keeping with a system analysis, the report pardie1 runways, one runway should be used for
poses a fundamental question: what caused or prompted take-offs and the other for landings. In the icing
the pilot-intommand to make the decision to take off; and example, it could be decided to absolutely forbid
what system safeguards should have prevented or altered operations when conditions are conducive to
this decision? It further states: airframe icing. These are the safest decisions but
they may not be the most efficient.
"...The pilot-in-command made a flawed decision, but
that decision was not made in isolation. It was made The second level of action is to accept the hazard
in the context of an integrated air transportation identified and adjust the system to tolerate human
system that, if it had been functioning properly, should error and to reduce the possibility of an occurrence.
...
have prevented the decision to take off there were In this context, the decisions following the Los
significant failures, most of them beyond the captain's Angels accident might include eliminating night
control, that had an operational impact on the events intersection take-offs or clearances involving
in Drydcn ... the regulatory, organizational. physical taxiing into position on an active runway and
and crew components must be examined to determine holding for take-off clearance. In the Dryden
how each may have influenced the captain's decision." example, the decision might be to eliminate
operations into stations without proper de-icing
The results of this examination are summariixd in the facilities, or when aircraft equipment related to
report as foHows: anti-icing protection is unserviceable, in
environmental conditions conducive to icing.
- ...
'6
the captain, as pilot-in-command, must bear Although not as safe as first level actions, these
responsibility for the decision to land and take off in options are more qalistic and eficient and they
Dryden on the day in question. However. it is equally work.
clear that the air transportation system failed him by
allowing him to be placed in a situation where he did The third level of action involves both accepting
not have all the necessary tools that should have that the hazard can be neither eliminated (level
supported him in making the p r o p decision."" one) nor controlled (level two) and teaching
operatio-nd personnel to live with it. Typical
2.2.8 Again, all elements have been considered. This actions include changes in personnel selection,
approach also puts into perspective who is in the best training, supervision, staffing and evaluation,
Chapter 2. Human Factors, management and organization

increasing or adding warnings, and any other reality of the failure to carry that concern ttuough into
modifications which could prevent operational action. It has been said that a concem for safety which
personnel from making a similar mistake. is sincerely held and expressly repeated but, nevenhe-
less, is not d e d through into action, is as much
Third level actions should not be taken in preference to protection from danger as no concem at all."
first or second level actions, since it is impossible to
anticipate all future kinds of human emr. Attempting to Adhering to the notion of accident causation in socio-
eliminate all human e m r is an unattainable goal, since technical systems, the Repon concludes:
error is a normal part of human behaviour. The total
system (including aircraft, crew, airports and ATC) should "[The railway company management] commitment to
identify, tolerate and correct human emr. Tolerate is the safety is unequivocal. The accident and its causes have
key word; as long is humans are involved. the system shown that bad workmanship, poor supervision and
must be designed to tolerate the entire range of "normal" poor management combimed to undermine that
human behaviour. including human weaknesses. It must be commitment"."
error-tolerant.
2.2.1 1 The message underlying the foregoing is two-
2.2.10 On Monday, 12 December 1988, acommuter fold. Firstly, it should be obvious that manifestations of
uain was approaching Clapham Junction station (England) intent like the well-known truism "safety is everybody's
when it crossed a signal which suddenly turned red. The business" are not enough; decision-maken have to adopt
driver, in accordance with standard operational procedures, an active stance in promoting safety action.14 Indeed, it is
slopped the uain and went to phone the signal box to asserted that management panicipation in safety
report that he had crossed a signal at "danger". During his deficiencies prevention is an everyday commitment and
absence, the signal turned from red to yellow as a result safety promotion by decision-makers requires as active an
of faulty rewiring work performed by a technician two involvement as that of the operational personnel. Secondly,
weeks earlier. This allowed another commuter uain to it would be misleading and quite unfair to suggest that
enter the same track and crash into the back of the decision-makers are not interested in or neglect safety
stationary train. Thirty-five people died and nearly 500 promotion. The Clapham repon exemplifies that. beyond
were injured, 69 of them seriously. The Report of the any reasonable doubt, concern for safety ranks high in
Investigation into the Clapham Junction Railway Accident decision-makers' thoughts. Why the failure in carrying
states: thought into deed, as evidenced by accident investigations
from the organizational perspective? One answer may be
'The vital importance of [the] concept of absolute
because of lack of awareness. Those at the decision-
safety was acknowledged time and again in the evi-
making levels may not be aware of how and why their
dence that the Coun heard [from the railway company
actions or inactions may affect safety; and even if they are
management]. The problem with such expressions of
aware, they might not know what to do to actively partici-
concern for safety was that the remainder of the
pate in safety promotion endeavours. If you are unaware
evidence demonstrated beyond dispute two things:
of a problem, then for all practical purposes that problem
does not exist. Should this contention about lack of aware-
(i) there was total sincerity on the part of all who
ness be true, it follows that decision-makers need the tools i
spoke of safety in this way but nevertheless
and knowledge to discharge their responsibility. This I
(ii) there was a failure to cany those beliefs through chapter is but one attempt in that direction. .. I

from thought to deed.

2.2.12 In filing a dissenting statement to the prob
The appearance was not the reality. The concern for able cause stated in the accident report following the
safety was permitted to co-exist with working practices runway collision between a Boeing 727 and a Beechcraft
which ... were positively dangerous. This unhappy co- King Air A100, one of the members of theinvestigating
existence was never detected by management and so agency asserted:
the bad practices never eradicated. The best of
intentions regarding safe working practices was "I also disagree with the notion that agencies cause
permined to go hand in hand with the wont of accidents. Failure of people and failures of equipment
inaction in ensuring that such practices were put into cause accidents. Shifting the cause from people to
effect. agencies blurs and diffuses the individual account-
ability that I believe is critically important in the
The evidence therefore showed the sincerity of the operation and maintenance of the transportation
concern for safety. Sadly. however. it also showed the system"!s
 Human Facrors Training Manual

2.2.13 This assertion reflects a real and valid actions with the surrounding environment. The purpose is
concern, as well as a somewhat widespread misconception. to either foster safe behaviour or discourage unsafe
There are some who fear that when exploring the relation- behaviour and thus improve safety and efficiency as well
ship between Human Factors, management and organiza- as the well-being of those in the aviation system. Human
tion - and how it influences aviation safety and Factors ideas and techniques can also be applied to
effectiveness - the notion of individual accountability organizations. This chapter borrows from the organism
may be lost. Others contend that this may abo be a subtle metaphor and discusses the equivalent components of
I< way of "passing the buck" for safety entirely to manage- brain, body, personality and objectives as they apply to
ment. In fact, the concept of organizational accidents organizations. Thus the characteristics of safe and unsafe
represents a broadened view of system safety, which does organizations and organizational behaviour can be
not intend either to shift responsibility or blame from considered as yet another contribution to the pursuit of
operational personnel towards management, or to remove safety, efficiency and individual well-being within the
individual responsibility. Firstly, as already stated, blame aviation system. The world-wide survey conducted in 1986
is a social and psychological process which involves self- by a major aircraft manufacturer (discussed in 2.5.1 and
preservation and denial and has only limited safety or 2.5.2) attests to the relevance of the concept of safe and
prevention value. Secondly, it is not suggested that unsafe organizations.
operational personnel do not make uncalled-for errors; that
they sometimes do is beyond doubt. The contention is that 2.3.2 Organizations have objectives which are
the potential for these errors has long been realized and usually related to production: building aircraft or other
measures to mitigate them are reasonably well recognized. equipment, transporting passengers, transporting goods.
What has been rather neglected are measures directed at etc. Producing profit for stockholders is one of the goals
enhancing the system's tolerance to human failures of many organizations. Most organizations within the avia-
committed - by the simple fact that they are human tion industry are formed to achieve some practical object-
-
beings subject to human biases and limitations by those ive or goal, and safety is not the primary goal. Safety fits
at the decision-making levels of the aviation system. In the into the objectives of organizations, but in a supporting
past, limiting prevention endeavours to the flight deck, the role, to achieve the production objectives safely, i.e.
ATC workstation, the maintenance shop or any of the without harm to human life or damage to property.18
other human-system interfaces has proved to be successful Therefore, before discussing safe and unsafe organizations,
in making aviation the safest mode of massive transporta- it is essential to put safety into perspective and decide
tion. In the present and the future, such an approach may where it fits within the objectives of aviation organiza-
turn out to be of limited safety value and, perhaps, futile. tions. From an organizational perspective, safety should be
seen as a method of conserving all forms of resources,
including controiiing costs. Safety allows organizations to
pursue their production objectives with minimum damage
23 SAFE AND UNSAFE to equipment or injury to personnel. It assists management
ORGANIZATIONS in achieving this objective with the least risk.Ig There is an
element of risk in aviation that cannot be eliminated, but
2.3.1 Over time, researchers and academics studying it can be successfuily controfled through risk management
organizations have resorted to a metaphor to assist their programmes directed at correcting safety deficiencies
endeavours: they have compared organizations to living before an accident occurs. These programmes are an
organisms, notably the human being. Organizations are essential tool for decision-makers to formulate decisions
viewed like complex living structures, with brain, body, on risk and to contribute to safety whik pursuing the
personality and objectives. Like human beings, organiza- production goals of their organizations.20 Basic risk
tions struggle for survival within a constantly changing management concepts are included in the Accident Preven-
environmen~'~ Within organizational literature, it is a tion Manual (Doc9422) and are further discussed in 2.5.5.
".
basic premise that .. organizations think. Like individ-
uals, they exhibit a consciousness, a memory, an ability to
create and solve problems. Their thinking strongly affects Corporate Culture
ihe generation and elimination of hazards."17 In this
comparison, the managers and decision-makers become the 2.3.3 Corporate culture is as relevant to
brain; the hierarchies, departments and other permanent organizational performance as personaiity is to human
structures (including the workforce) become the body; and behaviour. On 4 March 1987, a CASA C-212-C crashed -
corporate culture becomes the personality. Traditional just inside the ,threshold of Runway 21R at Detroit
Human Factors endeavours have focused on the brain. Metropolitan Airport, Michigan. USA. killing 9 of the 19
body and personality of human kings and their inter- persons on board. The probable cause statement indicates
 Chaper 2. Human Facrars, management and organimtion

that the captain was unable to control the aeroplane while tion of the world. In that sense, culture is a collective
attempting to recover from an asymmeuic power condition mental programming which distinguishesone human group
at low speed following his intentional use of reverse thrust from another. Culture defines the values and predisposes
@eta mode) of propeller operation to descend and slow the attitudes, exerting a final influence on the behaviour of a
aeroplane rapidly on final approach for landing. This particular group. Norms are the most common arid accept-
procedure was suictly forbidden by both the aircraft flight able patterns of values, attitudes and behaviour for a
manual and company operating procedures. The investiga- group. Norms are enforced by expressing disapproval of
tion also disclosed that this was not the first time this wrongdoers; how strongly a culture sanctions those who
captain - by all other accounts an able and competent violate norms is an indication of the importance attached
-
airman had resorted to this procedure. Several questions to those norms. For yeus people have thought that
immediately arise: organizations were beyond the influence of culture and
were only influenced by the technologies they utilize or
If company procedures were clearly stated, why the tasks they pursue. Research has demonstrated,
were they not followed by this captain? however, that culture deeply influences organizational
behavio~r.~ If~an. ~organization
~ attempts to impart values
If use of beta mode in flight was scn'cuy forbidden
or behaviours which are in contrast with existing organ-
and this captain [frequently] ignored this instruc-
izationaUcorporate culture or which are perceived to be in
tion, what prevented other pilots who witnessed
contrast with corporate goals. achieving these values or
this captain ignoring that order from bringing the
behaviours will either take considerable time and effort or
fact to the attention of the company?
be impossible altogether. A corporate culture may also
If use of beta mode in flight was forbidden by the allow or prevent violations, since they take place in
Ilight manual, why was it available to flight crews? situations where the shared values of individuals and the
group favour cerrain behaviours or attitudes. In the
Why was this captain's disregard for company simplest terns, a group will meet whatever norms are
pmedures and che aircraft flight manual not exposed established for an organization and will do whatever it
before it was discovered following an accident? thinks or perceives management really wants.

Lastly, if the company knew about the flying habits 2.3.6 The explanation of the seemingly undisciplined
of this captain. would they -and could they - behaviour of the captain involved in the Detroit accident
have taken any action?" must be sought in the existence of a corporate culture
2.3.4 The Final Report of the Commission of which condoned such practices and in the absence of
Inquiry into the Air Ontario Crash at Dryden, Ontario, in norms which condemned them. This is best evidenced by
the silence surrounding this captain's observed deviations
its indepth discussion of how corporate culture played a
significant role in this accident. suggests an answer to from established procedures. An attitude of disregard of
these questions: organizational policies or regulatory standards involves
more than Human Factors related to the cockpit, since it
"... even in organizations with a smng commitment does not develop overnight. Fast, time-saving. "eficient"
to standardization ... informal subcultures frequently approaches -resorting to whatever means necessary to
tolerate or encourage practices which are at variance accomplish them - must undoubtedly have been an
with organizational policies or w l a t o r y standards... accepted norm in the operational subcul~reof the
Evidence of procedural variance is found in several organization. No disapproval can have been explicitly
reported pactices ...these suggest that the [corporate] expressed to observed msgressions and thus, over time,
culture may have allowed crews considerable leeway such behaviour became a collective mental programming.
in making decisions about whether to (ake-off with which fostered this and probably other risk-taking attitudes
surface eonlamination ... a practice which. in pursuing organizational objectives. Ultimately, based
unfonunately, was noi unequivocally proscribed by the upon experience obtained during the term of employment,
then current [civil aviation authority] regulations ..."." pilots came to perceive such attitudes and behaviours as
the standard management expected from them and they
The inevitable questions then arise: What is culture? Can acted accordingly.
decision-makers influence corporate culture? If so, what
can decision-makers do to influence it?
Safe and unsafe corporate cultures
2.35 Culture refers to beliefs and values which
an shared by all or almost all members of a p u p . 2.3.7 Culture, like pemnality, involves deep-seated
Culture shapes behaviour and structures a person's percep traits and it is extremely resistant to change. As with
 Human Factors Traininn Manual

personality traits, change can be accomplished, but slowly 2.3.9 On 19 October 1984, a Piper PA-3 1 Navajo on
and over prolonged periods of time. By identifying what a night IFR flight from Edmonton to Peace River crashed
constitutes a good safety-oriented corporate culture and its into high temin 20 miles southeast of High Prairie,
characteristics, managers can change and improve existing Alberta, Canada. Six passengers perished; the pilot and
corporate culture by setting examples which are consistent three other passengers survived. The investigation deter-
across the whole value system. A safety culture within an mined that the pilot descended in cloud to below the rnini-
organization can be regarded as a set of beliefs, norms, mum obstacle clearance altitude, a violation which event-
attitudes, roles and social and technical practices ually triggered the accident. However, a major objective of
concerned with minimizing exposure of employees, the Canadian Aviation Safety Board was "... to discover
managers, customers and members of the general public to the circumstances which influenced the pilot to deviate
conditions considered dangerous or hazardous.2S It is one from accepted safe operating practices ... Although the
which promotes among participants a shared attitude of final decision in an aircruy? cockpit rests with the captain,
concern for the consequences of their actions, an attitude that decision is ofien iqkenced by factors over which he
which would cover material consequences as well as the has no direct control ..." (italics added).
possible effects on
2.3.10 The Board then decided to investigate the
2.3.8 In general terms, the characteristics which company work environment In so doing, it found out that:
define a safe culture and which decision-makers should
observe when modelling corporate safety culture include "In early 1984, a lack of adequate communication
the following: between pilots and management was noted by the Air
Carrier Branch of Transport Canada-The company
senior management places strong emphasis on chief pilot was subsequently appraised of the problem
$
.
.**
safety as part of the strategy of controlling risks;
"Crews ... were expected to carry out the operation
decision-makers and operational personnel hold a
without further supervision and to adhere as closely as
realistic view of the short- and long-term hazards
involved in the organization's activities;
possible to the published schedule ...
some pilots
worked a six-week day and were expected at times to
carry pagers during their day off ..."
those in top positions do not use their influence to
force their views or to avoid criticism about safety "Some pilots reported that they sensed a subtle but
issues; significant pressure to undertake and complete flights
...
the chief pilot set an example of noncompliance
those in top positions implement measures to with prescribed weather limitations ..."
contain the consequences of identified safety
deficiencies; ...
"Pilots were encouraged by company management
to fileVFR, even when the weather might be marginal
...
those in top positions foster a climate in which
there is a positive attitude towards criticisms,
comments and feedback from lower levels of the
arrivals :.,
VFR flights took less time, fuel and facilitated
pilots admitted cancelling IFR flight plans
while' still in IMC .:. they often descended below
organization; prescribed weather minima in an attempt to land ..."
- there is an awareness of the - importance of
communicating relevant safety information at all
"...personnel were apprehensiveabout doing anything
M ~ c hmanagement would consider as not in the best
levets af the organization (both within it and with interests of the company. Confrontation between pilots
outside entities); - - ' . -> -;>-, .
t ~
and management were reported as frequent and often
led to the resignation of the employee to avoid
there is promotion of appropriate, realistic and ...
imminent dismissal Company management did not
workable rules relating to hazards, to safely and to consider the exchanges were of a confrontational
potential sources of damage. with such rules being nature ..."
supported and cndorsed throughout the
organization: and The Rcport concludes:

* personnel are well trained and well educated and "The dcscent procedure used by the pilot was similar
fully understand the consequences of unsde acts. to that used durin~his initial route check into Hizh
 Chapter 2. H u m Factors, management and organirorion

Prairie six weeks earlier with a senior company pilot. and yet fail to secure over-all organizational safety and
While the pilot knew that this action was contrary to effectiveness because of inattention IO the way those
regulations, he believed it was safe." (italics added). individual components interact when integrated. If the
suucture is randomly designed, organizations may collapse
This shortcut: when operating under pressure (very much in the same
way that incorrectly designed displays or controls will
"... would have allowed the pilot IO regain his induce human error and provoke safety breakdowns when
schedule. By completing the assigned schedule, he under operational pressures).
expected to avoid further discord with management,
thus prolonging his employment with the company.'" 2.3.14 There are several components decision-
makers should consider when defining the structure of
2.3.11 These excerpts from the relevant section of organizations:
the official report can be easily seen to contrast with the
characteristics of safe corporate culture listed in 2.3.8. Complexity. This includes the required number of
They also provide guidance regarding areas of remedial managerial levels, the required division of lahour
action decision-makers can act upon to influence and and job specialization (departments and sections).
change corporate culture. the degree to which operational personnel and
facilities must be geographically dispersed or
The structure of organizations centralized and the extent to which mechanisms
which facilitate communication between levels
2.3.12 The design of the organirorion. i.e. its have been designed into the organization.
permanent smctures and hierarchies, relates to
organizational performance similar to the way body Srandardization. which is related to the complexity
constitution relates to human performance. The role of the of the job and the level of professi-onalism of
organization and its structure is to facilitate depatunental employees. In general terms, the simpler the job
interfaces, connecting and joining depamnents together.% (eg. assembly-line manufacturing), the greater the
On 18 November 1987, discarded smoker's material benefits of standardization; the more complex the
probably set fire to highly inflammable rubbish that had job (e.g. management tasks requiring high levels of
been allowed to accumulate in the running tracks of an professionalism), the lower the level of
escalator at the King's Cross underground station in standardization desirable. Aviation operational
London. England. Eventually a flash-over occurred and 31 activities are, nevertheless, highly proceduralized.
people were killed and many others seriously injured. The even when the highest levels of professionalism are
Report of the Investigation into the King's Cross under- involved. Complex tasks, such as flight deck
ground fire identified that: management, require both high levels of
professionalism and standardization.
"... running tracks were not regularly cleaned. panly
due to organizational changes which b l u d main- Centraliwtion of the formal decision-making
knance and cleaning responsibilities ... Safety process. This depends on the stability and
specialists scattered over three directorates focused on predictability of the surrounding environment:
occupational and operational safety, but passenger unpredictable environments require low central-
...
safety was neglected Inadequate fire and emergency ization to rapidly cope with unexpected changes
training were given to staff ... No evacuation plans and vice versa
existed for King's Cross underground scation ...Trains
do not have a public address system and there were no Adaptabilify to the envimnmen?'. This is the key
public telephones at King's Crws station."29 to success and ultimately to the survival of
organizations. Environmental uncertainty is the
2.3.13 In fact, practices in defining and building the most powerful of all the system factors affecting
structure of organizations had come under the scrutiny of organizational design. In highly uncertain
the research community well before this accident There environments, organizations should be flexible and
were compelling reasons for this research. Investigation of capable of rapid response to change. In highly
well-publicized, major catastrophes in socimechnical stable environments, it is desirable to design
systems clearly suggested that it is quite possible to stability and conuol for maximum effectiveness?'
correctly design individual components of the organiza-
tional structure (departments, sections, etc.) so that they 2.3.15 All these organizational components bear an
can achieve their assigned objectives safely and efficiently. impact on human performance, which in Nm affects the
 Human Factors Training Manual

way organizations achieve their objectives, including excessively on external sources to discharge them, i.e.
safety. The relevance of the organizational structure to the regulatory authorities. Regulations serve a purpose in that
safety deficiencies observed in the King's Cross under- certain safety procedures or equipment would never be
ground fire is apparent. Organizations with unnecessarily adopted without them. However, regulations usually repre-
complex structures (too many managerial levels or exces- sent minimum levels of safety compliance; furthermore, if
sive departmentalization) foster dilution of responsibilities regulations are formally applied but the sense of them is
and lack of accountability. They also tend to make inter- lost, the original reason for introducing them is quickly
departmental communications more difficult. Sluggish forgotten. It follows that legislation is, at best, a limited
interdepartmental communications, especially regarding way of affecting human behaviour. Regulations cannot
safety relevant infonnation, reduce safety margins and cover all risks involved in aviation since each accident is
invite safety breakdowns, as the following accident report unique; hence the importance of risk management pro-
further illustrates. .grammes such as those discussed in 2.55. Organizations
leaning heavily on regulations to pursue safety usually do
2.3.16 On 17 February 1991, a DC-9 series 10cargo not include a risk management structure. The danger of
aeroplane crashed while taking off from Cleveland- excessive reliance on regulations in lieu of properly
Hopkins international Airport, Ohio. USA. Both pilots organized risk management structures is best illustrated by
were fatally injured and the aircraft was destroyed. The the opening statement in the findings of most accident
crew had failed to detect and remove ice contamination reports: "... the airplane was certifcated, equipped and
from the wings. During the investigation, the NTSB deter- maintained in accordance with existing regulations and
mined that several organizations within the aviation system approved procedures ... the crew were certificated,
had been aware for years of the propensity of this par- qualified and experienced for their duties ..." Yet the
ticular series of aircraft for loss of control caused by a accident occurred.
minute amount of wing contamination. The manufacturer
had issued numerous articles on the subject, and three 2.3.18 On Monday, 14 November 1988, an Embraer
previous accidents on similar types had been attributed to 110 Bandeirante aircraft on a scheduled passenger flight
the same cause. However, the report indicates that, crashed in the vicinity of the Ilmajoki Airport in Finland.
because of the absence of a communications structure: The Finnish Board of Inquiry came to the conclusion that
the immediate cause of the accident was the [flight crew]
"... there was no system to ensure that the critical decision to continue the NDB approach below the mini-
information reaches all line pilots of these airplanes ... mum descent altitude, without the required visual contact.
the most critical cue that was not provided to the crew The Board also found as a contributing factor the perfonn-
on the night of the accident was information that was ance pressures that originated from the airline's poor
apparently readily available and known throughout safety culture. In pursuing the organizational issues which
much of the aviation community, that being the might have contributed to the accident, the investigation
sensitivity and vulnerability of the DC-9 series 10 revealed:
aircraft to minute amounts of ice contamination on the
upper surfaces of the plane's wings." "..,serious deficiencies in the operation of the airline
as well as in the activities of the airport operator and
The report concludes: the authorities. Also the legislation was found to be
"The National Transportation Safety Board determines out of date and insufficient, especially as far as
that the probable cause of this accident was the failure commercial flight operations are concerned."
of the flight crew to detect and remove ice contamina-
tion on the airplane's wings, which was largely a The report is an outstanding example of systemic
result of a tack of appropriate response by the Federal approaches to accident investigation and as such, it is
Aviation Administration, Douglas Aircraft Company extremely rich in prevention jessons. The discussion about
arid Ryan International Airlines to the known critical regulatory compliance is particularly applicable to this
effect that a minute amount of contamination has on section. The report first discusses the very important
the stall characteristics of the DC-9series 10 airplane contribution of regulatory compliance ,to safety in the
9.32 following terms: - -1, . .
*..

"... Flight safety is also affected by the effectiveness

Regulatory compiiice of the supervision carried out by the authorities and by
what measures are undertaken in response to what is
2.3.17 Whcn internal responsibilities regarding uncovered in the supervision. If the authorities cannot
safety are not clearly defined, organizations tend to rely or will not intervene when safety regulations have
 Chapter 2. Human Factors, management and organiurtion

been violated or if these violations are not even " ... The Chairman of London Regional Transport ...
noticed due to ineffective supervision, the violations told me that whereas financial matters were strictly
will probably begin to be regarded as a minor matter ...
monitored, safety was not smoke detectors were not
installed since the expense was not [felt to be]
justified. water fog equipment had been installed in
Having established the importance of regulatory com- 1948 and could not be used because of rust problems
pliance, the report then goes on to consider an important ... In my view, he was mistaken as to his
shortcoming in regulations - formal compliance - as responsibility."
follows:
The dilemma of allocation of resources may be further
"...If the authorities are unable to assess the substan- complicated by local perceptions of what constitutes a risk
tive conditions for operating an airline, or they do not and by cultural considerations regarding the value safety
have sufficient authority to do so, the supervision and has in the eyes of a society. It has been advanced that the
the resulting measures must be canied out purely on number of accidents occurring in one country largely
formal grounds. Instead of broad assessment, this reflects the accident rate its population is ready to tolerate;
merely leads to the judging of violations committed by in terms of safety, investment is made only as is necessary
individuals. and it is not possible to come to grips with to mainlain this rate. The tolerance rate and the ensuing
fundamental factors in h e organization and operative allocation of resources to pursue safety vary considerably
environment that endanger safety ..." across the community.

The report's conclusion on the scope and reach of regula-

tory compliance as a tool in pursuing safety, as it applies Accidents in complex
not only to the accident under investigation but to the technological systems
aviation system as a whole. leaves no room for misunder-
standing: 2.4.2 In concluding this comparison between human
"... in the course of the investigation, no particular beings and organizations, we will now consider the brain.
or management. In order to understand how decision-
reason arose to question in general the sufficient
competence of the pilots or other operational makers' actions or inactions influence safety, it is
personnel. What is primarily at issue is the company's necessary to intmduce a contemporary view on accident
poor safety culture ... Because of this. measures that causation?' As a complex sociotechnical system, aviation
are directed by the National Board of Aviation at the requires the precise co-ordination of a large number of
licenses and ratings of individual pilots would scarcely human and mechanical elements for its functioning. It also
affect the safety of the company's flight operations possesses elaborate safety defences. Accidents in such a
unless. at the same time. one can ensure that the system are the p d u c t of the conjunction of a number of
company management adopts the proper attitude and enabling factors, each one necessary but in itself not
has sufficient qualifications for caqing out its sufficient to breach system defences. Because of constant
function^."'^ technological progress, major equipment failures or
operational personnel errors are seldom the mot cause of
breakdowns in system safety defences. Instead, these
2.4 ALLOCATION O F RESOURCES breakdowns are the consequence of human decision-
making failures which occur primarily within managerial
2.4.1 Organizations in sociotechnical systems have sectors.
to allocate resources to two distinct objectives: production
and safety. In the long term, these are clearly compatible 2.4.3 Depending upon the immediacy of their conse-
goals: but given that resources are finite, there are likely quences, failures can be viewed as acfivefailures, which
to be many occasions when there will be short-tenn are errors and violations having an immediate adverse
conflicts of interest Resources allocated to the pursuit of effect, generally associated with the operational personnel
production (Figure 2-1) could diminish those available to (pilot, controller, mechanic, etc.): or latent failures. which
safety and vice versaY. When facing this dilemma, are decisions or actions, the &sequences of which may
organizations with inadequate smctures may emphasize remain dormant for a long time. Latent failures become
production management over safety or risk management. evident when triggered by active failures, technical prob-
Although a perfectly understandable reaction. it is ill- lems or adverse system conditions, breaking through sys-
advised and conuibutes to additional safety deficiencies. tem defences. Latent failures are present in the system
The King's Cross underground fire investigation report well before an accident and are most likely bred by
states: decision-makers. regulators and other people far removed
 1-2-12 Human Factors Training Manual

A delicate and complex balancing act

* Available money
Equlpmentlplant
Personnellexpertise

DECISIONMAKERS

* Successindicated negatively * Success indicated positively

Traditional measures noisy and deceptive * Readily and reliabiygauged
indlrec! and discontinuous * Direct and continuous
*M e reinforcement value of it& * Obviously reinforcing
* Only achieves high salience after * Salient and imperative
accident or near-miss

Sourcsr James Reason. 1990. Human E m Cambridge University Press.

Figure 2-1. A summary of some of the factors that

contribute to fallible, high-level decision-making

in time and space from the event Those at the human- their primary origin in errors made by the decision-makers.
machine interface, the operational personnel, are the Even in the best run organizations, a number of important
inheritors of defects in the system, such as those created decisions will have a downside by virtue of being made by
by poor design, conflicting goats, defective organizations humans who are subject to human biases and limitations
and bad management decisions. They simply create the as well as to contextual constraints. Since Some of these
conditions under which the latent failures can reveal unsafe decisions cannot be prevented, steps must be taken
themselves. Safety efforts should be directed at discover- to detect them and to reduce their adverse consequences.
ing and solving these latent failures rather than by Fallible decisions in line management may take the foml
localized efforts to minimize active failures. Active of inadequate procedures, poor scheduling or neglect of
failures are only the proverbial tip of the iceberg. recognizable hazards. They may lead to inadequate skills,
inappropriate rules or poor knowledge or they may be
2.4.4 The human contributionsto accidents ace illus- revealed by podr planning or workmanship. Fallible
trated in Figures 2-2 and 2-3. Most latent failures have decisions may also be caused by a lack of resources.
Chapter 2. H u m Factors, management and organizorion

2.4.5 The response of management to safety inform- tion airport while the crew was attempting to cany out a
ation is vital, since safety cannot be enhanced unless missed approach procedure in IMC. The aircraft was
corrective action is timely and effective. This response destroyed by the impact and a post-crash fire. All seven
may vary from denial actions, by which "offenders" are occupanrs were fatally injured in the crash." Analysis of
dismissed or the validity of their observations challenged; the performance of the flight crew suggested lapses in the
to repair actions. in which "offenders" are disciplined or application of technical and psychomotor skills. It also
relocated and dangerous items of equipment modified to identified breakdowns in flight deck activities and co-
prevent specific recurrence of an observed failure; to ordination of tasks. These are the active failures which,
reform actions. in which the problem is acknowledged and combined with adverse weather conditions, triggered the
global action taken, leading to an indepth reappraisal and accident. The investigating authority, however, decided to
eventual refonn of the system as a whole?6 These actions broaden the scope of the investigation, thus unveiling
relate to the three-level response discussed in 1.10: some of the latent failures which set the stage for this
accident:
2.4.6 On 26 September 1989. a Fairchild M e m 111
on a scheduled flight from Vancouver to T e r n . British Despite its history, the company had been granted
Columbia, Canada, with two pilots and five passengers on a waiver to operate large passenger aircraft under
board crashed one quarter mile to the west of the destina- a less stringent operating standard. The regulatory

Active and htent failures

.. . ~ ,:,

Sourn: James Reason. 1990. Human E m Cambridge University Press.

F i r e 2-2. Human contribution to accidents in complex systems

1-2-14 Human Factors Training Manual

Organisation TasWenvironment Individuals Failed

defences

Source: James Reason. Tollective Mistakes in Aviation: 'The Last Great Frontier"', Right Deck, Summer 1992, Issue 4.
1
Figure 23. The basic elements of an organizational accident

authority had authorized the company and its The regulatory authocity definitions and descrip-
pilots, through the mechanism of a waiver, to apply tions detailing the visual references required to
the standards of less stringent operating carry out a circling approach were ambiguous and
requirements (i.e. applicable to small aircraft under open to misinterpretation.
12 500 pounds gross weight) rather than the more
restrictive standards applicable to large airctaft 2.4.7 Discussing the accident with commendable
above 12 500 pounds gross weight. This implied introspection, the regulatory authority correctly identifies
reduced training requirements and less frequent the reform actions required by concluding in its periodic
proficiency checking. safety newsletteer: "...
in the context of system safety, one
might argue that organizational deficiencies related to
The company involved had a questionable record
training, standards and risk management led two relatively
with regard to regulatory compliance. In the two
unseasoned pilots, typical products of the flight training
years previous to the accident, govemment
system in this country, to commit a variety of trans-
regulators had issued three suspensions or
gressions that, clearly, were within the means of their
cince1lations of the company's operating certifi-
company and the govemment to prevent.'J8
cate. The certificate had been reinstated without
on-site inspection by the regulatory authority to
2.4.8 On the night of 2 Decemher 1984, a gas teak
ensure that uvrslive had been
from a pesticide plant devastated the Indian city of Bhopal
the company.
in the worst industrial disaster on record. More than 2 500
The conlpany did not employ standardized people were killed, and more than 200 000 were injured.
procedures. Interviews with company pilots The immediate cause of the leak was an influx of water
indicated that thcrc was often confusion among into a methyl isocyanate (MIC) stonge tank. The leak was
pilots a b u t what operational dircctivcs were in the rcsult of "botched mainiznmcc. operalor error.
placc. improvised bypass pipes. failed ssfbiy systcms.
Chapter 2. Human Facrors, mruiageotenf and organizarion

incompetent management. drought agricultural economics possess a structure which has been designed with
and bad government decision^"?^ The analysis of the a suitable degree of complexity. standardized
Bhopal disaster is a regrettable textbook example of the procedures and centralized decision-making which
concepts advanced by this chapter: is consistent with the objectives of the organization
and the characteristics of the surrounding
"Bhopal's plant rigid organizational structure ...
was environment;
one of the three primary causes of the accident the...
Bhopal plant was plagued by labour relations and rely on internal responsibility rather than regulatory
internal management disputes ...for a period of fifteen compliance to achieve safety objectives; and
years prior to the accident, the plant had been run by
eight different managers ... many of them came from respond to observed safety deficiencies with long-
different backgrounds, with little or no relevant term measures in response to latent failures as well
experience." as short-term, localized actions in response to
active failures.
'The discontinuity of the plant management, its
authoritative and sometimes manipulative managerial
style and the non-adaptive and unresponsive organiza-
tional system, collectively contributed to the accident. 25 MANAGEMENT'S
The latter element, i.e., organizational rigidity. was CONTRIBUTION TO SAFETY
primarily responsible for not responding and taking the
necessary and wmctivc course of actions to deal with 2.5.1 In 1986, a major aircraft manufacturer
the five reported major accidents occurring at the plant completed a world-wide airline operators survey with a
between 1981 and 1984 ... crisis often occur because view to helping control what was dubbed "crew-caused
warning signals were not attended to ..." accidents". The ensuing report became widely publicized
and a milestone within the airline training community
'The Bhopal plant's organizational culture should also since it provided valuable information applicable to flight
be held responsible for not heeding many operational crew training?' Although, by its nature, the survey
warnings regarding safety problems ... Bhopal's focused narrowly on flight crews, the researchers were
monolithic organizational culture, as the plant's confronted with evidence which suggested that there was
operational milieu. only fostered the centralization of more than just crew error to safe airline operations.
decision-making by rules and regulations or by
standardization and hierarchy, both of which required
high control and surveillance ..." 2.5.2 The repon indicates that one characteristic of
the airlines identified as safer was management emphasis
"Many key personnel were being released for on safety. These airlines:
independent operation without having gained sufficient
understanding of safe operating procedures ...'*' ...
" characterize safety as beginning at the top of the
organization with a strong emphasis on safety and this
perm&tes the entire operation. Flight operations and
The traits of a safe organization training managers recognize their responsibility to
flight safety and are dedicated to creating and
2.4.9 What are, then. the traits of a safe ...
enforcing safety-oriented policies There is a method
organization? In general terms, safe organizations: of getting information to the flight crews expeditiously
and a policy that encourages confidential feedback
pursue safety as one of the objectives of the ...
from pilots to management This management ani-
organization and regard safety as a major tude, while somewhat difficult to describe, is a
contributor in achieving production goals; dynamic force that sets the stage for standardization
and discipline in the cockpit brought about and
have developed appropriate risk management reinforced by a training programme oriented to safety
structures, which allow for an appropriate balance issues."
between production management and risk
management; 2.5.3 Three years later, in an address given before
the Aero Club of Washington, D.C., on 28 March 1989, an
enjoy an open, good and healthy safety corporate internationally recognized advocate of safety through
cultute: management assert&
 H u m Factors Training Manual

"Management attitudes can be wanslated into concrete reduce the safety standards below a minimum standard
action in many ways. Most obvious are the funda- which is defined beforehand and thus becomes one of the
mentals: the provision of well-equipped, well- objectives of the organization.&
maintained, standardized cockpits; the careful
development and implementation of, and rigid 2.5.6 When contemplating trade-offs behveen safety
adherence to, standardized operating procedures: and and production, management should evaluate the financial
a thorough training and checking program that ensures consequences of the decision. Since this trade-off involves
that the individual pilots have the requisite skills to risk, management must consider the cost involved in
operate the aircraft safely. These actions build the accepting such risk, i.e. how much will it cost the
foundations upon which everything else rests.'J2 organimtion to hove an accident. While there are insured
wsts (those covered by paying premium to insurance
The crash of a De Havilland DHC-6-300 Twin Otter on 28 companies) which can be recovered, there are also
October 1989 into high terrain, near HalawaBay, Molokai. uninsured costs which cannot, and they may be generally
Hawaii, while attempting to continue a VFR flight into double or triple the insured costs. Typical uninsured costs
deteriorating VMC provides an instructive example of of an accident include:
"management failure". The aircraft accident report includes
the following conclusion: insurance deductibles
lost time and overtime
"In summary, the Safety Board concludes that [the cost of the investigation
company's] managemcnt provided inadequate super- cost of hiring and training replacements
vision of its personnel, training and flight operations. loss of productivity of injured personnel
The numerous deficiencies evident during the investi- cost of restoration of order
gation relative to the IFR training of the pilots. the loss of use of equipment
reduced ground school training, the lack of CRM cost of rental or lease of replacement equipment
training, the captain's known behavioural traits, and increased operating costs on remaining equipment
the policy of not using the weather radar systems loss of spares or specialized quipment
installed on the airplanes, were the responsibility of fines and citations
the airline's management to c o m t . The failure of the legal fees resulting from the accident
management personnel to correct these deficiencies increased insurance premiums
contributed to the events that led to chis a~cident'~' liability claims in excess of insurance
loss of business and damage to reputation
2.5.4 The quotations in the previous paragraphs set cost of corrective action
the underlying rationale for this section and demonstrate
the critical contribution of management to sociotechnical 2.5.7 Those in the best position to effect accident
systems safety, which is the objective of this chapter. prevention by eliminating unacceptable risks are those who
Before addressing what management can do, however, it can intmduce changes in the organization, its structure.
is pertinent to discuss why management should act on corporate culture, policics and procedures, etc. No one is
safety. in a better position to produce these changes than
management Therefore, the economics of aviation safety
and ihe ability lo produce systemic and effective change
W h y management should underlie the 'justification for management to act on
take an active stance on safety safetYPS

2.5.5 Aside from the moral considerations regarding

potential injury or loss of human life and preservation of What management can do to take
prbperty, managemcnt should act because of the an active stance on safety
economics of aviation safety. Section 2 discusses the
dilemma of dividing finite resources between production 2.5.8 In a document such ;IS this manual which is
and safety goals. Although seemingly incompatible in the directed to such a wide audience in different States. in
short-term. these goals are perfectly compatible when different sizes of organizations and, most importantly, in
considered from a long-term perspective. It is a recognized different st~ucturesof organizations. it is impossible to be 1
generalization that lhe salest organizations are often the prescriptive about managcmenr actions in relation to
most efficient. There are inevitable trade-offs between safety. There are, nonetheless. a few genera! principles
safety and finance. However. safe organizations do not which apply anywhere: these are discussed in the balance
allow these trade-offs or apparcnt incompatibilities to of this section.
 Chapter 2. Human Factors, management and orpiration

2.5.9 Allocation of resources. From the simplest of actions to assist operational p e r s o ~ e in

l achieving their
perspectives. management's most obvious contribution to tasks in a manner which is logical, efficient and, most
safety is in the allocation of adequate and necessary importantly, error-resistant Rocedurcs are not produced in
resources 10 safely achieve the production goals of the a vacuum nor are they inherent in the equipment; they are
organization. The issues underlying this allocation are based on a broad concept of operation. There is a link
discussed in 2.3.18 as well as in the opening paragraphs of between procedures and philosophy, which Wiener and
this section. In practical terms, the first quotation in 3.3 Degani have called T h e four Ps of operations":
can be viewed as a listing of the "most wanted" items Philosophy, Policies, Procedures and PracticesP6
management should pursue when deciding on the alloca-
tion of resources. 2.5.12 These researches contend thaL by establish-
ing aphilosophy of operations, management states how it
2.5.10 Safety programmes and safety f d b a c k wants the organization to function. Such philosophy can
syslems. There are other activities involving allocation of only be established by the highest corporate level. From
resources which are not as obvious but are nevertheless philosophy, policies can be developed. Policies are broad
equally important. These activities are discussed indepth specifications of the manner in which management expects
in the Accident Prevention Manual (Doc 9422) and are tasks to be accomplished -training. flying, maintenance,
mentioned briefly in this section. The most important is exercise of authority, personal conduct, etc. Policies are
the implementation, continued operation and visible usually dictated by line management. The procedures,
suppon of a company safety programme. Such normally developed by supervisors, determine how tasks
programmes should include not only flight operations will be accomplished. The procedures must be designed to
safety. but also maintenance safety, ramp safety, etc. The be consistent with the policies, which must be consistent
programme should be administered by an independent with the over-all guiding philosophy. Lastly, management
company safety officer who reports directly to the highest must effect the quality control to make sure that practices
level of corporate management. Company safety officers in the operational environment do not deviate from written
and their staff must be quality control managers. looking procedures. Any attempt to shortcut this process may well
for corporate safety deficiencies rather than pointing produce inconsistent procedures, which will breed doubts
fingers at individual errors. To discharge their responsi- among the operational personnel about the preferred
bilities, safety officers need information which may come behaviour management expects from them to accomplish
from several sources: intemal safety audits which identify their task (Figure 2-4).
potential safety hazards, intemal incident reporting
systems, internal investigation of critical incidents as well
as performance monitoring programmes - both for the 2.5.13 Philosophies. policies and procedures must be
developed with due consideration for the operational
company and the industry. The possible feedback loops of
an internal audit system and their relative values in terms environment in which they will be used. Incompatibility of
of prevention are discussed in 2.5.14. An often-overlcmked the procedures with the operational environment can lead
source of information is the participation in industry-wide to the informal adoption of unsafe operating practices.
safety fora. such as conferences and workshops organized External activities, type of operation and the layout of the
by international associations. Armed with the information cockpit or workstation are factors to be considered when
thus obtained, the safety officer may then implement a evaluating the operational environment in which SOPs will
programme of disseminating critical safety information to be used. Feedback from operational situations, through the
all personnel. The stage for setting a safety-oriented observed practices of or reports from operational per-
organizations! climate is thus set. sonnel, is essential to guarantee that the bridge between
the Ps and the operational environment remains intact.
2.5.1 1 Standard operating procedures. There is an
even more subtle activity that management can undertake 2.5.14 .The example of the Ground Proximity
to contribute to safety. The development of, implemen- waming~Sys& -(GPWS) Policy. as instituted by one
tation of and adherence to standardized operating operatof17, illustrates this point:
. .. .. . ,
procedures (SOPs) have recently been recognized as a ~

major contribution by management to safety. Failure to Philosoply: it is a corporate goal to be a safe and
conform to sound SOPs has indeed been linked to secure airline, as stated in the corporate mission
numerous accidents and incidents. There are Human and goals.
Factors considerationsrelated to SOPs which concern both
the underlying philosophy and the design of such proce- Policy: in the event of a full, or partial. "Pull-up"
dures. Procedures are specifications for conducting or other hard (red) warning. the following action
predetermined actions: they specify a progression of must be taken promptly:
1-2-18 Human Factors Training Manual

Figure 24. The four Ps

 Chapter 2. Human Factors, management and organirntion

a) Below MSA (Minimum Safe Altitude) Figure 2-5 depicts three possible feedback loopsP8 Loop
I feeds back a company's accident statistics. In most
Announce "PULLUP Go-Amund" cases, the information supplied is too late for control,
Immediately complete the pull-up manoeuvre in because the events that safety management seeks to
all circumstances. eliminate have already occurred. Loop 2 carries inform-
ation about unsafe acts observed in daily operations.
b) At and Above MSA However. unsafe acts represent only the tip of the iceberg
since many actions that cause accidents cannot be recog-
Immediately assess aircraftposition,altitude and nized as such in advance. This information is usually
veliical speed. If pmximity to MSA is in doubf, disseminated at the lower levels of the organization, i.e.
take action as in a) above. operational personnel and supervisors. Loop 3 pmvides the
greatest opportunity for proactive control of safety.
Procedure: GPWS pull-up manoeuvre is described
in fleet-specific manuals. Describe the call-outs by 2.5.17 Risk management. The feedback loops, and
the handling pilot and the non-handling pilot - loop 3 in panicular, allow managers to assess the level of
procedures at and below MSA and procedures risks involved in the operations and to determine logical
above MSA: define MSA during climb and descent approaches when deciding to act upon them. The concept
in case of ainbiguities and include additional of risk management is discussed in the Accident Preven-
operational information deemed appropriate for ik tion Manual and is inuoduced in this chapter in 2.5.10.
crews to observe the GPWS Policy. The basic theoiy is based on the following assumptions:49

Practices: do flight crews observe the policy and There is always risk. Some risks can be accepted.
follow the procedure in operational conditions? some -but not all -can be eliminated and some
can be reduced to the point where they are
2.5.15 In the GPWS example discussed above, the acceptable.
operator's original policy mandated an immediate pull-up
upon receipt of any GPWS warning, regardless of altitude Decisions on risk are managerial decisions: hence
and position of the aircraft Operational feedback obtained the term "risk management".
through the operator's internal safety information system,
however, indicated that during the first calendar yearafter Risk management decisions follow a logical
this policy was implemented, GPWS alerts had not been pattern.
followed by a pull-up in 60% of occasions. This was due
to a variety of reasons, including false and nuisance 25.18 The first step in the risk management pmcess
warnings. Of particular concern was the fact that pull-ups is to make an accurate assessmeat of hazards (hazard
had not been initiated on 20% of occasions when the assessment): otherwise, decisions will be made on the
warning had been genuine. An obvious discrepancy basis of inaccurate information. One way to assess hazards !
-
between the three first Ps and the last one Practices - is :lo subjectively evaluale them based on probability of ,

was evident. The safety services of the operatordetcr- occut~ence.severity when they occur and exposure to i
mined that the reason for thii discrepancy between
. . . . philo- them. The second step i s to make an assessment of the 1
sophy, policy, procedures and practice centred a m e d the risk involved (risk assessment) and determine whether the
unreliability of the technology which resulted in false and organization is prepared to accept that risk. Again, the
nuisance warnings. In some cases,warnings had been trig- crucial points are the accuracy of the information about
gered at 37 000 ft flying in cruise, immediaiely after take- the nature of the hazard and the willingness to use this
off, when there were no obstacles in the flight path or in information. The third step involves finding those hazards
holding patterns; :withother airc&t '1 000 A below 'ihe
host GPw's. This idback.&& and ik'anali$,&,& &-
operator to review its GPWS policyhd aniendit"i&(har
that can be eliminated (hazard elimimrion) and eliminat-
ing them I f none of the identified hazards can be
eliminated, then the fourlh'dtep i s t o look for the hazards
!i
. , :

included in 25.14;Giiththe immedia that .canbereduced (Gwrdred&tion). The objective is to

compliance with thepoiicy on 3 1 &c ,,,=
auce .expos&L',>o,.;'a~.'particularh&:
:.... :
thi
drobability that i t k l l occk, or'&luce its severity when:
2.5.16 Internal feedback and trend-monitoring it does occur. In some cases, the risk can be reduced by
systems. The previous paragraph illusmtes the impottana developing means for safely coping with the hazard.
of the feedback from the "front end". that is. fmm day-tw
i
I
day operations. so that management can effect the conml 2:5.19 It must be kept in mind that judging accept- i
of the operations that policies and procedures suppon able risk is a subjective. social and legal activity that will
 1-2-20 Human Factors Training Manual

LINE
MANAGEMENT * UNSAFE -
ACTS
DEFICIENCIES
-
Local chedts
on adequacy
of efish'ng
LOOP 2 +&fences-
Loop 1

Sourc8:adapted from James Reason. 1990. Human Emor. Cambridge University Press.

Figure 2-5. Internal feedback and trend-monitoring systems

vary among different cultures and societies and even to the goals of the organization, a systems approach to risk
among organizations within a single culture or society. It management must be followed. Such an approach, in
follows, according to this line of reasoning, that safety is which all aspects of the organization's goals and available
judged nor measured If. based on an accurate assessment resources are analysed, offers the best option for ensuring
of the hazards, the risks are judged to remain high aud that recommendations concerning risk management are
unacceptable and. after serious consideration to hazard realistic and complementary to the purposes of the
elimination or reduction, the total risk remains unaccept- organization.s0
able, then the obvious decision is to cancel the operation
(short term) or to modify the system to bring risks to an
25.21 A loop is thus closed. This section presents
acceptable level (longer term). There is room for short-
the opinions of the prevention, research and training
term change around loops 1 and 2. but the long-term
communities regarding what management can do to contri-
changes lie around loop 3 where unsafe organizational
bute to safety. 'hey complement the background and justi-
shuctum can be modified and unsafe corporate cultures
fication pmvided by the first two sections in this chapter.
changed. The importance of this risk management process
There is growing consensus that management must play an
is that it allows management to clearly see che results of
active role in achieving aviation system safety. There is
action or inaction. Figure 2-6 illustrates the conventional
also consensus on the need for change and progress, with
risk management logic.
solid evidence stmngly supporting new approaches to the
25.20 In large organizations such as airlines. the relationship between management, organizations and
costs associated with loss of human life and physical safety. The case for dealing with management factors and
resources dictate that risk management is essential. In organizational accidents seems to be beyond reasonable
order to produce recommendations that do not sun counter challenge.
Chapter 2. Human Factors, management and organimtwn 1-2-21

RlSK MANAGEMENT LOGIC

WHAT ARE T H E H A Z A R D S
I N T H I S OPERATION?

I
I
WHAT I S T H E HOW SEVERE WHAT I S T H E
PROBABILITY . WILL THE EXPOSURE
OF AN ACCIDENT B E 7 TO THAT
ACCIDENT7 ACCIDENT?

WHAT I S T H E
L E V E L OF RISK7

-I
I S THIS L E V E L
OF R l S K
ACCEPTABLE7

I
I 1
YES N0

I I
CONTINUE CAN R l S K B E
OPERATION ELIMINATED?

YES
? NO

I I
TAKE ACTION CAN R l S K BE
REDUCED?

I
YES N0

I I I
TAKE ACTION CANCEL
OPERATION I

Source: Richard H. Wood 1991. Avlalton Safely ProgR1mS - A Management Handbwk IAP Inmrporated,
Casper, Wyom~ng.USA

Figure 2-6. Risk management logic

 Chapter 3

HUMAN FACTORS ISSUES IN THE DEVELOPMENT AND

IMPLEMENTATION OF COMMUNICATIONS, NAVIGATION
AND SURVEILLANCEIAIR TRAFFIC MANAGEMENT
(CNSIATM) SYSTEMS

3.1 INTRODUCTION is essential to take into account the human element

during the design phase so that the resulting system
capitalizes upon the relative strengths of humans
Historical background and computer-based technology. This approach is
referred to as a "human-centred" automation.
3.1.1 The Tenth Air Navigation Conference
(Montreal, 5-20 September 1991) "recognized the impor- Flight decWATS integration. ICAO CNSIATM
tance of Human Factors in the design and transition of systems will provide for a high level of integration
future ATC systems". It also "noted that automation was between aircraft and the air traffic control system.
considered to offer great potential in reducing human error". This will bring new and different challenges. The
It further recommended that "work conducted by ICAO in various components of the system will interact in
the field of Human Factors pursuant to ICAO Assembly new ways, and new means of communication
Resolution A26-9 include, inter alia, studies related to the between pilots and air traffic controllers will be
use and transition to future CNSIATM systems". . available. A dedicated systems approach must be
adopted to address the issues associated with this
3.1.2 Following the recommendation of the Confer- integration (including certification issues) and to
ence, the ICAO Air Navigation Commission agreed that the ensure that the system as a whole is "user-friendly".
plan of action of the Flight Safety and Human Factors
Programme would be revised to include work on Human Human performance in future ATS. The human
Factors considerations in future aviation systems with an element is the key to the successful implementation
emphasis on CNSIATM-related human-machine interface of the ICAO CNSIATM concept. A broad base of
aspects. scientific knowledge of human performance in
complex systems is available and research contin-
3.1.3 Based on the decision of the Commission, the ues to provide more. Additional research is still
Secretariat contacted experts from selected States and inter- needed regarding the influence of organizational
national organizations and reviewed recent and ongoing and management factors on individual and team
studies to identify Human Factors issues of relevance to performance in ATS. New techniques such as Team
ICAO CNSIATM systems. The survey identified several Resource Management (TRM) with Threat and
areas in which application of Human Factors knowledge Error Management (TEM) need to be introduced
and experience would enhance future ICAO CNSIATM globally. Information transfer in complex systems,
systems safety and efficiency: the system-wide implications of data-link imple-
mentation, automated aids such as conflict predic-
Automation and advanced technology in future tion and resolution advisory systems, and the
ATS systems. The application of state-of-the-art allocation of authority and functions between air
technology and automation is fundamental to the and ground in advanced systems are areas in which
ICAO CNStATM concept. Experience shows that it guidance is necessary.

31/5/05
No. 2
 Human Factors Training Manual

Training, selection and licensing of operational a concern among researchers, designers and users, that the
personnel. Acquiring technical skills alone will not indiscriminate application of automation may also create a
guarantee on-the-job performance with high relia- whole new set of human errors. Experience gained in the
bility and efficiency. Resource management train- operation of complex automated systems in civil aviation
ing programmes specially tailored to ATM have and elsewhere indicates that in order to be effective, auto-
become available under the name Team Resource mation must meet the needs and limitations of users and
Management (TRM). Although some successful purchasers (i.e. air traffic services providers and/or civil
attempts to address Human Factors training for aviation authorities). This chapter aims at informing
operational personnel are in place, it is evident that designers about the expected role of automation; assisting
much is lacking and more action in this regard is administrations in the evaluation of the equipment during
still desirable. Selection criteria which go Beyond the procurement process; and explaining to users what to
consideration of the candidate's technical aptitude expect from the tools that they will be given to achieve
and include social and personal characteristics asso- their tasks.
ciated with team performance are also important.
Licensing requirements which reflect these new 3.1.6 Experience gained with programmes developed
training objectives would provide the framework to outside civil aviation to meet the demands presented by
achieve them. complex systems (most notably in the nuclear power gen-
eration and chemical processing and weapons systems
Safety monitoring of ATS activities. Annex 11 industries, all of which have characteristics in common
requires that States implement "systematic and with advanced aviation systems in terms of complexity and
appropriate ATS safety management programmes" integration) is applied throughout the chapter as necessary.
and that "the acceptable level of safety and safety These programmes were developed following the failure of
objectives applicable to the provision of ATS" be projects that produced technically viable systems but which
established. Existing tools for monitoring safety could not be maintained or operated effectively in the field;
may not be sufficient in view of the increased com- they ensure that high-technology systems take into account
plexity and interdependence of the ICAO the relevant Human Factors aspects throughout the devel-
CNSIATM activities. Guidance is needed on how opment cycle, along with the more traditional technical
ATS activities can be monitored to provide the specifications. This is achieved by focusing attention on the
information required for identifying and resolving operator's performance and reliability as part of the total
safety issues. Emerging tools such as the Line system performance.
Operations Safety Audit (LOSA) and the Normal
Operations Safety Survey (NOSS) should be 3.1.7 This chapter:
considered.
introduces the historical background of the ICAO
CNSIATM system and discusses the concept;
Development of guidance material
presents the role of automation in advanced avia-
3.1.4 This chapter addresses the Human Factors tion systems. It also discusses the role of the human
implications of automation and advanced technology in operator in such a system. It is essential that system
modem aviation systems, including CNSIATM systems. It designers take the human element into account dur-
also intends to provide the civil aviation authorities with ing the preliminary stages of system design. It also
tools for establishing the requirements for the new systems discusses issues and concerns in CNSIATM system
and for reviewing proposals from manufacturers, from the automation;
perspective of Human Factors. This chapter should also be
useful for the ICAO panels and study groups working on introduces the concept of human-centred automa-
the ICAO CNSIATM concept to ensure that Human Factors tion, that is automation designed to work with
principles are adequately considered during the develop- human operators in pursuit of the stated objectives.
ment of automation and advanced technology in future Human-centred automation does not only enhance
systems. safety but also reduces training and operation costs
by allowing efficient, effective and safe operation;
3.1.5 The discussion related to the recommendation
of the Tenth Air Navigation Conference notes the potential introduces the principles of human-centred automa-
of automation for reducing human error. There is, however, tion based on the premise that a human (pilot,

31/5/05
No. 2
 Chapter 3. Human Factors issues in the
development and irnplementaiton of CNS/ATM systems

controllel; etc.) bears the ultimate responsibility for assessing new technologies, including the use of satellites,
the safety of flight operation; and making recommendations for the future development
of air navigation for civil aviation over a period of the order
introduces qualities human-centred automation of 25 years.
should possess if it is to remain an effective and
valued element of the aviation system. As automa-
3.2.3 The FANS Committee determined that it would
tion becomes more complex, it will be increasingly
be necessary to develop new systems that would overcome
difficult for human operators to remain aware of all
limitations of conventional systems and allow ATM to
actions being taken autonomously and thus increas-
develop on a global scale. The future systems would be
ingly difficult to know exactly what the automation
expected to evolve and become more responsive to the
is doing and why. Attributes of human-centred
needs of users whose economic health would be directly
automation, capable of preventing such a situation
related to the efficiency of these systems. The FANS Com-
from developing, are also discussed; and
mittee concluded that satellite technology offered a viable
solution to overcome the shortcomings of conventional
presents a list of references.
ground-based systems and to meet the future needs of the
international civil aviation community.

3.2 THE ICAO CNSIATM CONCEPT 3.2.4 The FANS Committee further recognized that
the evolution of ATM on a global scale using new systems
would require a multidisciplinary approach because of the
BACKGROUND close interrelationship and interdependence of its many
elements. Understanding that coordination and institutional
issues could eventually arise with new concepts, and
Air traffic environment realizing that planning would have to be carried out at the
worldwide level, the FANS Committee recommended to
3.2.1 The air transport industry grew more rapidly the ICAO Council in its final report that a new committee
than most other industries through the 1980s and 1990s. be established to advise on the overall monitoring, coordi-
Between 1985 and 1995, air passenger travel and air freight nation of development and transition planning. This would
on scheduled services grew at average annual rates of 5.0 ensure that implementation of future CNSIATM systems
and 7.6 per cent, respectively. Over this same period, would take place on a global basis in a cost-effective and
aircraft departures and aircraft-kilometres grew at average balanced manner, while still taking into account air
rates of 3.7 per cent and 5.8 per cent, respectively. The navigation systems and geographical areas.
annual changes in scheduled aircraft movements are
illustrated in Figure 3- 1.
3.2.5 In July 1989, the ICAO Council, acting on the
recommendation of the FANS Committee, established the
Special Committee for the Monitoring and Coordination of
The FANS Committee
Development and Transition Planning for the Future Air
Navigation System (FANS Phase 11).
3.2.2 Having considered the steady growth of intema-
tional civil aviation preceding 1983, taking into account
forecasts of traffic growth and perceiving that new techno- 3.2.6 In October 1993, the FANS Phase I1 Committee
logies were on the horizon, the Council of ICAO at the time completed its work. The FANS Phase 11 Committee recog-
considered the future requirements of the civil aviation nized that implementation of related technologies and
community. It determined that a thorough analysis and expected benefits would not arrive overnight, but would
reassessment of the procedures and technologies that had so rather evolve over a period of time, depending upon the
successfully served international civil aviation over the present aviation infrastructures in the different States and
many years was needed. In further recognizing that the regions, and the overall requirements of the aviation
systems and procedures supporting civil aviation had community. The FANS Phase II Committee also agreed that
reached their limits, the Council took an important decision much of the technology they were considering was already
at a pivotal juncture and established the Special Committee becoming available and that work should begin by
on Future Air Navigation Systems (FANS). The FANS gathering information and, where possible, accruing early
Committee was tasked with studying, identifying and benefits using available technologies.
-
31/5/05
No. 2
1-3-4 Human Factors Training Manual

WORLD AIRCRAFT MOVEMENTS

20 000

0
vt:
cd
V) Departures (thousands)
a, \

- .\
Aircraft-kilometres (millions)

Figure 3-1. Annual changes in scheduled aircraft movements

The Tenth Air Navigation Conference time) as their capability would permit. With this ideal in
mind, it was recognized that the existing overall air naviga-
3.2.7 In September 1991, 450 representatives from tion system and its subsystems suffered from a number of
85 States and 13 international organizations gathered at shortcomings in terms of their technical, operational, pro-
ICAO Headquarters in Montreal, Canada, at the Tenth Air cedural, economic and implementation nature. After close
Navigation Conference, to consider and endorse the analyses, the FANS Committee ascertained that the short-
concept for a future air navigation system as developed by comings of current systems (FANS I conducted its work
the FANS Committees, that would meet the needs of the between 1983 and 1988) around the world amounted to
civil aviation community well into the next century. The essentially three factors:
FANS concept, which became known as the communica-
tions, navigation, surveillance/air traffic management a) the propagation limitations of current line-of-sight
(CNS/ATM) systems, involves a complex and interrelated systems;
set of technologies, dependent largely on satellites.
CNS/ATM is the vision developed by ICAO with the full
b) the difficulty, caused by a variety of reasons, to
cooperation of all sectors of the aviation community to
implement current CNS systems and operate them
accommodate the future needs of international air transport.
in a consistent manner in large parts of the world;
and
SHORTCOMINGS OF
CONVENTIONAL SYSTEMS c) the limitations of voice communications and the
lack of digital air-ground data interchange systems
3.2.8 The FANS Committee, early in its work, to support automated systems in the air and on the
recognized that for an ideal worldwide air navigation sys- ground.
tem, the ultimate objective should be to provide a cost-
effective and efficient system adaptable to all types of oper- 3.2.9 Although the effects of the limitations were not
ations in as near four-dimensional freedom (space and the same for every part of the world, the FANS Committee

31/5/05
No. 2
Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

foresaw that one or more of these factors inhibited the efficient linkages between ground and airborne automated
desired development of ATM almost everywhere. As the systems in conjunction with pilot/controller communica-
limitations were inherent to the existing systems them- tions. In fact, digital data link can be seen as the key to the
selves, the FANS Committee realized that there was little development of new ATM concepts leading to the achieve-
likelihood that the global ATS system of the time could be ment of real benefits.
substantially improved. New approaches were necessary by
which the limitations could be surmounted and which
would further permit ATS systems to evolve into an ATM Navigation
system more responsive to the needs of the users.
CNSIATM systems, therefore, would have to allow for a Improvements in navigation include the progressive
considerable improvement in safety, efficiency and flexibil- introduction of area navigation (RNAV), supported
ity on a global basis. by an appropriate combination of global navigation
satellite system (GNSS), self-contained navigation
systems (IRUJIRS) and conventional ground-based
navigation aids. The ultimate goal is a transition to
A BRIEF LOOK AT CNSIATM GNSS that eliminates the requirement for ground-
based aids, although the vulnerability of GNSS to
3.2.10 The four main elements of CNSIATM systems interference may require the retention of some
are summarized below and are dealt with in detail in the ground aids in specific areas.
Global Air Navigation Plan for CNS/ATM Systems, 2nd
edition (Doc 9750). GNSS provides for global navigational coverage
and is being used for oceanic, en-route and terminal
Communications navigation and for non-precision approaches. With
appropriate augmentation systems and related
In CNSIATM systems, the transmission of voice procedures, GNSS supports approaches with verti-
will, initially, continue' to take place over existing cal guidance and precision approaches. GNSS, as
very high frequency (VHF) channels; however, specified in Annex 10, provides a high-integrity,
these same VHF channels will increasingly be used high-accuracy and all-weather global navigation
to transmit digital data. service. The full implementation of GNSS will
enable aircraft to navigate in all types of airspace,
in any part of the world, using on-board avionics to
Satellite data and voice communications, capable of
receive and interpret satellite signals.
global coverage, are also being introduced along
with data transmission over high frequency (HF)
channels.
Surveillance

The secondary surveillance radar (SSR) Mode S, Traditional SSR modes will continue to be used,
which is increasingly being used for surveillance in along with the gradual introduction of Mode S in
high-density airspace, has the capability of trans- both terminal areas and high-density continental
mitting digital data between air and ground. airspace.

An aeronautical telecommunication network (ATN) The major breakthrough, however, is with the
will provide for the interchange of digital data implementation of automatic dependent surveil-
between end-users over dissimilar air-ground and lance (ADS). ADS allows aircraft to automatically
ground-ground communications subnetworks. transmit their position, and other data, such as
heading, speed and other useful information
The regular use of data transmission for ATM purposes will contained in the flight management system (FMS),
introduce many changes in the way that communications via satellite or other communications links, to an air
between air and ground take place, and at the same time traffic control (ATC) unit where the position of the
offer many new possibilities and opportunities. aircraft is displayed somewhat like that on a radar
display. Benefits would be derived quickly through
The benefits expected from the future communications ADS in oceanic and some continental areas that
systems lie in the fact that they will allow more direct and currently have no radar coverage.

31/5/05
No. 2
 Human Factors Training Manual

ADS can also be seen as an application that represents the information on weather warnings such as storm alerts will
true merging of communications and navigation technolo- also contribute to the safety and effectiveness of flight
gies, and, along with ground system automation enhance- operations.
1 - ments, will allow for the introduction of significant
improvements for ATM, especially in oceanic airspace. 3.2.12 CNSIATM systems will improve the handling
Software is currently being developed that would allow this and transfer of information, extend surveillance using ADS
data to be used directly by ground computers to detect and and improve navigational accuracy. This will lead, among
resolve conflicts. other things, to reductions in separation between aircraft,
allowing for an increase in airspace capacity.
ADS-broadcast (ADS-B) is another concept for dissemina-
tion of aircraft position information. Using this method, 3.2.13 Advanced CNSIATM systems will also see the
aircraft periodically broadcast their position to other aircraft implementation of ground-based computerized systems to
as well as to ground systems. Any user, whether airborne or support increases in traffic. These ground-based systems
on the ground, within range of the broadcast, receives and will exchange data directly with FMS aboard aircraft
processes the information. All users of the system have through a data link. This will benefit the ATM provider and
real-time access to precisely the same data, via similar airspace user by enabling improved conflict detection and
displays, allowing a vast improvement in traffic situational resolution through intelligent processing, providing for the
awareness. automatic generation and transmission of conflict-free
clearances, as well as offering the means to adapt quickly
to changing traffic requirements. As a result, the ATM
Air trafSic management (ATM) system will be better able to accommodate an aircraft's
preferred flight profile and help aircraft operators to
In considering implementation of new communica- achieve reduced flight operating costs and delays.
tions, navigation and surveillance systems and all
of the expected improvements, it can be seen that
the overall main beneficiary is likely to be ATM.
More appropriately, the advancements in CNS 3.3 AUTOMATION IN ADVANCED
technologies will serve to support ATM. When AVIATION SYSTEMS
referring to ATM in the future concept, much more
than just air traffic control is meant. In fact, ATM 3.3.1 One major issue in advanced aviation systems
refers to a system's concept of management on a (including the CNSIATM system) is the impact of automa-
much broader scale, which includes ATS, air traffic tion and the application of advanced technology on the
flow management (ATFM), airspace management human operator. In order to be effective, automation must
(ASM) and the ATM-related aspects of flight meet the needs and constraints of designers, purchasers (i.e.
operations. air traffic services providers and/or civil aviation authori-
ties) and users. It is, therefore, essential to provide guide-
An integrated global ATM system should fully exploit the lines for the design and use of automation in highly
introduction of new CNS technologies through interna- advanced technology systems including the CNSIATM
tional harmonization of Standards and procedures. system. What roles should automation play in advanced
Ultimately, this would enable aircraft operators to conduct systems, how much authority should it have, how will it
their flights in accordance with their preferred trajectories, interact with the human operator and what role should be
dynamically adjusted, in the optimum and most cost- reserved for the human are but a few of the many questions
efficient manner. that should be answered during conceptual system design.

3.2.11 The ICAO CNSIATM systems concept is

widely seen as advantageous because it permits the The role of the human operator in highly
enhancement of safety. Improved reliability of the aeronau- automated systems
tical mobile satellite communications system, for example,
will mean more complete and less interrupted ATS commu- 3.3.2 Technology has advanced to an extent for
nications in some parts of the world. In addition, ADS and computers (automation) to be able to perform nearly all of
data communications systems facilitate improved conflict the continuous air traffic control and surveillance as well as
detection and resolution and assist the controller by provid- aircraft navigational tasks of the aviation system. Why,
ing advice on conflict resolution. More rapid and detailed then, is the human needed in such systems? Couldn't
Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

automation be constructed to accomplish all the discrete difference in the way humans and computers respond to
tasks of the human operator? Would it not be easier and situations could mean the difference between a reliable
even cheaper to design highly reliable automata that could (safe) and an unreliable (unsafe) aviation system. Human
do the entire job without worrying about accommodating a response involves the use and coordination of eyes, ears
human operator? and speech and the ability to respond to unexpected
problems through initiative and common sense. Computers
3.3.3 Many system designers view humans as unreli- depend on the right programme being installed to ensure
able and inefficient and think that they should be eliminated that the right action is taken at the right time. The inability
from the system. (This viewpoint is fuelled by the promise of automation designers to engineer a programme that can
of artificial intelligence and recently introduced advanced deal with all presumed eventualities and situations in the
automation.) It is unrealistic to think that machine function- aviation system, and the uncontrollable variability of the
ing will entirely replace human functioning1 Automation is environment are some of the major difficulties of compu-
almost always introduced with the expectation of reducing terizing all the tasks of the aviation system. The reality is:
human error and workload, but what frequently happens is if automation is faced with a situation it is not programmed
that the potential for error is simply relocated. More often to handle, it fails. Automation can also fail in unpredictable
than not, automation does not replace people in systems; ways. Minor system or procedural anomalies can cause
rather, it places the person in a different, and in many cases, unexpected effects that must be resolved in real time, as in
more demanding role.2 the air traffic control breakdowns in the UK NATS'
Swanwick en route centre (NERC) in 2002 and the break-
down of the flight data processing systems in the Tokyo Air
3.3.4 As an example, it is widely claimed that a
Traffic Control Centre in 2003. Considering these limita-
prerequisite for increasing airspace capacity is to change
tions, it is not very difficult to see that an automation-
the role of the air traffic controller from controlling every
centred aviation system can easily spell disaster to the
aircraft individually to managing a larger (or wider)
whole aviation infrastructure.
airspace. In future ATC architectures, automated tools for
conflict detection and resolution are supposed to play a
3.3.7 Although humans are far from being perfect
greater role in the routine provision of separation between
sensors, decision-makers and controllers, they possess
aircraft. Controller intervention will be necessary only
several invaluable attributes, the most significant of which
when the automation is unable to resolve developing
are their ability to reason effectively in the face of
situations, when traffic density precludes route flexibility,
uncertainty and their capacity for abstraction and concep-
or for other safety reasons. In other words, the traditional
tual analysis of a problem. Faced with a new situation,
controller becomes an exception manager who will have to
humans, unlike automatons, do not just fail; they cope with
resolve conflicts when aircraft or computers are unable to
the situation and are capable of solving it successfully.
and take over control when the airspace gets too busy or
Humans thus provide to the aviation system a degree of
when other critical parameters are exceeded.
flexibility that cannot now and may never be attained by
computational systems. Humans are intelligent: they
3.3.5 But as stipulated by Dekker and Woods (1999), possess the ability to respond quickly and successfully to
management by exception traps human controllers in a new situations. Computers, the dominant automatons of the
dilemma: intervening early provides only thin ground for ATC system, cannot do this except in narrowly defined,
justifying restrictions and creates controller workload well understood domains and ~ituations.~
problems (and compromises larger air traffic system goals)
while intervening late leaves little time for actually resolv- 3.3.8 Automation should be considered to be a tool or
ing the problem, which by then will be well underway resource, a device, system or method which enables the
(thereby compromising larger air traffic system goals). In human to accomplish some task that might otherwise be
summary, intervening early would be difficult, and difficult or impossible, or which the human can direct to
intervening late would be difficult, although for different carry out more or less independently a task that would
reasons. Management by exception seems to put the future otherwise require increased human attention or effort. The
controller in a fundamental double bind. word "tool" does not preclude the possibility that the tool
may have some degree of intelligence - some capacity to
3.3.6 The aviation system consists of many variables learn and then to proceed independently to accomplish a
that are highly dynamic and not fully predictable. Real-time task. Automation is simply one of many resources available
responses to developing situations are what assure the safe to the human operator, who retains the responsibility for
operation of the whole aviation system. The basic management and direction of the overall system.

31/5/05
No. 2
1-3-8 Human Factors Training Manual

3.3.9 An emerging term to denote a more intelligent In order to achieve the above priorities, all Delta Air Lines
design form of automation is "cooperative human-machine training programs, training devices, procedures, checklists,
architecture". According to Dekker and Woods (1999), the aircraft and equipment acquisitions, manuals, quality
active partner in a well coordinated human-machine team control programs, standardization, supporting documents
(which in management by exception would often be the and the day-to-day operation of Delta aircraft shall be in
machine) would not sound threshold crossing alarms to accordance with this statement of philosophy.
signal the end of its problem-solving capability. It would
instead continuously comment on the difficulty or increas- 3.3.12 Introducing such an automation philosophy
ing effort needed to keep relevant parameters on target. The into aviation operations is beneficial since by defining how
(human) supervisor could ask about the nature of the and when automation is to be used, it demarcates the
difficulty, investigate the problem, and perhaps finally boundary of human-machine responsibilities and thus
intervene to achieve overall safety goals. promotes safety and efficiency in the system. It should be
realized that an automation philosophy is not just linked to
3.3.10 In order to build such cooperative human- existing equipment. It can also be useful for an aviation
machine architecture for ATC it first should be determined organization's overall procedure design, training develop-
what levels and modes of interaction will be meaningful to ment and equipment procurement, and it should not be
controllers and in which situations. In some cases control- made into a set of detailed procedures. These procedures
lers may want to take very detailed control of some portion may have to change with the arrival of new equipment
of a problem, specifying exactly what decisions are made while the philosophy remains the same. Last but not least,
and in what sequence, while in others the controllers may it must also be consistent with the cultural context in which
want to make very general, high-level corrections to the the organization operates.
course of events.

3.3.11 Considering automation a resource is a line of CNSIATM system automation

thinking that has been well understood and precisely
defined by the aviation Human Factors community, to the 3.3.13 The core of the benefits of the CNSIATM
extent that philosophies have been developed by some system will be derived from automation intended to reduce
organizations in the industry to demarcate the function and eliminate constraints imposed on the system. D~~~bases
responsibilities of the two elements (human operators and describing current and projected levels of demand and
automation) in the system. A very good of such a
capacity resources, and sophisticated automated models
philosophy as adopted by one airline statex4 that accurately predict congestion and delay will, in the
future, be used to formulate effective real-time strategies
The word "automation", where it appears in this statement,
for coping with excess demand. Automation will play a
shall mean the replacement of a human function, either
central role in establishing negotiation processes between
manual or cognitive, with a machine function. This defini-
the aircraft flight management computer systems and the
tion applies to all levels of automation in all airplanes
ground-based air traffic management process, to define a
flown by this airline. The purpose of automation is to aid
new trajectory that best meets the user's objective and
the pilot in doing his or her job.
satisfies ATM constraints. The human operator, however,
The pilot is the most complex, capable and flexible should decide the outcome of the negotiation and its imple-
component of the ai~transportsystem, and as such is best mentation. Similarly, when the ground-based management
suited to determine the optional use of resources in any process recognizes a need to intervene in the cleared flight
given situation. path of an aircraft, the ATM computer will negotiate with
the flight management computer to determine a modifica-
Pilots must be proficient in operating their airplanes in all tion meeting ATM constraints with the least disruption to
levels of automation. They must be knowledgeable in the the user's preferred trajectory. Automation can also probe
selection of the appropriate degree of automation, and must each ADS position-and-intent report from an aircraft to
have the skills needed to move from one level of automa- detect potential conflicts with other aircraft, with hazardous
tion to another. weather or with restricted airspace.

Automation should be used at the level most appropriate to 3.3.14 The range of use of automated systems and
enhance the priorities of Safety, Passenger Comfort, Public automation is so central to the CNSIATM systems that it
Relations, Schedule and Economy, as stated in the Flight will not be possible to derive the envisaged benefits of the
Operations Policy Manual. CNSIATM system or even implement it effectively without

31/5/05
No. 2
 Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

the use of automation. It is clear that the possibilities being overlook the Human Factors issues involved. ICAO
researched as a result of the introduction of the global Annex 11 requires that whenever significant changes to
--
CNSIATM system range well beyond what is strictly operational procedures or regulations are contemplated, a
envisaged at present and further development may strictly system safety assessment must be conducted. The objective
depend on more and more automation. of such assessment is to identify any safety deficiencies in
the proposed changes before they are implemented, and to
3.3.15 Automation has been gradually introduced in ensure that the new procedures are error tolerant so that the
the aviation system. Flight deck automation has made consequences of human or technological failure are not
aircraft operations safer and more efficient by ensiiring catastrophic. Human Factors consideration in the design
more precise flight manoeuvres, providing display flexibil- and development of new systems can assure that the
ity, and optimizing cockpit space. Many modem ATC paramount requirement of safety is never compromised in
systems include automated functions, for example in data the whole system, but maintained and enhanced throughout
gathering' and processing, which are fully automated with all future challenges.
no direct human intervention. Computerized data bases and
electronic data displays have enhanced data exchange, the 3.3.19 Development in CNSIATM systems will seek
introduction of colour radar systems have allowed a greater to do more with less, by designing and procuring air traffic
measure of control, and the computerization of Air Traffic management systems that are highly automated. Increased
Flow Management (ATFM) has proved to be an essential automation in aviation is inevitable. The issue is therefore
element to efficiently deal with the various flow control about when, where and how automation should be
rates and increases in traffic demand. implemented, not if it should be introduced. Properly used
and employed, automation is a great asset. It can aid
3.3.16 For the purpose of this chapter, automation
efficiency, improve safety, help to prevent errors and
refers to a system or method in which many of the processes
increase reliability. The task is to ensure that this potential
of production are automatically pe$ormed or controlled by
is realized by matching automated aids with human
self operating machines, electronic devices, e t ~ The . ~
capabilities and by mutual adaptation of human and
concern is with automation of advanced aviation-related
machine to take full advantage of the relative strengths of
technology and in particular with Human Factors issues in
each. In aviation automated systems, the human (pilot,
CNSIATM systems development and application. Automa-
- tion is essential to the progressive evolution of the
controller, etc.), who is charged with the ultimate responsi-
bility for the safe operation of the system must remain the
CNSIATM systems and is expected to play a commanding
key element of the system: automation or the machine must
role in future development of aviation technology. As such,
assist the human to achieve the overall objective, never the
its progressive introduction, therefore, is most desirable.
contrary.
3.3.17 The techniques of air traffic management are
constantly changing. New data link and satellite communi- 3.3.20 A major design challenge in the development
cation methods are evolving, the quality of radar and data of air traffic management procedures and techniques using
processing is improving, collision avoidance systems are new technologies is to realize system improvements that
being developed, reduced vertical separation minima are centred on the human operator. Information provided to
(RVSM) above FL290 are being implemented, direct the human operator and the tasks assigned must be consist-
routing of aircraft between departure and arrival airports ent with the human's management and control responsibil-
instead of via airways is being explored, and highly ities as well as the innate characteristics and capabilities of
advanced air navigation systems are being researched and human beings. Any technological advance in the aviation
developed. More and more possibilities intended to system, including the CNSIATM system, should therefore
increase the benefits of the concept in a wider scale are also take into account the human-machine relationship early in
being discovered and introduced. its design process and development. If account is not taken
at this stage, the system may not be used as intended,
3.3.18 Further options offered by such technological prejudicing the efficiency or safety of the whole system.
advances have to be considered in terms of safety, Automation must be designed to assist and augment the
efficiency, cost effectiveness and compatibility with human capabilities of the human managers; it should, as much as
capabilities and limitations. These advances change the possible, be human-centred. As basic understanding of
procedures and practices of the global aviation system, the Human Factors improves, and as facilities for testing the
working environment and the role of pilots, air traffic Human Factors aspects of system designs become
controllers, dispatchers, aircraft maintenance technicians, available, the design process can be expected to be more
etc., presenting all concerned with the challenge not to efficient.
-
1-3-10 Human Factors Training Manual

Issues and concerns in CNSIATM shown that, in order to form a mental picture of the tr&c
systems automation situation, controllers derive a lot of their situational aware-
ness by speaking to the aircraft and by making annotations
3.3.21 CNSIATM systems are intended to be a world- on paper strips or making inputs (in more automated
wide evolution of communications, navigation and surveil- systems).6 Verbal and written (or keyboard) inputs keep
lance techniques into a largely satellite-based system. As people "in the loop" and allow active updating of the
such, they entail a continuous increase of the level of auto- mental picture and situational awareness in its widest
mation in aviation operations. Optimum use of automation sense.7 It is believed that the automation of data can lead to
both in the aircraft and on the ground (air traffic control, deficiencies in human performance, since it can deprive the
dispatch and maintenance) is desired to pennit high controller of important information about the reliability and
efficiency information flow. The Automatic Dependence durability of information. Automation may well reduce the
Surveillance data can be used by the automated air traffk effort required to perform certain tasks and the stress
management system to present a traffic display with as associated with them, but may also lead to loss of job
much information as required to the operator. To increase satisfaction by taking away some of the intrinsic interests
capacity and reduce congestion, airports and airspaces must of the job and the perceived control over certain functions.
be treated as an integrated system resource, with optimal
interaction between system elements, aircraft, the ground 3.3.25 There is enough information, both from safety
infrastructure, and most importantly, the human operators deficiencies information systems and from accident reports,
of the system. to illustrate the impact of the technology-centred approach
to automation. More than 60 concerns relating to automa-
3.3.22 In some States, extensive research is being tion were identified by a subcommittee of the Human
done on improvements to air safety through the introduc- Behaviour Technology Committee established by the
tion of air-ground data links replacing the majority of Society of Automotive Engineers (SAE) to consider flight
pilot/controller voice communications. It should, however, deck automation in 1985. The majority of these concerns
be recognized that voice communication will still be are as relevant to the air traffic control environment as they
required, at least for emergency and non-routine communi- are to the flight deck. A brief presentation of such concerns
cations. Controller - Pilot Data Link Communication includes:*
(CPDLC) is considered to offer great potential in reducing
human error while providing for increased airspace Loss of systems awareness may occur when the
capacity to accommodate future growth in air traffic. This, human operator is unaware of the basic capabilities
however, could involve changes in the human-machine and limitations of automated systems, or develops
interface which in the future may include increased use of erroneous ideas of how systems perform in pa-ticu-
artificial intelligence to assist the pilot and the controller in lar situations.
the decision-making process. Also, as evidenced by experi-
ence in the South Pacific, CPDLC introduces opportunities Poor interface design. Automation changes what
for errors in places in the system where they did not exist is transmitted through the human-machine inter-
before (see 3.3.3). face, either leading to some information not being
transmitted at all or the format of the transmitted
information being changed. Traditionally, most
3.3.23 All forms of automated assistance for the information has been conveyed from the machine to
human operator must be highly reliable, but this may also the human by means of visual displays and from the
induce complacency. Human expertise may gradually be human to the machine by means of input devices
lost and if the machine fails, the human operator may and controls. Poor interface design may also
accept an inappropriate solution or become unable to combine with the time required for the human to
formulate a satisfactory alternative. The most appropriate take over from automation and may become an
forms of human-machine relationship depend on the type of important factor, by reducing the quality of
task which is automated and particularly on the interaction execution or practice of an event due to lack of
between planning and executive functions. warmup.

3.3.24 In the air traffic management environment, it is Attitudes towards automation could best be
highly accepted that the performance of routine ATC tasks expressed as an indication of frustration over the
aids memory, which is not the case if these tasks are done operation of automated systems in a non-user-
automatically for the controller. Scientific studies have friendly environment, although improvements in
Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

the human-machine interface would probably Boredom and automation complacency may
reduce this feeling to some extent. Wherever intro- occur if a major portion of air traffic management
duced, automation has not been uncritically is completely automated, and human operators are
accepted by those who are meant to operate it. lulled into inattention. In the particular case of com-
Some aspects of automation are accepted while placency, humans are likely to become so confident
others are rejected (in some cases because operators that the automatic systems will work effectively
did not operate the equipment acceptably in the real that they become less vigilant or excessively toler-
world environment). Acceptance of automation ant of errors in the system's performance.
may also be affected by factors related to the
culture of the organization to which employees Automation intimidation results in part because of
belong. Poor relationships with management, an increase in system components. The result is a
employee perceptions of having had no choice in reliability problem, since the more components
the decision to accept automation, and lack of there are, the more likely it will be that one will
involvement in the development of automation are fail. However, humans remain reluctant to interfere
other examples of factors that may negatively affect with automated processes, in spite of some evi-
the acceptance of automation. These factors may dence of malfunction. This is partly due to
operate independently of the quality of the automa- inadequate training and partly to other pressures.
tion provided to the employees.
Distrust normally occurs because the assessment of
Motivation and job satisfaction involve problem a particular situation by the human differs from the
areas such as loss of the controller's feeling of automated system. If the system does not perform
importance, the perceived loss in the value of in the same manner as a human would do, or in the
professional skills, and the absence of feedback manner the controller expects, it can lead to either
about personal performance. Many operators feel inappropriate action or concern on the part of the
that their main source of satisfaction in their job lies human. This can also occur if the human is not
in its intrinsic interest to them. They believe that adequately trained. Distrust can be aggravated by
the challenge of the job is one of the main reasons flaws in system design which lead to nuisance
they enjoy their profession. A takeover by automa- warnings.
tion to the point that job satisfaction is reduced can
lead to boredom and general discontent. Mode confusion and mode misapplication are
results of the many possibilities offered by automa-
Over-reliance on automation occurs because it is tion, as well as of inadequate training. It is possible
easy to become accustomed to the new automated with a new computer technology for the controller
systems' usefulness and quality. A tendency to use to assume that the system is operating under a
automation to cope with rapidly changing circum- certain management mode when in fact it is not.
stances may develop even when there is not enough
time to enter new data into the computer. When Workload. The advance of automation has been
things go wrong, there may also be a reluctance by based partly on the assumption that workload
the human to discard the automation and take over. would be reduced, but there is evidence to suspect
that this goal has yet to be achieved. In the air
Systematic decision errors. Humans may depart traffic control environment, additional working
from optimal decision-making practices, particu- practices such as data entrylretrieval methods may
larly under time pressure or other stress. The exist- actually increase workload. For example, merely
ence of human biases may further limit the ability automating certain aspects of an ATC system will
of humans to make optimal decisions. One not necessarily enable the air traffic control officer
approach to reduce or eliminate biased decision- to handle more traffic. Automation should be
making tendencies is to use automated decision- directed at removing non-essential tasks, thereby
making aids at the time decisions are required. In allowing the controller to concentrate on more
such a system, humans adopt one of two strategies: important tasks, such as monitoring or directly
accept or reject the machine recommendation. controlling the system and resolving conflicts.
Although the benefits of automated decision-
making aids are theoretically evident, they still Team function. The team roles and functions in
remain to be conclusively demonstrated. automated systems differ from those which can be

31/5/05
No. 2
1-3-12 Human Factors Training Manual

exercised in manual systems. As an example, airborne systems. Traditionally these systems were consid-
controllers in more automated systems are more ered to be stand-alone systems, but in an advanced technol-
self-sufficient and autonomous and fulfil more ogy environment there increasingly is an automated
tasks by interacting with the machine rather than exchange of information between the systems based on
with colleagues or with pilots. There is less speech which safety-related actions may or may not be taken by
and more keying. This affects the feasibility and the respective operators. This may have implications for
development of traditional team functions such as certification requirements for the ground-based system
supervision, assistance, assessment and on-the-job components across States.
training. When jobs are done by members of a
closely coordinated team, a consensus about the
relative merits of individual performance can form
the basis not only of professional respect and trust 3.4 HUMAN-CENTRED TECHNOLOGY
but also of promotions or assignments of further
responsibilities. The subject of changes in team
roles and functions is one of the items that should A concept of human-centred automation
be addressed in Team Resource Management
(TRM) training for air traffic services personnel. 3.4.1 "Human-centred automation" is a systems
concept, meaning automation designed to work coopera-
3.3.26 The technology-centred approach in the auto- tively with human operators in pursuit of the stated
mation of highly advanced technologies such as the nuclear objectives. Its focus is an assortment of automated systems
power plant industry, chemical industry, civil aviation, designed to assist human operators, controllers or managers
space technology, etc., resulted in accidents with a great to meet their responsibilities. The quality and effectiveness
loss of lives and property. Basically, such accidents were an of the human-centred automation system is a function of
outcome of human-machine incompatibilities. Since the the degree to which the combined system takes advantage
technology was easily available, engineering-based of the strengths and compensates for the weaknesses of
solutions to human error were implemented without due both elements. To better understand the concept of human-
consideration of human capabilities and limitations. centred automation we may define a fully autonomous,
Technology-centred automation may be based on the robotic system as non-human-centred - the human has no
designer's view that the human operator is unreliable and critical role in such a system once it is designed and is
inefficient, and so should be eliminated from the system. made operational. Conversely, automation has no role to
However, two ironies of this approach have been identi- play in a fully manual system.
fied:' one is that designer errors can be a major source of
operating problems; the other is that the designer who tries 3.4.2 None of today's complex human-machine
to eliminate the operator still leaves the operator to do the systems are at either extreme. Nearly all systems provide
tasks which the designer does not know how to automate. automatic devices to assist the human in performing a
To this we can add the fact that automation is not, after all, defined set of tasks and reserve certain functions solely for
infallible and usually fails in mysterious and unpredictable the human operator. No one expects future advanced
ways. It is for this reason that there are increasing calls for aviation systems to be fully robotized, discarding the
a human-centred approach which takes all the elements, human element in its operation. They are also not expected
and especially the human element, into due consideration. to be operated without the assistance of some kind of
Hard lessons have been learned in the automation of automation. In fact, even today, both humans and machines
aviation systems in the past. Cockpit automation stands as are responsible for the safe operation of the aviation
an example. However, in cockpit automation, we can now system. The following classification for increasing degrees
say that - albeit with notorious exceptions - there is a of automation has been proposed (Billings, 1991):
return to human-centred automation, which is a positive
and encouraging trend strongly endorsed by ICAO. It is Direct manual control
hoped that lessons learned in the past are applied to all new
advanced technology systems so that known mistakes will
Assisted manual control
not be committed again.

3.3.27 A further new aspect of the introduction of Sharedcontrol

CNSIATM technology that may be of special relevance to
regulatory authorities is the interaction between ground and Management by delegation

3115105
No. 2
Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

Management by consent system design process. There are, however, several very
important payoffs for early investment in Human ~actors."
Management by exception, and

Autonomous operation. Human-centred technology (automation)

prevents disasters and accidents
As was discussed in the previous chapter, future growth in
the aviation system will require more automation. 3.4.5 Human or operator error has arguably been
Technology advancement in the system may well be based identified as the primary causal factor of accidents and
on the way we handle information and utilize automation. incidents. Speaking of systems in general, about 60 to 80
Information technology in aviation systems will foster per cent of accidents are attributed to operator error.12
profound changes in areas such as communications However, research applied to accident investigations casts
(airlground, airlair, groundlground), panel displays (flat, doubt on such findings, by demonstrating that in most cases
head-up, head-down), voice interactive techniques, data where human operators are said to be the primary causal
link, etc. Automation technology will likewise foster factor of an accident, they are confronted by unexpected
significant progress in areas such as flight control, air and unusually opaque technological interactions resulting
traffic control, digital control systems, fly by wire, etc. in unforeseen failures. Analysis of several high-technology
accidents, initially attributed to operator error, reveals that
3.4.3 The trend toward more information, greater most of the human error identified is induced by other
complexity and more automated operation has the potential factors. It is therefore essential to differentiate systemic-
to isolate the human operators from the operation and to induced human errors from those which are truly the
decrease their awareness of the state and situation of the consequence of deficient operator performance. Accident-
system being operated. There are many reasons, several of inducing factors include poor hardware design, poor
which were discussed earlier, why system designers should human-machine integration, inadequate training, and poor
consider Human Factors from the very beginning of the management practices and flawed organizational design. If
design process. Investigations of all major accidents which the humans involved in design, manufacture, training and
occurred within the last two decades of the 20th century in management are included in the wider picture, it could be
organizations using highly advanced technology (Three argued that "human error" plays a role in nearly every
Mile Island and Chernobyl - nuclear power technology, accident or incident. However, for analytical purposes it is
Tenerife - civil aviation, Bhopal - chemical industry, necessary to distinguish between latent conditions (by
Challenger - space technology) showed that improper or designers, manufacturers, trainers, managers) and active
flawed interfaces between human operators and technology failures (by operators), and it is important to realize that
were among the causal factors. Human error in those active failures which result in (near) catastrophic outcomes
accidents was induced by poor design, flawed procedures, can only do so because of a series of latent failures already
improper training, imperfect organizations, or other present in the system (see also 3.6.1 and 3.6.2).
systemic deficiencies. The key issue here is that human
error or degraded human performance is induced by factors 3.4.6 The cost associated with lost lives and injuries
which can be avoided at the proper stage.10 Systems design due to the lack of proper Human Factors consideration
which might induce human error can be avoided by better during design and certification of the technology cannot be
Human Factors design decisions from the very beginning of overstated. Research has clearly shown that technology-
system design to the very end. produced problems will not be eliminated by more
technology, especially in highly advanced systems where
3.4.4 The goal of human-centred automation is to human operators are expected to bear full responsibility for
influence the design of human-machine systems in their own as well as the automated systems' actions.
advanced technology so that human capabilities and limita-
tions are considered from the early stages of the design ... Most of us choose to think of the human role in our
process and are accounted for in the final design. A design sophisticated technological society as a minor part of the
that does not consider Human Factors issues cannot result equation. We accept a walk-on part in the modem world
in an optimal system that enhances productivity, safety and and give the machines, the systems, the lead. Again and
job satisfaction. Lack of recognition of the unique benefits again, in the wake of catastrophe, we look for solutions that
to be derived from human-centred automation may perhaps will correct "it" rather than "us." ... But no machine is more
be the main reason why Human Factors technology has trustworthy than the humans who made it and operate it. So
seldom been applied early or integrated routinely into the we are stuck. Stuck here in the high-risk world with our
 Human Factors Training Manual

own low-tech species, like it or not. No mechanical system 3.4.9 There is a front-end cost associated with
can ever be more perfect than the sum of its very Human human-centred technology (automation) in the conceptual
~act0rs.l~ stages, but, compared to the everyday operating costs
induced by inadequate design, it is negligible.
3.4.7 Human-centred technology (automation), by
integrating Human Factors considerations into the system There is an "iron law" that should never be ignored. To
design process, can resolve human error issues in highly consider Human Factors properly at the design and certifi-
advanced automated systems, thereby pre-empting future cation stage is costly, but the cost is paid only once. If the
disasters and accidents. operator must compensate for incorrect design in his
training program, the price must be paid every day. And
what is worse, we can never be sure that when the chips are
Human-centred technology (automation) reduces costs down, the correct response will be made.16

3.4.8 Costs associated with the introduction of new 3.4.10 In addition to the unnecessary costs associated
technology have mostly been determined during the with obvious breakdowns in the machine and human
concept exploration phase of system development. To keep interface, there. is an even greater cost associated with
costs down, Human Factors considerations are often left everyday degradation in overall system performance.
out of initial design considerations (in the hope that person- Because of inadequate consideration of the human role
nel training will make up for design deficiencies). The during conceptual design, systems frequently do not
result has been the multiplication of downstream costs perform as expected.
(training, operation and maintenance) far beyond the initial
savings. Changes to ensure that trained personnel can 3.4.11 Systems that employ human-centred technol-
operate the system, after system design has been set, are ogy and integrate human capabilities, limitations and
more difficult and costly.15This is illustrated by the graph expectations into system design are easier to learn and
in Figure 3-2. operate, thus considerably reducing the ultimate investment

100 a) No Human Factors integration

V)
.E rn
-2
>aa,

Q)
L -2 75
z mg
FE
zz 0
or:
$2 8
50
-----
Q)
'0 C
w m b) Re-active Human Factors integration
0 E
iz
0
25

Design Implementation Operation Life-cycle

Figure 3-2. Comparison of the evolution of costs associated with the introduction of new technology
with or without integration of Human Factors considerations.

3Y5105
No. 2
Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

in training and operating costs. Human-centred automation on Human Factors in Air Traffic Control Automation
design is a one-time investment - it becomes a permanent (1998):
part of the system at large. Conversely, investment in
personnel, manpower and training are recumng costs. The panel recommends implementation of high levels of
Thus, including Human Factors considerations in early automation of decision and action selection for system
system design is one sure way to avoid later costs. tasks involving relatively little uncertainty and risk.
However, for system tasks associated with greater uncer-
3.4.12 Generally speaking, the lack of Human Factors tainty and risk, automation of decision and action selection
considerations in the design and operation of systems will should not proceed beyond the level of suggesting a
invariably cause inefficiencies, problems, accidents and the preferred decision/action alternative. Any consideration for
loss of property and lives. automation above this level must be designed to prevent:
loss of vigilance, loss of situation awareness, degradation
3.4.13 The ability of humans to recognize and define of operational skills, and degradation of teamwork and
the expected, to cope with the unexpected, to innovate and communication. Such designs should also ensure the ability
to reason by analogy when previous experience does not to overcome or counteract complacency, recover from
cover a new problem is what has made the aviation system failure, and provide a means of conflict resolution if loss of
robust, for there are still many circumstances that are nei- separation occurs.
ther directly controllable nor fully predictable. Each of
these uniquely human attributes in addition to sub-cultural 3.5.4 As long as human operators are required to be
considerations is a compelling reason to retain the human fully responsible for the safe operation of the system, tools
in a central position in the design of appropriate automation (automation or otherwise) designed to assist them to under-
for the advanced aviation system. Appropriate automation take their responsibility should be designed with the human
is automation which is suited to the user population and the operator in mind. To effect this, regulators, designers, oper-
environment in which it is used. As such it should be bound ators and users should employ guidelines, or principles, for
within certain principles: the principles of human-centred the design and operation of automated systems envisaged to
automation. l7 be employed in the system and assist the human operators
to successfully undertake their responsibilities.

3.5 PRINCIPLES OF HUMAN-CENTRED 3.5.5 The application of these principles is central in

AUTOMATION the preliminary and final design processes of automated
systems in highly advanced technologies. The core of the
3.5.1 It has already been advanced that modem day matter is that automation is employed to assist human oper-
automation is capable of performing nearly all of the ators to undertake their responsibilities in the most safe,
functions envisaged in the aviation system both in the efficient, effective and economical mannei: It should never
aircraft and on the ground. We have also shown that the be the other way around. Questions raised in previous
human should, mainly in the interest of safety and chapters on how much authority automation should have,
economic advantages, remain the central focus in its how it will interact with the human operator, and what role
design. Questions regarding automation principles will, of should be reserved for the human can only be satisfied by
necessity, have to relate to the respective roles of the the application of a set of principles during the design,
humans and machines. It is accepted that humans will development and operation of an automation system.
retain responsibility for system safety. For this simple but Antoine de Sainte-ExupCry's observation that "the machine
most important reason they will also have to remain in full does not isolate man from the great problems of nature but
command of the automated systems for which they are plunges him more deeply into them" holds true now even
responsible. more than it did during the late 1930s, when it was voiced.

3.5.2 As introduced earlier, Billings (1997) proposes 3.5.6 Over time, progress in aviation safety has been
the various degrees of automation that may be at the hindered by piecemeal approaches. Pilots, controllers,
disposal of air traffic controllers as a continuum (see designers, engineers, researchers, trainers and others in the
Figure 3-3). aviation safety community have advocated solutions to
safety deficiencies which are undoubtedly biased by their
3.5.3 With respect to the question of which level of professional backgrounds. Such approaches have neglected
automation is appropriate for ATC, the following recom- to look into the big picture of aviation system safety, and
mendation (inter alia) was made to the FAA by the Panel have thus produced dedicated solutions to observed

31/5/05
No. 2
1-3-16 Human Factors Training Manual

Management Mode Automation Functions Human Functions

Fully autonomous operation; Controller has no active role in

controller not usually informed. operation. Monitoring is limited to
Autonomous operation System may or may not be capable fault detection. Goals are self-
of being bypassed. defined; controller normally has
no reason to intervene.

Essentially autonomous operation. Controller is informed of system

Management by exception Automatic decision selection. intent; may intervene by reverting
System informs controller and to lower level.
monitors responses.

Decisions are made by automation. Controller must consent to

Management by consent Controller must assent to decisions decisions. Controller may select
before implementation. alternative decision options.

Automation takes action only as Controller specifies strategy and

Management by delegation directed by controller. Level of may specify level of computer
assistance is selectable. authority.

Control automation is not Direct authority over all decisions;

Assisted control available. Processed radar imagery voice control and coordination.
is available. Backup computer data
is available.

Complete computer failure; no Proceduralcontrol of all traffic.

Unassisted control assistance is available. Unaideddecision making; voice
communications.

Figure 3-3. Degrees of automation available to air traffk controllers

deficiencies and conveyed the notion that different activi- discussing automation in the aviation system, it
ties within aviation take place in isolation. As mentioned should always be borne in mind that if people are
elsewhere in this document, the principles of human- to function efficiently, effectively and safely,
centred automation require that the industry embrace a Human Factors considerations must be integrated in
system approach to the design of automation systems. The the system starting at the conceptual stage and not
advantages of incorporating Human Factors considerations appended later on as part of a default decision.
early in system design cannot be overstated.
The human operator must be in command. For
The human bears the ultimate responsibility for humans to assume ultimate responsibility for the
the safety of the aviation system. History has safety of the system, they should be conferred with
shown us over and over again that in a complex essentially unlimited authority to pennit them to
system, no matter how automated, the human has fulfil this ultimate responsibility. It has been
the last vote in deciding a critical issue and the unequivocally stated that even when the automated
human is the last line of defence in case of system system is in full operation, "responsibility for safe
breakdown. The importance of people in a techno- operation of an aircraft remains with the pilot-in-
logical society is further reflected in the concept of command," and "responsibility for separation
pivotal people. Pfeiffer (1989) emphasizes the between controlled aircraft remains with the
irreplaceability of pivotal people in stressful controller." If they are to retain the responsibility
environments like flight operations, air traffic for safe operation or separation of aircraft, pilots
control, and power utility grid cont~-ol.19So when and controllers must retain the authority to

31/5/05
No. 2
Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

command and control those operations. It is the to actively control the system or to manage the
fundamental tenet of the concept of human-centred human or machine resources to which control has
automation that aviation systems (aircraft and ATC) been delegated. If humans are not actively
automation exists to assist human operators (pilots involved, it is likely that they will be less efficient
and controllers) in carrying out their responsibilities in reacting to critical system situations. Human-
as stated above. If this principle is not strictly centred aviation system automation must be
observed, and if decisions are made by automated designed and operated in such a way that it does not
systems instead of by human operators, compli- permit the human operator to become too remote
cated and unavoidable liability issues may arise. from operational details, by requiring of that
This will obviously lead into consideration of the operator meaningful and relevant tasks throughout
human operator's share of liability, which in turn the operation.
will adversely affect human performance. Thus, a
question of liability becomes a Human Factors To be involved, the human must be informed.
issue by default. Human operators should never be Without information about the conduct of the oper-
held liable for failures or erroneous decisions unless ation, involvement becomes unpredictable and
they have full control and command of the system. decisions, if they are made, become random. To
The reasons are very simple - like any other maintain meaningful involvement, the human oper-
machine, automation is subject to failure. Further, ator must have a continuing flow of essential
digital devices fail unpredictably and produce information concerning the state and progress of the
unpredictable manifestations of failures. The system controlled and the automation that is
human's responsibilities include detecting such controlling it. The information must be consistent
failures, correcting their manifestations, and contin- with the responsibilities of the human operator; it
uing the operation safely until the automated must include all the data necessary to support the
systems can resume their normal functions. Since human operator's involvement in the system. The
automation cannot be made failure-proof, automa- human operators must be prominently informed at
tion must not be designed in such a way that it can the level required to fulfil their responsibilities. The
subvert the exercise of the human operator's human operators must have enough information to
responsibilities. be able to maintain state and situation awareness of
the system. However, care must be taken not to
To command effectively, the human operator overload them with more information than is
must be involved. To assume the ultimate respon- necessary.
sibility and remain in command of the situation,
human operators must be involved in the operation. Functions must be automated only if there is a
They must have an active role, whether that role is good reason for doing so. There is a growing

PRINCIPLES OF
HUMAN-CENTRED AUTOMATION

The human bears the ultimate responsibility for the safety of the aviation system.
Therefore:
The human must be in command.
To command effectively, the human must be involved.
To be involved, the human must be informed.
Functions must be automated only if there is a good reason for doing so.
The human must be able to monitor the automated system.
Automated systems must, therefore, be predictable.
Automated systems must be able to monitor the human operator.
Each element of the system must have knowledge of the others' intent.
Automation must be designed to be simple to learn and operate.

31/5/05
No. 2
 Human Factors Training Manual

temptation to incorporate some new technology All unpredicted system behaviour must be treated
showpiece in a design just because it can be done as abnormal behaviour. To recognize this
rather than because it is necessary. In other words, behaviour, the human operator must know exactly
designs may be driven by technological feasibility what to expect of the automation when it is
rather than the needs of the users who must operate performing correctly.
and maintain the products of these designs. Auto-
mation of functions for no other reason except that Automated systems must also be able to monitor
it is technologically possible may result in the the human operator. Humans, of course, are not
user's inability to effectively employ it for the infallible either, and their failures may likewise be
benefit of the whole system. The question here unpredictable. Because human operators are prone
should be "not whether a function can be to errors, it is necessary that error detection,
automated, but whether it needs to be automated, diagnosis and correction be integral parts of any
taking into consideration the various Human automated aviation system. For this reason, it is
Factors questions that may arise".'' necessary that human as well as machine perform-
ance be continuously monitored. Monitoring auto-
The human must be able to monitor the auto- mation capable of questioning certain classes of
mated system. The ability to monitor the operator's actions that can potentially compromise
automated systems is necessary both to permit the safety must be designed into the system.
human operator to remain on top of the situation,
and also because automated systems are fallible. Each element of the system must have knowl-
The human can be an effective monitor only if edge of the others' intent. In highly automated
cognitive support is provided at the control station. operations, one way to keep the human operator
Cognitive support refers to the human need for actively involved is to provide him or her with
information to be ready for actions or decisions that information concerning the intent of the automated
may be required. In automated aviation systems, system. That is, given the current decisions made or
one essential information element is information about to be made by the automated systems, what
concerning the automation. The human operator will the situation look like in the future. Essentially,
must be able, from information available, to deter- the system should not only identify a potential
mine that automation performance is, and in all problem but also suggest alternative solutions and
likelihood will continue to be, appropriate to the show the implications of the action taken. Cross-
desired system situation. In most aviation systems monitoring can only be effective if the monitor
to date, the human operator is informed only if understands what the operator of the monitored
there is a discrepancy between or among the units system is trying to accomplish. To obtain the
responsible for a particular function, or a failure of benefit of effective monitoring, the intentions of the
those units sufficient to disrupt or disable the human operator or the automated systems must be
performance of the function. In those cases the known. The communication of intent makes it
operator is usually instructed to take over control of possible for all involved parties to work co-
that function. To be able to do so without delay, it operatively to solve any problem that may arise.
is necessary that the human operator be provided For example, many air traffic control problems
with information concerning the operations to date occur simply because pilots do not understand what
if these are not evident from the behaviour of the the controller is trying to accomplish, and the
system controlled. converse is also true. The automation of the ATC
system cannot monitor human performance effec-
Automated systems must be predictable. The tively unless it understands the operator's intent,
human operator must be able to evaluate the and this is most important when the operation
performance of automated systems against an departs from normality.
internal model formed through knowledge of the
normal behaviour of the systems. Only if the Automation must be designed to be simple to
systems normally behave in a predictable fashion learn and operate. One of the major objectives of
can the human operator rapidly detect departures this chapter is to consider how much automation is
from normal behaviour and thus recognize failures necessary, and why. If systems are sufficiently
in the automated systems. In so stating, it is simple (and this should always be a design goal)
important that not only the nominal behaviour, but automation may not be needed. If tasks cannot be
also the range of allowable behaviour be known. simplified, or are so time-critical that humans may

31/5/05
No. 2
Chapter 3. Human Factors issues in the
development and implementaiton of CNSIATM systems

not be able to perform them effectively, automation evolution of modern technology has made it practically
may be the solution. Even then, simpler automation impossible for one individual - the front-line operator -
will permit simpler interfaces and better human to cause an accident all alone. In those accidents where
understanding of the automated systems. Systems operator error has initially been identified as the causal
automation to date has not always been designed to factor, researchers were able to prove that the operator has
be operated under difficult conditions in an only triggered a chain of latent failures, long embedded in
unfavourable environment by overworked and the system, waiting undetected, or ignored for one reason
distracted human operators of below-average or another. A line of defence is built into modern-day
ability. Yet these are precisely the conditions where technology making it practically impossible for a single
the assistance of the automation system may be action to cause an unprecedented accident unless the
most needed. Simplicity, clarity and intuitiveness system has already been weakened by the elimination of
must be among the cornerstones of automation those defences. It has been proved that design deficiencies,
design, for they will make it a better and effective organizational and managerial shortcomings and many
tool. Though training, strictly speaking, is not the other latent failures were the root causes of many accidents
province of the designers, training must be consid- attributed to the front-line operators, who in most cases do
ered during the design of the components of the not survive the accidents to defend their actions.22
CNSIATM systems and should reflect that design in
3.6.2 Other accidents, also attributed to front-line
practice. Good Human Factors Engineering (HFE)
operators, were found to have been caused as a result of the
design is marked by an absence of problems in the
interaction of humans with automated systems (a mismatch
use of a system by humans and its effects are thus
of the human and machine elements of the system). Auto-
invisible in the final operational system. Its contri-
mation systems are made by humans. As such they can also
butions become an integral part of each component
harbour unplanned-for errors from as early as their concep-
or subsystem and cannot be readily isolated from
tion. The belief that better training will make up for
overall system functioning or credit to the HFE
unthought-of deficiencies in the design and development
inputs.21
stage has proved to be fallible. More gadgets and the
3.5.7 In establishing the basic guidelines for the introduction of more complex technology has only
principles of human-centred automation, it should be noted succeeded to make the machines inoperable because
that no attempt has been made to cover the engineering Human Factors considerations were not included in the
aspects of Human Factors. The attempt is only to construct basic concept. Human Factors researchers and specialists,
a philosophy of human-centred automation. By so doing, it accident investigators and analysts, human behaviour
is hoped to foster a dialogue which will further the overall specialists and experts studying human-machine interac-
goal of promoting a safe, orderly and economical aviation tions agree that making automation human-centred can
environment, integrating the best of both the human and the solve most human error associated problems. More impor-
machine. tantly, they believe that automation can be designed and
used to make the system, as a whole, more resistant to and
3.5.8 The principles of human-centred automation are tolerant of human errors in design, implementation, and
intended to serve as a template so that every time automa- operation of the systems. This implies that if automation is
tion is designed and introduced it can be filtered through to be an effective and valued component of the aviation
the template rather than justified and defended anew. system, it should also possess several qualities or character-
istics. By defining the attributes of human-centred automa-
tion, it is hoped that the system is made inherently and
distinctively useful to the human operator who, after all, is
3.6 QUALITIES OF HUMAN-CENTRED
burdened with full responsibility for its safety - human
AUTOMATION
and non-human. In defining the attributes an automation
system should possess, the intent once more is to promote
3.6.1 Human error has been identified as the major
dialogue on the subject, thus furthering the orderly and safe
causal factor in most aviation accidents. The most widely
operation of the entire air transportation system.
held perception, by people in all walks of life, is that the
error-causing human in those accidents is the "front-line 3.6.3 In discussing the attributes of human-centred
operator", simply stated as the pilot, air traffic controller, automation, it should be clear that they are not mutually
aircraft maintenance technician, etc. This perception, exclusive. An automated system that possesses some, or
fuelled by the media and widely accepted by the public, has even many, of these qualities may still not be fully eff~cient
caused a lot of anxiety because it conceals the fact that the if they are considered in isolation during design, for several

31/5/05
No. 2
1-3-20 Human Factors Training Manual

are interrelated. As in any engineering enterprise, it is Human-centred automation must be subordi-

necessary that the right compromise among the attributes nate. Except in predefined situations, automation
be sought. To be sure that an effective compromise has should never assume command and, in those situa-
been reached, the total system must be evaluated in actual tions, it must be able to be countermanded easily.
or under a simulated operation by a variety of human oper- Automation, while an important tool, must remain
ators of differing degrees of skill and experience. Such test- subordinate to the human operator. There are situa-
ing could be time-consuming and expensive and might tions in which it is accepted that automation should
often be conducted late in the development of the system; perform tasks autonomously, and more such tasks
nevertheless, it is the only way to prove the safety and are expected to be implemented in the CNSIATM
effectiveness of the automated concept. Thus, the first system. As automation becomes more self-
guideline in attributes of human-centred automation might sufficient, capable and complex, it will be increas-
simply be that human-centred automation should possess ingly difficult for the human operators to remain
these qualities in proper measure. aware of all actions being taken autonomously and
thus increasingly difficult for them to be aware of
3.6.4 Many of these attributes are to some extent exactly what the automation is doing and why. Such
bipolar, though not truly 0 ~ ~ o s i t e s ,and
2 ~ increasing the a situation will tend to compromise the command
attention on certain qualities may require de-emphasizing authority and responsibility of the human operators;
others. In the manner suggested, human-centred automation more importantly, it may lead them to a position of
must be: extreme distrust of the automation system, which
could compromise the integrity of the entire
human-machine system. It is important to make
Accountable <---------->Subordinate questions such as "What is it doing?'and "Why is
Predictable <----------> Adaptable it doing that?'unnecessary.
Comprehensible <----------> Flexible
Dependable <----------> Informative Human-centred automation must be predictable.
Error-resistant <---------->Error tolerant Occurrences in which automation did not appear to
behave predictably have, in the past, led to major
repercussions due in large part to human operators'
Human-centred automation must be account-
inherent distrust of things over which they do not
able. Automation must inform the human operator
have control. Here again, the level of abstraction at
of its actions and be able to explain them on
which automation is explained, or at which it
request. The human in command must be able to
provides explanation, is critical to the establishment
request and receive a justification for decisions
and maintenance of trust in it. The third question
taken by the automated system. This is a particular
most often asked by human operators of automation
problem in aviation, as there may not be time for
is "What's it going to do next?'. This question, like
the human operator to evaluate several decisions
the two above, should also be made unnecessary.
(terrain avoidance, collision avoidance, etc.).
As automation becomes more adaptive and intelli-
Where possible, automation must anticipate the
gent, it will acquire a wider repertoire of behaviours
human operator's request and provide advance
under a wider variety of circumstances. This will
information (as TCAS intends to do by providing
make its behaviour more difficult for human oper-
traffic advisories prior to requiring action to avoid
ators to understand and predict, even though it may
an imminent hazard), or its rules of operation in a
be operating in accordance with its design specifi-
particular annunciated circumstance must be
cations. It will also be more difficult for human
thoroughly understood by the human operator. It is
operators to detect when it is not operating
particularly important that explanations provided by
properly. Advanced automation must be designed
automation be cast in terms that make sense to the
both to be, and to appear to be, predictable to its
human operator; the level of abstraction of such
human operators, and the difference between failure
explanations must be appropriate to the human
and normal behaviour must be immediately
operator's need for the explanation. In this context
apparent to the human operator.
"accountable" means subject to giving a justifying
analysis or explanation. The bipolar attribute of Human-centred automation must be adaptable.
accountability is subordination. Great care must be Automation should be configured within a wide
taken to ensure that this cannot ever become range of operator preferences and needs. Adaptabil-
insubordination. ity and predictability are, in a sense, opposites, as
Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

highly adaptive behaviour is liable to be difficult to complex functions appear simpler to the human
predict. As automation becomes more adaptive and operator, the consequences of failure modes can
intelligent, it will acquire a wider repertoire of appear to be highly unpredictable to that human
behaviours under a wider variety of circumstances. operator unless the modes are very thoroughly
This will make its behaviour more difficult for the considered in the design phase. Simplicity has not
human operator to understand and predict, even been included as a necessary attribute for human-
though it may be operating in accordance with its centred automation, but it could well have been. It
design specifications. It will also be more difficult is vital that systems either be simple enough to be
for the human operator to detect when it is not understood by human operators, or that a simplified
operating normally. This suggests the necessity for construct be available to and usable by them. If a
constraints on the adaptability of automation to system cannot be made to appear reasonably simple
permit the human to monitor the automation and to the human operator, the likelihood that it will be
detect either shortcomings or failures in order to misunderstood and operated incorrectly increases
compensate for them. "Adaptable", as used here, significantly. CNSIATM systems automation
means capable of being modified according to designers and manufacturers should make a consid-
changing circumstances. This characteristic is erable effort to make their products simple enough
incorporated in aircraft automation: pilots need, and to be comprehended by human operators of widely
are provided with, a range of options for control differing skill levels.
and management of their aircraft. Similar options
Human-centred automation must be flexible. An
should also be available in CNSIATM system
appropriate range of control and management
automation. The range of options is necessary to
options should be available. The term "flexible" is
enable the human operators to manage their work-
used here to characterize automation that can be
load (taking into account differing levels of
adapted to a variety of environmental, operational
proficiency) and compensate for fatigue and
and human variables. A wide range of automation
distractions. In this regard, automation truly acts as
options must be available to provide flexibility for
an additional member of the control and manage-
a wide range of human operators with experience
ment team, assisting with or taking over entirely
that varies from very little to a great deal and
certain functions when instructed to do so. Adapta-
cognitive styles that vary as widely. Given the
bility increases apparent complexity and is shown
tendency to an inverse relationship between
here contrasted with predictability, to emphasize
comprehensibility and flexibility, comprehensibility
that extremely adaptable automation may be rela-
must not be sacrificed for flexibility, because the
tively unpredictable in certain circumstances. If
ability of the human operators to understand their
such a system is not predictable, or if it does not
automation is central to their ability to maintain
provide the human operator with sufficient indica-
command.
tion of its intentions, its apparently capricious
behaviour will rapidly erode the trust that the Human-centred automation must be dependa-
human wishes to place in it. It is good to remember ble. Automation should do, dependably, what it is
that one of the first principles of human-centred ordered to do, it should never do what it is ordered
automation states that automation must be predicta- not to do and it must never make the situation
ble, if the human is to remain in command. worse. Humans will not use, or will regard with
suspicion, any automated system or function that
Human-centred automation must be comprehen- does not behave reliably, or that appears to behave
sible. Technological progress is often equated with capriciously. This distrust can be so ingrained as to
increased complexity. Many critical automation nullify the intended purpose of the designer.
functions are now extremely complex, with several Dependability is of a particular importance with
layers of redundancy to insure that they are fault- respect to alerting and warning systems. Mistrust of
tolerant. It has been noted that training for legitimate warnings by systems which were prone
advanced automated systems is time-consuming to false warnings (such as early models of GPWS,
and expensive, and that much of the extra time is MSAW and STCA) have in the past resulted in
spent learning about the automation. Simpler tragic consequences. In fact, it may be wiser to omit
models that permit reversion in case of failures a function entirely, even a strongly desired function,
should be devised. This will result in training rather than to provide or enable it before it can be
benefits. While automation can be used to make certified as reliable.
 Human Factors Training Manual

Human-centred automation must be informa- fact that human or automation error has occurred.
tive. Information is critical both for involvement in Such warnings must be provided with enough time
the task and for maintaining command over it. If a to permit human operators to isolate the error, and
system were perfectly dependable in operation, a means must be provided by which to correct the
there might be no need to inform the human oper- error once it is found. Where this is impossible, the
ator of its operation. Perfection is impossible to consequences of an action must be queried before
achieve, however, and the information provided the action itself is allowed to proceed.
must be as nearly foolproof as possible, bearing in
Human-centred automation must be error-
mind that each increase in information quantity
tolerant. Some errors will occur, even in a highly
makes it more likely that the information may be
error-resistant system; therefore, automation must
missed, or even incorrect. One of the first principles
be able to detect and mitigate the effect of these
of human-centred automation is that "in order to be
errors. Since error-resistance is relative rather than
involved the human must be informed." But, how
absolute, there needs to be a "layered defence"
much information is enough? How much is too
against human errors. Besides building systems to
much? Human operators want all the information
resist errors as much as possible, it is necessary and
they can get, but they cannot assimilate too much,
highly desirable to make systems tolerant of error.
and what they will leave out is unpredictable. It is
In this sense, "tolerance" means the act of allowing
desirable to declutter and simplify displays and
something; it covers the entire panoply of means
format changes; in short, to provide for active as
that can be used to ensure that when an error is
opposed to passive information management, to
committed, it will not be allowed to jeopardize
assist the human operator in assigning priorities to
safety. The aviation system is already highly
ensure that the most important things are attended
tolerant of errors, largely through monitoring by
to first. Problems may, once again, arise because of
other team members. But certain errors possible
automation itself, or simply because the interfaces
with automated equipment, such as data entry
between the automation and the human are not
errors, may only become obvious long after they
optimal. The form of information will often deter-
have been committed. New monitoring software,
mine whether it can be attended to or not and it
displays and devices may be required to trap the
should be considered during the development of
more covert errors. In such cases, checks of actions
any CNSIATM information system.
against reasonableness criteria may be appropriate.
Given that it is impossible either to prevent or trap
Human-centred automation must be error-
all possible human errors, previous aviation
resistant. Automation must keep human operators
occurrences and especially incident data can be
from committing errors wherever that is possible.
extremely useful in pointing out the kinds of errors
Ideally, the ATM automation system should prevent
that occur with some frequency.
the occurrence of all errors, both its own and those
of the human operators. This may be unrealistic, 3.6.5 The attributes of a human-centred automation
but a system can and must be designed to be as suggested above are not mutually exclusive; there is
error-resistant as possible. Resistance to error in overlap among them. The first principles suggest a rough
automation itself may involve internal testing to prioritization where compromise is necessary. It is stated
determine that the system is operating within its that if humans are to be in command, they must be
design guidelines. Resistance to human error may informed. Accountability is an important facet of informing
involve comparison of human actions with a the human operator, as well as an important means by
template of permitted actions, or may be based on which the operator can monitor the functioning of the
clear, uncomplicated displays and simple, intuitive automation. Comprehensibility is another critical trait if the
procedures to minimize the likelihood of errors. human is to remain informed; he or she must be able to
Automation of unavoidably complex procedures is understand what the automation is doing. Each of these
necessary and entirely appropriate, provided the traits is an aspect of informativeness. At all times, the
human is kept in the loop so he or she understands human operator must be informed effectively of at least that
what is going on. The system must be able to be minimum of information, and informed in such a way that
operated by the human if the automation fails, and there is a very high probability that the information will be
it must provide an unambiguous indication that it is assimilated. In those cases where an automated system acts
functioning properly. It is also essential to provide in an unpredictable manner, an explanation should be read-
means by which human operators can detect the ily available if it .is not already known or fairly obvious.
Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

3.6.6 With the inevitable exceptions, regulators and that the most important facet of the whole system is the
the public-at-large agree that humans bear the ultimate human who operates, controls or manages the whole
responsibility for the safety of the civil aviation system. system in pursuit of human and social objectives.
This suggests that humans must remain in full command of
the whole system. However, despite this assertion, it is 3.6.8 Generally speaking, automation evolution to
thought that the independence of automation may tend to date has been largely technology-driven. However, design-
bypass the human operator as more and more of the ground ers of new aircraft and other aviation systems in recent
elements of the air transportation system are automated. years have made a determined attempt to help humans do
Automation that bypasses the human operators will of what they may not do well in the press of day-to-day
necessity diminish their involvement in the aviation system operations. In doing so they have helped to eliminate some
and their ability to command it, which in turn will diminish causes of human error, while enabling others directly
their ability to recover from failures or compensate for associated with the new technology.
inadequacies in the automated subsystems. Automation
designers should conclusively prove that such inadequacies 3.6.9 The CNSIATM system permits more flexible
will not exist or such failures will not occur before the and efficient use of airspace and enhances traffic safety.
aviation community can consider automation systems The air traffic management enhancements include:
which can bypass the human operator. It is important that a
balance be struck; where compromises are necessary, they improved handling and transfer of information
must err on the side of keeping the human operator in the between operators, aircraft and ATS units;
loop so that he or she will be there when needed. This point
improved communications between controllers and
is also made by Billings (1997):
pilots by the use of data link technology (CPDLC);
Pilots and air traffic controllers are essential because they extended surveillance (automatic dependent
are able to make good decisions and take appropriate surveillance (ADS), etc.); and
actions in difficult situations. We have not yet devised a
computer that can cope with the variability inherent in the advanced ground-based data processing systems,
flight and air traffic environment. including systems to display ADS-derived data and
aircraft-originated data to the controller allowing
3.6.7 Despite spectacular technological advances in for;arnong other things, improvement in conflict
automation, the effectiveness of automated and computer- detection and resolution, automated generation and
ized systems remains inextricably linked to the perform- transmission of conflict-free clearances, and rapid
ance capabilities of human operators. ATM automation will adaptation to changing t r f i c conditions.
force drastic changes in the role of the human operator; it
may also cause major changes in the process by which air 3.6.10 The development of the basic aims of the
traffic controllers and pilots work together to accomplish CNSIATM system including that of advanced aviation
the mission in a most safe manner. If an automated ATM systems, together with improved planning, is expected to
system inhibits the ability of controllers and pilots to work enhance safety and allow more dynamic use of airspace and
cooperatively to resolve problems, it will severely limit the air traffic management. In doing so, it is obvious that more
flexibility of the system, and the loss of that flexibility automation will be required and utilized. The challenge is
could undo much of the benefit expected from a more auto- to develop a system based on the principles of human-
mated system. In this context, advanced automated or centred automation which takes into account human capa-
computerized systems in the CNSIATM system should be bilities and limitations and in summary suggests that:
designed to help humans accomplish new and difficult
tasks and safely challenge the needs and requirements of
Humans must remain in command of flight and
air traffic operations. Automation can assist by
tomorrow. Over time, technology intended to increase
providing a range of management options.
safety margins has been used to increase .throughput,
leaving safety margins relatively unchanged. If humans are Human operators must remain involved. Auto-
to remain fully responsible for system safety, automation mation can assist by providing better and more
should not be used to increase system throughput beyond timely information.
the limits of human capability to operate manually in the
event of system automation failure. In developing the Human operators must be better informed.
various components of the CNSIATM system, designers Automation can assist by providing explanations of
and manufacturers as well as regulators should remember its actions and intentions.

31/5/05
No. 2
1-3-24 Human Factors Training Manual

Human operators must do a better job of ICAO Annex 11 - Air TrafSic Sewices (13th edition),
anticipating problems. Automation can assist by Montreal, 2001,
monitoring trends, making predictions and provid- ICAO Doc 9583 - Report of the Tenth Air Navigation
ing decision support. Conference, Montreal, 1991.
ICAO Doc 9758 - Human Factors Guidelines for Air
Human operators must understand the automa- Traffic Management Systems, Montreal, 2000.
tion provided to them. Designers can assist by Institute of Electrical and Electronics Engineers (IEEE),
providing simpler, more intuitive automation. "Too Much, Too Soon: Information Overload".
Human operators must manage all of their Spectrum, New York, June 1987, pp. 51-55.
resources effectively. Properly designed and used, Isaac, A.R. "Mental Imagery in Air Traffic Control". The
automation can be their most useful resource. Journal of Air Traffic Control, Vol. 34, No. 1, 1992,
pp. 22-25.
3.6.11 All concepts presented in this chapter go Lane, N.E. "Evaluating the Cost Effectiveness of Human
beyond theory; they can be put to very practical use. The Factors Engineering". Institute for Defence Analysis
goal is to influence the design of human-machine systems Contract MDA 903 '84 C 0031. Essex Corporation.
so that human capabilities and limitations are considered Orlando, Florida, 1987.
from the early stages of the design process and are Margulies, E and H. Zemanek. "Man's Role in Man-
accounted for in the final design. A design that considers machine Systems". In Analysis, Design, and Evaluation
such issues will result in a system that enhances safety, of Man-machine Systems, Proceedings of the
prdductivity and job satisfaction. The Human Factors IFAC/IFIP/FFORS/IEA Conference. G. Johannsen and
profession can provide system designers who possess all J.E. Rijnsdorp (eds.). Pregamon Press, New York,
the necessary expertise and know-how to incorporate these 1982.
principles during design. Orlady, H.W. "Advanced Technology Aircraft Safety
Issues". Battelle ASRS Office unpublished report.
Mountain View, California, 1989.
LIST OF REFERENCES Palmer, E., C.M. Mitchell and T. Govindaraj. "Human-
centered Automation in the Cockpit: Some Design
Bainbridge, L. "Ironies of Automation". In Analysis, Tenets and Related Research Projects". ACM SIGCHI
Design, and Evaluation of Man-machine Systems, Workshop on Computer-Human Interaction in
Proceedings of the ZFAC/ZFZP/FFORS/ZEA Conference. Aerospace Systems. Washington, D.C., 1990.
G. Johannsen and J.E. Rijnsdorp (eds.). Pregamon
Panel on Human Factors in Air Traffic Control Automa-
Press, New York, 1982, pp. 129-135.
tion. "The Future of Air TraJjc Control: Human
Billings, C.E. "Aviation Automation - The Search for a
Operators and Automation". National Research Coun-
Human-Centered Approach." Lawrence Erlbaum
cil, National Academy Press, Washington, D.C., 1998.
Associates, Mahwah (NJ), USA, 1997.
Patterson, W.P. "The Costs of Complexity". Industry Week,
Billings, C.E. "Human-centered Aircraft Automation: A
6 June 1988, pp. 63-68.
Concept and Guidelines". NASA Technical Memoran-
dum 103885. National Aeronautics and Space Admin- Perrow, C. Normal Accidents: Living with High-risk
istration, Washington, D.C., 1991. Technologies. Basic Books, Inc., New York, 1984.
Billings, C.E. "Toward a Human-centered Automation Pfeiffer, J. "The Secret of Life at the Limits: Cogs Become
Philosophy". Proceedings of the Fifth International Big Wheels". Smithsonian, Vol. 27, No. 4, 1989,
Symposium on Aviation Psychology. Columbus, Ohio, pp. 38-48.
1989. Price, H.E. "The Allocation of Functions in Systems".
Clegg, C., S. Ravden, M. Corbett and G. Johnson. "Allocat- Human Factors, Vol. 27, No. 1, 1985.
ing Functions in Computer Integrated Manufacturing: Price, H.E. "Conceptual System Design and the Human
A Review and New Method." Behaviour and Znforma- Role". MANPRINT Harold R. Booher (ed.). Van
tion Technology, Vol. 8, No. 3, 1989, pp. 175-190. Nostrand Reinhold, New York, 1990.
Davis, B. "Costly bugs: As Complexity Rises Tiny Flaws in Reason, J. Human Error. Cambridge University Press,
Software Pose a Growing Threat". Wall Street Journal. United Kingdom, 1990.
1987. Ruitenberg, B. "Certification of ATC equipment - an
Dekker, S. and Hollnagel, E. "Coping with Computers in oversight in oversight?" Paper presented at the Fifth
the Cockpit". Ashgate Publishing Ltd, Aldershot, Acstralian Aviation Psychology Symposium, Manly,
Hants, UK, 1999. Australia, 2000.
 Chapter 3. Human Factors issues in the
development and implementaiton of CNS/ATM systems

Schwalm, H.D. and M.G. Samet. "Hypermedia: Are We in Wiener, E.L. "Fallible Humans and Vulnerable Systems:
for "Future Shock'?'Human Factors Bulletin, Vol. 32, Lessons Learned from Aviation". Information Systems:
- No. 6, 1989. Failure Analysis. Wise, J.A. and A. Debons (eds.).
Wiener, E.L. "Management of Human Error by Design". NATO AS1 Series, Vol. F-32, Springer-Verlag, Berlin,
Human Error Avoidance Techniques Conference 1987.
Proceedings. Society of Automative Engineers, Inc., Wiener, E.L. and R.E. Cuny. "Flight-deck Automation:
1988. Promises and Problems". NASA TM 81206. Moffett
Wiener, E.L. "Human Factors of Advanced Technology Field, California, 1980.
('Glass Cockpit') Transport Aircraft". NASA Contrac- Zuboff, S. "In the Age of the Smart Machine". Basic
tor Report 177528. National Aeronautics and Space Books, Inc., New York, 1988.
Administration, Washington, D.C., 1989.

31/5/05
No. 2
 CHAPTER 4
ERGONOMICS

4.1 INTRODUCTION nomics in aviation safety. It is intended to provide basic

knowledge -as well as a source of information -which
4.1.1 Ergonomics has been applied in the design of will enable the reader to call upon the proper expertise
tools, even in an elementary way, since the beginning of when so required. It also intends to convey, in simple
civilization. In aviation. the focus in the early pioneering language, the current state-of-the-art information available
days - and for many years aftenvards - was on from States. and to encourage the use of available educa-
advancing some general principles to guide the design of tion and training.
flight deck displays and controls. This later broadened into
the experimental analysis of the design and layout of This chapter:
equipment, in close association with the analysis of the
demands and workload that thc equipment and tasks presents the basic facts about ergonomics.
imposed upon the human operator. Today's approach to including the difference between ergonomics and
design takes the user's characteristics (capabilities, Human Factors;
limitations, and needs) into consideration early on in the
system development process, and subordinates engineering discusses human capabilities that should be taken
convenience to them. The terms "user-friendly" and "error into account in equipment design;
tolerant'. referring to modem equipment, reflect this
intent. discusses the design of displays and controls, and
how they are integrated into the flight deck;
4.1.2 It cannot be denied that technological progress
has occurred, nor that such progress has enhanced flight
refers to environmental stresses of relevance to
safety. but operational experience indicates that human
ergonomics.
error is still induced to a significant extent by short-
comings in equipment design or in the pmedures used to
operate the equipment. Only by taking into account appro-
priate Human Factors considerations in system design can
4.2 BASIC FACTS ABOUT
safety be further enhanced. It would be misleading.
ERGONOMICS
however, to propose that safety in the system can be
achieved through design improvement alone: as Chapter 2
advocates, a systems approach to aviation safety is
Introduction
required.
4.1.3 This chapter addresses Human Factors issues 4.2.1 While in many countries the terms ergonomics
relative to the interface between humans and machines in and Human Factors are used interchangeably, there is a
aviation. This interface has traditionally been viewed as small difference in emphasis. Human Factors has acquired
presenting simple "knobs and dials" solutions to Human a wider meaning, including aspects of human performance
Factors problems. In some cases, these solutions could be and system interfaces which are not generally considered
found by looking at the appropriate table, but an under- in the mainstream of ergonomics. Chapter 1 proposes that
standing of how to solve Human Factors problems with the two terms be considered synonymous, to preclude
respect to the human-machine interface within the aviation dwelling on academic or semantic considerations and to
system is more than learning how to look at tables, avoid confusion: however, it indicates that the term
especially since such simple solutions may not be valid for ergonomics is used in many States to refer strictty to the
all situations. study of human-machine system design issues. From this
perspective, ergonomics is the study of the principles of
4.1.4 The purpose of this chapter is to increase the interaction between human and equipment, for the purpose
awareness of the pervasiveness and influence of ergo- of applying them in design and operations. Ergonomics
1-4-2 Human Factors Training Manual

studies human attributes, determining what requirements the system (the L H interface), while taking into consider-
in hardware and software result from the characteristics of ation the characteristics of all system components (e.g. the
the activities involved. It attempts to solve the problem of environment as well as the software).
adapting technology and working conditions to humans.
Throughout this chapter. this latter concept of ergonomics 4.2.3 A simplified representation of the person-
has been adopted, and as such. it is clearly differentiated machine system is shown in Figure 4-1. The machine
from Human Factors. componenr is displayed on the right. Displays (e.g. visual
and auditory) inform the human about the status of the
internal system or about conditions external to the system,
A systems approach while controls allow the human to effect changes in the
to safety system status. The hwnan component of the system is
shown on the left side of Figure 4-1. Information
4.2.2 Safety in aviation through design can best be displayed must be perceived and processed by the human,
achieved following a system approach strategy. A system and then conscious decisions may be made. Motor
approach-is a way of breaking down the "real world" into responses may be sent to effect changes in control settings.
identifiable componenu. and looking at how these The line depicted in Figure 4-1 separating the machine and
components interact and integrate. The Liveware-Hardware human represents the human-machine inreflace.
interface in the SHEL model, inuoduced in Chapter 1, can Information travels h u g h this interface in both
he seen as a lruman-mactrine sysrem, comprising people directions; ergonomics is very much concerned with
and machines interacting in an environment in order to geuing the information across this interface, and the
achieve a set of system goals. Ergonomics will try to ergonomist must ensure that displays and controls are
optimize the interaction between people and machines in compatible with human capabilities and task needs.

Figure 4-1. Representation of a person-system machine

(adapted from Meister, 1979)
 Chapter 4. Ergonamics

4.2.4 System goals must be defined before a person- a loaded term implying blame. Moreover. the word "error"
machine system can be specified and designed. These implies deviation from a definable correct or appropriate
goals. together with the identified operational constraints, behaviour. In fact, appropriate behaviour is often difficult
spell out the conditions within which the person-machine to define, and human error is increasingly being postulated
system will function. Operation of the system outside this as a symptom of deficiencies in equipment design or
set of conditions may lead to unsafe conditions. system performance rather than a cause in itself. Despite
these cautions, human error continues to be an important
4.2.5 Another imponant task of the ergonomist is concept in understanding the nature of and the factors
the allocation of functions and tasks to the human and affecting human behaviour, and various classifications of
machine components. The system design team (including human errors have been proposed by different authors.
the ergonomist) decides what functions should be given to
the hardware and software and to the human, based on
4.2.8 To niinimize human error, one must first
considerations such as human characteristics, task'needs,
understand its nature. There are basic concepts associated
workload, costs, training requirements, and technologies
with the nature of human erroc the origins and fre-
available. Functions allocated inappropriately may jeopar-
quencies of errors can befindamentally differenr, and the
dize system effectiveness and safety. The tendency to
consequences of errors can also be signi&antly different.
compare human and machine, in terms of the functions for
While some errors may be due to carelessness, negligence
which humans are superior to machines vis-8-vis those for
or poor judgement. many are induced by poorly designed
which machines are superior to humans. should not be
equipment or may result from the normal reaction of a
allowed to lead to a simplistic allocation of functions
person to a stressful situation. Emrs due to poor
entirely to the human or the machine. Humans and
equipment design or stressful situations are likely to be
machines should be complemenrary in the accomplishment
repeated and can be remedied through the practice of
of tasks. Furthermore, this complemcntarity should be
ergonomics.
designed with adequate flexibility so that function alloca-
[ion can be adapted to various operational situations (from
routine flight to emergencies). 4.2.9 Each of the interfaces in the SHEL model has
a potential for error where there is a mismatch between its
4.2.6 Theergonomist must proceed systematically in components. For example:
order to achieve the desired system goals. The following
set of example questions illustrates how an ergonomist
may proceed when designing systems:
- The Liveware-Hardware interface is a frequent
source of error: knobs and levers which are poorly
located or improperly coded create mismatches at
What inputs and outputs must be provided to
this interface.
satisfy systems goals?
What operations are required to produce system . In the Liveware-Sofnare interface. delays and
errors may occur while seeking vital information
outputs?
. What functions should the person perform in the
system?
fmm confusing, misleading or excessively cluttered
documentation and cham. Problems can also be
related to information presentation and computer
software design.
What are the training and skills requirements for
he human operators? Errors associated with the tiveware-Environment
Are the tasks demanded by the system compatible interface are caused by environmental factors such
with human capabilities? as noise, heat, lighting, air quality and vibration
and by the disturbance of biological rhythms.
What equipment interfaces does the human need to
perform the job? In the Liveware-tiveware interface, the focus is on
the interanion between people because this process
A system designed without proper regard to these may affect crew and system effectiveness. This
questions may end up like the one shown in Figure 4-2. interaction also includes leadership and command.
shortcomings in which may reduce operational
efficiency and cause misunderstanding and erron.
Control of human error

4.2.7 Human error is a very complex issue. This Considerations which prevent errors such as these are in
term must be used judiciously, as it may be perceived as the mainstream of ergonomics.
 1-4-4 Human Factors Training Manual

Figure 4-2. If the soap falls out of the bathtub, try thii!
(adapted from The Best of Rube Goldberg, compiled by Charles Keller, PrenticeHall, 1979)

4.2.10 The control of human error requires two considered to be the most important sensory system by
different approaches. First, it is desirable to minimize the which humans acquire information from external sources.
occurrence of errors (total elimination of human error is No attempt will be made to discuss the anatomy of the
not a realistic goal, since errors are a normal part of visual system, since it is described in many standard texts.
human behaviour). For example, errors may be reduced by The emphasis is to highlight the visual system at work,
ensuring a high level of staff competence; by designing what it does and does not do. Visual performance depends
controls and displays so that they match human character- on several factors: some are internal to the visual system
istics; by providing proper checklists. procedures, manuals, (i.e. visual acuity. accommodation and convergence,
maps and cham; by controlling noise, vibration, tempera- adaptation to light and darkness, perception of colours,
ture exvemes and other stressful conditions; and by etc.), while others are external and include variables such
providing mining and awareness programmes aimed at as task, target, and environmental characteristics (e.g. light
increasing co-operation and communication among crew intensity, conmst, size. location, movement and colour).
members. The second approach in the control of human All of these factors interact to determine the accuracy and
error involves minimizing the impocr or consequences of speed of human visual performance. An understanding of
ermrs by providing safety buffers such as cross- these human and system factors will enable the ergonomist
monitoring, crew co-operation and fail-safe equipment to predict and optimize system performance in a variety of
design. operational conditions.

4.3.2 It is convenient to separate visual functions

4.3 HUMAN CAPABILITIES into its three component senses: light, form, and colour.
The eye is capable of functioning over a wide range of
The visual system light intensities, from faint starlight over full moon to
bright sunshine. The eye requires time to adjust to varying
4.3.1 The visual system (i.e. the eyes and the levels of light intensity because the mechanism involved
associated parts of the nervous system) is generally is a photochemical process. When adapting fium dark to
 Clraprer 4. Ergonomics

l ~ g h tthe eye adjusts rapidly, whereas in adapting from normal vision, and 20140 means that the individual can
light to dark the adjustment is slow. The adaptation read at only 20 feet what a normal person would read at
involves three processes. First, the amount of light that can 40 feet. Absolute brightness, brightness conuast, time to
enter the eye (and thus reach the retina) is regulated by view the object, movement and glare are among the
pupil size: pupil size increares when a person uies to see facton which affect visual acuity.
in the dark and decreases while in brighter light. Secondly,
a photochemical process occurs when light intensity 4.3.4 To see an object sharply, the eye must focus
changes. Thirdly, two mechanisms function at different on it. When focusing on objects between infinity and 5-6
light intensity levels: rod vision, based on the function of mztres. the normal eye does not change, but when focus-
the peripheral light percepton in the retina, the rods, ing on objects at a shorter distance (less than c. 5 metres).
operates from the threshold up to moonlight level; here two things happen: the eyes accommodate (i.e. they adjust
form acuity is poor and colours cannot be discriminated. thcir refractive state to correspond to the distance to the
From early morning lightlevel, cone vision. based'on the object), and the eyeballs turn inwards s o that lhe visual
function of the central light perceptors in the retina, the axes of the two eyes converge on the object. When visual
cones. takes over and form acuity and colour perception clues are weak or absent (e.g. empty space). the muscles
become g d . At the transitional stage, roughly corres- controlling accommodation and convergence adjust by
ponding to full moonlight, both rods and cones are func- themselves to a distance of c. one metre ("empty space
tioning. Another important feature of rod and cone vision myopia"). This will significantly affect visual performance
is their different spectral scnsitivity, easily detected at dusk when a person is looking for distant objects and visual
when red colours turn dark before other colours change. cues are weak, as is the case when q i n g to spot reported
due to the relative insensitivity of the rods to red light. A traffic from a flight deck.
rcsult of this double mechanism for light appreciation is
that. to detect dim lights. one must look off-centre. To 4.3.5 Spatial orientation involves both the visual
endeavour to protect night vision by preserving rod function and the vestibular apparatus ("balance organ") of
adaptation (red cockpit lighting) is to a large extent the inner ear. Proprioception ("seat of the pants") plays a
illuso~yas very few flight tasks can be performed with rod role too. but it is less important. It is also influenced by
vision. past experience. Figure 4-3 presents a simplified model of
this activity.

In November 1979, a DGlO on a sightseeing

flight over the Antarctic crashed into the side of In June 1988, an Airbus A320 crashed in
a 12 000 f l volcano. The aircraft had descended MulhouseHabsheim, France, during a flight.
below the overcast at 6 000 ft to provide the The report of the InvestigationCommission
passengers with a view of the ice pack below. includes the following rematks on the subject of
Incorrect navigation coordinates loaded into the visual misjudgment: Whereas he [the captain]
Inertial Navigation System (INS) put the aircraft was accustomed to using 2 000- to 3 000-111
25 miles off the correct track; however, the crew long runways wilh approximately 100-ff high
failed to spot the slopes of the volcano in a control towers, he found himself on an 8Mkn
condition with 70 km visibility. Close examination long gmss strip with a a f t high tower; the
of the effects of visible and invisible texture on scale effect may have created a false
visual perception, and the illusion caused by impression." The report also mentions that the
sector whiieout can offer an explanation very high nose-up attitude, given the
regarding why the crew did not see the approaching maximum angle-of-attack, would
obstacle. have put the pilot's eye-level particularly high
compared with the rest of the airplane. The first
Source: ICAO ADREP Summary 8011. tree impact involved the rear fuselage.

Source: ICAO ADREP Summary 880.

4.3.3 Visual acuity is the ability of the visual system
to rcsolve detail. It can b e expressed in various notations,
commonly, it is expressed in terms related to the smallest
lelter an individual can read from a Snellen chart at 20 43.6 The eye ususually conveys the information
feet compared with the distance at which a "normal" sensed fairly faithfully. Ambiguity and uncertainty may
person can read the same letter. For example. 20120 is occur. however, when this sensed information is processed
 1-4-6 Human Factors Training Manual
--

motion feedback

motion
---+

visual
__f

L
Figure 4-3. A simplified model illustrating some of the components
involved in visual perception (adapted from Hawkins. 1987)

by the brain and combined with emotional factors, past 4.3.7 The failure to respond to a visual stimulus
learning. experience or expectation. Thcse factors ate even when clearly perceived may be due to fascination
included in the mind set. which is well reflected in the (i.e. conning of attention). In such a case, the pilot
popular saying that one sees what one expects to see. For concenttates on one flight insmment - far example, the
example. a warning light indicating system failure may be -
flight director and disregards other imponant informa-
correctly sensed, but a pilot's past experience with tion to which the pilot should respond. Fascination occurs
nuisance warnings may suggest that the warning is based not only under conditions of high workload. but also when
on a faulty signal and can therefore be ignored. workload is low and tedium prevails.

-
A de HavillandDHC6-3CQ Twin Otter, hauling a diamond drill and
crew, was approaching to land onto a 700-ftlong esker (an esker
is a geological formation like a sand bar) near Concession Lake,
Yellowknie, Canada The aircraft touched down in a ravine, 65 ft
short The pilot had never landed in this particular esker before
and he did not notice an &degree upslope, resulting in a flat
approach.

Source: ICAO ADREP Summary 891381.

 Chapter 4. Ergonomics

4.3.8 Visual illusions of one kind or another have 4.3.10 Impaired hearing may be a result of the
been experienced by all flight deck crew members. For connection between the middle ear and the mouth/nosc
many years physiologists and psychologists have been being blocked (e.g. due to a common cold). It may also be
proposing theories to explain them, and such studies and caused by the deposit of new bone or calcium material in
general information on visual illusions in aviation can be the ossicles or by infections in the middle ear causing
found elsewhere. For the purpose of this chapter, it is accumulation of fluid which dampens the movement of
enough to emphasize human vulnerability to these sound-transmi~ting components. Long-term exposure to
phenomena. loud noise (such as that from machinery or aircraft
engines) may damage permanently nerves in the inner ear.
Disease conditions such as brain tumours and strokes can
interfere with the functioning of the hrain region which is
A Cessna C i i o n was descending from FL330 , associated with hearing. Lastly, hearing ability generally
for a visual night landing at Stornoway, UK, in deteriorates with age.
December 1983. The aircraft was observed on
the radar display continuing a steady descent to 4.3.11 There are four primary characteristics of
sea level, where the radar trace disappeared, 10 sound in speech: intensily (sound pressure level), which is
mi from its destination. The night was very dark, measured in decibels (dB) and results in the subjective
and there was a layer of stratus clouds behveen sensation of loudness: frequency, which is measured in
1 MH) and 3 MX) It. Radar recordings indicate h e m (Hz) or cycles per second and produces the sensation
that at about 3 OM)ft, the pilot reduced to of pitch; harmonic composirion, which refen to the quality
approach speed, lowered the flaps and gear and of speech; and the rime factor, which reflects the speed at
descended very rapidly. All occupants died of which words are spoken, the length of the pauses, and the
drowning, indicating a non-violent impact with time spent on different sounds.
the sea. No evidence was found from the
partially recovered wr&age indicating engine
or airframe failure. The approach over the dark 'On arrival to work I cl~rnbinto a helicopter
sea towards a rghted area fostered conditions (worth about three million pounds) and am
COnducive to visual illusions. -
subjected to appalling noise levels even
allowing for the use of a good headset AND
Source: ICAO ADREP Summary 8511. earplugs, very aggravating levels of vibration, an
excruciatingly uncornfottable seat, a cockpit
-
heater that works flat out or not at all etc..
etc. The k t goes on and on. Why has the situa-
tion been allowed to come about? How can this
The vocal and auditory systems
situation be resolved? ..."
4.3.9 The vocol system generates speech. which is
Source: CHIRP kedbackNo. 10, April 1986
[Feedbackis the periodic bulletin of the United
the result of the interaction of several of its components.
Kingdom CAA Confidential Human Factors
Different voices utilize different ranges of pitch and
Incident Report (CHIRP)].
frequency, and although there are many ways in which
speech can be deformed, so long as the pattern of fre-
quency remains intacL the speech will remain intelligible.
The auditory system senses audio signals and speech. and
conveys them lo the brain for processing. The external ear 4.3.12 Noise is any unwanted sound or sound which
comprises the pinna, auditory canal, and eardrum. The has no relationship with the immediate task. It may inter-
middle ear has three small bones called ossicles, which fere with speech communications, annoy the listener or
transmit sound from the outside to the inner ear. The affect task performance, and it may have health implica-
middle ear is connected to the nose and throat; through tions. The relationship between the loudness of the
swallowing. yawning or sneezing. pressure within the "wanted" sound and that of the background noise is called
middle ear is equalized with that of the outside. The inner signal-to-noise ratio. which is more important factor than
ear houses the vestibular apparatus which has functions the absolute level of the signal or noise when determining
such as maintaining balance and providing the brain with intelligibility. Noise as an environmental stressor is further
information related to acceleration and changes of position. discussed later in this chapter.
 1-4-8 Human Factors Training Manlral

...Towards the end of this transmission (the ATC clearance), the CVR showed that the captain made
the exclamation"Yes!.' Some five seconds later, while the f i off'ker was still reading back the ATC
- ...'
clearance, the captain said, 'We go check thrust followed by the sounds of engine spin-up.

Ths CVR showed that the last portion of the first officer's readback became noticeably hurried and less
- -
clear. He ended his readback with the words, W e are now uh takin' off or 'We are now at take
OK

The controller then said, 'Okay (pause) stand by for takeoff, Iwill call you". On the KLM CVR, the
portion of this transmission following the word -okay" was ovedaid by a high-pitchedsqueal, and the
tone of the controller's voice was somewhat distorted, though understandable.

In Clipper 1736, upon hearing the KLM first officer advised that they were "taking off, and the
controller's "okay" and pause, the Pan Am first officer transmitted: 'and we are still taxiing down the
-
runway the Clipper one seven three six: It was this transmission which caused the squeal and the
distortion in the KLM cockpZ of the controller's transmission directing them to stand by for takeoff. The
Pan Am transmission was itself totally blocked by the controller's transmission to KLM. Only the words
"Clipper one seven three six" were heard in the tower. The controller then said, 'Papa Alpha one seven
three six, report runway clear", to which the Clipper replied, 'Okay, we'll report winen we are dear'.
During these transmissions, KLM 4805 continued to accelerate on its takeoff run.

Aboard the KLM aircraft, the flight engineer asked. 'Is he not clear, then?" The captain said. What did
you say?' The flight engineer: 'Is he not clear, that Pan American?" To this, both captain and first officer
responded with a positive and almost simultaneous, Yes".

About seven seconds later, the first officer called, V one'. Three seconds later, the Dutch crew saw
directly in front of them tie shape of Clipper 1736 turning to KLM's right in its attempt to clear the
runway. At 1706:49 GMT, KLM 4805 collided with Clipper 1736.

Source:Human Factors Report on the Tenerife Accident" U.S. ALPA.

4.3.13 Redwtdancy in spoken language helps to 4.4 HUMAN

convey information even when the sound is distorted or INFORMATION
surrounded by noise. One underlying danger in the case of PROCESSING
distorted information is that gaps are filled in by the
listener based on previous experience, learning and 4.4.1 Humans have a powerful and extensive system
expectation, hence there is a risk of false hypothesis for sensing and processing information about the world
emerging. Masking is the consequence of one sound around them. The information sensing and processing can
component (e.g. unwanted noise) reducing the ear's be broken down into several stages as generalized in
sensitivity to another component (e.g. an audio signal or Figure 4-4. Information in the form of stimuli must be
speech). The more the speech content is lost - through sensed before a person can react to them. There exis& a
distortion, noise, personal hearing deficiencies, etc. -the potential for error, because the sensory systems function
greater the risk of expectation playing a role in the only within a narrow range. Once stimuli are sensed, they
interpretation of aural messages. The consequence of this are conveyed to and processed by the brain. A conclusion
may be disasuous. is drawn about the nature and meaning of the message
received. This interpretative activity involving high-level
4.3.14 Ergonomics attempts to mitigate the adverse brain functions is called perception, and is a breeding
effects of noise on hearing and speech intelligibility by ground for errors. Expectation, experience, attitude.
attacking the problem at the source. Iransmission, andlor motivation, and arousal all influence pe~eptionand may
receiver end of the signal. speech, or noise. cause errors.
 Figure 4-4. Model of the human information processing system
(adapted from Hawkins, 1987)

4.4.2 After conclusions have been formed about the 4.4.4 . The duration of information storage differ-
meaning of stimuli, decision-making begins. Again, many entiates short-term from long-term memory. Short-term
factors may lead to erroneous decisions: inadequate/ memory involves rapid, continuous changes in informa-
inappropriate training or past experience: emotional or tion. and allows short-term retention and processing of
commercial considerations: fatigue,medication, motivation data. Long-term memory involves less frequently repeated
and physical or psychological conditions. Action (or sequences and is characterized by long-term storage of
inaction) follows decision. Once action has been taken, a information. Repetition or rehearsal allows information to
feedback mechanism may be available to inform the be stored in long-term memory.
person how effective the action 'was. Potential for
committing e m r s exist in these two last phases. 4.4.5 Short-term memory has very limited capacity.
It has generally been determined that it can accommodate
4.4.3 The ability to remember is essentialto human a small amount of information at one time (seven plus or
information processing: even the simplest system cannot minus two elements). Elements (e.g. symbols) at the
function without memory. Since human memory is a beginning and, especially, at the end of a series are
limited resource, the ergonomist must be careful to design retained better. Human ability to discriminate visual
systems that do not overload it. There is a distinction information is similarly limited. This fact should be
between long- and short-term memory. Long-term memory considered when presenting information on the flight deck.
is associated with the retention and retrieval of information
over a long period of time. Instruction and training are 4.4.6 The above-mentioned limitation of seven data
effective means of enhancing those retention and retrieval elements holds for items which, in the person's
capabilities. Short-term memory allows data retention and experience, appear unrelated. For example, the term LOW
processing for current activities. The data readily fade PRESSURE involves 11 unrelated letters, but they are
away after the activities are completed. really two groups or chunks for short-term memory. The
 Humon Factors Training Manual

individual items within each chunk have been blended as attempting to define or measure workload under
a single coherent unit. In any system in which strings of operational conditions. As technology advances in our
items need to be memorized. the ergonomist must try to society, mental workload will become more impoltant than
capitalize on the chunking principle to enhance short-term physical workload. With modem automated systems, oper-
memory. ators sometimes have monotonous work which consists of
unvarying physical or mental activity. Considerable effort
has been directed, and will continue to be directed, to
"Approaching from the west Approach establishing methods for assessing mental workload, with
instructed "Report visual before joining. Expect the ultimate goal of describing or predicting how much
clearance to joining downwind left-hand for mental workload is associated with a given task.
Runway 31, QFE ...

'Reported visual and told to call Tower. Tower In May 1978, a Boeing 727 crashed into
inst~ctedus to "Join downwind left-hand for Escambia Bay while on a surveillance-radar
runway 13. QFE ...".The other pilot and I both approach to Pensacola Regional Airport The
wrote this down independentfy, and read it back. crew was blamed for the unprofessional way in
In view of the previous message i wondered which they conducted the nonprecision
whether to query it, but this ATC is usually approach. However, ATC was also mentioned
pretty good, so I decided I must have misheard as a factor which accelerated the pace of flight
the previous. deck activities after the final approach fix. NTSB
found that the aircraft was positioned on the
'... Just about airport boundary we saw an final approach course '... in a situation that
aircraft on short finals for 31 ...Tower called would make it impossible for the captain to
back rather irately 'You were cleared to join configure his aircraft in the manner specified in
downwind left-hand for 31 ...' the flight manual'. There was also confusion
regarding the nature of the instrument approach
"...Another classic human emr which has available at Pensacola. These factors resulted in
always existed with 13/31 runways since the the crew's failure to extend the gear and flaps
advent of radio control. Trampositions or swaps appropriately. Moreover, subsequent warning
of positions are one of the commonest types of from the ground proximity warning system went
error in short-term memory ...' unheeded, and it was turned off seconds before
'...
the impact The NTSB concluded, these
Source: CHIRP Feedback No. 23,February [events] increased the captain's workload, and
1991. contributed to producing the major causal area
-
of the accident a lack of altitude awareness:

4.4.7 Attention. as a technical term. has two differ- Source: lCAO ADREP Summary 78/6. -
ent meanings. It refers to the human ability to ignore
eXlraneoUs events and to focus on the events of interest
(selective anention). This is exemplified by a person's
ability to maintain a conversation amid a noisy pmy. It is, 4.5 HUMAN DIMENSIONS
in shon, the ability to focus on a souru of information
embedded within several sources. On the other hand, 4.5.1 One of the primary objectives of ergonomics
divided attention is the human capability to attend to more is to match working (and living) areas and stations with
than one thing at the same time. An example of this is human characteristics. Some of the basic characteristics of
talking to ATC and watching for outside MIC humans are those associated with the size and shape of the
simultaneously. vacious pans of the body and with their movements.
Figure 4-5 illushates the imponance of considering human
4.4.8 There is no single dehition for mental work- dimensions in equipment design. The controls of some
load. Some relate it to information promsing and atten- lathes in current use are so placed that the ideal operator
tion, others to time available to perform a task. still others should be four-and-a-half feet tali, be two feet across the
to stress and arousal. Subjective opinions on workload can shoulders. and have a four-foot arm span -it is probably
be collected. using rating scales, questionnaires or inter- easier to change the machine than the people who must
views; these methods have been frequently used when operate it! Anthropomeuy is concerned with human
Chnprcr 4. Ergonomics 1411

Figure 4-5. The controls of a lathe in current use are not

within easy reach of the "average" penon
(from Applied Ergonomics IPC, 1969; Vol. 1)

dimensions such as weight, Statute. limb size and other change from generation to generation. For example, it is
specific measures such as seated eye height and reach known that people in some developed counfties have
when seated with and without restraining devices (such as generally become taller during the past 50 yeas. An
a shoulder harness). With this information it is possible to ergonomist must determine when and how such changes
estimate the optimum height for work surface and location will become a factor in design considerations.
of controls, the height and depth of stowage arcas, mini-
mum knee room between seat rows. width of seats, length 4.5.3 The ergonomist should take into account the
of armrests, height of headrest. life-raft and scat cushion concept of designing for human diierences. Not only are
design, and reach requirements. Biomechanics specializes there differences in physical dimensions among ethnic
in the application of the science of mechanics in the study groups, but there are also differences between men and
of living organisms (the human beiig in this case). The women within one ethnic group (for instance, conlml force
discipline studies areas such as the movements of body quiremenu which can be met by males may be too high
pans and the forces they can apply. For example, it is for females). Many aviation hardware pieces have for
necessary not only to know h a t a certain force will move some time been manufactured according to Caucasian
a control, but also where the control is located relative to male dimensions, even though in many cases they are
the body and the direction of control movement equally used by Asians, Africans. and others. The ergo-
nomist will identify the target user group and design
4.5.2 Data collection is an important step. Data must equipment accordingly. If a single design solution to
be collected from a representative and sufficiently large accommodate all user differences is not possible, a range
sample of the people who will use the equipment. When of adjustments is provided. so that most users are accom-
using these data. one must take into account the date of modated - rudder pedal and seat adjusunenu on the
data collection. since human physical dimensions may Right deck are among the examples.
 14-12 Hwnan Factors Training Manual

4.6 DISPLAYS, CONTROLS AND inate use of aural alerts on the flight deck has been known
FLIGHT DECK DESIGN to cause annoyance and confusion or to affect task
performance negatively. In such cases, one cannot over-
4.6.1 Displays and controls are at the heart of emphasize the importance of taking proper Human Factors
ergonomics. If we refer to the SHEL model, they are considerations into account in the design of these displays.
mostly pan of the Liveware-Hardware and Liveware-
Software interfaces. In the case of displays, the transfer of 4.6.6 There are basic issues which must be resolved
information goes from the Equipment to the Liveware. before a display can be properly designed and located.
Controls are used to uansfer information and commands Both design and location of displays can greatly influence
in the other direction, from the Liveware to the the effectiveness of the dialogue between human and
Equipment. There is usually an information loop involved machine. The following are some example considerations:
in this process, and ergonomists have the mission of
optimizing the flow within this loop. The following
paragraphs present some of the considerations in the The drum-pointer altimeter display has a history
design of displays and controls and their integration into of being misread in studies and real-life
the workplace of the flight deck. occurrences dating back to 1959. This particular
instrument is susceptible to the thousand-foot
4.6.2 This chapter does not discuss the issues misreads, especially when the indication is near
associated with the introduction of automation on the zero. The results of a study undertaken by
flight deck. Pan 2. Chapter 4 addresses this imponant and NASA indicated that the problem is because
contemporary aspect of flight deck design. humans cannot efficiently read both the drum
and pointer at the same time. They also showed
that the number of times when the altiude
Displays window on the drum-pointer altimeter is read is
very small. The time necessary to read the
4.6.3 The function of a display is to convey
window is almost twice as long as text reading.
information (about the status of the flight for example)
This instrument is believed to have been
accurately and rapidly from its source to the operator.
misread, and considered a contributing factor, in
Human capabilities and limitations in information
at least the following accidents:
- discussed before should be considered in the
processinr:
design of displays. Timcly. appropriate. accurate, and
a. American Airlines 8727, Constance,
adequate amount of information must be presented to the
Kentucky (USA), November 1965;
operator according to task requirements. It would be detri-
b. NortheastAirlines DC9, Martha's Vineyard,
mental to task performance to present more information
Massachussets (USA), June 1971;
than required. especially when the operator is overloaded,
c. Eastern Airlines DG9, Charlotte, North
fatigued or under stress.
Carolina (USA), September 1974;
4.6.4 Visual displays may be dynamic (e.g. alti- d. National Airlines 8727, Pensacola, Florida
meters and attitude indicators) or static (e.g. placards, (USA), May 1978;
signs, and charts) They present quantitative (e.g. altitude e. Aliilia DG9, Palermo, Itaiy, December
and heading) or qualitative (e.g. landing gear status) 1978; and
information. They may w m (e.g. ENGINE FIRE) or f. Iberia B727, Bilbao, Spain, February 1985.
caution (e.g. oil pressure indicator or light).
-
Source:The Killer Instrument The Drum
4.6.5 Displays may also be tacrildXinaesthetic Pointer Altimeter" (1990) Harold F. Marthinsen,
(tactile means related to the sense of touch, kinaesthetic Director of US ALPA's Accident Investigation
relaied to the sense of motion) or audiroq. Especially Deparhent
when the visual system is (or is expected to be) heavily
loaded, these displays may be used to communicate
information to the human operator. Tactirekinaesthetic
information uansfer may also be applied under degraded How, by whom, and in whe! circumstances will the
visual conditions. (A stall warning using the stick-shaker display be used?
method is a good example). The auditory canal is particu-
larly suited for alens such as warnings. For this reason, Auditory displays are generally omnidirectional,
there is a tendency to apply such aural displays heavily, while visual displays are not. W111 more than one
sometimes indiscriminately, on the flight deck. Indiscrim- person be required to see the display?
 Chapter 4. Ergonomics 14-13

How will ambient illumination influence the

effectiveness of the visual display? Shortly after a night takeoft from Bombay, at an
altitude just under 15W ft, the W i n g 747 with
Should the information be presented in the 210 persons on board rolled a 14-degree bank
analogue or digital format? Digital displays provide to the right Over the next 13 seconds, the
greater accuracy for recording or systems aircraft gradually returned to wings-level. Then it
monitoring (e.g. for engine instruments), while continued to roll into a %degree left bank At
analogue instruments are preferable when the this point, an abrupt left-aileron input was made,
numeric values are changing frequently or rapidly it was mornentan'ly reversed, and then went to
(e.g. with altimeter and rate of climb indicators). hard-over left. The pilot held hard left ~ d d e r
and ailerons until impact with the sea
30 seconds later, with the aircraft in a 108-
What is the angle at which the display will be
degree bank and at more than 300 knots.
viewed?
Incorrect information presented to the crew,
through a failure (horizm control reversal) in the
Will there be parallax problems?
flight director, contributed to the acddent
What will be the viewing distance? Will character
and symbol sizes need to be increased to afford
I Sours: ICAO ADREP Summary 78/5.
I
readability at a distance?

Displays which are in a standby or inactive mode obscured by the pointer. The tip of the pointer should
should clearly enunciate that fact. Ambiguity will touch the end of the graduation scale but should not over-
likely increase mental workload and induce errors. lap it. The distance between the pointer and the surface of
the scale may result in parallax which should be elimin-
Information which is suspect should not continue
ated or minimized. There will be no such problem if the
to be displayed to the operator. scale is displayed on an electronic display. In general, the
- Consider display factors such as brightness, colour,
contrast and flicker.
size of the displayed information (e.g. scales and icons)
must be positively related to the viewing distance (i.e. the
longer the viewing distance, the larger the scale or icon
size). This design consideration must allow for environ-
4.6.7 The display of letters and numbers (known as mental correction factors like lighting, vibration and non-
alphanumerics) has been the subject of much research. optimum viewing angles.
Mechanical. electro-mechanical and electronic displays
present various ergonomic problems which deserve atten- 4.6.9 The introduction of electtunic (e.g. cathode-ray
tion. Information presented must be legible. so that tube) displays provided the opportunity to overcome many
characters can be easily differentiated or identifiable. In of the earlier constraints of electro-mechanical displays,
addition, the information must be readable, which means permined integration of displays, and afforded greater
that total words or groups of leners and numerals are flexibility and a more effective use of panel space.
comprehensible. Readability is generally a function of Electronic displays generally have three applications on
factors such as character style. type form (e.g. uppercase the flight deck: for flight insmments, systems information
or italics), size, contrast and spacing. (e.g. engine data as well as data on other systems, includ-
ing warning systems), and flight management systems
4.6.8 Dial markings and shapes are two additional (FMS). Electronic displays present a variety of ergonomics
aspects considered by the ergonomist Examples of the concerns, including: brightness and brightness contrast; the
. basic types of displays used in presenting quantitative use of colours for different p i e x of information: the
information are shown in Figure 4-6. Scale progressions fatiguing effect of extended periods of screen monitoring;
should have fixed and regular graduation markings, and the symbology utilized; what information should appear,
should be presented in single units. Steps of 10 or 5 are and where, on the screen: and the fact -for reasons not
good, and steps of 2 are acceptable. Decimal points should -
yet very clear that reading text from a screen is slower
be avoided, and if used, the 0 ahead of the decimal point than from printed paper. On the other hand, electronic
should not be included. Full readings should be displayed displays are generally cost-effective and versatile. and
as opposed to truncated versions (e.g. 15 for 150). Care offer the user a reasonable amount of control over cenain
should be taken in the design of pointers when the inslru- important display properties such as brightness and bright-
ment also contains a digital read-out which can be ness conuast.
~ 1-4-14 Human Factors Training Manual

FIXED S W . MOVING PMNlER

a~~ >, .. *x

:i.:,j
:..*:.
: ii
:..:a

"-- X
.-...i..:
?;

- .- ...-

a&,&&* Semitiralar amwed & Vmcald HaumBl d e

and nega6w valuer

MOVING SCALE. FIXW POINTER

-. ....-
7. .. ..,: ,:
.c

G d a r s=aE ~ P e n + % h& V e m d lb%mBluale

.------.
DIGfTAL DISPLAY
jr!tjsi.6;3;

Figure 4-6. Example displays used in presenting quantitative information

(adapted from McCormich et al.. 1983)

4.6.10 Many operators have introduced heads-up preferably they should provide guidonce regarding
displays (HUDs) as an additional tool to allow for oper- the appropriate action required.
ations in lower weather minima. The symbology utilized
by these devices must be common to the symbology 4.6.12 Several considerations can be given to the
utilized in screens. last item. A good indication is provided by the number of
aircraft which were involved in an accident because the
crew shut down the wrong engine after an engine failure.
Advisory, caution and wonting (ACW)systems Considerations in the design of the ACW systems include,
first, system reliability, since confidence in a system will
4.6.11 Warnings signify a condition requiring an be lost if it is plagued by spurious warnings. Secondly,
immediate crew action for maintaining the safety of the excessive appearance of an ACW signal will reduce
system, and their colour coding is normally RED.Cautions response to it and become a nuisance. Lastly, auditory
imply a condition which may become an emergency if multi-warnings (i.e. the same sound being used to ales to
allowed to progress or deteriorate. These usually require more than one condition) require special considerations.
the appropriate, but not immediate. attention, and their They are effective in amacting attention, but may breed
coding is AMBER. Advisories are generally for informa- error or delay in corrective response. Voice messages may
tion only. and may or may not require crew action. Their be added to enhance identification and interpretation.
coding may be BLUE. WHITE, or GREW.Three basic 4.6.13 Advisories. cautions. and warnings on the
principles apply to the design of flight deck warning flight deck can be grouped into four broad categories:
systems:
those which inform about performance, or
they should akrf the crew and draw their attention; departures from operational envelopes or safe flight
profiles (e.g. for stall, overspeed and ground
they should reporf the nature of the condition: and proximity): they are usually of high urgency;
Chapter 4. Ergonomics

They may send a conlrol signal to a system (e.g. the flap

In December 1974, a Boeing 727 crashed 12 lever) or conml a display direcdy (e.g. an altimeter setting
minutes after departure from JFK airport The knob). As is the case with displays. the characteristics of
airspeed and altitude values recorded in the the user population must be taken into account by the
FDR are consistent with the predicted climb designer.
performance until the aircraft reached 16,000 ft,
when icing was encountered. The airspeed 4.6.16 The functional requirements, as well as the
when the stick-shaker was activated was manipulation force required, will determine the type and
estimated to be 165 kt, compared to the 412 M design of control to be adopted. An example checklist on
recorded by the FDR. The pitch attitude would how to select controls based on their functions is provided
have been 30 degrees nose-up. below.
'
The crew had not activated the pitot-heaters. Functiodforce Type of control
and ice accumulated and blocked the pitot
heads, producing erroneous airspeed and Mach Discrete functions push buttons, toggle switches
wamings. They incorrectly diagnosed tfie stall andlor forces low and rotary switches
wamings as Mach buffet and pulled the aircraft
nose-up, which resulted in a stall and spin. Continuous function rotary knobs, thumb wheels.
andlor forces low small levers or cranks
Sourcer NTSB AAR 7513.
High control forces handwheels and large levers,
large cranks and foot pedals

those which inform about aircrafl configuration

(e.g. landing gear and flap positions):
In December 1972, a M e e d L-1011 crashed
in the Everglades swamps near Miami. While
those which inform about the status of aircraft
the crew was attempting to replace a faulty nose
systems: these include limiting bands and flags on
gear indwtor light bulb, the autopilot was
instruments: and
inadveilenfly disconnected, and the air&
descended to cmsh into the swamps. The nose
those related to communications (e.g. SELCAL and
interphone). gear ligM future had not been provided with a
shadow divider between the two light bulbs, as
4.6.14 The following important principle must be is the usual design pracke. The shadow divider
reiterated: in the case of a failure, the user of a display allows the pilots to see that one-half of the
should not be presented with unreliable information. The fixlure is dark when the fiicst light bulb fails. The
failure should be annunciated on the display itself, rather secMld bulb, while woMng, confirm to the crew
that fhegear is safely kcked. Riis p w l a r
than on an indicator. It is v e q likely that, as long as the
unreliable information is shown, sooner or later it will be aircraft had been probably flying for several trips
used. with an undetected failed Qht bulb in the nose
gear fobrre. The secMld light bulb failed when
the airaaft was approaching Miami. This
Controls resulted in the highly improbable situation in
whid, both light bulbs were inoperative
simultaneously. lhe absence of the shadow
4.6.15 Contmls are means for the human operator to
divider was thus one of the factors which had
transmit messages or command inputs to the machine. The
message should be transmitted within a specified accuracy
c o n t n i to the chain of events leading to an
and time period. Different types of controls perform accident
different functions: they may be used to transmit discrete
Source: ICAO ADREP Summary 721557.
information (e.g. selecting a transponder code) or
continuous information (e.g. cabin temperature selector).
I
14-16 H u m n Factors Training Manunl
I

'... in c ~ i s efirst selected LP code instead of adjacenl fuel pumps during fuel balancing. No.
, Officer
1 engine flamed out - instantly relit ...'
Source: Feedback No.1, March 1983.

'...taxying out of dispersal we had reached the point in the chedtlist for 'Rap selection'. The captain
confirmed flaps to go to W e off so Iput my left hand down, grasped the knob and pushed
downwards. Its travel felt remarkably smooth, so I looked down to find Ihad actually closed down
the No. 2 HP cock shutting the starboard engine down. The top of the flap lever and the HP cock
are immed~atelynext to each other ..."
Source: FeedbackNo. 2, July 1983.

'... some readers may remember that we have published several reports about pilots whodehctwsi
off the fuel c& on BAC 1-11s by accident BAe took the reports vely seriously and put out a
wodd-wide British Aerospace Policy Letter alerting all the operators to the possible problem. Not,
perhaps, a cure - but certainly a step in the right direction."
Source: Feedback No. 3, December 1983.

4.6.17 Another basic requirement for controls. from

the ergonomics point of view, is their location within the In one particular family of twin-jet transport
work area However, it must be remembered that the aircraft, the engine fire switch is a powerful
optimal location for a display may not be optimal for control with which one action shuts off the
reach. ignition, the fuel, the hydraulic fluid supply, and
the pneumatic duct to the affected engine.
4.6.18 Other design considerations include: control- Recognizing the consequences of improper
display ratio, which is the ratio between the amount of actuation of this control, the designers went to
change in a display in respnse to a control input and the great lengths to reduce the probabilityof this
amount of change in the control effected by the operator; specfu: error. The fire switch has been given a
and the dimtion of movement of display element (e.g. a unique shape and feel, and is located where it
pointer) relative to the direction of control movement. As can easily be seen. The switch requires a long
shown in Figure 4-7. a rotary knob located on the right stroke, pull action unlike operating any other
side of a longitudinal display should go clockwise to move control on the flight deck. A light on the handle of
the arrow indicator up. Control resistance affects the speed the Meh shows which engine is on fire. Finally,
and precision of control operation, control "feel", the handle is locked in the normal position unless
smoothness of conml movement and susceptibility of a fire is sensed for that engine (although a
control to inadverient operation. Control coding (i.e. shape. manual override switch is also provided). It is
size. colour, labelling and location) aims to improve ident- located so that an additional discrete action is
ificarion, and reduce e m and time taken in selection (see required for an operator to accomplish the
Figure 4-8). The last of the example principles in control procedure. This system has worked well for the
design involves protection against inadvenent actuation. management of engine fires since it was
This can be achieved by methods such as gating, lockimg introduced 25 years ago.
and interlocking (e.g. by interconnecting conmls to
guarantee that reverse thrust levers cannot be operated Soum:'Error Tolerant Avionics and Dkplays',
until thrust levers are in idle). In some cases, an action Delmar M. Fadden. Human Error Avoidance
which is incompatible with existing conditions may trigger Techniques: Proceedingsof the Second
a visual or aural warning (e.g. closing the thrust levers Conference. WE P-229.
when the landing gear is retrdcted will turn on an aural
warning).
Chapter 4. Ergor~omics 1-4-17

A B

Counter- Clockwise
Clockwise to increase
to increase

w
Nearest point Nearest point
principle principle

Figure 4-7. Two population stereotypes associated with this control-display relationship

I Flap Control. Knob

I

I Mlnure Control Knob Supercharger Contml Knob

I

I Thronle Control Knob I R.P.M. Contml Knob I

Figure 4-8. FAA requirements for cockpit control knobs
(adapted from 14CFR. Ch. 1. Section 25.781)
1-4-18 1lurrra11Fucrors Training Munuul

Dvorak keyboard

O@H@
aaaasaeeeaoo
eeeea~aaeeao
BPOH~~bbl3t!J#!l8lcls84
i
QWERPl kevboard

Figure 4-9. The traditional QWERTY keyboard and

the more efiicieut Dvorak version

Figure 4-10. An example of a keyboard for a management or navigation

system (left) and a suggested layout
(adapted from H u m Factors. L.C. Butterbaugh and T.H. Rockwell, 1982)
Chapter 4. Ergonomics 1-4-19

4.6.19 The use of keyboards on the flight deck has generally failed to place emphasis on how to enable the
increased steadily over the years, as a consequence of the crew to perform their rasks in the most efficient and
advent of computerization and modem avionics systems. effective manner.
An experienced typist can make one uncorrected error per
2 000 to 4 000 keystrokes. Flight deck crew members are 4.6.21 In recent years, joint efforts by various civil
generally considered to be unskilled typists. In addition, and milimy industry groups, including manufacturers, air-
they may use the keyboard under adverse environmental lines, pilots and authorities have led to the development of
conditions (e.g. under poor lighting and in turbulence). For the concept of crew-system design. This concept empha-
on-board applications, accuracy and error detection are far sizes the functional integration of all system elements,
more important than speed of enuy. Key size, barriers taking into consideration the crew's requirements (e.g. for
between keys to prevent inadvertent operation and controls and displays). Factors integrated in the system
adequate handrests against vibration are some-of the design wncept also include geometry of the flight deck,
considerations in keyboard design. The traditional furnishings (e.g. seats, windows and glareshield), environ-
typewriter keyboard layout is named after the six initial mental variables (e.g. noise, vibration, light, temperature
letters of the top letter row (for example. QWERTY in and weather), and miscellanwus fixtures (e.g. coffee cup
English and AZERTY in French). DVORAK is an alterna- holders, eating facilities. foot rests and baggage holders).
tive layout, named after its originator. August Dvorak (see They also include the characteristics of people who will
Figure 4-9). However, all of these configurations are operate and maintain all components of the system.
generally unsuitable for flight deck applications because of
space limitations and the need for single-handed operation. 4.6.22 This systems approach to flight deck design
Figure 4-10 shows an example keyboard which has been is made possible by an activity known as systems
adopted for many airborne navigational systems. engineering. The purpose of this activity is to develop
relationships among system components. evaluate the
effects of individual components on each other, and
ultimately integrate all system components into one
In July 1987, a M e e d L-1011 flew within 100 effective functional entity. Human operators, maintenance
ft of a being 747 over the North Atlantic. It was personnel and trainers are viewed as components of a
later determined that the incident was due to a system; thus, this approach considers the final product as
data input error made by the L-1011 crew. The a human-machine complex. The flight deck is therefore
crew allegedly had followed established data seen as a system. with the components of Liveware,
entry procedures by ensuring data entered was Hardware, Software and Environment.
verified by another crew member; however, the
input error still occurred. Subsequently, the crew 4.6.23 For effective design, contemporary systems
did not follow established aosschedc engineering approaches incorporate ergonomics inputs,
procedures, thus allowing the error to go which in turn treat the flight deck as a workplace and take
unnoticed until the near MIsion occurred. proper consideration of the capabilities and limitations of
the users. Ergonomists aim to recognize and resolve
Source: ICAO ADREP Summary 871331. potential Human Factors problems early in the design
phase before any equipment is produced.

4.6.24 The ergonomics approach starts with an

appraisal of task requirements and user characteristics
4.6.20 For many years. the flight deck was viewed which will affect design decisions such as those specifying
as a common place where numerous otherwise unrelated the layout and makeup of the flight deck. In addition, the
systems, such as hydraulics. electrics, pneumatics and designer must take into account constraints which can
pressurization, converged. Each system was designed by limit design options. Such constraints include the aero-
a different group of specialists, and its associated controls dynamic characteristics of the aircraft, which are related to
and displays were largely driven by the particular func- the cross-section of the fuselage and the shape of the nose.
tional specifications of the relevant system. The flight For example, the Concorde flight deck width of 148 cm,
crew was thus presented with an assortment of displays. which is dictated by aerodynamic requirements, represents
knobs, switches and controls of various sizes, shapes and a relatively cramped environment when compared with a
markings, which were usually selected from different Boeing 747 which has a deck width of 191 cm.
manufacturers' catalogues. The designer's main task was
to make sure that all the equipment pieces were installed 4.6.25 Downward visibility during approach is a
within the allocated space. This design approach has requirement which influences the design of the windshield
 Hurnun Factors Training Maniwl

and the location of the design eye position (see Figure are determined by display location and distance from the
4-11). The design eye position is an important reference eyes of the prospective user. Viewing distance issues are
point which helps to determine placement of equipment particularly applicable to persons wearing glasses. Viewing
such as displays. distances are also particularly relevant to "glass cockpits".

4.6.26 The distance between pilots' seats is a factor 4.6.28 The panel containing flight instruments has
when cross-monitoring is required or when the same received much attention from designers. The basic T '
displays or controls are used by both pilots. Difficulties in layout which exists in most aircraft today is the result of
access to pilots' seats may result in the decision to move the need for fast and accurate scanning of four basic
the seats slightly outwards; however, proper consideration parameters - speed, attitude, altitude and heading -with
must be given to chis misalignment of pilot and control so priority given to attitude (see Figure 4-13). Instrument
that it does not lead to hazardous conditions during. panels which display system quantitative information (e.g.
operations. engine instrument panel) are arranged as a block or bank
of insuuments. A disturbance in the symmetrical pattern
4.6.27 Viewing distances for displays is another of that block as the result of a deviated indication on one
imponant aspect dictated by flight deck geometry. For of the instruments will be quickly detected by the crew.
large aircraft, typical viewing distances from the pilot's Synoptic panels (e.g. for the fuel, electrical. pneumatic and
eyes are 71-78 cm for the main panel, 20 cm for the over- hydraulic systems) display the system in a schematic form
head panel, and 2 m for the lateral systems panel (see with conuols and displays appropriately placed. Flight
Figure 4-12). Size of display details (e.g. alphanumcrics) guidance panels are gencrally mounted on the glareshield.

Figure 4-11. Reference eye position

(adapted hom Human Factors in Flight. F.H. Hawkins, 1987)
Chaprer 4. Ergonomics 1-4-21

distances(an)

Figure 4-12. Typical viewing distances from the pilot's eye design eye position to various
panels on the flight deck of a large jet
(adapted from Human Facrors in Flight, F.H. Hawkins, 1987)

director altimeter
indicator indicator

situation
indicator

Figure 4-13. The "basic T panel" which forms the core of

modem tliht instrument panel layouts
(adapted from H w ~ Factors
n in Flighr, F.H. Hawkins, 1987)
 Human Factors Training Manual

This lack of standardization has been known to cause

In January 1989, a Boeing 737-400 crashed confusion and errors on the part of the crew.
short of the runway at East Midlands airport,
near Kegworth, Leicestershire, UK During climb 4.6.30 Requirements for crew complement is another
to cruising altitude, a series of compressor stalls factor to consider in flight deck design and layout On
occurred in the No. 1 engine. m e stalls were aircraft operated by three crew members, the third crew
caused by a structural failure, g~ingrise to member may be sitting in front of a separate panel, facing
airframe shuddering, producing smoke and it laterally, or may sit between the pilots. facing forward.
fumes on the flight deck, as well as generating Manufacturers have alternated between the two designs
fluctuations of the No. 1 engine parameters. over the years. As a general rule, when systems complex-
Believing that the No. 2 engine had suffered ity increases to the point of requiring extensive instru-
damage, the crew throttled the engine back. The mentation. a separate station is required. On aircraft
shuddering caused by the surging of engine operated by two crew members, a large overhead panel is
No. 1 ceased Wen engine No. 2 was throttled installed to accommodate controls which would otherwise
back. This persuaded the crew that they had be placed on the lateral panel. In general, overhead panels
dealt correctly with the emergency. They then should have the most frequently used items located in the
shut engine No. 2 down and diverted the plane forward section, and the less frequently used items in the
to land. At 2.4 miles from the runway, there was rear section. because the rear section is relatively
an abrupt reduction of power and a fire warning inconvenient to reach.
from engine No. 1, then the aircraft crashed.
4.6.3 1 The two- versus three-person crew issue has
design implications which go beyond the basic process of
relocating controls and displays. For instance. emergency
In its report, the British AAlB recommends eva-
response on two- person aircraft involving first stage
luating the information presentation on new
failure of equipment with stand-by redundant module
instruments and their effectiveness in
should require minimal crew intervention. Switching to the
transmitting the associated information to the
stand-by back-up module upon failure of the primary
flightcrew. It also recommends that engine
equipment should be automatic, obviating the need for
instrument systems be modified to M u d e an
manual input by a third crew member. However, the crew
attention getting mechanism which will alert the
must still be informed of what h a . happened and provided
crew of system abnormalities. Fgure 4-14
with any other options required for further emergency
illustrates the proposed rearrangement.
action. In addition, activities and procedures which require
prolonged headsdown time should be avoided to maxi-
& opporlunities for visual look-out
This allows both pilots to reach k m without having to -
lean over the control column, and improves instrument
scanning. Figure 4-15 presents an example checklist for In December 1983, an Airbus A300B4 crashed
the evaluation of a typical flight guidance panel. Other short of the runway at Kuala Lumpur during an
panels which require proper ergowrnics design include approach under lnsmrment Meteorological
those for radio and interphone m m l s . circuit breakers, Conditions (IMC). Among the contn'butory
galley equipment, and door operation. factors, it was indkated that the aircraft was on
lease from another company, and its controls
differed in some respects from the other A3Ws
4.6.29 Toggle switches can follow either the
owned by the lessee company. The manual
"forwacd-on" @ush switch forward to turn on) or "sweep
provided with the accident aircraft di not
on!' (see Figure 4-16) concepts. ?he forward-on concept
include details of some m o d i i k m which
presents a problem of ambiguity with panels mounted
vertically or close to the vertical. It also lacks flexibility were made to the original insbuments before the
aircraft was transferred.
when modules have to be relocated, and the new switch
positions no longer follow the forward-on concept. The
sweepon concept solves these difficulties. In multi-type
Source: ICAO ADREP Summary 846.
fleets within a company. both concepts might be found.
Chnprer 4. Ergonomics 14-23

Primary engine display Secondary engine display

I NO. t engine NO.2 engine

I I
Figure &14. Proposed engine instrument system
1-4-24 Human Facrors Training Manual

Installation ~ w f i c h e(taggle)
~ General characteristics
Use by which uew members: Direct~onof movement Colour knish
whal priorities Interlerence; inadvertenl operation; Low refleclivity pamt lor panel,
Whal localion: s i m and reach guarding; Isver-locking, ganging fastenen, wunten, etc.
Verkal or horirontal mounting Coding, shape. lexlure, mlour Lighlplate edge radtus
Operational funciion Type and size (damage potential)
Vulnerabilii to reflections: Posiiion marhng: visibili from Delelhalisation
direct sunlight pilots' reference eye position Compatibility with other
Slandard dimensions Actuation lorce cockp'i panels
Relative location ol panel

a Readouls
Sire of alphanumerln Id Switches (pwh4uUon)
Sire and shape
componenWmodules

Leuerlnumeral type
Visibility from pilots' reference
position: parallax
Sep~atim,fencing, insdvertenl
operation
VedcaVhorizontal installation:
ElPanel lighting
Brightness vs vobge
Babnce, mmpatibility wih
Counter, direction of movement use in turbulence other panels
Countar, movement characteristics Fumtion annunciation, deylnight Even brightness, even illumination
(analogrdigital) Odofl indication, daylnight of readouts
Glass cover anti&ectve coating Actuation pressure and travel Colour tempemure
Low reflectw panit Use of mlour/brighlners mding of
Use of mlour
White on Mack or h k on wh3;
contrast
El Psnsl nomnclsturs
Lenering type and size
Redundant nomendature (duller)
push-bullon switches, etc.
Glare, high spots, leaks (note also
lighlplale edge radius)
Standard abbreviations Controls, mntinuoudstep.

kz;
Size
shape, texture, mlour
Lodon
Visibility obslructions
inlegdon with cockpit
system, location
Light reflechon potenhl, screening
Finger interlerence cod?'k Loca6onofswitchedmntmlsby light
Turning ratio, fast &wing Directidraki of movemenl Lighting of knoblmnkol positions
requirement Finger friction, grip PushbHon switch lighting
Positiive detenting Coding: shape, colour on and ofl posidon
Unambiguous pork& makings; Functionalinterrelation
visibility fmm pilob' Finger interiemffie. Maintenanse
reference eye posaon inadverlent operation Ease of removal and installation
Operating lorce % l i d operational rquirement Vulnerabiliv to handling damage
Direction of movement Operating lone
Finger friction, grip Delent characteristic

Figure 4-15. Checklist for evaluation of a typical cockpit panel

Chapter 4. Ergonomics 1-4-25

Figure 4-16. The "sweep-on" switch position concept

which is slowly replacing the
earlier "forward-on" arrangement
(adapted from Human Factors in Flight, F.H. Hawkins. 1987)

4.6.32 General principles in seat design are equally go beyond the medical problems (e.g. back ailments)
applicable to flight deck and parsenger seats. Some of which may appear. Back pain or discomfort is distressing
those principles include distributing the body weight and can affect motivation, behaviour and performance.
throughout the buttock region amund the sitting bones. and
providing a proper seat height to avoid excessive pressure
on the back of the thighs. The spinal column should be
kept in balance and maintain its relatively natural curva- 4.7 THE ENVIRONMENI
ture by proper lumbosacral support and seat design. Arm-
rests should provide the proper a m support while allowing Stress
free mobility of shoulders, anns and torso. In addition.
consideration must be given to factors such as durability 4.7.1 Stress was defined by Hans Selye as a non-
and weight of the material. flammability, smctural specific response of the body to any demand made upon
integrity, reliability, space available. certification it' This concept assumes that some "normal'? or "optimal"
requirements and cost. Proper attention must also be slate of bodily functions exists and that stressors (i.e.
directed to seat controls. restraint systems and footrests. stimuli or situations that stress the person) cause a
deviation from this normal state. Suess generally repre-
4.6.33 Pilots are required to remain strapped to their sents an attempt by the body to adapt to or cope with
seats for many hours. and the effects of seat characteristics situational demands and to return to the normal state as
1-4-26 Human Factors Training Manual

soon as possible. It can be differentiated into life stress. same across different tasks, but the exact shape and loca-
environmental stress and cognitive stress. Life stress is tion of each curve vary according to task complexity.
produced by adverse occurrences in a person's life (e.g.
divorce, family bereavement). Environmental and cognitive 4.7.3 Stress is related to a person's ability to pay
stress are more closely related to the specific activities attention to cues in the environmenL In a simple situation
which humans undertake. Environmenlal stress includes with few cues. suess will improve performance by causing
the effects of factors such as temperature. humidity. noise. attention to be focused. In a complex situation with many
pressure, illumination and vibration. Cognitivestress refers cues, stress will decrease performance because many cues
to the cognitive (or mental) demands of the task itself. will g o unheeded. This explains many accidents in which
Countermeasures to minimize the potential untoward crew under stress "locked on" to some particular instru-
effects of environmental and cognitive stress are within the ment which was defective (even if the instrument was of
purview of ergonomics. . minor importance), failing to attend to other pieces of
crucial information.
4.7.2 Stress has traditionally been linked to arousal.
which refers to nonspecific changes (e.g. hormonal and
brain activities) in the body to external stimulation. In Noise
general, stress and amusal levels are positively related -
that is to say, high stress is associated with high arousal 4.7.4 Noise is defined as any unwanted sound. There
level. The Yerkes-Dodson law depicted in Figure 4-17 are two imponant aspects of noise which must be consid-
relates performance and arousal. It shows that people's ered: the sources of noise, and the physiological and
performance levels increase according to the degree of psychological effects on the person exposed to it. Noise
arousal to a point beyond which any additional boost in affects a person in many ways depending on whether it is
arousal will generally be deuimcntal to task performance. expected. whether it makes a task more difficult, and
The ovcr-all shape of the relationship curve remains the whether the person is relaxed or alen.

Good

m
0
c Simple Task
m
E
:
a
Complex Task

Bad
Low High
Arousal

F i r e 4-17. The Yerkes-Dodson law relating performance and arousal

Chaprer 4. Ergonomics 14-27

4.7.5 Major sources of noise in fixed-wing aircraft lems noise genera- in communication. This may result in
include the engines, the air conditioning, pressurization frustration and anxiety over the need to repeat messages or
and hydraulic systems, and boundary layer turbulence. to understand them. This in turn may increase workload
Inside the aircrafl noise is louder near the sides of the and fatigue. While it is the ergonomist's task to try to
fuselage than at the centre. Noise level in the urkpit is minimize noise through design and by providing hearing
easily changed by the interaction of the airflow with the protection, crew members should be aware of the insidious
fuselage surface. Soundproofing will reduce noise, but it effects of noise and the damage it can pmvoke, and of
will increase aircraft weight as well. This has many methods to reduce noise levels or to protect oneself from
undesirable effects such as increases in fuel w s t Design its deuimental effects.
improvement lo reduce noise at its so- would be a
better alternative. For example, removing the windshield
wipers in one particular large jet transport reduced the Temperature
flight deck noise level by 2 dB.
4.7.9 Temperature extremes are one of the most
4.7.6 The most important pathogenic effect of noise, common environmental suessors. Since humans are
impaired hearing, has already been discussed in 4.2. Other comfomble only over a nmow band of temperatures, it is
physiological effects incIude changes in blood pressure necessary to know how well they function at different
and heart rate, headaches, tiredness and gastrointestinal temperature levels before remedial measures can be
problems such a s ulcers. In the past, prolonged monitoring derived. Questions about air-conditioning requirements and
of high-frequency (HF) radio represented a significant human performance under heat or cold stress should be
exposure to noise. This has been alleviated by the answered and taken into account during system design.
introduction of selective calling (SELCAL). Technological Cabin environmental conml systems are the principal
progress in communications - as well as in other areas means for controlling the internal aircraft environment.
- will ceminly provide new improvements in hearing
protection. The fact remains, however, that crew members 4.7.10 Humans generate heat while performing
who are exposed to intense aircraft noise over a long mechanical work, and to a lesser extent. when resting. The
period of time can be expected to suffer hearing loss in excess heat is transferred to the environment, primarily by
addition to the natural loss through ageing. perspiration and sweating. in order to maintain a relatively
constant body temperature of 37 degrees Celsius (C). The
4.7.7 Noise affects performance by interfering with success of body temperature regulation depends on various
the detection and understanding of task-related signals or factors: ambient temperature, humidity, and air velocity. If
speech. It interferes with verbal communication by affect- body temperature increases by more than 2 degrees C,
ing the signal-to-noise ratio and by decreasing speech physiological efficiency will be. impaired.
intelligibility. It further affects verbal communication by
impairing hearing.

In February 1984, a Cessna T-303 crashed

during landing at Hiiory, North Carolina, U.SA
A twinengine Beechcraft B-99 crashed during The a i m f t overran the runway and collided
an instrument approach to the Shenandoah with a fence. The pilot was hampered by an
Valley Am
i Virginia,in September 1985. The inoperative heater and a dome light that could
NTSB conciuded that among the factors *ch not be turned off.
conbibuted to the ffrghtmew's errors was
'...intra-i cwnmuniwSons diiffiulties
associated with high ambient noise levels in the
airplane ...'
I Source: ICAO ADREP Summary 8814.
4.7.11 The physiological effects of ambient
tenprature extremes are well known, but the effects of
heat stress on human performance are more complex. It is
generally accepted that excessive heat will cause perfonn-
ance decrement, but there is little agreement regarding
how much decrement will take place, or how long it will
4.7.8 Because it is annoying for most people. noise take to occur. People can withstand exposure to excessive
can have an impact on psychological conditions. On the temperatures for only a short period of time before
flight deck, this annoyance is compounded by ihe prob- measurable degradation sets in. Acclimatization prolongs
 Hutnun Factors Traininn Manual

this period. In non-acclimatized persons, degradation optimal. It should be borne in mind that oxygen systems
appears when the ambient temperature exceeds 30 degrees will be used in conditions accompanied by anxiety and
C, the relative humidity is high, and exposure exceeds other swessors, and simplicity of use and reliability are of
three hours. Obviously, clothing and physical activity level utmost importance.
play important roles, too.
Illumination
4.7.12 When exposed to cold, the body attempts to
maintain its core temperature by shivering and restricting
.. . 4.7.16 The nature and quantity of cockpit illumina-
blood flow to the body surface. Body temperatures below
tion required for a certain task may vary considerably.
35 degrees C are dangerous. Consciousness becomes
Factors of importance are !he speed and accuracy with
.. clouded at 34 degrees C, unconsciousness follows around
which the displays must be read, the ambient illumination,
30 degrees C, cardiac irregularities are usual between 30
other light sources (in particular, sunshine), and the
and 28 degrees C, and death is imminent. Although
presence of glare. Glare is defined as a condition of vision
humidity is not a factor, air velocity is important; as a
where there is discomfon or a reduction in the ability to
result, wind chill indices are increasingly being provided
see significant objects, or bob, due to an unsuitable distri-
in weather reports. (Wind chill is not a psychological
bution or range of luminance (i.e. density of light, or light
effect - it effectively lowers body temperature.) Cold
intensity per unit projected area) or to extreme conuasts in
increases both reaction and movement time, and manual
space or time.
dexterity begins to deteriorate when hand-skin temperature
falls below 18 degrees C.
4.7.17 Glare is an imponant aspect of the quality of
the illuminated environment. It can be caused by bright
light sources or light reflection off environmental surfaces.
Humidity
Glarc may produce discomfon or annoyance, and may
interfere with visual performance. The type of reflecdon
4.7.13 Humidity may become an issue with high-
off surfaces depends on the properries of the surface (e.g.
altitude jet lranspon aircraft because of h e low relative
whether it is polished. rough or matted). Some evidence
humidity at their operational altitudes. The discomfort
suggests that there is an element of subjectivity in
arising from low relative humidity may not imply physical
tolerance to glare. The most effective techniques for
indisposition. Over-all dehydration can be prevented with
reducing glare include blocking the glare surface or
adequate fluid intake. Diuretics like coffee or tea should
placing supplemenmy lighting to offset the effects of
be avoided. The installation of humidifiers on aircraft
glare.
could raise cabidcockpit humidity, but there are potential
problems such as weight penalty. condensation and
mineral contaminations that the designer must consider. Vibration

4.7.18 Vibration is any form of oscillating motion

Pressure that changes its magnitude of displacement periodically
with reference to a point, and it is a widespread physical
4.7.14 Cabin pressurization eliminates many phenomenon. The movement of pistons withii the
pmblems associated with high altitude flying, but it cylinders of engines or the disturbances generated in
introduces other potential problems, the most important aircraft flying through turbulent air are forms of vibration
being the risk of a rapid decompression. The time of which can be transmitted to humans. Vibration is generally
useful consciousness (TUC) following a rapid decompres- transmitted through direct contact between the body and
sion depends on aircraft altitude, the rate at which pressure the vibrating struclure, and it can have potentially harmful
falls, and the level of physical activify of the individual at effects.
the time of the event. At typical jet transport aircraft
altitudes (35 000 feet) TUC will vary between 33 and 54 4.7.19 Vibration is of operational significance in
seconds. Those average values can be expected to drop by aviation k a u s e it may impair visual acuity. interfere with
a half at 40 000 feet. This emphasizes the importance of neuromuscular control andlead to fatigue. Although better
immediate availability of supplemental oxygen to crew than before, high levels of vibration can still be
members. encountered in helicopters as wcll as in fixed-wing aircrafr
during low-level flight.
4.7.15 The technical reliability of automaticdelivery
systems, as well as the design of certain types of flight 4.7.20 Protection against vibration can be provided
crew quickdonning masks have sometimes been sub- by attention to its source. by modification of the trans-