- Email: [email protected]
Dual Design of Computer-Based Air Traffic Control Systems - Examples from European Air Traffic -
Copyright @IFACIntegrated Systems Engineering. Baden-Baden. Gennany. 1994
Dual Design of Computer-based Air Traffic Control Systems - Examples from European Air Traffic B. Harendt, H. Kesselmeier Informatics in Mechanical Engineering (lMA), University of Technology (RWTH) Aachen, Dennewartstr. 27 52068 Aachen, Germany
Abstract
controllers are supported by radar equipment, computers as well as telecommunication equipment. The radar equipment serves both the physical locating of aircrafts (primary radar) and the surveillance of data (secondary radar). The computers serve the processing of radar data, the correlation of radar data with flight data of the corresponding information systems, the data link to other control centers and the processing of all information for the working stations of the radar controllers.
The Dual Design Approach will be used to describe the complex air traffic control system as a humanmachine system. The Dual Design Approach is a set of principles to ensure appropriate development of both the technical and human aspects of humanmachine systems. Both the technology-based design and the working-process-based design should be used in parallel to obtain an optimum. This ist exemplified by two components of the air traffic control system. Examples of specific support systems - especially from EUROCONTROL - are shown. Based on these support systems for the radar controllers the capacity of air traffic control systems can be increased without additional risks in case of technical failures. But fully automated systems for air traffic control - even if it was feasible - will not be acceptable.
1. 1.1
In Europe EUROCONTROL (Maastricht) is going to install a new technical system (Operating and Display System) in 1996. The specifications for that system are elaborated at the moment through the simulations and tests OmD I-IV (Operational Display and Input Development). OmD II took place in 1991 and provides new knowledge and results for structuring the work routine and the technical aids (I). ODID IV takes place in summer 1993 (2).
Introduction The situation oftbe commercial air traffic
1.3
In the near future the commercial air traffic will increase continously. Prognoses start out from a doubling of the passenger miles over the period of 1990 to 2000. So the air traffic control systems reach the bounds of their capacity. The consequences are delays, increased .consumption of kerosene and increased accident risks. Therefore we must call for an increase of the capacities in air traffic control. This can be attained in the near future by means of technical measures (automation). Yet, what will be in 20 or 50 years. Where are the limits of growth in commercial air traffic?
1.2
Design task
It is necessary to optimize the human-machine system "air traffic control" in such a way that the airspace capacities can be increased without a retrograde step in safety and reliablity: - Should the human remain within the air traffic control system? - Will it work quicker and better in the long run with a fully automated system? - Who would like to go by a fully automated aircraft? In my opinion there will not be a fully automated air control system even in the long run~ The human will remain within the system being the one who decides and takes the responsibility. On the contrary: Radar controllers (and pilots) according to their tasks will gain importance even in an increasingly automated
Functions of air traffic control
The air traffic control serves the safe directing of the air traffic through the airspace. Its central element is the relation between a team of ground radar controllers and the pilot in the aircraft. The radar
321
system. Therefore, it is necessary to develop intelligent, supporting technical systems which -
functioning so that the knowledge that is needed during infrequent task activity is obtained during general activity (4)." The aim is thus to design the system so as to find a balance of man and machine which makes best use of human skills, judgement abilities, and experiences. For this design process, one approach is the dual design approach (5), as illustrated in Figure 2.
assign the main role to human beings, let them do the decisions, help them increase their abilities and help to overcome capacity limits.
In order to realize this the concept of humancentered design is considered. It pays special attention to the environment of the work systems, it integrates the benefit into the process of communication. As a design approach the "dual design approach" is introduced and exemplified by two components of the air traffic control system.
2.
The Dual Design Approach is a set of principles to ensure appropriate development of both the technical and human aspects of human-machine systems. Usually, project engineers tend to head for fully automated concepts. This kind of approach is represented by the left-hand triangle of Figure 2. Here, the major part of design efforts, creativity and research is used to obtain a fully automated system. However, at a certain stage of the development it becomes obvious that certain elements of the system cannot be fully automated. This may be due to economic or safety reasons or to limited technical possibilities. It means that humans are becoming part of the concept at a late stage. But then it is very difficult, if not impossible, to obtain jobs which take care of the benefits people can bring into a system.
Dual Design Approach as a concept of interdisziplinary design of human-machine Systems
Today, the design of a technical system is often understood as the design of a more or less automated system (3). This view of the unmanned system may be popular. Nevertheless, it appears impossible to implement it as many experiences have shown. The design of a technical system will always be the design of a human-machine system (Figure 1). A human-machine system is rather to be considered a
Therefore, it is necessary to introduce a second approach, the working-process based design, in order
c:J
system border
Figure 1: Human-machine system human-centered system : "The efficiency of a human-centered system is based on the complementarity of man and machine. Because of unforseen disturbances that may enter the system, the operator must be able to control all tasks that contain choice-uncertainty via an interactive interface. However, an operator cannot control a system unless he comprehends its functioning . A system should support the operator's model of its
to consider the human work situation as well. Contrary to the technology based design, a workingprocess based design raises the issue of how to solve the problem with a lower level of automation or computers. This will result in a concept where tasks are performed by people. It means that the main part of design efforts, creativity and ideas will be put into this approach (see Figure 2, right-hand triangle).
322
technology-based design
technology·based design
e) automatic data transfer
fully automated d) data·link panly automated c) language identification proces computer assisted b) secondary surveillance radar a) verbal communication manual
L--'-;~-:---~
working-process-based design
working-process-based design
Figure 2:
The dual design approach to humanmachine systems
Figure 3:
Both the technology based design and the workingprocess based design should be used in parallel to obtain an optimum. This is the basic idea of the Dual Design Approach. It is complementary in the technology-based design and in the working-processbased design. The weakness and the advantages of both concepts have to be compared and analyzed.
3.
Dual design communication
of
ground-air
c) Language identification process A language identifying computer which transfers the verbal orders of the radar controller into computer data, should not decrease the verbal communication, it could, however, partly substitute the minuting. There are two reasons why this concept has failed to be helpful. On the one hand this requires from the controller a computer suitable way of speaking. Unfortunately, this cannot be achieved in the controllers' way of speaking. On the other hand, the development in planning the air traffic is directed towards putting in the orders into the computer beforehand. Thus, a minuting through the executive controllers is not necessary.
The design of ground-air communication
Today a radar controller spends approximately 50% of his time to convey his orders to the pilots. In order to reduce these strains technical possibilities to automate this process should be examined. Based on the dual design approach the different realisation variants are shown in dependence of their automation grade (Figure 3).
d) Data-link The secondary surveillance radar can also be used for transmitting data from the ground to the aircraft. New standards (Mode-S) provide this possibility. These are the flight level, the heading and the speed. The pilot has to confirm these data through pressing a button. Furthermore, there is in parallel the possibility to use the verbal communication. Therefore, data-link can be used in standard situations, whereas verbal communication can be used in all other cases. Thus, the capacity can be increased without taking extra risks for safety.
a) Verbal communication The verbal communication via radio-telephone represents the minimum for communication. In some areas of air traffic control it is still the only available device. Furthermore, it is also a feedback option if additional technical systems fail. Moreover, the verbal communication via radiotelephone ·contains more than objective information that could be substituted by automatic data link. By means of articulation and way of speaking verbal communication also contains additional information. This information could not be substituted through automatic data link.
e) Automatic data transfer This concept allows a further increase of capacity, but only if, firstly, the strategy of control has already been designed automatically and, secondly, the transmission to the auto-pilot in the aircraft is to be carried out directly. Thus, the pilot and flight controller would be unnecessary. However, in cases of failures both could not act any longer. The controlling of the aircraft could not be corrected again without taking risks. Due to safety reasons this is not acceptable. Besides:
b) Secondary surveillance radar Almost all civil aircrafts have a transponder which sends the ground radar station automatically the identification code of the aircraft, the present flight level and the speed. This information can be depicted on the display of the radar controllers. Thus, time-consuming routine messages of the pilot can be dropped.
323
OOlD real-time simulations. The purpose of this experiment was to investigate the HeI applications involved in strip replacement as well as the use of color screens in air traffic control. More recently the usefulness of high defInition raster scan screens using multi window displays and a single input device has been studied. The working system has been designed on the basis of the following principles:
Who would like to travel with such a fully automated aircraft? Results: Data-link with the possibility of verbal communication in parallel serves best in order to increase the capacity without loss of safety. The data which are transfered via data-link, however, may not be transmitted directly to the auto-pilot of the aircraft. First, an examination and confIrmation of data control strategy are to be carried out by the pilot.
- to integrate all information on the surface of a single screen. - Decisions on air traffic orders will exclusively be taken by the controller himself. - Visual information aids help to the controller for his decision (entry aid window, exit aid window, conflict and risk display). - The decisions are supported by default values. These values can be adapted along the controllers' experiences. - Furthermore, there will not be any other proposals for decisions (e.g. in situations of conflict) which provoke a reactive behaviour of the controller. Instead, all relevant aspects of information will be visualized so that the controller can elaborate his solutions actively (see example in fIgure 5).
As the ground-ground communication continues to be increasingly automated, this must be restricted to standard situations in ground-air communication. On no account, there should be a direct remotecontrolling of the aircraft from the ground.
4.
Design of the tactical planning
The present working routines in the air traffic control centers provide job sharing between planning controller (tactical planning 20 - 5 minutes before the entrance of the aircraft) and executive controller (direct responsibility for the sector and direct communication with the pilots). The systems presently used lead to the fact that the controllers actually control the displays merely for 50% of their time. In the remaining time they have got to deal with actions and information that cannot be found on the display. Possible supporting aids for the tactical planning of the planning controllers are depicted in Figure 4.
technology-based design
The results of the simulations are positive. The visual aids are a useful support for the planning controller. Thus, the capacities on the air traffic sector can be increased by 20-40%. The controller, however, must carry on taking decisions. Otherwise, the loss of practical knowledge and the inability to act in situations of conflict is imminent. Due to safety reasons this is not acceptable. Another problem becomes apparent when automated air traffic control systems cause seperation from the real f} decision support systems world and end in disorientation. This may happen, e.g. when a controller team "flies" the small symbol e) window technology with intelligent planning tools of the aircraft on the radar display along the colored line representing the course, rather than flying the d} graphical display with touch aircraft through the real space ("we are just playing a input device game").
c) electronical strip board b) automatic strip printer working·process·based design a) manual strip board
Figure 4:
Dual design of the tactical planning
Today, different concepts have been already carried out and tested or used in some traffic control centers. The concept e) "window technology with intelligent planning tools" has proved to be the ideal solution in order to increase the capacity without a loss of safety. This was tested by EUROCONTROL in the
324
TARGET
PEl..'CFL 370R 350 330
, 1 1 _I. _. _. _ . _ . _ 1 1 _ . - 1- · - . 1 1
,, ,,, , .. _..... _. _._-_.- -,, - _.---.,_._
·-
310
· - . -I _ . -
290
· _. - 1r - - - .• .
.·· 1
,
__ __ _~ . - .-. - ._. _._ . _._._. _. _:. _. _.
XFL 370R
3.50 330
310
1
290
._.+._. 1
280 ~
260
2SO
1
~
· _ . - I. _.
1 1
260
· _ . -I.
250
250
1111111111111111111111111111111111111111111111111111111IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII!111111111111111111 Ti:me
Figure 5:
5.
Vertical assistence window as example for visual decision support aids (2)
Conclusion
6.
The capacity of air traffic control can be increased through ground-air data links and visualizing aids for the controllers. With this losses in safety do not occure. However, the possibility of verbal communication between pilot and controller must be obtained in the future. The decisions may not be taken by an automatic system, but the controllers' active decisions must be supported by means of possible intelligent visualizing aids. There will not be a fully automated air traffic control system not even in long term. The human being remains in the center of the system.
2
3
4
5
325
References EUROCONTROL, ODID Ill, Real-time Simulation, EEC-Report No. 242, Bruxelles, 1991. EUROCONTROL, OOlD IV, The Simulation Specification, unpublished internal report, Bruxelles, 1992. A. Bohnhoff, D. Brandt and K. Henning, The Dual Design Approach as a Tool for the interdisciplinary Design of Human-CentredSystems, Intern. Journal of Human Factors in Manufacturing, No. 3 (1992) pp. 289-301. F. Rauner; L.B. Rasmussen and M. Corbett, The Social Shaping of Technology and Work - A Conceptual Framework for Research and Development projects in the CIM-Area, ESPRITproject 1217 (1199), Bremen, 1987, p. 55 K. Henning, B. Ochterbeck, Dualer Entwurf von Mensch-Mascbine-Systemen, in: Der Mensch im Unternehmen by P. Meyer-Dohm et al. (eds), Bern, Stuttgart, 1988, pp. 225-245 .
Dual Design of Computer-based Air Traffic Control Systems - Examples from European Air Traffic B. Harendt, H. Kesselmeier Informatics in Mechanical Engineering (lMA), University of Technology (RWTH) Aachen, Dennewartstr. 27 52068 Aachen, Germany
Abstract
controllers are supported by radar equipment, computers as well as telecommunication equipment. The radar equipment serves both the physical locating of aircrafts (primary radar) and the surveillance of data (secondary radar). The computers serve the processing of radar data, the correlation of radar data with flight data of the corresponding information systems, the data link to other control centers and the processing of all information for the working stations of the radar controllers.
The Dual Design Approach will be used to describe the complex air traffic control system as a humanmachine system. The Dual Design Approach is a set of principles to ensure appropriate development of both the technical and human aspects of humanmachine systems. Both the technology-based design and the working-process-based design should be used in parallel to obtain an optimum. This ist exemplified by two components of the air traffic control system. Examples of specific support systems - especially from EUROCONTROL - are shown. Based on these support systems for the radar controllers the capacity of air traffic control systems can be increased without additional risks in case of technical failures. But fully automated systems for air traffic control - even if it was feasible - will not be acceptable.
1. 1.1
In Europe EUROCONTROL (Maastricht) is going to install a new technical system (Operating and Display System) in 1996. The specifications for that system are elaborated at the moment through the simulations and tests OmD I-IV (Operational Display and Input Development). OmD II took place in 1991 and provides new knowledge and results for structuring the work routine and the technical aids (I). ODID IV takes place in summer 1993 (2).
Introduction The situation oftbe commercial air traffic
1.3
In the near future the commercial air traffic will increase continously. Prognoses start out from a doubling of the passenger miles over the period of 1990 to 2000. So the air traffic control systems reach the bounds of their capacity. The consequences are delays, increased .consumption of kerosene and increased accident risks. Therefore we must call for an increase of the capacities in air traffic control. This can be attained in the near future by means of technical measures (automation). Yet, what will be in 20 or 50 years. Where are the limits of growth in commercial air traffic?
1.2
Design task
It is necessary to optimize the human-machine system "air traffic control" in such a way that the airspace capacities can be increased without a retrograde step in safety and reliablity: - Should the human remain within the air traffic control system? - Will it work quicker and better in the long run with a fully automated system? - Who would like to go by a fully automated aircraft? In my opinion there will not be a fully automated air control system even in the long run~ The human will remain within the system being the one who decides and takes the responsibility. On the contrary: Radar controllers (and pilots) according to their tasks will gain importance even in an increasingly automated
Functions of air traffic control
The air traffic control serves the safe directing of the air traffic through the airspace. Its central element is the relation between a team of ground radar controllers and the pilot in the aircraft. The radar
321
system. Therefore, it is necessary to develop intelligent, supporting technical systems which -
functioning so that the knowledge that is needed during infrequent task activity is obtained during general activity (4)." The aim is thus to design the system so as to find a balance of man and machine which makes best use of human skills, judgement abilities, and experiences. For this design process, one approach is the dual design approach (5), as illustrated in Figure 2.
assign the main role to human beings, let them do the decisions, help them increase their abilities and help to overcome capacity limits.
In order to realize this the concept of humancentered design is considered. It pays special attention to the environment of the work systems, it integrates the benefit into the process of communication. As a design approach the "dual design approach" is introduced and exemplified by two components of the air traffic control system.
2.
The Dual Design Approach is a set of principles to ensure appropriate development of both the technical and human aspects of human-machine systems. Usually, project engineers tend to head for fully automated concepts. This kind of approach is represented by the left-hand triangle of Figure 2. Here, the major part of design efforts, creativity and research is used to obtain a fully automated system. However, at a certain stage of the development it becomes obvious that certain elements of the system cannot be fully automated. This may be due to economic or safety reasons or to limited technical possibilities. It means that humans are becoming part of the concept at a late stage. But then it is very difficult, if not impossible, to obtain jobs which take care of the benefits people can bring into a system.
Dual Design Approach as a concept of interdisziplinary design of human-machine Systems
Today, the design of a technical system is often understood as the design of a more or less automated system (3). This view of the unmanned system may be popular. Nevertheless, it appears impossible to implement it as many experiences have shown. The design of a technical system will always be the design of a human-machine system (Figure 1). A human-machine system is rather to be considered a
Therefore, it is necessary to introduce a second approach, the working-process based design, in order
c:J
system border
Figure 1: Human-machine system human-centered system : "The efficiency of a human-centered system is based on the complementarity of man and machine. Because of unforseen disturbances that may enter the system, the operator must be able to control all tasks that contain choice-uncertainty via an interactive interface. However, an operator cannot control a system unless he comprehends its functioning . A system should support the operator's model of its
to consider the human work situation as well. Contrary to the technology based design, a workingprocess based design raises the issue of how to solve the problem with a lower level of automation or computers. This will result in a concept where tasks are performed by people. It means that the main part of design efforts, creativity and ideas will be put into this approach (see Figure 2, right-hand triangle).
322
technology-based design
technology·based design
e) automatic data transfer
fully automated d) data·link panly automated c) language identification proces computer assisted b) secondary surveillance radar a) verbal communication manual
L--'-;~-:---~
working-process-based design
working-process-based design
Figure 2:
The dual design approach to humanmachine systems
Figure 3:
Both the technology based design and the workingprocess based design should be used in parallel to obtain an optimum. This is the basic idea of the Dual Design Approach. It is complementary in the technology-based design and in the working-processbased design. The weakness and the advantages of both concepts have to be compared and analyzed.
3.
Dual design communication
of
ground-air
c) Language identification process A language identifying computer which transfers the verbal orders of the radar controller into computer data, should not decrease the verbal communication, it could, however, partly substitute the minuting. There are two reasons why this concept has failed to be helpful. On the one hand this requires from the controller a computer suitable way of speaking. Unfortunately, this cannot be achieved in the controllers' way of speaking. On the other hand, the development in planning the air traffic is directed towards putting in the orders into the computer beforehand. Thus, a minuting through the executive controllers is not necessary.
The design of ground-air communication
Today a radar controller spends approximately 50% of his time to convey his orders to the pilots. In order to reduce these strains technical possibilities to automate this process should be examined. Based on the dual design approach the different realisation variants are shown in dependence of their automation grade (Figure 3).
d) Data-link The secondary surveillance radar can also be used for transmitting data from the ground to the aircraft. New standards (Mode-S) provide this possibility. These are the flight level, the heading and the speed. The pilot has to confirm these data through pressing a button. Furthermore, there is in parallel the possibility to use the verbal communication. Therefore, data-link can be used in standard situations, whereas verbal communication can be used in all other cases. Thus, the capacity can be increased without taking extra risks for safety.
a) Verbal communication The verbal communication via radio-telephone represents the minimum for communication. In some areas of air traffic control it is still the only available device. Furthermore, it is also a feedback option if additional technical systems fail. Moreover, the verbal communication via radiotelephone ·contains more than objective information that could be substituted by automatic data link. By means of articulation and way of speaking verbal communication also contains additional information. This information could not be substituted through automatic data link.
e) Automatic data transfer This concept allows a further increase of capacity, but only if, firstly, the strategy of control has already been designed automatically and, secondly, the transmission to the auto-pilot in the aircraft is to be carried out directly. Thus, the pilot and flight controller would be unnecessary. However, in cases of failures both could not act any longer. The controlling of the aircraft could not be corrected again without taking risks. Due to safety reasons this is not acceptable. Besides:
b) Secondary surveillance radar Almost all civil aircrafts have a transponder which sends the ground radar station automatically the identification code of the aircraft, the present flight level and the speed. This information can be depicted on the display of the radar controllers. Thus, time-consuming routine messages of the pilot can be dropped.
323
OOlD real-time simulations. The purpose of this experiment was to investigate the HeI applications involved in strip replacement as well as the use of color screens in air traffic control. More recently the usefulness of high defInition raster scan screens using multi window displays and a single input device has been studied. The working system has been designed on the basis of the following principles:
Who would like to travel with such a fully automated aircraft? Results: Data-link with the possibility of verbal communication in parallel serves best in order to increase the capacity without loss of safety. The data which are transfered via data-link, however, may not be transmitted directly to the auto-pilot of the aircraft. First, an examination and confIrmation of data control strategy are to be carried out by the pilot.
- to integrate all information on the surface of a single screen. - Decisions on air traffic orders will exclusively be taken by the controller himself. - Visual information aids help to the controller for his decision (entry aid window, exit aid window, conflict and risk display). - The decisions are supported by default values. These values can be adapted along the controllers' experiences. - Furthermore, there will not be any other proposals for decisions (e.g. in situations of conflict) which provoke a reactive behaviour of the controller. Instead, all relevant aspects of information will be visualized so that the controller can elaborate his solutions actively (see example in fIgure 5).
As the ground-ground communication continues to be increasingly automated, this must be restricted to standard situations in ground-air communication. On no account, there should be a direct remotecontrolling of the aircraft from the ground.
4.
Design of the tactical planning
The present working routines in the air traffic control centers provide job sharing between planning controller (tactical planning 20 - 5 minutes before the entrance of the aircraft) and executive controller (direct responsibility for the sector and direct communication with the pilots). The systems presently used lead to the fact that the controllers actually control the displays merely for 50% of their time. In the remaining time they have got to deal with actions and information that cannot be found on the display. Possible supporting aids for the tactical planning of the planning controllers are depicted in Figure 4.
technology-based design
The results of the simulations are positive. The visual aids are a useful support for the planning controller. Thus, the capacities on the air traffic sector can be increased by 20-40%. The controller, however, must carry on taking decisions. Otherwise, the loss of practical knowledge and the inability to act in situations of conflict is imminent. Due to safety reasons this is not acceptable. Another problem becomes apparent when automated air traffic control systems cause seperation from the real f} decision support systems world and end in disorientation. This may happen, e.g. when a controller team "flies" the small symbol e) window technology with intelligent planning tools of the aircraft on the radar display along the colored line representing the course, rather than flying the d} graphical display with touch aircraft through the real space ("we are just playing a input device game").
c) electronical strip board b) automatic strip printer working·process·based design a) manual strip board
Figure 4:
Dual design of the tactical planning
Today, different concepts have been already carried out and tested or used in some traffic control centers. The concept e) "window technology with intelligent planning tools" has proved to be the ideal solution in order to increase the capacity without a loss of safety. This was tested by EUROCONTROL in the
324
TARGET
PEl..'CFL 370R 350 330
, 1 1 _I. _. _. _ . _ . _ 1 1 _ . - 1- · - . 1 1
,, ,,, , .. _..... _. _._-_.- -,, - _.---.,_._
·-
310
· - . -I _ . -
290
· _. - 1r - - - .• .
.·· 1
,
__ __ _~ . - .-. - ._. _._ . _._._. _. _:. _. _.
XFL 370R
3.50 330
310
1
290
._.+._. 1
280 ~
260
2SO
1
~
· _ . - I. _.
1 1
260
· _ . -I.
250
250
1111111111111111111111111111111111111111111111111111111IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII!111111111111111111 Ti:me
Figure 5:
5.
Vertical assistence window as example for visual decision support aids (2)
Conclusion
6.
The capacity of air traffic control can be increased through ground-air data links and visualizing aids for the controllers. With this losses in safety do not occure. However, the possibility of verbal communication between pilot and controller must be obtained in the future. The decisions may not be taken by an automatic system, but the controllers' active decisions must be supported by means of possible intelligent visualizing aids. There will not be a fully automated air traffic control system not even in long term. The human being remains in the center of the system.
2
3
4
5
325
References EUROCONTROL, ODID Ill, Real-time Simulation, EEC-Report No. 242, Bruxelles, 1991. EUROCONTROL, OOlD IV, The Simulation Specification, unpublished internal report, Bruxelles, 1992. A. Bohnhoff, D. Brandt and K. Henning, The Dual Design Approach as a Tool for the interdisciplinary Design of Human-CentredSystems, Intern. Journal of Human Factors in Manufacturing, No. 3 (1992) pp. 289-301. F. Rauner; L.B. Rasmussen and M. Corbett, The Social Shaping of Technology and Work - A Conceptual Framework for Research and Development projects in the CIM-Area, ESPRITproject 1217 (1199), Bremen, 1987, p. 55 K. Henning, B. Ochterbeck, Dualer Entwurf von Mensch-Mascbine-Systemen, in: Der Mensch im Unternehmen by P. Meyer-Dohm et al. (eds), Bern, Stuttgart, 1988, pp. 225-245 .