- Email: [email protected]
Flight decks and free flight: Where are the system boundaries?
ARTICLE IN PRESS
Applied Ergonomics 38 (2007) 409–416 www.elsevier.com/locate/apergo
Flight decks and free flight: Where are the system boundaries? Erik Hollnagel Industrial Safety Chair, E´cole des Mines de Paris—Poˆle Cindyniques, Rue Claude Daunesse, B.P. 207, F-06904 Sophia Antipolis Cedex, France Accepted 31 January 2007
Abstract The change from managed to free flight is expected to have large effects, over and above the intended efficiency gains. Human factor concerns have understandably focused on how free flight may affect the pilots in the cockpit. Yet it is necessary to see the change from managed to free flight as more than just an increment to the pilots’ work. Despite the best intentions the transition will not be a case of a smooth, carefully planned and therefore uneventful introduction of a new technology. It is more likely to be a substantial change to an already challenging working environment, in the air as well as on the ground. The significant effects will therefore not just happen within the existing structure or distribution of work and responsibilities, but affect the structure of work itself. This paper takes a look at free flight from a cognitive systems engineering perspective and identifies two major concerns: first what effects free flight has on the boundaries of the joint cognitive systems, and second how this affects demands to control. The conclusion is that both will change considerably and that we need to understand the nature of these changes before focusing on the possible effects of free flight on pilots’ performance. r 2007 Elsevier Ltd. All rights reserved. Keywords: Control; Delegation; Joint cognitive system; Substitution myth; System boundaries
1. Introduction When a new or modified technological system is taken into use there will always be something that works differently from what was planned and expected, despite the best efforts of designers and engineers. Practitioners usually need time both to tailor the system to meet their needs and to tailor their own practices to overcome design slips and quirks (Cook and Woods, 1996). This applies to human–technology interaction, as well as to human– human interaction and social practices. Most systems, even very complex ones, nevertheless reach a level of stable performance if they are allowed to work relatively undisturbed for some time. Many working environments are unfortunately subject to frequent change because new technology is introduced— often in the sanguine hope of improving efficiency, safety, or the well-being of the work force, because of a need to improve overall performance, to patch designs flaw or to prevent the recurrence of a serious incident or accident. E-mail address: [email protected]. 0003-6870/$ - see front matter r 2007 Elsevier Ltd. All rights reserved. doi:10.1016/j.apergo.2007.01.010
In the business of civil aviation, one force for change is the overall growth in the number of passengers, which shows little sign of decreasing. Based on an ICAO forecast of a growth in world air travel of 5% per annum until 2020, it can be estimated that by then the number of aircraft within a given airspace will be double that of today—unless, of course, all aircraft double the number of passengers they can carry. So far the solution to the growing air traffic has been to increase the number of aircraft a controller handles, or if that is not possible then to increase the number of sectors, thereby limiting the number of aircraft within a sector. Neither solution is tenable in the long run, for rather obvious reasons: increasing task demands and an increasing number of hand-over conditions and therefore also more communication. A different solution proposed for this problem is free flight, defined as ‘‘a safe and efficient flight operating capability under instrument flight rules in which the operators have the freedom to select their path and speed in real time’’ (RTCA, 1995). The meaning of free flight is that pilots are no longer restricted to fly inside the established air corridors. Instead pilots and airlines are
ARTICLE IN PRESS 410
E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
allowed self-optimisation of the routes by being given control over route selection and changes in speed, flight path, and altitude—all subject to Instrument Flight Rule conditions. According to its promoters, free flight is expected to lead to significant advantages in terms of time and fuel savings for operators and airlines (Liang and Chin, 1998). It will allow pilots on their own initiative to avoid weather and other factors that crop up during flight. Free flight, however, does not mean that pilots can fly where and when they please. Air traffic restrictions will still be imposed to ensure safe separation of aircraft. It is hardly surprising if a change of this nature will have far reaching consequences for both pilots and air traffic controllers. While it is hoped that the effects will be mainly beneficial, there are legitimate concerns about increased risks of collisions, deterioration of working conditions for pilots and air traffic controllers alike, etc. A considerable number of studies have already been carried out which look at specific effects, e.g., in terms of workload or conflicts (Hilburn et al., 1997) or the increased risk of collisions (Hoekstra et al., 2000). This paper will look at another consequence of introducing new technology, namely the way it affects work practices and therefore also the joint human–machine system. It is argued that it is important to understand the nature of such changes, since these are the basis for raising questions about more specific effects.
New tools alter the tasks for which they were designed, indeed alter the situations in which the tasks occur and even the conditions that cause people to want to engage in the tasks. (Carroll and Campbell, 1988, p. 4) Changes that go beyond that and intend to substitute part of the pilot’s work by introducing automation, obviously need even more scrutiny. When new automation is introduced into a system or when there is an increase in the autonomy of automated systems, developers often assume that adding ‘‘automation’’ is a simple substitution of a machine activity for human activity (the substitution myth). Empirical data on the relationship of people and technology suggest that is not the case. Instead, adding or expanding the machine’s role changes the cooperative architecture, changing the human’s role often in profound ways. (Sarter et al., 1997) The introduction of partially autonomous machine agents in a system has been likened to adding a new team member. This typically leads to new coordination demands and a redistribution of roles. Yet development projects rarely include specific considerations on how to make the automation an effective team player or consider evaluating possible systems along this dimension (Woods and Sarter, 2000). 2.1. The inner and the outer views
2. Incremental versus substantial change The consequences of introducing new technology are in many cases underestimated due to the general belief in the substitution myth. This is the common assumption—that artefacts are value neutral so that their introduction into a system only has intended and no unintended effects. The basis for this myth is the concept of interchangeability as used in the production industry where it was the basis for large-scale industrialisation, although the central principles are much older. The experience that identical parts can be interchanged is at least as old as Pi Sheng’s invention of the movable type during the Ch’ing-li period (1041–1048). Thus, if we have a number of identical parts, we can replace one part by another without any unwanted side-effects. This example pinpoints two important things about substitutability. One is that that substitutability only works when parts are not interacting, as in the movable types. Second, that there must not be any appreciable tear and wear or at least that it must be similar across all parts. If parts are interacting, they constitute a system with dependencies among parts, which almost by definition invalidates the substitution assumption. If the substitution principle is suspect in the case of technological components, it is even more in doubt in the case of a substitution of functionality. Although the change may intend only to support the pilot, the consequences may still be considerable.
In the case of free flight, the changes to the existing situation are so dramatic that the substitution myth clearly is inappropriate. Even a cursory knowledge of what goes in the cockpit makes it obvious that a change from managed to free flight will have significant consequences for the pilot’s working situation, in particular with regard to task demands and performance requirements. One consequence of free flight is, for instance, that the responsibility for maintaining safe separation must now be shared between pilots and air traffic controllers, and even eventually be transferred completely to the pilots—or rather the cockpits. Studies of cognition and work—or even more appropriately, studies of cognition at work—have traditionally focused on the cognition of the individual described in terms of what goes on in the individual’s mind. Despite the landmark work of people such as Hutchins (1995) and Klein et al. (1993), this tendency prevails. While this predilection for mental processes often is ascribed to the influence of information processing psychology and cognitivism, it is actually something that goes back to the beginning of psychology as a science, to what Hammond (1993) referred to as ‘Wundt’s choice’: the study of mental processes disentangled from all accessory conditions, i.e., from the complex relations between cognition and reality. According to this ‘inner’ view, changes to the pilots’ tasks can be expressed in terms of phenomena such as workload, resource and information management, attention effects, or
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
3. Joint cognitive systems
Decision making Attention Situation awareness
Workload
411
Events, context
Cognitive systems engineering (CSE) is concerned with coagency, i.e., with how the functioning and performance of a joint cognitive system can best be described and understood (Hollnagel and Woods, 1983, 2005). The focus of CSE is defined by the nature of work and by the entanglement that is a defining characteristic of work in practice. This leads to the following threads or themes:
Performance
Fig. 1. The inner view.
Staying in control? Changes to tasks? New responsibilities? Joint system boundaries?
Events, context Performance
Fig. 2. The outer view.
situation awareness (Fig. 1). It is therefore hardly surprising that a number of early studies tried to assess the changes that are expected according to such theories, e.g., Alter and Regal (1992), Avans and Smith (1996); Duong (1996); Pritchett and Hansman (1993), and Small et al. (1995). It is, however, necessary to see the change from managed to free flight as more than just an increment of the pilots’ work. The change is not a case of smooth, carefully planned and therefore uneventful introduction of a new technology, but rather represents a substantial change to the working environment brought on by economic demands. The significant effects will not only be those that happen within the existing structure or distribution of work and responsibilities, but also those that affect the structure of work itself. In other words, the question is whether the changes can be encompassed within the current understanding of what flying is, or whether they will require a revision of that concept. Fig. 2 illustrates some of the ways in which flying may change, e.g., new responsibilities for pilots, problems with staying in control, changes to the pilots’ tasks, and a revision of the boundaries between system and environment. In the following, the two most important of these issues will be considered: the boundaries of the joint cognitive system and changing requirements to control.
How people cope with the complexity that results from technological and socio-technical developments and innovation. This issue has become particularly potent due to the pace of development since the 1950s. Coping with complexity is a short-hand way of describing the ways in which practitioners (pilots, air traffic controllers, operators, etc.) manage and handle the demands that arise from an environment that may change rapidly and often in an unpredictable fashion. How people use artefacts in their work, specifically how the use of artefacts has become an intrinsic part of intentional activity. At present practically all work requires the use of artefacts to achieve the specified goals. Although artefacts that can support cognition, such as memory aids, have existed for many years the use of computers and information technology has made it possible to design artefacts for higher level cognitive functions, thereby often increasing the complexity. How humans and artefacts can be described as joint cognitive systems (JCS). This extends the scope from the interaction between humans and artefacts to human– technology coagency. CSE shifts the focus from humans and artefacts as separate units to the JCS as a single unit. An important consequence of focusing on the JCS is that the boundaries must be made explicit, both between the system and its environment and between the elements of the system.
The complexity of a system, hence the difficulties in coping, depends in the main on two closely coupled issues. One is the degree of orderliness or predictability of the system, which in turn is related to the time that is available. The other is the extent of the system, i.e., how large it is. A system can be defined as ‘‘a set of objects together with relationships between the objects and between their attributes’’ (Hall and Fagen, 1968, p. 81)—or just as anything that consists of parts connected together. It is therefore clearly important how large the system is, i.e., how many ‘objects’ it contains and how many interrelations there are. 3.1. Joint system boundaries It is normally taken for granted that it is meaningful to speak about a system and its environment, i.e., that welldefined boundaries exist. But defining or setting the boundary of a system is no trivial matter. The fact that
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
412
we habitually describe some systems in one way, for instance as the ubiquitous human–machine system, does not mean that this is the natural way to do it, nor that it is inherently meaningful, as discussed already by Wiener (1954). Although it has been common practice in engineering and human factors to base the boundary on structural considerations, there are alternative approaches. For example, adopting the classical human–machine systems approach, the pilots in the cockpit can be seen as one system—the flight crew—for which cockpit automation and flight management systems constitute the environment. This decomposition is the basis for a majority of studies of pilots in the cockpit, both for current flight conditions and for free flight. It is, however, also possible to consider the airplane, i.e., pilots plus flight control and automation, as the system—the flight JCS—for which the air traffic management (ATM) is the environment. In this case, the boundary has been enlarged, and the ‘new’ system clearly has functional characteristics of its own. It is possible to go one step further and consider the pilots and the ATM as one system—the traffic flow JCS—in which case the environment is the airlines, the airports, and so on. Fig. 3 shows four levels of description for managed flight. In the case of a JCS, the boundary depends both on the purpose of the analysis and on the purpose of the JCS. Using an example proposed by Beer (1964), a manufacturing cell in a garment factory may be considered as a JCS. While it is in itself a component of the larger system for garment production, it can also be seen as containing components, for instance a number of person-cum-scissor units. Each of these units can again be seen as a JCS since they comprise a human working with an artefact. The point of Beer’s definition, and of system definitions in general, is to emphasise that there is no ‘natural’ way of setting the boundary between a system and its environment: it depends on the purpose of the analysis. It follows from the principles of CSE that the boundaries may be based on system functions rather than on system structures, i.e., on what a system does rather than on what it is. If we consider systems as JCSs in the manner described above, then the boundaries can be derived using the guidelines shown in Table 1. The functional criterion here is that the JCS must be able to meet its objectives, which in essence means that it must be able to maintain control.
Table 1 A pragmatic definition of JCS boundaries
Objects that can be effectively controlled by the JCS Objects that cannot be effectively controlled by the JCS
Objects whose functions are important for the ability of the JCS to maintain control
Objects whose functions are of no consequence for the ability of the JCS to maintain control
1. Objects are included in the JCS
2. Objects may be included in the JCS
3. Objects are not included in the JCS
4. Objects are excluded from the description as a whole
Cockpit, Other Pilots (PF, PNF) Pilotsautomation, (PF, PNF) Pilots (PF, PNF)aircraft FMS
Crew Flight Local airspace
ATM
JCS JCS JCS JCS
Traffic flow
Fig. 4. Joint cognitive systems for free flight.
Many analyses of the possible effects of free flight tacitly assume that we are referring to a well-defined system (e.g., the pilots in the cockpit), and that the boundaries of that system remain unaffected by a change from managed to free flight. This assumption can unfortunately not be taken for granted. The first step must therefore be to consider whether the system boundaries change as a consequence of going from managed to free flight. Since pilots no longer will be guided by air traffic controllers but are given control over route selection, speed, flight path, and altitude, they have to pay more attention to what happens around them. One conceivable change is therefore that the environment of the flight JCS becomes the local airspace JCS rather than the traffic flow JCS, as shown in Fig. 4. Referring to Table 1 this means that it is necessary to consider how pilots within a local airspace can develop means of mutual control so that the trajectories of other flights become more predictable. 3.2. Changing system boundaries
Cockpit, Pilots (PF, PNF) Pilotsautomation, (PF, PNF) Pilots (PF, PNF) ATM FMS
Crew Flight Traffic flow Transportation
JCS JCS JCS JCS
Fig. 3. Joint cognitive systems for managed flight.
Airlines, airports
According to the arguments above, the primary issue to consider for the change to free flight should not be the traditional human factors concerns such as whether free flight will increase the workload on either the pilot or the air traffic controller, or whether it will make it harder to maintain situation awareness (e.g., Hilburn et al., 1997). The issues are rather what the responsibilities of the pilots will be after free flight compared to what they were before. Put differently, what process or processes are they going to
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
control and what are the boundaries of the system of which they are a part? As just one example, consider the following. In managed flight, the pilot’s main task is to monitor and control the aircraft’s position, while leaving the monitoring of the airspace to the controllers. In free flight, the pilot’s tasks might become to plan and select a route, to stay on course, and to monitor the airspace. This cannot avoid changing the scope or boundaries of the JCS and therefore also the nature of coping with complexity. In the case of managed flight, the description could usefully be focused on the flight crew or the flight. The ATM cannot formally be controlled by the flight, and will therefore be outside the boundary, i.e., a part of the environment. The same goes for other flights, since they are controlled by the ATM rather than by the crew in the plane. In the case of free flight, the ATM does not in principle affect the flight (at least during normal conditions) and may therefore either be included in the system or kept outside. Adjacent aircraft, however, clearly affect the flight and must therefore be included in the system, i.e., be inside the boundary. The JCS consequently changes from the single flight to the set of flights (aircraft) that are close enough to affect each other (Fig. 5). It is for this new JCS that the consequences of free flight should be investigated, rather than for the single flight or flight crew. One common strategy for efficient coping is to reduce the variability of the environment wherever possible. This can be done, for instance, by imposing restrictions on what others are allowed to do. In managed flight such restrictions are issued and monitored by the controllers, but in free flight they will have to be issued and monitored by the pilots themselves. The consequent demands on communication and coordination effectively lead to new tasks and therefore fundamentally change the nature of work. Other examples can easily be found, such as the problem of maintaining sufficient separation to other aircraft. The bottom line is that the introduction of free
Managed flight
413
flight will change the nature of the aviation transportation system. There will obviously be questions about the possible direct and indirect effects on pilots, air traffic controllers, and others; questions about new technology and new automation; questions about changes to risks, social relations, etc. There has already been a flood of investigations and reports that look at many of these details. The argument put forward here is that such efforts may be inappropriate if they are made under the assumption that the overall system is the same before and after free flight. It is not meaningful to embark on such investigations unless we fully understand what the nature of the system will be in a functional sense, i.e., what is it supposed to be able to do (goals), and what it needs in order to do it. 4. Changing requirements to control A cognitive system, and therefore also a joint cognitive system, is defined by its ability to maintain control, or more specifically to modify its behaviour on the basis of experience so as to achieve specific anti-entropic ends (Hollnagel and Woods, 2005). One framework for describing this ability is provided by the Extended Control Model (ECOM; Hollnagel et al., 2003), which describes the performance of a JCS as taking place on several layers of control simultaneously, using the notion of concurrent control loops. Some of these are closed (reactive), some are open (anticipatory), and some are mixed. The assumption of multiple layers of activity is crucial for the modelling approach, and although there is no theory that formally defines the number of layers, practice has shown that four layers are sufficient. Each layer is described in terms of a basic construct–action–event cycle (Fig. 6) that explains how a controlling system can maintain control of a dynamic process (Hollnagel, 1993). The basic principle is that decisions or
Free flight
Fig. 5. JCS boundaries in managed and free flight.
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
414
Disturbance
FEEDBACK EVENT
Mo
dif
ies
es
uc
od
Pr
CONSTRUCT Determines
ACTION
Fig. 6. Basic construct–action–event cycle.
‘actions’ are determined by the current understanding of the situation (called ‘construct’), which includes the anticipation or expectation of what will happen next. The ‘events’ represent the result of the actions (hence the feedback). If they match the expectations, they reinforce the ‘construct’; if there is a mismatch, the ‘construct’ must be modified. The ‘events’ can also be unexpected, for instance if they are due to disturbances; that, of course, also demands a modification of the ‘construct’. The ECOM describes a system’s performance by invoking four layers of control, each of which comprises the basic construct–action–event cycle in Fig. 6.
4.1. Control demands in managed and free flight The ECOM can be used to describe the interactions between the different layers for a single controller, but also the dependencies among multiple controllers. If we take the descriptions provided by Figs. 3 and 4 as a basis, a starting point would be to consider how control is distributed between the ‘flight’ and ‘traffic flow’ JCSs in the case of managed flight, and between the ‘flight’ and ‘local airspace’ JCS in the case of free flight. In the case of managed flight (Fig. 8), the pilots’ task is to follow the flight path given by air traffic control and to stay within the flight corridor. Given the high level of automation in today’s airplanes, work mostly takes place on the monitoring and regulating layers, often with monitoring as the dominating demand. Similarly, the tasks of ATM are to guide and monitor the aircraft that have been assigned to the sector. Just as the targets for the pilots are set by ATM, many of the targets for ATM also have an Situation assessment
rg et in g
Current understanding
Goal / targets Anticipatory control
Information M on ito ri n g
Goal / targets
Plans / objec tives
Situation assessment Re gu la t in g
Plans / objectives
Actions / target values
Measurements / feedback
Tr
Compensatory control
ac kin
The overall structure of the ECOM is illustrated in Fig. 7, which shows the relations among the four layers in a simplified manner. To avoid graphical clutter, Fig. 7 includes only the goal dependencies among the layers; other dependencies exist, for instance, in the propagation of feedback or events. For the same reason each layer is represented only by one construct–action–event cycle, even though there normally will be several concurrent cycles or loops. The arrows at the right-hand side of Fig. 7 indicate the relative weight of feedback and feedforward control for each layer.
Ta
g
The tracking layer describes the activities required to keep a JCS inside predetermined performance boundaries, typically in terms of safety or efficiency. Tracking is closed-loop and activities at the tracking layer usually are performed in an automatic and unattended manner. They may, however, become attended, hence more like regulating, if conditions change. The regulating layer describes the activities by which a JCS achieves short-term goals, such as specific manoeuvres relative to the environment (which need not be physical space). It also provides the goals and criteria for the tracking layer. Although regulating itself basically is a closed-loop activity, it does not always run smoothly and automatically but may require attention and effort. Whereas activities at the regulating layer may lead to either direct actions or goals for the tracking layer, activities at the monitoring layer are mainly concerned with setting objectives and activating plans for actions. This can involve monitoring the condition of the aircraft, although this has in many cases been taken over by automation, or monitoring the state of the environment. The last type of action occurs at the targeting layer. In free flight, the targets or goals may refer to route selection, speed, flight path, and altitude. Some goals may give rise to several subgoals and activities, which
possibly can be automated or supported in some way. Other goals have to do with criteria for acceptable performance. Goal-setting is distinctly an open-loop activity, and assessing the change relative to the goal is not based on simple feedback, but rather on a loose assessment of the situation—for instance, proximity to target. When the assessment is done regularly it may be considered as being a part of monitoring and control.
Actions / target values
Corrective actions
Fig. 7. The Extended Control Model (ECOM).
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
Pilots
415
ATM Airlines Regulators
Targeting
Targeting
Monitoring
Monitoring
Regulating
Regulating Tracking
Tracking
Fig. 8. Control demands in managed flight.
Pilots
ATM Airlines
Traffic
Regulators
Targeting
Targeting
Monitoring
Monitoring
Regulating
Regulating
Tracking
Tracking
Fig. 9. Control demands in free flight.
external origin, namely airlines and regulators. Although there is some computerised support, the extent of automation is fairly low and the demands to control are on the regulating, monitoring and targeting layers. The coupling between the two JCSs is accordingly between the ATM targeting layer and the ‘flight’ monitoring layer, as well as between the ‘flight’ regulating layer and the ATM monitoring layer. In other words, the situation corresponds to a kind of mutual monitoring condition where the emphasis is on communication and coordination rather than close collaboration. In the case of free flight (Fig. 9), the pilots’ tasks are to maintain safe separation while optimising the route with regard to criteria such as fuel economy, arrival time, and passenger comfort. In contrast to the managed flight situation, the targets are not provided by ATM but are set externally by the airlines and the regulators, or are derived from the traffic situation. There is at present relatively little automation to assist the pilots who therefore may experience increased task demands. The demands to control now extend to the targeting, monitoring, and regulating layers. In this situation, the tasks of ATM have been reduced and are now mainly to monitor the aircraft to ensure safe separation. This is likely to be supported by automation, such as Mid Term Collision Detection (Graham et al., 2000). The coupling between the two JCSs in free flight conditions will be between the ‘flight’ regulating layer and the ATM monitoring layer, as well as possibly between the ATM regulating layer and the ‘flight’ targeting layer (in the case of imminent conflicts).
According to this description, the coupling changes from one of mutual monitoring condition to one of unilateral monitoring and emphasis is on collaboration and coordination, rather than communication. The overall situation is, however, more complex since there are multiple ‘flight’ JCSs that must consider each other. The same principles can be applied to analyse these couplings, although that has not been done here. 5. Conclusions This paper has argued that in order to fully understand the potential effects of a change from managed to free flight, it is necessary to understand how the nature of work changes, i.e., to adopt an ‘outer’ rather than an ‘inner’ view. The change from managed to free flight will not only change the working conditions for pilots but will also affect what air traffic controllers do. Since the two groups can be considered both as individual JCSs and as parts in a larger JCS, it is necessary to understand how the change to free flight may change system boundaries as well as system interactions. Studies of specific phenomena, such as workload or decision-making, are always carried out under certain assumptions. While it is quite reasonable to expect that a change in the work environment will affect how specific functions or tasks are carried out, it must first be ascertained whether the nature of work remains the same as before. While many human factors studies seem tacitly to assume that the substitution myth is valid, i.e., that new
ARTICLE IN PRESS 416
E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
tools do not alter the situations in which they are used, general experience from field studies across many domains teaches us otherwise. What we need to study is therefore not different work under same the conditions, but rather different work under different conditions. One way of determining what the different conditions may be is to find the boundaries for the JCS that are being considered and to characterise the demands to control. The paper provides an illustration of how that can be done for the two conditions of managed flight and free flight. The conclusion from this analysis is that the demands to control and hence the tasks required differ considerably. Before we focus more specifically on the effects of free flight on pilots’ performance, on workload and awareness, we need to understand effects of changes to system boundaries and system goals. References Alter, K.W., Regal, D.M., 1992. Definition of the 2005 flight deck environment—final report. NASA-CR.-4479, NAS 1.26:4479, NASA, Washington, DC. Avans, D., Smith, K., 1996. Experimental investigations of pilot workload in free flight. In: Proceedings of the Human Factors and Ergonomics Society 40th Annual Meeting, p. 1259. Beer, S., 1964. Cybernetics and Management. Science Editions, New York. Cook, R.I., Woods, D.D., 1996. Adapting to new technology in the operating room. Hum. Factors 38 (4), 593–613. Duong, V., 1996. Dynamic models for airborne air traffic management capability: state of art analysis. Executive Summary. EEC task R.11, EATCHIP task FCO.ETI.ST06. Eurocontrol Experimental Centre, Cedex, France. Graham, R., Marsden, A., Pichancourt, I., Dowling, F., 2000. Controller roles—time to change. In: Third USA/Europe Air Traffic Management R&D Seminar, Napoli, 13–16 June 2000. Hall, A.D., Fagen, R.E., 1968. Definition of system. In: Buckley, W. (Ed.), Modern Systems Research for the Behavioural Scientist. Aldine Publishing Company, Chicago. Hammond, K.R., 1993. Naturalistic decision making from a Brunswikian viewpoint: its past, present, future. In: Klein, G.A., Oramasu, J.,
Calderwood, R., Zsambok, C.E. (Eds.), Decision Making in Action: Models and Methods. Ablex, Norwood, NJ, pp. 205–227. Hilburn, B., Bakker, M.W.P., Pekela, W.D., 1997. The effect of free flight on air traffic controller mental workload, monitoring and system performance. NLR Technical Paper TP97237. National Aerospace Laboratory NLR, Amsterdam, The Netherlands. Hoekstra, J.M., Ruigrok, R.C.J., van Gent, R.N.H.W., 2000. Free flight in a crowded airspace? In: Third USA/Europe Air Traffic Management R&D Seminar, Napoli, 13–16 June 2000. Hollnagel, E., 1993. Human Reliability Analysis: Context and Control. Academic Press, London. Hollnagel, E., Woods, D.D., 1983. Cognitive systems engineering: new wine in new bottles. Int. J. Man-Mach. Stud. 18, 583–600. Hollnagel, E., Woods, D.D., 2005. Joint Cognitive Systems: Foundations of Cognitive Systems Engineering. CRC Press, Boca Raton, FL. Hollnagel, E., Na˚bo, A., Lau, I., 2003. A systemic model for Driver-inControl. In: Proceedings of the Second International Driving Symposium on Human Factors in Driver Assessment, Training, and Vehicle Design. July 21–24, Public Policy Center, University of Iowa, Park City, UT. Hutchins, E., 1995. Cognition in the Wild. MIT Press, Cambridge, MA. Klein, G.A., Oramasu, J., Calderwood, R., Zsambok, C.E. (Eds.), 1993. Decision Making in Action: Models and Methods. Ablex, Norwood, NJ. Liang, D., Chin, D.K., 1998. CNS/ATM enhancements to reduce aircraft emissions. In: Proceedings of the Second USA/Europe Air Traffic Management R&D Seminar. Orlando, FL. Pritchett, A.R., Hansman, R.J., 1993. Variations in ‘‘party line’’ information importance between pilots of different characteristics. In: Proceedings of the Eighth International Symposium on Aviation Psychology. Columbus, OH, pp. 128–133. RTCA, 1995. Final Report of RTCA Task Force 3—Free Flight Implementation. RTCA, Inc., Washington, DC. Sarter, N.B., Woods, D.D., Billings, C.E., 1997. Automation surprises. In: Salvendy, G. (Ed.), Handbook of Human Factors & Ergonomics, second ed. Wiley, New York. Small, D.W., Carlson, L.S., Kerns, K., 1995. Human factors issues in free flight. MP 95W0000184, MITRE CAASD, McLean, VA. Wiener, N., 1954. The Human Use of Human Beings: Cybernetics and Society. Houghton Mifflin, Boston. Woods, D.D., Sarter, N.B., 2000. Learning from automation surprises and ‘going sour’ accidents. In: Sarter, N.B., Amalberti, R. (Eds.), Cognitive Engineering in the Aviation Domain. Lawrence Erlbaum Associates, Mahwah, NJ, pp. 327–354.
Applied Ergonomics 38 (2007) 409–416 www.elsevier.com/locate/apergo
Flight decks and free flight: Where are the system boundaries? Erik Hollnagel Industrial Safety Chair, E´cole des Mines de Paris—Poˆle Cindyniques, Rue Claude Daunesse, B.P. 207, F-06904 Sophia Antipolis Cedex, France Accepted 31 January 2007
Abstract The change from managed to free flight is expected to have large effects, over and above the intended efficiency gains. Human factor concerns have understandably focused on how free flight may affect the pilots in the cockpit. Yet it is necessary to see the change from managed to free flight as more than just an increment to the pilots’ work. Despite the best intentions the transition will not be a case of a smooth, carefully planned and therefore uneventful introduction of a new technology. It is more likely to be a substantial change to an already challenging working environment, in the air as well as on the ground. The significant effects will therefore not just happen within the existing structure or distribution of work and responsibilities, but affect the structure of work itself. This paper takes a look at free flight from a cognitive systems engineering perspective and identifies two major concerns: first what effects free flight has on the boundaries of the joint cognitive systems, and second how this affects demands to control. The conclusion is that both will change considerably and that we need to understand the nature of these changes before focusing on the possible effects of free flight on pilots’ performance. r 2007 Elsevier Ltd. All rights reserved. Keywords: Control; Delegation; Joint cognitive system; Substitution myth; System boundaries
1. Introduction When a new or modified technological system is taken into use there will always be something that works differently from what was planned and expected, despite the best efforts of designers and engineers. Practitioners usually need time both to tailor the system to meet their needs and to tailor their own practices to overcome design slips and quirks (Cook and Woods, 1996). This applies to human–technology interaction, as well as to human– human interaction and social practices. Most systems, even very complex ones, nevertheless reach a level of stable performance if they are allowed to work relatively undisturbed for some time. Many working environments are unfortunately subject to frequent change because new technology is introduced— often in the sanguine hope of improving efficiency, safety, or the well-being of the work force, because of a need to improve overall performance, to patch designs flaw or to prevent the recurrence of a serious incident or accident. E-mail address: [email protected]. 0003-6870/$ - see front matter r 2007 Elsevier Ltd. All rights reserved. doi:10.1016/j.apergo.2007.01.010
In the business of civil aviation, one force for change is the overall growth in the number of passengers, which shows little sign of decreasing. Based on an ICAO forecast of a growth in world air travel of 5% per annum until 2020, it can be estimated that by then the number of aircraft within a given airspace will be double that of today—unless, of course, all aircraft double the number of passengers they can carry. So far the solution to the growing air traffic has been to increase the number of aircraft a controller handles, or if that is not possible then to increase the number of sectors, thereby limiting the number of aircraft within a sector. Neither solution is tenable in the long run, for rather obvious reasons: increasing task demands and an increasing number of hand-over conditions and therefore also more communication. A different solution proposed for this problem is free flight, defined as ‘‘a safe and efficient flight operating capability under instrument flight rules in which the operators have the freedom to select their path and speed in real time’’ (RTCA, 1995). The meaning of free flight is that pilots are no longer restricted to fly inside the established air corridors. Instead pilots and airlines are
ARTICLE IN PRESS 410
E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
allowed self-optimisation of the routes by being given control over route selection and changes in speed, flight path, and altitude—all subject to Instrument Flight Rule conditions. According to its promoters, free flight is expected to lead to significant advantages in terms of time and fuel savings for operators and airlines (Liang and Chin, 1998). It will allow pilots on their own initiative to avoid weather and other factors that crop up during flight. Free flight, however, does not mean that pilots can fly where and when they please. Air traffic restrictions will still be imposed to ensure safe separation of aircraft. It is hardly surprising if a change of this nature will have far reaching consequences for both pilots and air traffic controllers. While it is hoped that the effects will be mainly beneficial, there are legitimate concerns about increased risks of collisions, deterioration of working conditions for pilots and air traffic controllers alike, etc. A considerable number of studies have already been carried out which look at specific effects, e.g., in terms of workload or conflicts (Hilburn et al., 1997) or the increased risk of collisions (Hoekstra et al., 2000). This paper will look at another consequence of introducing new technology, namely the way it affects work practices and therefore also the joint human–machine system. It is argued that it is important to understand the nature of such changes, since these are the basis for raising questions about more specific effects.
New tools alter the tasks for which they were designed, indeed alter the situations in which the tasks occur and even the conditions that cause people to want to engage in the tasks. (Carroll and Campbell, 1988, p. 4) Changes that go beyond that and intend to substitute part of the pilot’s work by introducing automation, obviously need even more scrutiny. When new automation is introduced into a system or when there is an increase in the autonomy of automated systems, developers often assume that adding ‘‘automation’’ is a simple substitution of a machine activity for human activity (the substitution myth). Empirical data on the relationship of people and technology suggest that is not the case. Instead, adding or expanding the machine’s role changes the cooperative architecture, changing the human’s role often in profound ways. (Sarter et al., 1997) The introduction of partially autonomous machine agents in a system has been likened to adding a new team member. This typically leads to new coordination demands and a redistribution of roles. Yet development projects rarely include specific considerations on how to make the automation an effective team player or consider evaluating possible systems along this dimension (Woods and Sarter, 2000). 2.1. The inner and the outer views
2. Incremental versus substantial change The consequences of introducing new technology are in many cases underestimated due to the general belief in the substitution myth. This is the common assumption—that artefacts are value neutral so that their introduction into a system only has intended and no unintended effects. The basis for this myth is the concept of interchangeability as used in the production industry where it was the basis for large-scale industrialisation, although the central principles are much older. The experience that identical parts can be interchanged is at least as old as Pi Sheng’s invention of the movable type during the Ch’ing-li period (1041–1048). Thus, if we have a number of identical parts, we can replace one part by another without any unwanted side-effects. This example pinpoints two important things about substitutability. One is that that substitutability only works when parts are not interacting, as in the movable types. Second, that there must not be any appreciable tear and wear or at least that it must be similar across all parts. If parts are interacting, they constitute a system with dependencies among parts, which almost by definition invalidates the substitution assumption. If the substitution principle is suspect in the case of technological components, it is even more in doubt in the case of a substitution of functionality. Although the change may intend only to support the pilot, the consequences may still be considerable.
In the case of free flight, the changes to the existing situation are so dramatic that the substitution myth clearly is inappropriate. Even a cursory knowledge of what goes in the cockpit makes it obvious that a change from managed to free flight will have significant consequences for the pilot’s working situation, in particular with regard to task demands and performance requirements. One consequence of free flight is, for instance, that the responsibility for maintaining safe separation must now be shared between pilots and air traffic controllers, and even eventually be transferred completely to the pilots—or rather the cockpits. Studies of cognition and work—or even more appropriately, studies of cognition at work—have traditionally focused on the cognition of the individual described in terms of what goes on in the individual’s mind. Despite the landmark work of people such as Hutchins (1995) and Klein et al. (1993), this tendency prevails. While this predilection for mental processes often is ascribed to the influence of information processing psychology and cognitivism, it is actually something that goes back to the beginning of psychology as a science, to what Hammond (1993) referred to as ‘Wundt’s choice’: the study of mental processes disentangled from all accessory conditions, i.e., from the complex relations between cognition and reality. According to this ‘inner’ view, changes to the pilots’ tasks can be expressed in terms of phenomena such as workload, resource and information management, attention effects, or
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
3. Joint cognitive systems
Decision making Attention Situation awareness
Workload
411
Events, context
Cognitive systems engineering (CSE) is concerned with coagency, i.e., with how the functioning and performance of a joint cognitive system can best be described and understood (Hollnagel and Woods, 1983, 2005). The focus of CSE is defined by the nature of work and by the entanglement that is a defining characteristic of work in practice. This leads to the following threads or themes:
Performance
Fig. 1. The inner view.
Staying in control? Changes to tasks? New responsibilities? Joint system boundaries?
Events, context Performance
Fig. 2. The outer view.
situation awareness (Fig. 1). It is therefore hardly surprising that a number of early studies tried to assess the changes that are expected according to such theories, e.g., Alter and Regal (1992), Avans and Smith (1996); Duong (1996); Pritchett and Hansman (1993), and Small et al. (1995). It is, however, necessary to see the change from managed to free flight as more than just an increment of the pilots’ work. The change is not a case of smooth, carefully planned and therefore uneventful introduction of a new technology, but rather represents a substantial change to the working environment brought on by economic demands. The significant effects will not only be those that happen within the existing structure or distribution of work and responsibilities, but also those that affect the structure of work itself. In other words, the question is whether the changes can be encompassed within the current understanding of what flying is, or whether they will require a revision of that concept. Fig. 2 illustrates some of the ways in which flying may change, e.g., new responsibilities for pilots, problems with staying in control, changes to the pilots’ tasks, and a revision of the boundaries between system and environment. In the following, the two most important of these issues will be considered: the boundaries of the joint cognitive system and changing requirements to control.
How people cope with the complexity that results from technological and socio-technical developments and innovation. This issue has become particularly potent due to the pace of development since the 1950s. Coping with complexity is a short-hand way of describing the ways in which practitioners (pilots, air traffic controllers, operators, etc.) manage and handle the demands that arise from an environment that may change rapidly and often in an unpredictable fashion. How people use artefacts in their work, specifically how the use of artefacts has become an intrinsic part of intentional activity. At present practically all work requires the use of artefacts to achieve the specified goals. Although artefacts that can support cognition, such as memory aids, have existed for many years the use of computers and information technology has made it possible to design artefacts for higher level cognitive functions, thereby often increasing the complexity. How humans and artefacts can be described as joint cognitive systems (JCS). This extends the scope from the interaction between humans and artefacts to human– technology coagency. CSE shifts the focus from humans and artefacts as separate units to the JCS as a single unit. An important consequence of focusing on the JCS is that the boundaries must be made explicit, both between the system and its environment and between the elements of the system.
The complexity of a system, hence the difficulties in coping, depends in the main on two closely coupled issues. One is the degree of orderliness or predictability of the system, which in turn is related to the time that is available. The other is the extent of the system, i.e., how large it is. A system can be defined as ‘‘a set of objects together with relationships between the objects and between their attributes’’ (Hall and Fagen, 1968, p. 81)—or just as anything that consists of parts connected together. It is therefore clearly important how large the system is, i.e., how many ‘objects’ it contains and how many interrelations there are. 3.1. Joint system boundaries It is normally taken for granted that it is meaningful to speak about a system and its environment, i.e., that welldefined boundaries exist. But defining or setting the boundary of a system is no trivial matter. The fact that
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
412
we habitually describe some systems in one way, for instance as the ubiquitous human–machine system, does not mean that this is the natural way to do it, nor that it is inherently meaningful, as discussed already by Wiener (1954). Although it has been common practice in engineering and human factors to base the boundary on structural considerations, there are alternative approaches. For example, adopting the classical human–machine systems approach, the pilots in the cockpit can be seen as one system—the flight crew—for which cockpit automation and flight management systems constitute the environment. This decomposition is the basis for a majority of studies of pilots in the cockpit, both for current flight conditions and for free flight. It is, however, also possible to consider the airplane, i.e., pilots plus flight control and automation, as the system—the flight JCS—for which the air traffic management (ATM) is the environment. In this case, the boundary has been enlarged, and the ‘new’ system clearly has functional characteristics of its own. It is possible to go one step further and consider the pilots and the ATM as one system—the traffic flow JCS—in which case the environment is the airlines, the airports, and so on. Fig. 3 shows four levels of description for managed flight. In the case of a JCS, the boundary depends both on the purpose of the analysis and on the purpose of the JCS. Using an example proposed by Beer (1964), a manufacturing cell in a garment factory may be considered as a JCS. While it is in itself a component of the larger system for garment production, it can also be seen as containing components, for instance a number of person-cum-scissor units. Each of these units can again be seen as a JCS since they comprise a human working with an artefact. The point of Beer’s definition, and of system definitions in general, is to emphasise that there is no ‘natural’ way of setting the boundary between a system and its environment: it depends on the purpose of the analysis. It follows from the principles of CSE that the boundaries may be based on system functions rather than on system structures, i.e., on what a system does rather than on what it is. If we consider systems as JCSs in the manner described above, then the boundaries can be derived using the guidelines shown in Table 1. The functional criterion here is that the JCS must be able to meet its objectives, which in essence means that it must be able to maintain control.
Table 1 A pragmatic definition of JCS boundaries
Objects that can be effectively controlled by the JCS Objects that cannot be effectively controlled by the JCS
Objects whose functions are important for the ability of the JCS to maintain control
Objects whose functions are of no consequence for the ability of the JCS to maintain control
1. Objects are included in the JCS
2. Objects may be included in the JCS
3. Objects are not included in the JCS
4. Objects are excluded from the description as a whole
Cockpit, Other Pilots (PF, PNF) Pilotsautomation, (PF, PNF) Pilots (PF, PNF)aircraft FMS
Crew Flight Local airspace
ATM
JCS JCS JCS JCS
Traffic flow
Fig. 4. Joint cognitive systems for free flight.
Many analyses of the possible effects of free flight tacitly assume that we are referring to a well-defined system (e.g., the pilots in the cockpit), and that the boundaries of that system remain unaffected by a change from managed to free flight. This assumption can unfortunately not be taken for granted. The first step must therefore be to consider whether the system boundaries change as a consequence of going from managed to free flight. Since pilots no longer will be guided by air traffic controllers but are given control over route selection, speed, flight path, and altitude, they have to pay more attention to what happens around them. One conceivable change is therefore that the environment of the flight JCS becomes the local airspace JCS rather than the traffic flow JCS, as shown in Fig. 4. Referring to Table 1 this means that it is necessary to consider how pilots within a local airspace can develop means of mutual control so that the trajectories of other flights become more predictable. 3.2. Changing system boundaries
Cockpit, Pilots (PF, PNF) Pilotsautomation, (PF, PNF) Pilots (PF, PNF) ATM FMS
Crew Flight Traffic flow Transportation
JCS JCS JCS JCS
Fig. 3. Joint cognitive systems for managed flight.
Airlines, airports
According to the arguments above, the primary issue to consider for the change to free flight should not be the traditional human factors concerns such as whether free flight will increase the workload on either the pilot or the air traffic controller, or whether it will make it harder to maintain situation awareness (e.g., Hilburn et al., 1997). The issues are rather what the responsibilities of the pilots will be after free flight compared to what they were before. Put differently, what process or processes are they going to
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
control and what are the boundaries of the system of which they are a part? As just one example, consider the following. In managed flight, the pilot’s main task is to monitor and control the aircraft’s position, while leaving the monitoring of the airspace to the controllers. In free flight, the pilot’s tasks might become to plan and select a route, to stay on course, and to monitor the airspace. This cannot avoid changing the scope or boundaries of the JCS and therefore also the nature of coping with complexity. In the case of managed flight, the description could usefully be focused on the flight crew or the flight. The ATM cannot formally be controlled by the flight, and will therefore be outside the boundary, i.e., a part of the environment. The same goes for other flights, since they are controlled by the ATM rather than by the crew in the plane. In the case of free flight, the ATM does not in principle affect the flight (at least during normal conditions) and may therefore either be included in the system or kept outside. Adjacent aircraft, however, clearly affect the flight and must therefore be included in the system, i.e., be inside the boundary. The JCS consequently changes from the single flight to the set of flights (aircraft) that are close enough to affect each other (Fig. 5). It is for this new JCS that the consequences of free flight should be investigated, rather than for the single flight or flight crew. One common strategy for efficient coping is to reduce the variability of the environment wherever possible. This can be done, for instance, by imposing restrictions on what others are allowed to do. In managed flight such restrictions are issued and monitored by the controllers, but in free flight they will have to be issued and monitored by the pilots themselves. The consequent demands on communication and coordination effectively lead to new tasks and therefore fundamentally change the nature of work. Other examples can easily be found, such as the problem of maintaining sufficient separation to other aircraft. The bottom line is that the introduction of free
Managed flight
413
flight will change the nature of the aviation transportation system. There will obviously be questions about the possible direct and indirect effects on pilots, air traffic controllers, and others; questions about new technology and new automation; questions about changes to risks, social relations, etc. There has already been a flood of investigations and reports that look at many of these details. The argument put forward here is that such efforts may be inappropriate if they are made under the assumption that the overall system is the same before and after free flight. It is not meaningful to embark on such investigations unless we fully understand what the nature of the system will be in a functional sense, i.e., what is it supposed to be able to do (goals), and what it needs in order to do it. 4. Changing requirements to control A cognitive system, and therefore also a joint cognitive system, is defined by its ability to maintain control, or more specifically to modify its behaviour on the basis of experience so as to achieve specific anti-entropic ends (Hollnagel and Woods, 2005). One framework for describing this ability is provided by the Extended Control Model (ECOM; Hollnagel et al., 2003), which describes the performance of a JCS as taking place on several layers of control simultaneously, using the notion of concurrent control loops. Some of these are closed (reactive), some are open (anticipatory), and some are mixed. The assumption of multiple layers of activity is crucial for the modelling approach, and although there is no theory that formally defines the number of layers, practice has shown that four layers are sufficient. Each layer is described in terms of a basic construct–action–event cycle (Fig. 6) that explains how a controlling system can maintain control of a dynamic process (Hollnagel, 1993). The basic principle is that decisions or
Free flight
Fig. 5. JCS boundaries in managed and free flight.
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
414
Disturbance
FEEDBACK EVENT
Mo
dif
ies
es
uc
od
Pr
CONSTRUCT Determines
ACTION
Fig. 6. Basic construct–action–event cycle.
‘actions’ are determined by the current understanding of the situation (called ‘construct’), which includes the anticipation or expectation of what will happen next. The ‘events’ represent the result of the actions (hence the feedback). If they match the expectations, they reinforce the ‘construct’; if there is a mismatch, the ‘construct’ must be modified. The ‘events’ can also be unexpected, for instance if they are due to disturbances; that, of course, also demands a modification of the ‘construct’. The ECOM describes a system’s performance by invoking four layers of control, each of which comprises the basic construct–action–event cycle in Fig. 6.
4.1. Control demands in managed and free flight The ECOM can be used to describe the interactions between the different layers for a single controller, but also the dependencies among multiple controllers. If we take the descriptions provided by Figs. 3 and 4 as a basis, a starting point would be to consider how control is distributed between the ‘flight’ and ‘traffic flow’ JCSs in the case of managed flight, and between the ‘flight’ and ‘local airspace’ JCS in the case of free flight. In the case of managed flight (Fig. 8), the pilots’ task is to follow the flight path given by air traffic control and to stay within the flight corridor. Given the high level of automation in today’s airplanes, work mostly takes place on the monitoring and regulating layers, often with monitoring as the dominating demand. Similarly, the tasks of ATM are to guide and monitor the aircraft that have been assigned to the sector. Just as the targets for the pilots are set by ATM, many of the targets for ATM also have an Situation assessment
rg et in g
Current understanding
Goal / targets Anticipatory control
Information M on ito ri n g
Goal / targets
Plans / objec tives
Situation assessment Re gu la t in g
Plans / objectives
Actions / target values
Measurements / feedback
Tr
Compensatory control
ac kin
The overall structure of the ECOM is illustrated in Fig. 7, which shows the relations among the four layers in a simplified manner. To avoid graphical clutter, Fig. 7 includes only the goal dependencies among the layers; other dependencies exist, for instance, in the propagation of feedback or events. For the same reason each layer is represented only by one construct–action–event cycle, even though there normally will be several concurrent cycles or loops. The arrows at the right-hand side of Fig. 7 indicate the relative weight of feedback and feedforward control for each layer.
Ta
g
The tracking layer describes the activities required to keep a JCS inside predetermined performance boundaries, typically in terms of safety or efficiency. Tracking is closed-loop and activities at the tracking layer usually are performed in an automatic and unattended manner. They may, however, become attended, hence more like regulating, if conditions change. The regulating layer describes the activities by which a JCS achieves short-term goals, such as specific manoeuvres relative to the environment (which need not be physical space). It also provides the goals and criteria for the tracking layer. Although regulating itself basically is a closed-loop activity, it does not always run smoothly and automatically but may require attention and effort. Whereas activities at the regulating layer may lead to either direct actions or goals for the tracking layer, activities at the monitoring layer are mainly concerned with setting objectives and activating plans for actions. This can involve monitoring the condition of the aircraft, although this has in many cases been taken over by automation, or monitoring the state of the environment. The last type of action occurs at the targeting layer. In free flight, the targets or goals may refer to route selection, speed, flight path, and altitude. Some goals may give rise to several subgoals and activities, which
possibly can be automated or supported in some way. Other goals have to do with criteria for acceptable performance. Goal-setting is distinctly an open-loop activity, and assessing the change relative to the goal is not based on simple feedback, but rather on a loose assessment of the situation—for instance, proximity to target. When the assessment is done regularly it may be considered as being a part of monitoring and control.
Actions / target values
Corrective actions
Fig. 7. The Extended Control Model (ECOM).
ARTICLE IN PRESS E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
Pilots
415
ATM Airlines Regulators
Targeting
Targeting
Monitoring
Monitoring
Regulating
Regulating Tracking
Tracking
Fig. 8. Control demands in managed flight.
Pilots
ATM Airlines
Traffic
Regulators
Targeting
Targeting
Monitoring
Monitoring
Regulating
Regulating
Tracking
Tracking
Fig. 9. Control demands in free flight.
external origin, namely airlines and regulators. Although there is some computerised support, the extent of automation is fairly low and the demands to control are on the regulating, monitoring and targeting layers. The coupling between the two JCSs is accordingly between the ATM targeting layer and the ‘flight’ monitoring layer, as well as between the ‘flight’ regulating layer and the ATM monitoring layer. In other words, the situation corresponds to a kind of mutual monitoring condition where the emphasis is on communication and coordination rather than close collaboration. In the case of free flight (Fig. 9), the pilots’ tasks are to maintain safe separation while optimising the route with regard to criteria such as fuel economy, arrival time, and passenger comfort. In contrast to the managed flight situation, the targets are not provided by ATM but are set externally by the airlines and the regulators, or are derived from the traffic situation. There is at present relatively little automation to assist the pilots who therefore may experience increased task demands. The demands to control now extend to the targeting, monitoring, and regulating layers. In this situation, the tasks of ATM have been reduced and are now mainly to monitor the aircraft to ensure safe separation. This is likely to be supported by automation, such as Mid Term Collision Detection (Graham et al., 2000). The coupling between the two JCSs in free flight conditions will be between the ‘flight’ regulating layer and the ATM monitoring layer, as well as possibly between the ATM regulating layer and the ‘flight’ targeting layer (in the case of imminent conflicts).
According to this description, the coupling changes from one of mutual monitoring condition to one of unilateral monitoring and emphasis is on collaboration and coordination, rather than communication. The overall situation is, however, more complex since there are multiple ‘flight’ JCSs that must consider each other. The same principles can be applied to analyse these couplings, although that has not been done here. 5. Conclusions This paper has argued that in order to fully understand the potential effects of a change from managed to free flight, it is necessary to understand how the nature of work changes, i.e., to adopt an ‘outer’ rather than an ‘inner’ view. The change from managed to free flight will not only change the working conditions for pilots but will also affect what air traffic controllers do. Since the two groups can be considered both as individual JCSs and as parts in a larger JCS, it is necessary to understand how the change to free flight may change system boundaries as well as system interactions. Studies of specific phenomena, such as workload or decision-making, are always carried out under certain assumptions. While it is quite reasonable to expect that a change in the work environment will affect how specific functions or tasks are carried out, it must first be ascertained whether the nature of work remains the same as before. While many human factors studies seem tacitly to assume that the substitution myth is valid, i.e., that new
ARTICLE IN PRESS 416
E. Hollnagel / Applied Ergonomics 38 (2007) 409–416
tools do not alter the situations in which they are used, general experience from field studies across many domains teaches us otherwise. What we need to study is therefore not different work under same the conditions, but rather different work under different conditions. One way of determining what the different conditions may be is to find the boundaries for the JCS that are being considered and to characterise the demands to control. The paper provides an illustration of how that can be done for the two conditions of managed flight and free flight. The conclusion from this analysis is that the demands to control and hence the tasks required differ considerably. Before we focus more specifically on the effects of free flight on pilots’ performance, on workload and awareness, we need to understand effects of changes to system boundaries and system goals. References Alter, K.W., Regal, D.M., 1992. Definition of the 2005 flight deck environment—final report. NASA-CR.-4479, NAS 1.26:4479, NASA, Washington, DC. Avans, D., Smith, K., 1996. Experimental investigations of pilot workload in free flight. In: Proceedings of the Human Factors and Ergonomics Society 40th Annual Meeting, p. 1259. Beer, S., 1964. Cybernetics and Management. Science Editions, New York. Cook, R.I., Woods, D.D., 1996. Adapting to new technology in the operating room. Hum. Factors 38 (4), 593–613. Duong, V., 1996. Dynamic models for airborne air traffic management capability: state of art analysis. Executive Summary. EEC task R.11, EATCHIP task FCO.ETI.ST06. Eurocontrol Experimental Centre, Cedex, France. Graham, R., Marsden, A., Pichancourt, I., Dowling, F., 2000. Controller roles—time to change. In: Third USA/Europe Air Traffic Management R&D Seminar, Napoli, 13–16 June 2000. Hall, A.D., Fagen, R.E., 1968. Definition of system. In: Buckley, W. (Ed.), Modern Systems Research for the Behavioural Scientist. Aldine Publishing Company, Chicago. Hammond, K.R., 1993. Naturalistic decision making from a Brunswikian viewpoint: its past, present, future. In: Klein, G.A., Oramasu, J.,
Calderwood, R., Zsambok, C.E. (Eds.), Decision Making in Action: Models and Methods. Ablex, Norwood, NJ, pp. 205–227. Hilburn, B., Bakker, M.W.P., Pekela, W.D., 1997. The effect of free flight on air traffic controller mental workload, monitoring and system performance. NLR Technical Paper TP97237. National Aerospace Laboratory NLR, Amsterdam, The Netherlands. Hoekstra, J.M., Ruigrok, R.C.J., van Gent, R.N.H.W., 2000. Free flight in a crowded airspace? In: Third USA/Europe Air Traffic Management R&D Seminar, Napoli, 13–16 June 2000. Hollnagel, E., 1993. Human Reliability Analysis: Context and Control. Academic Press, London. Hollnagel, E., Woods, D.D., 1983. Cognitive systems engineering: new wine in new bottles. Int. J. Man-Mach. Stud. 18, 583–600. Hollnagel, E., Woods, D.D., 2005. Joint Cognitive Systems: Foundations of Cognitive Systems Engineering. CRC Press, Boca Raton, FL. Hollnagel, E., Na˚bo, A., Lau, I., 2003. A systemic model for Driver-inControl. In: Proceedings of the Second International Driving Symposium on Human Factors in Driver Assessment, Training, and Vehicle Design. July 21–24, Public Policy Center, University of Iowa, Park City, UT. Hutchins, E., 1995. Cognition in the Wild. MIT Press, Cambridge, MA. Klein, G.A., Oramasu, J., Calderwood, R., Zsambok, C.E. (Eds.), 1993. Decision Making in Action: Models and Methods. Ablex, Norwood, NJ. Liang, D., Chin, D.K., 1998. CNS/ATM enhancements to reduce aircraft emissions. In: Proceedings of the Second USA/Europe Air Traffic Management R&D Seminar. Orlando, FL. Pritchett, A.R., Hansman, R.J., 1993. Variations in ‘‘party line’’ information importance between pilots of different characteristics. In: Proceedings of the Eighth International Symposium on Aviation Psychology. Columbus, OH, pp. 128–133. RTCA, 1995. Final Report of RTCA Task Force 3—Free Flight Implementation. RTCA, Inc., Washington, DC. Sarter, N.B., Woods, D.D., Billings, C.E., 1997. Automation surprises. In: Salvendy, G. (Ed.), Handbook of Human Factors & Ergonomics, second ed. Wiley, New York. Small, D.W., Carlson, L.S., Kerns, K., 1995. Human factors issues in free flight. MP 95W0000184, MITRE CAASD, McLean, VA. Wiener, N., 1954. The Human Use of Human Beings: Cybernetics and Society. Houghton Mifflin, Boston. Woods, D.D., Sarter, N.B., 2000. Learning from automation surprises and ‘going sour’ accidents. In: Sarter, N.B., Amalberti, R. (Eds.), Cognitive Engineering in the Aviation Domain. Lawrence Erlbaum Associates, Mahwah, NJ, pp. 327–354.