Petri net-based modelling of human–automation conflicts in aviation

Analyses of aviation safety reports reveal that human–machine conflicts induced by poor automation design are remarkable precursors of accidents. A review of different crew–automation conflicting scenarios shows that they have a common denominator: the autopilot behaviour interferes with the pilot's goal regarding the flight guidance via ‘hidden’ mode transitions. Considering both the human operator and the machine (i.e. the autopilot or the decision functions) as agents, we propose a Petri net model of those conflicting interactions, which allows them to be detected as deadlocks in the Petri net. In order to test our Petri net model, we designed an autoflight system that was formally analysed to detect conflicting situations. We identified three conflicting situations that were integrated in an experimental scenario in a flight simulator with 10 general aviation pilots. The results showed that the conflicts that we had a-priori identified as critical had impacted the pilots' performance. Indeed, the first conflict remained unnoticed by eight participants and led to a potential collision with another aircraft. The second conflict was detected by all the participants but three of them did not manage the situation correctly. The last conflict was also detected by all the participants but provoked typical automation surprise situation as only one declared that he had understood the autopilot behaviour. These behavioural results are discussed in terms of workload and number of fired ‘hidden’ transitions. Eventually, this study reveals that both formal and experimental approaches are complementary to identify and assess the criticality of human–automation conflicts. Practitioner Summary: We propose a Petri net model of human–automation conflicts. An experiment was conducted with general aviation pilots performing a scenario involving three conflicting situations to test the soundness of our formal approach. This study reveals that both formal and experimental approaches are complementary to identify and assess the criticality conflicts.

[1]  Denis Javaux,et al.  Models and Mechanized Methods that Integrate Human Factors into Automation Design , 2000 .

[2]  Charles Lesire,et al.  Particle Petri Nets for Aircraft Procedure Monitoring Under Uncertainty , 2005, ICATPN.

[3]  N B Sarter,et al.  LEARNING FROM AUTOMATION SURPRISES AND "GOING SOUR" ACCIDENTS. IN: COGNITIVE ENGINEERING IN THE AVIATION DOMAIN , 2000 .

[4]  Nancy G. Leveson,et al.  Designing automation to reduce operator errors , 1997, 1997 IEEE International Conference on Systems, Man, and Cybernetics. Computational Cybernetics and Simulation.

[5]  Charles E. Billings,et al.  Aviation Automation: The Search for A Human-centered Approach , 1996 .

[6]  M R Endsley,et al.  Level of automation effects on performance, situation awareness and workload in a dynamic control task. , 1999, Ergonomics.

[7]  Janette Cardoso,et al.  Possibilistic Petri nets , 1999, IEEE Trans. Syst. Man Cybern. Part B.

[8]  Jon Damon Reese,et al.  Analyzing Software Specifications for Mode Confusion Potential , 1998 .

[9]  Denis Javaux,et al.  A method for predicting errors when interacting with finite state systems. How implicit learning shapes the user's knowledge of a system , 2002, Reliab. Eng. Syst. Saf..

[10]  Christopher D. Wickens,et al.  Pilots' Monitoring Strategies and Performance on Automated Flight Decks: An Empirical Study Combining Behavioral and Eye-Tracking Data , 2007, Hum. Factors.

[11]  Steven J. Landry,et al.  Flight Deck Automation , 2009, Handbook of Automation.

[12]  John Rushby,et al.  Using model checking to help discover mode confusions and other automation surprises , 2002, Reliab. Eng. Syst. Saf..

[13]  Michael D. Harrison,et al.  Systematic Analysis of Control Panel Interfaces Using Formal Tools , 2008, DSV-IS.

[14]  Toshiyuki Inagaki,et al.  Automation and the Cost of Authority , 2003 .

[15]  Hassane Alla,et al.  Discrete, continuous, and hybrid Petri Nets , 2004 .

[16]  Mickaël Causse,et al.  Mitigation of Conflicts with Automation , 2011, Hum. Factors.

[17]  Renwick E. Curry,et al.  Flight-deck automation: promises and problems , 1980 .

[18]  Frédéric Dehais,et al.  The Perseveration Syndrome in the Pilot's Activity: Guidelines and Cognitive Countermeasures , 2009, HESSD.

[19]  Christopher D. Wickens,et al.  Empirical Study Combining Behavioral and Eye-Tracking Data Pilots ' Monitoring Strategies and Performance on Automated Flight Decks : An , 2007 .

[20]  Johannes Weyer.  Modes of Governance of Hybrid Systems , 2006 .

[21]  Mark S. Young,et al.  Cooperation between drivers and automation: implications for safety , 2009 .

[22]  J. Orasanu,et al.  Cognitive and contextual factors in aviation accidents: Decision errors. , 2001 .

[23]  Mickaël Causse,et al.  Go-around manoeuver: a simulation study , 2012 .

[24]  D. Woods,et al.  Automation Surprises , 2001 .

[25]  Frédéric Dehais,et al.  GHOST: experimenting conflicts countermeasures in the pilot's activity , 2003, IJCAI 2003.

[26]  E. Palmer,et al.  An automated method to detect potential mode confusions , 1999, Gateway to the New Millennium. 18th Digital Avionics Systems Conference. Proceedings (Cat. No.99CH37033).

[27]  Dennis B. Beringer,et al.  Automation in General Aviation: Two Studies of Pilot Responses to Autopilot Malfunctions , 1999 .

[28]  J. Weyer,et al.  Modes of Governance of Hybrid Systems. The Mid-Air Collision at Ueberlingen and the Impact of Smart Technology , 2006 .

[29]  Frédéric Dehais,et al.  What the heck is it doing ? Better understanding Human-Machine conflicts through models. , 2012 .

[30]  Nadine B. Sarter,et al.  How in the World Did We Ever Get into That Mode? Mode Error and Awareness in Supervisory Control , 1995, Hum. Factors.

[31]  Didier Dubois,et al.  An introduction to possibilistic and fuzzy logics , 1990 .

[32]  E. Salas,et al.  Human Factors : The Journal of the Human Factors and Ergonomics Society , 2012 .

[33]  R.W. Butler,et al.  A formal methods approach to the analysis of mode confusion , 1998, 17th DASC. AIAA/IEEE/SAE. Digital Avionics Systems Conference. Proceedings (Cat. No.98CH36267).

[34]  R Parasuraman,et al.  Designing automation for human use: empirical studies and quantitative models , 2000, Ergonomics.