Safety-relevant mode confusions—modelling and reducing them

Bredereke, Jan; Lankenau, Axel

doi:10.1016/j.ress.2004.07.020

Cited by 41 publications

(26 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…System failure can occur due to the interactions, even if all the components on their own are functional. As there is degree of autonomy in most aircraft, the pilot's ability to interact effectively with the system without losing too much control or situational awareness is extremely important so that in an emergency event the pilot is still able to effectively take manual control of the aircraft [11,15,49] or transition from one level of control (autopilot) to another (manual) [37], with incomplete information [46], or mode confusion [50] (dissonance between the mental model of the operator and the actual state of the technical system). The sociotechnical interactions on the flight desk are still not fully understood, particularly with respect to how they are affected by cultural influences [15], the representations of the hardware state to the pilot [46], and how the pilot builds mental awareness of the environment [51].…”

Section: Cognitive Processes and Sociotechnical Interactionsmentioning

confidence: 99%

Aviation Human Error Modelled as a Production Process

Pons¹,

Dey

2015

TOERGJ

View full text Add to dashboard Cite

As technology systems have become more complex, so it is increasingly difficult for human operators to comprehend how the system is behaving. There is a need to better understand the causes of human-error in the context of the situational variables. The specific case under examination is the process of landing an aircraft. This paper applies a production engineering perspective. By production-process, we refer to the set of actions that are necessary to move a system from one state to a desired new state. Such processes involve mechanisms for taking inputs and converting them to the desired outputs, under certain controls and constraints. Human error is thus treated as a constraint on the processes. A novel process methodology is developed to represent how technical systems, situational variables, external factors, and human error evolve over time in a process. The applicability is demonstrated with a dataset of case studies. In parallel, a new categorization of human errors is derived for this situation. The method permits cases to be examined individually, and also collectively for patterns. The results show that the initial landing approach is often the point of error initiation. For the specific case of landing accidents the methodology identifies that the failure causality was the lack of attention to establish procedure at the very start of descent, followed by persistent disregard of disconfirmatory evidence at the initial landing approach, especially under conditions of poor visibility. The paper makes a methodological contribution as well as suggesting new insights for how human error occurs at landing.

show abstract

Section: Cognitive Processes and Sociotechnical Interactionsmentioning

confidence: 99%

Aviation Human Error Modelled as a Production Process

Pons¹,

Dey

2015

TOERGJ

View full text Add to dashboard Cite

show abstract

“…These include techniques that only use a model of the HDI [8]- [11], [17]- [20], methods that use human mental models as part of larger system models [14]- [16], [21]- [23], and approaches that use cognitive architectures as part of the system model [24]- [34]. Bolton et al [51] note that there are tradeoffs between these and the task model-based approaches.…”

Section: B Comparison With Other Methodsmentioning

confidence: 99%

Generating Erroneous Human Behavior From Strategic Knowledge in Task Models and Evaluating Its Impact on System Safety With Model Checking

Bolton

Bass

2013

IEEE Trans. Syst. Man Cybern, Syst.

View full text Add to dashboard Cite

Human-automation interaction, including erroneous human behavior, is a factor in the failure of complex, safety-critical systems. This paper presents a method for automatically generating formal task analytic models encompassing both erroneous and normative human behavior from normative task models, where the misapplication of strategic knowledge is used to generate erroneous behavior. Resulting models can be automatically incorporated into larger formal system models so that safety properties can be formally verified with a model checker. This allows analysts to prove that a human-automation interactive system (as represented by the formal model) will or will not satisfy safety properties with both normative and generated erroneous human behavior. Benchmarks are reported that illustrate how this method scales. The method is then illustrated with a case study: the programming of a patientcontrolled analgesia pump. In this example, a problem resulting from a generated erroneous human behavior is discovered. The method is further employed to evaluate the effectiveness of different solutions to the discovered problem. The results and future research directions are discussed.Index Terms-Formal methods, human error, humanautomation interaction (HAI), model checking, system safety, task analysis.

show abstract

“…Concerning automation surprises, and in particular mode confusion, Rushby et al [24], [25] and Bredereke and Lankenau [26], [27] have worked on formalizing mode confusion and have proposed techniques to reduce it. The former used the Murφ model-checker, while the latter worked on specification/implementation refinement relations.…”

Section: Related Workmentioning

confidence: 99%

Automatic Detection of Potential Automation Surprises for ADEPT Models

Combéfis¹,

Giannakopoulou

Pecheur

2016

IEEE Trans. Human-Mach. Syst.

View full text Add to dashboard Cite

This paper describes how to automatically detect potential automation surprises in interactive systems, within a rapid automation interface design tool named ADEPT. The proposed analysis method in this paper is based on a conformance relation, called full-control, between the model of the actual system and a mental model of it, that is, its behavior as perceived by the operator. The method can, among other things, automatically generate a so-called minimal full-control mental model for a given system. Systems are well designed if they can be described by relatively simple mental models for their operators, which can be assessed with the minimal full-control mental model generation algorithms. During the generation, potential automation surprises are detected and highlighted with execution examples that may lead to confusion. The analysis methods are based on an enriched version of labeled transition systems to describe the system and mental models. In order to be able to integrate the analysis method within ADEPT, a semantics for ADEPT models makes it possible to translate them into enriched LTSs. The proposed translation is automated for a specified class of ADEPT models that are characterized and defined in this paper. A case study demonstrates the proposed analysis framework and informs how the integration with ADEPT can be improved.Index Terms-ADEPT toolset, formal methods, human factors, human-machine interaction.

show abstract

Safety-relevant mode confusions—modelling and reducing them

Cited by 41 publications

References 15 publications

Aviation Human Error Modelled as a Production Process

Aviation Human Error Modelled as a Production Process

Generating Erroneous Human Behavior From Strategic Knowledge in Task Models and Evaluating Its Impact on System Safety With Model Checking

Automatic Detection of Potential Automation Surprises for ADEPT Models

Contact Info

Product

Resources

About