Cockpit Monitoring and Alerting Systems

Paul M. Satchell

• Publisher: Routledge
• Year: 2016
• ISBN:
  9781351950770
• Edition: 1
• Topic: Technology & Engineering
• Subtopic: Aeronautic & Astronautic Engineering
• Index: Technology & Engineering

While monitoring of computer-controlled systems is widespread, it is critically important in the cockpit of current passenger aircraft. Such monitoring requires special vigilance for those rare untoward events, which may be new to the pilot and which can have devastating consequences. This book uses a multidisciplinary approach to address this problem of sustaining attention while monitoring. It outlines and explains alternative ways of viewing the processes needed to prevent Human Factors accidents; it examines the use and limitations of cockpit resource management programmes in inducing behavioural and attitudinal changes appropriate for highly automated flight decks. The author's approach deals rigorously with the physiological mechanisms underlying vigilance, arousal and stress, delineating clearly those that are relevant to the monitoring function. The three parts cover: monitoring problems and processes; monitoring measurement and alerting systems; and monitoring management. In the last part the author details management plans and guidance for monitoring assisted systems based on his understanding of the problems of continued human vigilance. Readership: pilots and training pilots; cockpit resource management groups; monitoring management specialists; university aviation departments; road and rail transport groups; those operating nuclear and large process installations.

1 Introduction

Monitoring is a very widespread human activity and requires the maintenance of appropriate vigilance levels. Vigilance is often critical to the individual, customers, the organisation and in some situations, mankind. In examining the monitoring role, only certain types of monitoring are considered, although there are implications for helping the alertness of all those in any monitoring role. The type of monitoring that is principally under consideration is that where the chance of an untoward event is low, where the untoward event may be new to the monitor’s experience and where the consequences from an untoward event can be devastating. This includes the modern long range airliner cockpit, power stations (conventional and nuclear), aerospace applications, industrial monitoring of critical chemical and biological processes, many forms of transport, health care and financial market monitoring. Other critical monitoring areas occur in military and security systems. Monitoring might be seen as an outmoded activity, because it is a form of inspection of control systems which, if properly constructed, would be failure tolerant if not failure free. The capability of modern control systems does not allow such an optimistic view.

In this examination of alerting systems and the monitoring role, the cockpit of the long range passenger carrying aircraft will be used for examples and argument. The cockpit has always been at the forefront of technology. The configuration of the cockpit is driven by all the issues bearing on the man-machine interface, and because it is so insulated from the outside world, the cockpit must contain, either within it, or connected to it by communication systems, all the solutions to the problems of long duration equipment monitoring. The modern cockpit is where many human activities have been automated and the role of cockpit personnel changed from procedural specialists to an equipment monitor and man-machine interface manager. The advent of ultra-long haul flight will further distance humans from procedural activities. This distancing, or peripheralisation, is intimately related to the degree, as well as the style, of automation, and is a potent negative factor in monitoring efficacy.

The problem of long term monitoring in aircraft is not a new one. Pilots have always been aware of the responsibility, the necessity in times of stress, fatigue or conflict within or outside of the cockpit, of first scanning all the instruments and maintaining awareness of the state of the aircraft. Even those involved in the first long distance flights were aware of the disparity between the demands of the monitoring task and the limitations of human monitoring ability. Charles Lindberg, in his crossing of the Atlantic, was aware of the importance of human arousal and the consequences of hypoarousal and monitoring failure. For 34 hours, Lindberg flew without cockpit windows, sacrificing their streamlining effect, some aircraft speed and pilot comfort in exchange for improved pilot performance from direct contact with the external environment (Lindberg, 1953). Nearly 60 years later the Boeing Commercial Airplane Company has provided an alerting system in their latest widebody aircraft, the Boeing 747-400. Again, the disparity between the demands of the monitoring task in long distance commercial flight and human monitoring ability have resulted in aircraft modification, with its associated certification costs and probable changes in human behaviour. The effectiveness in combating hypoarousal of both Lindberg’s open cockpit and Boeing’s alerting system is unknown. Neither device monitors the state of alertness of the crew or provides the means whereby the crew might alter their vigilance level.

Despite the recent immense changes in technology and the increasing shift to predominantly monitoring tasks, there has not been an associated development in vigilance assisting systems. Over the last 50 years there have been sporadic attempts to develop such systems, but there has been little support. The doyens of vigilance research dismiss human alerting systems as impractical, cumbersome, expensive and ineffective. Thus, we are now in the position of expecting many people to monitor, yet we have not created a work environment where those monitoring can do so effectively.

It is proposed that the workrole of those who monitor systems upon which considerable human and financial resources depend is becoming one where personal fulfilment and work satisfaction are being progressively ignored and eroded. The persistent inability to meet an unobtainable performance specification is a significant factor in job dissatisfaction, itself a potent factor in degrading the ability to sustain attention. Thus, a key consequence of automation, with its attendant distancing or peripheralisation of humans, is change in human performance which itself interferes with the monitoring process.

It has to be accepted that there is no single theory which adequately describes the behaviour of humans who have been peripheralised into the roles of system monitor and back-up system. Unfortunately, it is probable that there is not enough time for mankind to wait until human attentional systems are understood sufficiently such that either human monitoring can be manipulated or that job design can be altered to fit human abilities. Immediate measures must be taken to reduce the present mismatch between the demand for monitoring services and the inadequacy of the supply, even though these measures must be crude and inefficient. Peripheralisation with monitoring failure is likely to have been a factor in the Chernobyl nuclear reactor accident. A repeat of this monitoring failure is something that mankind cannot afford.

PART A Monitoring Problems and Processes

2 Automation, peripheralisation and error

The modern aircraft cockpit allows humans to find safe and cost effective solutions to the problem of transporting large loads over long distances through a hostile three dimensional maze. In this tiny workplace a highly motivated workforce interacts with a very advanced and rapidly changing technology. This new technology is essential on economic grounds, but much of this technology is not accessible to those on the flight deck, humans being distanced, or peripheralised, from essential flight processes (Norman, Billings, Nagel, Palmer, Wiener, Woods, 1988). Part of this peripheralisation process may stem from aircraft design failing to focus on human needs (Wiener and Curry, 1980). In this section, automation induced peripheralisation and its effects are considered as are modulating factors. After a brief examination of aircraft accident types, the interrelationships between automation, peripheralisation, human error and present responses to human error are considered. The consequences for monitoring in the cockpit are discussed.

2.1 Automation in aircraft

The external appearance of commercial aircraft has altered dramatically as their efficiency as a transport system has increased. Propulsion units have changed from low power, poorly reliable, fuel hungry piston engines to high thrust, ultra reliable, fuel efficient turbofans. Automation, defined as the replacing of human function with machine function, has been and will remain a key factor in obtaining optimal performance from modern propulsion units. Modern aerodynamascists have mated this propulsion efficiency to airframe developments which allow very large aircraft to carry big loads at relatively high mach numbers over prodigious distances. Again, automation has been a key factor, a variety of automated airframe functions now being essential for keeping costs at levels which allow airlines to supply seats at competitive rates. Another less visible technological revolution, as radical and as essential as the others, has been the automation of aircraft control systems. Automation of aircraft control systems has been essential for realising the economic potential of propulsion and aerodynamic developments. The prevailing philosophy underlying automation of the human interface of aircraft control systems has been questioned (Norman et al., 1988; Wiener, 1988; Rogers, 1991), partly because human factors accidents now predominate, the same human factors issues appearing repeatedly (Learmount, 1992). New, more human-centred approaches such as adaptive automation have been proposed (Morrison, Gluckman and Deaton, 1991; Emerson and Reising, 1991). These new approaches, and their potential contribution to cockpit monitoring management, are considered later.

2.1.1 Automation and aircraft control systems

Modern flight control systems are almost completely automated. In some instances humans are actively discouraged from using them because the control system requirements are too demanding (Billings, 1989). There are many examples, some well established like the yaw damper, and many, like neutral stability flight systems, automated flight controllers and automated aircraft warning systems, which are currently in service at various stages of development.

The need for automated flight control systems is obvious. Swept wing aircraft yaw away from banked turns. Such aircraft are fitted with an automatic device called a yaw damper which counteracts this tendency. This device is not usually turned off because human correction can be tedious and demanding (Davies, 1979; Hawkins, 1987). Similarly, humans have difficulty flying aircraft with neutral stability. There are significant reductions in drag and hence decreases in fuel costs if aircraft are flown with neutral stability, but computer assistance is essential for flying aircraft in this economically desirable configuration (Hopkins, 1987). In the same way, the flight path which best satisfies safety and commercial demands is best determined by an automated flight controller. These are but a few of a myriad of examples where human procedural, information processing, and management capabilities are being exceeded. Humans are becoming the limiting factor in systems performance (Taylor, 1989) in many respects. The introduction of automated warning systems is further evidence of the help humans need in the management of the modern commercial flight deck. Thus, there are aspects of flight control which are now impractical for humans, but without which commercial aviation becomes uneconomic (Tsang and Vidulich, 1989). Automation in the modern aircraft cockpit is widespread and essential.

2.1.2 Cockpit crew duties - old and new

Before the advent of modem control systems, piloting required considerable physical strength under certain flight conditions (Davies, 1979). In other circumstances, marginal levels of thrust could demand a very delicate touch. Cockpit crews would manually check fuel levels at stopovers, keep fingers crossed about tyre temperatures and guess about wind shear. Some crew workload was present during the cruise phase of flight, because autopilots were relatively primitive, navigation did not have the benefit of inertial navigation systems and flight deck instrumentation only gave direct information about aircraft systems. Crew workload increased in the vicinity of airports because of unsophisticated air traffic control systems, increased aircraft density and the manual demands of landing. Crew workloads were relatively high during most phases of flight.

The tasks and duties of cockpit personnel in the latest commercial aircraft are totally different. Every phase of flight can now be carried out without human intervention, and for economic reasons, many aspects of flight management are best performed by automated flight control systems. During the cruise phase, there is only a monitoring role as flying controls, engine management, fuel management, cabin environment control and navigation are all automated. There are few direct links between cockpit displays and critical aircraft components. Many of the monitoring systems only display if there is a problem, a multitude of systems sharing the same final display unit within the cockpit. Some aircraft do not have direct links between the cockpit controls and the control surfaces, the aircraft being managed by parallel computer systems which examine and evaluate the human input and dismiss it if it would cause danger to the aircraft (Hopkins, 1987). Crew workload in cruise is limited to monitoring, the workload at times being extremely low. Some aircraft can fly so far that machine endurance far exceeds the maximum acceptable duty period of pilots, some airlines using one crew for cruise, and the other for take-off and landing. In the vicinity of airports workload can fluctuate. While air traffic control has become very much more sophisticated, it has been swamped by the recent large increases in air traffic. Flight path changes during descent and approach can increase workload dramatically and unpredictably (Hughes, 1989; Wiener, 1989).

2.2 Peripheralisation

The term ‘peripheralisation’ describes the process of role change which accompanies increased levels of automation (Norman et al., 1988). Peripheralisation is a complex psychobiological state which occurs as a consequence of automation. It has been proposed that automation results in role changes where humans are shifted from being in direct contact to being a machine prosthesis, a system maintainer or a system manager. The automation of flight control systems, such that they cannot practically be accessed by humans, has resulted in significant role changes for flight deck personnel (Wiener and Curry, 1980; Roscoe, 1992), peripheralisation being an inevitable consequence.

2.3 Peripheralisation effects

Peripheralisation occurs in the cockpit, but its effect on humans is ill understood and little considered. Peripheralisation effects can probably be managed in many situations, providing there is an appropriate balance during the process of automating the man-machine interface between being ‘human-activity centred’ and being ‘task-requirement centred’. This balance is unlikely to have been achieved in the cockpit. Several have suggested that the human-centred component has been lacking (Wiener and Curry, 1980; Norman et al., 1988). Peripheralisation in the cockpit produces a variety of effects believed to be important in human error production. These effects, complacency, miscommunication, and changes in situational awareness shall be considered in turn.

Peripheralisation is likely to be a dynamic process (Degani and Wiener, 1991). Thus, under optimal conditions the functional interface between man and machine may be close to that intended. This interface is an aggregate of the human-hardware interface, the human-software interface and, as recently suggested, a human-procedural interface (Degani and Wiener, 1991). Under certain circumstances there will be a shift in the position of one or more of these interaction areas, and the overall functional interface may end up far from that intended. Illustrative examples include the input of false information into flight computers to make automated systems behave as desired (Wiener, 1989) and the changes in interface position which occur consequent upon the automation of checklists (Palmer and Degani, 1991).

2.3.1 Complacency

Complacency is a behavioural category used in incident classification in the National Aeronautics and Space Administration’s (NASA) Aviation Safety Reporting System. Complacency has been defined in this context as ’self-satisfaction which may result in non-vigilance based on an unjustified assumption of satisfactory system state’ (Parasuraman, Bahri, Molloy and Singh, 1991). While this definition is helpful, particularly in incident analysis, the extent to which complacency is a problem induced by automation can be difficult to delineate from other subtle changes in crew coordination and behaviour (Norman et al., 1988). However, recent studies suggest that there is a significant linkage between automation and complacency, key factors being the consistency and reliability of the automated system (Parasuraman et al., 1991). While complacency and a decline in situational awareness can occur simultaneously, or the former can precede the latter, decline in situational awareness can occur without any apparent evidence of complacency. There are a variety of human behaviours considered in this section on complacency, even though they are significantly different in a number of ways. These behaviours all have elements of non-vigilance coupled with assumptions about the state of control systems.

Primary/secondary task inversion Human behaviour is rarely unaffected by changes in machine prowess. ‘Primary/secondary task inversion’ (Wiener and Curry, 1980; Palmer and Degani, 1991) is the behavioural phenomenon where the presence of a backup system, such as an altitude alert mechanism, results in flight crew using the backup system as a primary source of information about altitude. Similarly, the best result from using various checklist systems occurs with the traditional challenge-response method, inferior results being obtained with variably automated systems, such as a manual-sensed checklist or an automatic-sensed checklist (Palmer and Degani, 1991).

Automation deficit Alt...

Table of contents

• Cover Page
• Title Page
• Copyright Page
• Table of Contents
• Preface
• 1. Introduction
• Part A Monitoring Problems and Processes
• Part B Monitoring, Measurement and Alerting Systems
• Part C Monitoring Management
• References
• Index