The project findings were integrated into the rail industry standards for the UK (RIS-0775-CCS Iss 2: AWS and TPWS Application Requirements).  This means that equipment designers can access the standard when designing the DMI and utlise the HF recommendations that were made and integrate them into their design. 

One example of the many changes that were recommendation for the DMI is as follows. The initial touchscreen DMI design presented to drivers included the ability to reinstate the Train Protection Warning System (TPWS) via the DMI by pressing the yellow button labelled ‘TPWS Isolated’. This button appears once the system has been isolated using the external switch, however it was not intuitive for users that TPWS could be reinstated from the DMI. This was because the yellow square labelled TPWS isolated was acting as an indicator informing the driver that the system was isolated but also as a button that functions in re-instating the TPWS. As such the label of the indicator did not match the function that the button carried out. Therefore, 

following feedback from users

, it was determined that an additional white button should be added, labelled ‘TPWS Re-instate’. End users were given a choice of text labels including ‘TPWS Switch on’, ‘TPWS Restore’ and ‘TPWS Turn on’.‘TPWS Re-instate’ was the most popular option and is consistent with the terminology used in the railway currently.

The project required a standardized approach for showing the indications and the buttons on the DMI, and it followed a robust HF approach. We ran usability trials with 20 drivers using a desktop simulator which displayed the different design options. Then we asked their opinion to understand if the new DMI design was intuitive.  

At the beginning of each usability trial, participants were briefed about ERTMS, the equipment to be used (see picture) and completed a familiarization drive. This enabled participants to get used to the route and the simulator display and controls. Drivers were also asked to use the ‘thinking aloud’ method (Lewis and Mack, 1982). The ‘think aloud’ method was explained to drivers using a demonstration video showing a user navigating a website and voicing their thoughts, expectations and difficulties. A non-rail example video created by Nielsen (2014) was used to avoid influencing the participants’ responses to the operational scenarios that would follow. Participants were asked to watch the video and follow a similar approach when voicing their own thoughts during the rest of the usability trial. Participants were asked to use the think-aloud process when operating the DMI. They were asked to speak aloud their thoughts on: what they were seeing, how they interpret the display, their view of the system status, how they expect the DMI to behave and any frustrations they experienced. 

Participants ran through 10 operational scenarios throughout the trial. Two human factors researchers were present for each trial. During each scenario, the researchers wereobserving the participant’s interactions with the DMI. Comments made by the drivers using the ‘think aloud’ technique were recorded and there was some discussion with drivers about their views and actions at the end of each scenario. Questions and topics discussed were informed by relevant usability heuristics (Nielsen, 1994) such as; ensuring visibility of the system status, error prevention and helping users recognize, diagnose and recover from errors. In addition, a small camera was positioned on the desk to record drivers’ interactions with the DMI. This ensured that any incorrect interactions or attempted actions were also captured. The driver inputs to the simulator were also recorded by the system and stored after each scenario.

At the end of the trial, participants completed an adapted system usability scale questionnaire (Brooke, 1996). This was to assess the usability of the existing safety system controls and indications. 

We then took on the driver’s feedback and redesigned the DMI to take into consideration the issues raised. We ran the findings past the equipment suppliers (the train hardware designers) to ensure that our suggestions were feasible. This included the colour of the indications that appeared on the touch screen DMI, the size of the buttons, the parameters of the buttons (flash, steady). Due to DMI functionaility constraints we had limited scoipe to make design changes to the DMI. Some of our initial ideas in an ideal world would have been more usable and intuitive – but because the system had already been designed, we were limited in what we could actually do. 

This HF intervention originally for the Rail sector is transferable between Aviation and Maritime, as pilots already use visual display units (VDUs) so some of the principles of design considered in this intervention may be transferable. It is also important to remember the constraints on the design due to the DMI functionality Aviation and Maritime may be ahead of the rail or have other systems already in place that are more compatible with HF design recommendations. The DMI changes for this intervention were post design and hence occurs between the design and the development stage. It required a medium to high effort due to time intensive analysis of the qualitative feedback from the drivers.  In terms of supporting tools, the project utlised a simulator and a usability scale questionnaire (SUS) was distributed to each of the 20 participants to test if the design was usable or not. The final output included a report with recommendations that fed into the Rail Industry Standards. 

The design solution that has become part of design standards is for there to be distinct visual warnings to the driver for both when they have passed a signal at danger and when they are driving too fast.

This was the simple solution but in order to gather data for the requirements simulation trials were undertaken. The original non-optimal system with a single light was already in operation and a simulation was undertaken where drivers were presented with over speed scenarios and signal passed at danger scenarios with the existing and options for the new interfaces. In the new design, voice alarms were also added, for example stating “Signal past at danger”. So rather than an audible tone there is a recorded message to further disambiguate whether the red light is due to speeding or passing a red danger signal.  

As part of the design, we could compare and demonstrate the improved human reliability with the improved display.  We also used Human Reliability Assessment in the context of a multi-disciplinary team of engineers, suppliers and HF specialists.  The human reliability assessment process was based on task analysis, error analysis and quantification using human reliability data from HEART, following the procedures presented in Kirwan’s A Guide to Practical Human Reliability Assessment. The design process involved TPWS panel manufacturers who could quantify the costs of different design options. 

Going through the process, reduced risk and made it safer because we had fewer cases of the drivers resetting and continuing after a signal being passed at danger, when they should have instead communicated with the signaler. 

This HF intervention originally in the rail sector is transferable to the aviation sector as there is a lot of simulation in air traffic control. The intervention produced changes to the Industry Standards for the design of the TPWS Display. It also imposed the HF principles of an un-ambiguous alarm system and promoted the process of user trials and human reliability assessment (HRA) because the change would mean a significant cost to the industry which is why a strong justification for the change was needed.  The safety approach was reactive, as we reacted to a non-optimal design and then created a new one.  The manpower to resource the simulations took 3-4 weeks with 20 train drivers and 2 HF Specialists.  We also required a train simulator.  Following the HF intervention, and hence the changes to operational standards, companies are required to use the new interface for new train cabs. Training of staff and updates to procedures were also undertaken. 

Countermeasures were suggested in the forms of lids, curtains and screens for each console or window. The dimension of each screen was determined thanks to the results of the analysis. 

The activity raised awareness on the negative effects of glare and was perceived by both the Customer and the Shipyard as a great added value; results were taken quite seriously as the Shipyard used them to build a lid for the cockpit console (the most exposed to direct and reflected sunlight) and to order custom electrically controlled curtains for all windows. The study helped clarifying the possibility of a serious problem and avoiding a dispute between Shipyard and Customer, improving the overall quality of the final product, even if better results may have been obtained if the study had been done in the early design phases, where there is still the possibility to change layouts.

The developed software will be used in all future custom bridges assessment.

The chosen approach was custom created for the specific problem, as there are no tools that can do such an analysis ‘out of the box’. The first step was determining the position of the sun in relation to the ship. The locations where the ship will operate were known (they are an input provided at the beginning of the basic design by the Customer), therefore complete information of the maximum sun height, total daily sunlight hours at solstices and equinoxes was assembled and used to produce the test cases.

Moreover, a rectangular test surface was defined representing the position of each console operator eyes, having as upper height the quota of the eyes of the 95%ile and lower limit the same parameter of the 5%ile, with percentiles values set according to an anthropometric database suitable for the reference population. Moreover, a point was also defined for the 50%ile to allow checks for the average of the reference population. The test surface and average point were defined with the aim to allow geometric checks, both manual and automated.

The analysis of the glare was divided in two phases:

1. Glare due to direct sunlight
Direct sunlight determination was done manually, as a simple CAD software is absolutely sufficient to do the required checks. Direct glare was checked on a vertical plane centered on the test surface (operator face), and rotated of 30° until all directions were covered. This allowed determining the maximum and minimum offending sun elevation angles, for each operator and for each direction.

2. Glare due to reflections on screens
Reflection glare was much more complicated. The chosen approach required programming a sort of ‘inverse’ ray tracing-like tool in CATIA CAD software that for each operator projected a line from the average eye point to the screen, calculating the reflection and whether it was impacting one of the windows or not. This allowed to create a mapping of the screen areas where sunlight could impact reflecting back to operator eyes, correlated with external sunlight angles. 
The approach was complicated also by the presence of multiple screens for many consoles and considered the presence of obstacles.
The determined ‘glare maps’ were also verified by using a proprietary software that CETENA produced to determine naval ships weapons coverage. The software produced a spherical image of what was visible from a single point and the outcomes of its application on each operator were used to determine the same raytracing-like results.

Finally, the obtained glare maps were crossed with sun height statistics in the four days identified in order to determine the maximum potential daily exposure hours for each operator.
Countermeasures were then suggested in the forms of lids, curtains and screens for each console.

The aforementioned issues were pointed out paying attention to include indications on how to improve them.

1. Free area in front of the food stores: it was simply suggested to increase the available area and to enlarge the lift door.

2. Sharp bend between two corridors in the path to the nursery: it was suggested to increase the corridor opening to ease the manoeuver when carrying the stretcher. A specific habitability guideline exists on this issue in Fincantieri guidelines database: “the minimum door width for access with a stretcher directly into a corridor at right angles to the door depends upon the width of that corridor. Table and figure below show the door width required to move into different widths of corridor without unduly tipping a stretcher.

3. Location of the lifts leading to ammunition stores: the Client understood the flaw but there was no way to solve it and accepted the operativity reduction counting on the massive available workforce on-board to complete the ammunitions loading operation in a finite time.

Overall, it is unknown whether the Client did any changes based on the analysis. However, they learned the process for integrating HF requirements at design phase and understood the implications of overlooking HF aspects and trying to solve them in a more advanced phase. Moreover, the consequences of developing a ship design that satisfies higher ranks needs despite a decrease of comfort for lower ranks was pointed out, and used as the main argument for explaining the inefficiencies and the lack of effectiveness of the design.

This methodology is normally applied in Fincantieri Group and goes by the name of Flow Analysis,  an effective tool for evaluating the design of a ship from a general perspective. A ship is a very complex environment, where hundreds of people interact and carry out possibly conflicting activities. The majority of physical-related activities involve movement (e.g. moving from one compartment to the other to perform maintenance, carrying materials with transportation tools, queuing for lunch, reaching the area of operations for safety reasons, etc), an activity onto which the topology of the ship and the placement of compartments has a huge impact. The usual procedure for such a study requires looking at the general arrangement while defining a block diagram that follows closely the movement of goods or people. Then, for each block the HF expert has to detail basic questions like what, when, who, where. In this simple way knowledge is gained on how the designer intends to plan the activity and critical steps are easily identified. A strong knowledge of best practices, international standards and generally speaking experience on the field is absolutely mandatory, since the ergonomist must warn the designer on the overlooked aspects and motivate the importance of the identified gaps. 

Usually these activities are done for a variety of ‘flows’, including:

• Food flow (provisions embarkation, preparation, consumption, waste disposal, etc)

• Ammunitions handling, from main deck to ammunitions stores including weapons refilling activities 

• Safety teams operations, where it is demonstrated that safety teams can access every part of the ship while wearing bulky protective clothes

• Evacuation routes with a qualitative evaluation of bottlenecks (to be refined with an actual software based evacuation study if requested) 

• Injured personnel recovery (access to nursery, bottlenecks free paths)

The flows also depend on the kind of ship operation and may include CAD verifications for fine aspects (e.g. manoeuver spaces for a fork lift inside a store can be checked geometrically). This HF assessment can be done at any stage of the design/build process of the ship but it can result in actual improvements only if it is performed during the basic design phase. If done in other phases, most probably the suggestions will not be followed due to the many constraints on ship compartments dimensioning and positioning.

After redesigning the simulator, by retrofitting a three-station control room, the training process improved. The following benefits were observed:

• The instructor could now very easily customize all training scenarios and change the events of the plot in such a way that could create a real, unfriendly and surprising environment. This improved the realism of the training process.

• It was easier for the assessors to observe all the technical and non-technical skills, such as situation awareness, decision making, communication, teamwork, and leadership.

• By escalating the scenarios in a more realistic way, the trainers and assessors could create more stress and fatigue to the trainees. Therefore, the human limitations are easier to evaluate.

• Trainers and assessors can visually observe all the training activity from a safe environment and assess human limitations, such as managing stress and dealing with fatigue.

A three-station control was retrofitted to the flooding simulator, which was effectively redesigned. The redesign was based on an approach that was similar to “HF Principles Evidence-Based Review” and “Fatigue Analysis” from the SAFEMODE HF Catalogue. Specifically, the approach included the following steps:

1. Questionnaires and semi-structured interviews with trainees and trainers. The questionnaire that was used for getting feedback was specifically developed for the needs of the assessment and experiment by Hellenic Navy safety experts, doctors and psychologists. The objective was to assess the effectiveness and efficiency of the training. The questionnaires were analyzed using established statistical methods. The feedback from the experienced trainers proved to be particularly useful for the redesign of the simulator.

2. Assessment of the trainees’ behaviour with the Hellenic Navy’s Behavioural Assessment rating scale.

3. Stress/fatigue analysis methods. The participants (both trainers and trainees) wore actigraphs (Garmin Vivosmart HR+) during the training activity and data were recorded from the devices. Training activities were conducted for three consecutive days and we had the chance to observe the effects of fatigue and sleep deprivation for 72 hours. The data gathered from the actigraphs were analyzed using statistical regression techniques. The objective was to determine the level to which the scenarios in the simulator may be escalated.

In the wake of the described incident, the relevant systemic procedures were taken under scrutiny. In this regard the following steps were followed:

1. The shipping company, following an incident investigation, drafted lessons learned and used them for improving the established procedures,

2. The shipping company’s Designated Person Ashore (DPA) sent the revised procedures to all the company’s vessels for feedback,

3. Comments were incorporated and the final revised procedure was disseminated to all the vessels of the company,

4. Training material (presentation) on the revised procedures was prepared and sent onboard all the vessels of the company. In addition, this material was sent to the manning agent for the training of newcomers and onboard personnel,

5. Continuous review of the procedures is being conducted with input out of the interaction of Bridge personnel with Pilots following vessels’ call at various ports, worldwide.

The revised procedure addressed the identified contributing factors by describing changes in the way of communication. It included a two-way communication model with reinforcement feedback and establishing predefined technical terminology to overcome miscommunication.

None of the listed HF intervention were used, but the situation was treated rather empirically. Therefore, the approach was based mainly on the experience of the DPA and the superintendents of the shipping company.

In case of a poor choice of parameters of the of the pilot-aircraft system’s technical component, hazardous events may occur. Among such events are pilot induced oscillations (PIO), which are well-known among Russian and international experts in the field. 

Since the 1990s they have also been referred to as aircraft-pilot coupling. This phenomenon has various causes. Due to the emergence of highly-automated aircraft with a lowered stability margin, the primary causes are the restricted maximum rate of the control surface deflection, performed by the actuators, and a significant phase delay in the control element dynamics of modern aircraft caused by various factors. 

Seeking to perform the piloting task accurately, the pilot generates significant lead compensation, which can rapidly cause diverging oscillations. This kind of occurrence is observed in both civil and military aircraft. According to the statistics at my disposal, the number of incidents/accidents in civil aircraft has increased by 15 % due to PIO.

From the interview regarding the “New active manipulator inceptor to improve accuracy and safety of flight” after the HF intervention: 

With the new active manipulator, the inceptor’s use does not depend on the force exerted on it but rather on the deflection. This is important because in the case of failure, the dynamics of the aircraft can change drastically and so avoids pilot’s need to apply excessive force.  Therefore, this new active manipulator increased safety.

In light of this, an extremely important task of decreasing the risk of such unfavorable interaction has arisen. A wide array of works is devoted to this matter. In particular, McRuer’s «Aviation safety and pilot control. Understanding and preventing unfavorable pilot-vehicle interactions», published in 1997 by the National Research Council, presents a detailed analysis of the phenomenon and an engineering approach to its suppression. 

One of the means of PIO suppression is installing nonlinear prefilters in the flight control system that do not let rapid signals into the system.

We have proposed a modification of one such prefilter, which also controls the gain coefficient from the feedback signals. 

In figure below (from my presentation at the 1995 AGARD conference) you can find the structure of these filters. The use of the proposed prefilter has allowed to decrease the resonance peaks of the closed-loop system, therefore lowering the probability of PIO occurrence. 

Another means of suppressing the PIO effect is an active (dynamic) change in stick control force.  This method, the elementary diagram of which is presented in the figure below, also allows to decrease the pilot-input lead, increase the amplitude margin of the open-loop system and, consequently, decrease the resonance peak of the closed-loop system, therefore lowering the PIO tendency. 

In recent years we have worked a lot on researching new types of predictive displays which also serve as a means of improving the interaction between the pilot and aircraft. See the article on the matter, titled «Development of Pilot Mathematical Model in the Preview Manual Control Task».

We also used a mathematical model of the neuro-muscular system to understand the output in relation to the deflection of the hand on the stick (manipulator), where the output is the forces that the pilot can place on the manipulator. 

Additionally, by combining the Flight Control System with the new active manipulator, there have been massive improvements. In the case of failure of the flight control system, we are able to change the stiffness of the inceptor because suddenly the pilot system becomes unstable and because the acceleration increases considerably. The inceptor has the mass and the steepness so with the help of the mathematical model of the neuro-muscular system, it is possible to change all of the parameters on the device.   

By combining the Flight Control System with the new active manipulator/ inceptor the percentage of accidents has decreased by 15% in case of failure of the flight control system.

After understanding the issue with the original design (setup does not support orientation and manoeuvering), on the impoved HMI we display the orientation of the PTZ cameras on a simple airport map.

Now on the PTZ control screen, you can see a map and you can easily identify which PTZ serves your purpose, which one to choose to observe a certain area. Then by clicking on the area on the map, the PTZ turns automatically in the right direction that you want to visualize.

It is much easier to interpret the picture, the time it takes to manage the system decreased, so it is easier for the ATCO to use. In general, it contributes to maintaining situational awareness by supporting quick information collection.

When installing the first version of the video system, we went through a full cycle of design, implementation, testing, and validation and this particular issue arose during the first cycle of validation. So after that, we went back to design and validation and as a result, this new function was created. In case of the contingency tower, the testing and validation is done during shadow operations. The HF experts are there making observations, creating surveys that the ATCOs can fill out. The HF experts also take part in debriefing sessions and facilitate other discussions after the sessions, which are used to define recommendations and requirements that are in line with the ATCOs capabilities and expectations.

The validation exercizes are normally concluded in a long list of recommendations, in this case the need to improve on this HMI function was only one item on that list. Similarly, the scope of improvement changes was borader than the fixing of the HMI.

During the project we used a methodology based on EUROCONTROL’s Human Factors Case that is exceptionally valuable to systematically assess and mitigate the risks associated with human factors aspect of a change. It can also used be to achieve potential benefits that might be outcome of the change. In this method, the assessment runs in parallel with the change project assuring that HF perspective is applied during concept, design and validation phases. In our case, during the HF process, validation needs were identified for the PTZ functionality, then the result of the validation did not met the pre-defined acceptance criteria, hence a corrective action was taken.

Human factors interventions of this kind are not supposed to be isolated actions to improve the operations or a system. Their goal is rather to facilitate a discussion and involvement of the air traffic controllers (our end users), the ATM experts, the technical experts, safety specialists, human factors analysts and the project manager. At the end of the validation cycle, the team  jointly comes up with recommendations and requirements, so the key to success is basically the team effort, clear communication and continuous involvement. In the case of refining our Remote tower facility, the value of having a very good team can not be overlooked. Safety experts, ATM experts, HF experts and the technical team (e.g. system engineers, designers) could all bring their knowledge to the table and by that navigating the design process to a satisfying outcome.

Safety assessment and human factors assessment at HungaroControl are integrated, therefore the list of recommendatins include both safety and HF interventions.

This HF Intervention is possibly transferable to the maritime sector, however, the standards are specific to aviation and hence not necessarily applicable to other sectors. The intervention used Risk informed design and hence a proactive safety approach during the design and development stage. It required an advance level of HF expertise due to the number of experts that contributed to the HF intervention. A medium effort was required during the course of 6 months during which other functionalities were also simultaneously developed.