We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our cookies if you continue to use our website. Term of use & Privacy Policy


GP Railway #01 European Rail Traffic Management System: Driver Machine Interface (DMI)


Before the change

As the European Rail Traffic Management System (ERTMS) is rolled out across the UK rail network, it will be required to operate together with previous safety systems. This is necessary because the implementation of ERTMS will be gradual and trains will be required to operate over both conventionally signalled infrastructure and ERTMS fitted infrastructure. It is therefore important that the driver is able to see clear, intuitive and consistent indications (including faults and failures) from the previous safety systems displayed on the ERTMS Driver Machine Interface (DMI).  It was important that this project considered the human in the system when designing the DMI. 

In conventional signalling, the driver observes rail signals (red, yellow and green) outside of the train cab but based on limitations of human performance this is not perfectly reliable task.  For example, if the driver has a lapse they may pass the red signal. ERTMS prevents this by automatically controls braking and stops the train before the movement authority. 

The project considered elements such as managing distraction from flashing indications and the hierarchy of decisions when selecting sequences of buttons. 

It is not possible to provide a single picture that accurately illustrates the DMI before, as all the indications that were changed are never visible at once. Rather we will focus on a single screenshot of one of the scenarios that resulted in a change of one feature on the DMI. The description of how this feature changed can be found in the next section.




After the change

The project findings were integrated into the rail industry standards for the UK (RIS-0775-CCS Iss 2: AWS and TPWS Application Requirements).  This means that equipment designers can access the standard when designing the DMI and utlise the HF recommendations that were made and integrate them into their design. 

One example of the many changes that were recommendation for the DMI is as follows. The initial touchscreen DMI design presented to drivers included the ability to reinstate the Train Protection Warning System (TPWS) via the DMI by pressing the yellow button labelled ‘TPWS Isolated’. This button appears once the system has been isolated using the external switch, however it was not intuitive for users that TPWS could be reinstated from the DMI. This was because the yellow square labelled TPWS isolated was acting as an indicator informing the driver that the system was isolated but also as a button that functions in re-instating the TPWS. As such the label of the indicator did not match the function that the button carried out. Therefore, 

following feedback from users

, it was determined that an additional white button should be added, labelled ‘TPWS Re-instate’. End users were given a choice of text labels including ‘TPWS Switch on’, ‘TPWS Restore’ and ‘TPWS Turn on’.‘TPWS Re-instate’ was the most popular option and is consistent with the terminology used in the railway currently.





How and Why

The project required a standardized approach for showing the indications and the buttons on the DMI, and it followed a robust HF approach. We ran usability trials with 20 drivers using a desktop simulator which displayed the different design options. Then we asked their opinion to understand if the new DMI design was intuitive.  

At the beginning of each usability trial, participants were briefed about ERTMS, the equipment to be used (see picture) and completed a familiarization drive. This enabled participants to get used to the route and the simulator display and controls. Drivers were also asked to use the ‘thinking aloud’ method (Lewis and Mack, 1982). The ‘think aloud’ method was explained to drivers using a demonstration video showing a user navigating a website and voicing their thoughts, expectations and difficulties. A non-rail example video created by Nielsen (2014) was used to avoid influencing the participants’ responses to the operational scenarios that would follow. Participants were asked to watch the video and follow a similar approach when voicing their own thoughts during the rest of the usability trial. Participants were asked to use the think-aloud process when operating the DMI. They were asked to speak aloud their thoughts on: what they were seeing, how they interpret the display, their view of the system status, how they expect the DMI to behave and any frustrations they experienced. 

Participants ran through 10 operational scenarios throughout the trial. Two human factors researchers were present for each trial. During each scenario, the researchers wereobserving the participant’s interactions with the DMI. Comments made by the drivers using the ‘think aloud’ technique were recorded and there was some discussion with drivers about their views and actions at the end of each scenario. Questions and topics discussed were informed by relevant usability heuristics (Nielsen, 1994) such as; ensuring visibility of the system status, error prevention and helping users recognize, diagnose and recover from errors. In addition, a small camera was positioned on the desk to record drivers’ interactions with the DMI. This ensured that any incorrect interactions or attempted actions were also captured. The driver inputs to the simulator were also recorded by the system and stored after each scenario.

At the end of the trial, participants completed an adapted system usability scale questionnaire (Brooke, 1996). This was to assess the usability of the existing safety system controls and indications. 

We then took on the driver’s feedback and redesigned the DMI to take into consideration the issues raised. We ran the findings past the equipment suppliers (the train hardware designers) to ensure that our suggestions were feasible. This included the colour of the indications that appeared on the touch screen DMI, the size of the buttons, the parameters of the buttons (flash, steady). Due to DMI functionaility constraints we had limited scoipe to make design changes to the DMI. Some of our initial ideas in an ideal world would have been more usable and intuitive – but because the system had already been designed, we were limited in what we could actually do. 

This HF intervention originally for the Rail sector is transferable between Aviation and Maritime, as pilots already use visual display units (VDUs) so some of the principles of design considered in this intervention may be transferable. It is also important to remember the constraints on the design due to the DMI functionality Aviation and Maritime may be ahead of the rail or have other systems already in place that are more compatible with HF design recommendations. The DMI changes for this intervention were post design and hence occurs between the design and the development stage. It required a medium to high effort due to time intensive analysis of the qualitative feedback from the drivers.  In terms of supporting tools, the project utlised a simulator and a usability scale questionnaire (SUS) was distributed to each of the 20 participants to test if the design was usable or not. The final output included a report with recommendations that fed into the Rail Industry Standards. 





GP R#02 The train protection and warning system (TPWS)


Before the change

The aim of the system is to stop a train when the driver passes a red light (a signal of danger).  A critical incident occurs when the driver passes this signal and the TPWS ensures that the train brakes are applied automatically.  However, the system was also designed to apply the train’s brakes in some cases when the driver was going too fast, so a driver would be driving on an open line and if they were going over the speed limit then the brakes would be applied and the train would come to a stand. Therefore, there was a dual function. 

Unfortunately, the visual warning in the train cab (what the driver sees as an indication, a red flashing light with the label ‘brake demand’) was the same for both of these situations.  If they were speeding or if they passed a signal at danger they would receive the same brake demand light.  The basic problem was that the system did not differentiate between speeding and passing the signal at danger.   In both cases, the brakes were automatically applied.  Across the network, drivers were experiencing an over speed signal more frequently, because you only need to go over the line speed by a little to activate the alarm.  When you have an over speed you were permitted to restart your train and carry on, but if you went past the signal at danger, it required communication with the signaler prior to moving the train.  So, a driver would experience the brake demand, see the red flashing light and then assume that they had an over speed when in fact it was because they had passed the signal at danger.   Therefore, the drivers were resetting the cabs themselves without talking to the signaler following a signal passed at danger, which creates a risk. 

For the non-optimal initial design, if you went past a red signal, there would have been a red signal outside of the cab and drivers are trained to drive to the signals.  If they over speed it is likely not be in the location of these signals. So when designing the system, designers did not take into consideration that a driver might be unaware they had passed a red signal or confuse this event for an overspeed. The driver would have had an audible alert to inform him that they are approaching a red signal and would then see a red light, most often head height, outside of the cab, so this approach assumes that drivers will see the signal.  This does not take into account the fact that drivers may be distracted or that they might see the signal and misperceive it despite their training.   If they are used to thinking the alarm occurs when they are going too fast, then they will assume the in-cab indication is due to speed and not due to passing a red signal. 



After the change

The design solution that has become part of design standards is for there to be distinct visual warnings to the driver for both when they have passed a signal at danger and when they are driving too fast.

This was the simple solution but in order to gather data for the requirements simulation trials were undertaken. The original non-optimal system with a single light was already in operation and a simulation was undertaken where drivers were presented with over speed scenarios and signal passed at danger scenarios with the existing and options for the new interfaces. In the new design, voice alarms were also added, for example stating “Signal past at danger”. So rather than an audible tone there is a recorded message to further disambiguate whether the red light is due to speeding or passing a red danger signal.  


How and Why

As part of the design, we could compare and demonstrate the improved human reliability with the improved display.  We also used Human Reliability Assessment in the context of a multi-disciplinary team of engineers, suppliers and HF specialists.  The human reliability assessment process was based on task analysis, error analysis and quantification using human reliability data from HEART, following the procedures presented in Kirwan’s A Guide to Practical Human Reliability Assessment. The design process involved TPWS panel manufacturers who could quantify the costs of different design options. 

Going through the process, reduced risk and made it safer because we had fewer cases of the drivers resetting and continuing after a signal being passed at danger, when they should have instead communicated with the signaler. 

This HF intervention originally in the rail sector is transferable to the aviation sector as there is a lot of simulation in air traffic control. The intervention produced changes to the Industry Standards for the design of the TPWS Display. It also imposed the HF principles of an un-ambiguous alarm system and promoted the process of user trials and human reliability assessment (HRA) because the change would mean a significant cost to the industry which is why a strong justification for the change was needed.  The safety approach was reactive, as we reacted to a non-optimal design and then created a new one.  The manpower to resource the simulations took 3-4 weeks with 20 train drivers and 2 HF Specialists.  We also required a train simulator.  Following the HF intervention, and hence the changes to operational standards, companies are required to use the new interface for new train cabs. Training of staff and updates to procedures were also undertaken. 

GP Maritime #01 Bridge re-design intervention to solve glare problems – Single compartments design


Before the change

We received the request to assess specific ergonomics aspects related to a custom shaped bridge for a new ship whose design phase had already been completed. For the Industry it is very common nowadays to receive requests to innovate the bridge compartment layout, mostly because the ‘classic’ design has not changed significantly over the last 50 years, and today’s technologies allow modifying the usual ways to convey information to operators, hence new shapes become possible and new concepts can be explored. In particular aviation-like cockpits (backed up by rear consoles for other non-navigation related functions) are a bridge layout quite looked after in these days. However, steering away from a well-known design exposes designers to the risk to under-evaluate specific aspects that with the previous design were not considered because the design itself eliminated them.

Following the requests by the Customer (Navy), the bridge of a newly built ship was designed with a triangular/diamond shape, having in the front part a cockpit with two seats, two rows of lateral (close to the windows) consoles and others in the middle (for Captain and Helmsman) of the compartment.



The Customer lamented that due to the bridge design (especially considering the big lateral and front windows) many operators would have been affected by a glare problem. The complaint was legitimate, as conventional bridge designs have a different shape that does not allow sunlight to reflect on consoles screens (these are concentrated in the central part of the compartment and windows are small, mostly distributed in the forward looking part of the bridge).

Therefore CETENA, without being previously involved in the support of the design process of this ship, was asked by the Customer to do an assessment for the bridge in order to identify the possible corrections to quantify and solve the glare problem as much as possible.



After the change

Countermeasures were suggested in the forms of lids, curtains and screens for each console or window. The dimension of each screen was determined thanks to the results of the analysis. 



The activity raised awareness on the negative effects of glare and was perceived by both the Customer and the Shipyard as a great added value; results were taken quite seriously as the Shipyard used them to build a lid for the cockpit console (the most exposed to direct and reflected sunlight) and to order custom electrically controlled curtains for all windows. The study helped clarifying the possibility of a serious problem and avoiding a dispute between Shipyard and Customer, improving the overall quality of the final product, even if better results may have been obtained if the study had been done in the early design phases, where there is still the possibility to change layouts.

The developed software will be used in all future custom bridges assessment.



How and Why

The chosen approach was custom created for the specific problem, as there are no tools that can do such an analysis ‘out of the box’. The first step was determining the position of the sun in relation to the ship. The locations where the ship will operate were known (they are an input provided at the beginning of the basic design by the Customer), therefore complete information of the maximum sun height, total daily sunlight hours at solstices and equinoxes was assembled and used to produce the test cases.

Moreover, a rectangular test surface was defined representing the position of each console operator eyes, having as upper height the quota of the eyes of the 95%ile and lower limit the same parameter of the 5%ile, with percentiles values set according to an anthropometric database suitable for the reference population. Moreover, a point was also defined for the 50%ile to allow checks for the average of the reference population. The test surface and average point were defined with the aim to allow geometric checks, both manual and automated.

The analysis of the glare was divided in two phases:

1. Glare due to direct sunlight
Direct sunlight determination was done manually, as a simple CAD software is absolutely sufficient to do the required checks. Direct glare was checked on a vertical plane centered on the test surface (operator face), and rotated of 30° until all directions were covered. This allowed determining the maximum and minimum offending sun elevation angles, for each operator and for each direction.

2. Glare due to reflections on screens
Reflection glare was much more complicated. The chosen approach required programming a sort of ‘inverse’ ray tracing-like tool in CATIA CAD software that for each operator projected a line from the average eye point to the screen, calculating the reflection and whether it was impacting one of the windows or not. This allowed to create a mapping of the screen areas where sunlight could impact reflecting back to operator eyes, correlated with external sunlight angles. 
The approach was complicated also by the presence of multiple screens for many consoles and considered the presence of obstacles.
The determined ‘glare maps’ were also verified by using a proprietary software that CETENA produced to determine naval ships weapons coverage. The software produced a spherical image of what was visible from a single point and the outcomes of its application on each operator were used to determine the same raytracing-like results.

Finally, the obtained glare maps were crossed with sun height statistics in the four days identified in order to determine the maximum potential daily exposure hours for each operator.
Countermeasures were then suggested in the forms of lids, curtains and screens for each console.




GP Maritime #02 Global transversal ship verifications- flows analysis example


Before the change

CETENA was hired to conduct the HF assessment of a ship design that the Client was carrying out. Unfortunately when the activity started the Client had already completed the basic design phase and could not substantially modify it despite the suggestions made. In fact, their ship had some flaws from an ergonomic perspective.



Three main issues were identified:

1. In front of the food stores, there was no free area for the transpallet to turn, so the operator could easily get stuck and he had no place for dismantling the pallet before fitting provisions in the stores. Moreover, the width of the elevator door was exactly the same as the width of the transpallet used to fetch the provisions, another aspect leading to potentially serious problems due to the missing clearance.              

2. Analysing the path from the top deck to the nursery, it was pointed out that the path had a very big flaw, i.e. a very sharp bend between two corridors that made it very difficult for people carrying a stretcher to make the sharp turn. The difficulties are due to the stretcher’s length and the fact that carrying an injured person greatly limits the movement the stretcher can have. For completing the transportation, the patient has to be lifted at weird angles in order for the stretcher to make the turn.

3. The location of the lifts for ammunition stores was analysed. Ammo pallets are delivered on the top deck by a crane and then a lift is required to take the pallets to the ammunitions stores. If the lift doesn’t work then the ammunitions boxes need to be taken to the stores by hand, dismantling the pallets on the top deck itself. The ship had a really long way to reach the ammunitions stores that made it impossible to complete the operation by hand in a short time and without excessive fatigue to the operators, due to the fact that the Client did not properly take into account guidelines on hand transportation, leaving it to operative crew members on-board. This aspect is quite typical when evaluating designs carried out by shipyards of emergent economies, where society stratification is more pronounced and the greatest part of the attention is on Officers comfort, while lower ranks are usually less considered.



After the change

The aforementioned issues were pointed out paying attention to include indications on how to improve them.

1. Free area in front of the food stores: it was simply suggested to increase the available area and to enlarge the lift door.

2. Sharp bend between two corridors in the path to the nursery: it was suggested to increase the corridor opening to ease the manoeuver when carrying the stretcher. A specific habitability guideline exists on this issue in Fincantieri guidelines database: “the minimum door width for access with a stretcher directly into a corridor at right angles to the door depends upon the width of that corridor. Table and figure below show the door width required to move into different widths of corridor without unduly tipping a stretcher.


3. Location of the lifts leading to ammunition stores: the Client understood the flaw but there was no way to solve it and accepted the operativity reduction counting on the massive available workforce on-board to complete the ammunitions loading operation in a finite time.

Overall, it is unknown whether the Client did any changes based on the analysis. However, they learned the process for integrating HF requirements at design phase and understood the implications of overlooking HF aspects and trying to solve them in a more advanced phase. Moreover, the consequences of developing a ship design that satisfies higher ranks needs despite a decrease of comfort for lower ranks was pointed out, and used as the main argument for explaining the inefficiencies and the lack of effectiveness of the design.



How and Why

This methodology is normally applied in Fincantieri Group and goes by the name of Flow Analysis,  an effective tool for evaluating the design of a ship from a general perspective. A ship is a very complex environment, where hundreds of people interact and carry out possibly conflicting activities. The majority of physical-related activities involve movement (e.g. moving from one compartment to the other to perform maintenance, carrying materials with transportation tools, queuing for lunch, reaching the area of operations for safety reasons, etc), an activity onto which the topology of the ship and the placement of compartments has a huge impact. The usual procedure for such a study requires looking at the general arrangement while defining a block diagram that follows closely the movement of goods or people. Then, for each block the HF expert has to detail basic questions like what, when, who, where. In this simple way knowledge is gained on how the designer intends to plan the activity and critical steps are easily identified. A strong knowledge of best practices, international standards and generally speaking experience on the field is absolutely mandatory, since the ergonomist must warn the designer on the overlooked aspects and motivate the importance of the identified gaps. 




Usually these activities are done for a variety of ‘flows’, including:

Food flow (provisions embarkation, preparation, consumption, waste disposal, etc)

Ammunitions handling, from main deck to ammunitions stores including weapons refilling activities 

Safety teams operations, where it is demonstrated that safety teams can access every part of the ship while wearing bulky protective clothes

Evacuation routes with a qualitative evaluation of bottlenecks (to be refined with an actual software based evacuation study if requested) 

Injured personnel recovery (access to nursery, bottlenecks free paths)

The flows also depend on the kind of ship operation and may include CAD verifications for fine aspects (e.g. manoeuver spaces for a fork lift inside a store can be checked geometrically). This HF assessment can be done at any stage of the design/build process of the ship but it can result in actual improvements only if it is performed during the basic design phase. If done in other phases, most probably the suggestions will not be followed due to the many constraints on ship compartments dimensioning and positioning.



GP Maritime #03 Redesign Of Damage Control (Flooding) Simulator


Before the change

In the Damage Control School of the Hellenic Navy, we manage and operate three different type of Ship Simulators: 

1. Firefighting, 

2. Evacuation, 

3. Flooding. 

The Flooding simulator is the most recent addition and was constructed with limited resources. Therefore, the initial decision was not to include an isolated control room to observe the training activity.
However, after running the first demo courses, we quickly realized that this limitation was very important and should be resolved as soon as possible. The problems that were identified were the following:

both trainers and trainees were in the same place, which affected the quality and the realism of training,

we could not escalate the scenarios of flooding the vessel, because then the trainers were the last or the first to evacuate and were mixed with the Emergency Response Teams,

we could not measure the Technical and Non-technical Skills.



After the change

After redesigning the simulator, by retrofitting a three-station control room, the training process improved. The following benefits were observed:

The instructor could now very easily customize all training scenarios and change the events of the plot in such a way that could create a real, unfriendly and surprising environment. This improved the realism of the training process.

It was easier for the assessors to observe all the technical and non-technical skills, such as situation awareness, decision making, communication, teamwork, and leadership.

By escalating the scenarios in a more realistic way, the trainers and assessors could create more stress and fatigue to the trainees. Therefore, the human limitations are easier to evaluate.

Trainers and assessors can visually observe all the training activity from a safe environment and assess human limitations, such as managing stress and dealing with fatigue.






How and Why

A three-station control was retrofitted to the flooding simulator, which was effectively redesigned. The redesign was based on an approach that was similar to “HF Principles Evidence-Based Review” and “Fatigue Analysis” from the SAFEMODE HF Catalogue. Specifically, the approach included the following steps:

1. Questionnaires and semi-structured interviews with trainees and trainers. The questionnaire that was used for getting feedback was specifically developed for the needs of the assessment and experiment by Hellenic Navy safety experts, doctors and psychologists. The objective was to assess the effectiveness and efficiency of the training. The questionnaires were analyzed using established statistical methods. The feedback from the experienced trainers proved to be particularly useful for the redesign of the simulator.

2. Assessment of the trainees’ behaviour with the Hellenic Navy’s Behavioural Assessment rating scale.

3. Stress/fatigue analysis methods. The participants (both trainers and trainees) wore actigraphs (Garmin Vivosmart HR+) during the training activity and data were recorded from the devices. Training activities were conducted for three consecutive days and we had the chance to observe the effects of fatigue and sleep deprivation for 72 hours. The data gathered from the actigraphs were analyzed using statistical regression techniques. The objective was to determine the level to which the scenarios in the simulator may be escalated.




GP Maritime #04 Pilotage: Incident investigation and follow-up actions, due to vessel’s allision at the port of Dhamra


Before the change

When a vessel is entering a port or sails through restricted waters (i.e. a river) it is either advisable or obligatory to ask the services from a pilot, depending on the Port Authority. A pilot is a person that gets on board the vessel and advises the Master or the Officer On Watch (OOW) (it depends who has the command of the vessel) about the positioning, the direction, and the speed of the vessel. According to the “Bridge Procedures Guide” from the International Chamber of Shipping (ICS), one of the most critical tasks for the safety navigation of each vessel during pilotage periods, is the integration of the pilot in the Bridge Team, providing strong evidence of sound Bridge Resource Management (BRM) / Bridge Team Management (BTM) procedures. A good cooperation between Master and Officer of the Watch (OOW) and the Pilot is essential for carrying out this task safely. Usually the cooperation is smooth, but due to the multinational character of the maritime industry there are several cases where the communication or cooperation is problematic. This is often due to the attitude of either the Pilot or the Master and the limited time of interaction.

The incident that initiated the change in the relevant procedure for the shipping company is described briefly below.

The vessel, while proceeding under pilotage to her berth, hit the corner of the pier, resulting in a damage on the hull above the water line on her port side (along the top side tank). The contributing factors were the following:

1. Poor cooperation between Master and Officer of the Watch (OOW) in vessel’s bridge – Pilot (Indian) – Chief Mate and Bosun at the forecastle.

2. Miscommunication: a) The orders from the Pilot to the tug-Masters were in the Indian language, which was not understood by anyone from the personnel of the vessel, b) Lack of adequate cooperation between the bridge of the vessel and Chief Officer at the forecastle (e.g. misinformation regarding vessel’s distance from the pier).

3. Lack of experience in dealing with challenges that may arise during pilotage periods from the Master and Officers onboard.

The system/procedure was following (actually, relaying) information and guidance from 3rd parties on the way that pilotage periods should be managed. Therefore, this incident can be classified as a “systemic failure”, as the established and implemented relevant procedures did not take into account the specific characteristics of vessel’s crew (e.g. skills, experience, understanding of the specific requirements out of the cooperation with Indian pilots, etc.).



After the change

In the wake of the described incident, the relevant systemic procedures were taken under scrutiny. In this regard the following steps were followed:

1. The shipping company, following an incident investigation, drafted lessons learned and used them for improving the established procedures,

2. The shipping company’s Designated Person Ashore (DPA) sent the revised procedures to all the company’s vessels for feedback,

3. Comments were incorporated and the final revised procedure was disseminated to all the vessels of the company,

4. Training material (presentation) on the revised procedures was prepared and sent onboard all the vessels of the company. In addition, this material was sent to the manning agent for the training of newcomers and onboard personnel,

5. Continuous review of the procedures is being conducted with input out of the interaction of Bridge personnel with Pilots following vessels’ call at various ports, worldwide.

The revised procedure addressed the identified contributing factors by describing changes in the way of communication. It included a two-way communication model with reinforcement feedback and establishing predefined technical terminology to overcome miscommunication.




How and Why

None of the listed HF intervention were used, but the situation was treated rather empirically. Therefore, the approach was based mainly on the experience of the DPA and the superintendents of the shipping company.



GP Aviation #02 Pre-filter Modification & Active (dynamic) change in stick control force for overcoming Pilot Induced Oscillations (PIO)


Before the change

Generally, pilot actions are divided into: 

1. manual control; 
2. monitoring; 
3. decision making.

When developing flight control system algorithms, synthesizing director signals for the display, choosing the characteristics and type of the control sticks, and developing flying qualities evaluation criteria, manual control by the pilot is being considered. In this mode, the pilot does not interfere periodically but rather constantly reacts, deflecting the control sticks in response to the perceived visual, motion, and proprioceptive cues. That is, the pilot’s interaction with the aircraft in this mode is not divided into stages prior to and after an intervention. There exists a constant interaction with the aircraft or, according to your terminology, intervention. The figure below presents a general diagram of the pilot’s interaction with other elements of the pilot-aircraft system in manual control. 



These elements include the controlled element dynamics (the aircraft + flight control system), the display, and the manipulator. In case the piloting task changes, all of these so-called task variables also change, as well as the input signal i(t) and the disturbances d(t). For example, during the approach, the controlled element dynamics is described by altitude response, and by pitch response during the flare. The mathematical models defining the changes in these state variables and the displayed signals perceived by the pilot are different.

The researches carried out back in the 1950s and 1960s showed that the pilot adapts to different task variables, trying to keep the open and closed-loop pilot-aircraft system characteristics approximately the same. It requires the pilot to perform compensation actions, which ultimately impairs pilot subjective rating, accuracy of flying, and, as a result, flight safety. Consequently, the goal of an engineer developing a flight control system and other system elements is to ensure the easiest possible type of pilot’s action that does not require excessive corrective actions. 

In the almost 70-year history of research into the pilot-aircraft system, methods for experimental research have been developed for the system, pilot behavior regularities have been studied, and mathematical models of his behavior, sensory and central nervous systems have been developed. These results have been used successfully in designing flight control systems of previous and current-generation aircraft.

From the interview regarding the “New active manipulator inceptor to improve accuracy and safety of flight” before the HF intervention

This investigation started 3 years ago.  It combined the flight control system with the manipulator from the pilot’s point of view.  Currently Aircraft manufacturers use a side stick (with Airbus pilots using a small side-stick) where the output signal is equal to the forces exerted on the side stick and not to the deflection. And so the manipulator of the sidestick is proportional to the displacement of the aircraft.



After the change

In case of a poor choice of parameters of the of the pilot-aircraft system’s technical component, hazardous events may occur. Among such events are pilot induced oscillations (PIO), which are well-known among Russian and international experts in the field. 

Since the 1990s they have also been referred to as aircraft-pilot coupling. This phenomenon has various causes. Due to the emergence of highly-automated aircraft with a lowered stability margin, the primary causes are the restricted maximum rate of the control surface deflection, performed by the actuators, and a significant phase delay in the control element dynamics of modern aircraft caused by various factors. 

Seeking to perform the piloting task accurately, the pilot generates significant lead compensation, which can rapidly cause diverging oscillations. This kind of occurrence is observed in both civil and military aircraft. According to the statistics at my disposal, the number of incidents/accidents in civil aircraft has increased by 15 % due to PIO.

From the interview regarding the “New active manipulator inceptor to improve accuracy and safety of flight” after the HF intervention

With the new active manipulator, the inceptor’s use does not depend on the force exerted on it but rather on the deflection. This is important because in the case of failure, the dynamics of the aircraft can change drastically and so avoids pilot’s need to apply excessive force.  Therefore, this new active manipulator increased safety.




How and Why

In light of this, an extremely important task of decreasing the risk of such unfavorable interaction has arisen. A wide array of works is devoted to this matter. In particular, McRuer’s «Aviation safety and pilot control. Understanding and preventing unfavorable pilot-vehicle interactions», published in 1997 by the National Research Council, presents a detailed analysis of the phenomenon and an engineering approach to its suppression. 

One of the means of PIO suppression is installing nonlinear prefilters in the flight control system that do not let rapid signals into the system.

We have proposed a modification of one such prefilter, which also controls the gain coefficient from the feedback signals. 

In figure below (from my presentation at the 1995 AGARD conference) you can find the structure of these filters. The use of the proposed prefilter has allowed to decrease the resonance peaks of the closed-loop system, therefore lowering the probability of PIO occurrence. 

Another means of suppressing the PIO effect is an active (dynamic) change in stick control force.  This method, the elementary diagram of which is presented in the figure below, also allows to decrease the pilot-input lead, increase the amplitude margin of the open-loop system and, consequently, decrease the resonance peak of the closed-loop system, therefore lowering the PIO tendency. 

In recent years we have worked a lot on researching new types of predictive displays which also serve as a means of improving the interaction between the pilot and aircraft. See the article on the matter, titled «Development of Pilot Mathematical Model in the Preview Manual Control Task».

We also used a mathematical model of the neuro-muscular system to understand the output in relation to the deflection of the hand on the stick (manipulator), where the output is the forces that the pilot can place on the manipulator. 

Additionally, by combining the Flight Control System with the new active manipulator, there have been massive improvements. In the case of failure of the flight control system, we are able to change the stiffness of the inceptor because suddenly the pilot system becomes unstable and because the acceleration increases considerably. The inceptor has the mass and the steepness so with the help of the mathematical model of the neuro-muscular system, it is possible to change all of the parameters on the device.   

By combining the Flight Control System with the new active manipulator/ inceptor the percentage of accidents has decreased by 15% in case of failure of the flight control system.


GP Aviation #03 Design of an HMI for the PTZ cameras at the Remote Tower Facility


Before the change

HungaroControl has a contingency site for its tower operations that is remotely located from the airport. The visual representation of the airport is provided by a video system. As part of the visualization, there are a number of PTZ (pan-tilt-zoom) cameras installed. These cameras are zommable and maneuverable remotely, therefore they substitute a binocular for air traffic controllers. At the original indstallation of the visual system, the HMI to monitor and control these PTZ cameras was a simple HMI on a separate screen (see image below). It showed simultaneously all of the pictures taken from different viewpoints covering different areas, and below that, we had preset buttons that are shortcuts to “frequently viewed areas”. During the validation process, we found out that this setup does not support the spatial orientation of the ATCOs, because each PTZ camera showed a different part of the aerodrome and it made the identification of the origins very difficult. The maneuvering of the cameras was also challenging only with a mouse.




After the change

After understanding the issue with the original design (setup does not support orientation and manoeuvering), on the impoved HMI we display the orientation of the PTZ cameras on a simple airport map.

Now on the PTZ control screen, you can see a map and you can easily identify which PTZ serves your purpose, which one to choose to observe a certain area. Then by clicking on the area on the map, the PTZ turns automatically in the right direction that you want to visualize.

It is much easier to interpret the picture, the time it takes to manage the system decreased, so it is easier for the ATCO to use. In general, it contributes to maintaining situational awareness by supporting quick information collection.




How and Why

When installing the first version of the video system, we went through a full cycle of design, implementation, testing, and validation and this particular issue arose during the first cycle of validation. So after that, we went back to design and validation and as a result, this new function was created. In case of the contingency tower, the testing and validation is done during shadow operations. The HF experts are there making observations, creating surveys that the ATCOs can fill out. The HF experts also take part in debriefing sessions and facilitate other discussions after the sessions, which are used to define recommendations and requirements that are in line with the ATCOs capabilities and expectations.

The validation exercizes are normally concluded in a long list of recommendations, in this case the need to improve on this HMI function was only one item on that list. Similarly, the scope of improvement changes was borader than the fixing of the HMI.

During the project we used a methodology based on EUROCONTROL’s Human Factors Case that is exceptionally valuable to systematically assess and mitigate the risks associated with human factors aspect of a change. It can also used be to achieve potential benefits that might be outcome of the change. In this method, the assessment runs in parallel with the change project assuring that HF perspective is applied during concept, design and validation phases. In our case, during the HF process, validation needs were identified for the PTZ functionality, then the result of the validation did not met the pre-defined acceptance criteria, hence a corrective action was taken.

Human factors interventions of this kind are not supposed to be isolated actions to improve the operations or a system. Their goal is rather to facilitate a discussion and involvement of the air traffic controllers (our end users), the ATM experts, the technical experts, safety specialists, human factors analysts and the project manager. At the end of the validation cycle, the team  jointly comes up with recommendations and requirements, so the key to success is basically the team effort, clear communication and continuous involvement. In the case of refining our Remote tower facility, the value of having a very good team can not be overlooked. Safety experts, ATM experts, HF experts and the technical team (e.g. system engineers, designers) could all bring their knowledge to the table and by that navigating the design process to a satisfying outcome.

Safety assessment and human factors assessment at HungaroControl are integrated, therefore the list of recommendatins include both safety and HF interventions.

This HF Intervention is possibly transferable to the maritime sector, however, the standards are specific to aviation and hence not necessarily applicable to other sectors. The intervention used Risk informed design and hence a proactive safety approach during the design and development stage. It required an advance level of HF expertise due to the number of experts that contributed to the HF intervention. A medium effort was required during the course of 6 months during which other functionalities were also simultaneously developed.


Would like to know more ?