Results for “human contribution to safety” — Page 3

NASA NTRS2017

Quantifying Pilot Contribution to Flight Safety During Dual Generator Failure

Accident statistics cite flight crew error in over 60% of accidents involving transport category aircraft. Yet, a well-trained and well-qualified pilot is acknowledged as the critical center point of aircraft systems safety and an integral safety component of the entire commercial aviation system. No data currently exists that quantifies the contribution of the flight crew in this role. Neither does data exist for how often the flight crew handles non-normal procedures or system failures on a daily basis in the National Airspace System. A pilot-in-the-loop high fidelity motion simulation study was conducted by the NASA Langley Research Center in partnership with the Federal Aviation Administration (FAA) to evaluate the pilot's contribution to flight safety during normal flight and in response to aircraft system failures. Eighteen crews flew various normal and non-normal procedures over a two-day period and their actions were recorded in response to failures. To quantify the human's contribution, crew complement was used as the experiment independent variable in a between-subjects design. Pilot actions and performance when one of the flight crew was unavailable were also recorded for comparison against the nominal two-crew operations. This paper details diversion decisions, perceived safety of flight, workload, time to complete pertinent checklists, and approach and landing results while dealing with a complete loss of electrical generators. Loss of electrical power requires pilots to complete the flight without automation support of autopilots, flight directors, or auto throttles. For reduced crew complements, the additional workload and perceived safety of flight was considered unacceptable.

Etherington, Timothy J.↗

NASA NTRS2019

Agile Approach to Assuring the Safety-Critical Embedded Software for NASA's Orion Spacecraft

Human-rated missions like NASA's Exploration Mission - 1 (EM-1) and the Orion Multi-Purpose Crew Vehicle are becoming exceedingly complex in terms of software's contribution to achieving mission objectives. The increasing complexity and inherent safety critical nature of the embedded flight software imposes a unique resource challenge to assurance providers responsible for affirming that the mission is going to fly safely. Another challenge NASA and other Government agencies are facing is that more and more software is being developed using an agile development methodology, which is divergent from the typical waterfall, iterative, and incremental development methodologies assurance providers generally observe in the development of safety-critical embedded software. Orion Independent Verification and Validation (IV&V) has addressed these challenges by providing focused assurance results of critical mission capabilities prioritized by a dynamic assessment of risk level. Prior to this approach, Orion IV&V evaluated areas of risk in much broader, and more static, terms. Due to the agile software development life cycle that Orion follows, IV&V findings were often reported months out of phase with the developer thereby imposing increased rework costs. As a result of evolving the approach to adding assurance on Orion, IV&V is able to incrementally deliver high-priority assurance conclusions and more impactful issues more in phase with the developer activities, thereby increasing the value of the findings to the project. The agile IV&V approach employed by the Orion IV&V team strives to achieve a cadence of delivery that matches the pace of development. This agile approach provides increased flexibility for the assurance provider to become more efficient in reporting assurance conclusions and issues. This paper and presentation will discuss the principles which drive the design of our approach, results to date, and stimulate thinking for groups looking to add assurance to software being developed using an agile methodology.

Justin Smith↗

NASA NTRS2016

The Cognitive Challenges of Flying a Remotely Piloted Aircraft

A large variety of Remotely Piloted Aircraft (RPA) designs are currently in production or in development. These aircraft range from small electric quadcopters that are flown close to the ground within visual range of the operator, to larger systems capable of extended flight in airspace shared with conventional aircraft. Before RPA can operate routinely and safely in civilian airspace, we need to understand the unique human factors associated with these aircraft. The task of flying an RPA in civilian airspace involves challenges common to the operation of other highly-automated systems, but also introduces new considerations for pilot perception, decision-making, and action execution. RPA pilots participated in focus groups where they were asked to recall critical incidents that either presented a threat to safety, or highlighted a case where the pilot contributed to system resilience or mission success. Ninety incidents were gathered from focus-groups. Human factor issues included the impact of reduced sensory cues, traffic separation in the absence of an out-the-window view, control latencies, vigilance during monotonous and ultra-long endurance flights, control station design considerations, transfer of control between control stations, the management of lost link procedures, and decision-making during emergencies. Some of these concerns have received significant attention in the literature, or are analogous to human factors of manned aircraft. The presentation will focus on issues that are poorly understood, and have not yet been the subject of extensive human factors study. Although many of the reported incidents were related to pilot error, the participants also provided examples of the positive contribution that humans make to the operation of highly-automated systems.

remote pilot station↗

NASA NTRS2008

Certifying Auto-Generated Flight Code

Model-based design and automated code generation are being used increasingly at NASA. Many NASA projects now use MathWorks Simulink and Real-Time Workshop for at least some of their modeling and code development. However, there are substantial obstacles to more widespread adoption of code generators in safety-critical domains. Since code generators are typically not qualified, there is no guarantee that their output is correct, and consequently the generated code still needs to be fully tested and certified. Moreover, the regeneration of code can require complete recertification, which offsets many of the advantages of using a generator. Indeed, manual review of autocode can be more challenging than for hand-written code. Since the direct V&V of code generators is too laborious and complicated due to their complex (and often proprietary) nature, we have developed a generator plug-in to support the certification of the auto-generated code. Specifically, the AutoCert tool supports certification by formally verifying that the generated code is free of different safety violations, by constructing an independently verifiable certificate, and by explaining its analysis in a textual form suitable for code reviews. The generated documentation also contains substantial tracing information, allowing users to trace between model, code, documentation, and V&V artifacts. This enables missions to obtain assurance about the safety and reliability of the code without excessive manual V&V effort and, as a consequence, eases the acceptance of code generators in safety-critical contexts. The generation of explicit certificates and textual reports is particularly well-suited to supporting independent V&V. The primary contribution of this approach is the combination of human-friendly documentation with formal analysis. The key technical idea is to exploit the idiomatic nature of auto-generated code in order to automatically infer logical annotations. The annotation inference algorithm itself is generic, and parametrized with respect to a library of coding patterns that depend on the safety policies and the code generator. The patterns characterize the notions of definitions and uses that are specific to the given safety property. For example, for initialization safety, definitions correspond to variable initializations while uses are statements which read a variable, whereas for array bounds safety, definitions are the array declarations, while uses are statements which access an array variable. The inferred annotations are thus highly dependent on the actual program and the properties being proven. The annotations, themselves, need not be trusted, but are crucial to obtain the automatic formal verification of the safety properties without requiring access to the internals of the code generator. The approach has been applied to both in-house and commercial code generators, but is independent of the particular generator used. It is currently being adapted to flight code generated using MathWorks Real-Time Workshop, an automatic code generator that translates from Simulink/Stateflow models into embedded C code.

Denney, Ewen↗

DOE OSTI2022

Ecological Adaptive Cruise Control of Plug-In Hybrid Electric Vehicle With Connected Infrastructure and On-Road Experiments

Abstract This paper examines both mathematical formulation and practical implementation of an ecological adaptive cruise controller (ECO-ACC) with connected infrastructure. Human errors are typical sources of accidents in urban driving, which can be remedied by rigorous control theories. Designing an ECO-ACC is, therefore, a classical research problem to improve safety and energy efficiency. We add two main contributions to the literature. First, we propose a mathematical framework of an online ECO-ACC for plug-in hybrid electric vehicle (PHEV). Second, we demonstrate ECO-ACC in a real world, which includes other human drivers and uncertain traffic signals on a 2.6 (km) length of the corridor with eight signalized intersections in Southern California. The demonstration results show, on average, 30.98% of energy efficiency improvement and 8.51% additional travel time.

Automation & Control Systems↗

NASA NTRS1996

Human Factors in Cabin Accident Investigations

Human factors has become an integral part of the accident investigation protocol. However, much of the investigative process remains focussed on the flight deck, airframe, and power plant systems. As a consequence, little data has been collected regarding the human factors issues within and involving the cabin during an accident. Therefore, the possibility exists that contributing factors that lie within that domain may be overlooked. The FAA Office of Accident Investigation is sponsoring a two-day workshop on cabin safety accident investigation. This course, within the workshop, will be of two hours duration and will explore relevant areas of human factors research. Specifically, the three areas of discussion are: Information transfer and resource management, fatigue and other physical stressors, and the human/machine interface. Integration of these areas will be accomplished by providing a suggested checklist of specific cabin-related human factors questions for investigators to probe following an accident.

Chute, Rebecca D.↗

NASA NTRS2017

Medical Support for ISS Crewmember Training in Star City, Russia

Medical support of spaceflight training operations across international lines is a unique circumstance with potential applications to other aerospace medicine support scenarios. KBRwyle's Star City Medical Support Group (SCMSG) has fulfilled this role since the Mir-Shuttle era, with extensive experience and updates to share with the greater AsMA community. OVERVIEW: The current Soyuz training flow for assigned ISS crewmembers takes place in Star City, Russia. Soyuz training flow involves numerous activities that pose potential physical and occupational risks to crewmembers, including centrifuge runs and pressurized suit simulations at ambient and hypobaric pressures. In addition, Star City is a relatively remote location in a host nation with variable access to reliable, Western-standard medical care. For these reasons, NASA's Human Health & Performance contract allocates full-time physician support to assigned ISS crewmembers training in Star City. The Star City physician also treats minor injuries and illnesses as needed for both long- and short-term NASA support personnel traveling in the area, while working to develop and maintain relationships with local health care resources in the event of more serious medical issues that cannot be treated on-site. The specifics of this unique scope of practice will be discussed. SIGNIFICANCE: ISS crewmembers training in Star City are at potential physical and occupational risk of trauma or dysbarism during nominal Soyuz training flow, requiring medical support from an on-duty aerospace medicine specialist. This support maintains human health and performance by preserving crewmember safety and well-being for mission success; sharing information regarding this operational model may contribute to advances in other areas of international, military, and civilian operational aerospace medicine.

Chough, Natacha↗

NASA NTRS2017

Medical Support for ISS Crewmember Training in Star City, Russia

Medical support of spaceflight training operations across international lines is a unique circumstance with potential applications to other aerospace medicine support scenarios. KBRwyle's Star City Medical Support Group (SCMSG) has fulfilled this role since the Mir-Shuttle era, with extensive experience and updates to share with the greater AsMA community. OVERVIEW: The current Soyuz training flow for assigned ISS crewmembers takes place in Star City, Russia. Soyuz training flow involves numerous activities that pose potential physical and occupational risks to crewmembers, including centrifuge runs and pressurized suit simulations at ambient and hypobaric pressures. In addition, Star City is a relatively remote location in a host nation with variable access to reliable, Western-standard medical care. For these reasons, NASA's Human Health & Performance contract allocates full-time physician support to assigned ISS crewmembers training in Star City. The Star City physician also treats minor injuries and illnesses as needed for both long- and short-term NASA support personnel traveling in the area, while working to develop and maintain relationships with local health care resources in the event of more serious medical issues that cannot be treated on-site. The specifics of this unique scope of practice will be discussed. SIGNIFICANCE: ISS crewmembers training in Star City are at potential physical and occupational risk of trauma or dysbarism during nominal Soyuz training flow, requiring medical support from an on-duty aerospace medicine specialist. This support maintains human health and performance by preserving crewmember safety and well-being for mission success; sharing information regarding this operational model may contribute to advances in other areas of international, military, and civilian operational aerospace medicine.

Chough, Natacha↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek A Whitman↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek Whitman↗

NASA NTRS1994

Towards a framework of human factors certification of complex human-machine systems

As far as total automation is not realized, the combination of technical and social components in man-machine systems demands not only contributions from engineers but at least to an equal extent from behavioral scientists. This has been neglected far too long. The psychological, social and cultural aspects of technological innovations were almost totally overlooked. Yet, along with expected safety improvements the institutionalization of human factors is on the way. The introduction of human factors certification of complex man-machine systems will be a milestone in this process.

Bukasa, Birgit↗

NASA NTRS1993

Crew interface analysis: Selected articles on space human factors research, 1987 - 1991

As part of the Flight Crew Support Division at NASA, the Crew Interface Analysis Section is dedicated to the study of human factors in the manned space program. It assumes a specialized role that focuses on answering operational questions pertaining to NASA's Space Shuttle and Space Station Freedom Programs. One of the section's key contributions is to provide knowledge and information about human capabilities and limitations that promote optimal spacecraft and habitat design and use to enhance crew safety and productivity. The section provides human factors engineering for the ongoing missions as well as proposed missions that aim to put human settlements on the Moon and Mars. Research providing solutions to operational issues is the primary objective of the Crew Interface Analysis Section. The studies represent such subdisciplines as ergonomics, space habitability, man-computer interaction, and remote operator interaction.

Bagian, Tandi↗

DOE OSTI2020

Towards a Deeper Understanding of Automation Transparency in the Operation of Nuclear Plants

Automation technologies have the potential to reduce operations and maintenance costs, ensure reliable power generation and safety, and thereby contribute to extending the lifespan of nuclear power plants. To fulfill this aspiration, automation behaviors have to be understandable and predictable to human operators and traceable for license holders and regulators in the event of automation failures. The current report investigates how automation transparency as a systems design principle can keep operators sufficiently informed about the inner workings of automation or make fail-safe automation run invisibly in the background to free up operator capacity.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2024

Enhanced Safety of Heavy-Duty Vehicles on Highways through Automatic Speed Enforcement – A Simulation Study

Highway safety remains a significant concern, especially in mixed traffic scenarios involving heavy-duty vehicles (HDV) and smaller passenger cars. The vulnerability of HDVs following closely behind smaller cars is evident in incidents involving the lead vehicle, potentially leading to catastrophic rear-end collisions. Here, this paper explores how automatic speed enforcement systems, using speed cameras, can mitigate risks for HDVs in such critical situations. While historical crash data consistently demonstrates the reduction of accidents near speed cameras, this paper goes beyond the conventional notion of crash occurrence reduction. Instead, it investigates the profound impact of driver behavior changes within desired travel speed distribution, especially around speed cameras, and their contribution to the safety of trailing vehicles, with a specific focus on heavy-duty trucks in accident-prone scenarios. To conduct this analysis, we utilize SUMO, an open-source microscopic traffic simulator, enabling realistic simulations of real-world driving behaviors with and without speed cameras. The simulations also consider empirical distributions of desired headway gaps and reaction times exhibited by human drivers. This study offers a fresh perspective on highway safety by examining how the influence of automatic speed enforcement systems on driver behavior enhances the safety of HDV when faced with challenging situations. By shedding light on these dynamics, we contribute valuable insights to the ongoing research efforts on using technology to create safer roadways, ultimately promoting safer coexistence between heavy-duty and passenger vehicles.

33 ADVANCED PROPULSION SYSTEMS↗

NASA NTRS1993

Cockpit checklists - Concepts, design, and use

Although the aircraft checklist has long been regarded as a foundation of pilot standardization and cockpit safety, it has escaped the scrutiny of the human factors profession. The improper use, or nonuse, of the normal checklist by flight crews is often cited as a major contributing factor to aircraft accidents. This paper reports the results of a field study of flight deck checklists and examines this seemingly mundane yet critical device from several perspectives: its functions, format, design, length, and usage, and the limitations of the humans who must interact with it. Certain sociotechnical factors, such as the airline 'culture', cockpit resource management, and production pressures that influence the design and use of this device, are also discussed. Finally, a list of design guidelines for normal checklists is provided. Although the focus of this paper is on the air transport industry, most of the principles discussed apply equally well to other high-risk industries, such as maritime transportation, power production, weapons systems, space flight, and medical care.

Degani, Asaf↗

DOE OSTI2025

Quantitative Risk Assessment for Fuel Cell Electric Bus Hydrogen Storage and Refueling Facility

It is necessary to understand the safety implications and risk mitigation options for fuel cell electric bus fleet deployment, especially for related facilities responsible for operations such as production, storage, compression, and dispensing of hydrogen for use by the buses. In this report, we present a quantitative risk assessment for a potential fuel cell electric bus fleet that was motivated by efforts to improve resilience at the Portland International Airport but can be applicable to a range of hydrogen case studies and use cases. We estimated risk for a facility that produces, stores, compresses, and dispenses hydrogen for the fleet of buses, with a focus on individual risk to people in terms of annual frequency of fatality. We considered the frequency of hydrogen leaks that could result in harmful physical outcomes like jet fires or explosions, and the consequences of those outcomes for people. We created customized fault trees to calculate the frequencies of different sizes of leaks and event sequence diagrams to calculate ignition probabilities for the various leak sizes. We also leveraged the HyRAM+ toolkit to use these inputs to calculate overall risk for the facility, which we separated into one section responsible for producing, storing, and compressing hydrogen, and one section responsible for dispensing the hydrogen to the buses. We found that the dispensing area seemed to have a higher risk than the production/storage/compression area of the facility, largely because of the inclusion of a component with a high leak frequency (the heat exchanger used to cool the hydrogen before entering the vehicle, to prevent overheating and expansion of hydrogen in the onboard tank). For the example production and refueling facility we evaluated and the data we used for the analysis, the leak frequency had a larger impact on the risk differences between the two sections on the facility, compared to the physical outcome consequence, which was slightly different due to the varying fuel conditions, but not substantially different. Actions can be taken to prevent these hazards (e.g., lowering leak frequencies in system components) or to mitigate the consequences if they do occur (e.g., installing barriers to protect people if ignition events occur). The choice of which actions to take depends not only on safety considerations but also on space, time, staffing, feasibility, and financial constraints. Therefore, the quantitative risk assessment approach can help understand relative risk contributions from different components, leak sizes, consequences, and human actions, to prioritize risk reduction strategies and balance these parameters. The outcomes of this report may be useful for a variety of stakeholders working in the hydrogen, transportation, vehicle, and aviation sector, including those responsible for aspects like facility design, operations, and regulations. There is not a single value of risk that determines whether a hypothetical system is “safe” or not. The insights about risk mitigations may be leveraged, and the quantitative risk assessment approach can be applied to other case studies to understand risk priorities and contributions specific to different FCEB and hydrogen facility uses.

08 HYDROGEN↗

NASA NTRS2017

Towards Designing Graceful Degradation into Trajectory Based Operations: A Human-Systems Integration Approach

One of the most fundamental changes to the air traffic management system in NextGen is the concept of trajectory based operations (TBO). With the introduction of such change, system safety and resilience is a critical concern, in particular, the ability of systems to gracefully degrade. In order to design graceful degradation into a TBO envrionment, knowledge of the potential causes of degradation, and appropriate solutions, is required. In addition, previous research has predominantly explored the technological contribution to graceful degradation, frequently neglecting to consider the role of the human operator, specifically, air traffic controllers (ATCOs). This is out of step with real-world operations, and potentially limits an ecologically valid understanding of achieving graceful degradation in an air traffic control (ATC) environment. The following literature review aims to identify and summarize the literature to date on the potential causes of degradation in ATC and the solutions that may be applied within a TBO context, with a specific focus on the contribution of the air traffic controller. A framework of graceful degradation, developed from the literature, is presented. It is argued that in order to achieve graceful degradation within TBO, a human-system integration approach must be applied.

human-system integration↗

NASA NTRS2017

Towards Designing Graceful Degradation into Trajectory Based Operations: A Human-Machine System Integration Approach

One of the most fundamental changes to the air traffic management system in NextGen is the concept of trajectory based operations (TBO). With the introduction of such change, system safety and resilience is a critical concern, in particular, the ability of systems to gracefully degrade. In order to design graceful degradation into a TBO envrionment, knowledge of the potential causes of degradation, and appropriate solutions, is required. In addition, previous research has predominantly explored the technological contribution to graceful degradation, frequently neglecting to consider the role of the human operator, specifically, air traffic controllers (ATCOs). This is out of step with real-world operations, and potentially limits an ecologically valid understanding of achieving graceful degradation in an air traffic control (ATC) environment. The following literature review aims to identify and summarize the literature to date on the potential causes of degradation in ATC and the solutions that may be applied within a TBO context, with a specific focus on the contribution of the air traffic controller. A framework of graceful degradation, developed from the literature, is presented. It is argued that in order to achieve graceful degradation within TBO, a human-system integration approach must be applied.

human-system integration↗