Editors : Daniel J. Garland, John Wise and David Hopkin Lawrence Erlbaum Associate Inc. Publishers, nj., 1998 Amalberti, R. (1998)

Val de Grâce Military Hospital, Paris, and IMASSA, Brétigny-sur-Orge, France

(IMASSA : Institut de Médecine Aéronautique du Service de Santé des Armées)

Aircraft automation is part of a vast movement to improve and control performance and risks in our so-called "advanced societies." Beyond the consequences for crews, automation is incorporated into the global evolution of these advanced societies as a tool providing people with more comfort and happiness, better performance, and fewer problems.

But automation is also part of the aviation business and gives rise to permanent national and international competition between manufacturers. Inevitably accidents, incidents, and successes feed this competition and are overexploited by the press.

From a technical point of view, any new technology calls for a period of adaptation to eliminate residual problems and to allow users to adapt to it. This period can takes several years, with successive cycles of optimization for design, training, and regulation. This was the case when jets replaced propeller planes. The introduction of aircraft like the B707 or the B727 were major events in aviation. These cycles are invariably fraught with difficulties of all types including accidents. People do not yet know how to optimize complex systems and reach the maximum safety level without field experience. The major reason for this long adaptive process is the need for harmonization between the new design on one hand and the policies, procedures, and moreover the mentalities of the whole aviation system on the other hand. This harmonization goes far beyond the first months or years following the introduction of the new system, both because of the superimposition of old and modern technologies during several years, and because of the natural reluctance of people and systems to change.

This is also true for the automation of cockpits. The current transition phase from classic aircrafts to glass cockpits has been marked by a series of major pilot error-induced incidents and accidents.

Some of these human errors have been recognized as facilitated by technical drawbacks in the design, operation, and/or training of automated aircraft.

An important question for the aviation community is to determine what part of these identified design, operations, procedures, and training drawbacks would disappear with appropriate personnel training and regulation but without design change. The second part of the question is which of the problems are more difficult to treat and will require changes in automation design and policy? However, one should note that there is no precise timetable for adaptation. Policies are often revisited under the pressure of an accident; for example the recent U.S. public reactions to the Valujet accident in Miami led the FAA to considerably strengthen surveillance of airlines in a highly competitive market where seat prices, services, and sometimes safety practices may be relaxed.

Human factors research in cockpit automation has been greatly influenced from this complex and highly emotional climate. There are dozens of human factors research teams in the world involved in the study of automation-induced problems. They have proposed series of diagnostics of automation drawbacks for more than a decade (two decades if the work done in automation within the nuclear industry is included). The concepts of irony of automation (Bainbridge, 1987), clumsy automation (Wiener, 1989), and insufficient situation/mode awareness (Endsley, 1996; Sarter & Woods, 1992) are good examples of these diagnostics. Theorists have also suggested generic solutions to improve the design of automated systems, such as the concepts of human-centered automation (Billings, 1997), user friendly design, ecological interfaces, ecological design, and ecological safety (Flach, 1990; Rasmussen &Vicente, 1989; Wioland & Amalberti, 1996). This profusion of research and ideas contrasts with the fact that human factors research does not have much application within the industry. It is the goal of this chapter to understand better the reasons for this paradox.

Of course, that is not to say that nothing exists in the industry regarding human factors. First, the growing adhesion of industry to cockpit resource management (CRM) courses is more than a success for psychosociologists. Second, human factors are intensively used by manufacturers and regulators. How can a manufacturer or an operator ignore the end user (the pilot) if it wants to please the customer and sell a product?

However, one must question how effectively human factors are used in design and operations and to comprehend why these human factors are not the ones suggested by the academics. Regardless of their success, CRM courses have encouraged a relative capsulation of human factors theoretical concepts within flight operations. In the rest of the industry, there is still a belief that human factors relies much more on good sense and past experience than on theory "We are all human, so we can all do human factors" (Federal Aviation Administration (FAA) human factors report, Abbott et al, 1996, page 124).

One further step in this analysis should allow us to comprehend what model of end user designers and operations staffs had (and/or still have) in mind. According to the nature of this end user model, we suspect that the design process will be different because the design is oriented toward the replacing of end users’ weaknesses.

In sum, speaking about automation is like addressing a very sensitive question that goes beyond the technical and "objective" analysis of automation-induced problems. The problems include those of ethical questions and reflect a persisting deficit in communication between the human factors academy and industry.

Fortunately, this situation is not frozen. Several recent initiatives by regulatory authorities (FAA Human Factors Team, JAA Human Factors Steering Group, OCAI' s International Human Factors Seminar) are casting new light on the problem. For safety reasons, and also because of a growing tendency of managers and politicians to fear from legal consequences and public disgrace if new crashes occur, authorities ask more and more human factors academies and industry staff to be more open-minded and to bridge their disciplines. Note that bridging does not mean unidirectional efforts. Industry should incorporate more academic human factors, but the academic realm should equally improve its technical knowledge, consider industry constraints, and consider the feasibility and cost of suggested solutions.

Because of this big picture, and because numerous (good) reports, books and chapters have already been devoted to overview of automation-induced problems in commercial and corporate Aviation (see e.g., Amalberti, 1994; Billings, 1997; Funk, Lyall & Riley, 1995); Parasuraman & Mouloua, 1996; Sarter & Woods, 1992, 1995; Wiener, 1988; Wise et al, 1993; etc.), this chapter gives priority to identifying mismatches between industry and the theorists and to suggesting critical assessment of human factors solutions, rather simply listing drawbacks and presenting new solutions as miracles.

The chapter is divided into three sections. The first section describes the current status of aircraft automation, why it has been pushed in this direction, what end user model triggered the choice, how far can the results be considered a success by the aviation technical community, and how drawbacks were explained and controlled. The second section starts from a brief description of automation drawbacks, then turns to the presentation of a causal model based on the mismatch of the pilot's model between industry and academia. The third and last section focuses on solutions suggested by the theorists to improve man-machine interface or to assist industry in improving jobs. It also considers the relevance, feasibility, and limitations of these suggestions.

Automation : a success story for Aviation
Today's automated aircraft have a variety of features ranging from automatons, automated tools and pilot support systems, numerous and complex subsystems, and highly integrated components.

Changes in the mode of information display to the pilot have been equally important. Use of cathode ray tube (CRT) screens has made for more succinct information presentation and a better emulation of the outside world through map displays.

These new cockpits have been christened "glass cockpits" to reflect this better representation of the outside world (the similarities between the instrument panel and the outside world) and the use of electronic display panels. Aircraft automation and computerization are now used on all types of two-person crew aircraft.
Premises of Automation in the Early 1970s : Emergence of an End User's Model Based on Common Sense
At the end of the 1960s, aviation was facing a big challenge. The early age of aviation with pilot heroes was over. Economic big growth and promises of a tremendously expanding world market were pushing the industry to demonstrate its capability to carry massive numbers of passengers, safely and routinely.

Human limitations were recognized as potential barreers to the attainment of this goal. Research in the related physiological and psychological human limitations was echoing the feeling that humans were "intelligent but fragile" machines. Among the strongest limitations were the limited capacity of attention and resources, which led to an oversimplified end user model with a single-channel metaphor. For all these reasons, individual and group performance were seen as highly unreliable.

Not surprisingly, the growing demands on performance placed by increasing traffic were resulting in calls for a new definition of the pilot role. Automation and prosthesis (intelligent assistance) were logically developed to bypass human limitations in order to meet the new challenges just described: routinely carrying more passengers, more safely, more efficiently, and more cheaply.

To sum up, designers originally hoped to

•Reduce workload and difficulty of carrying out the phases of the flight.

•Relieve pilots of having to perform repetitive sequences that are unrewarding and for which human beings in their inconsistency can be at their best or their worst.

•Endow pilots with the gratifying part of their jobs: decision making.
Automation: A Success Story
Automation in aviation has reached all the goals assigned in the 1960s. There is a consensus that nobody should design a modern aircraft with much less automation than the current glass-cockpit generation.

The global performance of systems has been multiplied by a significant factor: Cat III landing conditions have been considerably and safely extended, lateral navigation (LNAV) has been tremendously enhanced, computer-support systems aid the pilot in troobleshooting failures, and so forth.

The economic benefits have been equally remarkable: fuel saving, enhanced reliability, ease in maintenance support, reduction in crew complement, and tremendous benefits in the reduced training time. The duration of the transition course for type-rating on modern glass cockpits is at least 1 week shorter than for the old generation and has considerably improved cross-crew qualification among similar types of aircrafts. For example, the transition course between A320 and A340 asks for a 11-day course instead of a 22-day regular course. Another benefit relies upon the zero-flight training concept, which should aim soon at type-rating pilots on a machine without any flight (flight is of course the most expensive part of training). However, some U.S. airlines have came recently to the conclusion that crews are not learning enough in transition and are considering making the transition course much longer (fallout of Cali accident Investigation).

Automation has also contributed greatly to the current level of safety. Safety statistics show that glass cockpits have an accident rate half that of the previous generation of aircraft. The global level of safety now appears to be equal to that of the nuclear industry or railways (in Westen Europe). The only apparent concern is that this (remarkable) level of safety has not improved since the 1970s. Of course, one should also note that the current level of safety is not due only to automation, but to the overall improvement of system, including air traffic control (ATC), airports, and the use of simulators in training. But one has also to aknowledge that the current plateau of safety is not solely a function of automation problems. There is growing evidence that increases in traffic, in the complexity of organizations and management, and in the variety of corporate and national cultures all play significant roles in the plateau and need more consideration in future design and training.

Last, but not least, the regulation of aviation safety relies on the acceptance of a certain risk of accident that compromises between safety costs and safety benefits; this level of accepted risk is close to the one observed at the present time. Therefore manufacturers and managers do not feel guilty and consider that they meet the targets (better efficiency, less cost, with a high level of safety). Objectively, these people are correct. The reader will easely understand that this self-satisfaction does not promote room for dialogue when criticisms of automation are expressed.
Automation for the best and the worst: the pilots' and the theorists' perspectives
No important technical change can occur without important social change. Because automation is able to carry on most flying tasks, and because the use of automation has been necessary to reach the goal of better performance and safety, it was explicitely assumed by designers that pilots would follow the technical instructions given by computers, and use automation as much as possible. Pilots would have to adapt to their new position, with a noble role in programming the system, monitoring execution by automation, and only overriding in case of system malfunction.

This adaptation has been much more difficult than expected.

Pilots'unions rapidly complained about advanced automation. During the 1980s, many pilots refused to transition to the glass cockpit for as long as it is was possible in their company. The social reaction to glass has also been exacerbated by pilots’unions because of the reduction of flight-crew members (even though this was only partially true, because the reduction of crew was accomplished in the DC9 and B737). It is probably not a surprise that a series of glass cockpit accidents occured in a country (France) where the protests and strikes against the introduction of glass had been stronger than anywhere in the world (A320 Habsheim, A320 Mont-Saint-Odile, B747-400 Papeete, see Gras, Moricot, Poirot-Delpech, & Scardigli, 1994).

As noted in the introductory section, it is not the main goal of this chapter to list all the drawbacks of automation. However, a summary of these problems is given next with cross-references to chapters and books already published.

In addition, the use of databases is often a source of confusion between points with similar names or incidents related to point coordinate errors within the database itself (Wiener, Kanki and Helmreich, 1993).

Reason (1990) termed the latter resident pathogen errors to emphasize that multiple forms of these errors exist in the database but remain undetected until the point is used, just the way that an infection can be lodged in the body for a long time before sudden outbreak of disease (i.e., its long period of incubation).

Most of these drawbacks tend to disappear with experience on glass and with appropriate training, namely, dedicated glass cockpit crew-resource management courses (Wiener, Kanki and Helmreich, 1993).

This type of problem occurs frequently in final approach with runway changes, and has already been a causal factor in numerous incidents (see excerpts of ASRS quoted in the FAA human factors report, Abbott & al, 1996). These difficulties of reprogramming in real time are indicative of a more serious lack of comprehension that Wiener (1988), then Woods, Johannesen, Cook and Sarter (1994) have termed "a clumsy system logic", which in any case is a logic which differs greatly from that of a pilot.

The pilot evaluates the computer through his or her own action plan by using what he or she knows about how automated equipment functions. Most pilots lack a fundamental grasp of the internal logic of automation and evaluate the gap between their expectations (governed by what they would do if they were at the commands) and what the computer does. This analysis is sufficient in most cases, but can rapidly become precarious if the chasm widens between the action plan and the behavior of the machine. This is frequently observed while using autopilot modes that combine or follow one another automatically according to the plane's attitude without any action by the pilot (automatic reversion modes). Sarter and Woods (1991, 1992, 1995), in a series of studies about autopilot mode confusion, have shown the limitations of human understanding of such reversions in dynamic situations.

Several studies of recent incidents show that the human operator responds poorly in such conditions:

• He hesitates about taking over because he will accuse himself of not understanding before accusing the machine of faulty behavior. Trying to do his best, he does not try to reason on the basis of mental procedures, but on his own most efficient capacity (based on logical rules). This change in reasoning is time consuming and resource-depleting (to the detrement of coordination with the human copilot) and often aggravates the situation by postponing action.

• In many cases, lacking knowledge and time, he accepts much greater drift than he would from a human copilot.

• Finally, when he is persuaded that there is an automation problem, the human operator only tends to override the automated procedure that deviates from the goal; he does not override the others, and he is willing to invest more attention and be less confident in the subsequent phases of the flight (Lee & Moray, 1994).

In short, there are no problems when the automated procedure plan and the pilot's plan coincide. But difficulties surface rapidly as soon as plans differ; different modes of functioning do not facilitate efficient judgment of the difference, and the automation benefits (unjustly) from greater latitude than a human crewmate.

No doubt, these oversimplistic pilots models are extremely incorrect when considering the knowledge existing among theorists. The dymamic control model of cognition, characteristic of pilots activities but also of many other situations has been extensively described in a series of studies not limited to the aviation field (see Cacciabue, 1992; Hoc, 1996; Hollnagel, 1993; Rasmussen, 1986). There is growing evidence that dymanic cognition, regardless of the truth of limitations, is self-protected against the risk of loosing control by a series of extremely efficient mechanisms. Moreover, humans are using errors to optimize these mechanisms.

The lessons from such model are twofold: First, dynamic cognition is continuously tuning a compromise between contradictory dimensions: reaching goals with the best objective performance, with minimum resources spent on the job to avoid short-term overload and long-term fatigue and exhaustion. Meta-knowledge and error recovery capacities are at the core of the efficient tuning of this compromise. Human errors are just items among others, such as the feeling of difficulty, the feeling of workload, and the time of error recovery, required to cognitively adapt and control the situation to reach the assigned goals. Second, the design of some automated systems is masking cognitive signals and impoverishing the efficiency of meta-knowledge, therefore causing the potential for new categories of human losses of control.

The following section details this model and explains the negative interaction between automation and dymamic cognition (see also, for extended description, Amalberti, 1996; Wioland & Amalberti, 1996).

Field experiments in several areas confirm this pattern of behaviour. For example, a study considered the activity of fighter pilots on advanced combat aircraft (Amalberti & Deblon, 1992). Because of rapid changes in the short-term situation, fighter pilots prefer to act on their perception of the situation to maintain the short-term situation in safe conditions rather than delaying to evaluate the situation to an optimal understanding.

When an abnormal situation arises, civil and fighter pilots consider very few hypotheses (one to three) which all result from expectation developed during flight preparation or in flight briefings (Amalberti & Deblon, 1992; Plat and Amalberti, in press). These prepared diagnoses are the only ones that the pilot can refer to under high time-pressure. A response procedure is associated with each of these diagnoses, and enables a rapid response. This art relies on anticipation and risk-taking.

Because their resources are limited, pilots need to strike a balance between several conflicting risks. For example, pilots balance an objective risk resulting from the flight context (risk of accident) and a cognitive risk resulting from personal resource management (risk of overload and deterioration of mental performance).

To keep resource management practical, the solution consists in increasing outside risks, simplifying situations, only dealing with a few hypotheses, and schematising the reality. To keep the outside risk within acceptable limits, the solution is to adjust the perception of reality as much as possible to fit with the simplifications set up during mission preparation. This fit between simplification and reality is the outcome of in flight anticipation.

However, because of the mental cost of in flight anticipation, the pilot's final hurdle is to share resources between short-term behavior and long-term anticipation. The tuning between these two activities is accomplished by heuristics that again rely upon another sort of personal risk-taking : as soon as the short term situation is stabilized, pilots invest resources in anticipations and leave the short term situation under the control of automatic behaviour.

Hence the complete risk-management loop is multifold: Because of task complexity and the need for resource management, pilots plan for risks in flight preparation by simplifying the world. They control these risks by adjusting the flight situation to these simplifications. To do so, they must anticipate. And to anticipate, they must cope with a second risk, that of devoting resources in flight to long term anticipation to the detriment of short-term monitoring, navigation, and collision avoidance. Thus, pilots accept a continuous high load and high level of preplanned risk to avoid transient overload and/or uncontrolled risk.

Any breakdown in this fragile and active equilibrium can result in unprepared situations, where pilots are poor performers.

The tuning of the mode control depends both on the context and on meta-knowledge and self confidence. Metaknowledge allows the subject to keep the plan and the situation within (supposed) known areas, and therefore to bet on reasonable outcomes. The central cue for control-mode reversion is the emerging feeling of difficulty triggered by unexpected contextual cues or change in the rhythms of action, which lead to activation of several heuristics to update the mental representation and to keep situation awareness (comprehension) under (subjectively) satisfactory control.

These modes and heuristics control and adapt the level of risk when actions are decided.
A Model of Error Detection and Error Recovery. Controlling risk is not enough. Regardless of the level of control, errors will occur and the operator should be aware of it. He develops a series of strategies and heuristics to detect and recover from errors (Rizzo, Ferrente & Bagnara, 1994; Wioland & Amalberti, 1996).

Experimental results show that subjects detect over 70% of their own errors (Alwood, 1994; Rizzo et al, 1994); this percentage of detection falls to 40% when the subjects are asked to detect the errors of colleagues (Wioland & Doireau, 1995). This lesser performance is because the observer is deprived of the memory of intentions and actions (mental traces of execution), which are very effective cues for the detection of routine errors.

Jumpseat or video observations in civil and military aviation (for an overview see Amalberti, Pariès, Valot and Wibaux, 1997) shows that error rate and error detection are in complex interactions. The error rate is high at first when task demands are reduced and the subjects are extremely relaxed, then converges toward a long plateau, and finally decreases significantly only when the subjects almost reach their maximum performance level. The detection rate is also stable above 85% during the plateau, then decreases to 55% when the subjects approach their maximum performance, precisely at the moment subjects are making the lowest number of errors.

FIG 7.1 : An ecological safety model of cognition

Because operators are resource limited, they have to accept risks in simplifying the universe (setting up a mental representation), using routines to maintain the job under reasonable workload, and giving priorities in checks. Meta-knowledge, confidence, and respect for margins allow the users to maintain these accepted risks within acceptable limits. However, regardless of the value of the balance between accepted risks and risk protection, all subjects will make errors. Error detection and error recovery strategies are the natural complement of this risk of error. The error rate and error recovery time serve also to provide feedback and to help adapt cognitive mode control.
That figure indicates that error rate and error awareness are cues directly linked to the cognitive control of the situation. The feedback from errors allows the subject to set up a continuous picture of the quality of his own control of the situation. One can note that the best position for the subject does not fit with a total error avoidance, but merely with a total awareness of errors. The combined mechanisms protecting cognitive betting and allowing the subject to recover errors forms what is called an ecological safety model of cognition (Fig 7.1).

These results confirm the hypothesis of the highly dynamic and continuously adaptating nature of the ecological safety model. Operators are using a family of cognitive abilities to control risk.

This section tries to understand the logic of these negative interactions. The reasons for them are threefold. The first reason is linked to the multiplication of solutions to reach the same goal, the second is the long time needed to stabilize self-confidence and meta-knowledge on the glass cockpit, and the third and last reason corresponds to a certain irony of safety policies and automation design willing to suppress human error, finally resulting in suppressing individual ecological safety capacities.

FIG 7.2: Mapping the limitation of performance and the loss of control.

Left: the space of possibilities to reach a given level of performance. The performance envelope is normally self-limited, to remain in safe conditions (situation under controls), thanks to a series of cognitive signals warning the operator when approaching to unstable boundaries. Note that the operator can lose control of the situation, whatever the level of performance, but for different reasons.

Right: A perverse effect of automation. The envelope of cognitive performance has been artificially expanded by assistance and automated systems. This extension of the envelope of performance is a undebatable advantage for point 1. However, it is much more debatable for point 2, which represents a level of performance already attainable within the ecological envelope. The expansion of the performance envelope multiplies solutions to reach the same goal for the same level of performance and mechanichally reduces the experience of each solution.

Last, but not least, there is a mechanical effect on knowledge when expanding the number of solutions. The expansion of the performance envelope multiplies solutions to reach the same goal for the same level of performance and mechanichally reduces the experience of each solution (and the time on training for each of them; see Fig 7.2, and the next section).

The drawback of the glass cockpit is not only a matter of training length. The final quality of expertise is also changing. With complex and multimode systems, the human expertise cannot be systematic, and therefore is built upon local explorations. Even after 1000 flight hours, pilots do not have a complete and homogeneous comprehension of systems; they become specialists in some subareas, such as some FMS functions, and can almost ignore the neighboring areas. When analyzing carefully what pilots think they know (Valot & Amalberti, 1992), it is clear that this heterogeneous structure of expertise is not mirrored accurately by meta-knowlege. Because meta-knowledge is at the core of the control of risk taking, it is not surprising that overconfidence and underconfindence are facilitated. Overconfidence occurs the system is engaged in areas where the pilot discovers too late that he is beyond his depth; lack of confidence results in delayed decision making or refusal to make decisions. The A320 accidents of Habsheim and Bangalore occured with pilots precisely at this second stage, transitioning on the glass cockpit with a poor representation not only of the situation but also of their own capacities.

The third stage of expertise corresponds to the autonomous stage of Anderson’s model. A retraction to an operative subset of this expertise for daily operations is the last stage of the confidence model. The margins generated by this retraction provide pilots with a good estimate of the level of risk to assign to their own know-how. Again, the heterogeneous structure of expertise provokes some paradoxical retractions. Pilots import from their explorations small personal peaces of procedures that they have found efficient and tricky. The problem is here that these solutions are not part of standard training nor shared by the other crew members. They result a higher risk of mutual misunderstanding. Last, but not least, it is easy to understand that a little practice in manual procedures does not contribute to confidence, even when these procedures are formally known. The less the practice, the greater the retraction phase. Pilots become increasingly hesitant to switch to a manual procedure, and tend to develop active avoidance of these situations whenever they feel uneasy.

These effects are increased by the masking effect of both the training philosophy and the electronic protections. Because of economical pressure and because of operator and manufacturer competition, training tends to be limited just to the useful and to underconsider the complexity of systems. It is not uncommon that type rating amplifies the value of the electronic protections to magnify the aircraft, and excludes the learning of areas of techniques, because these areas are not considered as useful or are not used by the company, that is the vertical profile, or some other FMS functions. This approach also favors overconfidence and the heterogeneous structure of expertise and the personal unshared discovery of systems. The experience of cognitive approaches to boundaries increases the efficiency of signals. But in most flying conditions with the glass cockpit, workload is reduced, complexity is hidden by systems, human errors are much more complex and difficult to detect (feedback postponed, error at strategic level rather than execution level), and the result is that operators continue too long to feel at ease. The cognitive signals when approaching to boundaries are poorly activated until the sudden situation where all signals are coming in brutally and overwhelming cognition (explosion of workload, misunderstanding, and errors).

Some deciders consider that many accidents and incidents are due to a unsufficient expertise of crews. For example, many engineers would find it surprising that a crew would disregard very low air speed and low energy on an aircraft (Bangalore A320 accident) or that a crew would not be able to counterbalance a standard bank (Tarom A310 accident).

Also, there is a general consensus in the aviation community that the majority of problems arise because of crews or mechanics deviating from procedures. This picture is reinforced by several recent accident/incident analyses and by the increasing number of incident reporting files showing crew nonadherence to procedures.

Logically, authorities and industry have asked for a more procedure-driven approach and better training to reduce these kinds of crew nonadherence to procedure. However, the industry quickly realized that simplistic solutions had also limits. On the one hand, the number of regulations, procedures, and checklists has grown considerably in the past 10 years, encapsuling the aviation system into a very normative atmosphere with associated drawbacks of slow innovation and uncontrolled escapes. On the other hand, training issues have also been debated. There is a general agreement that cockpit resources management (CRM) concepts are a plus for training crews on automated aircrafts. The debate is much more open about training duration because it is not clear what part of training should be reinforced. Most of the industry plead for a better abinitio basic flight training, and then for short type-rating courses focusing on the aircraft type specificities and standard operating procedures (SOPs). Others, namely human factors people, plead for addition of a continuous reinforcement of basic manual skills all along with the carrer and type ratings, because these skills are poorly solicited with modern aircraft and tend to be lost. But economic pressure does not favor such a solution. Another training issue concerns the level of deep knowledge to be taught on system architecture and logic in order to guarantee an efficient crew practice and understanding.

The limited impact of all these efforts on the current (already excellent) level of safety leads industry to more and more consideration of alternative solutions, including more human factors-oriented solutions in design and certification, provided that fact human factors proposes viable and non naive solutions. This is the chance for human factors. But are the knowledge and the solutions available?
Human Factors Suggestions
Human factors suggestions for improving the design and operations of automated aircraft are gathered under the banner of human-centered design (Billings, 1997 for a revised version). The current litterature related to human-centered design emphasizes five different aspects that should be included in an efficient human factors methodology: (a) respect for human authority, (b) respect for human ecology, (c) the need for a better traceability of choices (d) the need for an early and global systemic approach during design, and (e) the need for a different perpective in interpreting and using flight experience data through aviation-reporting systems
Respect for Human Authority. Human factors are first interested in the role and position given to the end user in the system. Human factors cannot be restricted to a list of local ergonomics principles, such as shapes, colors or information flow, it first refers to a philosophy of human-machine coupling, giving the central role to Human. For example, suppose a system in which crew should be a simple executor, with a perfect instrument panel allowing a total comprehension, but without any possibility to deviate from orders, and with a permanent and close electronic cocoon overriding crew decisions. Such a system should no longer be considered as corresponding to a satisfactory human factors design. The crew cannot have a second role because the members continue to be legally and psychologically responsible for the flight. They must keep the final authority for the system.

Fortunately, crews still have the authority with glass cockpits. But the tendency of technique is clearly to cut down this privilege. Today, some limited systems already override the crew decision in certain circumstances (flight or engine protections). Tomorrow, datalink could override crews in a more effective and frequent manner. After tomorrow, what will come? The goal of the human factors community is to improve the value associated with these systems, not to enter into a debate on the safety balance resulting of these solutions (as usual, we know how many accidents/incidents these systems have caused, but we ignore how many incidents/accidents they have contributed to avoiding). But how far can we go in this direction with crews remaining efficient and responsible in the flight loop and with a satisfactory ethics of human factors? We must acknowledge that human factors has no solutions for an infinite growth of system complexity. We must also aknowledge that the current solutions are not applicable to future complexity. Therefore, if we want the crew to remain in command, either we limit the increasing human-machine performance until the research comes up with efficient results preserving the authority of humans, or we accept designing systems, for example, made with two envelopes. The first envelope is controlled by crews. Within this envelope, crews are fully trained to comprehend and operate the system. They share full responsibility, have full authority and can be blamed for unacceptable consequence of their errors. Outside this first envelope, the system enters into full automatic management. Crews are passengers. Human factors are not concerned, except for the transition from one envelope to the other one. Last, of course, ergonomics and human factors only tailor the first envelope.

The next human factors efforts should focus on fitting not only the surface of displays and commands with the human ecological needs, but the inner logic of systems. The achievement of this phase asks for a much more educational effort by design engineers and human factors. How could a design fit the needs of a pilot’s cognitive model if there is not a shared and accepted cognitive model and a shared comprehension of technical difficulties betwen technical and life-science actors? This is the reason why reciprocal education (technical education for human factors actors, human factors education for technical actors) is the absolute first priority for the next 10 years.

Such a global approach has been underconsidered with the introduction of glass cockpits and has resulted, for example, in several misfits between traffic guidance strategies and the capabilities of these new aircraft (multiple radar vector guidance, late change of runway, etc.). The situation is now improving. However, some of the future changes are so important and so new, like the introduction of datalink or the emergence of airplane manufacturers in Asia, that adequate predictive models of how the aviation system will adapt are still challenging human factors and the entire aviation communauty.

However, for the moment, the general trend is to continue optimizing the same solutions : asking for more incident reports, detecting more errors, suppressing more errors. The aviation reporting systems are exploding under the amount of information to be stored and analysed (over 40 000 files per year in only the U.S. ASRS), and the suppression of errors often results in new errors occuring. There is an urgent need to reconsider the meaning of errors in a very safe environment and to reconsider the relationship between human error and accident. Such programs are in progress at Civil Aviation Authorities of the United Kindgom (CAA UK) and the French Direction Générale de l’Aviation Civile (DGAC) and could result in a different data exploiting and preventive actions.

An incredible window of opportunity is open. The duration of this window will depend on the capacity of human factors specialists to educate industry and propose viable and consistent solutions. To succeed, it is urgent to turn from a dominant critical attitude to a constructive attitude. It is also important to avoid focusing on the lessons from the last war and to anticipate future problems, such as the coming of datalink and the cultural outcomes.

In contrast, the instrument is so powerful that it needs some taming. This phase will only take place through experience, doubtless by changes in the entire aeronautic system, in jobs, and in roles.

Let us not forget, as a conclusion, that these changes are far from being the only ones likely to occur in the next twenty years. Another revolution, as important as that brought about by automation, may well take place when data-link systems supporting communications between onboard and ground computers control the aircraft's flight path automatically. But this is another story...in a few years from now, which will certainly require that a lot of studies be carried out in the field of human factors.

One could say also that the problems are largely exaggerated. It is simply true that performance has been improved with automation, and that safety is remarkable, even though better safety is always desirable.