User Centred Interfaces in Co-operative Distributed Systems Fulko van Westrenen Umantec
[email protected] www.umantec.nl ABSTRACT
This paper describes new developments in cooperative decision making in aviation and maritime navigation. Essential is the free exchange of state information between all participants, and the use of a common rule-set. Such a system lacks the need for central control. Keywords
Co-operative decision making, user-centred design, information distribution, maritime navigation, freeflight. INTRODUCTION
A human-machine interface for a system under control has several purposes. It presents the current situation, it can present the past, it presents the control opportunities or affordances, and sometimes it advises on control actions. In this paper will focus on one function in particular: the prediction of the future based on shared information. This enables all users to anticipate co-operative. The interface as a crystal ball. In order to control a system knowledge of that system is needed. This knowledge can have the form of a set of rules and procedures. Another form is a mental model, which helps us understand the situation and predict the outcome of actions. In more complex systems part of this knowledge will be embedded in the system to enable supervisory control (Sheridan, 2002). With simple system that include only one operator, the prediction of the outcome of an action is relatively simple. The system can be modelled mathematically, the control action is programmed, and the outcome can be calculated. In an environment with many operators or users, this is much more complicated. In order to predict the outcome, knowledge from the other actors is required. The operator can apply this knowledge to anticipate on the behaviour of the other users. A well-known example of such a situation is road-traffic. The traffic flow can only be smooth because of anticipation.
Anticipation on another user requires two elements. The first is element knowing the present state of the other: position, speed, etc. The second element is the intention of the other: what does he/she want. An example of this last one is the use of indicator lights in the car. In high-risk situation with many participants, central control is installed to ensure safety and productivity. New technology can make this central control unnecessary. This paper will present work in two areas: air-traffic management and maritime navigation. These systems are complex sociotechnical systems (Vicente, 1999). Aircraft and ships highly complex, physically distributed, very dynamic, potentially highly hazardous, containing many coupled subsystems, with a high degree of automation, with partly uncertain data. At present, the crew on board and central control may have conflicting objectives that are very difficult to resolve. By distributing the entire system, this problem can be resolved. AVIATION
At present aircraft cannot see each other. To maintain a safe separation, an aircraft crew fully depends on the air-traffic control (ATC) on the ground. The controller from ATC uses radar and has flight-plans of all aircraft under his control. The radar provides an image of the current situation. The flight-plans give information about the intention of each of the aircraft. The controller uses this information to adjust the flight-plans for each of the aircraft under his control and gives orders for heading and altitude to each aircraft. The controller is responsible for separation. The crew of the aircraft is responsible for a safe flight. New technology is about to change this way of operation completely. In the very near future all aircraft will be fitted with a transponder that transmits the aircraft’s state to all other aircraft in the vicinity. Each aircraft can receive this information and present this to the crew in the cockpit. The crew can then use this information to maintain separation independent of ATC. This approach has several advantages. The first one is that it is available everywhere in the world, such as above the oceans. It does not depend on radar or ATCcentres. The second one is that aircraft do no longer
have to follow the plan devised by ATC, but can follow a path optimal for the aircraft, straight from origin to destination. This results in a better use of airspace, making higher traffic densities possible, and shorter flight times, reducing operating costs. A last one is that there is no simple point of failure. All aircraft are part of the system, and if one aircraft fails, all other aircraft can compensate for that. This concept of making the cockpit crew responsible for its own separation is known as fleeflight (NLR, 2004). It has been tested in full simulation, using cockpit simulators, and in a classroom environment with 24 pilots together (Van Westrenen & Groeneweg, 2003). The experiments show that the system satisfies the expectations. All aircraft can fly safely without ATC, traffic densities three times the present maximum were possible, the reduction in operating cast can be significant, and even in extreme traffic situations all aircraft remained safely separated. To make this possible the cabin crew depends on a display that presents all traffic information, detects possible conflicts, and advises on resolutions. Figure 1 shows the display designed by the NLR. It shows the own aircraft in middle at the bottom. All aircraft in the vicinity are depicted, together with altitude, speed, and callsign. The display also shows a conflict, which means that in the near future the own aircraft will come to close to another aircraft. A simple set of rules is used to detect a conflict and decide on a resolution. Safety is the primary objective of the rules. In order to make it work, all necessary information must be shared between the aircraft. It is vitally important that all aircraft use the same rules and share the same information. (Hoekstra, 2001) The conflict detection and resolution is presented on the navigation display. This display is truly usercentred: all information is presented relative to the own aircraft. The computer calculates if two aircraft come too close in the near future (5-10 minutes). If such an event is detected it is called a conflict, and this conflict and all solutions are shown on the display. The solution can be a change in heading, speed, altitude, or a combination of these. The choice depends on the actual situation and the aircraft's performance characteristics. The continuous update of all information makes instant reactions to unexpected changes possible. The experiments also showed that, in addition to the present state, the intention of the other aircraft is also needed to maintain safe separation in all situations. For this changes in heading and altitude within the next 10-20 minutes need to be added to the actual state of the aircraft. This makes it possible for other aircraft to anticipate on these intended changes (Van Westrenen & Groeneweg, 2003).
Figure 1: NLR freeflight display with traffic. The circle depicts a conflict and the dotted line leaning to the right a possible resolution. (original in colour) MARITIME NAVIGATION
In maritime navigation a similar development has started. Ships use radar to detect other ships and decide on possible conflicts. This has proven to be very effective, but radar is limited. At open sea the waves will clutter the image, and in estuaries, on rivers, and in ports many ships and obstacles will not be detected. In addition, a radar reflection does not contain information about the speed, heading, size, name, and intention of the other ships. For this, a maritime transponder is developed, similar to the aviation transponder, which will be introduced soon. It seems logical to use the same approach as in aviation. However, maritime navigation is different from aviation because in shallow waters, knowledge of the seabed is essential for safe navigation. To improve safety, there is a need to integrate information about other ships, the seabed, currents, waves, etc. The harbour pilots initiated a project to develop a portable pilot-unit (PPU) to do just this: integration of information. The PPU will contain all information needed for safe navigation. This includes a map, up-to-date seabed information, actual tide and currents, accurate position, heading and speed, and information about other ships in the area. It will have path prediction, conflict detection, grounding warning, and resolution advisories. Such a system would allow safe navigation with smaller margins, making the port better available under adverse weather and tidal condition, increase traffic densities, and increase safety. Where the navigation display of an aircraft focuses on the flight-plan and the other aircraft, the maritime display will focus on position and speed relative to the seabed and other ships. One such system was developed by QPS (QPS, 2004). An alternative is
presented in figure 2, based on an extensive task analysis (Van Westrenen, 1999). This display is again user-centred. All elements, positions, and speeds are relative the user's situation. User trials are planned for the near future.
Figure 2: Central part of a navigation display for the PPU. The map depicts the port of Rotterdam. In the map three other ships are depicted, with their names. (original in colour)
participants use the same information. This makes all users equally knowledgeable and responsible. The navigation display with conflict detection and resolution and the PPU collect large amounts of data and present this in such a way that the navigator/pilot can use this information directly to make his manoeuvring decisions. In order to do this the computer systems contain knowledge about the own state, the environment, and the rules on safe navigation. The system does not decide what manoeuvre must be made when a conflict is detected, it only presents all possible resolutions. The freeflight experiments have shown that this is a safe and effective way of operating. In maritime navigation these studies still have to start. Some will oppose to such a fully decentralised system, claiming that it may work fine in relatively simple situations, but will fail in complex, high traffic density situations. The results with freeflight have shown that local optimisation can cope with situation far beyond those that can be resolved centrally. In addition, when the system degrades, it does so very gracefully. Each participants tries to maintain a situation as safe as the situation allows for, using all available space. It is expected that the maritime situation will show results comparable to the freeflight results. REFERENCES
1.
DISCUSSION
New technologies enable new ways of operation and new strategies. In the present situation, central control is vital for safe operation. Both systems presented here lack a single control centre. Each user, or participant, is it's own centre. All information is relative to this specific user. Each user tries to optimise his/her situation. As a result, there is no central control. Conflicts are resolved locally and co-operative. This is made possible by providing all users identical and presenting the common information symmetrical. All users are fully known: type of ship or aircraft, position, heading, speed, name. There is no anonymity and no possibility to cheat, provided that some data verification measures are taken. By providing accurate and instant information, all users can react to changes immediately. A second similarity is that in both systems all data is exchanged freely, and all
2. 3. 4. 5. 6.
7.
Hoeksta, Jacco (2001) Designing for safety: the free flight air traffic management concept. PhD. Thesis TU-Delft, Netherlands. NLR (2004) Freeflight website: http://www.nlr.nl/public/hosted-sites/freeflight/ QPS (2004) Qastor website: http://www.qps.nl/Eng/Pages/QASTOR.asp Sheridan, Thomas B. (2002) Humans and Automation: System Design and Research Issues. John Wiley & Sons. Van Westrenen, Fulko (1999) The maritime pilot at work, PhD Thesis TU-Delft, Netherlands. Van Westrenen, Fulko & Jaap Groeneweg (2003) Co-operative conflict resolution: an experimental validation of aircraft self-separation. The International Journal of Aviation Psychology, vol 13, no 3, pp233-248. Vicente, Kim J. (1999) Cognitive work analysis: towards safe, productive, and healthy computerbased work. Lawrence Erlbaum Associates, London
