Beyond Human Factors: The Role of Human Centered Design in Developing a Safety-Critical System

Human Centered Design (HCD) may be envisioned as a simple process to aid in design [1]. The literature is replete with characterizations of HCD as a synonym for User-Centered Design (UCD), making it difficult to determine whether these areas of focus are the same or simply overlapping. ISO 9241-210:2010 generally defines HCD as: “an approach to systems design and development that aims to make interactive systems more usable by focusing on the use of the system and applying human factors/ergonomics and usability knowledge and techniques.” While this definition highlights the utility of HCD as an extension of Human Factors, it also limits HCD to a focus on the user.

Even where some have implicitly acknowledged HCD as a discipline, explicit claims of it being simply a focus on the user remain [2]. Norman has suggested that HCD may actually be harmful due to what he believes is a focus upon user needs in a task to the exclusion of the larger activity [2]. He envisions that HCD is simply the process that includes a creation of personas, scenarios, and designs to make the intended system adapt to the human. Instead, he favors Activity Centered Design (ACT). In a clarification to his provocative statements, Norman went so far as to say that HCD requires a revision: to include an activity-centered approach. This is unfortunate, as Boy has long argued for a systemic view that transcends a focus on the user; he has articulated an activity centered view of task in context, being influenced by organizational, technological, and situational constraints [3]. The Cognitive Functional Analysis Method (CFA) stands as a foundational construct of what Boy envisions as good HCD [4, 5]. Aside from simply a focus on the activity to be done, CFA argues that the designer must understand the underlying mechanism present, which Boy calls cognitive functions (see Fig. 1).

Cognitive function transforms a task into an activity [3]

Full size image

This paper asserts that HCD is very much concerned with “activity.” In fact, safety-critical tools that are developed—in this case the Trajectory Recovery System (TRS)—are concerned more with the “activity” than with isolated discreet tasks. Furthermore, focus transcends the user and activities to include a broader context. Knowledge that is elicited from an examination of the activity, user input, human factors, and domain expertise will inform conceptual design, prototyping and evaluation.

The functional approach is especially useful in the engineering of complex systems. Early HCD discerned that a more holistic understanding of work was required in order to produce reliable work systems [3]. Characteristically complex systems are organized around multiple agents in dynamic contexts, utilizing various resources to produce reliable work. Engineers and traditional human factors practitioners have been slow to realize this. Those who conduct design are more often than not absolved from responsibility when a system fails. Instead, when a complex system fails, they might blame “human error” or – in the case of systemic issues – “automation surprises” [6]. While many solutions have been suggested to address these issues, none have considered the emergent properties of systems in the design process. Engineers, be it human or technological, had failed to understand what they had created was part of an emergent phenomenon. Designers, operators, and organizations utilized systems that they failed to fully understand the underlying principles and practice of its operation [7]. Thus Leveson could rightly state: “The problem is that we are attempting to build systems that are beyond our ability to intellectually manage… [8].

The result of this ignorance was building systems we could not control [7, 9]. The consequence was wide spread—accidents or failures of life critical systems could be described as “normal” [10]. This is the gap that HCD offered when it insisted on elicitation of system functions. For with this focus upon functions, task, tools, and agents could be understood in the context of operation.

The TRS is a safety-critical system that seeks to address the problem of in-flight loss of control (ILOC) due to a stall in commercial or general aviation aircraft. To find a solution to the problem of ILOC, which is the number one cause of fatalities in commercial aviation, we conducted an examination of how the ILOC recovery task is performed in varying contexts, human/machine roles, and resources [11]. HCD was utilized to understand the context of use, elicit user requirements, innovate, prototype, test empirically, and iterate for improvement [12].

The TRS research project proposed an innovative display that guides a pilot to avoid terrain. HCD methods were critical to its development, as TRS built upon interaction design research. Prior work suggests that environmental cues can be leveraged to offer affordances for action [13–15]. The TRS concept advanced prior investigation of ecological displays in aviation by reducing the distance between interpretation of aircraft angle of attack and the required angle of attack for recovery [16]. Additionally TRS addressed the danger of cognitive tunnelling through application of advanced interaction media principles, namely cognitive countermeasures [17, 18].

The TRS HCD research paradigm is composed of four nodes organized around “activity”: understanding; conceptual development; prototyping; evaluation and analysis. This organization bridges the gap between abstract and tangible concepts. Furthermore, the TRS project leveraged these four HCD-based nodes to make possible the synthesis of tangibility, creativity and context in order to produce a feasible, viable, and usable solution to the problem of ILOC.

3.1 Understanding

Understanding of principles that are gathered during literature review, user surveys of Human Factors or Cognitive Engineering principles, and ethnographic observations were synthesized and made tangible a priori. This progression of tangibility continued into the TRS conceptual design and prototyping. At the focal point of these design milestones was the activity of the user. For example, the understanding phase was made tangible through the semantic structures. Such structures required anchoring to the real world. Thus, the design process was an effort to anchor semantic structures to the tangible world for the purpose of pragmatic operations.

3.2 Conceptual Development

In the conceptual development phase, understanding continued to an “imagined” world of what is possible and nominal. This is the place that creativity was set free to explore within the real world for which the system must be constrained. The way that the TRS project envisioned this being accomplished was through the development of scenarios and storyboards. Scenarios provide a contextual environment for requisite imagination and creativity in the design process. Likewise, storyboards provide an anchor for planning how scenarios occur in the “real world.”

3.3 Prototyping

The junction between creativity, contextual design, and tangibility is prototyping. This is where the TRS project has continually validated what has been understood and conceptually developed with the real world. Yet the real world or the world of activity is a complex one with interactions between technology, organizations and people [3] (see Fig. 2). The goal of prototyping is to validate the design realized in conceptual development, and thus create a tangible, testable system.

Systems comprise interactions between technology, organizations, and people [3]

Full size image

3.4 Evaluation and Analysis

The evaluation and analysis phase is not a discreet event within the research paradigm but an ongoing activity that occurs in each of the prior milestones. In the development of the TRS, understanding was continually evaluated against new data acquired, the conceptual model was validated against learning that occurred in the understanding phase; and prototyping naturally led to validation studies with users in context. Thus the process of validation was updated until a desired outcome was reached.

The final question of course is: “when do we know we have arrived”? In the case of the TRS project, the goal was to demonstrate that the system proposed actually worked. Therefore, it is acknowledged that maturity in context is still an ongoing activity, which will continue beyond the boundaries of the TRS project.

To supplement and assist in the application of a synthesized HCD research paradigm, multiple human factors methods were applied to maximize the development and successful implementation of the TRS. After all, HCD has blossomed to address paradigms not found in the field of Human Factors itself. Likewise, Human Factors approaches involve paradigms not typically used in HCD. Throughout the stages of developing and testing the TRS, more traditional human factors methods were employed, such as performing interviews with expert pilots, and implementing a research study in a high fidelity flight simulator.

4.1 Interviews with Experts

Interviews with experts are important to the field of Human Factors in that they provide researchers with a complete picture of the end user population. Where HCD provides the backbone of the system being developed in a context, completing interviews based in traditional human factors methods allows researchers to delve deeper into specific paradigms relevant to humans involved. Interviews with pilots played an integral role in the development of the TRS.

4.2 Research Study

As the final stage of design and development, a human factors research study with pilots was implemented to examine more deeply the human reaction to the TRS system. Measures tracking human performance, including eye data, workload data [19], situation awareness [20], and successful scenario completions were collected to gain a complete picture of the human condition while using the TRS. This information not only validated the use of the TRS, but provided additional details to understand the utility of the TRS for pilots. Final results are currently being generated [21].

The development of the TRS was an effort to propose, design, create and test an innovative solution to ILOC. The chosen research method, while including many human factors methods, was ultimately a product of HCD. Several concepts were joined in a complete research paradigm that led to the successful HCD development and Human Factors testing of the TRS. In this way, it can be said that HCD and Human Factors were joined in a symbiotic relationship in accomplishing the joint goal of developing a truly usable and desirable system. Indeed, we argue that these two foci complement each other and should be used in tandem to create the most effective systems for human use in complex environments.

The use of TRS can be applied to many contexts, including operational recovery guidance and/or training prompts for use during simulated upset recovery events by providing scaffolded learning. Furthermore, because the development of the TRS took into account the end user, the technology itself, and the context in which it can be used, it may carry a degree of external validity that many systems don’t have. This can, once again, be attributed to the combined approach of HCD (for considering the larger realistic context that the system exists in) and Human Factors (for iterative assessment). In future work, we encourage others to take a similar approach to designing and testing systems that will ultimately be used in real-world, safety-critical systems.