Warning system design incivil aircraft

Order Description This is a three in one module coursework, had not so pleasant experience with one of the last writer and had to request of the coursework to be rewritten twice, but the other two writer did excellent job. will like to avoid that particular writer. appreciate if careful attention is given to the examiners requirements. A lot of documents will be attached to give a good insight and provide almost all required information but not all will be needed to complete the 3 questions. 141 6 Warning system design in civil aircraft Jan M. Noyes, Alison F. Starr and Mandana L.N. Kazem Defining warning systems Within our society warnings are commonplace, from the natural warning colours in nature, the implicit warning proffered by the jagged edge of a knife, to packaging labels and the more insistent auditory warnings (e.g. fire alarms) requiring our immediate attention. Primarily a means of attracting attention the warning often, and most beneficially, plays both an alerting and informational role, providing information about the nature and criticality of the hazard. In many safety critical applications hazards are dynamic and may present themselves only under certain circumstances. Warning systems found in such applications are, therefore, driven by a ‘monitoring function’ which triggers when situations become critical, even life-threatening, and attention to the situation (and possibly remedial actions) are required. In summary, current operational warning systems have the following functions: 1. Monitoring: Assessing the situation with regard to deviations from predetermined fixed limits or a threshold. 2. Alerting: Drawing the human operators’ attention to the hazardous or potentially hazardous situation. 3. Informing: Providing information about the nature and criticality of the problem in order to facilitate a reaction in the appropriate individual(s) who is (are) assessing the situation. 4. Advising: Aiming to support human decision-making activities in addressing the abnormal situation through the provision of electronic and/or hardcopy documentation. Safety-critical industries continually strive to attain operational efficiency and maximum safety, and warning systems play an important role in contributing to these goals. The design of warning systems in the civil flight deck application will be considered here from the perspective of the user, i.e. as reported by the crew. This emanates from a research programme concerned with the development Jan M. Noyes, Alison F. Starr and Mandana L.N. Kazem 142 of an advanced warning system in this application area. One aspect of this programme included a questionnaire survey of civil flight deck crew from an international commercial airline; the aim being to highlight the user requirements of future warning systems. Some of the findings from this work are discussed towards the end of the three sections on alerting, informing and advising in order to bring the pilots’ perspective to the design of future warning systems. This is done within the context of the functions of the warning system highlighted in the definition given at the start of this chapter. Monitoring The monitoring function is primarily a technology-based activity as opposed to a human one. The role of the monitoring function is to ‘spot’ the deviation of parameters from normal operating thresholds. When these threshold conditions are crossed, a response from the warning system is triggered. The crossing of that threshold has then to be brought to the attention of the operator. On the flight deck, this is usually achieved through auditory and/or visual alerts. The earliest monitoring functions were carried out by operators watching displays of values waiting for this information to move outside of a limit. The simplest mechanical sensor is activated when a set threshold condition is met. The mechanisms by which the monitoring is now undertaken will vary from application to application, depending on aspects relating to the safety critical nature of the system, the functions being monitored, complexity of the system, and level of technology involved. However, as the focus of this chapter is on the human activities these mechanisms will not be discussed further and the three functions ‘alerting’, ‘informing’, ‘advising’ will provide the framework for consideration in the rest of this chapter. Alerting In a complex system and when the situation is particularly critical a large number of auditory and visual alerts can be activated, as in the Three Mile Island incident (Kemeny, 1979). In this particular case, over 40 auditory alarms were triggered and around 200 windows and gauges began to flash in order to draw the operators’ attention to the impending problem (Smither, 1994). A number of difficulties can occur at this stage. For example: a. The human operator(s) may fail to be alerted to the particular problem due to overload or distraction. This can sometimes occur even with the existence of the ‘attention-grabbing properties’ of the alerting system. An example of this occurred on the Eastern Airlines L-1011 flight in 1972. All of the flight deck crew became fixated with a minor malfunction on the flight deck, leaving no operator flying or monitoring the rest of the aircraft. Alerts indicating the unintended descent of the aircraft and thus significant Warning system design in civil aircraft 143 fall in altitude were unsuccessful in regaining the attention of the crew and alerting them to the hazardous situation developing. The result was that the aircraft crashed into the Everglades swamps with disastrous results (Wiener, 1977). b. The alerting signal may also be inaccessible to the operator if sensory overload occurs. Sensory overload at this early stage is a growing problem as the number of auditory and visual alerts on the flight deck continues to increase. In their survey of alarm management in chemical and power industries, Bransby and Jenkinson (1997) found that the total number of alarms on older plants was generally less than the total number found on the modern computer-based distributed control systems. Likewise on the civil flight deck, the number of auditory and visual alerts has increased over the decades. For example, during the jet era the number of alerts rose from 172 on the DC8 to 418 on the DC10, and from 188 on the Boeing 707 to 455 on the Boeing 747 (Hawkins, 1987), and to 757 on the newer Boeing 747-400. This increase has largely been seen as a result of enhanced aircraft system functionality and therefore a more general increase in system complexity. Paradoxically, this increase in the number of alerts intended to help crew comprehend the ‘dangerous’ situation can lead to the reverse effect, especially in situations where several alerts appear simultaneously and are abstract, therefore requiring association with a meaning. A recent Federal Aviation Authority (FAA) report highlighted this by stating ‘the more unique warnings there are, the more difficult it is for the flight crew to remember what each one signifies’ (Abbott, Slotte and Stimson, 1996, p. 56). When crew are overloaded with auditory alerts and flashing visual messages, it may actually hinder appropriate response and management of the situation. It is important in the design of alerting systems to ensure that the flight crews’ attention will be drawn to a problem situation at an early stage in its development. Flight deck alerting systems all have at least two levels of alert. The caution, indicating that awareness of a problem and possible reaction is required, and the warning, indicating a more urgent need for possible action. Ideally the alerting system should enable the pilot to follow transitions between new ‘critical’ developments, and in conjunction with the flight deck information, as well as maintaining awareness at all times of the current state of play. Having a system that facilitates the anticipation of problems would provide the crew with more time to consider the outcome of making various decisions. An example of this can be seen in the EGPWS (Enhanced Ground Proximity Warning System) found on some civil flight decks. In this system, dangerous areas of terrain, as relating to aircraft position, are depicted on a display. Increasing risk is depicted by a change in colour or colour saturation. Effectively this is an alert of changing urgency, which should direct crew attention to problems at an early stage (Wainwright, 2000). Jan M. Noyes, Alison F. Starr and Mandana L.N. Kazem 144 Individuals amongst the flight crew surveyed, who flew aircraft with one of the types of CRT-based warning systems, tended to agree that their aircraft’s alerting system was effective in allowing them to anticipate a problem (Noyes and Starr, 2000). This is not surprising since their alerting system was designed with a low level alert that triggered before the main caution or warning alert, thus allowing problems to be anticipated. On this aircraft, the low level alerting element of the system automatically displays the relevant system synoptics when parameters drift out of tolerance, but before they have changed sufficiently to warrant a full caution or warning level alert. The other salient feature evident from the survey was that fleets with a third crewmember were also found to be in agreement with the fact that current systems allow anticipation. These systems facilitate anticipation, but do not ‘anticipate’ themselves. In a three-person flight crew, part of the Flight Engineer’s role is to monitor system activity and anticipate failures. In a two-person crew however, this aspect of systems’ management has been replaced by increased numbers of cautions and warnings. Once these are triggered, operators must undertake prescribed set actions. A possible solution exists in developing systems, which can absorb this anticipatory role. A truly anticipatory system has yet to be introduced to the flight deck. However, there are many design difficulties in producing an anticipatory system to be implemented in such a complex and dynamic environment. Given this fact it is prudent to remember that design should not seek to replace the decision-maker, it must support the decision-maker (Cohen, 1993); indeed, in some instances the system design may not be capable of effectively replacing the decision-maker. Results from our survey work highlighted some of the difficulties associated with the development of anticipatory facilities. For example, the following comments were made by flight deck crew in response to a question about having a warning system with an anticipatory facility: ‘Most serious problems on the aircraft are virtually instantaneous – instrumentation giving anticipation would be virtually useless except on noncritical systems.’ ‘Workload could be increased to the detriment of flight safety.’ ‘Much aircraft equipment is either functioning or malfunctioning and I think it lowers workload considerably to avoid unnecessary instrumentation and advise pilots only of malfunctions.’ It could therefore be argued that perhaps it is best to leave the crew to fulfil all but the simplest anticipatory tasks. The crews are after all the only individuals with the benefit of experiencing the situation in hand; they may have information not available to the system and therefore arguably are the only decision-makers in a position to make appropriate predictions. Our survey work also indicated that flight deck crew with experience of having a flight engineer bemoaned the fact that the role of this person was gradually being phased out. This is particularly pertinent given the anticipatory function of the flight engineer. However, systems are becoming increasing complex. Interrelationships between aspects of different Warning system design in civil aircraft 145 systems and the context in which a problem occurs are important factors in what is significant for operator attention and what is not. Thus, returning to Cohen’s idea of required operator support, some assistance with the anticipatory task could, if correctly implemented, result in the better handling of problem situations. A further consideration relating to alerting is that not all warnings may be ‘true’ warnings, as all warning systems can give false and nuisance warnings. False warnings might occur, for example, when a sensor fails and a warning is ‘incorrectly’ triggered. In contrast, nuisance warnings are by definition accurate, but unnecessary at the time they occur, e.g. warnings about open doors when the aircraft is on the ground with passengers boarding, or a GPWS (Ground Proximity Warning System) warning that occurs at 35,000 feet activated by an aircraft passing below. Nuisance warnings tend to take place because the system does not understand the context. The category of nuisance warnings may also be extended to include warnings that are correct and relevant in the current situation, but have a low level of significance under certain circumstances. For example, in some aircraft, the majority of warnings will be inhibited during take-off as the consequences of the fault(s) they report are considered to be low in contrast to their potential to interrupt the crew during what can be a difficult phase of flight. It could be concluded from our survey work that false warnings on modern flight decks do not present a major problem, although in the words of one respondent ‘One false warning is “too often”.’ If false or nuisance warnings occur too frequently, they can encourage crews to become complacent about warning information to the extent that they might ignore real warnings. This was summed up by two respondents as follows: ‘... nuisance warnings have the effect of degrading the effectiveness of genuine warnings.’ and ‘a small number of ‘nuisance’ warnings can quickly undermine the value of warnings’. Hence, there is a need to minimise false and nuisance warnings at all times. This may not be possible with existing systems, but their reduction needs to be a consideration in the design of new systems. Another related problem of increasing concern involves the sensors on the aircraft that fail more often than the systems themselves. As already discussed, sensors failing may trigger a false warning condition, and a warning system that could differentiate and locate possible sensor failures would have operational benefits. Systems with such capability would better inform the crew and thus help prevent them from taking unnecessary remedial actions and ensure the maintenance of the full operating capability of the aircraft. There are a number of different system solutions that could be implemented and developed to overcome these problems. More reliable sensors that fail less often comprise one mechanism for reducing false and nuisance warnings. The use of context such as phase of flight to suppress warnings in order not to interrupt a critical phase of flight with information is a feature on the new ‘glass’ warning systems. These aircraft suppress all but the most critical warnings from 80 knots to rotation, since at this point of the flight it will almost always be safer to leave Jan M. Noyes, Alison F. Starr and Mandana L.N. Kazem 146 the ground than attempt to stop since there may not be enough runway left to do this. This type of contextual support could be used to provide better information in the future. For example, sensor or warning logic that considers context such as simple logic relating to weight on wheels and no engines running in order to restrict an alert relating to a warning about the aircraft doors being open. However, for other conditions, several more complex pieces of data may be required and an ‘understanding of the goal’ of the warning. Informing Once the alert has been given, the operator(s) must use the information provided by the alerting system, their knowledge, experience, and training as well as other information displayed to them to be able to understand the nature and seriousness of the problem. However, a number of human operator failures may affect this process. Having been successfully alerted to a problem, the operator(s) may respond by acknowledging the visual and auditory alerts, but fail to take any further action, i.e. the operator(s) demonstrate a lack of compliance. On the civil flight deck, crew bombarded by several loud auditory warnings (bells, buzzers and other alarms) often initially cancel the alarms before attending to the problem. However, this action of cancellation is no guarantee that they will do anything further in terms of remedial action. This problem of initial response followed by no further action has been well documented in aviation and medical environments (see, Campbell Brown and O’Donnell, 1997; Edworthy, 1994). There are many reasons for this. The crew may be distracted by the need to complete other activities, and once having switched off the alerts may fail to turn their attention to the reasons why the alerts occurred in the first place. Edworthy and Adams (1996) studied the topic of non-compliance to alarms and suggested that operators carry out a cost-benefit analysis in order to evaluate the perceived costs and benefits of compliance and non-compliance to alarm handling. Information from the warning system (including urgency information) will be considered in this evaluation. Therefore, there is a need for the warning system to depict accurately the nature and criticality of the problem in order to provide accurate information for the pilot to aid their decision-making. At present there is much room for improvement in this respect, especially with regard to auditory warnings (Edworthy and Adams, 1996). For example, auditory alarms often activate too frequently and are disruptively and inappropriately loud (Stanton and Edworthy, 1999). They also can be relatively uninformative. To quote a respondent from our survey of civil flight deck crew ‘a lot of our audio systems are so powerful they scare you half out of your skin without immediately drawing you directly to the reason for the warning’ (Eyre, Noyes, Starr and Frankish, 1993). Individuals need to assess the nature and extent of the difficulty, and to locate the primary cause in order to initiate remedial actions. They have to evaluate and consider the short-term implications of the difficulty, its criticality/urgency, any Warning system design in civil aircraft 147 compromise to safety and immediate actions required, as well as the longer-term consequences for the aircraft, its systems and the operation/flight being undertaken. The consequences of any action taken, whether immediate or planned, must also be included in the assessment. In the development of new alerting ‘supportive’ systems, this is the type of information that could be of significant use to the operator. The underlying system would need to facilitate the provision of this type of information, which then has to be presented to the operator. The situation being monitored is often complex with many components, influences and interactions, and there is a need to take into account a large number of parameters in order to assess the situation. Optimally the alerting system should assimilate relevant information from a number of sources or facilitate this task. This is difficult to realise in design as it is not always possible to predict which elements of the potential information set will be relevant to each other and to the particular situation. However, approaches are available which enable the relationships between elements, systems and context to be represented as we indicated in our work on using a model-based reasoning approach to the design of flight deck warning systems. In the past, integration of context/situation information into the design of alerting systems has not been developed to any great extent. For example, in the avionics application, warnings have been known to be given relating to the failure of de-icing equipment when the aircraft was about to land in hot climes, where there would be no need to have de-icing facilities available. Multiple warning situations are known to be a problem for crew, since the primary failure may be masked by other less consequential cascade or concurrent failures that take the crew’s attention, and maybe hinder location of the primary cause. Cascade failures are failures that occur as a result of the primary failure e.g. failure of a generator (primary failure) causing the failure of those systems powered by the generator (secondary failures). However, secondary failures may be displayed before the primary as the display of a warning in most systems is related directly to the point at which the threshold associated with a warning is crossed. To quote one crewmember ‘I find it very difficult in multi-warning systems to analyse and prioritise actions’. A further problem relates to concurrent failures. The problem-solving characteristics of human operators are such that we tend to associate alerts occurring simultaneously (or within a short space of time) as having the same cause when this may not be the case (Tversky and Kahneman, 1974). Concurrent failures may also cause conflict in terms of remedial actions; i.e. one solution may resolve one problem but worsen the situation for another. It can therefore be quite difficult for crew to handle warning information in these types of situation. Many current alerting systems present warnings/cautions in the order in which the signal reaches the method of display, and this has implications for the handling of warning information. With classic central warning panels, large cascade type Jan M. Noyes, Alison F. Starr and Mandana L.N. Kazem 148 failures lead to distinctive patterns of lights; recognition of these patterns can enable the crew to identify the primary cause hidden amidst the mass. With glass multifunction alerting systems, alerts are listed by criticality, e.g. all red warnings first followed by all the amber caution alerts. In general, within each of these categories temporal ordering is still used; new alerts enter at the top of the appropriate list (warning or caution list). This creates effectively a dynamic list and can result in the primary causes of multiple alert situations becoming embedded within its associated category list and possibly ‘hidden’ from view. The crew in our survey noted this: ‘… it would be helpful if the most urgent was at the top of the list’. However, some of these systems do use a limited set of rules to analyse the incoming warning information and identify a set of key primary failures which can lead to cascade effects e.g. generator failure. These systems will pull out primary failures and present them first. The issue of handling secondary failures was addressed within the survey. Just under two-thirds of the flight deck crew (65%) surveyed felt that the alerting systems on their current aircraft were deficient in providing consequential secondary information. A closer analysis of this 65% indicated a clear disagreement between flight crew of glass flight deck aircraft and crew of other aircraft fleets. Less than 5% of the former group believed their alerting systems to be deficient in this respect, indicating that the vast majority was satisfied. Conversely between 45% and 70% of the respondents from each of the other aircraft fleet groups regarded the provision of such secondary information, on their aircraft, to be sub-optimum. Therefore, future alerting system designs should facilitate the provision of secondary information. Advising A further aspect of the alerting system involves the use of instructional information to support human decision-making activities, and ensure remedial actions are appropriate and successful. On current flight decks, supporting documentation can be both screen-based and in hard-copy format, whereas on classic aircraft, i.e. aircraft that have warnings based on fixed legends on lights, this information is provided in a paper Quick Reference Handbook (QRH). The way in which this information is handled will depend on the severity, complexity and frequency of the situation that activated the alert(s), as well as operator experience, skills and knowledge. However, it should be noted that designers do not always view advisory documentation as part of the alerting system. In our work with flight deck crew it was viewed as an integral part of the alerting systems, although, in certification terms, it may not be viewed as an essential component of the operating system. All of the aircraft within the questionnaire survey had a QRH or equivalent document, e.g. the Emergency Checklist on the DC-10. For each aircraft, this document serves as the primary source of reference for the necessary remedial Warning system design in civil aircraft 149 actions to be taken in abnormal flying situations. The documentation is originally designed by the airframe manufacturer and modified by the management of the operating company to meet their operating procedures. It would seem that there might be a trade-off between the level of completeness of the QRH information (e.g. its quantity and detail) and the ease with which the document can be used, i.e. the more information provided, the more difficult the document is to use in practise. Paper presentation of such information will inevitably lead to this problem as the information provided must be complete and therefore by nature will be difficult to present in a format that can be used quickly and effectively. Glass display presentation, on the other hand, could potentially help the pilot to locate the appropriate material quickly by tailoring the information presented to the situation. Evolution of flight deck warning systems This lack of assimilation is apparent throughout the evolution of flight deck alerting systems (see, Starr, Noyes, Ovenden and Rankin, 1997, for a full review). Briefly, the early warning systems were a series of lights positioned on the appropriate systems’ panels, and so were located across the flight deck (GordenJohnson, 1991). At this stage of evolution, warning indications were predominately visual, and crew had to scan the panels continually to check for the appearance of a warning. This discrete set of annunciators was gradually replaced by the ‘master/ central warning and caution’ concept, which involved the addition of a master light that indicated to crew that a warning had been activated. This was further developed into a centralisation of warning lights on a single panel within the crew’s forward visual field (Alder, 1991). The next development beyond physically locating the alerts together would be to ‘integrate’ the alerting information for presentation to the crew, as mentioned earlier. Although modern flight deck displays are referred to as integrated, they are not truly integrated since they consist of single elements of information displayed together according to circumstances and the current phase of flight (Pischkle, 1990). A fully integrated alerting system would be capable of monitoring and interpreting data from aircraft systems and flight operational conditions in order to provide crew with a high-level interpretation of the malfunction in the event of failures and abnormal conditions. A fully integrated warning system has yet to be realised to any great extent even in the latest civil aircraft, traditional alerting systems are generally used which conform to a ‘stimulus’ (e.g. valve out limits) followed by ‘response’ (e.g. warning light) concept. Also, monitoring to an identified risk point is traditional, and in the past there has been a lack of sophisticated display and control technology to achieve integration. This may be due to the inherent design difficulties in predicting information requirements, briefly noted earlier, and Jan M. Noyes, Alison F. Starr and Mandana L.N. Kazem 150 previous lack of technical ability to realise such a systems solution. However, the advent and implementation of more sophisticated software and programming techniques means that alerting systems with a greater capability to integrate information from a variety of sources can be developed, and such solutions are gradually becoming a more realistic proposition (Rouse, Geddes and Hammer, 1990). Care must be taken not to allow such systems to exceed their inherent limitations (due in part to our limited ability to predict the information requirements of unpredictable situations) or reduce data visibility. O’Leary (2000) indicates that the very task of converting data to knowledge is vital to the pilot in facilitating good pilot decision-making and therefore we must think carefully before removing this role from the crew. A further point of contention relates to the certification requirements of alerting systems. Given the criticality of alerting information it may be that the certification requirements prevent such systems becoming feasible or economically viable. However, by functionally separating the primarily alerting processes from the more informational and supportive processes of future alerting systems it may be possible to incorporate data integration into a ‘support system’ whilst leaving the more critical ‘alert’ to follow the more easily certifiable ‘stimulus-response’ concept. General discussion During each of the alerting, informing and advising functions, operator-involved failures can occur: human operators may fail to be alerted to the warning, may fail to assess it adequately, may neglect to respond to the warning situation and/or may not make sufficient use of information available. As already stated, they may take immediate action, but fail to make follow-up actions that will lead to the restoration of normal operations, a point well documented by Campbell-Brown and O’Donnell (1997) in their work on alarms in distributed control systems. In the process control industry, as well as aviation, there are many reasons for this, from the design of the warning system per se to task considerations and the overall design philosophies of the organisation, operating policies and procedures, extending to (user) practices (Degani and Wiener, 1994; Edworthy and Adams, 1996). Analyses of specific human responses to warnings and explanations of their failures are complex and multi-faceted, and outside the remit of the current chapter. Perhaps the very idea of having humans interact with warning systems is a problematic one. In many situations, the main part of the operator’s job may be uneventful to the point of boredom with long periods of monitoring required. This state can change very quickly when an event triggers an alarm or number of alarms. Hence, the monitoring phase is interrupted by rapid activity, the occurrence of which cannot be easily predicted, and may result in information overload as the monitoring role assumed by the human operator changes to diagnostician. This latter role requires the user to comprehend and remedy what Warning system design in civil aircraft 151 may be a complicated, multi-causal, often stress-inducing situation. Further, there may be little time available to support decision-making activities. This was described by Wickens (1992, p. 508) as ‘hours of intolerable boredom punctuated by a few minutes of pure hell’. Jenkinson (1997) stated that further work is clearly needed on this transition between boredom and panic. Humans tend not to be good at either of the aforementioned task extremes – monitoring tasks or working under high stress levels. Activities under both conditions are error-prone. Evidence for this can be seen from the number of aircraft accidents (and incidents) that implicate human error as a primary cause. Figures differ according to definitions of error and methods of calculating accident and incident data, but human error has been given as a causal factor in 80% of fatal aircraft accidents in general aviation and 70% in airline operations (Jensen, 1995). Recent statistics indicate there were 1063 accidents worldwide involving commercial jet aircraft between 1959 and 1995 of which 64.4% cited flight crew error as a primary cause (Boeing, 1996). The incidence of decision-making errors in these events is estimated to be as high as 70% (Helmreich and Foushee, 1993). However, there is a need to recognise that placing the ‘blame’ on human error does not provide the full explanation of how and why an accident or incident occurred, neither does it take into account the multi-causal chain of events and circumstances leading up the error (Noyes and Stanton, 1997; Reason, 1990). Consequently, the concept of the ‘system-induced human error’ has become widely recognised (Wiener, 1987) and as a result the onus has been placed on cockpit design as a whole to alleviate this problem. The detection and notification of problems (generally via cautions) can sometimes lead to increased workload. Information overload is certainly thought to be an issue in multiple alert situations. Although over the years, developments in alerting systems have aimed to provide the flight deck crew with the information they need, in a form they can readily understand and at an appropriate time, there are still occasions when information overload occurs (see, Starr et al., 1997). For example, multiple failure situations will trigger large numbers of lower level alerts, and can generate copious warnings. Despite this, crew agreed that additional information about the consequences of planned actions and secondary consequences of malfunctions would be an improvement on current systems, even in view of the inevitable increase in information presented. The prospect of this further increase in information is balanced by the difficulties faced currently in managing this type of failure situation. Finally, when considering supporting documentation, the balance between the amount and level of detail given, and the ease of access to relevant information must be considered. A fundamental problem with existing checklists (as combined within the QRH), both paper and multi-function displays, is that they are designed so that each checklist is associated with one failure/abnormality. In the event of multiple failure situations, priorities are generally not adequately handled. This is a problem and it has already been highlighted that pilots would Jan M. Noyes, Alison F. Starr and Mandana L.N. Kazem 152 like to see more support in this area. However, any further development of the QRH concept (paper or screen) must keep in mind that pilots literally require a Quick Reference Handbook. Looking to the future, continuing technological developments mean that future alerting systems will have the capability for handling increasingly large amounts of data/information. Unless this is carefully managed, the human operator will inevitably suffer from information overload. This has already been experienced in the nuclear power industry with operators being presented with large amounts of raw data that previously would have been filtered by experienced watch keepers (Maskell, 1997). It may be that progress will depend not only on technological advances, but on making greater use of the data already available (Frankish, Ovenden, Noyes and Starr, 1991); perhaps finding new ways to display information. Furthermore, the development of ‘soft displays‘ supported by powerful computational resources has important implications for the design of future flight deck warning systems. By providing information tailored directly to the current requirements of the users, this type of interface could not only aid the human operator, but also provide a solution in terms of enabling further information to be provided on an already crowded flight deck. The limitations of such displays however must be understood and duly considered. The alerting system is an essential component of any safety-critical system, since it is instrumental in drawing the attention of the operator to a problem situation at a point when safety can still be maintained. To be successful in this role the system must effectively monitor, alert, inform and support the operator in order that the problem can be efficiently diagnosed and rectified/ contained. Continuing developments in advanced technologies and the use of more ‘intelligent processing’ in systems have increased the number of design possibilities for warning systems and may provide solutions in terms of managing information overload. However the solution to information overload may lie in information efficiency – it may be possible to combine alerting, informing and supporting functions by providing information that performs all three roles simultaneously. For example, by aiming to develop the alerting aspects of the alerting system to be more informative and striving for new ways to maintain aircraft, system and environment visibility to make the problem itself more visible and therefore naturally alerting. Indeed it has been suggested that the situation itself may provide the most important warning cues (Edworthy and Adams, 1996). Perhaps this aspect will be addressed in future work on warning systems. References Abbott, K., Slotte, S. and Stimson, D. (1996). The interfaces between flightcrews and modern flight deck systems Report of the FAA Human Factors Team. Washington DC: Department of Transportation. Warning system design in civil aircraft 153 Alder, M.G. (1991). Warning systems for aircraft: A pilot’s view. In, Proceedings of IMechE ‘Philosophy of Warning Systems’ Seminar S969. London: Institution of Mechanical Engineers. Billings, C.E. (1997). Aviation automation: The search for a human-centred approach. New Jersey: LEA. Boeing Airplane Company (1996). Table of all accidents – World-wide commercial jet fleet. Flight Deck, 21, 57. Bransby, M.L. and Jenkinson, J. (1997). Alarm management in the chemical and power industries: A survey for the HSE. In, Proceedings of IEE Digest 97/136 ‘Stemming the Alarm Flood’. London: Institution of Electrical Engineers. Campbell Brown, D. and O’Donnell, M. (1997). Too much of a good thing? – Alarm management experience in BP Oil. In, Proceedings of IEE Digest 97/136 ‘Stemming the Alarm Flood’. London: Institution of Electrical Engineers. Cohen M. (1993). The bottom line: Naturalistic decision aiding. In, G. Klein, J. Orasanu, R. Calderwood, and C. Zsambok, (Eds.), Decision making in action: models and methods. New Jersey: Ablex. Degani, A. and Wiener, E.L. (1994). On the design of flight-deck procedures. NASA Contractor Report 177642. NASA-Ames Research Center, CA: NASA. Edworthy, J. (1994). The design and implementation of non-verbal auditory warnings. Applied Ergonomics, 25, 202-210. Edworthy, J., and Adams, A. (1996). Warnings design: A research prospective. London: Taylor and Francis. Eyre, D.A., Noyes, J.M., Starr, A.F. and Frankish, C.R. (1993). The Aircraft Warning System Questionnaire Results: Warning Information Analysis Report 23.3, MBRAWSAC Project. Bristol: University of Bristol, Department of Psychology. Frankish, C.R., Ovenden, C.R., Noyes, J.M. and Starr, A.F. (1991). Application of model-based reasoning to warning and diagnostic systems for civil aircraft. In, Proceedings of the ERA Technology Conference ‘Advances in Systems Engineering for Civil and Military Avionics’ (ERA Report 91-0634, pp. 7.1.1 – 7.1.7). Leatherhead: ERA Technology. Gorden-Johnson, P. (1991). Aircraft warning systems: Help or hindrance philosophy of warning systems. In, Proceedings of IMechE ‘Philosophy of Warnings Systems’ Seminar S969. London: Institution of Mechanical Engineers. Hawkins, F.H. (1987). Human Factors in flight. Aldershot: Ashgate. Helmreich, R.L. and Foushee, H.L. (1993). Why crew resource management? Empirical and theoretical bases of Human Factors training in aviation. In, E.L. Wiener, B.G. Kanki and R.L. Helmreich (Eds.), Cockpit resource management, (3-45). San Diego: Academic Press. JAR-25. Joint Aviation Requirements for large aeroplanes. Civil Aviation Authority, Cheltenham: Joint Aviation Authorities Committee. Jan M. Noyes, Alison F. Starr and Mandana L.N. Kazem 154 Jenkinson, J. (1997). Alarm reduction in nuclear power plants: Results of an international survey. In, Proceedings of IEE Digest 97/136 ‘Stemming the Alarm Flood’. London: Institution of Electrical Engineers. Jensen, R.S. (1995). Pilot judgement and crew resource management. Aldershot: Avebury Aviation. Kemeny, J. (1979). The need for change: The legacy of TMI Report of the President’s Commission on the Accident at Three Mile Island. New York: Pergamon. Learmount, D. (1995). Lessons from the cockpit. Flight International 11-17th January, 24-27. Maskell, P. (1997). Intelligent surveillance for naval nuclear submarine propulsion In Proceedings of IEE Digest 97/136 ‘Stemming the Alarm Flood’. London: Institution of Electrical Engineers. Newman, T.P. (1991). Cephalic indications, nictitations and anopic ungulates. In, Proceedings of IMechE ‘Philosophy of Warning Systems’ Seminar S969. London: Institution of Mechanical Engineers. Noyes, J.M. and Starr, A.F. (2000). Civil aircraft warning systems: Future directions in information management and presentation. International Journal of Aviation Psychology, 10, 169-188. Noyes, J.M., Starr, A.F. and Frankish, C.R. (1996). User involvement in the early stages of the development of an aircraft warning system. Behaviour and Information Technology, 15, 67-75. O’Leary, M. (2000). Situation Awareness: Has EFIS Delivered? In, Proceedings of ‘Situational Awareness On The Flight Deck: The Current And Future Contribution By Systems And Equipment’ 2000. London: Royal Aeronautical Society. Perrow, C. (1984). Normal accidents. New York, NY: Basic Books. Pischkle, K.M. (1990). Cockpit integration and automation: The avionics challenge. In, Proceedings of ‘International Federation of Airworthiness’ Conference, November 19th . Reason, J.T. (1990). Human error. Cambridge: University Press. Rouse, W.B., Geddes, N.D. and Hammer, J.M. (1990). Computer-aided fighter pilots. IEEE Spectrum, 38-40. Smither, R.D. (1994). The psychology of work and human performance. New York: Harper Collins. Stanton, N.A. and Edworthy, J. (Eds.) (1999). Human Factors in auditory warnings. Aldershot: Ashgate. Starr, A.F., Noyes, J.M., Ovenden, C.R. and Rankin, J.A. (1997). Civil aircraft warning systems: A successful evolution? In, H.M. Soekha (Ed.) Proceedings of IASC ‘97 (International Aviation Safety Conference). Rotterdam, Netherlands: VSP BV. Taylor, R.M., Selcon, S.J. and Swinden, A.D. (1995). Measurement of situational awareness and performance: A unitary SART index predicts performance on a Warning system design in civil aircraft 155 simulated ATC task. In, R. Fuller, N. Johnston and N. McDonald (Eds.), Human Factors in aviation operations. Aldershot: Avebury Aviation. Tversky, A. and Kahneman, D. (1974). Judgement under uncertainty: Heuristics and biases. Science, 185, 1124-1131. Wainwright, W. (2000). Integration of Situational Awareness on Airbus Flight Decks. In, Proceedings of ‘Situational Awareness On The Flight Deck: The Current And Future Contribution By Systems And Equipment’ 2000. London: Royal Aeronautical Society. Wiener, E.L. (1977). Controlled flight into terrain accidents: System-induced errors. Human Factors, 19, 171-181. Acknowledgements This work was carried out as part of a UK Department of Trade and Industry funded project, IED:4/1/2200 ‘A Model-Based Reasoning Approach to Warning and Diagnostic Systems for Aircraft Application’. Thanks are due to the late David Eyre for his meticulous data analyses.