Human error risks in safety-critical technology: case studies and strategies involving electronic interfaces

Transcription

1 Human error risks in safety-critical technology: case studies and strategies involving electronic interfaces Presented by: Heather Fitzpatrick - ATSB

2 Presentation overview PART 1: Emerging HF themes for electronic interfaces PART 2: Case studies on safety-critical interface issues PART 3: Strategies used to reduce risks

3 The Australian Transport Safety Bureau is Australia s national transport safety investigator. We don t investigate to lay blame but to improve safety. In-flight safety considerations

4 ATSB investigation analysis model

5 Part 1: emerging human factors themes in electronic interface use

6

7 Defining human factors : It s a multi-disciplinary science that applies knowledge about the capabilities and limitations of human performance to all aspects of the design, operation and maintenance of products and systems

8 The human element is a complex multidimensional issue that affects maritime safety and marine environmental protection. It involves the entire spectrum of human activities performed by ships crews, shore based management, regulatory bodies, recognized organizations, shipyards, legislators, and other relevant parties, all of whom need to cooperate to address human element issues effectively International Maritime Organization Resolution A.850(20), 1997

9 Competing attentional demands Expectancy Skill fade Limited standardisation Human Factors themes that relate to ECDIS use Challenges of monitoring Mode awareness Automaticity Non-detected slips Focus of attention Inattentional blindness

10 Some key HF themes applicable to ECDIS use: MODE AWARENESS What s it doing now? So many user settings, only two eyes! SKILL FADE Refers to concerns about ability to use paper charts with ECDIS implementation INATTENTIONAL BLINDNESS AND EXPECTANCY Silenced aural alerts Different systems take extra attentional resources CHALLENGES OF MONITORING AUTOMATED SYSTEMS Error detection in seemingly opaque systems

11

12

13 Part 2: Case studies on safety-critical interface issues

14 Case study 1: Rail track worker fatality FINDING The signalling technology displayed over multiple screens did not provide information regarding kilometrages [and] its drop-down menus obscured items in the display and the size of the track circuits occupied by trains varied

15 Case study 2 A319 descent below minimum permitted altitude AO The pilot flying inadvertently selected the EXPED pushbutton instead of the APPR pushbutton, and, in an attempt to correct the error, pressed the A/THR pushbutton, creating a thrust lock condition. The rapidly changing aircraft state led to the crew experiencing a high workload. This was likely to have limited their capacity to identify mode changes and to respond to the aircraft s undesired high airspeed and rate of descent.

16 Case study 3: Vasco De Gama grounding in Thorn Channel FINDING (MAIB 23/2017) [The] primary means of navigation, ECDIS, was not being used effectively or in accordance with expected standards. Accurate pilotage routes were not being charted, safety parameters and alarms were not set up and the most appropriate display screen setting was not being selected.

17 Part 3: Strategies used to reduce the risks

18 POLICIES AND PROCEDURES Could be considered admin control Outlines what should and shouldn t be done, but that s only the first step in making it happen

19 POLICIES AND PROCEDURES Could be considered admin WARNINGS AND ALERTS control Outlines what should and Can be nuisance or overwhelming The shouldn t problem be is done, that you but have that s to pass only the first step in making it happen a threshold before they activate sometimes that s too late

20 POLICIES AND PROCEDURES Could be considered admin WARNINGS AND ALERTS control Outlines what should and SIMULATIONS Can be nuisance AND or overwhelming TRAINING The shouldn t problem be is done, that you but have that s to pass only Can the first help step with better in making practice it happen use of a threshold before they activate sometimes tech that s too late Non-jeopardy environment to practice in It cannot eliminate all risks, i.e. training can t assure perfect practices

21 POLICIES AND PROCEDURES Could be considered admin WARNINGS AND ALERTS control Outlines what should and SIMULATIONS Can be nuisance AND or overwhelming TRAINING The shouldn t problem be is done, that you but have that s to pass only a Can the threshold first help step with before better in making they practice activate it happen use of HUMAN CENTRED DESIGN sometimes tech that s too late Non-jeopardy Designing the environment problem out to practice in About recognising the needs of It cannot eliminate all risks, i.e. the users training can t assure perfect practices Common across different modes Reference: Costa (2016) Human Centred Design for Maritime Safety

22

23 Thank you