Introduction to this Special Issue on “Human-Machine Interaction and Cooperation in Safety-Critical Systems”

1 Motivation

Human-machine systems can be characterized as mission- or safety-critical “if the[ir] failure […] could lead to consequences that are determined to be unacceptable” [18] and if they entail substantial risks due to mass, energy or information associated with them [14]. Domains like aviation, automotive, crisis management, critical infrastructures, healthcare, medical technology, military or railway are more and more characterized by interactive and multimedia systems. Their technical availability, reliability and security alone won’t lead to required outcomes and performances because “when the user interaction with a safety-critical system goes wrong, the result can be catastrophic” [39].

Although specific challenges have to be met in order to develop usable solutions for a certain domain, common issues with respect to human-machine interfaces can be identified. For example,

1. usability in terms of efficient and effective achievement of objectives is more important than user experience but giving more weight to hedonistic attributes of tools and humans’ positive emotions might lead to more profound systems [16, 32, 49];

2. usability engineering and risk management processes have to be aligned in order to ensure usability, safety and security in an efficient manner [1, 20, 25];

3. usability evaluations are more difficult to apply than in other domains, e. g. access to safety-relevant areas might not be possible or just to a limited extent [13, 22, 28];

4. routine and extraordinary missions (e. g. incidents, accidents) as well as transitions between these modes of operation have to be considered [34, 43, 51];

5. the overall relationship between human operators and machines has to be assessed in terms of trust and responsibility [6, 14, 17];

6. complex concepts like situation awareness, supervisory control or decision support have to be considered [7, 21, 24, 38];

7. training and other human factors aspects like crew resource management are essential parts of system design [36, 45, 47].

In 2014, the German Informatics Society (GI) published five “Grand Challenges of Informatics” [10]. Three of them can be associated with safety-critical human-machine systems:

1. systemic risks in world-wide networks requiring methods of communication geared to target groups;

2. ubiquitous human-computer interaction affecting almost all aspects of human lives;

3. reliability of software depending on performances of both humans and machines.

A new special-interest group was established 2015 as part of the technical committee “human-computer-interaction” of the GI to foster exchange between existing domain specific networks.^1[1] Besides workshops in 2014, 2015 and 2016 as well as special issues in 2015 [44] this special issue is an outcome of this work.

In the following sections, the diversity of users (see section 2), technologies (see section 3) and interaction or cooperation models (see section 4) potentially involved in mission- or safety-critical contexts is outlined. The contributions to this Special Issue are introduced in section 5.

2 Users: Domain Experts, Consumers and Volunteers

In safety-critical domains, four basic user groups can be distinguished with respect to training and experience:

1. domain experts with a high degree of training and experience in system usage (e. g. pilots);

2. domain experts with a limited degree of training and experience in system usage (e. g. crisis managers);

3. owners of consumer products and personal infrastructure with little or no training at all (e. g. car drivers);

4. volunteering laypeople without special training (e. g. social media users in emergencies or disasters).

It is worth mentioning that each group represents a heterogeneous set of people and several physical, physiological, psychological and psychosocial factors affect individual and group performances. For example, car drivers participating in safe driving trainings gain experience in dealing with extraordinary weather conditions or emergency situations. However, such measures can’t be compared to ones trained professionals (e. g. pilots, power plant operators) have to deal with. As applicants they are often subject to elaborate assessments and have to pass several barriers to recruitment [11]. Training and development are important parts of their professional life [23, 50]. Usually, they have a good understanding of technological aspects (e. g. automation) and have developed appropriate mental models of their application area [14].

Trained professionals have to distinguished from domain experts using interactive systems with only a limited degree of training and experience (e. g. crisis managers, members of Emergency Medical Services (EMS)). While they possess domain-specific knowledge and skills, computer literacy, technology acceptance and expertise in using specific applications might depend more strongly on personal interests and job history (e. g. previous work in dispatch centres or command vehicles). For example, most members of rescue forces and civil protection units (see Figure 1) currently are used to managing routine and extraordinary missions with the aid of the paper-based artefacts (e. g. forms, tables, charts, maps, private notes) and several means of communication (e. g. radio, mobile phone). However, these tools will likely be replaced or complemented by computer-based solutions like rugged tablet PCs [31]. Such advanced interactive and multimedia systems still “have to be incorporated in curriculums of EMS employees’ qualification and training” [30] in order to ensure a certain degree of expertise.

Figure 1

Members of different Emergency Medical Services and crisis intervention units.

Because consumer products and personal infrastructure (e. g. highly automated cars, smart home applications) more and more show safety-critical characteristics, their owners representing the public at large have to be regarded as crucial parts of safety-critical systems. On the contrary to trained professionals and domain experts, they have to meet only a few requirements (e. g. passing a theoretical test and a driving test) or none at all (e. g. anyone can buy smart home systems). Therefore, domain knowledge, computer expertise in general and system-specific expertise will vary strongly. Appropriate mental models can hardly be assumed and will most likely not be induced by manuals.

Volunteers (“emergent groups”) are “private citizens who work together in pursuit of collective goals relevant to actual or potential disasters but whose organization has not yet become institutionalized” [52]. Contrary to myths, citizens of affected areas seldom panic, are not helpless or dependent on external rescuers and do not loot [12]. The essential influencing factors for the emergence of such groups are (a) an extra community setting, which legitimizes the group; (b) a crucial event, which is perceived as a threat; (c) a supportive social climate with positive values, norms and beliefs regarding the necessity of collaborative actions; (d) an existing social network, so that communication can take place; and (e) available resources such as information, knowledge or skills [37]. Reuter et al. [41] summarize the perception of volunteers without special training: On the one hand, volunteer groups are conceived negatively [19, 35] and on the other hand their existence is valued as an essential factor when fighting a crisis [26]. Furthermore, it is stated that official plans do not incorporate self-help [5, 52] although, as spotted by another study, self-help is an important part of official relief actions in safety- and time-critical circumstances [26]. Nowadays social media play an important role in volunteer activities [27, 41].

3 Technology: Large-scale, Cars, Mobile and Wearable Devices

Also related to technology a high diversity can be observed: Traditionally, safety-critical domains are characterized by large-scale technologies like airplanes, power plants or ships (see Figure 2). It is worth mentioning that working environments and workplace layouts in control rooms and stations, in cockpits or at ship bridges differ from each other in several ways. While large control rooms of power plants consist of hundreds of displays and instruments which are operated and supervised by several team members, airplane cockpits accommodate two pilots who are closely surrounded (“embedded” [14]) by their instruments and, in case of a Boeing 777, by “six primary flat-panel displays and several other smaller displays” [18].

Figure 2

Naval ships as an example for large-scale technology in safety-critical domains.

On the contrary to airplanes or power plants, dispatch centers for police departments, fire departments (Figure 4) or Emergency Medical Services (see Figure 3) cannot be considered safety-critical due to masses or energies associated with them but rather due to data and information they handle. As Knight [18] points out: “Many modern information systems are becoming safety-critical in a general sense because financial loss and even loss of life can result from their failure.”

Figure 3

Workstation at a dispatch center for fire departments and Emergency Medical Services.

Figure 4

On-Site Unit of the Fire Department [40].

Cars are likely the most often used safety-critical mass product. In industrialised countries, the majority of people aged from 17 (Germany) to 80 and above drive a car. In case of an accident they risk their own life as well as the life from passengers and other road users or pedestrians. Dense traffic situations and high driving speed as well as the distraction due to integrated infotainment systems are a big challenge for the driver and his / her situation awareness. Several advanced driver assistant systems have been developed with the goal to increase comfort and safety, e. g. collision warning and automated braking. Currently cars with technology for high automated driving (see [48] for different levels of automations) are available, but further research is required until reliable fully automated driving systems without any need for human intervention will be available. Until then, drivers still need to be part of the control loop, at least in some situations. This requires a new form of vehicle-driver interaction, as drivers’ task changes from permanent execution of driving operations to monitoring the car performance or in high automation vehicles to reacting on take-over requests. Therewith driving changes to a human-machine cooperation, a new form which drivers need to learn to safely operate the vehicle and HMI designers still need to develop concepts for to minimize operating errors. Due to high diversity of the users and the huge variety of traffic situations user tests with large number of participants need to be executed with tools from simple driving simulators (see Figure 5) up to prototype vehicles.

Figure 5

A simple driving simulator with eye tracker, e. g. for first tests on driver distraction.

In many safety-critical domains (e. g. healthcare), mobile and ubiquitous information access independently from stationary workstations is deemed necessary. Therefore, rugged tablet PCs, handheld computers, optical head-mounted displays (“smartglasses”) and computerized wristwatches (“smartwatches”) are gradually introduced (see Figure 6).

Figure 6

Surgeons wearing smartglasses (left) with additional fastening and (right) in addition to magnifying spectacles and ordinary glasses [33].

However, required outcomes and performances in safety-critical contexts can’t be ensured by improving computer-based tools (e. g. availability, connectivity, reliability and security) and by taking human factors into account (qualification, training, working conditions) alone. Designing human-machine-relationships entails several challenges with regard to task or function allocation, interaction design, trust and responsibility.

4 Interaction and Cooperation

While the design of safety-critical human-machine interfaces has been focussed on single users and devices in the past, it needs to consider “many people – many machines” and more dynamic task or function allocation in the future. Currently, several researchers propose a shift “from human-machine interaction to human-machine cooperation” [15]. Flemisch et al. [8] state that after years of domain-specific research activities human-machine cooperation is one the essential topics in designing (safety-critical) human-machine systems.

Apart from cooperation between humans and machines, cooperation between humans, either domain experts or laypeople, will have an impact on the design of safety-critical human-machine systems. For example, social media platforms and mobile apps are nowadays used as an important tool by citizens in emergencies [46].

Furthermore, interface and interaction design supporting efficient and safe usage of computer-based systems under safety- and time-critical circumstances will remain a major challenge independently from a specific interaction or cooperation model. Tangible multimodal user interfaces [2] and future mobile interfaces have to designed for “dynamicity of contexts of use, interaction on the move and device management (e. g. power availability) […]. This includes, for instances, multiple devices issues such as designing a single application to be used on various mobile (or not) devices as well as designing various applications to be deployed on multiple devices to be used by a single user” [29]. Usability evaluations and impact analyses of interaction and cooperation models on acceptance and performances have to be carefully considered [3, 4, 9].

5 Contributions

The five articles in this Special Issue Issue reflect the diversity of users, technologies and their relationships outlined in the first sections of this introduction and emphasize the importance of considering various aspects of human-machine interfaces in mission- or safety-critical domains.

In “A configurable footswitch unit for the open networked neurosurgical OR – development, evaluation and future perspectives” Dell’Anna, Janß, Clusmann, and Rademacher describe the user-centered design and evaluation of a configurable central footswitch for open networked neurosurgical operating room settings. They show that efficiency of human-machine interaction in safety-critical contexts can be improved.

In “Big Data in a Crisis? Creating Social Media Datasets for Crisis Management Research” Reuter, Ludwig, Kotthaus, Kaufhold, von Radziewski, and Pipek describe the design and evaluation of an application which supports members of emergency services and researchers in collecting social media datasets for crisis management. The authors show how “Big Data” can be applied in safety-critical contexts in a user- and task-centered way.

In “Joint Decision Making and Cooperative Driver-Vehicle Interaction during Critical Driving Situations” Altendorf, Weßel, Baltzer, Canpolat, and Flemisch propose a framework for joint decision-making relying on common goals and norms of human drivers and automation. It is based on the description of individual processes for situation assessment and decision-making on different layers of the driving task.

Eschen, Keye-Ehing, and Gayraud in their article “Safety-Critical Personality Aspects in Human-Machine Teams of Aviation” focus on personality aspects correlating with safety-critical performances in aviation. A study with 156 participants was conducted and based on the combination of the Hybrid Team Questionnaire (HTQ) and the Hybrid Interaction Scenario (HTS). Some personality aspects concerning disinhibiting, spontaneous behaviour and sensation seeking show correlations with poorer performance in simulations of future human-machine interaction.

In “Trust in Technology as Safety Aspect: Use Case Highly Automated Driving” Wintersberger and Riener present an interaction model for trust calibration issuing personalized messages in real time. They describe the results of two user studies according to trust and driving ethics in highly automated driving. In the first one with 48 participants, they compared mental and emotional states of front-seat passengers to get insight into the dispositional trust of potential users of automated vehicles. In the second one they examined the willingness of drivers to risk even severe accidents depending on the number and age of pedestrians that would otherwise be sacrificed.