Human-in-the-Loop (HITL): Probabilistic Predictive Modeling (PPM) of an Aerospace Mission/Situation Outcome ^†

Abstract

Improvements in safety in the air and in space can be achieved through better ergonomics, better work environment, and other efforts of the traditional avionic psychology that directly affect human behaviors and performance. There is also a significant potential, however, for further reduction in aerospace accidents and casualties through better understanding the role that various uncertainties play in the planner’s and operator’s worlds of work, when never-perfect human, never failure-free navigation equipment and instrumentation, never hundred-percent-predictable response of the object of control (air- or space-craft), and uncertain-and-often-harsh environments contribute jointly to the likelihood of a mishap. By employing quantifiable and measurable ways of assessing the role and significance of such uncertainties and treating a human-in-the-loop (HITL) as a part, often the most crucial part, of a complex man–instrumentation–equipment–vehicle–environment system, one could improve dramatically the state-of-the-art in assuring aerospace operational safety. This can be done by predicting, quantifying and, if necessary, even specifying an adequate (low enough) probability of a possible accident. Nothing and nobody is perfect, of course, and the difference between a highly reliable object, product, performance or a mission and an insufficiently reliable one is “merely” in the level of the never-zero probability of failure. Application of the probabilistic predictive modeling (PPM) concept provides a natural and an effective means for reduction of vehicular casualties. When success and safety are imperative, ability to predict and quantify the outcome of an HITL related mission or a situation is a must. This is not the current practice though. The application of the PPM concept can improve therefore the state-of-the-art in understanding and accounting for the human performance in a vehicular mission or a situation. While the traditional statistical human-factor-oriented approaches are based on experimentations followed by statistical analyses, the PPM concept is based on, and starts with, physically meaningful and flexible predictive modeling followed by highly focused and highly cost effective experimentations geared to the chosen governing model(s). The PPT concept enables one to quantify, on the probabilistic basis, the outcome of a particular HITL related effort, situation or a mission. If the predicted outcome, in terms of the most likely probability of the operational failure, is not favorable, then an appropriate sensitivity analysis (SA) based on the developed and available algorithms can be effectively conducted to improve the situation. With the appropriate modifications and generalizations, such a cost-effective and insightful approach is applicable to numerous, not even necessarily in the aerospace and vehicular domain, HITL related missions and situations, when a human encounters an uncertain environment or a hazardous off-normal situation. The suggested approach is applicable also when there is an incentive to quantify human’s qualifications and performance, and/or when there is a need to assess and possibly improve his/her role in a particular mission or a situation. The general PPM concepts are illustrated in this analysis by addressing several more or less typical aerospace HITL related problems and by providing meaningful numerical examples.

1. Introduction

“A pinch of probability is worth a pound of perhaps.”—James G. Thurber, American writer and cartoonist

Human error contributes to about 80% of vehicular (aerospace, maritime, automotive, railroad) casualties and accidents (see, e.g., [1,2,3]). Such a large percentage of mishaps should not be attributed, of course, to the direct human error only. A mishap often occurs because an erroneous decision is made by the vehicle operator in the conditions of uncertainty as a result of his/her interactions, in various unpredictable and often harsh environmental conditions, with never-perfect forecasts, never one-hundred-percent dependable navigation instrumentation and operation equipment, and not always user-friendly and trustworthy information. While considerable improvements in various vehicular technologies and practices can be achieved through better ergonomics, better work environment, and other means that directly affect human behavior, there is also an opportunity for reduction in vehicular casualties through the application of the probabilistic predictive modeling (PPM) (see, e.g., [4]) followed by an appropriate experimentation geared to a particular governing model. PPM enables one to gain a better understanding of the role that various uncertainties play in the planner’s and operator’s world of work, as well as the role of the human factor in various human-in-the-loop (HITL) related missions and situations [5,6,7,8,9,10,11,12].

By employing quantifiable and measurable ways of assessing the role of such uncertainties and by treating HITL as a part of the complex man–instrumentation–equipment–vehicle–environment system, one could improve dramatically the human performance and the vehicular mission success and safety by being able to predict, quantify and, if needed, even specify and thereby assure an adequate probability of the occurrence of a mishap. This probability cannot be high, but does not have to be lower than necessary either: it has to be adequate for a particular application, mission or a situation. There is a crucial need therefore to quantify the roles of different factors affecting the outcome of a HITL related mission, whose failure free outcome is imperative. It is noteworthy also that there is always an incentive to optimize the human and equipment performance in terms of costs and preparation (planning) time. No optimization is possible, of course, if the major factors affecting the results of interest, such as failure free operation, cost effectiveness and preparation time are not quantified. The PPM approach enables one to do that by using methods and approaches of applied probability and probabilistic risk analysis.

The traditional statistical HITL related approaches are based on experimentation followed by statistical analyses. The suggested PPM concept is based, on the contrary, on the physically meaningful, flexible, highly focused and highly cost effective predictive modeling. Modeling is applied first and is followed by experimentation that is geared to a particular predictive model. The PPM concept proceeds from understanding that nobody and nothing is perfect and that the difference between a success and a failure in a particular product, effort, situation or a mission is, in effect, “merely” the difference in the level of the never-zero probability of failure. The PPM concept enables one to quantify, on the probabilistic basis, the outcome of a particular effort, and, with the appropriate modifications and generalizations, is applicable not only in the aerospace domain and even not only in the vehicular domain, but also in numerous and various HITL related situations, when a human encounters an extraordinary challenge requiring an application of his/her best abilities, or when there is an incentive to quantify his/her qualifications and performance. Suitable examples are surgery, forensic practices or military strategies and tactics. The PPM effort should always be geared to a particular mission, situation, application and acceptable adequate probability of failure. The latter is usually determined by the possible consequences of failure.

One major merit of the PPM approach is that it complements the existing system-related and human-psychology-related efforts, and bridges the gap between the three critical bodies of knowledge responsible for the man–instrumentation–equipment–vehicle–environment system’s performance and safety: reliability engineering, vehicular technologies and human factor.

In this overview the following HITL related topics, strategies and situations, addressed in the recent author’s publications, are identified, analyzed and discussed:

(1)

double-exponential probability distribution function of the human non-failure [5,10,11];

(2)

assessment of the aerospace mission success and safety [5,6,7];

(3)

some short-term predictions for the HITL related situations;

(4)

helicopter-landing-ship (HLS) process, with an emphases on the role of the human factor (swiftness in decision making) and with an objective not to compromise the strength of the helicopter undercarriage [8,9];

(5)

the famous “miracle-on-the-Hudson” event vs. the infamous UN-shuttle disaster [10];

(6)

probability of the flight non-failure if one of the pilots gets incapacitated during the flight [11];

(7)

PPM in the concept of anticipation in aviation [12,13,14,15,16,17,18,19,20].

One of the major challenges associated with the application of the PPM concept is the choice of suitable distributions for a particular problem of interest. Although there is no straightforward way for doing that, such distributions could be either based on the accumulated experience or could be anticipated and accepted beforehand based on the common sense and insightful intuition about the physics of the problem. “The intuitive mind is a sacred gift, and the rational mind is a faithful servant. Unfortunately, we have created a society that honors the servant and has forgotten the gift” (A. Einstein). Let us refer, as an example, to the helicopter landing ship (HLS) problem. The actual time of human reaction (decision making) is always positive, is never zero, but could not be unrealistically long either. In addition, shorter times of reaction are more likely than longer times. This means that the probability density distribution function for the human reaction (decision making) time should be skewed towards shorter times, and the most likely time of human reaction (maximum value, mode, of the probability density distribution function) should be low, but never zero. The simplest distribution that meets these requirements is the single-parametric Rayleigh distribution. That is why this distribution was selected to characterize human reaction in the HITL HLS problem. A more powerful and more flexible two parametric Weibull distribution could also be used, but this will make analytical modeling more complicated. As to the lull time in the sea condition, this time is most likely symmetric with respect to its mean value, and therefore the two-parametric normal distribution has been chosen to describe the random lull time. Although, generally, normal distributions cover also negative values of the considered random variable, this “shortcoming” of the distribution is suppressed in our analysis by choosing a large enough ratio of the mean value of lull time to its standard deviation. Another example is the recently suggested double-exponential probability distribution function for the human non-failure, when fulfilling a particular challenging mission in an off-normal situation. This function (addressed in the next section) could be applied in a number of HITL related problems and has also a clear physical meaning. This meaning, as will be shown, is associated with the change in the uncertainty (entropy) of the probability of human non-failure with the change in the level of the mental workload (MWL).

It should be pointed out that while the PPM approach opens new perspectives for aerospace human psychologists and ergonomics specialists, numerous additional analyses will be necessary to make the recommendations and guidelines based on the PPM concept widely accepted and highly practical. These analyses should be geared to various practical situations, including those beyond the aerospace and even vehicular domain.

2. Double-Exponential Probability Distribution Function

“Everyone knows that we live in the era of engineering, however, he rarely realizes that literally all our engineering is based on mathematics and physics”—Bartel Leendert van der Waerden, Dutch mathematician

The probability $P^h(F,G)$ of the navigator’s non-failure, when a vehicle is operated in off-normal (extraordinary) conditions, can be assumed to be distributed in accordance with the following double-exponential law of the extreme-value-distribution (EVD) type (see, e.g., [4]):

$$P^h(F,G)=P_0 \text{exp}\left[\left(1-\frac{G^2}{G_0^2}\right)\text{exp}\left(1-\frac{F^2}{F_0^2}\right)\right]$$

(1)

here $P_0$ is the probability of the human non-failure for the specified (normal) mental workload (MWL) $G_0$ in ordinary (normal) operation conditions; $G\ge G_0$ is the actual (elevated, off-normal) MWL; $F_0$ is the most likely (normal, specified) human capacity factor (HCF); $F\ge F_0$ is the actual (off-normal) HCF exhibited or required in the extraordinary condition. The $P_0$ level should be established beforehand, as a function of the normal $G_0$ and $F_0$ levels. In avionics this could be done by conducting “accelerated” testing and appropriate measurements on a flight simulator.

By differentiation the Equation (1) with respect to the MWL $G$ we obtain:

$$\frac{d\overline{P}}{dG}=-\frac{2H}{G}\frac{G^2}{G^2-G_0^2}$$

(2)

where $H=-\overline{P}\text{ln}\overline{P}$ is the entropy of the distribution $\overline{P}=\frac{P^y(F,G)}{P_0}.$ At low MWL levels close to the normal level, the change in the relative probability $\overline{P}$ of non-failure with the increase in the MWL is significant. This is not surprising though: it is easy to improve a poor performance than a good one. In another extreme case, when the actual MWL $G$ exceeds considerably the normal one $(G>>G_0),$ we have: $\frac{d\overline{P}}{dG}=-\frac{2H}{G}.$ This result explains the physical meaning of the Equation (1): the change in the probability of human non-failure with the change in the level of the MWL is proportional, for high MWL levels, to the underlying uncertainty (entropy of the distribution of this probability) and is inversely proportional to the MWL level. The right part of the last formula could be viewed as a kind of a coefficient of variation (COV), where the role of the uncertainty in the numerator is played by the entropy, rather than by the standard deviation, and the role of the stressor (MWL) in the denominator is played, as in the well-known statistical COV characteristic, by the MWL, rather than by the mean value of the random characteristic of interest.

The Equation (1) enables one to quantify, on the probabilistic basis, the human’s ability (capacity) to cope with an elevated mental overload. Using an analogy from the reliability engineering field and particularly with the stress–strength (demand–capacity) interference model (Figure 1), the MWL could be viewed as a certain demand (stress, load), while the HCF as capacity (strength) of the object. In the case in question it is the capacity of a human to perform the given task. It is the relative levels of the MWL and HCF that determine the human’s “reliability”, i.e., the likelihood of his/her non-failure (success). Unlike in the well-known capacity-demand interference model, the Equation (1) combines the demand $G$ and the capacity $F$ in the same PPM, with an intent to consider a situation of the type shown in Figure 2.

Figure 1. Demand (stress/mental workload (MWL))–capacity (strength/human capacity factor (HCF)) interference curves.

Figure 1. Demand (stress/mental workload (MWL))–capacity (strength/human capacity factor (HCF)) interference curves.

Figure 2. Long-term (pilot capabilities) HCF vs. MWL (pilot workload).

Figure 2. Long-term (pilot capabilities) HCF vs. MWL (pilot workload).

It should be emphasized that while the notion of the MWL has been addressed and well described in the human psychology literature, the idea of mental capacity is rather new. Although it is true that it might be difficult to establish a comprehensive list of factors that could impact the HCF and the human performance in a particular situation, it is also true that the MWL has to be compared to a more or less well-substantiated HCF. It goes without saying that MWL and HCF, as a demand and a capacity, are to be measured in the same units, otherwise there will not be possible to create a meaningful “pass/fail” model. The MWL and the HCF could be particularly dimensionless.

Cognitive (mental) overload is central in the today’s aviation and aerospace psychology. Excessive MWL has been recognized for a long time as a significant cause of error in aviation and space navigation. The MWL depends on the operational conditions and the mission complexity, has to do with the significance of the general task and is directly affected by the challenges that a navigator faces, when controlling the vehicle in a complex, heterogeneous, multitask, and uncertain-and-harsh environment. The pilot’s environment includes various concepts of situation awareness: spatial awareness (for instrument displays); system awareness (e.g., for keeping the pilot informed about actions that have been taken by automated systems); and task awareness (that has to do with the attention and task management). Measuring the MWL using subjective and objective measures has become in the today’s aerospace psychology a single key method for improving navigation safety. The subjective ratings are applied particularly during simulation tests. They can be, e.g., in the form of periodic inputs to some kind of data collection device that prompts the pilot to enter a number (say, between 1 and 10) to estimate the MWL every few minutes. A suitable example is heart rate variability. Measurement of cardiac activity has been a useful physiological technique employed for the assessment of MWL, both from tonic variations in heart rate and after treatment of the cardiac signal. Using post-flight questionnaires is yet another approach, because one would not want to interfere with the pilot’s work during actual flight operations.

As to the HCF (capacity), it should consider, but might not be limited to, the relevant human qualities. Examples are psychological suitability for a particular task; professional experience and qualifications; education, both special and general; relevant capabilities and skills; level, quality and timeliness of training; performance sustainability (consistency, predictability); mature (realistic) and independent thinking; independent acting, when necessary; ability to concentrate; ability to anticipate; self-control and ability to act in cold blood in hazardous and even life threatening situations; ability to operate effectively under significant MWL and time pressure; ability to make substantiated decisions in a short period of time; ability to operate effectively, when necessary, in a tireless fashion, for a long period of time (tolerance to stress); team-player attitude, when necessary; swiftness in reaction, when necessary. These and other qualities are certainly of different importance in different HITL situations. It is clear also that different individuals possess these qualities in different degrees even prior to any training. HCF and the corresponding qualities and capacities could be time-dependent. When there is an intent to come up with suitable figures-of-merit (FOM) for the HCF for a particular individual, one could rank, similarly to the MWL estimates, the above and perhaps also other meaningful qualities on the scale from, say, one to ten, and calculate the average FOM for each individual and for a particular task, situation or a mission. Certification of navigators from the standpoint of their HCF could be considered.

The MWL/HCF concept and its possible generalizations (say, by considering time, or multi-parametric MWL conditions), after the appropriate sensitivity analyses (SA) are carried out, can be used:

(1)

when developing guidelines for personnel training;

(2)

when choosing the appropriate flight simulation conditions; and/or

(3)

when there is a need to decide if the existing level of automation and/or the navigation instrumentation/equipment are adequate in extreme, but not impossible, extraordinary situations. If not, additional and/or more advanced instrumentation or equipment should be considered. Then the human participation could be minimized or even eliminated.

The calculated $\overline{P}=\frac{P^h(F,G)}{P_0}$ values indicate that:

(1)

at normal MWL level and/or at an extraordinarily (exceptionally) high HCF level the probability of human non-failure is close to 100%;

(2)

if the MWL is exceptionally high, the human will definitely fail, no matter how high his/her HCF is;

(3)

if the HCF is high, even a significant MWL has a small effect on the probability of non-failure, unless this MWL is exceptionally large (indeed, highly qualified individuals are able to cope better with the off-normal situations);

(4)

the probability of non-failure decreases with an increase in the MWL (especially for relatively low MWL levels) and increases with an increase in the HCF (especially for relatively low HCF levels);

(5)

for high HCFs the increase in the MWL level has a much smaller effect on the probabilities of non-failure than for low HCFs.

These intuitively more or less obvious judgments are quantified by using an analysis based on the Equation (1) .The computed data show also that the increase in the HCF $(F/F_0 \text{ratio})$ and in the MWL $(G/G_0 \text{ratio})$ above the 3.0 has a small effect on the probability of non-failure. This means particularly that the navigator does not have to be trained for an extraordinarily high MWL and to a relative HCF $(F/F_0 \text{ratio})$ higher than 3.0 compared to a navigator of an ordinary capacity (qualification). In other words, a navigator does not have to be a superman to successfully cope with a high level MWL, but still has to be trained to be able to cope with a MWL by a factor of three higher than the normal level. As has been mentioned, if the requirements for a particular level of safety are above the HCF for a well educated and well trained human, then the development and employment of the advanced equipment and instrumentation should be considered for a particular task, and the decision of the right way to go should be based on the evaluation, on the probabilistic basis, both the human and the equipment performance.

In conclusion of this section it should be emphasized that although the suggested double-exponential Equation (1) has been found useful and fruitful for the evaluation of the MWL vs. HCF in different aerospace safety situations, other PPM approaches are also possible and might be quite fruiteful. As Khalil Gibran, famous Lebanese-American poet and writer, had put it, “Say not, ‘I have found the truth’, but rather ‘I have found a truth’”. Such approaches include, but are not limited to, of course, to demand-capacity interference model of the type shown in Figure 1, including time-dependency of the distributions, as well as various long tailed probability distributions that assign relatively high probabilities to regions far from the modes, means or medians of the underlying distribution considered (see, e.g., [21]), or, more general, various fractional processes (see, e.g., [22]). Various EVDs, other than the Equation (1), can also be applied. This is true, particularly, for the widely used in reliability theory Weibull distribution, which can be applied in the HITL problems as well, as shown in the next section of the review.

3. Mission Success and Safety

“There are truths, which are like new lands: the best way to them becomes known only after trying many other ways”—Denis Diderot, French philosopher, art critic, and writer

While the Equation (1) can be used to quantify the likelihood of the human non-failure, the reliability of the equipment (instrumentation), which includes the performance of both the hardware and the software, can be characterized, e.g., by Weibull distribution, which is widely used in reliability engineering. As to the role of the uncertain environment, this could be considered by accounting for the probability of the encounter (occurrence) of a condition of the given level of severity. If appropriate and highly dependable equipment is used, a mission could still be successful, even if the MWL is significant and the HCF is not very high.

The success (failure) of a vehicular mission could be time dependent and could have different actual and specified probabilities of success at different stages (segments). Let, e.g., a particular mission of interest consists of $n$ segments $(i=1,2,\mathrm{...},n)$ characterized by different probabilities, $q_i,$ of occurrence of a particular harsh environment or by other extraordinary conditions during the fulfillment of the i–th segment of the mission. The segments are characterized also by different durations, $T_i,$ and also by different predicted failure rates, ${\lambda }_i^e,$ of the equipment and instrumentation. These rates may or may not depend on the environmental conditions, but could be affected by aging/degradation and other time-dependent causes. In the simplified example below we assume that the combined input of the hardware and the software, as far as the failure rate of the equipment and instrumentation is concerned, is evaluated beforehand and is adequately reflected by the appropriate failure rate ${\lambda }_i^e$ values. These values could be either determined from the vendor specifications or, preferably, should be obtained on the basis of the specially designed and conducted failure oriented accelerated testing (FOAT) and subsequent predictive modeling [14]. FOAT should be preferably geared to a particular predictive model, such as, e.g., multi-parametric Boltzmann–Arrhenius–Zhurkov (BAZ) model [14]. This model is rather general and flexible and can be successfully employed in many reliability related problems.

The probability of the equipment non-failure at the moment $t_i$ of time during the fulfillment of the mission on the i–th segment, assuming that Weibull distribution is applicable, is

$$P_i^e=\text{exp}\left[-{\left({\lambda }_i^e{t}_i\right)}^{{\beta }_i^e}\right]$$

(3)

where $0\le t_i\le T_i$ is an arbitrary moment of time within the i–th segment, and ${\beta }_i^e$ is the shape parameter in the Weibull distribution. One could assume that the time-dependent probability of human non-failure can be also represented in the form:

$$P_i^h(t_i)=P_i^h(0)\text{exp}\left[-{\left({\lambda }_i^h{t}_i\right)}^{{\beta }_i^h}\right]$$

(4)

of Weibull distribution, where ${\lambda }_i^h$ is the failure rate, ${\beta }_i^h$ is the shape parameter and $P_i^h(0)$ is the probability of the human non-failure at the initial moment of time $t_i=0$ of the given segment. When $t_i\to \infty ,$ the probability of non-failure (say, because of the human fatigue or other causes) tends to zero. The probability $P_i^h(0)$ can be assumed particularly in the form of the Equation (1).

The probability of the mission failure at the i–th segment can be found, in an approximate analysis (in a more rigorous analysis conditional probabilities should be considered) as

$$Q_i(t_i)=1-P_i^e(t_i)P_i^h(t_i)$$

(5)

and the overall probability of the mission failure can be determined as

$$Q={\displaystyle \sum _{i=1}^n{q}_i}{Q}_i(t_i)=1-{\displaystyle \sum _{i=1}^n{q}_i}{P}_i^e(t_i)P_i^h(t_i)$$

(6)

This formula can be used also for specifying the failure rates and the HCF in such a way that the overall probability of failure would be adequate for the given mission. The assessments based on the Equation (6) can be used to choose, if possible, an alternative route, so that the set of the probabilities $q_i$ of encounter of the environmental conditions of the given severity brings the overall probability of the mission failure to an acceptable and low enough level.

Let, for instance, the duration of a particular vehicular mission be 24 h, and the vehicle spends equal times at each of the 6 segments (so that $t_i=4$ h at the end of each segment), the failure rates of the equipment and the human performance are independent of the environmental conditions and are, say, λ = 8 × 10⁻⁴ 1/h, the shape parameter in the Weibull distribution in both cases is β = 2 (Rayleigh distribution is applicable), the HCF ratio $\frac{F^2}{F_0^2}$ is $\frac{F^2}{F_0^2}=8$$(\text{so that }\frac{F}{F_0}=2.828),$ the probability of human non-failure at ordinary conditions is $P_0=0.9900,$ and the MWL $G_i^2/G_0^2$ ratios are 1, 2, 3, 4, 5, and occur with the probabilities $q_i$ = 0.9530, 0.0399, 0.0050, 0.0010, 0.0006 and 0.0005, depending on the severity of the environmental conditions. These data indicate that about 95% of the mission time takes place in ordinary conditions. The calculated ${\overline{P}}_i$ ratios for the above six segments are 1.0000; 0.9991; 0.9982; 0.9978; 0.9964 and 0.9955. The corresponding computed probabilities $P_i^h$ of the human non-failures are 0.9900; 0.9891; 0.9882; 0.9878; 0.9864 and 0.9855; the products $P_i^e{P}_i^h$ of the equipment and the human non-failures are 0.9900; 0.9891; 0.9882; 0.9878; 0.9864; and 0.9855; and the products $q_i{P}_i^e{P}_i^h$ are 0.9435; 0.0395; 0.0049; 0.0010; 0.0006; and 0.0005. With these data the predicted probability of the mission non-failure is:

$$P={\displaystyle \sum _{i=1}^n{q}_i}{P}_i^e(t_i)P_i^h(t_i)=0.9900$$

(7)

and the probability of its failure is therefore $Q=0.01=1\%.$

4. Some Short-Term Predictions

“We see that the theory of probability is at heart only common sense reduced to calculations: it makes us appreciate with exactitude what reasonable minds feel by a sort of instincts, often without being able to account for it.”—Pierre-Simon, Marquis de Laplace, French mathematician and astronomer

The solution addressed in the previous section is suitable for the design of the hardware and the software, for making long-term assessments and strategic decisions, and for planning a vehicular mission before it commences. There are, however, extraordinary situations, when the navigator has to make a decision on a short-term, often on an emergency basis, during the fulfillment of a mission. Here are examples of some typical problems.

• Problem #1. The probability that the particular environmental conditions will be detrimental for the vehicle safety is p. The probability that these conditions are detected by the available navigation equipment, adequately processed and delivered to the navigator in due time is p₁. But the navigator is not perfect either, and the probability that he/she misinterprets the obtained information from the navigation instrumentation is p₂. If this happens, the navigator can either launch a false alarm (take inappropriate and unnecessary corrective actions), or conclude that the environmental conditions are acceptable and make inappropriate go-ahead decision. The navigator receives n messages from the navigation equipment and instrumentation during his/her watch. What is the probability that at least one of the messages will be assessed incorrectly?
• Solution. The probability that a particular message is misinterpreted is $P=p(1-p_1)+(1-p)p_2.$ Then the probability that at least one message out of $n$ is misinterpreted is $Q=1-{(1-P)}^n.$ Clearly, $Q\to 1,$ when $n\to \infty .$ Thus, the outcome depends on both the equipment (instrumentation) performance and the human ability to correctly interpret the obtained information. The formula $Q=1-{(1-P)}^n$ can be used particularly to assess the effect of the human fatigue on his ability to interpret correctly the obtained messages. Let, for instance, $n=100$ (the navigator receives 100 messages during his watch) and $p=1:$ the forecast environmental conditions that the vehicle is expected to encounter will definitely cause an accident and should be avoided. So, the instrumentation did not fail, and the probability $p_1$ that the navigator obtained this information and that the information has been delivered in a timely fashion is $p_1=0.999.$ Let the probability that the navigator interprets the information incorrectly is only $p_2=0.01=1\%.$ then P = 0.001 and Q = 0.0952. Thus, the probability that one message could be misinterpreted is as high as 9.5%. If the equipment is not performing adequately and the probability p₁ is only, say, p₁ = 0.95, then P = 0.05 and Q = 0.9941: one of the messages from the navigation equipment will be most certainly misinterpreted. We conclude that the performance and the accuracy of the instrumentation are as important as the human factor is.
• Problem #2. The probability that the instrumentation does not fail during the time T of the fulfillment of a certain segment of a mission is p₁. The probability that the human “does not fail”, i.e., receives and interprets the obtained information correctly during this time is p₂. It has been established that a certain (non-fatal though) mishap has occurred during the time of the fulfillment of this segment of the mission. What is the probability that the accident has occurred because of the equipment failure?
• Solution. Four hypotheses were possible before the accident actually occurred: H₀ = the equipment did not fail and the human did not make any error; H₁ = the equipment failed, but no human error occurred; H₂ = the equipment did not fail, but the human made an error; H₃ = the equipment failed and the human made an error. The probabilities of these hypotheses can be evaluated as:

  $$P(H_0)=p_1{p}_2;P(H_1)=(1-p_1)p_2;P(H_2)=p_1(1-p_2);P(H_3)=(1-p_1)(1-p_2)$$

  (8)

  Then the conditional probabilities of the event A “the accident has occurred” are:

  $$P(A/H_0)=0, P(A/H_1)=P(A/H_2)=P(A/H_3)=1.$$

  (9)

  Applying Bayes’ formula

  $$P(H_i/A)=\frac{P(H_i)P(A/H_i)}{{\displaystyle \sum _{i=1}^{n}P(H_i)P(A/H_i)}},i =\text{1, 2, …, }n$$

  (10)

  we obtain the following expression for the probability that only the equipment failed:

  $$P(H_1/A)=\frac{(1-p_1)p_2}{(1-p_1)p_2+p_1(1-p_2)+(1-p_1)(1-p_2)}=\frac{(1-p_1)p_2}{1-p_1{p}_2}$$

  (11)

  If the equipment never fails (p₁ = 1), then P = 0. On the other hand, if the equipment is very unreliable (p₁ = 0), then P = p₂: the probability that the equipment fails is equal to the probability that the operator did not make an error. If the probabilities p₁ and p₂ are equal (p₁ = p₁ = p) then $P=\frac{p}{1+p}$ is the probability that either the equipment failed or the human made an error. For very reliable equipment and a next-to-perfect operator (human) (p = 1), P = 0.5: the probability that only the equipment failed is 0.5. For very unreliable equipment and very “imperfect” human (p = 0) we obtain P = 0: it is quite likely that both the equipment failed and the human made an error.
• Problem #3. The assessed probability that a certain segment of a mission will be accomplished successfully, provided that the environmental conditions are favorable, is p₁. This probability will not change even in unfavorable environmental conditions, if the navigation equipment is adequate and functions properly. If, however, the equipment (instrumentation) is not perfect, then the probability of safe fulfillment of the given segment of the mission is only $p_2⊲p_1.$ It has been established that the probability of failure-free functioning of the navigation equipment is p_*. It is known also that in this region of the navigation space unfavorable conditions are observed at the given time of the year in k% of the time. What is the probability of the successful accomplishment of the mission in any environmental conditions? What is the probability that the navigator used the equipment, if it is known that the mission has been accomplished successfully?
• Solution. The probability of the hypothesis H₁ “the environmental conditions are favorable” is $P(H_1)=1-\frac{k}{100}.$ The probability of the hypothesis H₂” the environmental conditions are unfavorable” is $P(H_2)=\frac{k}{100}.$ The conditional probability $P(A/H_1)$ of the event A “the navigation is safe” when the environmental conditions are favorable is $P(A/H_1)=p_1.$ The conditional probability $P(A/H_2)$ of the event A “the navigation is safe” when the environmental conditions are unfavorable can be determined as

  $$P(A/H_2)=p_{*}{p}_1+(1-p_{*})p_2$$

  (12)

  so that the sought probability of accident-free navigation on the given segment is

  $$P(A)=\left(1-\frac{k}{100}\right)p_1+\frac{k}{100}\left[p_{*}{p}_1+(1-p_{*})p_2\right]=p_1-\frac{k}{100}(p_1-p_2)(1-p_{*})$$

  (13)

  If it is known that the mission has been accomplished successfully despite unfavorable environmental conditions, then

  $$P(A/H_2)=\frac{\frac{k}{100}\left[p_{*}{p}_1+(1-p_{*})p_2\right]}{P(A)}=\frac{\frac{k}{100}\left[p_{*}{p}_1+(1-p_{*})p_2\right]}{p_1-\frac{k}{100}(p_1-p_2)(1-p_{*})}$$

  (14)

  Let, e.g., p₁ = 1.0, p₂ = 0.95, p_* = 0.98, k = 80. Then P(A) =0.9992, P(A/H₂) =0.7998. Thus, the probability of the successful accomplishment of the mission is 0.9992, and the probability that the navigator used the navigation instrumentation/equipment that enabled him/her to accomplish the mission successfully is 0.7998, otherwise the mission would have failed.

5. Helicopter Landing Ship (HLS)

“There is nothing more practical than a good theory.”—Kurt Zadek Lewin, German–American psychologist

The helicopter-landing-ship (HLS) situation [8,9] is addressed with an emphasis on the human factor role in assuring the helicopter undercarriage strength. This strength should not be compromised as a result of the impact that helicopter experiences during its landing on the ship’s deck. The human factor is important from the standpoint of the operation time that affects the likelihood of safe landing. The operation time includes the time required for the officer-on-board and the helicopter pilot to make their go-ahead decisions, and the time of actual landing. It is assumed in this analysis, for the sake of simplicity, that both these times could be approximated by Rayleigh’s law, while the lull duration follows the normal law with a high ratio of the mean value to the standard deviation. Safe landing could be expected if the probability that it occurs during the lull time is sufficiently high. The probability that the helicopter undercarriage strength is not compromised can be evaluated as a product of the probability that landing occurs during the lull time and the probability that the relative velocity of the helicopter with respect to the ship’s deck at the moment of landing does not exceed the allowable level. This level is supposed to be determined for the helicopter-landing-ground (HLG) situation. The HLG is viewed as a “normal” condition, while the HLS is viewed as an off-normal (extraordinary) situation. The developed PPM can be used when establishing specifications for the helicopter undercarriage strength and when developing guidelines for personnel training. Particularly, the model can be of help when establishing the times to be met by the two humans involved to make their go-ahead decisions in due time to safely land the helicopter.

Typically, officer-on-ship-board, using the information from the on-board surveillance systems, signals to the helicopter pilot, when the lull period (“wave window”) commences (Figure 3). The challenge is to foresee, the duration of the lull. If the random sum, T = t + θ, of the random time, t, needed for the officer-on-board and the helicopter pilot to make their go-ahead decisions, and the random time, θ, needed to actually land the helicopter, is lower, with a high enough probability, than the (random) duration, L, of the lull, then safe landing becomes likely.

Figure 3. Helicopter landing ship.

Figure 3. Helicopter landing ship.

We use Rayleigh’s distributions

$$f_t(t)=\frac{t}{t_0^2}\text{exp}\left(-\frac{t^2}{2t_0^2}\right),{\mathrm{f}}_{\theta }(\mathrm{t})=\frac{\mathrm{\theta }}{{\mathrm{\theta }}_0^2}\text{exp}\left(-\frac{{\mathrm{\theta }}^2}{2{\mathrm{\theta }}_0^2}\right)$$

(15)

as suitable approximations for the times t and θ of decision making and actual landing, and the normal distribution

$$f_l(l)=\frac{1}{\sqrt{2\pi }\sigma }\text{exp}\left(-\frac{{\left(l-l_0\right)}^2}{2{\sigma }^2}\right),\frac{l_0}{\sigma }\ge 4.0$$

(16)

as an appropriate approximation for the duration, L, of the lull. In the above formulas, $t_0$ and ${\theta }_0$ are the most likely times of decision making and landing (modes of the corresponding probability density distributions), respectively (in the case of a Rayleigh law these times coincide with the standard deviations of the random variables in question), $l_0$ is the most likely value (mode) of the lull time (in the case of normal law it coincides with the mean and the median of the distribution), and $\sigma$ is the standard deviation of the lull time. The ratio $\frac{l_0}{\sigma }$ (“safety factor”) of the mode to the standard deviation should be large enough (say, larger than 4), so that the normal law could be used as a suitable approximation for the random variable of time that cannot be negative. The probability, $P_{*},$ that the random sum T = t + θ of the variables t and θ exceeds a certain level, $\widehat{T}$ can be found as

$$\begin{array}{l}{P}_{*}=1-{\displaystyle \underset{0}{\overset{\widehat{T}}{\int }}\frac{t}{t_0^2}\text{exp}\left(-\frac{t^2}{2t_0^2}\right)\left[1-\text{exp}\left(-\frac{{\left(T-t\right)}^2}{2{\theta }_0^2}\right)\right]}dt=\text{exp}\left(-\frac{{\widehat{T}}^2}{2t_0^2}\right)+\\ +\text{exp}\left[-\frac{{\widehat{T}}^2}{2\left(t_0^2+{\theta }_0^2\right)}\right]\left\{\frac{{\theta }_0^2}{t_0^2+{\theta }_0^2}\left[\text{exp}\left[-\frac{t_0^2{\widehat{T}}^2}{2{\theta }_0^2\left(t_0^2+{\theta }_0^2\right)}\right]\right]-\text{exp}\left[-\frac{{\theta }_0^2{\widehat{T}}^2}{2t_0^2\left(t_0^2+{\theta }_0^2\right)}\right]\right\}+\\ +\sqrt{\frac{\pi }{2}}\frac{\widehat{T}{t}_0{\theta }_0}{{\left(t_0^2+{\theta }_0^2\right)}^{3/2}}\text{exp}\left[-\frac{{\widehat{T}}^2}{2\left(t_0^2+{\theta }_0^2\right)}\right]\left\{\left[erf\left[\frac{t_0\widehat{T}}{{\theta }_0\sqrt{2\left(t_0^2+{\theta }_0^2\right)}}\right]\right]+erf\left[\frac{{\theta }_0\widehat{T}}{t_0\sqrt{2\left(t_0^2+{\theta }_0^2\right)}}\right]\right\},\end{array}$$

(17)

where $erf(x)=\frac{2}{\sqrt{\pi }}{\displaystyle \underset{0}{\overset{x}{\int }}{e}^{-z^2}}dz$ is the error function.

When the most likely duration ${\theta }_0$ of landing is small compared to the most likely time, $t_0,$ required for the officer-on-board and the helicopter pilot to make their go-ahead decisions, the Equation (17) yields: $P_{*}=\text{exp}\left(-\frac{{\widehat{T}}^2}{2t_0^2}\right).$ Thus, the probability that the total time of operation exceeds a certain time duration, $\widehat{T}$ depends in this case only on the most likely time, $t_0,$ of decision making. Solving this relationship for the $\frac{t_0}{\widehat{T}}$ ratio, we have: $\frac{t_0}{\widehat{T}}=\frac{1}{\sqrt{-2\text{ln}{P}_{*}}}.$ If the acceptable probability, $P_{*}$ of exceeding the time, $\widehat{T}$ is, e.g., P = 10⁻⁴, then the total time of making the go-ahead decisions should not exceed 0.233=23.3% of the time, $\widehat{T}$ (lull duration), otherwise the requirement P ≤ 10⁻⁴ will be compromised.

Similarly, when the most likely duration, $t_0,$ of decision making is very small compared to the most likely time, ${\theta }_0,$ of landing, then $P_{*}=\text{exp}\left(-\frac{{\widehat{T}}^2}{2{\theta }_0^2}\right).$ In this case the probability of exceeding time level, $\widehat{T}$ depends only on the most likely time, ${\theta }_0,$ of landing.

It is noteworthy that the single-parametric Rayleigh law is characterized by a rather large standard deviation and therefore might provide an over-conservative approximation. A more realistic and more flexible two-parametric law, such as, e.g., Weibull distribution, might be more appropriate and more practical as a suitable probability distribution of the random times, t and θ. Its use, however, will make our analysis unnecessarily more complicated, and our goal is not so much to dot all the i’s and cross all the t’s in the problem in question, but rather to demonstrate that the attempt to use PPM to pre-quantify the role of the human factor in a particular HITL situation is quite fruitful.

When the most likely time $t_0$ of making the go-ahead decisions and time ${\theta }_0$ of the actual landing are equal, the Equation (17) yields:

$$P_{*}=P_{*}\left(\frac{t_0}{\widehat{T}},\frac{{\theta }_0}{\widehat{T}}\right)=\text{exp}\left(-\frac{{\widehat{T}}^2}{2t_0^2}\right)\left[1+\sqrt{\pi }\frac{\widehat{T}}{2t_0}\text{exp}\left({\left(\frac{\widehat{T}}{2t_0}\right)}^2\right)erf\left(\frac{\widehat{T}}{2t_0}\right)\right]$$

(18)

For large $\frac{\widehat{T}}{t_0}$ ratios $\left(\frac{\widehat{T}}{t_0}\ge 3\right)$ the second term in the brackets becomes large compared to unity, so that only this term should be considered. The calculated probabilities of exceeding a certain time level, $\widehat{T}$ based on the Equation (18), are shown in Table 1. In the third row of this table we indicate, for the sake of comparison, the probabilities, P, of exceeding the given time, $\widehat{T}$ when only the time $t_0$ or only the time ${\theta }_0$ is different from zero, i.e., for the special case that is mostly remote from the equal time case $t_0={\theta }_0.$ Clearly, the probabilities computed for other possible combinations of the times $t_0$ and ${\theta }_0$ could be found between the calculated probabilities $P_{*}$ and P.

The following major conclusions can be drawn from the computed data:

(1)

the probability that the total time of operation (the time of decision making and the time of landing) exceeds the given time level $\widehat{T}$ rapidly increases with an increase in the time of operation and

(2)

the probability of exceeding the time level $\widehat{T}$ is considerably higher, when the most likely times of decision making and of landing are finite, and particularly are equal to each other, in comparison with the situation when one of these times is significantly shorter than the other, i.e., zero or next-to-zero.

Table 1. The probability $P_{*}$ that the operation time exceeds a certain time level $\widehat{T}$vs. the ratio $\widehat{T}/t_0$ of this time level to the most likely time $t_0$ of decision making for the case when the time $t_0$ and the most likely time ${\theta }_0$ time of actual landing are the same. For the sake of comparison, the probability P of exceeding the time level $\widehat{T}$ when either the time $t_0$ or the time ${\theta }_0$ are zero, is also indicated.

$\widehat{T}/t_0$	6	5	4	3	2
P*	6.562 × 10−4	8.553 × 10−3	6.495 × 10−2	1.914 × 10−1	6.837 × 10−1
P	1.523 × 10−8	0.373 × 10−5	0.335 × 10−3	1.111 × 10−2	1.353 × 10−1
P*/P	4.309 × 104	2.293 × 103	1.939 × 102	1.723 × 101	5.053

Table 1. The probability $P_{*}$ that the operation time exceeds a certain time level $\widehat{T}$vs. the ratio $\widehat{T}/t_0$ of this time level to the most likely time $t_0$ of decision making for the case when the time $t_0$ and the most likely time ${\theta }_0$ time of actual landing are the same. For the sake of comparison, the probability P of exceeding the time level $\widehat{T}$ when either the time $t_0$ or the time ${\theta }_0$ are zero, is also indicated.

$\widehat{T}/t_0$	6	5	4	3	2
P*	6.562 × 10−4	8.553 × 10−3	6.495 × 10−2	1.914 × 10−1	6.837 × 10−1
P	1.523 × 10−8	0.373 × 10−5	0.335 × 10−3	1.111 × 10−2	1.353 × 10−1
P*/P	4.309 × 104	2.293 × 103	1.939 × 102	1.723 × 101	5.053

This is especially true for short operation times: the ratio P_*/P of the probability P_* of exceeding the time level $\widehat{T}$ in the case of $t_0={\theta }_0$ to the probability P of exceeding this level in the cases $t_0=0$ or ${\theta }_0=0$ decreases rapidly with an increase in the time of operation. Thus, there exists a significant incentive for reducing the operation time. The importance of this intuitively obvious fact is quantitatively assessed by the Table 1 data.

The Table 1 data can be used, particularly, to train the human for a quick reaction in the HLS situation. If, for instance, the expected duration of the lull is 30 s, and the specified probability of exceeding this time is $P={10}^{-3},$ then, as evident from the table data, the times for decision making and actual landing should not exceed 5.04 s each. Another useful information that could be drawn from the calculated data is whether it is possible at all to train a human to react in just a couple of seconds. If not, then one should decide on a broader involvement of more sophisticated, more powerful and more expensive equipment to do the job. If pursuing such an effort is decided upon, then developed PPM and extensive probabilistic SA based on this model will be needed to determine the most effective ways to go.

The probability that the normally distributed lull time L is found below a certain level $\widehat{L}$ is

$$P_l=P_l\left(\frac{\sigma }{\widehat{L}},\frac{l_0}{\widehat{L}}\right)={\displaystyle \underset{-\infty }{\overset{\widehat{L}}{\int }}{f}_l(l)dl=}\frac{1}{2}\left[1+erf\left(\frac{\widehat{L}-l_0}{\sqrt{2}\sigma }\right)\right]=\frac{1}{2}\left[1+erf\left(\frac{1-\frac{l_0}{\widehat{L}}}{\sqrt{2}\frac{\sigma }{\widehat{L}}}\right)\right]$$

(19)

The probability that the lull time is exceeded can be determined by equating the times $\widehat{T}=\widehat{L}=T$ and computing the product

$$P_A = P_{*}\left(\frac{t_0}{T},\frac{{\theta }_0}{T}\right)P_l\left(\frac{\sigma }{T},\frac{l_0}{T}\right)$$

(20)

of the probability, $P_{*}\left(\frac{t_0}{T},\frac{{\theta }_0}{T}\right),$ that the time of operation exceeds a certain level, T, and the probability, $P_l\left(\frac{\sigma }{T},\frac{l_0}{T}\right),$ that the duration of the lull is shorter than the time T. The Equation (19) considers the role of the sea condition (through the values of the most likely duration, $l_0,$ of the random lull time, L, and its standard deviation, $\sigma$ ), the role of the human factor, $t_0$ (the total most likely time required for the officer-on-ship-board and the helicopter pilot to make their go-ahead decisions for landing), and the role of the most likely time, ${\theta }_0,$ of actual landing (which characterizes both the qualification of the helicopter pilot and the qualities/behavior of the flying machine) on the probability of safe landing.

After a low enough allowable value, $P_A^{*},$ of the probability, $P_A,$ is agreed upon, one could establish the allowable maximum most likely time, ${\theta }_0,$ of landing. The actual time of landing can be assessed as $\Delta t^{*}={\theta }_0\sqrt{-2\text{ln}{P}_l},$ where $P_l$ is the allowable probability that the level $\Delta t^{*}$ is exceeded. If, for instance, ${\theta }_0=10\text{sec}$ and $P_l={10}^{-5},$ then $\Delta t^{*}=48.0$ s.

The cumulative probability distribution function for the extreme vertical ship velocity ${\dot{z}}^{*}$ (the probability that the vertical velocity of the ship deck at the HLS location is below a certain level ${\dot{z}}^{*})$ due to her motions in heave, pitch and roll in waves can be expressed, using the extreme value distribution (EVD) technique. This technique leads to the following distribution:

$$F_{{\dot{z}}^{*}}({\dot{z}}^{*})=\text{exp}\left[-n^{*}\text{exp}\left(-\frac{{\left({\dot{z}}^{*}\right)}^2}{2D_{\dot{z}}}\right)\right]-\text{exp}\left(-n^{*}\right)$$

(21)

Here $D_{\dot{z}}$ is the variance of the ship’s vertical velocity $\dot{z}$$n^{*}=\frac{\Delta t^{*}}{{\tau }_e}$ is the expected number of ship oscillations during the landing time $\Delta t^{*};$ and ${\tau }_e$ is the effective period of the ship motions in irregular seas. The formula $n^{*}=\frac{\Delta t^{*}}{{\tau }_e}$ reflects an assumption that a ship in irregular waves behaves as a narrow-band filter that enhances the oscillations whose frequencies are close to the ship’s own natural frequency (in still water) in heave and pitch and suppresses all the other frequencies. If the landing time (measured by the expected number $n^{*}$ of ship oscillations) is significant, the second term in Equation (21) becomes small and can be omitted. If the level ${\dot{z}}^{*}$ is zero, the function $F_{{\dot{z}}^{*}}({\dot{z}}^{*})$ becomes $F_{{\dot{z}}^{*}}(0)=\text{exp}(-n^{*}),$ and, for a high enough $n^{*}$ value, we still obtain $F_{{\dot{z}}^{*}}(0)=0.$ If, however, for a finite $n^{*}$ (which is never zero and cannot be smaller than one) the level ${\dot{z}}^{*}$ is high, the function $F_{{\dot{z}}^{*}}({\dot{z}}^{*})$ becomes $F_{{\dot{z}}^{*}}(\infty )=1.$

The landing velocity, V, when landing on a solid ground, is a random variable that could be assumed to be normally distributed:

$$f_v(v)=\frac{1}{\sqrt{2\pi D_v}}\text{exp}\left[-\frac{{\left(v-\overline{v}\right)}^2}{2D_v}\right]$$

(22)

where $\overline{v}$ is the mean value of the velocity V and $D_v$ is its variance. Then the probability distribution function of this velocity (i.e., the probability that the random velocity V is below a certain value v) is

$$F_v(v)=\frac{1}{2}\left[1+erf\left(\frac{v-\overline{v}}{\sqrt{2D_v}}\right)\right]$$

(23)

The allowable level $v^{*}$ of the landing velocity V, assuming a large enough probability $F_v(v^{*}),$ can be found from the Equation (23) by substituting the $v$ value with the $v^{*}$ value. The cumulative distribution function for the relative vertical velocity $V_r=V+{\dot{Z}}^{*}$ of the helicopter with respect to the ship’s deck can be determined as:

$$\begin{array}{l}\mathrm{F}(\mathrm{v})=\mathrm{P}({\mathrm{V}}_{\mathrm{r}}\le \mathrm{v})={\displaystyle \underset{-\infty }{\overset{{\mathrm{v}}_{\mathrm{r}}}{\int }}{\mathrm{f}}_{\mathrm{v}}(\mathrm{v}){\mathrm{F}}_{{\dot{\mathrm{z}}}^{*}}({\mathrm{v}}_{\mathrm{r}}-\mathrm{v})\mathrm{d}\mathrm{v}}=\\ =\frac{1}{\sqrt{2\mathrm{\pi }{\mathrm{D}}_{\mathrm{v}}}}{\displaystyle \underset{-\infty }{\overset{{\mathrm{v}}_{\mathrm{r}}}{\int }}\text{exp}\left[-\frac{{\left(\mathrm{v}-\overline{\mathrm{v}}\right)}^2}{2{\mathrm{D}}_{\mathrm{v}}}\right]}\left[\text{exp}\left(-{\mathrm{n}}^{*}\text{exp}\left(-\frac{{\left({\dot{\mathrm{z}}}_{*}\right)}^2}{2{\mathrm{D}}_{\dot{\mathrm{z}}}}\right)\right)-\text{exp}\left(-{\mathrm{n}}^{*}\right)\right]\mathrm{d}\mathrm{v}=\\ =\frac{1}{\sqrt{\mathrm{\pi }}}{\displaystyle \underset{0}{\overset{\infty }{\int }}\text{exp}\left[-{\left(\mathrm{\xi }-\mathrm{\gamma }\right)}^2\right]\left[\text{exp}\left(-{\mathrm{n}}^{*}\text{exp}(-\mathrm{\delta }{\mathrm{\xi }}^2)\right)-\text{exp}(-{\mathrm{n}}^{*})\right]\mathrm{d}\mathrm{\xi }}\end{array}$$

(24)

Here $\xi =\frac{v}{\sqrt{2D_v}}$ is the variable of integration; $\gamma =\frac{v_r-\overline{v}}{\sqrt{2D_v}}={\gamma }_t-{\gamma }_v$ is the safety factor associated with the ship motion, which is computed as the difference between the total safety factor ${\gamma }_t=\frac{v_r}{\sqrt{2D_v}},$ when landing in rough seas on the ship’s deck, and the safety factor ${\gamma }_v=\frac{\overline{v}}{\sqrt{2D_v}},$ when landing on the solid ground; and $\delta =\frac{D_r}{D_{\dot{z}}}$ is the ratio of the variance, $D_r,$ of the relative velocity, $V_r,$ of the helicopter undercarriage with respect to the ship’s deck to the variance , $D_{\dot{z}},$ of the ship’s vertical velocity $\dot{z}.$ The Equation (24) determines the probability that the random relative velocity, $V_r$ , of the helicopter undercarriage with respect to the ship’s deck remains below a certain value, $v_r.$ When $D_{\dot{z}}\to \infty$ (significant ship motions) and/or $D_r\to 0$ (insignificant absolute vertical velocities of the helicopter), the ratio $\delta =\frac{D_r}{D_{\dot{z}}}\to 0.$ This situation is unfavorable for the undercarriage strength: the probability that the extreme vertical velocity of the helicopter during its landing on the ship’s deck remains below a certain $v$ value is zero: $F(v)=0.$

For large enough (but not very large) $n^{*}$ values (landing lasts for a rather long time), the Equation (24) yields:

$$F(v)=\frac{1}{\sqrt{\pi }}{\displaystyle \underset{0}{\overset{\infty }{\int }}\text{exp}\left[-{\left(\xi -\gamma \right)}^2-n^{*}\text{exp}(-\delta {\xi }^2)\right]d\xi }$$

(25)

For very large $n^{*}$ values we have: $F(v)=0.$ Such a situation is also unfavorable for safe landing. For not very large $n^{*}$ values, however (landing does not take long), but large $\delta =\frac{D_r}{D_{\dot{z}}}$ ratios (significant variance of the relative velocity, but insignificant variance of the velocity of the vertical ship motions), the Equation (25) yields:

$$F(v)=\frac{1}{\sqrt{\pi }}{\displaystyle \underset{0}{\overset{\infty }{\int }}\text{exp}\left[-{\left(\xi -\gamma \right)}^2\right]d\xi =\frac{1}{2}}\left(1+erf\gamma \right)=\frac{1}{2}\left[1+erf\left(\frac{v-\overline{v}}{\sqrt{2D_v}}\right)\right]$$

(26)

This formula is not (and should not be) different from the formula for the case of safe landing on a solid ground. For small $\delta =\frac{D_r}{D_{\dot{z}}}$ ratios (but still large $n^{*}$ values), the Equation (26) yields:

$$F(v)=\frac{1}{2}\text{exp}(-n^{*})\left[1+erf\left(\frac{v-\overline{v}}{\sqrt{2D_v}}\right)\right]$$

(27)

This formula contains a factor $\text{exp}(-n^{*})$ that accounts for the finite duration of landing. When $n^{*}$ is small (very short time of landing), the situation is not different from the case of landing on a solid ground. When $n^{*}$ is large, the situation is certainly unfavorable: $F(v)=0.$ Thus, the probability that a certain level $v_{*}$ of the relative velocity $V_r$ of the helicopter with respect to the ship’s deck is not exceeded can be found as $P_B=F(v_{*}).$ The probability $P_C$ that the undercarriage strength will not be compromised can be evaluated as a product of the probability 1 − P_A that the helicopter will be able to land during the lull time and the probability $P_B=F(v_{*})$ that the relative velocity of the helicopter with respect to the ship’s deck will not exceed a certain allowable (specified) level $v^{*}:$$P_C=(1-P_A)P_B.$

If the landing velocity, $v_0,$ on the ground is treated as a deterministic value (if the variance $D_v$ of this velocity can be considered zero) and the allowable relative velocity $v^{*}$ (which is due to the undercarriage structure only) are known, then the condition of safe landing becomes quite simple. Indeed, in such a situation the Equation (26) results in the following simple formula for the extreme value ${\dot{z}}^{*}$ of the ship’s vertical velocity:

$${\dot{z}}^{*}=\sqrt{2D_{\dot{z}}\left[\text{ln}{n}^{*}-\text{ln}\left(-\text{ln}{P}_D+\text{exp}(-n^{*})\right)\right]}$$

(28)

and the condition of safe landing becomes ${\dot{z}}^{*}\le v^{*}-v_0.$

Let the most likely times of making the go-ahead decisions and of the actual landing be the same and equal to t₀ = θ₀ = 10 s, the most likely (mean) lull time be l₀ = 20 s, and the standard deviation of the lull time be σ = 5 s. The calculated data are shown in Table 2. As evident from the table data, the probability $P_A$ that the time of operations exceeds the duration of the lull increases rapidly with the decrease in the ratio of the lull duration to the most likely time of either the decision making or the landing process, while the probability that the lull duration is below a certain value decreases with the decrease in the ratio of this value to the most likely lull duration. The first effect prevails, and the product of these two probabilities (defining the likelihood that the helicopter is not successful in landing on the ship’s deck during the lull time) increases with the decrease in the duration of the lull time almost as fast as the probability of the operation time does. It is only for very long times of operation that the probability $P_l$ of exceeding a certain time limit starts to play an appreciable role. We conclude therefore that in the situation in question the human factor associated with the decision making times plays a significant role, as far as safe landing is concerned. The developed model enables one to quantitatively assess this intuitively obvious role.

Let, for instance, the number of ship oscillations during the time of landing be $n^{*}=5,$ the required (specified) probability of safe landing be as high as $P_D=0.9999,$ the variance of the vertical velocity of the ship due to her motions during the lull period be $D_{\dot{z}}=0.030$ m/s, and the extreme value of the relative vertical velocity computed as the difference between the specified (allowable) velocity $v^{*}$ of the helicopter and the actual ground landing velocity $v_0,$ be $v^{*}-v_0=0.8$ m/s. Then the level of the relative velocity at the moment of landing is:

$$\begin{array}{l}{\dot{z}}^{*}=\sqrt{2D_{\dot{z}}\left[\text{ln}{n}^{*}-\text{ln}\left(-\text{ln}{P}_D+\text{exp}(-n^{*})\right)\right]}=\sqrt{2x0.030\left[\text{ln}5-\text{ln}(-\text{ln}0.9999+\text{exp}(-5))\right]}=\\ =0.629m/s⊲0.8m/s\end{array}$$

(29)

Hence, landing in this case can be permitted and is expected to be safe.

It could be concluded the PPM approach enables one to quantify the role of the human factor, along with other uncertainty sources, in the HLS situation. Safe landing can be expected if the probability that it takes place during the lull time is sufficiently high.

Table 2. The probability $P_A$ of safe landing vs. the ratio $T/t_0$ of the normally distributed duration $T$ of the lull to the most likely time $t_0$ of decision making or the most likely time ${\theta }_0$ of actual landing, when the times $t_0$ and ${\theta }_0$ are equal.

$T/t_0$	6	5	4	3	2
$P_{*}$	6.562 × 10−4	8.553 × 10−3	6.495 × 10−2	1.914 × 10−1	6.837 × 10−1
$T/l_0$	3.0	2.5	2.0	1.5	1.0
$P_l$	1.0	1.0	0.9999	0.9770	0.5000
$P_A$	6.562 × 10−4	8.553 × 10−3	6.494 × 10−2	1.870 × 10−1	3.418 × 10−1

Table 2. The probability $P_A$ of safe landing vs. the ratio $T/t_0$ of the normally distributed duration $T$ of the lull to the most likely time $t_0$ of decision making or the most likely time ${\theta }_0$ of actual landing, when the times $t_0$ and ${\theta }_0$ are equal.

$T/t_0$	6	5	4	3	2
$P_{*}$	6.562 × 10−4	8.553 × 10−3	6.495 × 10−2	1.914 × 10−1	6.837 × 10−1
$T/l_0$	3.0	2.5	2.0	1.5	1.0
$P_l$	1.0	1.0	0.9999	0.9770	0.5000
$P_A$	6.562 × 10−4	8.553 × 10−3	6.494 × 10−2	1.870 × 10−1	3.418 × 10−1

6. “Miracle-on-the-Hudson”: Emergency Landing and Quantitative Aftermath

“The only real voyage of discovery consists not in seeing new landscapes, but in having new eyes”—Marcel Proust, French author and critic

The PPM concept was applied [10] as a quantitative “aftermath” to the famous 2009 US Airways “Miracle-on-the-Hudson” successful landing (ditching), as well as to the infamous 1998 Swiss Air “UN-shuttle” disaster. It has been concluded that the developed formalisms, after trustworthy input data are obtained (using, e.g., flight simulators or Delphi method) might be applicable even beyond the vehicular domain in various HITL situations, when a short-term high human performance is imperative and therefore the ability to quantify it is highly desirable. It has been concluded also that the following ten factors that affect mission success and safety in various HITL situations, including emergency landing, should be considered: (1) human performance (capacity) factor (HCF); (2) navigation, information and control instrumentation (equipment) factor; (3) vehicle (object of control) factor; (4) environmental factor and (5–10) six interfaces between (interactions of) the above factors. All these factors and their interfaces are associated with uncertainties that contribute to the cumulative probability that a certain pre-established safety criterion for a particular anticipated casualty or a mishap is violated. These uncertainties are characterized by their probability distributions, safety criteria, consequences of possible failure and the levels of the acceptable risks.

When adequate human performance in a particular HITL situation is imperative, ability to quantify the human factor is highly desirable. Such a quantification could be done particularly by comparing the actual or the anticipated MWL with the likely (“available”) HCF, as it is done by the double-exponential probability Equation (1). The MWL vs. HCF based PPM models and their modifications and generalizations can be helpful, after appropriate algorithms are developed and extensive SA are carried out, to evaluate the role that the human plays, in terms of his/her ability (capacity) to cope with a MWL in various situations, when human factor, equipment/instrumentation performance and uncertain and often harsh environments contribute jointly to the success and safety of a task or a mission. These models can be used also to assess the risk of a particular mission success and safety, with consideration of the HITL performance; to develop guidelines for personnel selection and training; to choose the appropriate simulation conditions; and/or to decide if the existing levels of automation and the employed equipment (instrumentation) are adequate in possible off-normal situations (if not, additional and/or more advanced and perhaps more expensive equipment or instrumentation should be developed, tested and installed).

In the “Miracle-on-the-Hudson” analysis [10] the probability distribution function Equation (1) and the “swiftness-in-reaction” PPM formalism described in the HLS [8,9] analysis were applied for the evaluation of the likelihood of a human non-failure in an emergency landing situation. We have shed HITL “probabilistic light” on the two well-known events: the famous 2009 “Miracle-on-the-Hudson” event (Figure 4) and the infamous 1998 “UN-shuttle” disaster. These two recent events were chosen to illustrate the substance and fruitfulness of the PPM approach in the landing on water and, more specifically, in a ditching situation.

Figure 4. The “Miracle-on-the-Hudson” landing.

Figure 4. The “Miracle-on-the-Hudson” landing.

As far as the “Miracle-on-the-Hudson” is concerned, a quantitative assessments of why such a “miracle” could have actually occurred, and what had been and had not been a “miracle” indeed in the incident in question has been addressed. It has been argued and demonstrated that the miracle was not so much that Captain Sullenberger managed to land the aircraft in an emergency situation, but that Captain Sullenberger, a pilot with an extraordinary high HCF turn out to be behind the aircraft wheel in a particular off-normal situation (see Table 3 and Figure 4). As to the “UN-shuttle” crash, it has been argued that the crash occurred because of the low HCF of the aircraft crew (despite their in general high qualifications and most likely adequate training) in a moderately off-normal situation that they encountered with. The situation was, in effect, much less demanding than the “Miracle-on-the-Hudson” one.

Table 3. Estimated Sullenberger’s HCF.

No.	Relevant Qualities	Relative HCF Rating F/F0 *	Comments
1	psychological suitability for the given task	3.2	(1) 57-year-old former fighter pilot who had been a commercial airline pilot since leaving the US Air Force in 1980. He is also a safety expert and a glider pilot. “I was sure I could do it”, Captain Sullenberger said in an interview. “The entire life up to this moment was a preparation for this moment”. “I am not just a pilot of that flight. I am also a pilot who has flown for 43 years…”; (2) Probability of human non-failure in normal flight conditions is assumed to be 100%; (3) The formula $p=\text{exp}(1-\frac{G^2}{G_0^2})$ would have to be used to evaluate the probability of non-failure in the case of a pilot of ordinary skills. The computed numbers are shown in [10] in parentheses. The computed numbers show that such a pilot would definitely fail in the off-normal situation in question. Captain Sullenberger
2	professional qualifications and experience	3.9
3	level, quality and timeliness of past and recent training	2.0
4	mature (realistic) and independent thinking	3.2
5	performance sustainability (predictability, consistency)	3.2
6	ability to concentrate and act in cold blood (“cool demeanor”) in hazardous and even in life threatening situations	3.3
7	ability to anticipate (“expecting the unexpected”)	3.2
8	ability to operate effectively under pressure	3.4
9	self-control in hazardous situations	3.2
10	ability to make a substantiated decision in a short period of time (“we are going to be in the Hudson”)	2.8
	Average FOM	3.14

* This is just an example that shows that the approach makes physical sense. Actual numbers should be obtained using FOAT on a simulator and confirmed by an independent approach, such as, say, Delphi method [12,23].

Table 3. Estimated Sullenberger’s HCF.

No.	Relevant Qualities	Relative HCF Rating F/F0 *	Comments
1	psychological suitability for the given task	3.2	(1) 57-year-old former fighter pilot who had been a commercial airline pilot since leaving the US Air Force in 1980. He is also a safety expert and a glider pilot. “I was sure I could do it”, Captain Sullenberger said in an interview. “The entire life up to this moment was a preparation for this moment”. “I am not just a pilot of that flight. I am also a pilot who has flown for 43 years…”; (2) Probability of human non-failure in normal flight conditions is assumed to be 100%; (3) The formula $p=\text{exp}(1-\frac{G^2}{G_0^2})$ would have to be used to evaluate the probability of non-failure in the case of a pilot of ordinary skills. The computed numbers are shown in [10] in parentheses. The computed numbers show that such a pilot would definitely fail in the off-normal situation in question. Captain Sullenberger
2	professional qualifications and experience	3.9
3	level, quality and timeliness of past and recent training	2.0
4	mature (realistic) and independent thinking	3.2
5	performance sustainability (predictability, consistency)	3.2
6	ability to concentrate and act in cold blood (“cool demeanor”) in hazardous and even in life threatening situations	3.3
7	ability to anticipate (“expecting the unexpected”)	3.2
8	ability to operate effectively under pressure	3.4
9	self-control in hazardous situations	3.2
10	ability to make a substantiated decision in a short period of time (“we are going to be in the Hudson”)	2.8
	Average FOM	3.14

* This is just an example that shows that the approach makes physical sense. Actual numbers should be obtained using FOAT on a simulator and confirmed by an independent approach, such as, say, Delphi method [12,23].

Based on the executed analysis, we have come up with the following ten major principles (“ten commandments”) that should be followed in the PPM-based HCF vs. MWL approach:

(1)

HCF is viewed as an appropriate quantitative measure of the human ability to cope with an elevated short-term MWL;

(2)

it is the relative levels of the MWL and HCF that determine the probability of human non-failure in a particular HITL situation;

(3)

such a probability cannot be low, but need not be higher than necessary either: it has to be adequate for a particular foreseeable application, mission or a situation;

(4)

when adequate human performance is imperative, ability to quantify it is highly desirable, even a must, especially if one intends to optimize and assure adequate HITL performance;

(5)

one cannot assure adequate human performance by just conducting routine today’s human psychology based efforts, which might provide appreciable improvements, but do not quantify human behavior and performance (in addition, these efforts might be too and unnecessarily costly), and/or by just following the existing “best practices” that are not aimed at a particular situation or an application; the events of interest are certainly rare events, and “best practices”: might or might not be applicable;

(6)

MWLs and HCFs should consider, to an extent possible, the most likely anticipated situations; obviously, the MWLs are and HCFs should be different for a jet fighter pilot, for a pilot of a commercial aircraft, or for a helicopter pilot, and should be assessed and specified differently;

(7)

PPM is an effective means for improving the state-of-the-art in the HITL field: nobody and nothing is perfect, and the difference between a failed human performance and a successful one is ”merely” in the level of the probability of non-failure;

(8)

failure oriented accelerated testing (FOAT) on a flight simulator is viewed as an important constituent part of the PPM concept in various HITL situations: it is aimed at better understanding of the psychological and non-psychological (“physical”) factors underlying possible failures; it might be complemented by the Delphi effort;

(9)

extensive predictive modeling is another, in addition to the FOAT on a flight simulator, important constituent of the effort, and, in combination with highly focused and highly cost effective FOAT, is a powerful and effective means to quantify and perhaps nearly eliminate human failures;

(10)

consistent, comprehensive and psychologically meaningful PPM plus FOAT assessments can lead to the most feasible HITL qualification (certification) methodologies, practices and specifications.

7. Two Men in a Cockpit: Probability of Non-Failure if One of Them Gets Incapacitated

“I will not take up your time, dear boy, with telling you what is the matter with me. Life is brief, and you might pass away before I had finished”—Jerome K. Jerome, English writer and humorist, “Three Men in a Boat (to say nothing of the dog)”

We apply the modified double-exponential Equation (1)

$$Q(F)=1-\text{exp}\left[-\frac{t}{T}\frac{G^2}{G_0^2}\text{exp}\left(-\frac{F^2}{F_0^2}\right)\right]$$

(30)

to a situation, when one of the two equally and highly qualified pilots becomes, for one reason or another, incapacitated at a certain moment of time in the flight (such a mishap is referred to as an accident), and, because of that, his mate has to cope with a total, say, twice-as-high, MWL [13]. It does not actually have to be a twice-as-high MWL, but we have chosen this number for the sake of simplicity. In the above formula, $Q(F)$ is the probability of failure of the pilot to perform his/her duties, t/T is the (nonrandom) ratio of the elapsed operation time, t, to the total duration, T, of the flight including landing (0 ≤ t ≤ T), G is the total MWL treated as a non-random variable, G₀ is the most likely (specified) value of the MWL in the ordinary conditions, F is the HCF (treated as a random variable), and F₀ is the most likely (specified) non-random value of this factor.

The Equation (30) makes physical sense. Indeed, when t = 0 (at the beginning of the flight) and/or when G = 0 (very low MWL) and/or when F→∞ (highly skilled, highly trained and highly effective operator with a high HCF), then the probability $Q(F)$ of the navigator’s failure is zero. When t→∞ (vehicle operates for a very long time) and/or G→∞ (the MWL is extremely high), while the HCF F is finite and might be not very high, then the probability $Q(F)$ of the operator failure is equal to one.

Examine a situation at the moment t of time after an aircraft took off. The flight duration is T. If the MWL G is evenly distributed between the two pilots, then, using the Equation (30), we write the probability of failure for each pilot as

$$Q_{1/2}(F)=1-\text{exp}\left[-\frac{T-t}{T}\frac{G^2}{4G_0^2}\text{exp}\left(-\frac{F^2}{F_0^2}\right)\right]$$

(31)

If at this moment of time an accident occurs, and, as a result of this, one of the pilots becomes incapacitated, then his mate will have to cope with the entire workload G, and the probability that he/she fails during the remaining time (T − t) can be found as

$$Q_1(F)=1-\text{exp}\left[-\frac{T-t}{T}\frac{G^2}{G_0^2}\text{exp}\left(-\frac{F^2}{F_0^2}\right)\right]$$

(32)

From Equations (31) and (32) we have:

$$Q_{1/2}(F)=1-{[1-Q_1(F)]}^{1/4}$$

(33)

If the accident occurs at the last moment t = T of the flight, and the MWL G is not very large (say, because the environmental conditions are favorable and the navigation equipment is adequate and reliable), then both the probabilities $Q_{1/2}(F)$ and $Q_1(F)$ become zero: no casualty could possibly occur. If the accident occurs at the initial moment of time t = 0, then the Equations (17) and (18) yield:

$$Q_{1/2}(F)=1-\text{exp}\left[-\frac{G^2}{4G_0^2}\text{exp}\left(-\frac{F^2}{F_0^2}\right)\right],Q_1(F)=1-\text{exp}\left[-\frac{G^2}{G_0^2}\text{exp}\left(-\frac{F^2}{F_0^2}\right)\right]$$

(34)

If, in such a situation, the MWL G during the flight is high and the HCF F has a finite value, then the probabilities $Q_{1/2}(F)$ and $Q_1(F)$ are equal to one: human failure will definitely occur and, hence, the aircraft casualty will certainly take place. If, however, the total MWL G is low, while the HCF F is significant, then the probabilities $Q_{1/2}(F)$ and $Q_1(F)$ are equal to zero: no casualty is likely to occur.

A casualty could not possibly occur if one of the following three cases takes place: (1) none of the pilots fails to perform his/her duties, or if (2) the captain fails to perform his/her duties, but the first officer takes over completely and successfully the operation of the aircraft, or if (3) the first officer fails to perform his/her duties, but the captain takes over completely and successfully the operation of the aircraft. The probability of the first event is ${(1-Q_{1/2})}^2.$ The probabilities of the second and the third events are the same and are $Q_{1/2}{(1-Q_1)}^2.$ The probability of an accident free navigation can be then evaluated as

$$P={(1-Q_{1/2})}^2+2Q_{1/2}{(1-Q_1)}^2=1+Q_{1/2}(Q_{1/2}-2Q_1)$$

(35)

The probability of a casualty is therefore

$$Q=1-P=Q_{1/2}(2Q_1-Q_{1/2})$$

(36)

If none of the pilots fails $(Q_{1/2}=Q_1=0),$ then no accident could possibly occur (Q = 0). If one of the pilots is unable to cope even with the half of the total workload $(Q_{1/2}=1)$ then, certainly, he/she will not be able to cope with the total load either, so that Q = 1 as well, and the probability of a casualty becomes Q = 1. The probabilities $Q_{1/2}$ and Q are computed as functions of the probability $Q_1$ in Table 4.

Table 4. Probabilities of failure at different MWL conditions.

MWL Conditions
Q1	0	0.0001	0.0005	0.001	0.005	0.05	0.10	0.20	0.30
Q1/2	0	2.5 × 10−5	0.0001	0.0003	0.00125	0.01274	0.0260	0.0543	0.0853
Q	0	4.4 × 10−9	8.75 × 10−8	5.25 × 10−7	1.09 × 10−5	0.00111	0.00452	0.01877	0.0439
Q1	0.4	0.50	0.60	0.70	0.80	0.85	0.90	0.95	1.00
Q1/2	0.1199	0.1591	0.2047	0.2599	0.3313	0.3777	0.4377	0.6239	1.00
Q	0.0815	0.1338	0.2037	0.2963	0.4203	0.4994	0.5963	0.7961	1.00

Table 4. Probabilities of failure at different MWL conditions.

MWL Conditions
Q1	0	0.0001	0.0005	0.001	0.005	0.05	0.10	0.20	0.30
Q1/2	0	2.5 × 10−5	0.0001	0.0003	0.00125	0.01274	0.0260	0.0543	0.0853
Q	0	4.4 × 10−9	8.75 × 10−8	5.25 × 10−7	1.09 × 10−5	0.00111	0.00452	0.01877	0.0439
Q1	0.4	0.50	0.60	0.70	0.80	0.85	0.90	0.95	1.00
Q1/2	0.1199	0.1591	0.2047	0.2599	0.3313	0.3777	0.4377	0.6239	1.00
Q	0.0815	0.1338	0.2037	0.2963	0.4203	0.4994	0.5963	0.7961	1.00

The following conclusions could be drawn from the computed data: (1) The probability of a casualty is considerably lower than the probability of an accident, i.e., the failure of one of the pilots to cope with the total workload, especially when the latter probability is low. If one wants to keep the probability of a casualty below, say, 10−5 = 0.001%, then the probability that one of the pilots cannot cope, if necessary, with the entire workload should be kept below 0.5%. If the latter probability is 10%, then the probability of a casualty becomes as high as 0.45%; (2) The probability of a casualty is lower than the probability of failure of one of the pilots to cope with a half of the workload, if the probability of failure of one of the pilots to cope with a total workload is below $Q_1=1-\frac{1}{2\sqrt[3]{2}}=0.6031,$ and is higher than the probability of failure of one of the pilots to cope with a half of the workload, if the probability of failure of one of the pilots to cope with a total workload is higher than the above number. Certainly, there is a strong incentive to make the probability of failure of each pilot at ordinary conditions as low as possible. The Table 3 data enable one to quantify this obvious conclusion; (3) The probability that one of the pilots becomes unable to cope with the total workload is always higher, of course, than the probability than he/she becomes incapable to cope with half of the workload. This difference is especially high for low probabilities of failure.

From Equation (32) we find

$$\frac{F}{F_0}=\sqrt{-\text{ln}\left[-\frac{T}{T-t}\frac{G_0^2}{G^2}\text{ln}(1-Q_1)\right]}$$

(37)

If the accident occurred when t/T = 0.5, and the “force majeure” MWL G is twice as high as the ordinary (specified) MWL G₀, then

$$\frac{F}{F_0}=\sqrt{-\text{ln}\left[-\frac{1}{2}\text{ln}(1-Q_1)\right]}$$

(38)

If, for instance, $Q_1={10}^{-5},$ then F/F₀ = 3.49. Hence, the extraordinary (“force majeure”) HCF should be about 3.5 fold larger than the ordinary value of this factor. If one requires that the probability of failure is $Q_1={10}^{-7},$ then the required predicted F/F₀ ratio should be as high as F/F₀ = 4.10. In a hypothetical situation, when the accident occurs at the initial moment of time and the pilot and the controller decide nevertheless to continue the flight, the last formula yields:

$$\frac{F}{F_0}=\sqrt{-\text{ln}\left[-\frac{1}{4}\text{ln}(1-Q_1)\right]}$$

(39)

For $Q_1={10}^{-5}$ and $Q_1={10}^{-7}$ we obtain F/F₀ = 3.59 and F/F₀ = 4.18, respectively. Hence, the time of an accident has a relatively small effect on the increase in the “force majeure” human factor.

In order to assess the role of the time moment, when an accident occurs, examine the following problem. If the casualty did not occur during the time t, what is the probability Q* that it will occur during the remaining time (T – t) of the flight, if the specified probability of the occurrence of the casualty for the entire flight is Q? Two events have to take place in order that the accident occurs during the time (T – t): (1) it should not occur during the time t and (2) has to occur during the time (T – t).The probability that the casualty occurs during the time t is Q(t/T). The probability that the casualty occurs during the remaining time (T – t), provided that it did not occur during the time t, is (1 − Q(t/T))Q*. The probability that the casualty occurs during the total time T can be found as Q = Q(t/T) − (1 − Q(t/T))Q*. Hence, $Q_{*}=Q\frac{1-\frac{t}{T}}{1-Q\frac{t}{T}}$ and $Q=Q\frac{Q_{*}}{1-(1-Q_{*})\frac{t}{T}}.$ The computed Q_* values indicate that the probability Q_* that the casualty occurs during the remaining time (T – t) of the flight if it did not occur during the initial time t of the flight is always smaller than the specified probability Q of the casualty occurrence during the total flight time T, and decreases with an increase in the total flight time. At the last moment t = T the probability Q_* is zero no matter how high the probability Q is, unless the latter probability is equal to one. The probability Q_* increases with an increase in the specified probability Q. the two probabilities coincide at the initial moment of time t = 0; if one wants to keep the probability Q_* at a sufficiently low level he/she should keep the specified probability Q also at a low level.

8. Anticipation in Aviation

“You can see a lot by observing”—Yogi Berra, American baseball player; “It is easy to see. It is hard to foresee”—Benjamin Franklin, American scientist and statesman

Anticipation is an important cognitive resource for improved aeronautics safety [12,13,14,15,16,17,18,19,20,21,22]. Two problems that have to do with uncertainties in an anticipation effort in aeronautics are addressed in this analysis:

(1)

assessment of the probability that the random actual (“subjective”, “internal”, pilot-performance-related) anticipation time is below an also random (“objective”, “external”, “available”) time of the dynamic process of interest (if this is the case, it is likely that no-anticipation-related casualty is possible), and

(2)

evaluation of the likelihood of success of a (random) short-term anticipation from the predetermined (deterministic) long-term anticipation.

While the today’s HITL related efforts in anticipation concepts in aviation are, as a rule, statistical, our approach is based on the PPM. This approach can do what the routine conventional methods cannot: one will not be able to ever accumulate enough statistics on real or near-real disasters coming from “operator error” in an attempt to extract usable design guidelines.

Plenty of insightful analyses have been conducted in the anticipation in avionics field by a number of outstanding cognitive engineers. Employing the traditional approach, when a cognitive engineer starts with an experimental effort and then tries to replicate the findings through simulation, Amalberti [16] has indicated particularly that no matter how valuable experimentations might be, it is usually next-to-impossible to isolate the role that an inadequate anticipation might play in a particular off-normal situation that led or could have led to a casualty, although some occurred or avoided accidents show that anticipation played the major role. In connection with this finding, we would like to emphasize that such an isolation (separation) could be done, with a greater or lesser success, by using PPM. It is true, of course, that even by using either the traditional approach (experimentation first) or our PPM approach (modeling first) it might still be impossible to correctly identify and consider the role of anticipation and it various aspects, but it would be a miracle, if this could be done by using only one of these two available approaches. The analytical PPM used in the analyses below is of particular importance, since it leads to close form solutions that clearly indicate the role of the major factors affecting the outcome in the problem of interest. In addition, analytical models and formalisms are highly “generalizable”, i.e., can be used for rather different cognitive engineering related situations, both within a particular domain of application and across various domains.

Two anticipation related problems in aeronautics have been considered in this paper.

One problem has to do with the duration of the anticipation effort as compared to the “available” time until the event of important commences. While anticipation is defined differently in different fields of human psychology, we proceed, following Cellier [17], from the definition that anticipation is “an activity consisting of evaluating the future state of a dynamic process, determining the time and timing of actions to undertake on the basis of a representation of the process in the future and, finally, mentally evaluating the possibilities of these actions”. In accordance with this definition, one has to assess, on the probabilistic basis, the durations of the following three time periods affecting the success of the anticipation effort:

(1)

time required to evaluate the future state of the dynamic process of interest (what will most likely happen, if I do not interfere?);

(2)

time required to determine the time when pilot’s actions should start and what kind of actions should be taken (when should I start acting, and what exactly should I do in view of what might happen if I do not act?); and

(3)

time required to determine, by mental evaluation, whether the required actions are possible (are the actions that I intend to undertake possible, and, if they are, will I achieve my objective?). If the likelihood that the total anticipation time will be appreciably below the moment of time when the anticipated situation in the dynamic process is expected to commence is high, then there is a reason to believe that the anticipation effort will be successful.

Another problem addressed is the probabilistic assessment of the success of a short-term anticipation from the known (predetermined and deterministic) long-term anticipation. When solving this problem we proceed from Denecker’s [13] definition and distinction between short-term (“subsymbolic”) and long-term (“symbolic”) anticipations. According to Denecker, short-term anticipation (STA) relies on reflex loops and is “a low level action” control activity, while long-term anticipation (LTA) relies on the solutions based on the accumulated and analyzed knowledge of the situation of interest and the required adequate modus operandi.

When assessing, on the probabilistic basis, the total anticipation time and particularly that this time exceeds a certain level, we assume that the times required to evaluate the state of the approaching dynamic process of interest, the time required to determine the moment of action and the time to decide what kind of actions should be undertaken could be combined into the phase 1 (evaluation phase) of the anticipation time, while the time required to determine, by mental evaluation, whether the required actions are indeed possible are viewed as the phase 2 of the anticipation time (possibility assessment phase). Such a breakdown seems to be justifiable, since in reality the pilot, in his/her cognitive evaluation of the situation, anticipates most likely concurrently his/her activities associated with the assessment of the significance and the attributes of the future state of the dynamic process of importance and the moment of time that, after the future state of the dynamic process of importance is established, the pilot makes the “now or never” decision.

The time required to determine, by mental evaluation, whether the actions decided upon are indeed possible and will meet the objective comprises the phase 2 (possibility phase) of the anticipation process. If, for one reason or another, one decides on a different breakdown of the anticipation phases, the accepted formalism would still be applicable. Based on the accepted time breakdown, one can use the same formalism as in the above HLS problem. Following the HLS formalism, we use the following rationale.

If the (random) sum T = t + θ of the (random) time, t, needed for the completion of the evaluation phase 1 of the anticipation process and the (random) time, θ, of the possibility assessment phase 2 is lower, with a high enough probability, than the “external”, available (random) time, L, from the beginning of the anticipation process to the beginning of the dynamic process of interest, then the anticipation process could be considered successful. The simplest physically meaningful probability distribution for the random times of interest is Raileigh’s law. The rationale behind such an assumption is the same as in the HLS problem: the times t and θ to complete the phases 1 and 2 of the anticipation process cannot be negative, the likelihood of zero random times t and θ is zero, and so is the likelihood of their very large values, and the most likely times t₀ and θ₀ of the random times t and θ should be small enough, and should be much closer to zero than to very large values. In the Equation (15), t₀ and θ₀ are the maximum values of these distributions and, hence, the most likely values of the random times t and θ. The mean times $\overline{t}$ and $\stackrel{\rightharpoonup }{\theta }$ of the variables t and θ are related to the most likely times t₀ and θ₀ as $\overline{t}=\sqrt{2\pi }{t}_0,$$\overline{\theta }=\sqrt{2\pi }{\theta }_0.$ The (random) time, L, from the beginning of the anticipation process to the beginning of the dynamic process (event) of importance, has a different physical nature than the anticipation times t and θ. While the times t and θ are “subjective” times that have to do with the swiftness and quality of human anticipation, the random time L is an “objective” (“external”, “available”) time that is independent of the human anticipation. It is natural to assume that the normal law Equation (16) can be used as a suitable approximation for the time, L. In the Equation (16) l₀ is the most likely (and also the mean and the median) value of the “external” time L, and σ₀ is its standard deviation. The ratio l₀/σ₀ (“safety factor”) of the mean value of the available time L to its standard deviation should be large enough (say, larger than 4), in order that the normal law could be used as an acceptable approximation for a random variable that cannot be negative, and it is the case in question, when this variable is time. The probability P_* that the sum T = t + θ of the random variables t and θ (total anticipation time) exceeds a certain time duration (level) $\widehat{T}$ can be found as a convolution of the distributions Equation (15) of the random variables t and θ and is expressed by the Equation (17). When the time $\widehat{T}$ is zero, it will be always exceeded (P_* = 1). When the time $\widehat{T}$ is infinitely long $(\widehat{T}\to \infty ),$ the probability that this time is exceeded is always zero (P_* = 0). When the most likely duration ${\theta }_0$ of the phase 2 of anticipation is very small compared to the most likely duration, $t_0,$ of the phase 1, the Equation (17) yields: $P_{*}=\text{exp}\left(-\frac{{\widehat{T}}^2}{2t_0^2}\right),$i.e., the probability that the total anticipation time exceeds a certain time duration, $\widehat{T}$ depends only on the most likely time, $t_0,$ of of the first phase. If the acceptable probability P_* of exceeding the time $\widehat{T}$ (e.g., the duration of the available time, if this duration is treated as a non-random variable of the level $\widehat{T}$ ), is, say, $P={10}^{-4},$ then the anticipation time should not exceed 0.2330 = 23.3% of the time $\widehat{T}$ (expected duration of the available time), otherwise the requirement $P\le {10}^{-4}$ will be compromised. Similarly, when the most likely duration, $t_0,$ of the phase 1 of anticipation effort is very small compared to the most likely time, ${\theta }_0,$ of the second phase, the Equation (17) yields: $P_{*}=\text{exp}\left(-\frac{{\widehat{T}}^2}{2{\theta }_0^2}\right),$ i.e., the probability of exceeding the time level $\widehat{T}$ depends only on the most likely time, ${\theta }_0,$ of the second phase of anticipation.

When the most likely times $t_0$ and ${\theta }_0$ required to complete the two phases of the anticipation effort are equal, the Equation (17) results in the Equation (18). For large enough $\frac{\widehat{T}}{t_0}$ ratios $\left(\frac{\widehat{T}}{t_0}\ge 3\right)$ the second term in the brackets becomes large compared to unity, so that only this term should be considered. The calculated probabilities of exceeding a certain time level $\widehat{T}$ based on the Equation (17), are shown in Table 1. In the third row of this table we indicate, for the sake of comparison, the probabilities, $P^0,$ of exceeding the given time, $\widehat{T}$ when only the time $t_0$ or only the time ${\theta }_0$ is different from zero, i.e., for the special case that is mostly remote from the case $t_0={\theta }_0.$ The probabilities computed for other possible combinations of the times $t_0$ and ${\theta }_0$ could be found between the calculated probabilities P_* and $P^0.$ The Table 1 data should be interpreted in the problem in question as follows: the probability P_* that the anticipation time exceeds a certain time level $\widehat{T}$vs. the ratio $\widehat{T}/t_0$ of this time level to the most likely time $t_0$ of anticipation for the case when the most likely time $t_0$ of the first phase and the most likely time ${\theta }_0$ of the second phase are the same. For the sake of comparison, the probability $P^0$ of exceeding the time $\widehat{T}$ when either the time $t_0$ or the time ${\theta }_0$ are zero, is also indicated. The following two practically important conclusions could be drawn from the Table 1 data:

(1)

The probability that the total time of anticipation exceeds the given time level $\widehat{T}$ rapidly increases with an increase in the time of anticipation;

(2)

The probability of exceeding the time level $\widehat{T}$ is considerably higher, when the most likely times of the two phases of anticipation time are finite, and particularly are equal to each other, in comparison with the situation when one of these times is significantly shorter than the other, i.e., zero or next-to-zero. This is especially true for short anticipation times: the ratio $\frac{P_{*}}{P^0}$ of the probability $P_{*}$ of exceeding the time level $\widehat{T}$ in the case of $t_0={\theta }_0$ to the probability $P^0$ of exceeding this level in the case $t_0=0$ or in the case ${\theta }_0=0$ decreases rapidly with an increase in the duration of anticipation time. Therefore an obvious incentive exists for reducing the total anticipation time. The importance of this intuitively obvious fact is quantitatively assessed in our analysis.

The data of the type shown in Table 1 can be used, particularly, to train the personnel for a quick reaction, as far as the anticipation process is concerned. If, e.g., the expected duration of the available time is 30 s, and the required (specified) probability of exceeding this time is $P={10}^{-3}$ (0.1%), then, as evident from the table data, the times for each of the two phases of the anticipation process should not exceed 5.04 s. It is advisable, of course, that these predictions are verified by simulation and by actual best practices. Particularly, one should obtain statistical information, from the accumulated experience, about the available time durations for different practical situations. Another useful information that could be drawn from the data of the type shown in Table 1 is whether it is possible at all to train a human to react (make a quick and reasonable anticipation) in just several seconds. If not, then one should decide on a broader involvement of more sophisticated, more powerful and more expensive equipment to do the job. If pursuing such an effort is decided upon, then an appropriate SA will be needed to determine the most promising ways to go.

The available time L is a random normally distributed variable, and the probability that this time is found below a certain level $\widehat{L}$ can be determined using the Equation (19). The probability that the available time in the anticipation situation is exceeded can be determined by equating the times $\widehat{T}=\widehat{L}=T$ and computing the product $P_A=P_{*}\left(\frac{t_0}{T},\frac{{\theta }_0}{T}\right)P_l\left(\frac{{\sigma }_0}{T},\frac{l_0}{T}\right)$ of the probability $P_{*}\left(\frac{t_0}{T},\frac{{\theta }_0}{T}\right)$ that the total time of anticipation exceeds a certain level, T, and the probability $P_l\left(\frac{{\sigma }_0}{T},\frac{l_0}{T}\right)$ that the duration of the available time is shorter than the time T. The Equation (19) considers the effect of the “objective” situation (through the values of the most likely duration, $l_0,$ of the random available time, L, and its standard deviation ${\sigma }_0$ ), the role of the human factors $t_0$ and ${\theta }_0$ (the most likely times of the anticipation process phases; these times characterize the pilot qualifications) on the probability of the success of the anticipation process. After a low enough acceptable value $P_A^{*}$ of the probability $P_A$ is established (agreed upon), the Equation (19) can be used to establish the allowable maximum most likely time ${\theta }_0$ of the second phase of the anticipation process. The actual time of the second (final) phase of the anticipation process can be assessed by the formula $\Delta t^{*}={\theta }_0\sqrt{-2\text{ln}{P}_l},$ where $P_l$ is the allowable probability that the level $\Delta t^{*}$ is exceeded. If, for instance, ${\theta }_0=10$ s and $P_l={10}^{-5},$ then $\Delta t^{*}=48.0$ s.

Let the most likely times of the two phases of the anticipation process be the same and equal to t₀ = θ₀ = 10 s, the most likely (mean) available time be l₀ = 20 s, and the standard deviation of the available time be σ₀ = 5 s. Then, using the Equations (18) and (19), and the data in Table 1 we obtain the data shown in Table 2. As evident from the Table 2 data, the probability P_A that the total anticipation time exceeds the duration of the available time (failure of the anticipation process) increases rapidly with the decrease in the ratio of the duration of the available time to the most likely time of either of the two phases of the anticipation effort, while the probability that the available time is below a certain value, decreases with the decrease in the ratio of this value to the most likely duration of the available time. The first effect prevails, and the product of these two probabilities (defining the likelihood that the anticipation effort fails) increases with the decrease in the duration of the available time almost as fast as the probability of the anticipation time does. It is only for very long anticipation times that the probability P_l of exceeding a certain time limit starts to play an appreciable role. We conclude therefore that in the situation in question the human factor associated with the anticipation times play a significant role, as far as the success of the anticipation effort is concerned. The developed model enables one to quantitatively assess in the problem in question this role, along with other uncertainty sources. The success of the anticipation effort can be expected if the probability that it takes place during the available time is sufficiently high. The developed simple and easy-to-use formulas enable one to evaluate this probability. The model can be used particularly when developing guidelines for personnel training. Plenty of additional risk analyses and human psychology related effort will be needed, of course, to make such guidelines practical.

The probabilistic assessment of the success of short-term anticipation from the predetermined long-term anticipation can be carried out based on the double-exponential EVD-type probability distribution function given by the Equation (1). According to Denecker [13], short-term anticipation (STA) relies on reflex loops and is “a low level action” control activity. Long-term anticipation (LTA) relies on the solutions based on the accumulated and analyzed knowledge of the situation of interest and the required adequate modus operandi. Implementing knowledge enables one to make a long-term projection on a next-to-deterministic basis, i.e., with a very low risk of failure, while a short-term projection requires skills and ability to act swiftly and adequately in often unpredictable and extraordinary situations. In both cases the appropriate HCF is needed and in both cases the outcome depends to a great extent on the level of the MWL. In the analysis that follows we consider that the STA has its roots in the LTA and that the probability of the STA success depends to a great extent on the groundwork carried out when the LTA strategy and sequence of actions has been developed, as well as on the level and quality of training. “Hard in training, easy in battle”, as the Russian Commander-in-Chief Suvorov put it. Better LTA facilitates STA. In other words, the STA has its roots in the LTA and can be viewed as a deviation from the LTA, when the aircraft is operated in conditions, when STA is required.

In this analysis we assume that the probability of the STA success is distributed in accordance with the following double-exponential law of the extreme-value-distribution (EVD) type:

$$P^h(F,G)=P_0 \text{exp}\left[\left(1-\frac{G^2}{G_0^2}\right)\text{exp}\left(1-\frac{F^2}{F_0^2}\right)\right]$$

(40)

here $P_0$ is the probability of success (non-failure) of the LTA effort, which is characterized by the MWL for the specified (normal) LTA MWL level $G=G_0,$ and the LTA HCF $F=F_0;G_0$ is the most likely (normal, specified, predetermined and pre-established) LTA MWL; $G\ge G_0$ is the STA MWL; $F\ge F_0$ is the required STA HCF. The $P_0$ level should be established beforehand, as a function of the $G_0$ level, when the HCF $F=F_0.$ This could be done, e.g., by conducting testing, measurements and recordings on a flight simulator. The calculated ratios:

$$\overline{P}=\frac{P^h(F,G)}{P_0}=\text{exp}\left[\left(1-\frac{G^2}{G_0^2}\right)\text{exp}\left(1-\frac{F^2}{F_0^2}\right)\right]$$

(41)

of the probability of the STA success to the probability of the LTA success are shown in Table 3. The following conclusions are drawn from the calculated data:

(1)

At normal MWL level $(G=G_0)$ and/or at an extraordinarily (exceptionally) high HCF level $(F\to \infty )$ the probability of the STA success is close to 100%.

(2)

The probabilities of the STA success are always lower than the probabilities of LTA success. This obvious fact is quantified by the calculated data.

(3)

If the MWL is exceptionally high, the STA effort will definitely fail, no matter how high his/her HCF is.

(4)

If the HCF is high, even a significant MWL has a small effect on the probability of the STA success, unless this workload is exceptionally large.

(5)

The probability of STA success decreases with an increase in the MWL (especially for relatively low MWL levels) and increases with an increase in the HCF (especially for relatively low HCF levels). This intuitively obvious fact is quantified by the calculated data.

(5)

For high HCFs the increase in the MWL level has a much smaller effect on the probabilities of STA success than for low HCFs. All these conclusions make physical sense, of course, but provide a valuable quantitative assessment of the likelihood of the STA success.

The Table 5 data show that the increase in the $F/F_0$ ratio and in the $G/G_0$ ratio above the 3.0 value has a small effect on the probability of the STA success. This means particularly that an exceptionally highly qualified pilot does not have to be trained for an extraordinarily high STA-related MWL and does not have to be trained by a factor higher than 3.0 compared to a pilot of ordinary capacity (skills, qualification). In other words, a pilot does not have to be a superman to successfully cope with a high level MWL in STA conditions, but still has to be trained in such a way that, when there is a need, he/she would be able to cope with a STA MWL by a factor of 3.0 higher than the normal level, and his/her STA HCF should be by a factor of 3.0 higher than what is expected of the same person in ordinary (normal) conditions.

Table 5. Calculated $\overline{P}=P^h(F,G)/P_0$ ratios of the probability $P^h(F,G)$ of human non-failure in off-normal conditions to the probability $P_0$ of non-failure in normal conditions.

$G^2/G_0^2$	1	2	3	4
$F^2/F_0^2$
1	1	0.3679	0.1353	0.0498
2	1	0.6922	0.4791	0.3317
3	1	0.8734	0.7629	0.6663
4	1	0.9514	0.9052	0.8613
5	1	0.9819	0.9640	0.9465
8	1	0.9991	0.9982	0.9978
10	1	0.9999	0.9998	0.9996
∞	1	1	1	1
$G^2/G_0^2$	5	8	10	∞
$F^2/F_0^2$
1	0.0183	9.1188 × 10−4	1.234 × 10−4	0
2	0.2296	0.0761	0.0365	0
3	0.5820	o.3878	0.2958	0
4	0.8194	0.7057	0.6389	0
5	0.9294	0.8797	0.8480	0
8	0.9964	0.9936	0.9918	2.5 × 10−40
10	0.9995	0.9991	0.9989	4.4 × 10−6
∞	1	1	1	1

Table 5. Calculated $\overline{P}=P^h(F,G)/P_0$ ratios of the probability $P^h(F,G)$ of human non-failure in off-normal conditions to the probability $P_0$ of non-failure in normal conditions.

$G^2/G_0^2$	1	2	3	4
$F^2/F_0^2$
1	1	0.3679	0.1353	0.0498
2	1	0.6922	0.4791	0.3317
3	1	0.8734	0.7629	0.6663
4	1	0.9514	0.9052	0.8613
5	1	0.9819	0.9640	0.9465
8	1	0.9991	0.9982	0.9978
10	1	0.9999	0.9998	0.9996
∞	1	1	1	1
$G^2/G_0^2$	5	8	10	∞
$F^2/F_0^2$
1	0.0183	9.1188 × 10−4	1.234 × 10−4	0
2	0.2296	0.0761	0.0365	0
3	0.5820	o.3878	0.2958	0
4	0.8194	0.7057	0.6389	0
5	0.9294	0.8797	0.8480	0
8	0.9964	0.9936	0.9918	2.5 × 10−40
10	0.9995	0.9991	0.9989	4.4 × 10−6
∞	1	1	1	1

Let us elaborate on the LTA and STA MWL and HCF. Although there is no universally accepted definition of the MWL and how it should/could be evaluated, there is a consensus that suggests that MWL can be conceptualized as the interaction between the structure of systems and tasks, on the one hand, and the capabilities, motivation and state of the human operator, on the other. More specifically, MWL could be defined as the “cost” that an operator incurs as tasks are performed. Given the multidimensional nature of MWL, no single measurement technique can be expected to account for all the important aspects of it. Current research efforts in measuring MWL use psycho-physiological techniques, such as electroencephalographic, cardiac, ocular, and respiration measures in an attempt to identify and predict MWL levels. Measurement of cardiac activity has been the most popular physiological technique employed in the assessment of MWL, both from tonic variations in heart rate and after treatment of the cardiac signal. The authors of this paper intend to develop a methodology and to carry out experiments to measure the LTA and STA workloads.

The HCF includes the person’s professional experience; qualifications; capabilities; skills; training; sustainability; ability to concentrate; ability to operate effectively, in a “tireless” fashion, under pressure, and, if needed, for a long period of time; ability to act as a “team-player;” swiftness of reaction, i.e., all the qualities that would enable him/her to cope with high MWL. In order to come up with suitable figures of merit (FOM) for the HCF, one could rank each of the above and other qualities on a scale from one to ten, and calculate the average FOM for each individual.

9. Future Work

“If a man will begin with certainties, he will end with doubts; but if he will be content to begin with doubts, he shall end in certainties.”—Sir Francis Bacon, English philosopher and statesman

Aviation psychologists do not normally measure HCF as a single, unitary quantity. They might estimate the navigator’s ability to handle stress, or test his/her reaction time, or ability to visually detect targets out the window, etc. These are all separate parameters that improve the pilot’s ability to handle workload. It is important, however, that all these parameters, as well as some more permanent factors, like the pilot’s qualifications; general professional experience and skills; performance sustainability; ability to concentrate; ability to make adequate and prudent decisions in conditions of uncertainty; etc. are also considered in a unified HCF. It is mandatory, of course, that such a unified HCF is measured in the same units as the MWL is, otherwise the “stress”-“strength” model could not be used. These units could be particularly dimensionless, but should be established for a particular mission or task in advance. Other, perhaps, less challenging tasks might include:

(1)

Testing to evaluate the effect of the fatigue state of the pilot on the effectiveness of his/her performance: there are cognitive test methodologies that can assess alertness;

(2)

Carrying out continuous mental workload (MWL) measurements using subjective and/or psycho-physiological measures;

(3)

Assessing the role of the aircraft type and the effectiveness of automation: more automation will make the pilot’s job easier, in most cases, but might not be always available or affordable;

(4)

Evaluating the role of weather conditions that might affect the MWL, and might have an effect on the HCF as well;

(5)

Assessing the role of the “phase of flight.” Since descent and landing are characterized by the highest level of MWL, the relationship (1) should be applied and verified for these conditions. It is the authors’ belief that it could be indeed applicable to such conditions, although we did not consider them specifically and directly in this paper. Particularly, complexity of the airport and air traffic situation might have an effect on the MWL: more complexity certainly means more MWL for the pilot to manage;

(6)

Categorizing the types of errors/outcomes (again, typical and possible errors, not mistakes or blunders: these are beyond any PRM analysis) that might occur. One should determine ahead of time which kind of deviations of normal conditions and what kind of errors/outcomes he/she is interested in. Catastrophic loss of an aircraft usually results from a series of failures—deviations from normal conditions that might lead to a casualty, an unrecoverable situation. There was probably no reported loss of a commercial aircraft because one of the pilots was incapacitated, and our analysis has indicated that. Indeed, such an outcome would be rather unlikely, unless the pilot-in-charge is very bad and the probability that he/she fails even in normal operation conditions is next-to-one. In this connection we would like to point out again that the addressed example is just an illustration of one of the possible applications of the basic relationship (1). This relationship might have many more applications in vehicular technology, and, as far as the aerospace industry is concerned, might be applicable, after appropriate modification and generalization, not only to address (less critical) en-route situations, but landing situations as well;

(7)

Use the model to compare the performance of different pilots (MCF) for different MWL levels. Of course, even a significant deviation from normal conditions does not necessarily lead to a casualty, and our models were able to quantify this circumstance. Additional insight is needed, however, to correctly design and adequately interpret the results of the tests in a flight simulator. In this connection it would be interesting to compare the accelerated life test (ALT) and highly accelerated life tests (HALTs) in hardware electronics and photonics with what could be expected from the flight simulation tests.

10. Conclusions

“The truth is rarely pure and never simple”—Oscar Wilde, Irish dramatist, novelist, and poet, The Importance of Being Earnest

PPM is suggested as a powerful, cost-effective and highly flexible means to characterize and to quantify, on the probabilistic basis, the likelihood of a human failure to perform his/her duties when operating an aerospace vehicle. We have shown how some PPM based formalisms could be effectively employed to quantify the role of the human factor in various HITL situations. The suggested models, after appropriate sensitivity analyses are carried out, might be used when developing guidelines for personnel training and/or when there is a need to decide if the existing navigation instrumentation is adequate in extraordinary safety-in-air-and-in-space situations, or if additional and/or more advanced equipment should be developed and installed. The initial numerical data based on the suggested model make physical sense and are in good (qualitative) agreement with the existing practice. Although the suggested PPM approach is powerful, promising and fruitful, further research, refinement, and validation would be needed, of course, before the developed models become practical and widely used.