Part 3: 'Reliance' and 'distraction' effects in PTC
automation Reliance level 1. To the existing method of operation described above
we add a system component that proovides an audible warning in advance of
a CSR. (For discussion purposes the train's speed is not enforced by a wayside
or on-board component or subsystem.) The audible warning adds a level of
safety but does not replace any of the required rules or does not control
the train's brakes. The reliance on that audible warning would be assigned
a one. Reliance level 2. This system provides an audible warning in advance
of the CSR and also meets the requirement of a PTC system in that the CSR
will be enforced by a subsystem on board the locomotive. The crew's responsibility
under the existing method of operation does not change in regard to the
requirements for the CSR. The principal difference now becomes the LE's
choice/ability to permit the PTC on-board components to control the train's
speed to comply with the CSR and what other information may be delivered
to the LE from the on-board sub-system. That information may include distance
to target or the civil speed directive. Assign a two for reliance in this
case. Reliance level 3. The same PTC system exists as above. A principal difference
is there are no mandatory directives issued and/or there are no requirements
for conversing among the crew members regarding the existence of any CSR.
An audible warning may be received in the locomotive cab and there may be
an advance directive for speed or distance to target but no other form of
advance warning. The automation now becomes depended on for most train control
functions regarding the CSR. The LE's role will be to monitor the system
performance. Reliance level 4. The PTC system is considered the preferred method of
operation. The operating skills/rules/knowledge required by the LE pertain
solely to automatic system with manual control of the locomotive/train,
the skills/rules/knowledge-based train handling and operating rules would
again come into play. The reliance on the system at this level is absolute.
It is now necessary to provide for a rule set that prohibits manual operation
except in very limited circumstances. Each system, sub-system or component could be evaluated for its potential
to develop a reliance effect by determining: (1) its purpose and function
as a replacement for a task performed by the LE or C; (2) the performance
reliability; (3) the accuracy at which the component/sub-system performs;
(4) the difficulty level of the task; (5) the motivation of the LE or C
to allow/deny the component to operate: (6) the requirements established
by the system/railroad for allowing/denying the LE or C from operating the
locomotive/train. We currently recommend that the "designed reliance" of a PTC
system be at level 2, as defined above. The actual automation of PTC would
then work in the background at level 6, as described in section 2.4 on page
3. 4.6 Warning Before PTC Enforcements The LE must have suitable warning before the PTC system imposes an enforcement.
"Suitable" depends on the particular event to be enforced. In
all instances a distinctive audible enforcement alarm should be sounded
prior to enforcement. In addition, some kind of graphic display, on a cathode
ray tube or other kind of visual presentation, for the algorithm braking/deceleration
distances should be used The display should at least show the deceleration
of the train, the point at which deceleration or stop must be completed,
and calibrations in wayside mile posts and their fractions in tenths of
miles. A display of percentage of gradient could also be useful. Such a
display would be essential for PTC warnings requiring either decelerating
or stopping the train, but could be useful in general, when no PTC alarms
are present. The PTC systems, subsystems, and components on board a locomotive should
be designed to ensure necessary functions can be performed by alternative
means, such as manual control, when the automation fails. Automated control actions and out of tolerance conditions or failures
in any system, subsystem, or component should be announced to the LE and
C. Transient faults associated with control automation should not fail passively
or silently. There should be established a tolerance level for determining
when the automation is no longer reliable because of either the frequency
of the transient faults or the safety-critical nature of the systems from
which the faults originate. The failure of such automation should be announced
with a clear and distinctively sound-coded alarm, in such a way as to permit
the LE to immediately take control of the locomotive and its train including
all on-board PTC systems, subsystems, and components. When transient faults
occur, they should be recorded regarding their kind and time in the locomotive
event recorder. 5. Training for PTC There is general agreement that training needs increase with increasing
automation, and PTC is no exception. Training must include not only traditional
skill maintenance, but also training in new skills and dealing with emergencies,
particularly those likely to occur if the automation fails. (Details of
PTC training are not regarded as part of the charge for this white paper.) The design of a training program requires a thorough task analysis, emphasizing
not only what displays the operator must observe but also what information
is required to be gained and understood, and not simply what controls to
operate but also what variables are to be controlled both by the automation
and by the personnel according to what criteria. This should yield critical
insights for setting training objectives, writing a syllabus, and specifying
a specific plan for student testing and program evaluation. 5.1. Classroom and written instruction Training should include preliminary formal classroom instruction in the
rules and practices for PTC. Merely posting bulletins or leaving a stack
of governing rules for PTC in a crew register room will not do. Written material should explain the overall characteristics of the particular
on-property application of PTC and the expectations for employees and contractors
involved with this form of PTC operation. This should be augmented by classroom
presentation, discussion and testing to provide feedback to the students. 5.2. Locomotive simulator instruction Locomotive simulators have been found to be of great value to train and
test the LE for some three decades. They have also been used to conduct
experiments of the LE on safety related issues, test the ability of different
braking systems, and as tools for accident investigation. They could be
useful for PTC-related training. This would be especially so for some elements
of skills maintenance. Simulators also offer an opportunity to train the
LE through exposure to rare but possible events that can occur in the railroad
environment. The initial teaching of PTC operations would also profit from
simulator training. Simulators vary greatly in their sophistication and ability to mimic
real world stimuli. They have been classified in 49 CFR (Code of Federal Regulations) Part
240 as a Type I Simulator which means a replica of the control compartment
of a locomotive with all associated control equipment that: (1) Functions in response to a person's manipulation and causes the gauges
associated with such controls to appropriately respond to the consequences
of that manipulation; (2) Pictorially, audibly and graphically illustrates the route to be
taken; (3) Graphically, audibly, and physically illustrates the consequences
of control manipulations in terms of their effect on train speed, braking
capacity, and in-train force levels throughout the train; and (4) Is computer enhanced so that it can be programmed for specific train
consists and the known physical characteristics of the line illustrated. A Type II Simulator means a replica of the control equipment for a locomotive
that: (1) Functions in response to a person's manipulation and causes the gauges
associated with such controls to appropriately respond to the consequences
of that manipulation; (2) Pictorially, audibly, and graphically illustrates the route to be
taken; (3) Graphically and audibly illustrates the consequences of control manipulations
in terms of their effect on train speed braking capacity, and in-train force
levels throughout the train; and (4) Is computer enhanced so that it can be programmed for specific train
consists and the known physical characteristics of the line illustrated. A Type III Simulator means a replica of the control equipment for a locomotive
that: (1) Functions in response to a person's manipulation and causes the gauges
associated with such controls to appropriately respond to the consequences
of that manipulation; (2) Graphically illustrates the route to be taken; (3) Graphically illustrates the consequences of control manipulations
in terms of their effect on train speed braking capacity, and in-train force
levels throughout the train; and (4) Is computer enhanced so that it can be programmed for specific train
consists and the known physical characteristics of the line illustrated
(56 FR [Federal Register] 28254, June 19, 1991, as amended at 58 FR 19002,
Apr. 9, 1993; 60 FR 53133, Oct. 12, 1995). In the order of their ability to simulate the operation of a locomotive
in the most realistic manner, the Type I simulator is superior to the Type
II , which is superior to Type III. The Type II and Type III simulators
have some limited value for maintaining skill levels of the experienced
LE. Their use, however, for initial training of persons who have never been
at the controls of a moving train may improperly prepare them for the task
of actual operation. Actual train movements provide an array of powerful
stimuli that reinforce train handling assumptions for the LE. These stimuli
tend to be learned over time, and have subtle distinctions meaningful only
after developing a level of experience on a particular territory through
repetition. Among these arrayed experiences are those tactile (providing
a sensation by touch) and kinesthetic (providing a sensation of bodily movement,
position, and tension). Both of these are necessary to provide feedback
assurance to the LE that the choices made for handling the train are the
right ones, including that they are in the correct temporal sequence, each
choice further timed according to appropriate duration. This initial knowledge
base, accordingly, must be developed with actual experience from handling
a moving train. The Type I simulator, also known as "a full-motion simulator"
provides a more realistic experiential stimulation and operational feedback
for the trainee. The simulator has a work setting of an actual locomotive
cab mounted on a motion base of hydraulic legs with four degrees of freedom
supplied through hydraulic actuators. Sideways force cues are provided as
the simulation lurches through track switch turnouts. Lesser displacements
of this kind, either to the left or right and return, are experienced by
the trainee when passing over various simulated track structures such as
frogs and railroad crossings at grade. The cab realistically rolls and sways
while simulating running over the track. The sway, at right angles to a longitudinal axis, can be up to 5 degrees
to each side and reproduces the side sway of a unit as it moves. Other motion
is felt longitudinally when pulling trailing cars (by rearward shock forces,
or blows, to the cab) and when the slack of trailing cars runs in against
the locomotive (by forward shock forces to the cab). Longitudinal motion
of a simulator can be up to 6 inches. If the trainee handles the simulated
train too roughly, then, he or she will experience quite severe shock blows
while in the LE's cab seat, as simulations of improperly controlled slack
run-ins or run-outs are reproduced. Realistic sound affects reproduce those
of real operations and are exactly synchronized to the back-screen projections
for the simulation. There is no research that indicates a Type I simulator
is superior to a Type II or Type III simulator, but it is generally believed
by LEs that the realistic feedback provided by Type I simulators provides
a superior learning environment. One of the advantages of simulator training is an instructor at his accompanying
computer console can add many changing variables to a simulated run. He
can simulate any number of failures such as loss of dynamic brake, pneumatic
control switch open, undesired emergency brake application, slack action,
and a break in two of the train, as well as a change in tonnage or number
of cars. The back-screen projected environment allows for a very large number
of variations on events and conditions. Literally hundreds of permutations of the same route can be simulated
thus preventing the trainee from memorizing "the same old film."
For example, signal number 103.2 could be green over red, or dark, or red
over yellow, the latter simulating movement over a diverging track. More
advanced computerization is permitting the simulation of varying weather
conditions and can inject realistic railroad operating scenarios to which
the LE must react. A sophisticated computerized locomotive simulator is demanding and, as
in aircraft simulators, can afford training opportunities not allowable
in the real world. A wide range of operationally difficult, cognitively
taxing, and potentially dangerous simulations with different train profiles
and locomotive consists can be experienced by the trainee. Thus various
failure modes of PTC can be simulated and experienced. These failure modes
can even be safely experimented with regarding LE reactions to them. Problems of a LE transitioning from a locomotive having traditional analog
displays to one having integrated-cab-electronics (ICE) screen displays
for running an engine and handling a train could be prevented with training
on a sophisticated simulator. Problems of transitions of the LE from non-PTC
to PTC territory, and between differing kinds of PTC territories could similarly
be prevented with training on a sophisticated simulator. 6. CONCLUSIONS (1) Over-reliance on (or not knowing how much to rely on) automation,
and added distraction of having to (or poor ability to) monitor automation,
are well known problems in the human factors literature, but there are few
easy remedies. (2) Maintenance of the locomotive engineer's perceptual, decision-making
and control skills is considered mandatory. (3) A PTC system should provide an auditory warning of appropriate hazards
and graphical information about stopping profiles from the given speed.
Otherwise it should allow for manual operation, unless certain limits are
exceeded, at which point automatic braking enforcement should go into effect. (4) Failures of a PTC system should be announced by a clearly discernible
auditory alarm, and the type and time of failure recorded on the locomotive
event recorder. (5) Special classroom and simulator training for PTC operation, including
failure scenarios, should be given to LE, C and train dispatcher personnel.
This should be based on a thorough task analysis of PTC operation and response
to potential PTC failure. 7. REFERENCES Aurelius, John P. and Norman Korobow (1971). The Visibility and Audibility
of Trains Approaching Rail-Highway Grade Crossings. Final Report FRA-RP-71-2,
May 1971. BBC (1999). BBC website, 20 Sep.1999 <http://news.bbc.co.uklhi/english/uk/newsid
4520001452732.stm>): Coston, James E. (1999). The Next Degree of Separation, Journal of Commerce,
May 12. Desmond, P.A., Hancock, P.A. and Monette, J.A. (1998). Fatigue and automation-induced
impairments in simulated driving performance. Transportation Research Record
1628. Washington, DC: National Academy Press. Endsley, M.R. (1995). Towards a theory of situation awareness in dynamic
systems. Human Factors, 37(1), 32-64. Endsley, M. R. and Kiris, E.G. (1995). The out-of-the-loop performance
problem and level of control in automation. Human Factors, 37(2), 381-394. Fitts, P.M. (1954). The information capacity of the human motor system
in controlling the amplitude of movement. J. Experimental Psychology 47:
381-391. FRA (U.S. Federal Railroad Administration) (1998). Railroad Safety Statistics:
Annual Report 1997. Washington, DC: USDOT, FRA. GAO (U.S. General Accounting Office) (1995). Railroad Safety: Status
of Efforts to Improve Railroad Crossing Safety. Report GAOIRCED-95- 191.
August 1995. Getty, D.A., Swets, J.A., Pickett, R.M. and Gonthier, D. (1995). System
operator response to warnings of danger: a laboratory investigation of the
effects of the predictive value of a warning on human response time. J.
of Experimental Psychology Applied 1(1) pp. 19-33. Hale, A., and H. H. Jacobs (1975). Proposed Qualification Requirements
for SelectedRailroad Jobs. Report No. FRAIOR&D-75/44. Washington, DC:
DOT, FRA, Office of Research and Development. Hick, W. E. (1952). On the rate of gain of information. Quart. J. Experimental
Psychology 4:11-26. Lee, J. and Moray, N. (1992) Trust, control strategies and allocation
of function in human-machine systems, Ergonomics 35(10), 1243-1270. McDonnell Douglas Corporation (1972). Railroad Enginemen Task and Skill
Study. Report No. FRA-OPP-73-2. Washington, DC: DOT, FRA. Mackworth, J.F. and Taylor, M.M. (1963). d' measure of signal detectability.
Canadian J. of Pyschology, 17, pp. 302-325. Moray, N., "Mental Workload Since 1979 (1988). International Reviews
of Ergonomics 2:2, 123-150. Moray (1999). Personal communication. Moray, N., Inagaki, T. and Itoh, M. (1999). Adaptive automation, trust,
and self-confidence in fault management and time-critical tasks. J. of Experimental
Psychology:Applied. (in press). Mouloua, M. and Koonce, J.M. (1997). Human-Automation Interaction. Mahwah,
NJ:Erlbaum. Muir, B.M. & Moray, N. (1996). Trust in automation. Part II. Experimental
studies of trust and human intervention in a process control simulation.
Ergonomics 39(3) 429-461. Parasuraman, R. and Mouloua, M. (1994). Automation and Human Performance,
Mahwah, NJ: Erlbaum. Parasuraman, R., Hancock, P.A. and Olofinboba, 0. (1998). Alarm effectiveness
in driver collision-warning systems. Ergonomics, in press. Parasuraman, R., and Riley, V. (1997). Humans and automation: use, misuse,
disuse, abuse. Human Factors, 39(2), 230-253. RSAC (Railroad Safety Advisory Committee). (1999, July). Report to the
Federal Railroad Administrator, Implementation of Positive train Control
Systems. Rasmussen, J. and Rouse, W.B. (1981). Human Detection and Diagnosis of
System Failures. New York: Plenum Press. Riley, V. (1994). A theory of operator reliance on automation. In M.Mouloua
and R. Parasuraman (Eds). Human Performance in Automated Systems: Recent
research and trends. Hillsdale, NJ: Lawrence Eribaum. 8-14. Savage, Jan (1998). The Economics of Railroad Safety. Norwell, MA: Kluwer
Academic Publishers. Savage, Ian (1999). Railroad Safety and Public Policy, Journal of the
Transportation Research Forum, 38:56-63. Shannon, C. E. (1949). Communication in the presence of noise. Proceedings
of IRE 37: 10-22. Sheridan, T. B. (1970). On how often the supervisor should sample. IEEE
Trans. Systems Science and Cybernetics. SSC-6: 140-145. Sheridan, TB., Supervisory Control, in G. Salvendy, Ed., Handbook of
Human Factors, New York: Wiley, 1987. Sheridan, TB. (1992). Telerobotics, Automation and Human Supervisory
Control. Cambridge, MA: MIT Press, p. 311). Sheridan, T. B. and Simpson, R. W. (1979). Toward the Definition and
Measurement of the Mental Workload of Transport Pilots. MIT Flight Technology
Laboratory Report R79-4, January. Sheridan, T. and Parasuraman, R. (1999). Human vs. Automation in Responding
to Failures: An Expected-Value Analysis, submitted paper. Sheridan, T. (1999).Weighing situation awareness against time to respond:
a basis for allocating attention, submitted paper. Swets, J. & Pickett, R. 1982. Evaluation of diagnostic systems. New
York: Academic press. Wickens, C.D. (1992). Engineering Psychology and Human Performance, 2nd
Edition. New York: Harper-Collins. Wiener, E. L. & Curry, R. E. (1980). Flight-deck automation: promises
and problems. Ergonomics, 23(10), 995-1011. Wilde, G. J. S., L. J. Cake, and M. B. McCarthy (1975). An Observational
Study of Driver Behaviour at Signalized Railroad Crossings. Canadian Institute
of Guided Ground Transport Report No. 75-16. Williges, R. C. and Weirwille, W. W. (1979). Behavioral measures of aircrew
mental workload. Human Factors 21: 549-574. Woods, D.D. & Roth, E. M. (1988). Cognitive Systems Engineering.
In M. Helander, (Ed). Handbook of Human-Computer Interaction. Amsterdam:
North-Holland Elsevier. [end]
Editor's Note: This is the third and final installment of the Postive Train Control White Paper. Parts one and two were published in the January and February 2000 issues of the Newsletter, respectively.
A complete copy of the 23-page report can be found on the BLE webpage at:
http://www.ble.org/pr/news/ptcposition.pdf
© 2000 Brotherhood of Locomotive Engineers