Part 3: 'Reliance' and 'distraction' effects in PTC automation

By T. B. Sheridan (MIT),
F. C. Gamst (Univ. of Mass., Boston),
and R. A. Harvey, BLE
 
White Paper, 11/28/99

Reliance level 1. To the existing method of operation described above we add a system component that proovides an audible warning in advance of a CSR. (For discussion purposes the train's speed is not enforced by a wayside or on-board component or subsystem.) The audible warning adds a level of safety but does not replace any of the required rules or does not control the train's brakes. The reliance on that audible warning would be assigned a one.

Reliance level 2. This system provides an audible warning in advance of the CSR and also meets the requirement of a PTC system in that the CSR will be enforced by a subsystem on board the locomotive. The crew's responsibility under the existing method of operation does not change in regard to the requirements for the CSR. The principal difference now becomes the LE's choice/ability to permit the PTC on-board components to control the train's speed to comply with the CSR and what other information may be delivered to the LE from the on-board sub-system. That information may include distance to target or the civil speed directive. Assign a two for reliance in this case.

Reliance level 3. The same PTC system exists as above. A principal difference is there are no mandatory directives issued and/or there are no requirements for conversing among the crew members regarding the existence of any CSR. An audible warning may be received in the locomotive cab and there may be an advance directive for speed or distance to target but no other form of advance warning. The automation now becomes depended on for most train control functions regarding the CSR. The LE's role will be to monitor the system performance.

Reliance level 4. The PTC system is considered the preferred method of operation. The operating skills/rules/knowledge required by the LE pertain solely to automatic system with manual control of the locomotive/train, the skills/rules/knowledge-based train handling and operating rules would again come into play. The reliance on the system at this level is absolute. It is now necessary to provide for a rule set that prohibits manual operation except in very limited circumstances.

Each system, sub-system or component could be evaluated for its potential to develop a reliance effect by determining: (1) its purpose and function as a replacement for a task performed by the LE or C; (2) the performance reliability; (3) the accuracy at which the component/sub-system performs; (4) the difficulty level of the task; (5) the motivation of the LE or C to allow/deny the component to operate: (6) the requirements established by the system/railroad for allowing/denying the LE or C from operating the locomotive/train.

We currently recommend that the "designed reliance" of a PTC system be at level 2, as defined above. The actual automation of PTC would then work in the background at level 6, as described in section 2.4 on page 3.

4.6 Warning Before PTC Enforcements

The LE must have suitable warning before the PTC system imposes an enforcement. "Suitable" depends on the particular event to be enforced. In all instances a distinctive audible enforcement alarm should be sounded prior to enforcement. In addition, some kind of graphic display, on a cathode ray tube or other kind of visual presentation, for the algorithm braking/deceleration distances should be used The display should at least show the deceleration of the train, the point at which deceleration or stop must be completed, and calibrations in wayside mile posts and their fractions in tenths of miles. A display of percentage of gradient could also be useful. Such a display would be essential for PTC warnings requiring either decelerating or stopping the train, but could be useful in general, when no PTC alarms are present.

The PTC systems, subsystems, and components on board a locomotive should be designed to ensure necessary functions can be performed by alternative means, such as manual control, when the automation fails.

Automated control actions and out of tolerance conditions or failures in any system, subsystem, or component should be announced to the LE and C.

Transient faults associated with control automation should not fail passively or silently. There should be established a tolerance level for determining when the automation is no longer reliable because of either the frequency of the transient faults or the safety-critical nature of the systems from which the faults originate. The failure of such automation should be announced with a clear and distinctively sound-coded alarm, in such a way as to permit the LE to immediately take control of the locomotive and its train including all on-board PTC systems, subsystems, and components. When transient faults occur, they should be recorded regarding their kind and time in the locomotive event recorder.

5. Training for PTC

There is general agreement that training needs increase with increasing automation, and PTC is no exception. Training must include not only traditional skill maintenance, but also training in new skills and dealing with emergencies, particularly those likely to occur if the automation fails. (Details of PTC training are not regarded as part of the charge for this white paper.)

The design of a training program requires a thorough task analysis, emphasizing not only what displays the operator must observe but also what information is required to be gained and understood, and not simply what controls to operate but also what variables are to be controlled both by the automation and by the personnel according to what criteria. This should yield critical insights for setting training objectives, writing a syllabus, and specifying a specific plan for student testing and program evaluation.

5.1. Classroom and written instruction

Training should include preliminary formal classroom instruction in the rules and practices for PTC. Merely posting bulletins or leaving a stack of governing rules for PTC in a crew register room will not do.

Written material should explain the overall characteristics of the particular on-property application of PTC and the expectations for employees and contractors involved with this form of PTC operation. This should be augmented by classroom presentation, discussion and testing to provide feedback to the students.

5.2. Locomotive simulator instruction

Locomotive simulators have been found to be of great value to train and test the LE for some three decades. They have also been used to conduct experiments of the LE on safety related issues, test the ability of different braking systems, and as tools for accident investigation. They could be useful for PTC-related training. This would be especially so for some elements of skills maintenance. Simulators also offer an opportunity to train the LE through exposure to rare but possible events that can occur in the railroad environment. The initial teaching of PTC operations would also profit from simulator training.

Simulators vary greatly in their sophistication and ability to mimic real world stimuli.

They have been classified in 49 CFR (Code of Federal Regulations) Part 240 as a Type I Simulator which means a replica of the control compartment of a locomotive with all associated control equipment that:

(1) Functions in response to a person's manipulation and causes the gauges associated with such controls to appropriately respond to the consequences of that manipulation;

(2) Pictorially, audibly and graphically illustrates the route to be taken;

(3) Graphically, audibly, and physically illustrates the consequences of control manipulations in terms of their effect on train speed, braking capacity, and in-train force levels throughout the train; and

(4) Is computer enhanced so that it can be programmed for specific train consists and the known physical characteristics of the line illustrated.

A Type II Simulator means a replica of the control equipment for a locomotive that:

(1) Functions in response to a person's manipulation and causes the gauges associated with such controls to appropriately respond to the consequences of that manipulation;

(2) Pictorially, audibly, and graphically illustrates the route to be taken;

(3) Graphically and audibly illustrates the consequences of control manipulations in terms of their effect on train speed braking capacity, and in-train force levels throughout the train; and

(4) Is computer enhanced so that it can be programmed for specific train consists and the known physical characteristics of the line illustrated.

A Type III Simulator means a replica of the control equipment for a locomotive that:

(1) Functions in response to a person's manipulation and causes the gauges associated with such controls to appropriately respond to the consequences of that manipulation;

(2) Graphically illustrates the route to be taken;

(3) Graphically illustrates the consequences of control manipulations in terms of their effect on train speed braking capacity, and in-train force levels throughout the train; and

(4) Is computer enhanced so that it can be programmed for specific train consists and the known physical characteristics of the line illustrated (56 FR [Federal Register] 28254, June 19, 1991, as amended at 58 FR 19002, Apr. 9, 1993; 60 FR 53133, Oct. 12, 1995).

In the order of their ability to simulate the operation of a locomotive in the most realistic manner, the Type I simulator is superior to the Type II , which is superior to Type III. The Type II and Type III simulators have some limited value for maintaining skill levels of the experienced LE. Their use, however, for initial training of persons who have never been at the controls of a moving train may improperly prepare them for the task of actual operation. Actual train movements provide an array of powerful stimuli that reinforce train handling assumptions for the LE. These stimuli tend to be learned over time, and have subtle distinctions meaningful only after developing a level of experience on a particular territory through repetition. Among these arrayed experiences are those tactile (providing a sensation by touch) and kinesthetic (providing a sensation of bodily movement, position, and tension). Both of these are necessary to provide feedback assurance to the LE that the choices made for handling the train are the right ones, including that they are in the correct temporal sequence, each choice further timed according to appropriate duration. This initial knowledge base, accordingly, must be developed with actual experience from handling a moving train.

The Type I simulator, also known as "a full-motion simulator" provides a more realistic experiential stimulation and operational feedback for the trainee. The simulator has a work setting of an actual locomotive cab mounted on a motion base of hydraulic legs with four degrees of freedom supplied through hydraulic actuators. Sideways force cues are provided as the simulation lurches through track switch turnouts. Lesser displacements of this kind, either to the left or right and return, are experienced by the trainee when passing over various simulated track structures such as frogs and railroad crossings at grade. The cab realistically rolls and sways while simulating running over the track.

The sway, at right angles to a longitudinal axis, can be up to 5 degrees to each side and reproduces the side sway of a unit as it moves. Other motion is felt longitudinally when pulling trailing cars (by rearward shock forces, or blows, to the cab) and when the slack of trailing cars runs in against the locomotive (by forward shock forces to the cab). Longitudinal motion of a simulator can be up to 6 inches. If the trainee handles the simulated train too roughly, then, he or she will experience quite severe shock blows while in the LE's cab seat, as simulations of improperly controlled slack run-ins or run-outs are reproduced. Realistic sound affects reproduce those of real operations and are exactly synchronized to the back-screen projections for the simulation. There is no research that indicates a Type I simulator is superior to a Type II or Type III simulator, but it is generally believed by LEs that the realistic feedback provided by Type I simulators provides a superior learning environment.

One of the advantages of simulator training is an instructor at his accompanying computer console can add many changing variables to a simulated run. He can simulate any number of failures such as loss of dynamic brake, pneumatic control switch open, undesired emergency brake application, slack action, and a break in two of the train, as well as a change in tonnage or number of cars. The back-screen projected environment allows for a very large number of variations on events and conditions.

Literally hundreds of permutations of the same route can be simulated thus preventing the trainee from memorizing "the same old film." For example, signal number 103.2 could be green over red, or dark, or red over yellow, the latter simulating movement over a diverging track. More advanced computerization is permitting the simulation of varying weather conditions and can inject realistic railroad operating scenarios to which the LE must react.

A sophisticated computerized locomotive simulator is demanding and, as in aircraft simulators, can afford training opportunities not allowable in the real world. A wide range of operationally difficult, cognitively taxing, and potentially dangerous simulations with different train profiles and locomotive consists can be experienced by the trainee. Thus various failure modes of PTC can be simulated and experienced. These failure modes can even be safely experimented with regarding LE reactions to them.

Problems of a LE transitioning from a locomotive having traditional analog displays to one having integrated-cab-electronics (ICE) screen displays for running an engine and handling a train could be prevented with training on a sophisticated simulator. Problems of transitions of the LE from non-PTC to PTC territory, and between differing kinds of PTC territories could similarly be prevented with training on a sophisticated simulator.

6. CONCLUSIONS

(1) Over-reliance on (or not knowing how much to rely on) automation, and added distraction of having to (or poor ability to) monitor automation, are well known problems in the human factors literature, but there are few easy remedies.

(2) Maintenance of the locomotive engineer's perceptual, decision-making and control skills is considered mandatory.

(3) A PTC system should provide an auditory warning of appropriate hazards and graphical information about stopping profiles from the given speed. Otherwise it should allow for manual operation, unless certain limits are exceeded, at which point automatic braking enforcement should go into effect.

(4) Failures of a PTC system should be announced by a clearly discernible auditory alarm, and the type and time of failure recorded on the locomotive event recorder.

(5) Special classroom and simulator training for PTC operation, including failure scenarios, should be given to LE, C and train dispatcher personnel. This should be based on a thorough task analysis of PTC operation and response to potential PTC failure.

7. REFERENCES

Aurelius, John P. and Norman Korobow (1971). The Visibility and Audibility of Trains Approaching Rail-Highway Grade Crossings. Final Report FRA-RP-71-2, May 1971.

BBC (1999). BBC website, 20 Sep.1999 <http://news.bbc.co.uklhi/english/uk/newsid 4520001452732.stm>):

Coston, James E. (1999). The Next Degree of Separation, Journal of Commerce, May 12.

Desmond, P.A., Hancock, P.A. and Monette, J.A. (1998). Fatigue and automation-induced impairments in simulated driving performance. Transportation Research Record 1628. Washington, DC: National Academy Press.

Endsley, M.R. (1995). Towards a theory of situation awareness in dynamic systems. Human Factors, 37(1), 32-64.

Endsley, M. R. and Kiris, E.G. (1995). The out-of-the-loop performance problem and level of control in automation. Human Factors, 37(2), 381-394.

Fitts, P.M. (1954). The information capacity of the human motor system in controlling the amplitude of movement. J. Experimental Psychology 47: 381-391.

FRA (U.S. Federal Railroad Administration) (1998). Railroad Safety Statistics: Annual Report 1997. Washington, DC: USDOT, FRA.

GAO (U.S. General Accounting Office) (1995). Railroad Safety: Status of Efforts to Improve Railroad Crossing Safety. Report GAOIRCED-95- 191. August 1995.

Getty, D.A., Swets, J.A., Pickett, R.M. and Gonthier, D. (1995). System operator response to warnings of danger: a laboratory investigation of the effects of the predictive value of a warning on human response time. J. of Experimental Psychology Applied 1(1) pp. 19-33.

Hale, A., and H. H. Jacobs (1975). Proposed Qualification Requirements for SelectedRailroad Jobs. Report No. FRAIOR&D-75/44. Washington, DC: DOT, FRA, Office of Research and Development.

Hick, W. E. (1952). On the rate of gain of information. Quart. J. Experimental Psychology 4:11-26.

Lee, J. and Moray, N. (1992) Trust, control strategies and allocation of function in human-machine systems, Ergonomics 35(10), 1243-1270.

McDonnell Douglas Corporation (1972). Railroad Enginemen Task and Skill Study. Report No. FRA-OPP-73-2. Washington, DC: DOT, FRA.

Mackworth, J.F. and Taylor, M.M. (1963). d' measure of signal detectability. Canadian J. of Pyschology, 17, pp. 302-325.

Moray, N., "Mental Workload Since 1979 (1988). International Reviews of Ergonomics 2:2, 123-150.

Moray (1999). Personal communication.

Moray, N., Inagaki, T. and Itoh, M. (1999). Adaptive automation, trust, and self-confidence in fault management and time-critical tasks. J. of Experimental Psychology:Applied. (in press).

Mouloua, M. and Koonce, J.M. (1997). Human-Automation Interaction. Mahwah, NJ:Erlbaum.

Muir, B.M. & Moray, N. (1996). Trust in automation. Part II. Experimental studies of trust and human intervention in a process control simulation. Ergonomics 39(3) 429-461.

Parasuraman, R. and Mouloua, M. (1994). Automation and Human Performance, Mahwah, NJ: Erlbaum.

Parasuraman, R., Hancock, P.A. and Olofinboba, 0. (1998). Alarm effectiveness in driver collision-warning systems. Ergonomics, in press.

Parasuraman, R., and Riley, V. (1997). Humans and automation: use, misuse, disuse, abuse. Human Factors, 39(2), 230-253.

RSAC (Railroad Safety Advisory Committee). (1999, July). Report to the Federal Railroad Administrator, Implementation of Positive train Control Systems.

Rasmussen, J. and Rouse, W.B. (1981). Human Detection and Diagnosis of System Failures. New York: Plenum Press.

Riley, V. (1994). A theory of operator reliance on automation. In M.Mouloua and R. Parasuraman (Eds). Human Performance in Automated Systems: Recent research and trends. Hillsdale, NJ: Lawrence Eribaum. 8-14.

Savage, Jan (1998). The Economics of Railroad Safety. Norwell, MA: Kluwer Academic Publishers.

Savage, Ian (1999). Railroad Safety and Public Policy, Journal of the Transportation Research Forum, 38:56-63.

Shannon, C. E. (1949). Communication in the presence of noise. Proceedings of IRE 37: 10-22.

Sheridan, T. B. (1970). On how often the supervisor should sample. IEEE Trans. Systems Science and Cybernetics. SSC-6: 140-145.

Sheridan, TB., Supervisory Control, in G. Salvendy, Ed., Handbook of Human Factors, New York: Wiley, 1987.

Sheridan, TB. (1992). Telerobotics, Automation and Human Supervisory Control. Cambridge, MA: MIT Press, p. 311).

Sheridan, T. B. and Simpson, R. W. (1979). Toward the Definition and Measurement of the Mental Workload of Transport Pilots. MIT Flight Technology Laboratory Report R79-4, January.

Sheridan, T. and Parasuraman, R. (1999). Human vs. Automation in Responding to Failures: An Expected-Value Analysis, submitted paper.

Sheridan, T. (1999).Weighing situation awareness against time to respond: a basis for allocating attention, submitted paper.

Swets, J. & Pickett, R. 1982. Evaluation of diagnostic systems. New York: Academic press.

Wickens, C.D. (1992). Engineering Psychology and Human Performance, 2nd Edition. New York: Harper-Collins.

Wiener, E. L. & Curry, R. E. (1980). Flight-deck automation: promises and problems. Ergonomics, 23(10), 995-1011.

Wilde, G. J. S., L. J. Cake, and M. B. McCarthy (1975). An Observational Study of Driver Behaviour at Signalized Railroad Crossings. Canadian Institute of Guided Ground Transport Report No. 75-16.

Williges, R. C. and Weirwille, W. W. (1979). Behavioral measures of aircrew mental workload. Human Factors 21: 549-574.

Woods, D.D. & Roth, E. M. (1988). Cognitive Systems Engineering. In M. Helander, (Ed). Handbook of Human-Computer Interaction. Amsterdam: North-Holland Elsevier. [end]


Editor's Note: This is the third and final installment of the Postive Train Control White Paper. Parts one and two were published in the January and February 2000 issues of the Newsletter, respectively.

A complete copy of the 23-page report can be found on the BLE webpage at:

http://www.ble.org/pr/news/ptcposition.pdf

2000 Brotherhood of Locomotive Engineers