To appear in the Proceedings of the Cognitive Engineering Systems in Process Control , Kyoto, Japan, November, 1996.

This paper describes the evolution of models of human-machine systems over the past forty years. Next, it describes the similarities between human-machine systems models and a variety of other recent approaches to understanding and aiding human interaction in real-world systems, including cognitive engineering, ecological psychology, and naturalistic decision making. The paper then proposes a set of tenets that characterizes such models and human interfaces whose design is based upon them. Related research is cited.

Human-machine systems engineering (HMSE) has its roots in engineering: mechanical, electrical, industrial, and aeronautical, e.g., (Rouse, 1980; Sheridan & Ferrell, 1974). Applications typically examine operator interfaces to complex, real-time, and, often, high-risk, systems. Examples include aircraft (military and civilian), power plants (often nuclear), space systems (i.e., satellite ground control and manned spacecraft such as the shuttle and space station), and, more recently, manufacturing. The initial goal of human-machine systems engineering was to develop robust operator models, models with the same levels of fidelity as system models, e.g., aircraft dynamics. The vision was to have a complete human-machine system model/simulation that could accurately predict system and human behavior and provide quantitative assessments of proposed system designs (Rouse, 1980).

In the sixties and seventies, the crossover model and the optimal control model (Baron, 1984; Wickens, 1984) were good examples of this type of model. These models described continuous tracking behavior by human operators undertaking tasks such as flying a fully manual aircraft, piloting a ship, and driving an automobile. These initial control theory models showed great promise as methodologies for comprehensive human-machine system models (Wickens, 1984).

The introduction of relatively inexpensive and extremely powerful digital computers in the late sixties and early seventies changed both the nature of controlled systems and the role of the human in the system: operators evolved from continuous manual controllers to supervisory controllers of multiple computer-controlled subsystems (Sheridan, 1976). As a result, the human-machine systems engineering community refocused the behavior that they were trying to model and, since the continuous control-theoretic models were no longer adequate, searched for alternative modeling methodologies.

Currently, computational models using knowledge-based or AI (artificial intelligence) representations are the predominant formulation (Elkind, 1989). At first, continuing to strive for analytic formulations, there were HMSE models that used a variety of methods from operations research (e.g., queueing theory models of pilot decision making, workload, display sampling, and air traffic control, e.g., (Chu & Rouse, 1979; Rouse, 1977; Walden & Rouse, 1978)). As AI representations for human and machine intelligence were introduced, human-machine systems engineers began to find these computational structures very powerful for modeling operator interaction with complex systems. Consider, for example, rule-based models of operator control, e.g., (Knaeuper & Rouse, 1985), blackboard models of operator intent, e.g., (Rubin, Jones, & Mitchell, 1988), script- and case-based models of operator decision making, e.g., (Sewell & Geddes, 1990).

In addition to changing its modeling methods, a portion of the human-machine systems research community changed its modeling goal: rather than pursuing the development of a global and analytic/computational human operator simulation, (i.e., a quantitative, predictive model), they became more focused: the development of system and task representations that could be used for the design of operator interfaces to complex dynamic systems, including displays, aids, and training systems. Thus, for many researchers, the goal is no longer to produce a black-box human operator simulator that functions as robustly as traditional engineering models of system hardware and software, but rather the development of a useful description/prescription of the system-task-operator interactions.

With its use of knowledge-based structures to represent knowledge-based or cognitive tasks human-machine systems engineering overlaps and complements various other disciplines that focus on understanding and modeling human cognition, problem solving, and decision making.

Related Disciplines: Cognitive Engineering, Ecological Psychology, and Naturalistic Decision Making

A central tenet of human-machine systems engineering is the importance of context. (Baron, 1984) summarizes this requirement succinctly:

(A human-machine systems model)...embodies the idea that to model human performance, one must model the system in which that performance is embedded. Human behavior, either cognitive or psychomotor, is too diverse to model unless it is sufficiently constrained by the situation or environment; however, when these environmental constraints exist, to model behavior adequately, one must include a model for that environment (p. 6).

For complex engineering systems, Sheridan and Ferrell (1974) note that the frequent use of terms such as operator and performance instead of person or behavior is meant to emphasize the context and the relatively narrow range of human experience which is represented.

The importance of context and understanding user goals is a common thread through all of the disciplines related to human-machine systems engineering. Cognitive engineering is a discipline with its foundations in human factors, computer science, cognitive psychology, and artificial intelligence (Norman, 1986; Rasmussen, 1986; Woods & Roth, 1988). Norman defines cognitive engineering "... as neither Cognitive Psychology, nor Cognitive Science, nor Human Factors, (but rather)...a type of applied Cognitive Science, trying to apply what is known from science to the design and construction of machines." (p. 31)

Approaching context from the point of view of human-computer interaction (HCI) and users who are likely to be novices or intermittent users rather than skilled operators, Norman proposes user-centered design as a science in which human interfaces to machines can be designed to enhance human productivity and to reduce human errors. As Norman defines user-centered design, task knowledge is a necessary prerequisite. It is important to note that this view of the importance of context is not consistently shared by the community of HCI researchers; much HCI research is conducted in context-free environments.

Rasmussen and Woods are concerned primarily with skilled practitioners, rather than intermittent or casual users; for both Woods and Rasmussen context is the starting point. Woods and colleagues describe cognitive engineering as problem- and event-, as opposed to technology-, driven: a discipline of designing tools based on practitioner needs in particular tasks. Similarly, Rasmussen and colleagues propose a cognitive engineering methodology that provides a suite of representations with which to characterize the world, the problem solving used to control it, and lower-level behaviors undertaken to achieve control goals.

The recent emergence (or re-emergence) of ecological psychology and related models, e.g., Flach (1995), likewise affirms the importance of context in understanding or modeling human behavior. Consider, for example, Flach et al.'s description of the importance of examining the context of behavior in which action is embedded:

Examining the main effects of human capability is important, but interactions supersede main effects, and situational demands can modify behavior to such an extent that our original knowledge of the isolated human ability might serve to mislead us in richer and more complicated environmental settings. (p. xii)

Likewise, the study of naturalistic decision making, researchers who include psychologists, engineers, and economists, has suggested that the context in which decisions are made may be the paramount factor in understanding the decision making process. Given context, seemingly 'irrational' decisions may become quite understandable and predictable, e.g., (Klein et al., 1993).

Each of these disciplines searches for increasingly powerful representations to describe and prescribe human behavior. The remainder of this paper proposes a set of tenets that characterize effective models of operator interaction with complex dynamic systems. To the extent that a discipline attempts to model behavior in such applications, the tenets can help to evaluate the likely success of a proposed representation as a tool for design.

When used for design, HMSE models are a class of models that make explicit the types of information required to design the semantics of the human-computer interaction needed to control a complex dynamic system. The models of the human operator explicitly represent the domain of application, task constraints, and the flexibility inherent in human interaction with a complex system. The models need to reflect the work environment and its dynamic nature, as perceived by the operator given the current system state and current system goals. Such models must represent both monitoring/situation assessment and control activities. Models that represent monitoring and situation assessment attempt to identify and structure important system variables, states, or aggregate measures that the supervisory control role often only implicitly implies. For example, operators are often told 'monitor everything.' Models of monitoring/situation assessment provide a forum in which designers and engineers can articulate explicitly various essential monitoring and situation assessment decisions. Such models help to make the designer's assumptions about the system and its controller explicit, an important design feature as supervisory control systems become more sophisticated (Rasmussen, 1986).

The model of control activities must represent at least three properties of both the control and controlled systems and the operator supervising them: (1) what changes to the system the operator wants to make; (2) why the changes should be made, with respect to system goals and current state, and, finally, (3) how the needed changes to the system can be made, i.e., the operator activities undertaken to bring about the desired state.

Models should represent the concurrent nature of the control activity and the choices available to the operator given current system state. Operators are usually responsible for multiple, concurrent functions and do not pursue one goal or activity to the exclusion of all others. In most control systems, there is not one, strictly deterministic, way of undertaking a desired control activity. Rather, there is a range of acceptable ways of accomplishing the same task. Specific actions are, to some degree, at the discretion of the operator.

Finally, to be useful for design, an effective model must be both descriptive and prescriptive. An exclusively prescriptive model, that is, a model that specifies what an operator should do, but fails to describe what operators actually do (as do many mathematical models of 'optimal' decision makers) provides little useful guidance for interfaces that operators trust and find useful. Likewise, a descriptive model that fails to include paths prescribing operator activities consistent with overall goals and system structure yields little useful design information.

The following sections formalize these characteristics into a set of tenets. The hypothesis of this paper is that these tenets are necessary characteristics of models useful in designing effective operator interfaces to complex dynamic systems.

1. Models should explicitly represent the domain of application.

Context-free research, e.g., research into the 'best' menu structure, the best number or set of colors for display screens or 'domain general' human behavior, is not typically useful in enhancing operator or system performance in complex systems or in understanding or predicting the behavior of operators who are experienced and well motivated. There are at least two reasons. First is the belief shared by all the disciplines discussed above: only with an understanding of context can behavior be understood or predicted; otherwise, human behavior is too diverse to model effectively. Second, much of the research that is purported to be context free in fact has implicit assumptions about the domain of application; such assumptions restrict its utility and generalizability. Careful examination of a great deal of the research presented under the rubric of human-computer interaction implicitly assumes that the domain is office automation, desk-top publishing, or software development. Very little of this research is applicable to an environment that is dynamic (i.e., the state changes whether or not the human operator takes some action) or complex (the cost of errors may be catastrophic or enormous), or addresses the needs of well-trained, well-motivated operators engaged in roles that are multi-task, multi-objective, and multi-person (Baron, 1984).

For example, although the cluttered desk metaphor is ubiquitous, most designers of supervisory control systems must address display design in the context of multiple monitors: operator workstations in dynamic systems typically consist of between five and eight monitors. Thus, the issue is not so much how to manage a set of overlapping windows on a desktop as how to manage four or five monitors, with potentially hundreds of display pages and thousands of data items, and how to display information that may be needed continuously or only under certain circumstances.

2. Models require a hierarchic structure.

As systems become more complex, the number of operator-controlled modes and system-operating conditions increases, thus increasing the complexity of the control problem. As a result, operators, both individually and as teams, develop ways to organize and reduce the complexity of the system and associated control activities (Miller, 1985; Rasmussen, 1986). Hierarchies are often proposed as a mechanism to reduce complexity and organize large amounts of system knowledge (Miller, 1985; Mitchell & Miller, 1986; Rasmussen, 1986)

A modeling methodology that fails to mirror the organizational structure that designers, engineers, and operators use to organize their knowledge will be hard to apply and validate. Large-scale systemss are typically conceptualized, designed, and controlled hierarchically. Representation is both bottom-up and top-down. The sheer volume of information about a large, complex, and dynamic system requires that information be organized with levels that systematically abstract away detail in order to focus on higher level functions, purposes, or behaviors. Likewise, to understand a given level, increasing detail is added top-down until the finest level of system description or control activity is specified or described.

Model validation is essential to ensure a representation that is useful for design. Models that fail to match the cognitive structure or organization that system engineers and operators develop to conceptualize the system and its operation are unlikely to be understood by domain practitioners and, thus, modeling errors of both omission and commission may pass undetected.

3. Models should include a detailed and formal representation of operator control activity.

Human-machine system models can represent the system being controlled, the control system, the operator responsible for supervisory control, or any mix thereof. For effective design of operator interfaces, however, the model must include a detailed description of operator activities. As Norman makes clear in his definition of user-centered design: effective interface design requires detailed knowledge of what activities a user will carry out by means of the interface (Norman, 1986).

For complex systems, the utility of designs based on a task-analytic model is sometimes questioned, e.g., (Vicente & Rasmussen, 1992). It is certainly the case that all required operator activities or system scenarios cannot be anticipated ahead of time. In fact, operators are often retained in systems to ensure safety and system effectiveness in the face of unanticipated circumstances. Given today's levels of automation, however, for the foreseeable future, the majority of operator time will be spent monitoring and controlling a system that is operating within nominal or anticipated ranges. As such, it is reasonable to design operator interfaces, e.g., displays, aids, and training systems, to support execution of nominal or anticipated control activities. Indeed, there is strong evidence that displays and other interfaces based on activity models significantly enhance the performance of trained operators when compared with either conventional designs or innovations based on other paradigms (Benson, Govindaraj, Mitchell, & Krosner, 1992; Kirlik, Kossack, & Shively, 1994; Mitchell, 1996).

4. The activity model should be hierarchic in form, with the highest level specifying control functions and the lowest level specifying individual control actions.

In complex systems, activity definition rarely consists of only the specification of individual operator control commands or information queries. Rather, high-level operator functions are defined and systematically decomposed into sets of operator actions needed to carry them out.

A hierarchical representation allows both the semantics and syntax of control activity to be conceptualized and linked. Higher level activities specify the control functions and subfunctions. Operator actions, or inputs required to carry out higher level activities, are the lowest-level specification.

Specification of actions can be either conceptual, i.e., independent of a specific interface configuration or linked to attributes of the hardware and software that comprise the interface. Both representations are useful, though the conceptual representation facilitates linkage of a action to alternative ways of achieving it. Most control systems that include a graphical user interface also retain a command-line, thus operators have at least two means for achieving the same effect.

The number of levels and associated names should be chosen to organize coherently the relationship between functions and actions and to reflect the semantics of the domain. The term activity is meant to be used at any level of abstraction: from function to action. Functions may be decomposed into subfunctions. Actions are likely to be grouped into higher-level activities, that may be called tasks (an organized set of actions to accomplish some goal), procedures (a prespecified sequences of actions normally initiated by some event), checklists, etc. For example, nuclear power plant operators have procedures and pilots have checklists.

The terminology of functions and subfunctions is used rather than goal and subgoal because these are the terms that operators, engineers, and designers often use to describe system control activities. Although functions and subfunctions, indeed any operator activity, is associated with a goal or purpose, in system control, goals are often implicit. For example, spacecraft controllers describe an activity as 'monitor the health and status of a subsystem,' rather than to pursue the associated goal, i.e., ensure that subsystem variables remain within specified ranges. Likewise, pilots characterize their primary flight deck functions as aviate, navigate, and communicate as opposed to the goal, 'navigate safely and efficiently.'

5. Activity models should be heterarchic and the relationship among activities at the same level should allow specification of a non-deterministic relationship.

Most operators supervising complex dynamic systems carry out multiple activities concurrently. Models should represent the multiple, and perhaps competing, goals, and the associated activities. A heterarchic representation allows a model to reflect the operator's multi-tasking role and dynamic focus of attention.

Operator models must reflect the flexibility, i.e., non-deterministic nature, of many control activities. At any given time, for a given system state, there may be no next best activity, but rather a set of plausible activities that will meet one or more system and operator goals. The notion of mapping from a current state to a set of feasible next activity choices is called non-deterministic to distinguish it from activity flows which are strictly deterministic (i.e., sequential) or can be described by a probability distribution (i.e., stochastic) (Mitchell, 1987; Mitchell & Miller, 1986) A non-deterministic representation partitions incorrect from feasible activity choices. Thus, activity that is likely to be erroneous can be identified.

Sequential models fail to represent the inherent flexibility in control systems that operators can, and do, choose to use. A common problem with rule-based models is that a predicted sequence of actions, one of several possible, does not match the chosen sequence (Knaeuper & Rouse, 1985). For some systems, a best action sequence may be identifiable based on a metric or operating procedures. Operators, however, cleverly find alternatives that, for all practical purposes, are equivalent. For many systems, no a priori best choice is specified: operators are instructed to carry out all required functions carefully and in a timely manner.

Models used for design should carefully preserve the flexibility inherent in the system. A number of advice-giving and training systems based on sequential models of performance failed to enhance performance (Knaeuper & Morris, 1984; Resnick, Mitchell, & Govindaraj, 1987; Zinser & Henneman, 1988). In each case, operators tended to ignore advice or training instructions in favor of alternative strategies that, given system goals, were equally effective.

Non-deterministic models provide no ordering for feasible activities options. Although stochastic models may be powerful tools in ordering alternative strategies, there is rarely sufficient data to formulate operator-specific distributions that reflect personal preferences. In a recent study of a system that inferred pilot intentions from control actions, more than 33% of the initial inferences were revised because pilots made alternative, but valid, mode choices (Callantine & Mitchell, 1996).

6. The model should allow representation of activities that may be perceptual, cognitive, etc. as well as physical.

In supervisory control systems, many activities may not involve explicit physical activities; activities may be perceptual, cognitive, or have some other non-physical manifestation. Thus, an operator may scan a displayed value (perceptual) and evaluate it against a desired setpoint (cognitive). As control systems become more automated and operators increasingly become system monitors, operator workload is likely to be composed of activities that are not associated with overt physical actions. Pilot scan, for example, includes examination of speed, altitude, pitch and roll; in current cockpits, all of this information is displayed concurrently, and, thus, a scan involves no physical action above the level of eye or head movement.

Operator interfaces should be designed to support both physical and non-physical activities, or the workload associated with an interface may unintentionally increase. Modeling methods such as traditional task-analytic techniques typically model only physical activities (Kirwan & Ainsworth, 1992). As such, they do not adequately identify information needs or decisions such as situation assessment. This type of analysis is unlikely to ensure that an interface effectively supports an important class of supervisory control activities.

7. The model should link organized sets of operator activities to system representations that cue them.

In dynamic systems, to organize information and facilitate validation, operator activity should be described in the context of system state and enabling or triggering events. A single collection of activities may be carried out in support of one or more different higher-level activities.

Most control activities are associated with one or more enabling events. An event can be thought of as a change in system state or the result of an operator action. Enabling or triggering events cue an operator that an activity should be performed. Pilots, for example, execute a top-of-descent checklist and satellite controllers execute pre-pass procedures to establish and verify communications channels.

Linking activities and enabling events to sequences of expected activities begins to specify the requirements of an 'intelligent' operator interface. An intelligent interface can be thought of an one that provides information or advice at the right time, in the right form, and at the right level of abstraction (Mitchell, 1996; Mitchell & Miller, 1986).

8. A model of operator activity should, at least in part, guide the design of displays and controls.

Design of displays and control for operators of complex dynamic systems is a difficult task and one often done poorly. Rasmussen (1986) characterizes conventional displays as illustrative of the one-sensor-one-display design approach. Displayed data are provided at a single level of detail, typically that of the sensors used to record them and in the units in which they are measured. Even when represented electronically, where format is a design decision, displays in control rooms typically show only the lowest level of data available

There are several reasons for this. One is that historically there was only one level of display and thus displayed data needed to be provided at the lowest level of detail available, guarding against the possibility that data aggregation or abstraction inadvertently omitted necessary information. Second, most systems have more than one type of user; if only one level of information is available, the most detailed is probably the only safe choice.

It is important to note that although historically a one-sensor-one-display design may have been necessary due to hardware and software constraints, such constraints no longer apply. Inexpensive display hardware, versatile software, and readily available interface technology allow the implementation of interfaces that are limited only by the skill and knowledge of designers.

The third reason is the prevalence of hardware-, as opposed to user-, centered design. This issue directly addresses designer knowledge about the operator activities an interface is intended to support. The role of the operator in a complex system is often defined by default: the operator performs whatever activities are necessary to compensate for the limitations of the control system's hardware and software. It is not atypical for designers to be fairly unfamiliar with actual operator activities. Thus, interface design resembles those aspects about which designers know the most: system hardware and software. Mitchell gives one example of hardware-centered design in satellite ground control (Mitchell, 1987). Chappell and colleagues provide another on the flight deck of modern aircraft (Chappell, Crowther, Mitchell, & Govindaraj, 1996). Woods and colleagues illustrate it in manned space systems (Woods, Johannesen, Cook, & Sarter, 1994).

An interesting experience that further illustrates the problem concerns a commercial control system widely used in the process control industry. The interface is based on system schematics and makes extensive use of newer user interface technologies. A major U.S. oil company requested assistance in understanding why oil refinery operators disliked the control system interface, whereas company engineers found it very useful. An analysis of operator activities showed that to carry out nominal and off-nominal activities operators had to thrash through many layers of display pages, copy down data that were needed but overlaid by other pages, and manually aggregate recorded values with pen and paper. Although the schematics-based interface metaphor matches the engineers' cognitive representation of the system, the same representation was not consistent with the representation or the needs of operators.

Designs based on an model of operator activity are open of course to the criticism that they fail to support the operator in unanticipated (i.e., unmodeled) circumstances (Vicente & Rasmussen, 1992). Although activity-based displays can be expected to be effective most of the time, designers should take care to preserve access to the lowest level data available in the system. Displays linking information to activities are proposed as an added layer, not as a replacement, for currently available information (Mitchell & Miller, 1986). Moreover, activities other than supervisory control, e.g., fault detection and management, particularly activities conducted off-line, may require very different representations. Consider the difference in perceived usefulness between the engineers and operators using the process control system described above. Rasmussen's (1986) abstraction hierarchy, a model of system structure, might be much more effective in supporting fault diagnosis. By definition, however, unexpected circumstances cannot be anticipated; thus, no display design can guarantee to support them. Anomalous events or catastrophes will force operators to use any information available, perhaps reverting to the original one-sensor-one-display formats and/or system schematics.

10. Operator displays should be 'intelligent'. Intelligence may be defined and controlled by an activity model anticipating operator needs.

Displayed information should match the operator's needs given the current system state. An understanding of what information the operator needs under various system conditions allows the aggregation and abstraction of data into information that is tailored to current system state.

Activity models can be used both to design the interface and to specify the software that controls, in real time, the amount and form of displayed information. Higher levels of an activity model specify grouping of information into windows and windows into meaningful sets. Operators can indicate to the interface an intention to perform some activity and the model can retrieve, organize, and display the needed information.

Norman's user-centered design and Woods' (1995) notion of representation aiding can both be implemented by means of activity models (Woods, 1995). An activity model specifies likely user needs and defines the semantics of representations that are likely to be useful.

Displays based on activity models have been shown to have a number of useful attributes. Such displays have significantly enhanced the performance of trained operators (Dunkler, Mitchell, Govindaraj, & Ammons, 1988; Mitchell & Saisi, 1987; Thurman & Mitchell, 1995). Activity-based design can be contrasted with other strategies whose improvements either failed to result in a significant performance enhancement or resulted in enhancements that faded as operator expertise stabilized (Benson et al., 1992; Kirlik et al., 1994). In empirical studies, model-based designs appear to compensate for system variability and to constrain operator behavior--both desirable, though somewhat unexpected, attributes (Thurman, 1995; Weiner, Thurman, & Mitchell, 1995). Moreover, activity-based designs seem to reduce user variability and enhance the performance of less skilled users (Miller, 1985; Mitchell & Miller, 1986). The best operators are usually effective regardless of the quality of the interface. Displays that 'suggest' a means of controlling the system, however, appear to help less skilled operators learn more quickly and when trained, perform in an effective and more consistent manner.

11. Decision aids should retain the operator in the decision process. One strategy is to base the structure of the aid and its interaction with the operator on a model of operator activity.

Advances in computer technology and artificial intelligence provide new computational tools that greatly expand the potential to support decision making in the supervisory control of complex work environments (Woods, 1986a). The most frequent use of this technology, however, is often inconsistent with human skills.

...the primary design focus is to use computational technology to produce a stand-alone machine expert that offers some form of problem solution...(Thus), the interface design process focuses on features to help the user accept the machine solution (p.87) (Woods, 1986b).

Woods notes that the primary issue in such systems is user acceptance of the proposed solution and that system designers will go so far as to suggest that the system provide the user with placebo-like interaction in order to facilitate user acceptance of the machine's recommendations. For example, some systems allow users input to report data that they consider important; the aid, however, does not make use of these data.

Woods identifies three problems with such systems. First, when the machine gives only its solution to a problem, the decision maker may not have the authority to override machine output in practice as well as in theory. Since the only practical options are to accept or reject system output, there is a great danger of what Woods calls the 'responsibility/authority double-bind' in which the user always either rejects or accepts the machine solution. The former discards the enhancements that intelligent decision support may add to overall system effectiveness; the latter abrogates the responsibility and purpose of the human decision maker in the system.

The second problem is that it is not clear that people are skilled at discriminating correct from incorrect solutions. The effectiveness of human decision makers in system control may depend on intimate involvement in the decision process rather than only evaluation of the decision product.

Woods identifies the potential loss of cognitive skill as the third problem. Humans are retained in systems to compensate for the limitations of automation. A user who depends almost exclusively on the recommendations of the machine expert may be ill-prepared for occasions when the machine expert fails and operator skill is essential to safe and effective system operation.

Research provides experimental data that illustrate some of the problems. In a series of experiments at Georgia Tech, advice-giving systems consistently failed to improve overall system performance (Knaeuper and Morris, 1984; Resnick et al., 1987; Zinser and Henneman, 1988). The primary reason that these systems failed to enhance system performance is that users either did not ask for or did not take the advice. In one instance in which the machine-based system automatically recommended the next operator procedure, a pilot study showed that in order to dispel user animosity, the aid had to be 'toned down' (Knaeuper and Morris, 1984). In the other studies, although advice was free (i.e., neither system had either an implicit or explicit penalty for requesting advice), subjects rarely requested it. These results raise interesting questions about the efficacy and style of decision support.

An alternative is to design decision support systems with a knowledge base and problem solving process that is comparable to that of the user. Decision aids whose design and processing is based on an activity model can offer advice and a rationale that is understandable by a user. Contrast this to typical rule-based advisory systems that provide a rule trace-back when asked for an explanation.

Cognitive science research has shown that conversational 'repair' is essential in effective human dialog (Bushman, Mitchell, Jones, & Rubin, 1993; Fox, 1993). An aid whose advice is offered at multiple levels of abstraction can be tailored or easily redirected by users to provide more assistance more pertinent to the situation at hand. Several experiments illustrate the utility of this approach. Aids based on activity models have consistently enhanced operator performance (Bushman et al., 1993) and defined the computer component of human-computer teams that are as effective as teams comprised of two experienced operators (Bushman et al., 1993; Jones & Mitchell, 1995).

12. Human-centered automation requires a model of operator intent. An activity model is a good candidate.

Human-centered automation is automation which helps the operator carry out supervisory control functions and, in the face of anomalous events, allows the operator to transition efficiently to lower-level system control (Billings, 1991). Not all automation is human-centered. As systems become more sophisticated, it is possible that some systems may no longer require supervision by an operator responsible for moment-to-moment system operation and control. In manufacturing, this is sometimes called 'lights out' automation.

If the operator is to remain part of the control loop, however, and resume control in the event of system failure, automation must be human-centered, or the operator and automation will not interact collaboratively. Current automation frequently confuses or surprises operators. Weiner (1989) describes pilot reactions to flight control automation: What is it doing? Why is it doing that? What will it do next?

Billings suggests that human-centered automation requires mutual intent inferencing; thus, the computer must have a model of the operator. An operator activity model is one way to structure the knowledge that the computer controller has about the operator and the processes it uses to carry out control activities. A model that is intelligible to both computer and operator can support mutual intent inferencing, facilitate collaboration, and, when a difference or question arises, allow rapid and effective inspection, repair, or smooth transfer of control from computer to operator.

Operator intent inferencing systems whose design is based on activity models have been shown to be very effective at inferring operator intentions; and control automation or aids based on these models offered assistance, reminders, and suggestions that enhanced overall system performance (Callantine & Mitchell, 1996; Geddes, 1989; Jones, Mitchell, & Rubin, 1990; Sewell & Geddes, 1990).

Baron, S. (1984). A control theoretic approach to modelling human supervisory control of dynamic systems. In W. B. Rouse (Ed.), Advances in man-machine systems research (pp. 1-47). Greenwich, Connecticut: JAI Press, Inc.

Benson, C. R., Govindaraj, T., Mitchell, C. M., & Krosner, S. M. (1992). Effectiveness of direct manipulation interaction in the supervisory control of flexible manufacturing systems. Information and Decision Technologies, 18, 33-53.

Billings, C. E. (1991). Human-centered aircraft automation: A concept and guidelines. Report Technical Memorandum. (#103885). Moffet Field, CA: NASA Ames Research Center.

Bushman, J. B., Mitchell, C. M., Jones, P. M., & Rubin, K. S. (1993). ALLY. An operator's associate for cooperative supervisory control systems. IEEE Transactions on Systems, Man, and Cybernetics, 23(1), 111-128.

Callantine, T. J. & Mitchell, C. M. (1996). GT-CATS: Tracking operator activities in complex systems. Report Moffet Field, CA: NASA Ames Research Center.

Chappell, A. R., Crowther, E. G., Mitchell, C. M., & Govindaraj, T. (1996). The VNAV Tutor: Addressing a mode awareness difficulty for pilots of glass cockpit aircraft. IEEE Transactions on System, Man, and Cybernetics, accepted for publication.

Chu, Y. & Rouse, W. B. (1979). Adaptive allocation of decision making responsibility between human and computer in multi-task situations. IEEE Transactions on Systems, Man, and Cybernetics, SMC-9(12), 769-777.

Dunkler, O., Mitchell, C. M., Govindaraj, T., & Ammons, J. C. (1988). The effectiveness of supervisory control strategies in scheduling flexible manufacturing systems. IEEE Transactions on Systems, Man, and Cybernetics, SMC-18(2), 223-237.

Elkind, J. E., Card, S. K., Hochberg, and Huey, B. M. (Eds.) (1989). Human performance models for computer-aided engineering. Report Washington, D. C.: National Academy Press.

Flach, J., Hancock, P., Caird, J., Vicente, K. (Ed.). (1995). Global perspectives on the ecology of human-machine systems. Hillsdale, NJ: Lawrence Erlbaum Associates.

Fox, B. A. (1993). The human tutorial dialogue project: Issues in the design of instructional systems. Hillsdale, NJ: Lawrence Erlbaum Associates.

Geddes, N. D. (1989). Understanding human operator intentions in complex systems. Unpublished doctoral dissertation, Center for Human-Machine Systems Research, School of Industrial and Systems Engineering, Georgia Institute of Technology, Atlanta, GA.

Jones, P. M. & Mitchell, C. M. (1995). Human-computer cooperative problem solving: Theory, design, and evaluation of an intelligent associate system. IEEE Transactions on Systems, Man, and Cybernetics, SMC-25(7), 1039-1053.

Jones, P. M., Mitchell, C. M., & Rubin, K. S. (1990). Validation of intent inferencing by a model-based operator's associate. International Journal of Man-Machine Studies, 33, 177-202.

Kirlik, A., Kossack, M. F., & Shively, R. J. (1994). Ecological task analysis: Supporting skill acquisition in dynamic interaction. Report Center for Human-Machine Systems Research, School of Industrial and Systems Engineering, Georgia Institute of Technology, Atlanta, GA.

Kirwan & Ainsworth (Eds.). (1992). A guide to task analysis. Washington, D.C.: Taylor & Francis.

Knaeuper, A. & Morris, N. M. (1984). A model-based approach for online aiding and training in process control. In Proceedings of the 1984 IEEE International Conference on Systems, Man, and Cybernetics (pp. 173-177).

Knaeuper, A. & Rouse, W. B. (1985). A rule-based model of human problem-solving behavior in dynamic environments. IEEE Transactions on Systems, Man, and Cybernetics, SMC-15(6), 708-719.

Miller, R. A. (1985). A system approach to modeling discrete control performance. In W. B. Rouse (Ed.), Advances in man-machine systems (pp. 177-248). Greenwich, Connecticut: JAI Press, Inc.

Mitchell, C. M. (1987). GT-MSOCC: A domain for modeling human-computer interaction and aiding decision making in supervisory control systems. IEEE Transactions on Systems, Man, and Cybernetics, SMC-17(4), 553-572.

Mitchell, C. M. (1996). GT-MSOCC: Operator models, model-based displays, and intelligent aiding. In W. B. Rouse (Ed.), Human-technology interaction in complex systems (pp. 233-293). Greenwich, CT: JAI Press Inc.

Mitchell, C. M. & Miller, R. A. (1986). A discrete model of operator function: A methodology for information display design. IEEE Transactions on Systems, Man, and Cybernetics, SMC-16(3), 343-357.

Mitchell, C. M. & Saisi, D. L. (1987). Use of model-based qualitative icons and adaptive windows in workstations for supervisory control systems. IEEE Transactions on Systems, Man, and Cybernetics, SMC-17(4), 573-593.

Norman, D. A. (1986). Cognitive engineering. In D. A. Norman & S. W. Draper (Eds.), User centered system design (pp. 31-61). Hillsdale, NJ: Lawrence Erlbaum Associates.

Rasmussen, J. (1986). Information processing and human-machine interaction: An approach to cognitive engineering. New York: North Holland.

Resnick, D. E., Mitchell, C. M., & Govindaraj, T. (1987). An embedded computer-based training system for rhino robot operators. IEEE Control Systems Magazine, May, 3-8.

Rouse, W. B. (1977). Human-computer interaction in multitask situations. IEEE Transactions on Systems, Man, and Cybernetics, SMC-7(5), 384-392.Rouse, W. B. (1980). System engineering models of human-machine interaction. New York: North Holland.

Rubin, K. S., Jones, P. M., & Mitchell, C. M. (1988). OFMspert: Inference of operator intentions in supervisory control using a blackboard architecture. IEEE Transactions on Systems, Man, and Cybernetics, SMC-18(4), 618-637.

Sewell, D. R. & Geddes, N. D. (1990). A plan and goal based method for computer-human system design. Human-computer interaction, INTERACT 90, 283-288.Sheridan, T. B. (1976). Toward a general model of supervisory control. In T. B. Sheridan & G. Johannsen (Eds.), Monitoring behavior and supervisory control (pp. 271-281). New York: Plenum Press.

Sheridan, T. B. & Ferrell, W. R. (1974). Man-machine systems: Information, control, and decision models of human performance. Cambridge, MA: The MIT Press.

Thurman, D. A. (1995). Improving operator effectiveness in monitoring complex systems: A methodology for the design of interactive monitoring and control interfaces. Unpublished M.S. Thesis, Center for Human-Machine Systems Research, School of Industrial and Systems Engineering, Georgia Institute of Technology, Atlanta, Georgia.

Thurman, D. A. & Mitchell, C. M. (1995). A design methodology for operator displays of highly automated supervisory control systems. In Proceedings of the 6th IFAC/IFIP/IFOR/SEA Symposium on Analysis, Design, and Evaluation of Man Machine Systems . Boston, MA.

Vicente, K. J. & Rasmussen, J. (1992). Ecological interface design: Theoretical foundations. IEEE Transactions on Systems, Man, and Cybernetics, SMC-22(4), 589-606.Walden, R. S. & Rouse, W. B. (1978). A queueing model of pilot decisionmaking in a multitask flight management situation. IEEE Transactions on Systems, Man, and Cybernetics, SMC-8(12), 867-875.

Weiner, A. J., Thurman, D. A., & Mitchell, C. M. (1995). Applying case-based reasoning to aid fault management in supervisory control. In Proceedings of the 1995 International Conference on Systems, Man, and Cybernetics (pp. to appear). Vancouver, BC.

Wickens, C. D. (1984). Engineering psychology and human performance. Columbus, Ohio: Charles Merrill. Woods, D. D. (1986a). Cognitive technologies: The design of joint human-machine cognitive systems. The AI magazine, 86-92.

Woods, D. D. (1986b). Paradigms for intelligent decision support. In E. Hollnagel, G. G. Mancini, & D. Woods (Eds.), Intelligent decision support in process environments, (pp. 153-174). New York: Springer-Verlag.

Woods, D. D. (1995). Towards a theoretical base for representation design in the computer medium: Ecological perception and aiding human cognition. In J. Flach, P. Hancock, J. Caird, & K. Vicente (Eds.), Global perspectives on the ecology of human-machine systems (pp. 157-188). Hillsdale, New Jersey: Lawrence Erlbaum Associates.

Woods, D. D., Johannesen, L. J., Cook, R. I., & Sarter, N. B. (1994). Behind human error: Cognitive systems, computers, and hindsight. Wright-Patterson AFB, OH: Crew Systems Ergonomics Information Analysis Center.

Woods, D. D. & Roth, E. M. (1988). Cognitive systems engineering. In M. Helander (Ed.), Handbook of human-computer interaction (pp. 3-34). Amsterdam: Elsevier Science Publishers.

Zinser, K. & Henneman, R. L. (1988). Development and evaluation of a model of human performance in a large-scale system. IEEE Transactions on Systems, Man, and Cybernetics, SMC-8(3), 367-375.