Building safe software

Murphy is a set of techniques and tools under investigation for their potential in enhancing the safety of software. This paper describes some of the work which has been done and some which is planned

Resilience markers for safer systems and organisations

If computer systems are to be designed to foster resilient performance it is important to be able to identify contributors to resilience. The emerging practice of Resilience Engineering has identified that people are still a primary source of resilience, and that the design of distributed systems should provide ways of helping people and organisations to cope with complexity. Although resilience has been identified as a desired property, researchers and practitioners do not have a clear understanding of what manifestations of resilience look like. This paper discusses some examples of strategies that people can adopt that improve the resilience of a system. Critically, analysis reveals that the generation of these strategies is only possible if the system facilitates them. As an example, this paper discusses practices, such as reflection, that are known to encourage resilient behavior in people. Reflection allows systems to better prepare for oncoming demands. We show that contributors to the practice of reflection manifest themselves at different levels of abstraction: from individual strategies to practices in, for example, control room environments. The analysis of interaction at these levels enables resilient properties of a system to be ‘seen’, so that systems can be designed to explicitly support them. We then present an analysis of resilience at an organisational level within the nuclear domain. This highlights some of the challenges facing the Resilience Engineering approach and the need for using a collective language to articulate knowledge of resilient practices across domains

Technology for the Future: In-Space Technology Experiments Program, part 2

The purpose of the Office of Aeronautics and Space Technology (OAST) In-Space Technology Experiments Program In-STEP 1988 Workshop was to identify and prioritize technologies that are critical for future national space programs and require validation in the space environment, and review current NASA (In-Reach) and industry/ university (Out-Reach) experiments. A prioritized list of the critical technology needs was developed for the following eight disciplines: structures; environmental effects; power systems and thermal management; fluid management and propulsion systems; automation and robotics; sensors and information systems; in-space systems; and humans in space. This is part two of two parts and contains the critical technology presentations for the eight theme elements and a summary listing of critical space technology needs for each theme

The Effect of Interruptions on Primary Task Performance in Safety-Critical Environments

Safety critical systems in medicine utilize alarms to signal potentially life threatening situations to professionals and patients. In particular, in the medical field multiple alarms from equipment are activated daily and often simultaneously. There are a number of alarms which require caregivers to take breaks in complex, primary tasks to attend to the interruption task which is signaled by the alarm. The motivation for this research is the knowledge that, in general, interrupting tasks can have a potentially negative impact on performance and outcomes of the primary task. The focus of this research is on the effect of an interrupting task on the cognitive behavior of nurses on a primary task: administering medication to a simulated patient. Fifty-eight student nurses were monitored with eye-tracking technology as they perform direct patient care and a medication administration task. There are four hypotheses. First, it is hypothesized that an interruption generated by an alarm during medication administration significantly increases errors because it causes caregivers to forget components of the original task. These errors result when the primary task is suspended in memory, as a result of the intervening task, and because of this suspension, memory for the original task can decay. Second, it is hypothesized that interrupting tasks result in time delays on the primary task (the time during which the caregiver is performing the interrupting task is not included in the time to perform the original task). Third, it is hypothesized that metacognition training will mitigate the negative effects of the interrupting task on the primary task. The metacognition training is based on knowledge of how memory processes are affected by interruptions and how modifying these processes can potentially result in a reduction of errors. Fourth, it is hypothesized that the intervention strategy will lead to improvements in the memory for the material that is required to resume and complete the primary task. This improvement will be measured by increases in the number of eye fixations to the primary task before attending to the secondary task. Furthermore, this measurement will correlate with a reduction in errors

Feasibility study of an Integrated Program for Aerospace vehicle Design (IPAD). Volume 2: The design process

The extent to which IPAD is to support the design process is identified. Case studies of representative aerospace products were developed as models to characterize the design process and to provide design requirements for the IPAD computing system

An Agent Based Model to Assess Crew Temporal Variability During U.S. Navy Shipboard Operations

Understanding the factors that affect human performance variability as well as their temporal impacts is an essential element in fully integrating and designing complex, adaptive environments. This understanding is particularly necessary for high stakes, time-critical routines such as those performed during nuclear reactor, air traffic control, and military operations. Over the last three decades significant efforts have emerged to demonstrate and apply a host of techniques to include Discrete Event Simulation, Bayesian Belief Networks, Neural Networks, and a multitude of existing software applications to provide relevant assessments of human task performance and temporal variability. The objective of this research was to design and develop a novel Agent Based Modeling and Simulation (ABMS) methodology to generate a timeline of work and assess impacts of crew temporal variability during U.S. Navy Small Boat Defense operations in littoral waters. The developed ABMS methodology included human performance models for six crew members (agents) as well as a threat craft, and incorporated varying levels of crew capability and task support. AnyLogic ABMS software was used to simultaneously provide detailed measures of individual sailor performance and of system-level emergent behavior. This methodology and these models were adapted and built to assure extensibility across a broad range of U.S. Navy shipboard operations. Application of the developed ABMS methodology effectively demonstrated a way to visualize and quantify impacts/uncertainties of human temporal variability on both workload and crew effectiveness during U.S. Navy shipboard operations

Technical approaches for measurement of human errors

Human error is a significant contributing factor in a very high proportion of civil transport, general aviation, and rotorcraft accidents. The technical details of a variety of proven approaches for the measurement of human errors in the context of the national airspace system are presented. Unobtrusive measurements suitable for cockpit operations and procedures in part of full mission simulation are emphasized. Procedure, system performance, and human operator centered measurements are discussed as they apply to the manual control, communication, supervisory, and monitoring tasks which are relevant to aviation operations