Display Design to Support Efficient Search in Safety Risk Identification for Supervisory Control of Unmanned Aerial Vehicles

Kurzfassung

Humans will continue to play a crucial role in future, highly automated aviation systems despite the introduction of increasing system autonomy. Humans are especially needed to ensure the safe execution of safety-critical system functions. Whereas the automation executes the system functions, the human operator is responsible for supervising the execution of the functions, also known as supervisory control. The design of Human Machine Interfaces (HMIs) for supervisory control poses a major challenge, as the HMI must be developed in such a manner that the human operator is constantly kept informed of the automation's behavior and intent. However, supervisory control of complex, highly automated or autonomous systems with several modes of operation requires the monitoring of a large number of system parameters. If the HMI is not designed well, it leads to the danger of not detecting safety risks in time or at all. In order to assist in the detection of safety risks, the HMI should allow for efficient visual search for off-nominal system indications. This should be accomplished by adopting strategies for display design that prevent the displays from becoming unnecessarily complex. With regard to different strategies for display design, two design philosophies are the most relevant in terms of visual complexity and thus the ability to support efficient search: the Ecological Interface Design (EID) and the dark design philosophy. Ecological displays are rather complex, as they visualize a large amount of information required to understand interrelationships (also known as means-end relationships) between different system processes and functions. These means-end relationships are shown to support the human operator in interpreting the current system state correctly and enable problem-solving. However, due to the complexity of ecological displays, visual search can become more difficult. In contrast, dark displays are typically very simple in layout but do not visualize the interrelationships between different system processes and functions. Thus, while visual search is commonly better supported in dark displays, it is more difficult for the operator to develop an accurate understanding of the system and the current system state as a whole. There is currently no display design philosophy that aims to combine the advantages of ecological and dark displays, i.e. enabling visual search while still ensuring a comprehensive understanding of the system. Therefore, the research gap this dissertation seeks to fill is the development of a new display design concept combining the main notions from EID and the dark display design method. Primarily, the goal of the new display design concept is to visualize the means-end relationships while facilitating efficient visual search for off-nominal system behavior. This is achieved by systematically hiding information from the human operator's primary view in order to keep the display layout simple without omitting any information required for the human operator to understand the means-end relationships during safety-compromising events. The developed display design concept is described in detail in chapter 3. In the new display design concept, states of safety critical system functions are displayed by function-specific icons. Different system states are represented by different colors. These colors differ according to the urgency of the system state they represent. The choice of color is determined based on color salience. A method to quantify target color salience was developed and used to determine the appropriate colors for depicting system states of increasing urgency (e.g., a warning state is more urgent than an advisory state and should therefore be displayed using a more salient color). The goal of matching the salience of the target color to the urgency of the system state information is to guide the human operator's visual attention (in terms of reaction time) based on the system state's urgency, leading to shorter reaction times the more urgent a system state information is. In order to validate the method for quantifying color salience and to choose the optimal colors for representing system states of varying urgency, two visual search experiments were conducted. The results of the experiments support the proposed method for quantifying target salience and suggest to use light grey for safe, and yellow and red for safety critical indications. Cyan is suited for coding advisory indications that are less critical. The method to determine color salience and the two conducted experiments are described in detail in chapter 4. Finally, the developed display design concept was applied to the design of displays in two use cases: first, the autonomous operation of multiple small Unmanned Aerial Vehicles (UAV) in low-altitude urban airspace and second, the remote supervision of multiple large UAVs in controlled airspace. Both displays were evaluated within the scope of evaluation studies (see chapter 5). The results of the evaluation studies suggest that the designed displays are feasible and easy to understand. The information management concept of the new display design concept was described as reasonable and logical with satisfying results for usability and acceptability. Important information was accessible quickly and (critical) system states could easily be identified. Most of the designed icons for representing safety critical system functions are well suited to represent their intended function. In chapter 6, the findings of each conducted study are related to each other. It is described how the findings together fill the research gap. Furthermore, the implications of the results as well as limitations and the potential for future research are elaborated and discussed.