This article was downloaded by: [Selcuk Universitesi]

On: 24 January 2015, At: 23:55

Publisher: Taylor & Francis
Informa Ltd Registered in England and Wales Registered Number: 1072954 Registered
office: Mortimer House, 37-41 Mortimer Street, London W1T 3JH, UK

Theoretical Issues in Ergonomics

Science
Publication details, including instructions for authors and
subscription information:
http://www.tandfonline.com/loi/ttie20

Human-in-the-loop: probabilistic
predictive modelling, its role,
attributes, challenges and applications
abcd
Ephraim Suhir
a
Department of Mechanics and Materials, Portland State
University, Portland, OR, USA
b
Department of Applied Electronic Materials, Technical
University, Vienna, Austria
c
Faculty of Engineering, Ariel University, Ariel, Israel
Click for updates d
ERS Co., 727 Alvina Ct., Los Altos, CA 94024, USA
Published online: 20 Aug 2014.

To cite this article: Ephraim Suhir (2015) Human-in-the-loop: probabilistic predictive modelling,
its role, attributes, challenges and applications, Theoretical Issues in Ergonomics Science, 16:2,
99-123, DOI: 10.1080/1463922X.2014.895879

To link to this article: http://dx.doi.org/10.1080/1463922X.2014.895879

PLEASE SCROLL DOWN FOR ARTICLE

Taylor & Francis makes every effort to ensure the accuracy of all the information (the
“Content”) contained in the publications on our platform. However, Taylor & Francis,
our agents, and our licensors make no representations or warranties whatsoever as to
the accuracy, completeness, or suitability for any purpose of the Content. Any opinions
and views expressed in this publication are the opinions and views of the authors,
and are not the views of or endorsed by Taylor & Francis. The accuracy of the Content
should not be relied upon and should be independently verified with primary sources
of information. Taylor and Francis shall not be liable for any losses, actions, claims,
proceedings, demands, costs, expenses, damages, and other liabilities whatsoever or
howsoever caused arising directly or indirectly in connection with, in relation to or arising
out of the use of the Content.

This article may be used for research, teaching, and private study purposes. Any
substantial or systematic reproduction, redistribution, reselling, loan, sub-licensing,
systematic supply, or distribution in any form to anyone is expressly forbidden. Terms &
 Conditions of access and use can be found at http://www.tandfonline.com/page/terms-
and-conditions
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015
 Theoretical Issues in Ergonomics Science, 2015
Vol. 16, No. 2, 99–123, http://dx.doi.org/10.1080/1463922X.2014.895879

Human-in-the-loop: probabilistic predictive modelling, its role,

attributes, challenges and applications
Ephraim Suhir*

Department of Mechanics and Materials, Portland State University, Portland, OR, USA; Department
of Applied Electronic Materials, Technical University, Vienna, Austria; Faculty of Engineering, Ariel
University, Ariel, Israel; ERS Co., 727 Alvina Ct., Los Altos, CA 94024, USA

(Received 14 November 2013; accepted 14 February 2014)

Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

Traditional human-factor-oriented approaches are based on experimentations followed

by statistical analyses. Our novel probabilistic predictive modelling (PPM) concept is
based on physically meaningful and flexible predictive modelling followed by
experimentations geared to the appropriate models. The concept enables one to
quantify, on the probabilistic basis, the outcome of a particular effort, situation or a
mission. This cost-effective and insightful approach is applicable to numerous human-
in-the-loop (HITL) situations, when a human acting as a part of the complex man–
instrumentation–equipment–vehicle–environment system encounters an uncertain
environment or a hazardous off-normal situation, and when there is an incentive to
improve his/her role in a particular mission or a situation. The application of the PPM
concept could improve dramatically the state-of-the-art in the HITL field in various
vehicular technologies and beyond. The examples are taken mostly from the field of
avionic safety.
Keywords: predictive modelling; probabilistic risk analysis; human-in-the-loop;
vehicular technologies; mission success and safety

1. Introduction
Human error contributes to about 80% of the vehicular (marine, avionic, automotive)
casualties and accidents (Sheridan and Ferrell 1974; Lehto and Buck 2008; Foyle and
Hooey 2008). This large percentage should not be attributed, of course, to the direct
human error only. A mishap often occurs because an erroneous decision is made by the
vehicle operator in the conditions of uncertainty as a result of his/her interactions, in vary-
ing and often harsh environmental conditions, with never-perfect forecasts, never 100%
dependable navigation instrumentation and operation equipment and not always user-
friendly and trustworthy information.
Considerable improvements in vehicular technologies can be achieved through better
ergonomics, better work environment and other means that directly affect human behav-
iour. There is also a significant opportunity for reduction in vehicular casualties through
probabilistic predictive modelling (PPM) followed by an appropriate experimentation
geared to a particular predictive model. PPM leads to better understanding of the role that
various uncertainties play in the planner’s and operator’s world of work. By employing
quantifiable and measurable ways of assessing the role of such uncertainties and by treat-
ing human-in-the-loop (HITL) as a part (often the most crucial part) of the complex

*Email: [email protected]

Ó 2014 Taylor & Francis

 100 E. Suhir

man–instrumentation–equipment–vehicle–environment system, one could improve dra-

matically the human performance and the vehicular mission success and safety, to predict
and, if needed, even specify and assure low enough probability of a mishap (Suhir 1997,
2010a, 2010b, 2012, 2013a, 2013b; Suhir and Mogford 2011; Salotti and Claverie 2012;
Salotti 2012). This probability cannot be high, but does not have to be lower than neces-
sary either: it has to be adequate for a particular application, mission or a situation. In
addition, there is always a wish to optimise the human and equipment performance in terms
of costs and preparation (planning) time. Because of that there is an obvious incentive for
quantifying the reliability of the man–instrumentation–equipment–vehicle–environment
system and to find the best compromise between its safety and cost-effectiveness.
Unlike the traditional statistical HITL approaches, which are based on experimenta-
tion followed by statistical analyses, our PPM concept is based on the physically mean-
ingful and flexible predictive modelling followed by experimentation geared to the
accepted and physically meaningful model(s). The PPM concept proceeds from under-
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

standing that nobody and nothing is perfect and that the difference between a success and
a failure in a particular effort, situation or a mission is, in effect, ‘merely’ the difference
in the level of the never-zero probability of failure. The PPM approach enables one to
quantify the outcome of a particular effort, and, with the appropriate modifications and
generalisations, is applicable not only in the vehicular domain, but also in numerous situa-
tions (forensic, medical, military, etc.), when there is a need to quantify human’s qualifi-
cations and performance. The PPM approach complements the existing system-related
and human-psychology-related efforts, and bridges the gap between the three critical
areas responsible for the system performance and safety – human factor, reliability engi-
neering and vehicular technologies. Additional analyses will be needed, of course, to
make the guidelines based on the suggested concept practical and effective. The effort
should be geared to particular applications and acceptable adequate (actually, low
enough) probabilities of failure. In the analysis that follows some findings obtained by
using the PPM are set forth.
One of the major challenges in the PPM effort addressed in this paper is to choose a
suitable probability distribution for the problem of interest. Although there is no straight-
forward way for doing that, the appropriate distribution could be either based on an accu-
mulated experience or could be anticipated and accepted beforehand based on the
common sense and the underlying physics of the problem of interest. Let us refer, as an
example, to the helicopter landing ship (HLS) problem addressed in Section 5. The time
of human reaction (decision-making) is never zero, but could not be infinitely long either,
and shorter times of human reaction are more likely than longer times. This means that
the probability distribution function for the human reaction time should be skewed in the
direction of shorter times: the most likely time of human reaction (maximum value of the
probability density distribution function) should be low, but never zero. The simplest dis-
tribution that meets these requirements is the single-parametric Rayleigh distribution, and
that is why this distribution has been selected to characterise human reaction. On the other
hand, the ‘lull’ time in the sea condition is most likely symmetric with respect to its mean
value, and therefore, the two-parametric normal distribution has been chosen to describe
the random ‘lull’ time. Although, generally, normal distribution also covers negative val-
ues of the random variable, this ‘shortcoming’ of the distribution is suppressed in our
HLS analysis by choosing a large enough ratio of the mean value of this time to its stan-
dard deviation. The double-exponential probability distribution function for human non-
failure that is addressed in the next section has also a clear physical meaning associated
with an uncertainty (entropy) of the probability of non-failure (Suhir and Mogford 2011).
 Theoretical Issues in Ergonomics Science 101

2. Double-exponential probability distribution function for human non-failure

The probability Ph ðF; GÞ of the navigator’s non-failure, when a vehicle is operated in off-
normal (extraordinary) conditions, can be assumed to be distributed in accordance with
the following double-exponential law (Suhir and Mogford 2011) of the extreme value dis-
tribution (EVD) type (see e.g. Suhir 1997):



G2 F2
Ph ðF; GÞ ¼ P0 exp 1 exp 1  : ð1Þ
G02 F02

Here P0 is the probability of non-failure for the specified (normal) mental workload
(MWL); G0 is the MWL in ordinary (normal) operation conditions; G  G0 is the actual
(elevated, off-normal) MWL; F0 is the most likely (normal, specified) human capacity
factor (HCF); F  F0 is the actual (off-normal) HCF exhibited or required in the extraor-
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

dinary condition. The P0 level should be established beforehand, as a function of G0 and

F0 . In avionics, this could be done by conducting testing and measurements, and record-
ing human failures on a flight simulator.
By differentiation the distribution (1), we obtain

dP 2H G2
¼ ;
dG G G  G02
2

where H ¼ Pln P is the entropy of the distribution. At MWL levels close to the normal
level G0 , the change in the relative probability of non-failure with the increase in the
MWL is significant. This is not surprising: it is relatively easy to improve poor perfor-
mance than a good one. In another extreme case, when GG0 , we have

dP 2H
¼ :
dG G

This result explains the physical meaning of the distribution (1): the change in the probability
of non-failure with the change in the level of the MWL is proportional, for high MWL levels,
to the degree of uncertainty (entropy of the distribution of this probability) and is inversely
proportional to the MWL level. The right part of the latter formula could be viewed as a
kind of a coefficient of variation (COV), where the role of the uncertainty in the numerator is
played by the entropy, rather than by the standard deviation, and the role of the stress (load-
ing) in the denominator is played by the MWL, rather than by the mean value of the random
characteristic of interest (as it is in the well-known statistical COV characteristic).
Equation (1) enables one to quantify, on the probabilistic basis, the human’s ability
(capacity) to cope with an elevated mental overload. Using an analogy from the reliability
engineering field and particularly with the well-known stress-strength interference model,
the MWL could be viewed as a certain ‘demand’ (‘stress’), while the HCF could be inter-
preted as a ‘capacity’ (‘strength’). Equation (1) combines, however, the demand and the
capacity in the same PPM. It is the relative level of the MWL and HCF that determine the
likelihood of a success or a failure.
It should be emphasised that while the notion of the MWL has been well described in
the human psychology literature, the idea of mental capacity is new. Although it is true that
it might be difficult to establish a more or less comprehensive list of factors that could
impact human capacity and performance in a particular situation, it is also true that the
 102 E. Suhir

MWL has to be compared with a more or less well substantiated HCF; otherwise, there will
not be possible at all to create a meaningful quantitative pass/fail predictive model. It is
noteworthy that an appropriate HCF list has been developed in connection with the analyses
of the ‘Miracle on the Hudson” event (see Section 6). Some of the HCF items that should
be considered and quantified in a particular problem are listed at the end of that section.
The MWL/HCF concept and its possible generalisations (say, by considering time), after
the appropriate sensitivity analyses are carried out, can be used when developing guidelines
for personnel training, when choosing the appropriate flight simulation conditions and/or
when there is a need to decide if the existing level of automation and the level of the perfor-
mance of the navigation instrumentation and equipment are adequate in extreme, off-normal,
but not impossible, extraordinary situations. If not, additional and/or more advanced instru-
mentation or equipment should be considered, developed and installed.
The MWL (‘demand’) depends on the operational conditions and the complexity of
the mission and has to do with the significance of the general task. The MWL is directly
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

affected by the challenges that a navigator faces, when controlling the vehicle in a com-
plex, heterogeneous, multitask and often uncertain and harsh environment. Such an envi-
ronment includes numerous different and interrelated concepts of situation awareness:
spatial awareness for instrument displays; system awareness (e.g. for keeping the pilot
informed about actions that have been taken by automated systems); and task awareness
that has to do with the attention and task management. As to the HCF (‘capacity’),
it considers professional experience; capabilities and skills; level of training; performance
sustainability; ability to concentrate; mature thinking; ability to operate effectively in a
‘tireless’ fashion, under pressure and, if needed, for a long period of time; ‘team-player’
attitude; swiftness in reaction, if necessary, etc. Testing on a simulator should continue
until an anticipated human failure occurs. The mean-time-to-failure should be measured
for the selected group of typical (experienced) navigators. Such ‘testing-to-fail’ is analo-
gous to the recently suggested failure-oriented accelerated testing (FOAT) in electronics
and photonics reliability engineering (Suhir 2013a).
The calculated P ¼ P ðF;GÞ
h

P0 ratios (Suhir and Mogford 2011) that consider the reduc-

tion in the probability of non-failure in off-normal situations indicate that
(1) at normal MWL level and/or at an extraordinarily (exceptionally) high HCF level,
the probability of human non-failure is close to 100%;
(2) if the MWL is exceptionally high, the human will definitely fail, no matter how
high his/her HCF is;
(3) if the HCF is high, even a significant MWL has a small effect on the probability of
non-failure, unless this MWL is exceptionally large (indeed, highly qualified indi-
viduals are able to cope better with off-normal situations);
(4) the probability of non-failure decreases with an increase in the MWL (especially
for relatively low MWL levels) and increases with an increase in the HCF (espe-
cially for relatively low HCF levels); and
(5) for high HCFs, the increase in the MWL level has a much smaller effect on the
probabilities of non-failure than for low HCFs.
These intuitively more or less obvious judgements are quantified in our analysis by
the calculated data. The computed data show also that the increase in the HCF F=F0 ratio
and in the MWL G=G0 ratio above the 3.0 value has a small effect on the probability of
non-failure. This means particularly that a navigator does not have to be trained for an
extraordinarily high MWL and does not have to be trained to a relative HCF higher than
 Theoretical Issues in Ergonomics Science 103

3.0 compared to a navigator of ordinary capacity (qualification). In other words, a pilot

does not have to be a superman to successfully cope with a high-level MWL, but still has
to be trained to be able to cope with a MWL level by a factor of three higher than the nor-
mal MWL level. The model (1) is rather flexible and, as has been indicated above, after
the appropriate testing and sensitivity analyses are carried out, can be used in many ways
to improve avionics safety.
The HCF versus MWL PPM approach considers elevated (off-normal) random relative
HCF and MWL levels with respect to the ordinary (normal, pre-established) deterministic
HCF and MWL values. These values could and should be established on the basis of the
existing human psychology practices. The interrelated concepts of situation awareness and
MWL (‘demand’) are central to today’s aviation psychology. Cognitive (mental) overload
has been widely recognised as a significant cause of error in aviation. The time lags
between critical MWL variables require predictions and actions in an uncertain world.
MWL has to do with the significance of the long- or short-term task. Task manage-
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

ment is directly related therefore to the level of the MWL, as the competing ‘demands’ of
the tasks for attention might exceed the operator’s resources – his/her ‘capacity’ to ade-
quately cope with the ‘demands’ imposed by the MWL. Measuring the MWL has become
a key method of improving aviation safety. There is an extensive published work in the
psychological literature devoted to the measurement of the MWL in aviation, both mili-
tary and commercial. Pilot’s MWL can be measured using subjective ratings and/or
objective measures. The subjective ratings during FOAT (simulation tests) can be (after
the expected failure mode is defined), e.g., in the form of periodic inputs to some kind of
data collection device that prompts the pilot to enter a number between 1 and 10 (for
example) to estimate the MWL every few minutes. There are also some objective MWL
measures, such as heart rate variability. Another possible approach uses post-flight paper
questionnaires. It is easier, however, to measure the MWL on a flight simulator than in
actual flight conditions. In a real aircraft, one would probably be restricted to using post-
flight subjective (questionnaire) measurements, since one would not want to interfere
with the pilot’s work.
Given the multidimensional nature of MWL, no single measurement technique can be
expected to account for all the important aspects of it. In modern military aircraft, com-
plexity of information, combined with time stress, creates difficulties for the pilot under
combat conditions, and the first step to mitigate this problem is to measure and manage
the MWL. Current research efforts in measuring MWL use psycho-physiological techni-
ques, such as electroencephalographic, cardiac, ocular and respiration measures, in an
attempt to identify and predict MWL levels. Measurement of cardiac activity has been a
useful physiological technique employed in the assessment of MWL, both from tonic var-
iations in heart rate and after treatment of the cardiac signal.
As to the most likely (normal) HCF, it includes, as has been mentioned above, but
might not be limited to, the following major qualities that would enable a professional to
successfully cope with an elevated off-normal MWL:

(1) psychological suitability for a particular task;

(2) professional experience and qualifications;
(3) education, both special and general;
(4) relevant capabilities and skills;
(5) level, quality and timeliness of training;
(6) performance sustainability (consistency, predictability);
(7) independent thinking and independent acting, when necessary;
 104 E. Suhir

(8) ability to concentrate;

(9) ability to anticipate;
(10) self-control and ability to act in cold blood in hazardous and even life-threatening
situations;
(11) mature (realistic) thinking;
(12) ability to operate effectively under pressure;
(13) ability to operate effectively, when necessary, in a tireless fashion, for a long
period of time (tolerance to stress);
(14) ability to act effectively under time pressure and make well-substantiated deci-
sions in a short period of time;
(15) team-player attitude, when applicable and necessary;
(16) swiftness in reaction, when necessary.

These and other qualities are of course of different importance in different HITL situa-
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

tions. It is also clear that different individuals possess these qualities in different degrees.
HCF could be time-dependent.
In order to come up with suitable figures of merit (FOMs) for the HCF, one could
rank, similarly to the MWL estimates for particular situations or missions, the above and
perhaps also other qualities on the scale from, say, one to ten, and calculate the average
FOM for each individual and a particular task or a situation.

3. Mission success and safety

While the PPM (1) can be used to quantify the likelihood of the human non-failure in
various missions’ success and safety evaluations, the performance of the equipment
(instrumentation), which includes the performance of both the hardware and the soft-
ware, can be characterised, e.g. by Weibull distribution. As to the role of the uncertain
environmental conditions, these could be considered by the probability of the encounter
of conditions of the particular level of severity. If highly reliable equipment is used, the
mission could be still successful, even if the HCF is not very high (see, e.g., Suhir 2012;
Salotti and Suhir 2014).
The success (failure) of a vehicular mission could be time-dependent and could be
characterized by different actual and specified probabilities of success at different stages
(segments). Let, for example, the mission of interest consists of n consecutive segments
ði ¼ 1; 2; . . .; nÞ characterised
(1) by different probabilities qi of occurrence of a particular harsh environment or by
other extraordinary conditions during the fulfilment of the ith segment of the
mission;
(2) by different durations Ti of these segments and
(3) by different failure rates λei of the equipment and instrumentation.
These failure rates may or may not depend on the environmental conditions, but could
be affected by aging, degradation and other time-dependent reliability affecting causes. In
the simplified example below, we assume that the combined input of the hardware and the
software, as far as the failure rate of the equipment and instrumentation is concerned, is
evaluated beforehand and is adequately reflected by the appropriate failure rate λei values.
These values could be either determined from the vendor specifications or, preferably,
should be obtained based on the specially designed and conducted FOAT and the subse-
quent predictive modelling evaluations (Suhir 1997).
 Theoretical Issues in Ergonomics Science 105

The probability of the equipment non-failure at the moment ti of time during the fulfil-
ment of the mission on the ith segment, assuming that Weibull distribution is applicable,
is
e
Pei ¼ exp½ðλei ti Þbi ,

where 0  ti  Ti is an arbitrary moment of time within the ith segment and bei is the
shape parameter in the Weibull distribution. One could assume that the time-dependent
probability of human non-failure can be also represented in the form,

h
Phi ðti Þ ¼ Phi ð0Þexp½  ðλhi ti Þbi ,

of Weibull distribution, where λhi is the failure rate, bhi is the shape parameter and Phi ð0Þ is
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

the probability of the human non-failure at the initial moment of time ti ¼ 0 of the given
segment. When ti !1, the probability of non-failure (say, because of the human fatigue
or other causes) tends to zero. The probability Phi ð0Þ can be assumed in the form (1).
Then, the probability of the mission failure at the ith segment can be found, in an approxi-
mate analysis (in a more rigorous analysis the conditional probabilities should be consid-
ered) as

Qi ðti Þ ¼ 1  Pei ðti ÞPhi ðti Þ,

and the overall probability of the mission failure can be determined as

X
n X
n
Q¼ qi Qi ðti Þ ¼ 1  qi Pei ðti ÞPhi ðti Þ: ð2Þ
i¼1 i¼1

This formula can be used also for specifying the failure rates and the HCF in such a way
that the overall probability of failure would be adequate. The assessments based on the
formula (2) can be used to consider, if possible, an alternative route in such a way that the
set of the probabilities qi brings the overall probability of failure of the mission to an
acceptable level. If at a certain segment of the fulfilment of a mission, the human perfor-
mance is not critical, then the corresponding probability Phi ðti Þ of human non-failure
should be put equal to one. On the other hand, if there is confidence that the equipment
(instrumentation) failure is not critical, or if there is a reason to believe that the probabil-
ity of the equipment non-failure is considerably higher than the probability of the human
non-failure, then it is the probability Pei ðti Þ that should be put equal to one. Finally, if one
is confident that a certain level of the harsh environment will be inevitably encountered
during the fulfilment of the mission at the ith segment of the route, then the corresponding
probability qi of encounter such an environment should be put equal to one.

4. Some short-term predictions

The concept described in the previous section is suitable for the design of the hardware and
the software, for making long-term assessments and strategic decisions, and for planning a
vehicular mission before it commences. There are, however, extraordinary situations, when
during the fulfilment of a mission the navigator has to make a decision on a short term,
often on an emergency basis. Here are some more or less typical problems (Suhir 2012).
 106 E. Suhir

Problem 1: The probability that particular environmental conditions will be detrimental for
the vehicle safety (say, the probability of exceeding a certain probability that defines safety
level) is p. The probability that these environmental conditions are detected by the available
navigation equipment, adequately processed and delivered to the navigator in due time is
p1 . But the navigator is not perfect either, and the probability that he/she misinterprets the
obtained information from the navigation instrumentation is p2 . If this happens, the navigator
can either launch a false alarm (take inappropriate and unnecessary corrective actions), or
conclude that the weather conditions are acceptable and make inappropriate go-ahead deci-
sion. The navigator receives n messages from the navigation equipment during his watch.
What is the probability that at least one of the messages is assessed/interpreted incorrectly?
Solution: The hypotheses about a certain message are as follows: H1 ¼ the weather con-
ditions are unacceptable, so that the corrective actions are necessary; H2 ¼ the weather
conditions are acceptable and therefore no corrective actions are needed. The probability
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

that a message is misinterpreted is

P ¼ pð1  p1 Þ þ ð1  pÞp2 :

Then, the probability that at least one message out of n is misinterpreted is

Q ¼ 1  ð1  PÞn :

Clearly, Q!1, when n!1. Thus, the outcome depends on both the equipment
(instrumentation) performance and the human ability to correctly interpret the obtained
information. The last formula can be used particularly to assess the effect of the human
fatigue on his/her ability to interpret correctly the obtained messages. Let, for instance,
n ¼ 100 (the navigator receives 100 messages during his/her watch) and p ¼ 1: the fore-
cast environmental conditions that the vehicle will encounter will certainly cause an acci-
dent and should be avoided. So, the instrumentation did not fail, and the probability p1
that the navigator obtained this information and that the information has been delivered
in a timely fashion is p1 ¼ 0.999. Let the probability that the navigator interprets the
information incorrectly is only p2 ¼ 0:01 ¼ 1%. Then, P ¼ 0.001 and Q ¼ 0.0952. Thus,
the probability that one message could be misinterpreted is as high as 9.5%. If the equip-
ment is not performing adequately and the probability p1 is only, say, p1¼ 0.95, then P ¼
0.05 and Q ¼ 0.9941: one of the messages from the navigation equipment will be most
certainly misinterpreted. We conclude, therefore, that the performance and the accuracy
of the instrumentation are as important as the human factor is.
Problem 2: The probability that the instrumentation does not fail during the time T of the
fulfilment of a certain segment of a mission is p1 : The probability that the human ‘does
not fail’, i.e., receives and interprets the obtained information correctly during this time is
p2 : It has been established that a certain (non-fatal though) accident has occurred during
the time of the fulfilment of this segment of the mission. What is the probability that the
accident occurred because of the equipment failure?
Solution: Four hypotheses were possible before the accident actually occurred: H0 ¼ the
equipment did not fail and the human did not make any error; H1 ¼ the equipment failed,
but no human error occurred; H2 ¼ the equipment did not fail, but the human made an
error; H3 ¼ the equipment failed and the human made an error. The probabilities of these
hypotheses are PðH0 Þ ¼ p1 p2 ; PðH1 Þ ¼ ð1  p1 Þp2 ; PðH2 Þ ¼ p1 ð1  p2 Þ and
PðH3 Þ ¼ ð1  p1 Þð1  p2 Þ. The conditional probabilities of the event A ‘the accident
 Theoretical Issues in Ergonomics Science 107

occurred’ are PðA=H0 Þ ¼ 0, PðA=H1 Þ ¼ PðA=H2 Þ ¼ PðA=H3 Þ ¼ 1. Applying Bayes’

formula,

PðHi ÞPðA=Hi Þ
PðHi =AÞ ¼ Pn , i ¼ 1; 2; . . . ; n;
i¼1 PðHi ÞPðA=Hi Þ

we obtain the following expression for the probability that only the equipment failed:

ð1  p1 Þp2 ð1  p1 Þp2
PðH1 =AÞ ¼ ¼ :
ð1  p1 Þp2 þ p1 ð1  p2 Þ þ ð1  p1 Þð1  p2 Þ 1  p1 p2

If the equipment never fails ðp1 ¼ 1Þ, then P ¼ 0. On the other hand, if the equipment
is very unreliable ðp1 ¼ 0Þ, then P ¼ p2 : the probability that the equipment fails is equal
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

to the probability that the operator did not make an error. If the probabilities p1 and p2 are
equal ðp1 ¼ p2 ¼ pÞ, then
p
P¼
1þp

is the probability that either the equipment failed or the human made an error. For very
reliable equipment and a next-to-perfect operator (human) ðp ¼ 1Þ, P ¼ 0:5: the probabil-
ity that only the equipment failed is 0.5. For very unreliable equipment and very
‘imperfect’ human ðp ¼ 0Þ, we obtain P ¼ 0: it is quite likely that both the equipment
failed and the human made an error.
Problem 3: The assessed probability that a certain segment of a mission will be accom-
plished successfully, provided that the environmental conditions are favourable, is p1 .
This probability will not change even in unfavourable environmental conditions, if the
navigation equipment is adequate and functions properly. If, however, the equipment
(instrumentation) is not perfect, then the probability of safe fulfilment of the given seg-
ment of the mission is only p2 < p1 . It has been established that the probability of failure-
free functioning of the navigation equipment is p . It is also known that in this region of
the navigation space, unfavourable navigation conditions are observed at the given time
of the year in k% of the time. What is the probability of the successful accomplishment of
the mission in any environmental conditions? What is the probability that the navigator
used the equipment, if it is known that the mission has been accomplished successfully?
Solution: The probability of the hypothesis H1 ‘the environmental conditions are favour-
able’ is PðH1 Þ ¼ 1  100
k
. The probability of the hypothesis H2 ‘the environmental condi-
tions are unfavourable’ is PðH2 Þ ¼ 100
k
. The conditional probability PðA=H1 Þ of the event
A ‘the navigation is safe’ when the environmental conditions are favourable is
PðA=H1 Þ ¼ p1 . The conditional probability PðA=H2 Þ of the event A ‘the navigation is
safe’ when the environmental conditions are unfavourable can be determined as
PðA=H2 Þ ¼ p p1 þ ð1  p Þp2 , so that the sought probability of accident-free navigation
on the given segment is


k k k
PðAÞ ¼ 1 p1 þ ½p p1 þ ð1  p Þp2  ¼ p1  ðp1  p2 Þð1  p Þ:
100 100 100
 108 E. Suhir

If it is known that the mission has been accomplished successfully despite unfavourable
environmental conditions, then

k
½p p1 þ ð1  p Þp2  k
½p p1 þ ð1  p Þp2 
PðA=H2 Þ ¼ 100 ¼ 100 k :
PðAÞ p1  100 ðp1  p2 Þð1  p Þ

Let, for example, p1 ¼ 1:0, p2 ¼ 0:95, p ¼ 0:98 and k ¼ 80. Then, PðAÞ ¼ 0:9992,
PðA=H2 Þ ¼ 0:7998. So, the probability of the successful accomplishment of the mission
is 0.9992, and the probability that the navigator used the navigation instrumentation/
equipment that enabled him/her to accomplish the mission successfully is 0.7998.
Problem 4: The probabilities qi for encountering wave conditions in North Atlantic in
the region between 50 and 60 north latitude are as follows: qi ¼ 0:1500 for wave
heights of 3% significance of h3%;m ¼ 3m (wave heights of 3% significance means that
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

97% of the waves are characterised by the heights below the h3%;m level, and 3% have the
height exceeding this level); qi ¼ 0:0501 for h3%;m ¼ 6m; qi ¼ 0:00920 for h3%;m ¼ 9m;
qi ¼ 0:000876 for h3%;m ¼ 12m; qi ¼ 0:0000437 for h3%;m ¼ 15m; and qi ¼ 0:00000115
for h3%;m ¼ 18m. Two sources of information predict a particular qi value at the next seg-
ment of the route with different probabilities p1 and p2 . What is the likelihood that the first
source is more trustworthy than the second one?
Solution: Let A be the event ‘the first forecaster is right’, A be the event ‘the
first forecaster is wrong’, B is the event ‘the second forecaster is right’ and B be
the event ‘the second forecaster is wrong’. So, we have PðAÞ ¼ p1 and PðBÞ ¼ p2 .
Since the two forecasters made different predictions, the event AB þ AB took place. The
probability of this event can be evaluated as follows: PðAB þ ABÞ ¼ PðABÞþ
PðABÞ ¼ PðAÞPðBÞ þ PðAÞPðBÞ ¼ p1 ð1  p2 Þ þ ð1  p1 Þp2 . The first source will be
more trustworthy if the event AB takes place. The probability of this event is

p1 ð1  p2 Þ 1
PðABÞ ¼ ¼ :
p1 ð1  p2 Þ þ ð1  p1 Þp2 1 þ 1p1 p2
1p2 p1

This relationship is computed in Table 1. Clearly, PðABÞ ¼ 0:5, if p1 ¼ p2 ¼ p;

PðABÞ ¼ 1:0, if p1 ¼ 1 and p2 6¼ 1; PðABÞ ¼ 0, if p1 6¼ 1 and p2 ¼ 1. Other Table 1 data
quantify the trustworthiness of the two mutually exclusive forecasts in question.

Table 1. Calculated trustworthinesses of weather forecast.

p1 =p2 0.1 0.2 0.4 0.6 0.8 0.9

0.1 0.500 0.692 0.857 0.931 0.973 0.988

0.2 0.308 0.500 0.727 0.857 0.941 0.973
0.4 0.143 0.273 0.500 0.692 0.857 0.931
0.6 0.069 0.143 0.308 0.500 0.727 0.857
0.8 0.027 0.059 0.143 0.273 0.500 0.692
0.9 0.012 0.027 0.069 0.143 0.308 0.500
 Theoretical Issues in Ergonomics Science 109

5. Helicopter landing ship

The helicopter-landing-ship (HLS) situation (Suhir 2010a, 2010b) is addressed with an
emphasis on the effect of the human performance on the helicopter undercarriage strength
that should not be compromised. The human factor is important from the standpoint of the
operation time that affects the likelihood of safe landing during the lull period in sea con-
dition. The operation time includes the time required for the officer-on-board and the heli-
copter pilot to make their go-ahead decisions and the time of actual landing. It is assumed,
for the sake of simplicity, that both these times could be approximated by the Rayleigh
law, while the lull duration follows the normal law with a high ratio of the mean value to
the standard deviation. Safe landing could be expected if the probability that it occurs dur-
ing the lull time is high.
The probability that the helicopter undercarriage strength is not compromised can be
evaluated as a product of the probability that landing occurs during the lull time and the
probability that the relative velocity of the helicopter with respect to the ship’s deck at the
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

moment of landing does not exceed the allowable level. This level is supposed to be deter-
mined for the helicopter-landing-ground situation, i.e., for ‘normal’ conditions, while the
HLS event is viewed as an off-normal one. The developed PPM can be used when estab-
lishing specifications for the undercarriage strength and guidelines for personnel training.
Particularly, the model can be of help when establishing the times to be met by the two
humans (officer-on-board and helicopter pilot) involved in the HLS situation to make their
go-ahead decisions for landing in due time and to actually land the helicopter.
Typically, officer-on-ship-board, using the information from the on-board surveil-
lance systems, signals to the helicopter pilot, when the lull period (‘wave window’) com-
mences. The challenge is to foresee, to an extent possible, the duration of the lull. If the
random sum, T ¼ t þ u, of the random time t needed for the officer-on-board and the heli-
copter pilot to make their go-ahead decisions and the random time u needed to actually
land the helicopter, is lower, with a high enough probability, than the (random) duration
L of the lull, then safe landing becomes likely. Let us assume the simplest physically
meaningful probability distributions for the random time periods of interest, and use
Rayleigh’s distributions,

2

t t u u2
ft ðtÞ ¼ 2 exp  2 ; fu ðtÞ ¼ 2 exp  2 ; ð3Þ
t0 2t0 u0 2u0

as suitable approximations for the random times t and u of decision-making and landing,
and the normal law,
!
1 ðl  l0 Þ2 l0
fl ðlÞ ¼ pffiffiffiffiffiffi exp  ;  4:0; ð4Þ
2ps 2s 2 s

as an approximation for the random duration L of the lull. In the above formulas, t0 and u0
are the most likely times of decision-making and landing, respectively, l0 is the most
likely (mode) value of the lull time (in the case of normal law it coincides with the mean
and the median of the distribution) and s is the standard deviation of this time. The ratio
l0
s (‘safety factor’) should be large enough (say, larger than 4), so that the normal law
could be used as a suitable approximation for the random variable of time that, in princi-
ple, cannot be negative.
 110 E. Suhir

The probability P that the sum, T ¼ t þ u, of the variables t and u exceeds a certain
level T^ can be found as

ZT^
2 " !# !
T^
2
t t ðT  tÞ2
P ¼ 1  exp  2 1  exp  dt ¼ exp  2
t02 2t0 2u20 2t0
0" # ( " " # # " #)
T^ t02 T^ u20 T^
2 2 2
u20
þ exp  2 exp  2 2  exp  2 2
2ðt0 þ u20 Þ t02 þ u20 2u0 ðt0 þ u20 Þ 2t0 ðt0 þ u20 Þ
rffiffiffi " #
p T^t0 u0 T^
2
þ exp  2
2 ðt02 þ u20 Þ3=2 2ðt0 þ u20 Þ
82 2 33 2 39
>
< >
=
6 6 ^
t0 T 77 6 u0 T^ 7
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

4erf 4 qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi55 þ erf 4 qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi5 ;

>
: >
u0 2ðt2 þ u2 Þ
0 0 t0 2ðt2 þ u2 Þ ;
0 0

ð5Þ

where
Z x
2
ez dz
2
erf ðxÞ ¼ pffiffiffi
p 0

is the error function. When the most likely duration of landing u0 is small compared to the
most likely time t0 required for making each of the two go-ahead decisions, the expres-
sion (5) yields
!
T^
2
P ¼ exp  2
2t0

The probability that the total time of operation exceeds a certain time duration T^
depends only on the most likely time t0 of decision-making. Solving this relationship for
the tT^0 ratio, we have

t0 1
¼ pffiffiffiffiffiffiffiffiffiffiffiffiffi :
T^ 2lnP
If the acceptable probability P of exceeding the time T^ is, for example, P ¼ 104 ,
then the time of making the go-ahead decisions should not exceed 0.233 ¼ 23.3% of the
time T^ (lull duration), otherwise, the requirement P  104 will be compromised. Simi-
larly, when the most likely duration t0 of decision-making is very small compared to the
most likely time u0 of landing, then
!
T^
2
P ¼ exp  2
2u0

The probability of exceeding time level T^ depends only on the most likely time u0 of
landing. It is noteworthy that the single-parametric Rayleigh law is characterised by a
 Theoretical Issues in Ergonomics Science 111

rather large standard deviation, and therefore, might provide an over-conservative

approximation. A more realistic and more flexible two-parametric law, such as Weibull
law, might be more appropriate and more practical as a suitable probability distribution
of the random times t and u. Its use, however, will make our analysis unnecessarily more
complicated, and our goal is not so much to dot all the i’s and cross all the t’s, as far as
PPM of the role the human factor is concerned, but rather to demonstrate that the attempt to
use PPM to pre-quantify the role of this factor in a particular HITL situation might be quite
fruitful. When developing practical guidelines and recommendations, a particular law of
the probability distribution should be established based on both the physically (intuitively)
meaningful and the reliable statistical data, and employment of goodness-of-fit criteria
(Pierson’s, Kolmogorov’s, etc.) might be needed in detailed statistical analyses. These are,
however, beyond the scope of this paper.
When the most likely time t0 of making the go-ahead decisions and time u0 of the
actual landing are equal, the formula (5) yields
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

 !"
2 !
#
T^ pffiffiffi T^ T^ T^
2
t0 u0
P ¼ P ; ¼ exp  2 1þ p exp erf : ð6Þ
T^ T^ 2t0 2t0 2t0 2t0

^ ^
For large tT0 ratios ðtT0  3Þ, the second term in the brackets becomes large compared to
unity, so that only this term should be considered. The calculated probabilities of exceed-
ing a certain time level T^, based on the formula (6), are shown in Table 2. In the third
row of this table we indicate, for the sake of comparison, the probabilities P8 of exceeding
the given time T^, when only the time t0 or only the time u0 is different from zero, i.e., for
the special case that is mostly remote from the equal time case t0 ¼ u0 . Clearly, the proba-
bilities computed for other possible combinations of the times t0 and u0 could be found
between the calculated probabilities P and P8.
The following major conclusions can be drawn from the Table 2 data:

(1) The probability that the total time of operation (the time of decision-making and
the time of landing) exceeds the given time level T^ rapidly increases with an
increase in the time of operation and
(2) The probability of exceeding the time level T^ is considerably higher, when the most
likely times of decision-making and of landing are finite, and particularly are equal
to each other, in comparison with the situation when one of these times is signifi-
cantly shorter than the other, i.e., zero or next to zero. This is especially true for short
operation times: the ratio P =P of the probability P of exceeding the time level T^
in the case of t0 ¼ u0 to the probability P of exceeding this level in the cases

Table 2. The probability P that the operation time exceeds a certain time level T^ versus the ratio
T^=t0 of this time level to the most likely time t0 of decision-making for the case when the time t0
and the most likely time u0 of actual landing are the same. For the sake of comparison, the probabil-
ity P8 of exceeding the time level T^, when either the time t0 or the time u0 is zero, is also indicated.

T^=t0 6 5 4 3 2

P 6.562E4 8.553E3 6.495E2 1.914E1 6.837E1

P8 1.523E8 0.373E5 0.335E3 1.111E2 1.353E1
P =P 4.309E4 2.293E3 1.939E2 1.723E1 5.053
 112 E. Suhir

t0 ¼ 0 or u0 ¼ 0 decreases rapidly with an increase in the time of operation.

Thus, there exists a significant incentive for reducing the operation time. The
importance of this intuitively obvious fact is quantitatively assessed by the Table 2
data.

The Table 2 data can be used, particularly, to train the human for a quick reaction in
the HLS situation. If, for instance, the expected duration of the lull is 30 sec, and the spec-
ified probability of exceeding this time is P ¼ 103 , then, as evident from the table data,
the times for decision-making and actual landing should not exceed 5.04 sec each.
Another useful information that could be drawn from the calculated data is whether it is
possible at all to train a human to react in just a couple of seconds. If not, then one should
decide on a broader involvement of more sophisticated, more powerful and more expen-
sive equipment to do the job. If pursuing such an effort is decided upon, then PPM and
probabilistic sensitivity analyses will be needed to determine the ways to go.
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

The probability that the normally distributed lull time L is found below a certain level
L^ is

 ZL^ 
 " !#
s l0 1 L^  l0 1 1  lL^0
Pl ¼ Pl ; ¼ fl ðlÞdl ¼ 1 þ erf pffiffiffi ¼ 1 þ erf pffiffiffi s : ð7Þ
L^ L^ 2 2s 2 2 L^
1

The probability that the lull time is exceeded (probability of possible failure) can be
determined by equating the times T^ ¼ L^ ¼ T and computing the product
t u  s l 
0 0 0
PA ¼ P  ; Pl ;
T T T T
of the probability, P ðtT0 ; uT0 Þ, that the time of operation exceeds a certain level T and the

probability, Pl Ts ; lT0 , that the duration of the lull is shorter than the time T. The calculated
probabilities PA are shown in Table 3. The formula (7) considers the effect of the sea con-
dition (through the values of the most likely duration l0 of the random lull time L and its
standard deviation s), the role of the human factor, t0 (the total most likely time required
for the officer-on-ship-board and the helicopter pilot to make their go-ahead decisions for
landing), and the most likely time, u0 , of actual landing (which characterises both the
qualification of the helicopter pilot and the qualities/behaviour of the flying machine) on
the probability of safe landing. After a low enough allowable value, PA , of the probability
PA is agreed upon, one could establish the allowable maximum most likely time u0 of
landing. The actual time of landing can be assessed as
pffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
Dt ¼ u0 2lnPl ,

Table 3. Probabilities of failure at different MWL conditions.

Q1 0 0.0001 0.0005 0.001 0.005 0.05 0.10 0.20 0.30
Q1=2 0 2.5E5 0.0001 0.0003 0.00125 0.01274 0.0260 0.0543 0.0853
Q 0 4.4E9 8.75E8 5.25E7 1.09E5 0.00111 0.00452 0.01877 0.0439
Q1 0.4 0.50 0.60 0.70 0.80 0.85 0.90 0.95 1.00
Q1=2 0.1199 0.1591 0.2047 0.2599 0.3313 0.3777 0.4377 0.6239 1.00
Q 0.0815 0.1338 0.2037 0.2963 0.4203 0.4994 0.5963 0.7961 1.00
 Theoretical Issues in Ergonomics Science 113

where Pl is the allowable probability that the level Dt is exceeded. If, for instance,
u0 ¼ 10 sec and Pl ¼ 105 , then Dt ¼ 48:0 sec.
The cumulative probability distribution function for the extreme vertical ship velocity
z_ (the probability that the vertical velocity of the ship deck at the HLS location is below
a certain level z_ ) due to her motions in heave, pitch and roll in waves can be expressed,
using the EVD technique, as

" !#
  ðz_ Þ2
Fz_ ðz_ Þ ¼ exp n exp   expðn Þ: ð8Þ
2Dz_

_
Here Dz_ is the variance of the ship’s vertical velocity z,
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

Dt
n ¼
te

is the expected number of ship oscillations during the landing time Dt and te is the effec-
tive period of the ship motions in irregular seas. The above formula reflects an assumption
that a ship in irregular waves behaves as a narrow-band filter that enhances the oscilla-
tions whose frequencies are close to the ship’s own natural frequency (in still water) in
heave and pitch, and suppresses all the other frequencies. If the landing time (measured
by the expected number n of ship oscillations) is significant, the second term in Equation
(8) becomes small and can be omitted. If the level z_ is zero, the function Fz_ ðz_ Þ becomes
Fz_ ð0Þ ¼ expðn Þ, and, for a high enough n value, we still obtain Fz_ ð0Þ ¼ 0. If, how-
ever, for a finite n (which is never zero and cannot be smaller than one), the level z_ is
high, the function Fz_ ðz_ Þ becomes Fz_ ð1Þ ¼ 1.
The landing velocity V, when landing on a solid ground, is a random variable that
could be assumed to be normally distributed:
" #
1 ðv  vÞ2
fv ðvÞ ¼ pffiffiffiffiffiffiffiffiffiffiffi exp  ; ð9Þ
2pDv 2Dv

where v is the mean value of the velocity V and Dv is its variance. Then, the probability
distribution function of this velocity (i.e., the probability that the random velocity V is
below a certain value v) is



1 vv
Fv ðvÞ ¼ 1 þ erf pffiffiffiffiffiffiffiffi : ð10Þ
2 2Dv

The allowable level v of the landing velocity V, assuming a large enough probability
Fv ðv Þ, can be found from Equation (10) by substituting the v value with the v value.

The cumulative distribution function for the relative vertical velocity, Vr ¼ V þ Z_ , of
 114 E. Suhir

the helicopter with respect to the ship’s deck can be determined as follows:
Zvr
FðvÞ ¼ PðVr  vÞ ¼ fv ðvÞFz_ ðvr  vÞdv
1
Zvr " #" !! #
1 ðv  vÞ2 ðz_ Þ2
¼ pffiffiffiffiffiffiffiffiffiffiffi exp  exp n exp   expðn Þ dv ð11Þ
2pDv 2Dv 2Dz_
1
Z1
1
¼ pffiffiffi exp½ðξ  gÞ2 ½expðn expðdj2 ÞÞ  expðn Þdξ:
p
0

Here ξ ¼ pffiffiffiffiffi
v ffi
2D
is the variable of integration;
v
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

vr  v
g ¼ pffiffiffiffiffiffiffiffi ¼ g t  g v
2Dv

is the safety factor associated with the ship motion, which is computed as the difference
between the total safety factor

vr
g t ¼ pffiffiffiffiffiffiffiffi ,
2Dv

when landing in rough seas on the ship’s deck, and the safety factor

v
g v ¼ pffiffiffiffiffiffiffiffi ,
2Dv

when landing on the solid ground; and

Dr
d¼
Dz_

is the ratio of the variance Dr of the relative velocity Vr of the helicopter undercarriage
_ The for-
with respect to the ship’s deck to the variance Dz_ of the ship’s vertical velocity z:
mula (11) determines the probability that the random relative velocity Vr of the helicopter
undercarriage with respect to the ship’s deck remains below a certain value vr . When
Dz_ !1 (significant ship motions) and/or Dr !0 (insignificant absolute vertical velocities
of the helicopter), the ratio d ¼ DDrz_ !0. This situation is unfavourable for the undercar-
riage strength: the probability that the extreme vertical velocity of the helicopter during
its landing on the ship’s deck remains below a certain v value is zero: FðvÞ ¼ 0. For large
enough (but not very large) n values (landing lasts for a rather long time), the formula
(11) yields

Z1
1
FðvÞ ¼ pffiffiffi exp½ðj  gÞ2  n expðdj2 Þdj: ð12Þ
p
0
 Theoretical Issues in Ergonomics Science 115

For very large n values, we have FðvÞ ¼ 0. Such a situation is also unfavourable for
safe landing. For not very large n values, however (landing does not take long), but large
d ¼ DDrz_ ratios (significant variance of the relative velocity, but insignificant variance of the
velocity of the vertical ship motions), the formula (12) yields

Z1 

1 1 1 vv
FðvÞ ¼ pffiffiffi exp½ðj  gÞ dj ¼ ð1 þ erf gÞ ¼ 1 þ erf pffiffiffiffiffiffiffiffi :
2
ð13Þ
p 2 2 2Dv
0

This formula is not (and should not be) different from the formula for the case of safe
landing on a solid ground. For small d ¼ DDrz_ ratios (but still large n values), the formula
(13) yields


vv
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

1
FðvÞ ¼ expðn Þ 1 þ erf pffiffiffiffiffiffiffiffi : ð14Þ
2 2Dv

This formula contains a factor expðn Þ that accounts for the finite duration of landing.
When n is small (very short time of landing), the situation is not different from the case
of landing on a solid ground. When n is large, the situation is certainly unfavourable:
FðvÞ ¼ 0. Thus, the probability that a certain level v of the relative velocity Vr of the
helicopter with respect to the ship’s deck is not exceeded can be found as PB ¼ Fðv Þ.
The probability PC that the undercarriage strength will not be compromised can be evalu-
ated as a product of the probability 1  PA that the helicopter will be able to land during
the lull time, and the probability PB ¼ Fðv Þ that the relative velocity of the helicopter
with respect to the ship’s deck will not exceed a certain allowable (specified) level v :
PC ¼ ð1  PA ÞPB .
If the landing velocity v0 on the ground is treated as a deterministic value (if the vari-
ance Dv of this velocity can be considered zero) and the allowable relative velocity v
(which is due to the undercarriage structure only) is known, then the condition of safe
landing becomes quite simple. Indeed, in such a situation, Equation (11) results in the fol-
lowing simple formula for the extreme value z_ of the ship’s vertical velocity:
qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi


z_ ¼ 2Dz_ lnn  ln  lnPD þ expðn Þ ; ð15Þ

and the condition of safe landing becomes z_  v  v0 . Here are a couple of examples.
Example 1: Let the most likely times of making the go-ahead decisions and of the actual
landing be the same and equal to t0 ¼ u0 ¼ 10 sec, the most likely (mean) lull time be
l0 ¼ 20 sec and the standard deviation of the lull time be s ¼ 5 sec. The calculated data
are shown in Table 3. As evident from the table data, the probability PA that the time of
operations exceeds the duration of the lull increases rapidly with the decrease in the ratio
of the lull duration to the most likely time of either the decision-making or the landing
process, while the probability that the lull duration is below a certain value decreases
with the decrease in the ratio of this value to the most likely lull duration. The first effect
prevails, and the product of these two probabilities (defining the likelihood that the heli-
copter is not successful in landing on the ship’s deck during the lull time) increases with
the decrease in the duration of the lull time almost as fast as the probability of the opera-
tion time does. It is only for very long time of operation that the probability Pl of
 116 E. Suhir

exceeding a certain time limit starts to play an appreciable role. We conclude, therefore,
that in the situation in question the human factor associated with the decision-making
times plays a significant role, as far as safe landing is concerned. The developed model
enables one to quantitatively assess this intuitively obvious role.
Example 2: Let, for instance, the number of ship oscillations during the time of landing
be n ¼ 5, the required (specified) probability of safe landing be as high as PD ¼ 0:9999,
the variance of the vertical velocity of the ship due to her motions during the lull period
be Dz_ ¼ 0:030 m=sec and the extreme value of the relative vertical velocity computed as
the difference between the specified (allowable) velocity v of the helicopter and the
actual ground landing velocity v0 be v  v0 ¼ 0:8 m=sec. Then, the level of the relative
velocity at the moment of landing is
qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
z_ ¼ 2Dz_ ½lnn  lnðlnPD þ expðn ÞÞ
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

pffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
¼ 2x0:030½ln5  lnðln0:9999 þ expð5ÞÞ

¼ 0:629 C0:8 m=sec:

Hence, landing in this case can be permitted and is expected to be safe.

Thus, it could be concluded that the PPM approach enables one to assess the role of
the human factor, along with other uncertainty sources, in the HLS situation. Safe landing
can be expected if the probability that takes place during the lull time is sufficiently high.

6. Emergency landing: ‘Miracle-on-the-Hudson’

The PPM concept was applied in Suhir (2013b) as a quantitative ‘aftermath’ to the
famous 2009 US Airways ‘Miracle-on-the-Hudson’ successful landing (ditching), as well
as to the infamous 1998 Swiss Air ‘UN-shuttle’ disaster. It has been concluded that the
developed formalisms, after trustworthy input data are obtained (using, for example,
flight simulators or Delphi method), might be applicable even beyond the vehicular
domain in various HITL situations, when a short-term high human performance is imper-
ative, and therefore, the ability to quantify it is highly desirable. It has been concluded
also that the following ten factors that affect mission success and safety in various HITL
situations, including emergency landing, should be considered: human performance
(capacity) factor (HCF); navigation, information and control instrumentation (equipment)
factor; vehicle (object of control) factor; environmental factor and six interfaces between
(interactions of) the above factors. All these factors and their interfaces are associated
with uncertainties that contribute to the cumulative probability that a certain pre-estab-
lished safety criterion for a particular anticipated casualty or a mishap is violated. These
uncertainties are characterised by their probability distributions, safety criteria, conse-
quences of possible failure and the levels of the acceptable risk. When adequate human
performance in a particular HITL situation is imperative, ability to quantify the human
factor is highly desirable. Such a quantification could be done particularly by comparing
the actual or anticipated MWL with the likely (‘available’) HCF, as it is done in the dou-
ble-exponential probability distribution addressed in Section 1. The MWL versus HCF
based PPM models and their modifications and generalisations can be helpful, after
appropriate algorithms are developed and extensive sensitivity analyses are carried out,
to evaluate the role that the human plays, in terms of his/her ability (capacity) to cope
 Theoretical Issues in Ergonomics Science 117

with an MWL in various situations, when human factor, equipment/instrumentation perfor-

mance and uncertain and often harsh environments contribute jointly to the success and
safety of a task or a mission; to assess the risk of a particular mission success and safety,
with consideration of the HITL performance; to develop guidelines for personnel selection
and training; to choose the appropriate simulation conditions; and/or to decide if the exist-
ing levels of automation and the employed equipment (instrumentation) are adequate in
possible off-normal situations (if not, additional and/or more advanced and perhaps more
expensive equipment or instrumentation should be developed, tested and installed).
In the ‘Miracle-on-the-Hudson’ analysis (Suhir 2013b), the double-exponential proba-
bility distribution function (1) addressed in Section 1 and the ‘swiftness-in-reaction’ PPM
formalism described in Section 5 were applied for the evaluation of the likelihood of a
human non-failure in an emergency landing situation. We have shed ‘probabilistic light’
on the two well-known events: the famous 2009 ‘Miracle-on-the-Hudson’ event and the
infamous 1998 ‘UN-shuttle’ disaster. These two events were chosen to illustrate the sub-
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

stance and fruitfulness of the PPM approach. As far as the ‘Miracle-on-the-Hudson’ is con-
cerned, a quantitative assessment of why such a ‘miracle’ could have actually occurred,
and what had been and had not been indeed a ‘miracle’ in the incident has been addressed.
As to the ‘UN-shuttle’ crash, it has been demonstrated that the crash occurred because of
the low HCF of the aircraft crew in an off-normal situation they encountered with. The sit-
uation was, in effect, much less demanding than the ‘Miracle-on-the-Hudson’ one.
Based on the executed analysis, we have come up with the following 10 major princi-
ples (‘ten commandments’) that should be followed in the PPM-based HCF versus MWL
approach:

(1) HCF is viewed as an appropriate quantitative measure of the human ability

(capacity) to cope with an elevated short-term MWL.
(2) It is the relative levels of the MWL and HCF that determine the probability of
human non-failure in a particular HITL situation.
(3) Such a probability cannot be low, but need not be higher than necessary either: it
has to be adequate for a particular anticipated application, mission or a situation.
(4) When adequate human performance is imperative, ability to quantify it is highly
desirable, especially if one intends to optimise and assure adequate HITL
performance.
(5) One cannot assure adequate human performance by just conducting routine
today’s human-psychology-based efforts, which might provide appreciable
improvements, but do not quantify human behaviour and performance (in addi-
tion, these efforts might be too and unnecessarily costly), and/or by just follow-
ing the existing ‘best practices’ that are not aimed at a particular situation or an
application; the events of interest are certainly rare events, and ‘best practices’:
might or might not be applicable.
(6) MWLs and HCFs should consider, to an extent possible, the most likely antici-
pated situations; obviously, the MWLs are and HCFs should be different for a
jet fighter pilot, for a pilot of a commercial aircraft, or for a helicopter pilot, and
should be assessed and specified differently.
(7) PPM is an effective means for improving the state-of-the-art in the HITL field:
nobody and nothing is perfect, and the difference between a failed human perfor-
mance and a successful one is ‘merely’ in the level of the probability of non-failure.
(8) FOAT on a flight simulator is viewed as an important constituent part of the
PPM concept in various HITL situations: it is aimed at better understanding of
 118 E. Suhir

the psychological and non-psychological (‘physical’) factors underlying possi-

ble failures; it might be complemented by the Delphi effort.
(9) Extensive predictive modelling is another, in addition to the FOAT on a flight
simulator, important constituent of the effort, and, in combination with highly
focused and highly cost effective FOAT, is a powerful and effective means to
quantify and perhaps nearly eliminate human failures.
(10) Consistent, comprehensive and psychologically meaningful PPM plus FOAT
assessments can lead to the most feasible HITL qualification (certification)
methodologies, practices and specifications.

7. Two men in a cockpit

We apply the modified double-exponential distribution (1),


Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

t G2 F2
QðFÞ ¼ 1  exp  exp  ; ð16Þ
T G02 F02

to a situation, when one of the two equally and highly qualified pilots becomes, for one
reason or another, incapacitated at a certain moment of time in the flight (such a mishap
is referred to as an accident), and, because of that, his mate has to cope with a total, say,
twice-as-high, MWL (Suhir and Mogford 2011). In the above formula, QðFÞ is the proba-
bility of failure of the pilot to perform his/her duties, Tt is the (non-random) ratio of the
elapsed operation time t to the total duration T of the flight including landing (0  t  T ),
G is the total MWL treated as a non-random variable, G0 is the most likely (specified)
value of the MWL in the ordinary conditions, F is the HCF (treated as a random variable)
and F0 is the most likely (specified) value of this factor. The formula (16) makes physical
sense. Indeed, when t ¼ 0 (at the beginning of the flight) and/or when G ¼ 0 (very low
MWL) and/or when F  1 (highly skilled, highly trained and highly effective operator
with a high HCF), then the probability QðFÞ of the navigator’s failure is zero. When
t  1 (vehicle operates for a very long time) and/or G  1 (the MWL is extremely
high), while the HCF F is finite and might be not very high, then the probability QðFÞ of
the operator failure is equal to one.
Examine a situation at the moment t of time after an aircraft took off for a flight of the
duration T. If the MWL G is evenly distributed between the two pilots, then, using the for-
mula (16), we write the probability of failure for each pilot as


T  t G2 F2
Q1=2 ðFÞ ¼ 1  exp  exp  2 : ð17Þ
T 4G02 F0

If at this moment of time an accident occurs, and, as a result of this, one of the pilots
becomes incapacitated, then his mate will have to cope with the entire workload G, and
the probability that he/she fails during the remaining time T  t can be found as


T  t G2 F2
Q1 ðFÞ ¼ 1  exp  exp  2 : ð18Þ
T G02 F0

From Equations (17) and (18), we have

Q1=2 ðFÞ ¼ 1  ½1  Q1 ðFÞ1=4 : ð19Þ

 Theoretical Issues in Ergonomics Science 119

If the accident occurs at the last moment t ¼ T of the flight, and the MWL G is not very
large (say, because the environmental conditions are favourable and the navigation equip-
ment is adequate and reliable), then both the probabilities Q1=2 ðFÞ and Q1 ðFÞ become
zero: no casualty could possibly occur. If the accident occurs at the initial moment of
time t ¼ 0, then the formulas (17) and (18) yield

 

G2 F2 G2 F2
Q1=2 ðFÞ ¼ 1  exp  2 exp  2 ; Q1 ðFÞ ¼ 1  exp  2 exp  2 : ð20Þ
4G0 F0 G0 F0

If, in such a situation, the MWL G during the flight is high and the HCF F has a finite
value, then the probabilities Q1=2 ðFÞ and Q1 ðFÞ are equal to one: human failure will defi-
nitely occur and, hence, the aircraft casualty will certainly take place. If, however, the
total MWL G is low, while the HCF F is significant, then the probabilities Q1=2 ðFÞ and
Q1 ðFÞ are equal to zero: no casualty is likely to occur. Such a casualty could possibly
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

occur if one of the following three cases takes place: (1) none of the pilots fails to perform
his/her duties, or if (2) the captain fails to perform his/her duties, but the first officer takes
over completely and successfully the operation of the aircraft, or if (3) the first
officer fails to perform his/her duties, but the captain takes over completely and
successfully the operation of the aircraft. The probability of the first event is ð1  Q1=2 Þ2 .
The probabilities of the second and the third events are Q1=2 ð1  Q1 Þ2 . Hence,
the probability of an accident-free navigation can be evaluated as

P ¼ ð1  Q1=2 Þ2 þ 2Q1=2 ð1  Q1 Þ2 ¼ 1 þ Q1=2 ðQ1=2  2Q1 Þ:

The probability of a casualty is therefore

Q ¼ Q1=2 ð2Q1  Q1=2 Þ:

If none of the pilots fails ðQ1=2 ¼ Q1 ¼ 0Þ, then no accident could possibly occur
ðQ ¼ 0Þ. If one of the pilots is unable to cope even with the half of the total workloads
(Q1=2 ¼ 1Þ, then, certainly, he/she will not be able to cope with the total load either, so
that Q1 ¼ 1 as well, and the probability of a casualty becomes Q ¼ 1. The probabilities
Q1=2 and Q are computed as functions of the probability Q1 in Table 4. The following
conclusions could be drawn from the computed data:

(1) The probability of a casualty is considerably lower than the probability of an acci-
dent, i.e., the failure of one of the pilots to cope with the total workload,

Table 4. The probability PA of safe landing versus the ratio T =t0 of the normally distributed dura-
tion T of the lull to the most likely time t0 of decision-making or the most likely time u0 of actual
landing, when the times t0 and u0 are equal.

T =t0 6 5 4 3 2

P 6.562E4 8.553E-3 6.495E2 1.914E1 6.837E1

T =l0 3.0 2.5 2.0 1.5 1.0
Pl 1.0 1.0 0.9999 0.9770 0.5000
PA 6.562E4 8.553E3 6.494E2 1.870E1 3.418E1
 120 E. Suhir

especially when the latter probability is low. If one wants to keep the probability
of a casualty below, say, 105 ¼ 0:001%, then the probability that one of the
pilots cannot cope, if necessary, with the entire workload should be kept below
0.5%. If the latter probability is 10%, then the probability of a casualty becomes
as high as 0.45%.
(2) The probability of a casualty is lower than the probability of failure of one of the
pilots to cope with a half of the workload, if the probability of failure of one of
the pilots to cope with a total workload is below Q1 ¼ 1  2p13 ffiffi2 ¼ 0:6031, and is
higher than the probability of failure of one of the pilots to cope with a half of the
workload, if the probability of failure of one of the pilots to cope with a total
workload is higher than the above number. Certainly, there is a strong incentive
to make the probability of failure of each pilot at ordinary conditions as low as
possible. The Table 3 data enable one to quantify this obvious conclusion.
(3) The probability that one of the pilots becomes unable to cope with the total work-
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

load is always higher, of course, than the probability than he/she becomes incapa-
ble to cope with half of the workload. This difference is especially high for low
probabilities of failure.

From Equation (18), we find that

sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
 ffi
F T G02
¼ ln  lnð1  Q1 Þ : ð21Þ
F0 T  t G2

If the accident occurred when Tt ¼ 0:5, and the ‘force majeure’ MWL G is twice as high as
the ordinary (specified) MWL G0, then
rffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
h 1 iffi
F
¼ ln  lnð1  Q1 Þ :
F0 2

If, for instance, Q1 ¼ 105 , then FF ¼ 3:49. Hence, the extraordinary (‘force majeure’)
0

HCF should be about 3.5-fold larger than the ordinary value of this factor. If one requires
that the probability of failure is Q1 ¼ 107 , then the required predicted FF ratio should be
0

as high as FF ¼ 4:10. In a hypothetical situation, when the accident occurs at the initial
0

moment of time, and the pilot and the controller decide nevertheless to continue the flight,
the last formula yields
rffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
h 1 iffi
F
¼ ln  lnð1  Q1 Þ :
F0 4

For Q1 ¼ 105 and Q1 ¼ 107 , we obtain FF ¼ 3:59 and FF ¼ 4:18, respectively.

0 0

Hence, the time of an accident has a relatively small effect on the increase in the ‘force
majeure’ human factor.
In order to assess the role of the time moment, when an accident occurs, examine the
following problem. If the casualty did not occur during the time t, what is the probability
Q that it will occur during the remaining time T  t of the flight, if the specified probabil-
ity of the occurrence of the casualty for the entire flight is Q? Two events have to take
 Theoretical Issues in Ergonomics Science 121

place in order that the accident occurs during the time T  t: (1) it should not occur during
the time t and (2) has to occur during the time T  t. The probability that the casualty
occurs during the time t is QTt . The probability that the casualty occurs during the remain-
ing time T  t, provided that it did not occur during the time t; is ð1  QTt ÞQ . The proba-
bility that the casualty occurs during the total time T can be found as

 t
Q ¼ QTt þ 1  Q Q :
T

1 t
Hence, Q ¼ Q 1QT and Q ¼ 1ð1Q
t
Q
Þ
t. The computed Q values indicate that the
T T
probability Q that the casualty occurs during the remaining time T  t of the flight if it
did not occur during the initial time t of the flight is always smaller than the specified
probability Q of the casualty occurrence during the total flight time T, and decreases with
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

an increase in the total flight time. At the last moment t ¼ T, the probability Q is zero, no
matter how high the probability Q is, unless the latter probability is equal to one.
The probability Q increases with an increase in the specified probability Q; the two prob-
abilities coincide at the initial moment of time t ¼ 0. If one wants to keep the probability
Q at a sufficiently low level he/she should keep the specified probability Q also at a low
level.

8. Future work
Aviation psychologists do not normally measure HCF as a single, unitary quantity. They
might estimate the navigator’s ability to handle stress, or test his/her reaction time, or
ability to visually detect targets out the window, etc. These are all separate parameters
that improve the pilot’s ability to handle workload. It is important, however, that all these
parameters, as well as some more permanent factors, like the pilot’s qualifications, gen-
eral professional experience and skills, performance sustainability, ability to concentrate,
ability to make adequate and prudent decisions in conditions of uncertainty, etc. are also
considered in a unified HCF. It is mandatory, of course, that such a unified HCF is mea-
sured in the same units as the MWL is, otherwise, the ‘stress–strength’ model could not
be used. These units could be particularly dimensionless, but should be established for a
particular mission or task in advance.
Other, perhaps, less challenging tasks might include the following:

(1) Testing to evaluate the effect of the fatigue state of the pilot on the effectiveness
of his/her performance: there are cognitive test methodologies that can assess
alertness.
(2) Carrying out continuous MWL measurements using subjective and/or psycho-
physiological measures.
(3) Assessing the role of the aircraft type and the effectiveness of automation: more
automation will make the pilot’s job easier, in most cases, but might not be
always available or affordable.
(4) Evaluating the role of weather conditions that might affect the MWL, and might
have an effect on the HCF as well.
(5) Assessing the role of the ‘phase of flight’. Since descent and landing are charac-
terised by the highest level of MWL, the relationship (1) should be applied and
verified for these conditions. It is the author’s belief that it could be indeed
 122 E. Suhir

applicable to such conditions, although we did not consider them specifically and
directly in this paper. Particularly, complexity of the airport and air traffic situa-
tion might have an effect on the MWL: more complexity certainly means more
MWL for the pilot to manage.
(6) Categorising the types of errors/outcomes (again, typical and possible errors, not
mistakes or blunders: these are beyond any probabilistic risk management analy-
sis) that might occur. One should determine ahead of time which kind of devia-
tions of normal conditions and what kind of errors/outcomes he/she is interested
in. Catastrophic loss of an aircraft usually results from a series of failures – devia-
tions from normal conditions that might lead to a casualty, an unrecoverable situ-
ation. There was probably no reported loss of a commercial aircraft because one
of the pilots was incapacitated, and our analysis has indicated that. Indeed, such
an outcome would be rather unlikely, unless the pilot-in-charge is very bad and
the probability that he/she fails even in normal operation conditions is next-to-
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

one. In this connection, we would like to point out again that the addressed exam-
ple is just an illustration of one of the possible applications of the basic relation-
ship (1). This relationship might have many more applications in vehicular
technology, and, as far as the aerospace industry is concerned, might be applica-
ble, after appropriate modification and generalisation, not only to address (less
critical) en route situations, but landing situations as well.
(7) Use the model to compare the performance of different pilots (human capacity
factor [HCF]) for different MWL levels. Of course, even a significant deviation
from normal conditions does not necessarily lead to a casualty, and our models
were able to quantify this circumstance. Additional insight is needed, however, to
correctly design and adequately interpret the results of the tests in a flight simula-
tor. In this connection, it would be interesting to compare the accelerated life test
and highly accelerated life test in hardware electronics and photonics with what
could be expected from the flight simulation tests.

9. Conclusion
PPM is suggested as a powerful, cost-effective and highly flexible means to characterise
and to quantify, on the probabilistic basis, the likelihood of a human failure to perform
his/her duties when operating a vehicle (an aircraft, a boat, a car, etc.). We have shown
how some PPM-based formalisms could be effectively employed to quantify the role of
the human factor in various HITL situations. The suggested models, after appropriate sen-
sitivity analyses are carried out, might be used when developing guidelines for personnel
training and/or when there is a need to decide if the existing navigation instrumentation is
adequate in extraordinary safety-in-air situations or if additional and/or more advanced
equipment should be developed and installed. The initial numerical data based on the sug-
gested model make physical sense and are in satisfactory (qualitative) agreement with the
existing practice. Although the suggested PPM approach is powerful, promising and fruit-
ful, further research, refinement and validation would be needed, of course, before the
developed models become practical and widely used.

Relevance to ergonomics theory

Our novel and pioneering PPM concept enables one to quantify, on the probabilistic basis,
the outcome of a particular effort, situation or a mission.
 Theoretical Issues in Ergonomics Science 123

About the author

Ephraim Suhir is a Fellow of the American Physical Society, the Institute of Physics, UK, Institute
of Electrical and Electronics Engineers, American Society of Mechanical Engineers, Society of
Optical Engineers, International Microelectronics and Packaging Society and the Society of Plastics
Engineers. He is Fulbright scholar in information technologies, State Department, USA, and foreign
full member of the National Academy of Engineering, Ukraine. Ephraim has authored about 350
technical publications (patents, books, book chapters, technical papers) and received numerous pro-
fessional awards.

References
Foyle, D.C., and B.L. Hooey. 2008. Human Performance Modeling in Aviation. Boca Raton, FL:
CRC Press.
Lehto, M.R., and J.R. Buck. 2008. Introduction to Human Factors and Ergonomics for Engineers.
New York: Lawrence Erlbaum Associates.
Salotti, J.M. 2012. “Revised Scenario for Human Missions to Mars.” Acta Astronautica 81: 273–
Downloaded by [Selcuk Universitesi] at 23:55 24 January 2015

287.
Salotti, J.M., and B. Claverie. 2012. “Human System Interactions in the Design of an
Interplanetary Mission.” In Human Factors: A View from an Integrative Perspective, edited by
D. De Waard, K. Brookhuis, F. Dehais, C. Weikert, S. R€ ottger, D. Manzey, S. Biede,
F. Reuzeau, and P. Terrier. Proceedings HFES Europe Chapter Conference Toulouse.
pp. 205–212. http://hfes-europe.org.
Salotti, J.M., and E. Suhir. 2014. “Manned Missions to Mars: Minimizing Risks of Failure.” Acta
Astronautica 93: 148–161.
Sheridan, T.B., and W.R. Ferrell. 1974. Man-Machine Systems: Information, Control, and Decision
Models of Human Performance. Cambridge (MA): MIT Press.
Suhir, E. 1997. Applied Probability for Engineers and Scientists. New York: McGraw-Hill.
Suhir, E. 2010a. “Helicopter-Landing-Ship: Undercarriage Strength and the Role of the Human
Factor.” ASME OMAE Conference, Honolulu, HI, June 1–9; see also ASME Offshore Mechan-
ics and Arctic Engineering (OMAE) Journal, February, pp. 31–42.
Suhir, E. 2010b. “Probabilistic Modeling of the Role of the Human Factor in the Helicopter-Landing-
Ship (HLS) Situation.” International Journal of Human Factor Modeling and Simulation
(IJHFMS) 1 (3): 313–320.
Suhir, E. 2012. “Human-in-the-Loop: Likelihood of Vehicular Mission-Success-and-Safety.” Journal
of Aircraft 49 (1): 29–36.
Suhir, E. 2013a. “Assuring Aerospace Electronics and Photonics Reliability: What Could and
Should Be Done Differently.” 2013 IEEE Aerospace Conference, Big Sky, MT, March 2–9.
Suhir, E. 2013b. “Miracle on the Hudson: Quantitative Aftermath.” International Journal of Human
Factor Modeling and Simulation 4 (1): 35–62.
Suhir, E., and R.H. Mogford. 2011. “Two Men in a Cockpit: Probabilistic Assessment of the Likeli-
hood of a Casualty if One of the Two Navigators Becomes Incapacitated.” Journal of Aircraft
48 (4): 1309–1314.