Icao 10151 Human Performance Manual Jun 2021

Doc 10151
Manual on Human Performance (HP)

for Regulators
First Edition, 2021
Approved by and published under the authority of the Secretary General
INTERNATIONAL CIVIL AVIATION ORGANIZATION

Doc 10151
Manual on Human Performance (HP)
for Regulators
First Edition, 2021
Approved by and published under the authority of the Secretary General

Published in separate English, Arabic, Chinese, French, Russian
and Spanish editions by the
999 Robert-Bourassa Boulevard, Montréal, Quebec, Canada H3C 5H7
For ordering information and for a complete listing of sales agents

and booksellers, please go to the ICAO website at www.icao.int
First Edition — 2021
ICAO Doc 10151, Human Performance (HP) Manual for Regulators
© ICAO 2021
All rights reserved. No part of this publication may be reproduced, stored in a

retrieval system or transmitted in any form or by any means, without prior
permission in writing from the International Civil Aviation Organization.
AMENDMENTS
Amendments are announced in the supplements to the Products

and Services Catalogue; the Catalogue and its supplements are
available on the ICAO website at www.icao.int. The space below
is provided to keep a record of such amendments.
RECORD OF AMENDMENTS AND CORRIGENDA
AMENDMENTS CORRIGENDA
No. Date Entered by No. Date Entered by
(i)
From ICAO Assembly Resolutions in Force (as of 4 October 2019) (Doc 10041), A40-4:
Appendix O: Human performance
Whereas the aims and objectives of ICAO as laid down by the Chicago Convention provide for fostering the
development of international air transport “. . . so as to . . . promote safety of flight in international air
navigation”;
Whereas it is recognized that human performance, as influenced by physiological and cognitive capabilities and
constraints, contributes significantly to the overall safety performance of the aviation system;
Whereas it is recognized that the safety and efficiency benefits associated with new technologies, systems and
procedures can only be realized when they are designed to enhance the performance of the individuals who use
them; and
Whereas it is recognized that implementation of the future aviation systems will result in changes in roles for
aviation professionals requiring work across multi-disciplinary teams to support collaborative decision-making;
The Assembly resolves that:
1. Member States ensure the integration of human performance considerations in the planning, design,
and implementation of new technologies, systems and processes as part of a safety management approach;
2. Member States promote and facilitate the integration of human performance elements within
competency-based training programmes throughout the career of a professional; and
3. Member States include strategies which promote safe, consistent, efficient and effective operational
performance of the individual and across teams of individuals to address safety priorities.
(iii)
TABLE OF CONTENTS
TABLE OF CONTENTS ...........................................................................................................................................v
ACRONYMS ....................................................................................................................................................... vii
FOREWORD ....................................................................................................................................................... ix
Purpose of this Manual ................................................................................................................................. ix
Structure of this Manual .................................................................................................................................. x
PART 1. UNDERSTANDING HP ...................................................................................................................... 1-1
1.1 Human Performance, Human Factors or Ergonomics? ......................................................................1-2
1.2 A Human-Centred Design Process ....................................................................................................1-3
1.2.1 Examples of the use of the HCD Process ............................................................................................................... 1-7
1.3 Systems Thinking .............................................................................................................................1-9
1.4 HP Principles.................................................................................................................................. 1-11
PART 2. HP IMPLICATIONS FOR REGULATORY ACTIVITIES ............................................................................. 2-1
2.1 Collecting and Analysing Data ..........................................................................................................2-2
2.1.1 Sources and Types of Data..................................................................................................................................... 2-3
2.1.2 HP Taxonomies ...................................................................................................................................................... 2-4
2.1.3 In-Depth Analysis of a Single Occurrence .............................................................................................................. 2-6
2.1.4 Analysis of Aggregated Data .................................................................................................................................. 2-9
2.2 Developing Regulatory Material.......................................................................................................2-9
2.3 Evaluating, Accepting and Approving ............................................................................................. 2-10
2.3.1 Equipment ........................................................................................................................................................... 2-11
2.3.2 Organizations, Management Systems, Processes and Procedures ...................................................................... 2-18
2.3.3 Personnel Training and Licensing ........................................................................................................................ 2-25
2.4 Providing Ongoing Surveillance ...................................................................................................... 2-33
2.4.1 Safety Reporting Systems .................................................................................................................................... 2-34
2.4.2 Safety Risk Assessment ........................................................................................................................................ 2-35
(v)
2.4.3 Safety Investigations ............................................................................................................................................ 2-36
2.4.4 Fatigue Management........................................................................................................................................... 2-37
2.4.5 Training Activities ................................................................................................................................................ 2-38
2.4.6 Management of Change ...................................................................................................................................... 2-39
2.5 Promoting Safety ........................................................................................................................... 2-41
APPENDIX A REFERENCES ........................................................................................................................... A-1
APPENDIX B HP WEB LINKS ........................................................................................................................ B-1
(vi)
ACRONYMS
ASBU Aviation system block upgrades

ATC Air traffic control
ATO Approved training organization
ATS Air traffic services
CE Critical elements
CRM Crew resource management
FRMS Fatigue risk management systems
GANP Global Air Navigation Plan
HCD Human centred design
HF Human factors
HP Human performance
HPP Human performance principle
ICAO International Civil Aviation Organization
PANS Procedures for Air Navigation Services
SARPs Standards and Recommended Practices
SMS Safety management system
SSP State Safety Programme
TEM Threat and error management
TRM Team resource management
UAS Unmanned aircraft system
(vii)
FOREWORD
PURPOSE OF THIS MANUAL
This manual highlights the importance of integrating human performance (HP) considerations in the development
of ICAO Standards and Recommended Practices (SARPs) and in States’ associated regulatory activities. It supports
regulators to make it easy for people in the aviation system to do the right thing and avoid negative
safety consequences. This is done through the development of appropriate regulatory material, through evaluating,
accepting and approving and through the continued surveillance of service providers’1 adherence to these regulatory
requirements. This manual addresses HP considerations embedded in all these regulatory activities.
This manual also provides guidance to regulators on HP considerations necessary to meet their obligations under
the Convention on International Civil Aviation2 and its Annex 19 – Safety Management SARPs for the establishment
of a State Safety Programme (SSP). It illustrates how HP considerations are embedded in key oversight
responsibilities and activities that are included in an SSP. It does not, however, attempt to comprehensively address
all aspects of safety oversight, nor all aspects of HP. For instance, this manual does not discuss in any detail issues
of physical or mental health, nor questions of individuals’ fitness for duty. Furthermore, it does not focus on HP
issues for specific types of aviation personnel. Instead, it takes a system’s perspective on human performance, and
it brings to focus the human contribution to the global aviation system.
The purpose of this manual is not to make every regulator an HP expert, but to enable all regulatory personnel to
recognize HP considerations in their daily work activities, including in their own internal organization, and to know
when to seek the help of a qualified and experienced HP professional. The manual is meant to guide and structure
the conversations about HP between the regulator and the people being regulated. Finally, the industry can also
benefit by gaining an understanding of regulatory expectations related to HP.
This manual complements the following:
 Human Factors Training Manual (Doc 9683); and
 Human Factors Guidelines for Aircraft Maintenance Manual (Doc 8824)
1In this manual, the term “service provider” is used interchangeably with the term “organization” to refer to any approved
aviation industry organization, including air traffic service providers, commercial air transport operators, aerodrome operators,
and approved maintenance and training organizations. The guidance is also relevant to designated individuals who provide
aviation services on behalf of the State (e.g., pilot examiners, aviation medical examiners, maintenance inspectors, certification
engineers).
2
Commonly known as “The Chicago Convention”.
(ix)
STRUCTURE OF THIS MANUAL
This manual is comprised of two parts.
Part 1 (Understanding HP) introduces the basic terminology of human performance, human factors and ergonomics,
and focuses on concepts to provide a better understanding of why HP matters to regulators. It provides the
foundation for Part 2 and serves to highlight the human contribution to the aviation system. It introduces the notions
of systems thinking and human-centered design, as well as five HP principles.
Part 2 (HP Implications for Regulatory Activities) focuses on specific regulatory activities and their associated HP
aspects. It provides guidance for the application of HP considerations to assist regulatory personnel to better
perform their job functions.
Understanding the basics of HP (Part 1) and the application of that understanding in regulatory activities (Part 2)
provide States, their regulators and those involved in developing ICAO provisions with powerful tools to enhance
the safety and efficiency of the global aviation system.
Finally, the Appendices provide a list of documents referenced in this manual (Appendix A) and web links to
additional HP-related reference materials (Appendix B).
(x)
PART 1. UNDERSTANDING HP
An understanding of HP is fundamental for regulators in doing their job, regardless of what role(s) they have within
the regulatory body.
An understanding of HP leads regulatory personnel to recognize how multiple influences throughout the entire
aviation system can affect a service provider’s safety performance during day-to-day operations. The aviation system
is globally and technologically interlinked. Having a broad picture of the system, how and where people work within
the system, and the influences upon them, enables regulators to develop and adapt effective regulations and
oversight methodologies. This in turn supports people to do their best for the safety of the aviation system. This
broad view extends the focus beyond minimum standards towards ways in which the regulator can support safety
enhancements within their State, their region and internationally.
Historically, thinking about the human contribution to the aviation

system has largely focused on people’s errors and violations that Throughout the aviation system,
may adversely affect safety. More recently, there has been a shift people are both the source of some
in focus toward the positive contribution people make to safety, of the risks and an integral part of
resilience and efficiency. People’s ability to adapt is often the
reason that the system is successful, despite interruptions and identifying and managing all risks.
disturbances such as storms, mechanical emergencies and
economic downturns. This focus recognizes the value in assessing
and understanding, not only when things go wrong, but also when
things go right. And most of the time, things do go right.
People’s ability to adapt means that
The focus on either the negative contribution or the positive
the system is more likely to recover contribution of people to system performance may vary depending
from unexpected disturbances, on the context. Each informs our approach for developing ICAO
provisions and national regulations to manage people and their
resulting in increased resilience.
performance. In practice, a blend of these perspectives is often
more appropriate than taking either perspective to the exclusion of
the other.
Understanding HP can also help regulators to identify when the support of specialist knowledge is needed. Although
some States may not have the resources, ideally, HP specialists are part of the regulator’s staff, most commonly in
functions such as evaluation, testing, approval and development of regulatory and guidance materials. They could
also be in a general role of coordinating HP activities that aim to reduce human error and improve human
performance. Regardless of whether States have HP specialists on their permanent staff or bring them in as
consultants, it is important that they be suitably qualified with appropriate in-depth knowledge.
1-1
1-2 Human Performance (HP) Manual for Regulators
To provide a foundation for understanding the relevance of HP for regulatory personnel, Part 1 of this
manual addresses:
 human performance, human factors or ergonomics;

 a human-centred design (HCD) process;
 systems thinking; and
 HP principles.
1.1 HUMAN PERFORMANCE, HUMAN FACTORS OR ERGONOMICS?
The terms human performance, human factors and ergonomics are sometimes confused and are often used
interchangeably, even in ICAO documents. This is not surprising because they are closely linked.
For the purposes of this manual, we distinguish between human performance and human factors as follows:
 human performance (HP) refers to how people perform their tasks. HP represents the human
contribution to system performance.
 human factors (HF) is concerned with the application of what we know about human beings, their
abilities, characteristics and limitations, to the design of equipment they use, environments in which
they function and jobs they perform3.
The notion of “design” is used in this document in a broad sense that goes beyond drawing schematics of specific
pieces of hardware. This broad notion of design extends to the development of processes and procedures, of job
descriptions and task specifications, and to the development of ICAO provisions and SARPs and States’ regulatory
requirements.
Outside aviation, HF and ergonomics are terms that are also sometimes used interchangeably, although they tend
to be used with slightly different emphasis. HF is more often associated with the psychological aspects of the human
whereas ergonomics is more often associated with the physical
aspects of the human. In aviation, ergonomics is considered a
subset of human factors that focuses specifically on designing
Human factors (HF) encompasses
technical systems, products and equipment to meet the physical
needs of the user. knowledge from a range of scientific
disciplines that support human
This manual uses the term HP, but HP cannot be disassociated
from HF and ergonomics. HF brings insights and understanding to performance (HP) through the
HP from many different scientific disciplines, such as psychology design and evaluation of equipment,
(including cognitive psychology, industrial and work and environments and work, in order to
organizational psychology, and social psychology), behavioural
psychology, sociology, anthropology, medical sciences including improve system performance.
3
Human Factors and Ergonomics Society, 2008.
Understanding HP 1-3
aviation medicine and occupational medicine, design and engineering, computer science and statistics.
Regulatory personnel draw on these different disciplines and perspectives to support HP and improve safety in a
variety of roles. Regulators need to apply HF knowledge to evaluate whether their regulations and rules adequately
support safety. Regulators should also apply HF knowledge to ascertain that the systems, equipment, workplaces
and processes used by those they regulate are designed and used to adequately support HP. Therefore, regulators
should ensure they utilize suitably educated, qualified and experienced professionals to evaluate compliance with
those specific aspects of the regulations.
1.2 A HUMAN-CENTRED DESIGN PROCESS
People design, build, approve, maintain and operate every aspect of the global aviation system. The performance of
the aviation system, including its safety performance, depends on HP. Because humans are at the centre of this
aviation system, a human-centered approach to the design and development of all aspects within the system is
needed.
Human-centered design (HCD) - also known as user-centered design – is an approach that helps ensure that the
product being designed – such as systems, equipment, procedures, services, or regulations - is useful and usable4
and will support skilled performance in the workplace so that intended operational benefits can be realized. Designs
that are developed using a human-centred approach take into account the HP principles (see 1.4) and can result in
improved system performance and human well-being.
Understanding HCD has relevance for regulators in evaluating people, processes, procedures, systems and
equipment, and in the development of regulations. It also has relevance for regulators in planning for, and
supporting the implementation of new technologies, and in the management of change.
The International Organization for Standardization (ISO) describes an HCD approach as having the following
characteristics5 (adapted for this manual):
a) the design is based upon an explicit understanding of users, tasks and work environments (i.e. how
the HP principles presented in 1.4 are manifested in the operational environment);
b) users are involved throughout design and development stages;
c) the design is driven and refined by user-centred evaluation and the use of operational data;
d) an iterative process is used that builds on lessons learned through multiple tests;
e) the process ensures that the whole user experience is addressed under varying conditions of use;
and
4Usability can be defined as the “extent to which a system, product or service can be used by specified users to achieve
specified goals with effectiveness, efficiency and safety in a specified context of use” (adapted from ISO 9241-210: 2010).
5 ISO 9241-210: 2010.
f) the design team has multidisciplinary skills and perspectives, including individuals with relevant
HF expertise.
Therefore, using an HCD approach focuses on a solid understanding of the users’ context and requirements. As a
result of users’ involvement and the focus on user needs and capabilities, a development project may see a
shortened implementation phase and higher user acceptance. Because a key aspect of an HCD approach is
continuous improvement based on lessons learned in testing and trials, following the HCD process reduces the
likelihood of being surprised by unintended consequences. Ultimately, following the HCD process can lead to
improved safety, which is the regulator’s priority. It can also lead to significant reductions in life-cycle costs.
A complete process that uses a human-centred approach encompasses design, development, production,
implementation and monitoring. It typically involves the following steps:
1) A concept of use (or operation) is identified. This is the developer's general vision of how the user will
interact with the product to be developed. It is based on: a) baseline assumptions about what the users
need to know and are able to do; b) how they will do it; and c) a description of the operational context
(including assumptions about the environment in which the design will operate and to what other systems
it connects). For example, in developing a new technology, it is at this early stage that decisions are made
about what functions the technology will perform and what will be the role of the humans interacting with it.
2) Design requirements are identified. Design requirements specify what the product being developed must
be able to accomplish as well as properties that it must have to “build in safety”, recognizing the range of
possible responses humans may make when interacting with the product. The design requirements will lead
to design features and functions that are needed to support human performance. For example, in
developing new airport markings, clear visibility in all lighting and weather conditions would be identified
as a design requirement.
3) Prototype designs are developed. Prototype design concepts (also known as candidate designs) are
developed based on the design requirements and user needs, not to create the perfect design solution, but
to make sure the design solution is on target. For
example, in developing a new display, several different
layouts are drafted and different symbologies may be
proposed. A prototype design can be anything from an An HCD approach builds in safety by
informal drawing (low fidelity prototype), to a fully considering HP principles and how
functional simulation (high fidelity prototype).
people will interact with the product
4) Prototype designs are tested and evaluated. A test and being designed, and by engaging
evaluation programme provides an opportunity to try end-users in the design, prototyping
out prototype design concepts and obtain user feedback
to make improvements. Tests and evaluations are also and testing before implementation
conducted to ensure the product works as intended, is to make sure that what is being
easy to use under varying conditions of use and meets developed performs as expected.
human and operational performance requirements.
While demonstrations for potential users provide
benefits, they cannot substitute for tests that gather
objective and subjective data. It is important to test early and to test often. Each iteration is evaluated to
improve the next iteration. Iterative usability testing typically leads to an improved design, with fewer
late-stage design changes or the need to develop “work-arounds” post implementation. For example, in
developing a new approach procedure for an airport, various approach profiles can be tested in a variety of
flight simulators, simulating different aircraft and different environmental and traffic conditions. Each
iteration could lead to improvements in the design of the approach procedure.
5) The design is selected. Finally, from the results of the evaluation of candidate designs and from lessons
learned through user testing, the optimal design is selected for development. Once the selected design is
fully developed into a product, formal testing, verification and validation rounds are completed with the
participation of end-users prior to implementation.
6) Implementation guidance is developed. Guidance to describe how the selected design is intended to be
used in the operational context needs to be developed. Implementation guidance should not only explain
how to use the design but also identify any changes in user responsibilities and include what, if any, training
is needed to use the design. Again, engaging end-users in
the development of guidance material can prove highly
effective in achieving a smooth implementation. For Lessons learned using an HCD
example, in approving a fatigue risk management system approach help to build robust
(FRMS), a regulator should expect, as part of its approval
process, that an operator presents an implementation
implementation guidance to support
plan that identifies to which part of its operations the ICAO SARPs and national regulations.
FRMS applies, the various responsibilities of those
involved, and the training they will undertake, as well as
how the intended FRMS processes will be used. Similarly, in developing supporting regulatory material for
a new regulation, details describing how the change can be implemented and acceptable means of
compliance should be included.
7) Performance is monitored after implementation. Using the implementation guidance, the selected design
can be integrated as part of normal operations. Lessons learned through use should result in continuous
improvement to evolve the capabilities of existing tools, technologies, processes or procedures, or drive the
development of new design concepts. For example, following the adoption of a new departure procedure
from an airport, indicators are identified and tracked to measure and monitor traffic counts, ground delays
and potential losses of separation. In addition, reports from air traffic controllers and pilots are solicited to
document any concerns and unintended consequences. This data and information are then used to
determine if any further adjustments are needed to the procedure, or to any other part of the system,
including supporting regulations.
IMPLICATIONS BOX 1
How can understanding human-centred design help

regulators?
“Design” can relate to the development of anything, whether a piece of equipment, a

process, a procedure, a programme or a document. In this sense, regulators are “developers” of regulatory
material and processes, as well as being regulators of developers (i.e. those that develop processes,
procedures and programmes) and not just approvers of equipment that has already been designed (see
2.3.1). Understanding HCD means that regulators can both use this process themselves and support the
use of this process by those they regulate in order to have new or amended rules, programmes, processes
and procedures that are easily implementable. Examples of using an HCD process to draft regulatory
material and to develop safety promotion material are provided in 1.2.1.
Lessons learned through using an iterative HCD process can also assist with the development of ICAO
provisions (which include SARPs, PANS, technical instructions, circulars, policy, and guidance material)
that support the implementation of new approaches, regulations, management systems, technologies and
procedures.
Such lessons are particularly relevant to provisions associated with the operational improvements
outlined in the Global Air Navigation Plan (GANP), and in particular in the aviation system block upgrades
(ASBUs) framework. These operational improvements are aimed at increasing the capacity or improving
the performance of the aviation system, and involve meeting challenges associated with rapid changes in
air traffic, emerging technologies, and innovative ways of doing business. To ensure that the associated
implications for the humans in the system are considered from the outset, those involved in the initial
identification of the operational improvements are asked to consider the following questions which are
presented in the ICAO GANP portal:
 Does it imply a change in task by a user or affected others?

 Does it imply processing of new information by the user?
 Does it imply the use of new equipment?
 Does it imply a change to levels of automation?
The answers to these questions outline the expected changes to people’s functions, roles and
responsibilities that will need to be supported even before some of the operational improvements have
been developed. As the development process unfolds, these questions get asked again and again. Using
an iterative HCD approach to develop the operational improvements provides information to allow these
questions to be answered in increasing detail. More detailed answers lead to ICAO provisions and
regulatory material that better support HP considerations in the implementation of
operational improvements.
The same questions can be used in part to ensure that HP principles have been considered by an
organization preparing to implement change (see 2.4.6).
1.2.1 EXAMPLES OF THE USE OF THE HCD PROCESS
a) Drafting regulatory material and guidance material for a new type of system, such as an unmanned aircraft
system (UAS)
1) A concept of use (or operation) is identified. It is at this early stage that decisions are made about
whether a regulation for a new type of system (in this case, a UAS) will be prescriptive or performance-
based. Making such a decision is based on understanding the people involved, their activities, tasks and
operational contexts, as well as on an assessment of the safety and risks of the new system, the ability
to oversee the system in operation and the expected range of experience of the users.
2) Design requirements are identified. In this case, the target recipients and scope of the new regulation
are identified, as well as setting certain weight limits or a range for the class of UAS, area acceptable for
its operation, and demonstration of competence required by those being regulated.
3) Prototype designs are developed. Internal discussions within policy teams develop draft proposals of the
new regulation based on internal regulatory philosophy and experience.
4) Prototype designs are tested and evaluated. The different drafts developed under Step 3 are reviewed
internally by those who would oversee them (both legally and in-the-field). Proposals are then checked
with the affected operational community (e.g. informally or through workshops). Each iteration leads to
further development of the language and structure of the proposed regulation or guidance material to
enable it to meet the agreed philosophy of operation. The drafts also specify the surveillance process,
including penalties for incorrect use that can be expected.
5) The design is selected. The review process then selects the approach, implementation time period,
required actions, oversight approach and review process. The selected design is then published.
6) Implementation guidance is developed. Guidance material may be needed to support the correct
implementation of the regulation. For example, the findings from the review process can be used to
develop implementation guidance that identifies acceptable means of compliance with the regulations
and describes how to make an application to use the UAS. Findings from the review process can also
inform the regulatory processes associated with the oversight process, including penalties for incorrect
use that can be expected.
7) Performance is monitored after implementation. Once the new regulation is in force, compliance and
deviations are tracked through monitoring of performance indicators, occurrence reporting and other
relevant routine reporting (e.g. reports on findings of medical assessments). In addition, reports from
the operational community are solicited through surveys, workshops or during surveillance activities, to
document any concerns and any unintended consequences. This information is then used to determine
if any further adjustments to the regulations or the regulatory approach are needed.
b) Developing safety promotion material for the use of the new system
1) A concept of use (or operation) is identified. It is at this early point that decisions are made about what
is the intended outcome of the safety promotion (e.g. awareness of the regulation, UAS operations best
practices, safety concerns around these operations, reporting of issues, etc.). Making such a decision is
based on understanding the people involved, their activities, tasks and operational contexts. This
material may differ for target audiences (the UAS operator, regulatory staff, general public) and target
activities (e.g. during the use of the UAS reporting of issues or concerns during or after use of the UAS).
2) Design requirements are identified. Because communication is key to safety promotion, the regulator
may use an internal or external communications team, or the internal team who finalized the regulatory
material. Design requirements of safety promotion material relate to the desired behavioural outcomes
and a messaging approach to achieve those outcomes (e.g., a focus on positive rather than negative
messaging with short “take-home messages” that are each associated with simple graphics to make
them easy to remember).
3) Prototype designs are developed. Different drafts and different media of the safety promotional
materials are proposed for the different messages and target audience groups.
4) Prototype designs are tested and evaluated. The drafts developed for the different audience groups are
reviewed internally and shared with the operational community for comments. This allows
improvements to the language used, layout and the media of the proposed material for the particular
message and audience.
5) The design is selected. From the testing under Step 4, the selected material is finalized for the different
audience groups (e.g., UAS operator, regulatory teams, general public).
6) Implementation guidance is developed. Details describing how the promotional material can be
distributed and used are developed, including a timeline for the activities. For example, this
implementation could include registered UAS users and operators or their clubs and associations,
internal briefings and promotional activities, and for the general public a launch on social media sites
and through newspaper advertisements.
7) Performance is monitored after implementation. To measure the effectiveness of the promotional

efforts, surveillance activities such as questioning and observing UAS operators, reporting behaviour of
both the public and the UAS operators, and evaluating relevant external reports are used to assess
trends. Web analytics (how many hits or downloads) could also be used to assess the reach and uptake
of materials. All this data can then be used to determine if adjustments to the materials are needed, and
how future safety promotion efforts are to be conducted for maximum effectiveness.
1.3 SYSTEMS THINKING
Systems thinking is an approach to view systems in a holistic and integrated manner, rather than as isolated
components or parts. It examines the links and interactions between the elements that comprise the whole of the
system. Systems thinking is particularly useful in addressing complex systems where small changes in one part of the
system can lead to large and unexpected effects in the overall system.
ICAO SARPS are designed, through their application in State regulations, to provide for global interoperability and to
keep the aviation system safe, secure, economically viable and environmentally sustainable. Because every change
to any part of the system is likely to impact other parts of it, adopting a
systems perspective enables regulators to develop effective regulations
and avoid unintended consequences.
A system is a collection of
People often think of human performance at a very local level, comprising separate, but interrelated
a single person or a team/crew performing a task. But human
parts that work together to
performance, individually and collectively, is connected to, and dependent
on, other parts of the aviation system. And because the aviation system is achieve a common purpose.
a “system of systems”, it is important to understand the differences and
interactions between the different kinds of systems in it:
 Simple systems. These are relatively easy to understand and have predictable performance. Simple systems
have one or a small number of known goals or functions that do not change over time. As such, they are
easy to repair and ensure that they consistently meet pre-identified performance standards. An aviation
example of a simple system is the passenger emergency lighting system used to guide passengers out of an
aircraft in an emergency.
 Complicated systems. The structure, elements and interactions in a complicated system might be difficult
to understand but can be understood and quantified with a high degree of accuracy and completeness by
experts. Knowledge of these systems is normally developed in a linear way (where an understanding of one
element leads to an understanding of the next element and their impact on another can be reasonably
predicted) and, like simple systems, can be designed to meet pre-identified performance standards. An
aircraft jet engine, which has several goals that remain the same over time (including to produce thrust and
generate electricity and hydraulic pressure), is an example of a complicated system.

Complex systems. In a complex system, the whole is greater than the sum of its parts. Everything is
connected to, and dependent on, something else. Importantly, the behaviour of the system cannot be
predicted by examining the behaviour of its separate parts, and the
system cannot be understood by only looking at one component or from
Because each human being is one perspective. Complex systems are often subject to random and
unpredictable events due to the multiple and changing influences and
a complex system, introducing
interactions within the system. Humans are themselves complex systems.
a human to a system renders An individual may change behaviour, adapting to internal influences, such
the whole system complex. as health or personal mood, as well as to external influences, such as
environment or equipment. Any interaction between a human and
technology, regardless of whether the technology itself is simple or
complicated, changes the nature of the whole human-technology system, making it a complex system.
The global aviation system is, therefore, a complex socio-technical system of systems. In other words, it is a network
of people, technologies and environments that are all interconnected. Everything can potentially affect something
else. Weather changes in one location affect operations halfway around the world. New legislation in one country
affects operations in other countries. A small software change for one part of one computer in the network can
affect the whole world. Seemingly small changes within one organization can have ripple effects throughout the
aviation system as other organizations try to adapt.
Regulatory actions affect the aviation system through influencing

what people do and how they do it, whether directly or indirectly. Within a complex system, it is the
Regulatory actions directed to a specific group of people may also human contribution that often
affect the actions of other groups of people, sometimes in unexpected
ways. For example, approving a change in a flight deck procedure at
provides the important safety
an airline of one country can affect the ground crew at an airport in a barriers and sources of recovery.
different country, which could affect the ramp operation, affecting
the airport and other airlines using that airport.
Therefore, regulators need to use appropriate methods and tools for regulating, evaluating and approving complex
systems. Many regulatory methods and tools in use may be more appropriate for evaluating simple and complicated
systems than for evaluating the vast range of socio-technical interactions in and between the complex operational
systems that make up the global aviation system.
IMPLICATIONS BOX 2
Why is systems thinking important for regulators?
Systems thinking allows regulators to recognize that the performance of the system as
a whole, not just its safety performance, depends on effective human performance.
Taking a systems perspective means that regulators:
 assess risks to all parts of the aviation system by anticipating unintended consequences of their
regulations and regulatory actions (see Part 2);
 seek to understand the context within which behaviour occurs, when it comes to investigating safety
occurrences and analyzing safety reports (see 2.1);
 consider who will be directly AND indirectly affected when developing new regulations (see 2.2);
 understand that any change, including those related to introducing new technologies, may not
necessarily reduce complexity or the possibility of errors, but may shift these to different parts of the
system, with different consequences (see 2.3.1); and
 can take multiple perspectives on situations, problems and opportunities to support human
performance and apply them within their regulatory functions.
1.4 HP PRINCIPLES
This section presents five HP principles that outline how the performance of people is influenced by different factors.
These principles are:
 Principle 1: People’s performance is shaped by their capabilities and limitations;
 Principle 2: People interpret situations differently and perform in ways that make sense to them;
 Principle 3: People adapt to meet the demands of a complex and dynamic work environment;
 Principle 4: People assess risks and make trade-offs; and
 Principle 5: People’s performance is influenced by working with other people, technology and the
environment.
Each of these HP principles is described below. These principles are linked to regulatory activities described in Part 2.
Awareness of these principles help to shape, improve and maximize the performance of the aviation system as
a whole.
The HP principles are informed by research and operational experience. They highlight different aspects of human
performance. These principles necessarily interact and overlap to some extent. For instance, the first principle is
about human capabilities and limitations. In fact, everything about humans can be described in terms of capabilities
and limitations. The fifth principle is about some of the external factors that influence human performance. In fact,
all such observations could be described as either internal or external influences on the individual. Thus, these
principles are not an attempt to create a categorization scheme, with each category being a discrete building block
of human performance. Instead, they provide different insights and perspectives to come closer to a multi-
dimensional picture of human performance.
The HP principles apply generally to all humans involved in the aviation system, at the individual, team and
organizational levels. Thus, the HP principles are also relevant to the regulator’s own internal organization
and processes.
Principle 1: People’s performance is shaped by their capabilities and limitations
People have various physical and mental capabilities, such as strength, flexibility, memory, attention,
resourcefulness and creativity. They apply these capabilities in their daily work to keep the system functioning safely,
effectively and efficiently. However, the same abilities that make people so critical to safety, system resilience and
operational success may also make them susceptible to errors and to unwanted behaviour.
People have limitations too. Some are based on physiology. For example,
people cannot function well without adequate sleep and nutrition. They
cannot lift very heavy weights, cannot see in the dark and are subject to
involuntary responses under stress. Some of these physiological limitations
can be aggravated in aviation when flying at high altitude (e.g. decreased
oxygen delivery to organs, including sensory organs, can result in problems
with night vision or impaired decision-making).
People also have cognitive constraints. For example, they cannot always
remember what they were told. Nor can they always immediately solve
complex calculations in their heads, or maintain attentiveness when they are
bored, tired or cognitively overloaded.
To free up cognitive resources for other tasks, people can make quick,
automatic responses when performing frequent activities and well-practised
routines. Although this ability is mostly effective, this “automatic mode” can
also lead to unintended actions. For example, a well-learned response to one situation might be executed in
response to a related situation that needs a different response. People naturally use reasoning strategies or mental
shortcuts that allow them to “speed up” their decision making. These shortcuts, also called heuristics, are often very
effective. However, they don’t always work, and can result in a variety of decision biases (see 2.1.2) that may lead
to poor decisions.
Sensory limitations and information processing limitations can lead to

perceptual illusions and to failure to notice subtle changes in the environment,
especially when attention is focused elsewhere or when experiencing spatial
disorientation during flight.
Furthermore, people’s performance is variable. No one can perform at the

same level all the time, and the level at which people can perform certain types
of tasks changes throughout the day. For example, people’s performance may
deteriorate when they are ill, bored, stressed or fatigued. However, for all their
limitations, when well supported, people are able to manage novel situations,
adapting their skills to safely manage the operation. It is this human trait of
adaptability that enables the global aviation system to function.
Principle 2: People interpret situations differently and perform in ways that make sense to them
People are always trying to make sense of the world around them. They look for patterns and predictability. Using
the information available to them, they make conscious decisions and take actions based on explicit knowledge of
facts and procedures as well as on implicit knowledge informed through experience, insights and intuition. People
rely on such implicit knowledge to interpret facts, to judge their credibility, to fit them together and to determine
what is relevant. This implicit knowledge plays a particularly important role in the way people make sense of an
operational environment where not everything can be predicted or controlled, including the actions of other people.
This implicit knowledge is especially powerful when there is little time in which to make a decision.
People do not go to work with the intention of making an error or of contributing to a safety event. Although people
can sometimes make reflexive responses that they cannot explain, generally people behave intentionally. They
behave and make conscious decisions in ways that make sense to them, and that they think will achieve a good
outcome. They analyse and interpret information presented to them, and act according to their understanding of
the situation. In hindsight, it is often easy to see how decisions and actions led to an undesired outcome and how it
might have been avoided – but at the time the decision was made or the action taken, it seemed appropriate. It
made sense. The unintended consequences were unknown and may not have been predictable. People’s actions
therefore need to be considered in context and understood from the individual’s perspective at the time of
the action.
Principle 3: People adapt to meet the demands of a complex and dynamic work environment
People are key to the aviation system, creating resilience by constantly adjusting and adapting to overcome delays,
adverse weather and other unexpected situations. Further, within the aviation system, multiple organizations are
often working towards the same outcome, although each has different goals, pressures and cultures. Individuals
from one organization may be heavily dependent on, and influenced by, the actions of another organization. An
example might be a safe and speedy aircraft turnaround between flights, which involves flight crew, cabin crew,
dispatchers, maintenance personnel and ground handlers.
As a result of this continuous adaptation, the work actually performed by people is often different from how the
work was originally expected to be performed. Rules, procedures, tasks and equipment are often designed and
planned in an environment where a limited set of variables is considered. In the operational environment, work is
performed under conditions in which not everything can be predicted or controlled.
To be effective under these dynamic conditions, people need to be able to do more than simply complete a series
of pre-identified procedural steps. Whilst standard procedures support safe and efficient operations, people may
need to adjust their work in a way that takes into account potential risks and manages unanticipated events.
Additionally, people must have and be able to integrate the right knowledge and skill with an accurate understanding
of the operational environment and how their actions may affect others.
To address emerging and changing demands, rules and procedures should be reviewed, validated and updated to
meet the demands of a complex and dynamic work environment.
Principle 4: People assess risks and make trade-offs
The aviation work environment presents people with conflicting goals. Any activity in aviation must balance safety
objectives and other organizational objectives, such as on-time performance, cost savings and environmental
protection. For individuals, these conflicting goals can sometimes translate into difficult operational trade-offs:
efficiency vs. thoroughness, speed vs. accuracy, cost vs. benefit, short term vs. longer term benefits, and personal
vs. organizational goals. Consciously or not, people evaluate the risks posed by these trade-offs, e.g., when assessing
the risk of a delayed departure against the risk of not performing a procedure thoroughly. People perceive risks
based on their individual characteristics, their own experience, and their ability to anticipate and manage possible
outcomes.
These trade-off choices are influenced by personal beliefs, interests and motivations, as well as social, organizational,
and cultural factors. These choices are also influenced by the perceived incentives and disincentives in the system.
People are acutely sensitive to the perceived incentives and disincentives present in their work environment, even
though these may not always be consistent with stated organizational priorities and goals. For example, if a manager
continuously claims that safety is the highest organizational priority, but at the same time rewards speedy
performance and discourages or even punishes thoroughness when it causes delays, employees learn to value speed
over safety.
Trade-offs can sometimes result in errors or in deviations from published rules or procedures. This flexibility might
be perceived as a safety deficiency. However, procedures and rules are often prescribed in a limited context or for
specific purposes, and it is the responsibility of the people in the system to balance the risks and find the right
trade-offs. In making choices, people attempt to make what they think is an acceptable compromise to resolve the
goal conflict, while keeping risk within subjectively acceptable limits. The risks perceived by the individual may not
align with management’s or the regulator’s view of
risk. Individuals may consider risks to include being
embarrassed, being ridiculed, threatening a
relationship or being punished. Also, risks are likely
to be perceived differently by different people at
different times, especially after an
unintended outcome.
It is worth noting that leaders and managers are also

human, and so they too make such trade-offs
and compromises.
Although every person is different and can be

unpredictable in some sense, each has an inherent
ability to understand goals, and to assess risks and
make trade-offs in order to provide an overall
acceptable solution in a complex aviation
work environment.
Principle 5: People’s performance is influenced by working with other people, technology, and the environment
Human performance can be positively or negatively affected by interacting with other people and with all elements
of the socio-technical system. We learn and behave within the constructs of the culture we are brought up in and in
which we live. Group and organizational cultures provide the context in which people work together. Such cultures
reflect assumptions, often unstated, about the nature of the world. These assumptions, in turn, determine how
people perceive the world around them and how they respond to it. The group and the organization establish
expectations for “the way things are done around here”. The individual and the group can be influenced by the
environment in which they work, such as by physical location, weather conditions or national culture. They are then
influenced by the equipment and technology they are provided with. Even when provided with the proper
equipment, procedures, guidance and training, people’s performance is influenced by interactions with others, and
everything around them, in ways that can vary from the expected result.
When people work together as a group, they can do more collectively than any individual can do alone. In the same
way that some physical capabilities of the group are greater than the individual capabilities of any group member
(e.g., the group can lift a heavier weight than a single person can), the group’s limitations may also be greater than
the limitations of any individual group member. For example, the cognitive bias of “group think” occurs when
people’s desire for group consensus, harmony or conformity results in a dysfunctional decision. Individuals in the
group may make incorrect assumptions about others’ thoughts, values, needs and desires, as well as about those of
the group as a whole. At the same time, groups can also help individuals make better decisions, and improve
performance by compensating
for individuals’ limitations, and
encouraging and supporting
appropriate behaviour and
optimal performance.
In the aviation system, there

are multiple different groups
within which people operate.
These groups can be within an
individual organization, across
multiple organizations that work closely together, or based on job type. Individuals may be heavily dependent on
the actions and behaviours of other people from another group who may be working under different constraints
and goals.
Similar to the way their performance is influenced by working with other people, people’s performance is also
influenced by the technology used and by the environment in which they perform. Well-designed tools allow people
to improve their performance, whereas poorly designed or missing tools force people to improvise and might lead
to reduced performance. And new or modified tools, even when well-designed, will result in changes to how people
perform their tasks and may even change their role and their responsibilities. For example, the introduction of
automation can change the role of the human operator from that of an initiator and direct manipulator to that of a
reacting supervisor.
Environmental conditions such as lighting, temperature and space also influence people’s performance. People work
best with adequate lighting, comfortable temperature and sufficient space to perform their tasks. When such
optimal conditions do not exist, people again have to improvise, and their performance might not be as intended.
IMPLICATIONS BOX 3
How does understanding the HP principles help regulators?
From a regulatory perspective, each of the HP principles can be turned into a

question taking into account different operational environments:
 HP Principle 1: How will the regulatory requirements and/or oversight activities achieve the desired
intent, given people’s capabilities and limitations?
 HP Principle 2: How might people with differing levels of experience and understanding make sense
of the regulatory requirements, and apply them in ways that were not intended?
 HP Principle 3: How will the regulatory requirements and/or oversight activities achieve the desired
intent, given that people will be adapting to varying operational conditions?
 HP Principle 4: What kinds of risks and trade-offs might people face in complying with regulatory
requirements or when responding to oversight activities?
 HP Principle 5: How will the influence of other people, technology or the working environment
affect people’s ability to comply with the regulatory requirements?
The answers to these questions should have direct consequences for regulatory choices and actions,
including identifying what regulatory material is needed, what an acceptable means of compliance looks
like and what oversight approaches will be used. Such regulatory choices and actions are examined
further in Part 2 of this manual.
The HP principles also have consequences for a regulator’s effectiveness, potentially impacting safety and
operational issues (e.g., approval of inadequate equipment due to lack of resources, knowledge, time or
because of undue political pressures).
PART 2. HP IMPLICATIONS FOR REGULATORY ACTIVITIES
A State Safety Programme (SSP) is the means through which a State can manage the safety risk in their national
aviation system. Part 2 of this manual focuses on some key regulatory activities which are necessary for the
implementation of an SSP in accordance with Annex 19 – Safety Management. Since HP considerations are
embedded in many aspects of an SSP, Part 2 provides guidance for the application of HP considerations to assist
regulatory personnel in better performing their required job functions. Because the ICAO provisions are developed
to direct and support the States’ regulatory activities, this part of the manual is also applicable for the development
of ICAO provisions.
Throughout Part 2, references are made to the components of an SSP as outlined in Figure 2-1.
Figure 2-1. Components of a State Safety Programme. The four components of an SSP include the eight critical elements (CEs)
of a State safety oversight system (light green boxes) which comprise the foundation of the SSP and other elements associated
with safety management (orange boxes) 6.
6 Safety Management Manual (Doc 9859)
2-1
In this part of the manual, specific regulatory activities and their related HP considerations are linked to SSP
components and their associated elements. Although all the SSP elements apply to every State, how the SSP is
implemented will vary based on the State’s particular needs and context in order to manage the safety risks in its
aviation system. This implementation includes ensuring compliance with the regulations established by the State as
well as the assessment of the effectiveness of each service provider’s safety management system (SMS) and the
ongoing monitoring of their safety performance. Part 2 does not attempt to comprehensively address all aspects of
an SSP, nor does it comprehensively address all regulatory activities. Instead, it highlights regulatory activities
associated with those SSP components and their associated elements that have significant HP considerations.
Despite focusing on particular regulatory activities, the HP principles have consequences for regulatory choices and
actions, and HP considerations should be embedded in regulatory activities. Throughout Part 2, attention is drawn
to the HP principles, described in Part 1, to explain particular HP implications.
The particular regulatory activities addressed in the following sections are:
 collecting and analysing data;

 developing regulatory material;
 evaluating, accepting and approving (e.g., systems and equipment, procedures, personnel);
 providing ongoing surveillance; and
 promoting safety.
2.1 COLLECTING AND ANALYSING DATA
Because it is people who create safety, either directly by their actions or indirectly by their design of processes,
equipment and systems, that the need to collect and analyse HP-related data is central to safety management. The
need to gather data and information is reflected in the Annex 19 requirements7. Guidance that highlights the need
to consider the assessment of HP-related risks is provided in the Safety Management Manual8. HP information may
be extracted from many different types of data, whether collected on a mandatory or voluntary basis, and whether
looking at what went well or at what went wrong. For a regulator, it may include:
 in-service operational data (such as data provided by the original equipment manufacturer (OEM) and
airlines);
 hazard identification and safety surveys;
 safety risk assessment data; and
 data obtained through safety reporting systems, medical reporting systems, and the investigation
of occurrences.
7
Annex 19, Chapter 5: Safety data and safety information collection, analysis, protection, sharing and exchange.
8
Safety Management Manual (Doc. 9859), 2.5.6 - Assessing human factors-related risks.
HP Implications for Regulatory Activities 2-3
Analysing safety data represents an important opportunity to examine the interactions between the human and
other system components. The analyses performed on the data collected provides an evidence base that may be
used to support HP considerations in the SSP by identifying:
 when new or amended regulations and safety critical provisions are needed (SSP component 1 – CE-2 and
CE-59);
 what is effective, to embed these approaches in future regulatory activities (SSP component 29); and
 what is not working, to manage safety risks (SSP component 29).
The regulator’s role in monitoring how a service provider collects and analyses data to examine HP-related issues is
addressed later as part of providing ongoing surveillance (see 2.4.2 and 2.4.3).
The following subsections focus on the challenges that regulators have when collecting and analysing safety data to
examine HP-related issues:
 using different sources and types of data;

 using HP taxonomies;
 analysing a single occurrence; and,
 aggregating across multiple occurrences.
2.1.1 SOURCES AND TYPES OF DATA
Many safety data collection systems are focussed on the identification and monitoring of outcomes such as technical
failures, runway incursions and excursions, and unstable approaches. However, to understand why an unwanted
outcome occurs, substantive HP data should be collected, carefully analysed, and monitored. Such HP data can then
provide information on how the humans in the system contributed, both positively and negatively, to the various
outcomes. This information could suggest important improvements to technology design, to procedures, and to
training, as well as help identify regulatory gaps. To obtain such information, regulators need to look beyond simply
counting the number of instances where “human error” was identified as a contributing factor; they must consider
detailed contextual information.
The pros and cons of gathering HP information via multiple dedicated reporting systems versus having a single
common safety reporting system also need to be considered by regulators. For example, collecting data via a
common system is often more efficient than merging and analysing data across different systems. It avoids
duplication and places information related to HP alongside information on other subjects, such as technical events.
However, it also means that the methods of collecting, processing and analysing the data are less well tailored to
examining HP. For example, standardized report forms have to strike a balance between requiring enough
information to understand when further investigation is needed and deterring people from reporting because to do
so is too onerous. This challenge inherently limits the number of HP specific questions that can be asked on such a
form. Another reason to have more than one system for collecting data is to separate those who have access to it
before it can be de-identified, from those who can only see the de-identified reports. For example, even when the
9 See Figure 2-1.

regulator applies the principles of safety data protection10, reporting systems where incident reports are received
by regulatory personnel may receive fewer reports with less contextual information than reporting systems where
reports are received by an organization independent of the regulator. In the case of the latter, reporters may have
greater confidence that they will not be punished on the basis of the report, and that they can still provide
information that can be used to improve safety while avoiding regulatory attention.
Regardless of the source, both qualitative and quantitative data offer the prospect of useful HP insights:
 Qualitative data provides a description of a person’s experience or

perspective in a narrative. While many accident and incident forms ask
for subjective narrative about causes, contributing factors and Coding qualitative data
circumstances, this information needs to be coded for analysis.
into numbers does not
 Quantitative data is expressed in numbers. Contextual data that can
provide HP information may already be quantitative (e.g., the date, the make the quantitative
time of day, light levels, the number of hours on duty, the amount of representation objective.
fuel used for landing, or the temperature), or be coded to be expressed
quantitatively (e.g., subjective rating scales).
Systemic problems are not always clear and uncovering them requires an in-depth analysis of HP-related data.
Sometimes, there is not enough data. The impressive safety record that aviation has set means that analysis of
aggregated data needs to include a much wider array of safety data than just accidents. Furthermore, it may be
difficult to recruit and retain the right expertise to extract the information or interpret the data. Keeping in mind
these particular challenges, States should consider working collaboratively with other States, industry stakeholders,
academic researchers and HP specialists in order to have access to the necessary data to gain insight.
2.1.2 HP TAXONOMIES
A taxonomy provides the organizing framework (or categorizations of data) for analysis of data. Clearly described
categories make it easier to accurately code the data. There are many
different taxonomies available for categorizing HP data, most of which
Good taxonomies should include several layers of increasingly detailed subcategories. However, a
distinction needs to be made between the level of HP detail that is useful
meet the criteria of being for in-depth analysis of a single occurrence or a few occurrences and the
comprehensive, usable, level of HP detail that is useful in uncovering the most prevalent national,
reliable, valid and diagnostic. regional or global HP-related issues.
All taxonomies have limitations. A taxonomy that is too narrowly focused

may not help to accurately describe or identify problems. Other common
problems arise through the mixing of circumstances, events and outcomes, or through the mismatch in the scope of
10
As per Annex 19, States are required to accord protection to safety data captured by, and safety information derived from,
voluntary safety reporting systems and related sources. As a Recommended Practice, States should also extend the same
protection to safety data captured by, and safety information derived from, mandatory safety reporting systems and related
sources. Further information is provided in Appendix 3 of Annex 19 and in the Safety Management Manual, Chapter 7 (Protection
of Safety Data, Safety Information and Related Sources), 7-1.
codes in a taxonomy. An example would be where air navigation services-related issues are described in detail, but
all maintenance related issues are covered by a single code. Clearly, the analyst would then discover an
overwhelming number of “aircraft maintenance issues” in comparison with “misheard ATC clearances”.
The level of detail of the codes needs to match the scope and purpose of the analysis. A high-level analysis needs to
look at high-level codes and a detailed analysis needs to use detailed codes. But to truly understand the HP issues
and underlying systemic issues such as latent conditions11, a detailed analysis is often required. Such an analysis
might also require specific HP expertise. For instance, it may be simple and easy to code and count the number of
times people “failed to follow procedures”. But to understand where the problem lies, the particular procedure and
the operational context within which the “failure to follow the procedure” occurred must be coded as well. It might
be that the procedure was not designed for the context in which it was used and therefore it was not possible to be
followed. In such a case, the solution to the problem would be found in redesigning the procedure or in changing
the operational context, rather than in forcing people to follow the procedure.
In some cases, taxonomies relating to HP have cultural biases. For instance, a taxonomy that lists among its examples
of impairment and incapacitation: “alcohol”, “illegal drug” and “medication” assumes that alcohol is not an illegal
drug. Yet in many countries alcohol is illegal, and in other countries, there are legal alcohol limits applied to aviation
personnel. Furthermore, medication may be either prescribed, or obtained without a prescription and the same
drugs may be taken legally or illegally. In summary, the logic of a taxonomy needs to be scrutinized when it is devised
and then again once it is in use, in order to ensure that it is effective and can be consistently applied.
Tests of reliability are usually used to establish whether or not the taxonomy can be applied consistently by different
people (inter-rater reliability) and consistently by the same people over time (intra-rater reliability).
When analysing any information about humans, it can be tempting to make assumptions, apply our own
interpretations, and be potentially biased in the analysis (for more about biases, see below). Therefore, care should
be taken to avoid biases in interpreting the HP data, such as assuming causal relationships where there are none.
Regulators should consider the following key points, when looking for HP-related issues in safety data:
a) data collection forms should be designed with a clear understanding of what HP-related information is
needed to correctly identify HP issues.
b) consideration needs to be given to selecting suitable taxonomies, given that all taxonomies have limitations,
and that different taxonomies provide different insights.
c) when recording mandatory accident and incident data, analysts need to accurately and consistently apply
the taxonomy to the HP-related data.
d) people performing the data analyses need to have adequate training. In addition to understanding the HP
principles, they need an understanding of the HP implications related to:
 the limitations and reliability of the data sets used;
11
Latent conditions are described in Section 2.3 - Accident causation of the Safety Management Manual (Doc 9859) as follows:
Breaches in safety defences can be a delayed consequence of decisions made at the higher levels of the organization, which may
remain dormant until their effects or damaging potential are activated by certain operating conditions (known as latent
conditions).
 the interpretations that can (and cannot) be made using such data sets;
 latent conditions; and
 when further detailed analysis may be necessary.
e) The limitations of the taxonomy selected need to be reflected in what is concluded from the analysis.
2.1.3 IN-DEPTH ANALYSIS OF A SINGLE OCCURRENCE
The primary objective of any accident or incident investigation is to allow the aviation community to understand not
only what happened but also why it happened, in order to prevent recurrences and improve the system as a whole.
Accident and incident investigation is an activity that falls under SSP Component 2 (Safety Risk Management), and
can be undertaken at different levels, resulting in different roles for the regulators involved:
a) Annex 13. Accident and incident investigations are conducted by a State’s accident investigation authority,
with the goal of providing an independent and objective understanding of the occurrence. Regulatory
personnel may participate in Annex 13 investigations upon invitation from the accident investigation
authority. While the accident investigation authority focuses on the identification of causes and/or
contributing factors to make safety recommendations, the regulator often needs to act on those
recommendations and implement safety interventions.
b) Safety investigations of occurrences that have been identified through a State’s safety reporting system
(Annex 19) but that are outside of the scope of Annex 13 may also be undertaken by the regulator12.
Because people are involved in every aspect of the aviation system, HP perspectives are relevant to all accidents and
incidents. Lessons to be learned can be gained in recognizing what went well, in addition to what went wrong.
Considering the HP principles during an in-depth analysis of a single
occurrence assists regulators in better understanding why humans
Operator error is very rarely throughout the system behaved or responded in the way they did. The
regulator needs to take into account the dynamics of the situation and the
the root cause of an factors most likely to have influenced peoples’ actions at the time (see 1.4
occurrence. Usually, some - HP Principles). This understanding is necessary to be able to identify and
underlying systemic issue is accurately describe any systemic issues or latent conditions, so that the
most appropriate remedial actions can be taken. Such actions may include:
hiding behind it.
the need for more comprehensive or updated guidance; further safety
promotion activities; adjustments to regulatory requirements; and
enforcement actions in those rare cases where necessary to maintain
minimum safety standards.
12
Service providers also frequently conduct their own investigations into occurrences (see 2.4.3 - Safety Investigations for
information on the regulator’s role in assessing how well HP aspects have been considered within safety investigations conducted
by service providers).
When participating in an in-depth analysis of a single occurrence, a regulator should have a sufficient understanding
of HP to recognize their own knowledge gaps and to determine whether to seek additional specialist HP expertise.
HP considerations impact on:
 When data should be collected
HP data collection should be initiated as soon as possible after an occurrence as this data is easily lost or
contaminated with the passing of time. Aside from forgetting some details (HPP 1), people tend to create
a narrative that “makes sense” (HPP 2), inadvertently adding in extra details based on their expectations
and on things they learned after the event.
 The type of information that is collected
The dividing line between relevant and irrelevant HP information is often blurred. Information that may
initially seem to be unrelated to the event could prove to be extremely important after other connections
are uncovered by further analysis. A variety of sources of available data (from documents, maintenance
and airworthiness records, interviews, witness reports, and other related information) may need to be
taken into account.
 How interviews are conducted
If conducting an interview immediately after an occurrence, it is important to recognize that interviewees

who have experienced a serious event or even a near miss are likely to be strongly affected. Due to attention
and perceptual mechanism limitations, those involved in an accident or serious incident cannot process all
the information at the time of the event (HPP1). Even interviews of involved personnel conducted following
the mandatory reporting of an incident after some time has passed, can likely be an extremely
uncomfortable experience for an interviewee. Interviews should be conducted so as to maximize the
retrieval of information about the occurrence and not focus on
finding fault with the actions taken or decisions made.
Interviews are most productive in the context of a sound safety Punishing an individual for
culture where it is recognized that taking systemic remedial making an error undermines
actions is more beneficial than punishing an individual,
particularly when their behaviour can be understood in terms of
safety culture and can prevent
the HP principles and the operational context (see 2.4.2 for the development of effective
additional information on safety culture in incident reporting). barriers and mitigations.
To improve the effectiveness of interviews, an interviewer can:
a) select an interview location which maximizes the opportunity for a private, warm, friendly and
inviting space rather than one that is intimidating. Consider aspects of the location which might
be threatening or uncomfortable for women, minority groups or individuals in a power dynamic;
b) ensure everyone involved in the interview understands the objective of the interview, their roles
and responsibilities;
c) avoid dominating the conversation, but instead spend the majority of time listening actively;
d) look at and engage with the person being interviewed. Consider having a separate note taker so
that the interviewer can be fully focused on the interviewee. If too much time is spent looking
down and taking notes, the investigator might miss important non-verbal cues that will help
understand the nuances involved;
e) ask open-ended questions;
f) avoid treating the interview as a “question and answer” session. Listen for cues in what the
person is saying to lead to further questions (rather than strictly follow predetermined questions).
Do not interrupt. Wait for a suitable time to ask follow-up questions if the story is not understood;
g) keep responses neutral and calm. Don’t judge the interviewee; and
h) above all, assume positive intent in the individual – no one started their day intending to have
this incident or accident.
 Potential biases in interpreting information and data
During the different stages of an investigation, effort is required to separate facts from their interpretation
and to also look for information supporting or contradicting these facts and these interpretations. When
building the occurrence scenario, the regulator conducting the investigation never has access to all the
information. Thus, often only assumptions can be made based on the information available. Such
assumptions are guided by the choice of facts considered, as well as the biases to which all people are
subject to. Among other biases, the regulator must strive to overcome the following biases when
investigating an occurrence:
a) Hindsight bias: Knowing the outcome of an event has an influence on the way the analysis is
done;
b) Attribution bias: A tendency to infer causes of behaviours (e.g., to link an operator’s error to an
operator’s assumed incompetence);
c) Frequency bias: to over (or under) estimate the probability of occurrence of a particular event;
d) Confirmation bias: to notice and accept that which supports prior beliefs and expectations, and
to ignore or dismiss those facts which do not quite fit the pattern expected; and
e) Group conformity: to agree with the majority decisions in the group of investigators.
When undertaking an in-depth analysis of an occurrence, the regulator needs to be aware of the impact
of such biases, and constantly test assumptions made against evidence in order to minimize their effects.
It should be noted that interviewees are also subject to various biases which influence their perception
and recollection of events.
Properly conducting the analysis of single occurrences and consistently using the same taxonomy results in accident
and incident data that, when aggregated, can provide the basis for monitoring organizational, national, regional and
global safety performance.
2.1.4 ANALYSIS OF AGGREGATED DATA
To monitor performance and support policy-making, analysing aggregated data across multiple occurrences, hazards
or other performance indicators is necessary. Such data may be obtained through collections of in-depth analyses
of single occurrences as well as from occurrence reporting systems, hazard reporting systems and in-service
operational data.
High-level analysis of HP issues provides an opportunity to find similar underlying causes for a variety of outcomes
that otherwise may not be obvious. For example, monitoring the number and rate of incident reports citing time
pressure may provide an insight into how busy particular locations are. Such time pressure could lead to misloaded
aircraft, incorrect pushbacks, taxiway incursions, stop bar overruns, misheard ATC clearances, altitude deviations
and so on. However, to establish whether increased reports of “time pressure” in different locations have the same
underlying cause(s), further analysis and examination of contextual factors are needed. Is it increased traffic?
Changes to scheduling? Changes to staffing levels, absence rates or contractual arrangements?
Identifying common HP issues even when they have different implications and result in different types of outcomes
enables regulators to identify the most effective preventive or remedial actions. For example, a maintenance
engineer missing a procedural step may have a very different potential outcome from an air traffic controller issuing
a clearance to the wrong call sign, but both could be the result of fatigue. Identifying fatigue as a common issue
means that instead of updating each and every procedure that is not followed, a regulator can instead focus on
interventions relevant to addressing the more significant underlying HP issue of fatigue.
Therefore, when paired with reviews of individual occurrences and with dialogue with service providers, analyses of
aggregated data can be particularly useful in identifying latent conditions, underlying common causes, and
systemic issues.
2.2 DEVELOPING REGULATORY MATERIAL
An SSP requires the establishment of regulatory material on a variety of topics, including, but not limited to:
operating regulations (CE-2); licensing certification, authorization and/or approval obligations (CE-6); and technical
guidance, tools and provisions of safety critical information (CE-5). This can be seen in Figure 2-1.
Regulatory material may need to be developed or updated for a

variety of reasons, but in all cases, it is important that the material
addresses appropriate HP considerations. Additionally, regulatory Because ICAO SARPs drive States’
material should be developed based on factual HP information, not
regulatory requirements, HP
just opinion. Such HP information should come from credible
sources, have appropriate operational context and include considerations are essential to the
information based on operational data. For example, HP development of those SARPs and
information may come from audit findings, trends identified their supporting guidance material.
through the State’s mandatory occurrence reporting system and
through health status data monitoring, the HCD process (see 1.2) or relevant research.
Some high-level regulatory material (e.g., public law, ICAO SARPs, or State regulations) mention HP explicitly,
including phrases such as “consider human factors principles”, or referencing “human performance considerations”.
Other high-level regulatory material may make little or no specific reference to the terms “human factors” or “human
performance”, although many still address HP issues. For example, regulatory material may include terms such as
“minimum crew”, “workload”, “reduce the likelihood of error”, “fitness for duty” or “take account of human
capabilities and limitations”, all of which have clear HP implications. To facilitate implementation, these high-level
statements should be supported by detailed guidance material regarding HP that is specific to the objective of the
regulation. Because the HP topics that need to be addressed often require specialized HP knowledge, it is essential
to include specialists with HP knowledge relevant to the topic being addressed in the development of regulatory
material, as well as in the official review and coordination process of all documents with HP-related material.
To address HP considerations, regulations need to be developed while keeping in mind the legal, cultural and
operational context of those who will be implementing them. Therefore, before adopting other States’ regulations,
while still striving to keep regulations harmonized as much as practicable, regulators need to give careful
consideration to how such regulations will be interpreted and implemented in their own State.
When developing regulatory material, HP considerations include:
a) the conditions and operational environments where it will be implemented;
b) the safety assumptions that have been made, e.g., a high level of user proficiency, user fitness-for-duty,
effective use of safety management processes;
c) the specific regulatory context, i.e. the new or amended regulatory material in the context of existing
regulations, including relevant non-aviation specific regulations and legislation;
d) the way in which rules and regulations are perceived and followed given the cultural context.
2.3 EVALUATING, ACCEPTING AND APPROVING
An SSP requires that licensing, certification, authorization and/or approval obligations be met (see Figure 2-1,
Component 2 and CE-6), which results in the need for some form of evaluation or test.
Different States and aviation authorities use a variety of terms to describe this type of activity. For the purpose of
this manual, no distinction is made between terms such as testing, assessing and evaluating, nor between the terms
certifying, approving, authorizing, accepting and licensing. In all cases, the regulator’s responsibility is to ensure that
whatever is being evaluated complies with the associated regulatory requirements, and that the regulatory
requirements and guidance are adequate to enable such an evaluation.
The following sections provide high-level guidance on actions the regulator can take to ensure that HP considerations
have been adequately addressed when evaluating or approving:
 Equipment;
 Organizations, management systems and procedures; and
 Personnel (through training and licensing approvals).
2.3.1 EQUIPMENT
Because equipment (i.e. hardware, software and systems) is designed to be used by people, either directly or
indirectly, there are many equipment-related HP issues to be considered by the regulator in its evaluation and
approval. The regulator evaluates products designed by a variety of different types of organizations, often referred
to as “applicants”. It is the applicants’ responsibility to identify the appropriate regulatory requirements, propose
how compliance will be shown and then demonstrate compliance. The regulator is responsible for evaluating the
completeness and accuracy of the identified list of regulatory requirements. Additionally, the regulator is responsible
for accepting the proposed method of compliance and for evaluating compliance with these regulatory requirements
for equipment (whether hardware, software or associated manuals such as for installation, operation and
maintenance).
Examples of equipment that require regulatory approval include:
a) aircraft;
b) flight deck systems;
c) remotely piloted aircraft systems;
d) ATC systems; and
e) aerodromes systems.
It is critical that the applicant provide sufficient evidence to the regulator that supports regulatory compliance. The
evidence should include the assumptions made about human performance during the design phase, which are then
validated as part of testing, before the equipment is put into operational use. This evidence can be submitted as part
of the test plan, to be approved by the regulator. Furthermore, early involvement meetings between the applicant
and the regulator are encouraged, especially to address HP considerations.
The applicant should also demonstrate how the users, their operational context, and the conditions of use, have
been considered in the development of the equipment. The applicant should also undertake iterative testing and
evaluation cycles to reduce the likelihood of unintended consequences. Designing and developing the equipment
and manuals in accordance with an HCD approach (see 1.2) can increase the likelihood that HP issues are identified
and addressed early, resulting in a better product.
When it comes to determining whether the necessary HP requirements have been met, specific HP expertise is
frequently needed. It is recommended that the level of scrutiny for evaluating and approving equipment reflect
the following:
a) potential for safety implications/risk;
b) degree of change in or novelty of design, procedure, layout, tasks and/or operation;
c) potential impact on attention, awareness, tasking, performance and workload;
d) existence and adequacy of current regulatory guidance (e.g., to address the new and novel systems,
equipment, programmes, procedures, feature, function, system, design or operation); and
e) potential for confusion, misleading data and/or user error.
Regardless of what type of equipment is being evaluated or approved, there are many considerations relevant to
human performance. Such considerations include:
a) error management (including prevention, detection, and recovery) - such as human data entry errors
and how the system or equipment is designed to catch or ‘trap’ the errors;
b) task performance - such as time to complete task(s), procedures needed to perform the task;
c) workload - such as the amount or intensity of effort involved in a task, and the task’s sequencing, or
overlap with other tasks;
d) learnability and usability - such as the degree to which learning to use and operating the equipment
can be done effectively and efficiently;
e) complexity - such as the number and/or nature of interconnected/interactive components;
f) context – such as the particular operational context and conditions of use;
g) situation awareness - such as the operator’s awareness of the current and future state of the system
and of the task expected of the equipment and the operator under different conditions of use;
h) maintainability - such as the degree to which the design allows for ease of maintenance and
servicing; and
i) crashworthiness, survivability and resilience aspects of aircraft, vehicles and associated systems.
To assess whether the equipment under evaluation for approval adequately addresses these HP considerations, the
regulator should evaluate compliance with the appropriate HP regulatory and guidance materials, and systematically
look at its:
Intended function (the stated purpose of the system), e.g.:

Is the system’s intended function sufficiently clear and detailed, including the human role, to
allow the regulatory authority to evaluate the system?
Design philosophy (an overarching usability theme that applies across multiple systems, such as within
a flight deck or ATC workstation), e.g.:
— Has the design philosophy been documented and tested?

— Is the product consistent with the design philosophy? (e.g. where a “quiet, dark flight deck
philosophy” has been chosen, are the system status indicators only illuminated when user
attention is needed?)
Design features, e.g.:
— Displays
 Information elements (such as information in a data block on the ATC radar display, or
system schematics on the maintainer’s display), e.g.:
Is the right information displayed at the right time to allow the users to safely
accomplish their tasks?
 Organizing information (such as layout, location), e.g.:
Is the information accessible and usable in a manner consistent with the urgency,
frequency and duration of the users’ tasks?
Does familiar information have to be accessed from unfamiliar locations?
 Information presentation or format (such as use of colors and symbols), e.g.:
Is all information free of clutter and in a format that is clear and unambiguous at a
resolution and precision appropriate for the users’ tasks?
— Alerts, e.g.:
Do alerts enable effective user awareness and subsequent user action, and with an
acceptable level of nuisance alerts?
— Controls (such as knobs, buttons, touch pad, track ball, yoke, side stick), e.g.:
Does the system have sufficient controls to accomplish all tasks associated with the
intended function, including enabling users to intervene in a manner appropriate to
the task?
— System behaviour (such as the relationship between control input and system response), e.g.:
Is the operationally relevant behaviour of the system predictable and unambiguous?
— Integration/installation (such as location of the display and aspects of how it integrates with
other displays and systems), e.g.:
Is the system’s use of colour and symbols consistent with other displays in the same
workstation or flight deck? Or consistent across different workstations and flight
decks of different aircraft models?
— Automated functions: See Automated systems section below.
It is recognized that all States have limited resources, and many do not have specific and extensive HP expertise
available. Thus, a State may not have the regulatory resources necessary to undertake a full HP evaluation of all such
systems but is still required to ensure regulatory compliance. Even if a particular State chooses to find compliance
through delegation or bilateral recognition agreements (i.e. accepting findings of regulatory compliance from
another State), the authority and responsibility for approval still rests with the signatory State. In such cases, the
signatory State needs to:
a) be assured that the safety analysis undertaken by the State of Design to grant approval has adequately
taken HP considerations into account, per the local regulatory requirements and the specificities of the
State’s operational environment; and
b) consider how this new equipment will be implemented and maintained within the State’s local operational
environment and within the context of its applicable regulations. This includes the identification of any
necessary training that may be required to address local needs.
Approvals of equipment always include assessments of the safety impact of using it, which the applicant is required
to submit. One of the key challenges for the regulator in approving hardware/software systems and equipment is
understanding the safety impacts related to human performance prior to use in operations. This understanding is
much enhanced when a human-centred design process (see 1.2) has been used by the applicant to develop the
particular hardware or software system.
The means for analysing safety risks borrow heavily from methods developed solely for technical systems. Likelihood
severity methods assign quantitative values to each for an overall quantitative risk score. Such methods have limited
applicability to addressing human performance because, for example, they:
a) primarily address human error rather than the full range of possible human performance that influence
safety outcomes;
b) require likelihood estimates of specific human actions, e.g., “human error rates”, that typically cannot be
validated, particularly prior to approval; and
c) are impractical for addressing the true context and complexity of operations and other factors that affect
human performance.
Because of these and other limitations with traditional safety-risk assessment methods, the applicant’s safety
analysis would benefit from:
a) an assessment of human-system operations that considers both positive and negative human contributions;
b) qualitative analysis methods in addition to quantitative methods; and
c) a sufficiently detailed and comprehensive breakdown of the related human tasks, and the human and
machine interactions, so that representative operational behaviour can be addressed.
Automated systems
In meeting SSP obligations, regulatory authorities may be required to evaluate and approve equipment that
automates certain functions. Automation entails some specific HP challenges, so this section provides some HP
considerations specific to evaluating automated systems.
Automation refers to the performance of a function by hardware and/or software instead of by humans. Therefore,
all “automation” is inherently a system, and in this Manual is equivalent to “automated system”.
“Automated” and “autonomous” are different and should not be used interchangeably. Autonomous systems are
defined here to be a subset of automated systems that have the ability to apply information (often in complex and
dynamic situations) and independently determine a course of action in the absence of a predefined plan to
accomplish goals. Autonomous systems should receive particular attention when being evaluated. This is because,
unlike other automated systems, the designers of autonomous systems may not be able to state in advance precisely
how the system will act to accomplish its goals in all cases. The assessments need to be based in part on the function
the autonomous system is expected to perform as well as on how humans are expected to interact with it.
Despite the intended benefits of automation, an extensive body of literature has been developed over the past
several decades identifying human performance issues associated with automated systems. Because these systems
may be in service for several decades, many of these issues persist in the aviation system. It is important for the
regulator to know what issues to look for when conducting an evaluation of automation, whether it be an ATC,
aircraft, or other system-related issue. In considering the design features identified above with respect to
automation, it is particularly important to address the following HP questions:
Has the rationale for the decision to automate been documented?

— It is important to ask why a particular function should be automated because automation may not
always offer the best system solution. Is it for workload reduction? Performance enhancement?
System scalability?
Does the automation display appropriate information to allow the user to meet their performance
obligations and their responsibilities?
— Information about system function is critical for users to understand the system, to know what it
is doing, and to calibrate their trust appropriately.
— Too much information about system functioning can result in information overload and clutter.
— Lack of feedback on system functioning makes it difficult for the human to be aware of and to
understand how the automated system is working and how to predict what it will do next.
Does the automation provide the user with the appropriate level of control?
— As long as humans are responsible for a task, they must have the appropriate authority to exercise
that responsibility 13 . This means that automated systems not only need to provide sufficient
information through displays, but also provide means for human intervention through controls
(e.g., manual override).
Are the human performance expectations and user responsibilities clearly identified?
— Automation results in new user interactions that require training and practice, often in addition
to what is required for "manual" operations.
— An automated system that encounters conditions outside the operating environment envisioned
by the designer may suddenly cease to perform its function. In such cases, recovery may depend
on a rapid response by the human.
How are automation surprises mitigated? Automation may surprise the human user when:
— the user is expecting one behaviour, but the automated system exhibits another behaviour;
— the automated system unexpectedly transfers control to the human; and
13Billings, C. E. (1997) Aviation automation: The search for a human-centered approach. Mahwah, NJ: Lawrence Erlbaum
Associates, Inc.
— complex system interdependencies result in unexpected changes in state or mode.
What knowledge and skills does the user need to manage the automation in normal and abnormal
situations?
— Lack of practising a task that has been automated may degrade human proficiency of motor and
cognitive skills and knowledge needed when the automation fails.
— Automated systems change existing tasks, create new tasks and introduce different error types.
Are there unintended adverse effects of automation?

— Use of automated systems can reduce workload during traditionally low workload phases but
may add workload or interfere during time-critical, dynamic circumstances.
— When automated systems consistently perform well, the human may develop over-reliance on
the automated system, which can contribute to skill degradation.
— Automated systems may shift the human’s role from active controller to supervisor or monitor,
something people are not particularly good at doing.
While many of these questions are also applicable to hardware and software systems in general, they are particularly
relevant to automated systems.
IMPLICATIONS BOX 4
So how are the HP principles (HPPs) relevant to evaluating,

accepting and approving equipment?
The hardware/software system design and operation, system installation and placement and procedures
may directly affect the user’s workload, awareness, ability to respond and other aspects of human
performance (see 1.4). Supporting human performance by design is usually the most sustainable and most
effective intervention. Using the HCD process (see 1.2) to design a wide variety of systems and equipment,
such as maintenance tools, airport ramps, flight deck displays or air traffic controller’s workstations, can all
reduce the likelihood of error, and make the task easier, more intuitive and efficient.
It is important that systems and equipment:
1. Accommodate people’s physiological needs and physical, as well as cognitive, constraints.

Systems, equipment and tools should be designed to be used appropriately throughout the likely
range of the users’ performance, and should be fit for purpose (see HPP 1).
2. Be designed to be used effectively within the actual work environment to achieve the task
objectives. Prior to approval, systems and equipment should be evaluated and tested under
realistic operational conditions (see HPP 3).
3. Ensure that information and data are:
— available when needed, clearly communicated and integrated when possible to support
people in building and maintaining an accurate understanding of the situation (see
HPP-2); and
— presented in ways that assist people in assessing operational risks and potential
consequences, and in ways that allow them to reflect and balance trade-offs in their
decision-making (see HPP 4).
4. Be designed, where required, to be used effectively by a group or a team, as well as across different
groups who share tasks and activities (see HPP 5).
5. Be supported by implementation guidance that includes identification of the knowledge and skills
needed by the users and how the user is expected to perform.
2.3.2 ORGANIZATIONS, MANAGEMENT SYSTEMS, PROCESSES AND PROCEDURES
As part of the SSP requirements, States have regulatory responsibilities to ensure that HP considerations have been
adequately addressed when evaluating and approving the following:
 the organization14 itself;

 its management systems; and
 its processes and procedures.
The regulator should ensure that the organization provides documentation that sufficiently explains how it complies
with regulatory requirements. The organization should also demonstrate how HP is addressed in the operating
environment. Such compliance should be shown both at the time of application (seeking approval) and as an ongoing
surveillance activity. One way an organization can demonstrate its attention to HP is by following the HCD process
(see 1.2) and by addressing each of the HP principles (see 1.4).
Some of the HP considerations associated with evaluating or approving each of the items above are described further
below. HP considerations for ongoing surveillance are addressed in 2.4.
a) Organizations
The regulator is responsible for approving a variety of organizations15. While detailed information on approving
specific types of organizations is provided in other ICAO manuals16, the focus of this section is on addressing the HP
aspects of evaluating and approving any organization and authorizing it to undertake particular activities.
14
The guidance is also relevant to designated individuals who provide aviation services on behalf of the State (e.g., pilot
examiners, aviation medical examiners, maintenance inspectors, certification engineers).
15
In the case of training organizations, approvals are granted, and surveillance is provided, by a State-designated Licensing
Authority, which may or may not be part of the regulatory authority. In this document, the term “regulator” is used in a general
way to refer to those who perform the functions of approving and providing surveillance of any organization, whether as member
of a Civil Aviation Authority or a Licensing Authority.
16
Approval of:
 Training Organizations: Manual on the Approval of Training Organizations (Doc 9841).
 Air Operators: Manual of Procedures for Operations Inspection, Certification and Continued Surveillance (Doc 8335).
 Maintenance Organizations: Airworthiness Manual (Doc 9760), Part III, Chapter 10.
 Design and Manufacturing Organizations: Airworthiness Manual (Doc 9760), Part V, Chapters 2, 3, 4.
 Aerodromes: Manual on Certification of Aerodromes (Doc 9774).
 RPAS: Manual on Remotely Piloted Aircraft Systems (RPAS) (Doc 10019).
Key HP considerations when evaluating an organization for approval include:
Does the organization’s training documentation reflect a commitment to personnel competence,

identifying how the organization selects and inducts its staff, as well as provide them with continued
training?
Is there evidence that the organization’s personnel are sufficiently qualified and trained to perform their
roles effectively? (This includes managers, line staff, technical and administrative staff, instructors/trainers,
safety personnel and evaluators.)
Are there enough people to provide the proposed services?
Are safety and HP accounted for in all business areas – for example in financial planning where budgets can
limit safety and HP resources, as well as in drafting operational procedures?
Are HP considerations adequately documented in the organization’s evaluation processes and procedures?
Does the organization seek to identify areas where its unique operating environment requires further
mitigations or enhanced procedures in order to ensure safe provision of services?
Does the organization have a process for assessing and learning from things going right?
Do training programmes indicate that staff are trained in organizational processes, individual
responsibilities and expected behaviours? See 2.3.3a) - Training Programmes.
Many of these HP considerations point to the organization’s safety culture (discussed further in Implications Box 5:
So how are the HP principles relevant when regulators are evaluating or approving an organization or its
management systems?). All these considerations influence the way an organization operates its various
management systems (discussed below).
b) Management systems
The regulator is responsible for evaluating and approving a variety of management systems including, where
applicable:
 quality management systems (e.g., Aeronautical Information Service Quality Management System,
Instrument Flight Procedure Design Service Quality Management System);
 SMS;
 FRMS17;
17
For detailed information on the approval of an FRMS, see of the Manual for the Oversight of Fatigue Management Approaches
(Doc 9966) Chapters 5 and 6.
 transportation of dangerous goods (as per Annex 6, Part I and Annex 18 — The Safe Transport of Dangerous
Goods by Air);
 regulatory compliance systems or internal audit systems (as per Annex 19); and
 training management systems (i.e. the training plan, managing the delivery of the training programme(s),
managing trainer competence, and monitoring student progress).
During the initial evaluation of an organization’s management system, there needs to be evidence that HP has been
considered in the establishment of the system processes and that the management system supports HP to achieve
the system’s goals For example:
 In an SMS18:
Are HP-related safety data collected, analysed and acted upon as appropriate?
Is there a process that encourages reporting and enables identification of HP issues and learning
and sharing lessons from experiences within the organization (see 2.4.2)?
Is there a process for informing personnel of organizational actions taken when things do not go
as planned?
Is there a process for managing safety risks associated with individuals’ fitness for duty, including
a process for returning an individual to duty after an absence related to being unfit?
Does the organization’s training programme include addressing individual responsibilities,

organizational processes and procedures and their rationale (see 2.4.5)?
Does the organization have an identified change management process that includes appropriate
HP training relevant to changing roles and responsibilities (see 2.4.6)?
 In a Training Management System:
Does the training programme integrate HP elements as per regulatory requirements? (see 2.3.3a);
Is there a process to ensure standardized assessment of competence? (see 2.3.3b)
Are simulators, training aids and devices “fit for purpose”? (see 2.3.3c)
However, it can be difficult to assess how the system processes actually work and whether the management system
sufficiently demonstrates appropriate consideration of HP simply by examining documentation. Prior to approving
a management system, a regulator is likely to need to observe people in their day-to-day work and ask questions
about how they would carry out their functions within that particular management system. In doing so, a regulator
can gain important insight into the likely effectiveness of the management system. For example, the regulator
can assess:
18
See also this manual, 2.4 - Providing Ongoing Surveillance.
 what processes the management system has to inform, and be informed by, other systems in use (allowing
people to monitor interactive effects);
 how HP-related hazards are recognized within the risk assessment methodology used;
 when and why personnel actually report hazards or report safety concerns, including those related to HP;
 how well understood are the personnel roles and obligations with respect to the management system;
 whether an HCD approach and an understanding of the appropriate HP considerations is evident in the
development of the management system processes;
 whether appropriate processes and procedures for the reporting and management of compliance issues
are in place; and
 how effective is the organizational training and how are in-house learning activities used to enhance a
“safety culture” and support people to know how things are done and what they are expected to do
(see also 2.4.5 - Training Activities, and Implications Box 5).
Similarly, because it may be difficult to assess whether the organization’s proposed assurance methods are suitable
and sufficiently address the HP considerations during the initial assessment period, continued surveillance activities
are critical. These surveillance activities should include periodic assessments and assurance activities that look for
evidence that the approved management systems remain effective in actual operations (see 2.4).
IMPLICATIONS BOX 5
So how are the HP principles (HPPs) relevant when regulators

are evaluating or approving an organization or its
management systems?
An organization’s culture affects how safety is perceived, valued and prioritized by management and operational
personnel. This has a large influence on how effectively an organization manages its safety risks and how
managers and employees behave and interact.
The organization strongly influences HP through: effective leadership, using good design practices, providing
access to training and selecting enough suitable candidates to undertake the various tasks that must be
accomplished. It does so through its management system, including the managers, and the procedures they
utilize. As part of evaluating and approving an organization or its management systems, a regulator should look
for evidence that:
1. People are selected for and assigned work they are able to perform and are fit to undertake. Work and the
work environments offer flexibility and adjustability to accommodate people’s needs and variable
performance (see HPP 1).
2. The organization addresses risks associated with not being fit for duty. There is an identified method for
reporting “not fit for duty”, and people are made aware of when to report “not fit for duty” and of the
consequential organizational responses (see HPP 1).
3. A focus on continual organizational and individual learning in response to safety events, including close calls,
incidents and accidents is established. This focus should emphasize understanding why the decisions and
actions made by the individuals involved in the events made sense to them at the time, rather than focusing
on what they did wrong (see HPP 2).
4. Contributions to improving work and procedures based on lessons learned from past experience are valued.
There is a willingness to continually improve, including learning from subject matter experts, from
colleagues, and from observing what goes well during operations (see HPPs 2 and 5).
5. Personnel are encouraged to actively engage in hazard identification, risk assessment and risk mitigation.
They are also encouraged to recognize what works well, to utilize best practices, and to report where the
equipment, tools or procedures do not fit the reality of the operation (See HPP 3 and 4).
6. The organization recognizes potential operational trade offs, and desired behaviours are clearly promoted
and reinforced through the organization’s processes, procedures and training (see HPPs 4 and 5).
7. Managers at all levels across the organization are aware of the likely impacts that their own behaviour has
on other people and groups. They use multiple methods of communication to achieve a shared
understanding of the goals, roles and responsibilities of everyone in the organization (see HPP 5).
c) Processes and procedures
Air traffic controllers, pilots, aircraft operators, training schools and maintenance personnel all use processes and
procedures which may require regulatory evaluation and approval. This section does not focus on the evaluation of
processes and procedures as part of the approval of management systems (see 2.3.2b), but rather on those
processes and procedures for which regulators have specific responsibility and authority to approve.
Processes and procedures provide a logical progression of actions and decisions. They support consistency, help
manage complexity, and minimize the potential for errors. Because processes and procedures are designed and
executed by people, regulators should take HP considerations into account during their evaluations and approvals.
A process consists of various functions and defines a framework or identifies a path necessary to accomplish an
objective. The regulations may require the organization to establish a process and may outline a framework, but the
organization then develops the specific actions, activities, systems, people or tools that are to be used in order to
meet the objective in context.
Examples of processes that regulators may approve include:
 airport-specific foreign object debris (FOD) management;
 airline-specific process for the management of change; and
 training organization processes for the development of courseware.
A procedure, on the other hand, is more detailed, identifying how specific actions are to be undertaken by an
individual(s), and in what order, to complete a task. Examples of procedures that regulators may approve include:
 standard operating procedures, such as normal checklists;
 flight procedures, such as a standard instrument departure procedure;
 procedures for the assessment of fitness for duty, (e.g., procedure for medical assessors to reach an
Accredited Medical Conclusion that an individual with a borderline medical assessment is certified as “fit
for duty”).
The likelihood of the regulator approving an operational process or procedure may be improved by using an HCD
approach in its development (see 1.2). This includes taking into account the HP principles (see 1.4) and involving
users and stakeholders who may be directly or indirectly affected, as well as those with appropriate operational and
HP expertise. It also means that the proposed process or procedure has been subject to multiple reviews, tests, trials,
feedback and revisions.
For the purposes of evaluation and approval, the regulator should check that the process or procedure is:
 formally documented and readily available;
 written at the appropriate level of detail to ensure accurate execution; and
 clear about:
— what is to be accomplished;
— when and under which conditions it should be executed;
— what each step is, and who performs each step; and
— when non adherence is permitted (e.g., defined situations and what the potential risks/hazards
are if they are not followed).
An application package submitted to the regulator should not only identify the process or procedure itself, but also
be clear about the reasons for the new, or any change to existing, processes or procedures and what additional
training may need to be provided. It should include a method for review to ensure that the process or procedure
remains effective over time.
Because a procedure is more specific than a process in detailing how a task must be performed, when evaluating
and approving a procedure, the regulator should also check that it:
 is appropriate for the task (e.g., operationally relevant, able to be accomplished with acceptable workload
and in a timely manner, can be integrated with other concurrent procedures);
 is unambiguous and able to be applied uniformly and consistently within an operation;
 includes a method to confirm proper completion (e.g., supported by cross checking or being signed off by
another party);
 reflects the operational needs and prevents conflicting demands;
 is fit for the range of environments where they will be executed (e.g., at night or in bad weather); and
 is able to be executed by people with a range of physical characteristics (e.g., height, strength).
Additional Considerations for the Approval of Airspace and Flight Path Procedures
Approving airspace and flight path procedures requires special HP considerations to ensure that they are evaluated
from the user’s perspective (primarily pilots and air traffic controllers).
The complexity of designing airspace and flight paths is increasing. The planning and design of routes, holding
patterns, airspace structure and ATC sectorization in both terminal and en-route airspace need to take into account
many factors other than simply maintaining separation or flying efficiently from an economic perspective.
Examples of HP considerations for such approvals include:
 pilot management of flight path constraints, including if route is amended, which affects workload;
 number of flight path transitions, which add variability to the flight path and add visual complexity to charts;
 transitions between flight path segments, which affect pilot monitoring and management of energy;
 phraseology and designators, which affect voice and data communications and comprehension;
 depiction on charts, which needs to take into account clutter, scaling, etc. Notes on charts, which can be
difficult to read when there are too many of them (e.g., from overly complex procedures);
 rejoining procedures after being taken off from an ATS route (e.g., from vectoring), which can be challenging
to pilots;
 appropriate balance of operational demands (e.g., pilots vs controllers); and
 variability of aircraft flight management systems (e.g., between different aircraft types), which can affect
pilot workload and procedure conformance.
Further information on airspace design and flight (path) procedures development is provided in:
 Annex 11 — Air Traffic Services;
 PANS-OPS (Doc 8168): Procedures for Air Navigation Services — Aircraft Operations; Volume I — Flight
Procedures; Volume II — Construction of Visual and Instrument Flight Procedures; Volume III – Aircraft
Operating Procedures;
PANS-ATM : Procedures for Air Navigation Services – Air Traffic Management (Doc 4444).
 Required Navigation Performance Authorization Required (RNP AR) Procedure Design Manual (Doc 9905).
2.3.3 PERSONNEL TRAINING AND LICENSING
As part of its SSP obligations, a State is required to ensure that the training requirements for the issuance of licences
or other authorizations for personnel are met (SSP component 2, CE-6). This obligation is typically addressed through
licensing processes and through approval and oversight of personnel training. Human performance is central to the
purpose of both personnel training and licensing, because both focus on the competence of those conducting the
training and those receiving it.
Licences and ratings are issued on the basis of the applicant meeting Annex 1 — Personnel Licensing requirements
in relation to:
 age;
 medical fitness19;
 knowledge (identified through training content and successful completion of examinations);
19
The Manual of Civil Aviation Medicine (Doc 8984) and Manual on Prevention of Problematic Use of Substances in the Aviation
Workplace (Document 9654) are designed to assist and guide designated medical examiners, medical assessors and Licensing
Authorities in decisions relating to the medical fitness of license applicants as specified in Annex 1. The manual should also be
useful to supplement properly supervised theoretical and practical post-graduate training in aviation medicine.
 skills (demonstrated and assessed during training and at the time of testing for licensing purposes); and
 experience (i.e. hours of flight time, training course length or on-the-job training).
Each of these is understood to impact an individual’s ability to function effectively in their roles.
The medical fitness requirements (including functional and operational limitations) for licensing purposes link
directly to HP principle 1 and involve meeting:
 minimum physical health requirements, e.g., absence of specified conditions or compliance with specified
criteria relating to vision, colour perception, hearing, and cardiovascular, respiratory and other systems of
the body; and
 minimum mental health requirements, e.g., absence of specified conditions or compliance with specified
criteria relating to psychological conditions or mental illness such as anxiety or depression.
Physical and mental health requirements can also apply to revoking or suspending licenses where an individual’s
altered health status may have adverse safety consequences. This includes when individuals receive or refuse
treatments for specified conditions or are taking specified drugs, whether prescribed or taken recreationally.
The knowledge and skill requirements for licensing and rating purposes are associated with identified training
requirements for topics to be trained and examined, and the necessary training outcomes (i.e. operational functions
to be successfully demonstrated). As such, training requirements are key to the licensing and rating process.
However, not all training required for personnel is for the purposes of initial licensing or for issuing or maintaining a
rating. Other Annexes to the Chicago Convention also identify training requirements related to specific areas and for
ensuring proficiency and maintaining currency of both licence holders and other specified personnel, including:
 recurrent training requirements as per Annex 6, Part I;
 upset prevention and recovery training requirements for pilots as per Annex 6, Part I;
 initial and recurrent training requirements for dangerous goods as per Annex 18;
 initial and recurrent training requirements for designees as per Annex 1 (e.g., medical examiners and
assessors, pilot examiners, maintenance inspectors); and
 security training requirements for flight and cabin crew as per Annex 17.
Other training requirements are part of a service provider’s management systems obligations (see 2.3.2 b)) and
relate to organizational processes, individual responsibilities and expected safety behaviours. These include:
 fatigue management training requirements as per Annex 6, Parts I and III and Annex 11; and
 training requirements to meet SMS obligations as per Annex 19.
While some of these training requirements must be met by service providers, some training (i.e. that related to the
requirements of Annex 1) can only be delivered by an approved training organization (ATO). Such training requires
approval and oversight by the State-designated Licensing Authority. While dedicated ATOs typically concentrate on
providing initial licensing or specialist training, a service provider (e.g., aircraft operator, air traffic service provider,
maintenance organization) that is also an ATO is able to provide a range of training, including that related to:
 ratings and other authorizations;
 ensuring proficiency and maintaining currency of both licence holders and other specified personnel; and
 training to meet its safety management responsibilities (e.g., SMS or FRMS).
In accordance with the Chicago Convention, where training is specified, there is an obligation to ensure that the
training provided is suitable and sufficient to prepare people for the role they will be assuming. To ensure that
training is fit for purpose, the following sections focus on HP considerations associated with evaluating:
 training programmes;
 personnel assessment processes; and
 use of training aids, devices and simulators.
a) Training programmes
Because all training is inherently related to HP, the evaluation of the design and delivery of training programmes
should be particularly sensitive to the HP Principles (see text box below).
It is common in various parts of the aviation industry to talk about “human factors training” when referring to specific
training topics such as threat and error management (TEM) and crew or team resource management (CRM/TRM)
(see text box below). In regard to licensing or otherwise authorizing pilots, air traffic controllers and aircraft
maintenance personnel, Annex 1 specifies “human performance” training requirements in the form of “knowledge
about” TEM principles and the demonstrated ability to manage threats and errors when performing their operational
functions. The TEM framework assists in understanding the relationship between safety and HP in dynamic and
challenging operational contexts. While not the only HP-related elements of any training programme, both TEM and
CRM/TRM are widely accepted as key elements, and national regulations may specify such training requirements for
a range of aviation professionals (see text box below).
TEM AND CRM/TRM
TEM training focuses on recognizing and preventing or mitigating threats (including those associated with
human limitations and capabilities) and errors that can result in an “undesired state”. It incorporates the use
of skills that are sometimes trained as part of CRM/TRM to ensure individuals can function effectively as team
members. Both TEM and CRM/TRM training programmes focus on key components of HP, including:
• workload management;
• situation awareness;
• problem-solving and decision making;
• communication; and
• leadership and teamwork.
While CRM is the term used among flight and cabin crew, TRM is the term used within the air traffic
environment. Other professional groups have chosen to adapt these programmes for their own purposes, e.g.,
maintenance resource management (MRM) for aviation maintenance personnel; dispatch resource
management (DRM) for dispatchers; and multi crew resource management (MCRM) for flight crews and cabin
crews, flight crews and controllers, or controllers and ground crews. It has also been adapted for single-pilot
operations (SPRM/SP-CRM).
Rather than be limited to TEM or CRM/TRM training, the ability to manage risks in operational conditions can also
be understood in a broad sense to be the intent of all “HF training”, including that related to SMS and fatigue
management. In this broad sense, TEM is not limited to demonstrating
standard operational responses to a specific list of events and errors seen
in the flight deck or ATS units. It extends to the ability of any person
working in the aviation industry to identify risks and hazards and respond All training is inherently related to
adaptively to any actual or potential risks that may be present prior to, HP. “HF training” is directed at
during or after every day operational activities. This includes people’s preventing and managing risks in
ability to identify hazards and assess risks associated with their own dynamic operational contexts. “HF
capabilities and limitations, and those of others, and being able to training” therefore has relevance,
anticipate and avoid even minor hazards so that safety is enhanced. It
not just for meeting technical
follows that, for the purposes of safety management, a service provider’s
training requirements, but for
training should also address associated organizational processes and
individual responsibilities, and opportunities provided for learning and meeting organizational safety
sharing lessons from experiences within the organization (see 2.4.5 - management responsibilities.
Training).
The evaluation of aviation training programmes with licensing or any

other aviation personnel authorization as outcomes should focus on finding evidence that the training aims for the
student:
 to have an understanding of:
— how they are expected to contribute to system performance in their role; and
— the operational implications of the HP principles in performing their day-to-day duties; and
 to demonstrate that they can use this knowledge to monitor and adjust their own behaviour to improve
operational outcomes.
Training supports human performance by preparing people for their jobs, keeping their knowledge and skills current,
building motivation and further knowledge and skills for career development. Aside from evaluating its content,
other HP-related aspects a regulator should consider when evaluating an organization’s training programme include:
 availability and quality of training facilities and tools. Training should be conducted in environments
designed to optimize knowledge and skill acquisition through a variety of learning approaches, including
cognitive rehearsals, simulations and real-world scenarios;
 whether provisions are made for different students’ learning rates and varying conditions;
 whether the training allows the application of knowledge and skills, including those related to risk
management, to be practised and critiqued under real operational conditions;
 whether the training is focused on learning and building expertise, rather than on rote memorization of
facts, rules or procedures;
 whether the training explains the rationale for procedures and clarifies people’s responsibilities in ensuring
they continue to reflect best practice based on lessons learned;
 whether HP considerations are incorporated in the feedback to students (e.g., did the trainee demonstrate
self-awareness of limitations and capabilities and a recognition of system risks? Did the trainee make
adjustments to optimize their own performance during a training operation, based on the mission
objectives and their observations?);
 whether the training programme allows students to reflect on their own performance, e.g., training records
contain provisions for student self-evaluation;
 whether instructors are able to adapt their conduct according to the situation, setting, and the needs of the
student;
 whether the training programme is regularly reviewed to confirm continued relevance to the dynamic
operational environment (including the use of operational data to evaluate and improve the training)20; and
 whether the training continues across an individual’s career and is tailored to his/her learning needs, role
and level of experience.
20
The Evidence-based Training (EBT) philosophy is a good example of a means to ensure training remains relevant. EBT is
intended as a means for assessing and training key areas of flight crew performance in a recurrent training system, according to
Annex 6, Part I, 9.3, Flight crew member training programmes, and 9.4.4, Pilot proficiency checks. Additional guidance on EBT is
available in PANS-TRG (Doc 9868), Part II, Chapter 2, as well as in the Manual of Evidence-based Training (Doc 9995).
IMPLICATIONS BOX 6
So how are the HP principles relevant when evaluating training for the
purposes of licensing or otherwise authorizing aviation personnel?
The evaluation of the design and delivery of training programmes should be

particularly sensitive to the HP principles, regardless of whether the training has a
licensing or other authorization (including ratings, currency and proficiency checks) as
the outcome. From an HP perspective, when evaluating such training, the relevant
State authority (whether the Licensing Authority or the regulator) should strive to
ensure that the training:
 takes into account the capabilities and limitations of the trainees; that it optimizes knowledge and skill
acquisition in the learning environment, as well as retrieval and use in the operational environment.
The training should also provide tools for and promote people’s awareness of their performance
variability, capabilities, limitations and biases so that they can optimize their fitness for duty* and
adapt their behaviours in order to take timely preventative actions and adopt suitable mitigations in
the workplace (HPP 1);
 supports and promotes people’s understanding of how they are influenced by different factors that
may limit and bias how they make sense of the world. Training should also provide skills and tools so
people can mitigate the negative effects of these factors, and understand and apply alternative
perspectives (HPP 2);
 enables people to acquire, integrate and maintain the right knowledge, skills and attitudes required to
perform well in the actual operational environment, including in unexpected situations (HPP 3);
 supports and promotes the development of people’s abilities to assess and analyse risks, and to make
decisions in situations that require trade-offs between conflicting goals (HPP 4); and
 supports and promotes people in acquiring the understanding and means for effective
communication, coordination and leadership required for optimal performance in human-human and
human-machine interaction (HPP 5).
In summary, in evaluating content of training for the purposes of licensing or otherwise authorizing aviation
personnel, a State authority should look for evidence that the training of any task includes the application of
strategies to anticipate and manage the varying influences on human performance (whether as an individual
or as a part of a group) that may occur when performing that task within the dynamic work environment.
*See also Section 2.4.1 - Safety reporting systems and the ICAO Document Fitness to Fly: A Medical Guide for
Pilots (2018).
For detailed information on the conduct of training, refer to:
 Procedures for Air Navigation Services - Training (Doc 9868).
 Manual of Procedures for Establishment and Management of a State’s Licensing System (Doc 9379).
 Human Factors Training Manual (Doc 9683).
b) Personnel assessment processes
Aviation regulatory authorities also have oversight responsibilities to ensure that the way in which an individual’s
performance is assessed is reliable, consistent and suitable, regardless of whether these assessments are done by
the regulator or are delegated to authorized persons.
While course instructors undertake ongoing assessments of all their students during training, assessments of the
performance of those applying for a licence or rating are undertaken by examiners who are either employed by the
regulator or who are designated industry personnel. In accepting or approving assessment processes, a regulator
should look for evidence that HP considerations are incorporated in:
 the testing and checking plans, e.g.:
— test plans provide opportunities for the applicant to be challenged sufficiently and be required to
demonstrate effective risk management skills in normal as well as in abnormal or unexpected
operational conditions.
 how the assessments or tests and checks are conducted, e.g.:
— the instructor or examiner demonstrates awareness of how their interpersonal skills affect the
applicant’s performance;
— the instructor or examiner is aware of potential biases and makes correct and consistent
assessments; and
— the instructor or examiner incorporates an HP perspective (e.g., management of workload,

communication, risk assessment, and consideration of trade offs) in the feedback to the applicant.
Besides the HP implications for evaluating the assessment process of individual applicants, there are also HP
implications for evaluating the assessment process of the training program itself:
 whether there is ongoing assessment of the performance of the training programme, e.g.:
— records are used by the organization to review and modify the training programme based on
evidence, such as altering the training content to address the aviation industry’s or particular
organization’s identified risks associated with HP.
 how the outcome of tests and checks is fed back to the training organization for continuous improvement
purposes, e.g.:
— deficiencies identified during tests and checks become training topics. Strengths are also
recognized, and the associated training approaches are used to improve areas with weaker
performance; and
— data on HP issues in daily operation is used to determine training needs and to create realistic
scenarios to be used in training.
c) Simulators, training aids and devices
Simulators, training aids and devices are used extensively in training and assessments of all types of aviation
professionals. How they are used depends heavily on the device’s design and that of the training programme or
assessment activity. Because of the broad possible uses of these devices, aviation regulatory authorities have
oversight responsibilities to ensure that there is a proper match between the device’s capabilities and its intended
purpose. In the case of flight simulation training devices (FSTDs), formal approval is required.
In evaluating simulators, training aids and devices and their use21, HP considerations for regulators include:
 Is the capability of the simulator, training aid or device aligned to the training objectives?
— e.g., if the training objective is to demonstrate mastery of a procedural flow, is a part-task
procedure trainer sufficient or is a full simulator needed?
 Is the support for the use of the simulator, training aid, or device developed and updated?
— e.g., are instructor training and documented guidance on implementation, maintenance and
technology support included?
 How successful is the transfer of learning to work situations using the simulator, training aid or device?
— e.g., operational assessments are done during and after training to confirm that the opportunities
for negative training are minimized and the opportunities for positive training are maximized when
training and assessments are conducted using the device.
Regulators need to be aware that final assessment of these devices requires a high level of experience from the
assessor, which can be difficult for some States to achieve. In order to prevent inconsistent levels of assessment, it
may be possible to contract a more experienced State to provide the assessment.
21
The Manual of Criteria for the Qualification of Flight Simulation Training Devices (Doc 9625) provides technical criteria for
establishing the simulation fidelity levels required to support training tasks for various pilot licences, qualifications, ratings and
type training requirements.
2.4 PROVIDING ONGOING SURVEILLANCE
Each State has the responsibility to verify that organizations continue to meet the established requirements and
function at the level of competency and safety required. This is part of its SSP obligations regarding State safety
assurance (Figure 2-1, Component 3). This is achieved through a State’s surveillance activities, including the
monitoring of safety performance indicators.
Section 2.3 describes the HP considerations for the initial approval of anything - regardless of whether it is equipment
(2.3.1), an organization or its management systems, processes and procedures (2.3.2), a training programme or an
individual for licensing purposes (2.3.3). However, once approved, all of these aspects are subject to ongoing
surveillance to ensure that they continue to comply with established requirements and are “fit for purpose” (e.g., an
aircraft maintains its airworthiness, an aircraft operator maintains its operations as per its operations manuals, and
a pilot continues to be fit to fly).
To avoid missing some important HP issues, surveillance has to consider not only continued compliance with
individual regulations, but also how the combination of these regulations affects human performance within the
operational and organizational contexts.
Surveillance activities and compliance assessments often only capture a single point in time. However, HP by its very
nature, is variable and continuously changing and adapting. In undertaking surveillance activities, a regulator should
be looking for evidence that a service provider addresses HP considerations in relation to its operational context and
environment in order to maintain and improve its safety performance. A service provider would provide evidence
of such through its ongoing management of daily operations, which are normally monitored by a State as part of its
continuing surveillance of the service provider’s SMS. Both the regulated organization and the regulator need to
collect, analyse, interpret and then act on data and information that include HP issues.
To find evidence of how effectively a service provider addresses HP considerations in its day-to-day operations, a
regulator needs to focus on:
a) how the service provider and its workforce identifies HP issues;
b) how the effectiveness of any mitigations to support HP is monitored; and
c) how lessons learned and user feedback are used to maintain and improve “how things get done”.
A regulator needs to examine documentation and other evidence provided by the service provider, as well as talk to
and observe behaviours of employees at all levels in relation to areas such as:
a) safety reporting;
b) safety risk assessment;
c) safety investigations;
d) fatigue management;
e) training; and
f) management of change.
Section 2.4 further describes the type of HP-related evidence a regulator should be looking for in each of these areas.
2.4.1 SAFETY REPORTING SYSTEMS
Safety reporting is essential for a service provider to be able to identify and understand the risks associated with HP
and, where possible, to be able to develop mitigations for such risks. A regulator should assess both the safety
reporting system that a service provider established as well as the outputs of that system. From an HP perspective,
it is important that a regulator does not just focus on how many safety reports a service provider receives, but
whether the service provider has considered the variety of factors that might be influencing why and when people
in their organization report.
Safety reporting should support both mandatory and voluntarily identified safety issues. While regulators need to
check that mandatory safety reporting requirements are complied with, it is often voluntarily provided contextual
information that can most help a service provider to understand why someone acted in the way they did. Such
contextual information may include the reporting of specific operational or organizational factors, such as:
a) interactions with other aviation professionals, issues with phraseology and communication and language;
b) work conditions (e.g., level of automation, authority and responsibility, support staff);
c) environmental information (e.g., weather, remoteness, topography);
d) task specific workload (e.g., task intensity (under or over arousal), complexity of the task);
e) experience level of the reporter or those who they were working with;
f) staffing arrangements (e.g., provision to cover for sickness or other absences, authority status of staff,
isolation of staff (lone workers));
g) commercial pressures (e.g., financial motivations of a particular company may result in the erosion of safety
buffers);
h) shift-related factors that impact on fatigue (e.g., shift pattern and duration, stability of the working pattern,
use of overtime); and
i) impact of changes to working organizational structures or processes and procedures.
However, requiring such contextual information in a safety report form can deter people from reporting because it
is time consuming. Regulators should assess how service providers collect and utilize such contextual information.
For example, is the standardized report form used by the service provider designed to enable the collection of
enough information to allow the service provider to recognize when further investigation is warranted?
People will only report non-mandatory issues when they understand and trust the system being used, and when
they trust their peers and managers with the information provided. To examine whether a service provider seeks to
foster such trust and engagement, a regulator should look for evidence that the service provider:
a) has clear expectations for individuals to report risks and hazards, including when an individual considers
him/herself unfit to perform safety-critical tasks to an acceptable standard (e.g., in cases of fatigue or
mental health issues);
b) has identified the implications for individuals of submitting a report;
c) offers an option for anonymous reporting;
d) has specified how it will respond to reports and takes appropriate actions consistent with its stated policy;
e) makes it easy to report (e.g., report forms are readily available and easy to complete and submit);
f) maintains the integrity of the safety reporting system and reporter confidentiality;
g) involves operational personnel and HP specialists in reviewing contextual information provided in safety
reports and in identifying appropriate mitigations; and
h) provides timely feedback to the workforce on changes made in response to issues or hazards identified
through its safety reporting system.
For more information about service providers’ safety reporting systems, refer to the Safety Management Manual
(Doc 9859).
2.4.2 SAFETY RISK ASSESSMENT
Safety is all about the management of risk. HP considerations are central to risk assessment. What’s more, risks
change over time. Just as the service provider’s process of safety risk assessment must be continuous, so does the
regulator’s surveillance of such processes. To assess that a service provider’s safety risk assessment processes
include HP-related issues, a regulator can observe whether:
a) HP expertise is used appropriately in the organization’s safety risk assessments;
b) the service provider uses credible sources of validated HP information to support its risk assessment;
c) the service provider collects and analyses data from its own operations to support its safety risk assessment;
d) a range of operational conditions and human operator performance variability is considered in assessing
the safety risk;
e) safety risk assessment matrices/frameworks used are

suitable for HP assessment. Assessing the risks associated
with human performance is complex, and the Assessing the risks associated with HP
methodology used to assess these risks should reflect this is more complex than the risks
complexity;
associated with technology because
f) the rationale for assigning likelihood and severity values
is defensible and is consistently applied. (Currently, there HP is highly variable, with a wide
is no universally accepted, validated method to assign range of interacting influences
numeric values to the probability of declines in human internal and external to the individual.
performance); and
g) a range of mitigations to support HP is identified,
Many of the effects of the interaction
documented and implemented (e.g., assumed levels of between these influences are difficult
proficiency, implementation of scheduling rules, or impossible to predict. The
provision of checklists).
consequences of variable HP will differ
according to the task being performed
and the context.
For more information about service providers’ safety risk assessment, refer to the Safety Management Manual
(Doc 9859).
2.4.3 SAFETY INVESTIGATIONS
Section 2.1 focuses on the regulator’s collection and analysis of data to examine HP issues. In contrast, this section
focuses on the regulator’s role in assessing how well HP aspects have been considered in internal safety
investigations conducted by service providers. Such investigations include both those undertaken through the
analysis of their safety data as well as through investigations of their own safety occurrences.
While a lot of data may be collected by a service provider, analysing

it to identify HP-related risks requires an understanding of the
operational implications of the HP principles. Similarly, an Reliance on training as the only
understanding of the operational implications of the HP principles is
mitigation should be challenged
also key to learning from safety occurrences and putting in place
effective mitigations. Using the retraining of an individual as a when changes in processes and
standard response to all safety occurrences (effectively identifying equipment may be a more robust
the individual as “the problem”) does not reflect an understanding of barrier in supporting HP.
the operational implications of the HP principles and does little to
address systemic issues.
In providing surveillance, regulatory inspectors and auditors should look for evidence of the inclusion of HP
considerations in safety data analysis and investigations, such as:
a) investigators and analysts are trained to have at least a basic understanding of HP and the terminology
being used, and know when and where to seek further guidance. If an assessment taxonomy is used, it
should include HP categories which are understood by the analysts and investigators and that are used
consistently;
b) investigators and analysts recognize that identifying an event simply as human error offers little insight.
To gain further insight, analysis of safety occurrences includes an in-depth evaluation that requires a
thorough understanding of the context;
c) investigation reports contain an assessment of the HP issues and data relating to factors affecting HP,
e.g., experience levels, time of day, light levels, environmental conditions;
d) analysts and investigators coordinate regularly to ensure that they are investigating, coding and
analysing their data consistently; and
e) broad systemic issues are also considered in the investigations and analyses, e.g., monitoring working
time, sick leave and staff retention to understand pressures on individuals.
For more information about safety investigations, refer to Doc 9859 the Safety Management Manual (Doc 9859).
2.4.4 FATIGUE MANAGEMENT
Fatigue is recognized as a specific safety issue for which aviation regulatory authorities have oversight responsibility
for a number of different aviation professionals. ICAO SARPs (Annex 6 Part I, Annex 6 Part III (Section II) and Annex 11)
require that regulations be established based upon scientific principles for the purpose of managing fatigue. These
basic principles relate to:
a) the need for sleep;
b) sleep loss and recovery;
c) circadian effects on sleep and performance; and
d) the influence of workload.
In providing surveillance, a regulator should look for evidence that a service provider adapts its scheduling practices
based on:
a) how the organization identifies, assesses, monitors and controls its specific fatigue risks; and
b) whether the organization has and uses a process for the voluntary reporting of fatigue issues.
Further, where there are specific fatigue management regulations for certain groups of aviation professionals, the
organization must demonstrate how they comply with those requirements, including:
a) provision of adequate opportunities for sleep;

b) limiting extended periods of being awake;
c) addressing circadian factors;
d) management of workload, which could vary based on the operational context;
e) stability of schedules; and
f) methods for managing on-the-day operational disruptions.
For detailed information on fatigue management approaches and oversight, refer to Doc 9966 (Manual for the
Oversight of Fatigue Management Approaches).
2.4.5 TRAINING ACTIVITIES
After initial approval of training programmes (see 2.3.3), ongoing surveillance of training activities, whether
undertaken by an ATO or a service provider, is necessary as a means of confirming that the training continues to
meet its objectives. While recognizing the need for ongoing surveillance of training programmes which have licensing
and other authorizations for aviation personnel as outcomes, this section focuses on the ongoing surveillance of
training activities a service provider undertakes as part of its safety management responsibilities.
To support HP, a service provider’s training activities need to address organizational processes and individual
responsibilities, and enable learning and sharing lessons from experiences within the organization. How they do so
is a reflection of the service providers’ safety culture. When providing ongoing surveillance of “organizational
training”, regulators should look for evidence that a service provider’s training programme:
a) remains current and relevant, addressing changing needs as identified within specific organizational and
operational areas of risk;
b) is tailored to address the HP challenges of the specific workgroup and work environment;
c) develops understanding of HP to improve its workforce’s ability to identify and report HP-related risks and
hazards, including those that affect an individual’s ability to perform safety critical functions; and
d) includes a method for monitoring the training programme’s effectiveness (e.g., sampling day-to-day
behaviours demonstrated by its staff, examining whether safety reports include feedback on HP issues, etc).
Hence, the regulator should look for evidence that the service provider trains its people to understand the
operational implications of the HP principles (see 1.4) in performing their day-to-day duties, and that the people are
able to use this knowledge to monitor and adjust their own behaviour in order to take preventative or early
corrective actions to address hazards as part of their daily functions.
For more information on supporting HP through safety management-related training, refer to the Safety
Management Manual) (Doc 9859) and the Manual for the Oversight of Fatigue Management Approaches (Doc 9966).
2.4.6 MANAGEMENT OF CHANGE
Each State has the responsibility to ensure that organizations identify

changes which may affect the level of safety risk associated with its
aviation products or services. Such changes include changes to an When an organization makes
organization’s business model, their employment practices, key significant changes to its business
personnel, work practices, or the introduction of new technologies. The
potential hazards associated with these changes need to be identified
practices, such as a change to its
and the risks associated with the potential consequences need to be working or employment
managed. practices, the implications for HP
Altering or introducing any new system, piece of equipment, process, should be the focus of
procedure or approach to work results in changes to what people are performance monitoring.
expected to do. When relevant and required by the regulator, the
organization should present the regulator with notification of a planned
change. However, the regulator needs more information than just a
notification of a planned change to determine whether a service provider’s implementation planning has adequately
taken HP considerations into account. A regulator needs to consider whether the service provider’s plan for change
has:
a) identified what is being changed (whether it is a system, a piece of equipment or a process);
b) considered the risks associated with making the change in terms of the overall system (e.g., the potential
effects of a planned change may extend to people in different parts of the organization, to other
organizations or to the environment);
c) identified who will be impacted by the change both directly and indirectly, and in what ways they will be
affected; and
d) a process to help ensure successful implementation. HP aspects of a change management process include:
— if the appropriate stakeholders have been involved in the planning of the change, such as air traffic
personnel and aircraft operators;
— how leadership supports the change, such as through training resources, and positive discussions
of the rationale and benefits; and
— how those affected by the change can try it in a low-risk environment, such as through simulation,
real-time shadow operations, or actual low-workload operations to increase familiarity and user
confidence, as well as to minimize the risk of unintended consequences.
To assess whether an organization has adequately addressed the particular HP challenges associated with
implementing the proposed change, the regulator may seek answers to the questions below22. How these are to be
managed should be explained in the service provider’s change management plan.
Does the change alter the tasks of a user or affected others? If yes:
 How does it change the task itself?

 How does the change affect other tasks the user or affected others have to perform?
 Does the change alter roles and responsibilities for the users or affected others?
 Do the new tasks/roles require new knowledge or skill?
 Does the change alter the user’s work environment?
 What happens if the user does not perform the task exactly as expected, or performs the task late?
Does the change imply processing of new information by the user23? If yes:
 How (when and in what format) should this new information be presented?
 How does it relate to other information?
 Does using the information require new knowledge or skill?
Does the change imply the use of new equipment? If yes:
 How does the use of the equipment fit into the user’s workflow?
 What level of performance is the user expected to achieve using this new equipment?
 What happens when the expected level of user performance is not maintained?
 What happens when the equipment malfunctions?
 Does the use of this new equipment require new knowledge or skill?
Does the change involve automation? If yes:
 Does the automation change the task the user needs to perform?
 How does the user know what the automation is doing?
 What is the user’s role in managing normal and abnormal conditions?
 Does the user require new knowledge or skill to operate effectively? (see also 2.3)
Does the change take place in parallel with other changes? If yes:
 Has the change implementer explicitly considered the effect of “layered” changes with regard to the current
operation, as well as with regard to each individual change?
 Is there time planned to allow staff to get comfortable with one change before having to cope with another
change? or
 Are there mitigations aimed at the risk associated with the cumulative effect of simultaneous
changes (e.g., simulation training in a single change vs training with all integrated changes incorporated)?
22
Many of the same questions are used in the iterative development process for new ASBU modules as part of the Global Air
Navigation Plan (Doc 10004).
23
“Processing new information” includes the user having to look at new locations to retrieve familiar information.
Once in place, any change needs to be monitored to provide assurance that it is performing as expected, that there
are no negative unintended consequences, and that the impact on HP is being managed in such a way that the
change supports HP in actual operation.
For more information about assessing service providers’ change management processes, refer to the Safety
Management Manual (Doc 9859).
2.5 PROMOTING SAFETY
ICAO Assembly Resolution A40-4 calls on all Member States to “ensure the integration of human performance
considerations … as part of a safety management approach.” A safety management approach and Component 4 of
the SSP (Figure 2-1) call for the promotion of safety.
The SSP recognizes the need for promoting safety to personnel within the regulatory authority and also the need for
safety promotion by the regulator targeting all aviation organizations. Outside of Annex 19, ICAO has other specific
requirements for safety promotion activities. For example, Annex 1 (para 1.2.4.3) specifically requires the regulator
(Licensing Authority) to implement appropriate aviation-related health promotion for licence holders subject to a
medical assessment to reduce future medical risks to flight safety.
Given that the people in the system create safety, either directly through
their actions or indirectly through their designs, the promotion of HP
considerations is key to the promotion of safety. Understanding human Consider identifying examples
performance, the way people meet the challenges of the aviation system,
of desired behaviours as well
and why they perform in the ways they do is critical to the promotion of
safety. It is important that people not only understand that the HP as undesired behaviours when
principles apply to themselves and to everybody else and but also that developing safety promotional
being aware of the consequences of the HP principles does not make a
approaches and materials.
person immune to them. Because safety promotion deliverables are
aimed at people, the development and deployment of such materials
should follow the HCD process (see 1.2.1.b). To further support people
in doing the right thing as part of their promotional activities, regulators should encourage the sharing of HP-
related information across organizations and across States.
A parting thought…..
Institutionalizing the consideration of HP, whether within a regulatory authority or within aviation organizations,
requires the adoption of systems thinking and the understanding of HP considerations, including the HP principles.
Such institutionalization is enabled through leadership from senior managers who understand and communicate the
critical significance of human performance.
APPENDIX A REFERENCES
ICAO MANUALS AND DOCUMENTS
The ICAO manuals and documents referenced in the body of this document are listed below. They are available
through the ICAO portal (restricted access to Member States) or through the ICAO Store at: https://store.icao.int/ .
Where free access is available, the web link is provided.
Airworthiness Manual (Doc 9760)

Fitness to Fly: A Medical Guide for Pilots (2018) at: https://www.unitingaviation.com/fitnesstofly/
Global Aviation Safety Plan (Doc 10004) at: www.icao.int/gasp
Global Air Navigation Plan at: https://www.icao.int/airnavigation/Pages/GANP-Resources.aspx
Global Air Navigation Plan Portal at: https://www4.icao.int/ganpportal/
Human Factors Training Manual (Doc 9683)

Manual for the Oversight of Fatigue Management Approaches (Doc 9966) at:
https://www.unitingaviation.com/publications/9966-EN/#page=1
Manual of Aircraft Accident and Incident Investigation (Doc 9756)
Manual of Criteria for the Qualification of Flight Simulation Training Devices (Doc 9625)
Manual on the Approval of Training Organizations (Doc 9841)
Manual on Certification of Aerodromes (Doc 9774)
Manual of Civil Aviation Medicine (Doc 8984) at:
https://www.icao.int/publications/Documents/8984_cons_en.pdf#search=Manual%20of%20Civil%20Av
iation%20Medicine
Manual of Evidence-based Training (Doc 9995)
Manual on Prevention of Problematic Use of Substances in the Aviation Workplace (Doc 9654)
Manual of Procedures for Operations Inspection, Certification and Continued Surveillance (Doc 8335)
Manual on Remotely Piloted Aircraft Systems (RPAS) (Doc 10019)
Procedures for Air Navigation Services – Aircraft Operations (Doc 8168)
Procedures for Air Navigation Services – Air Traffic Management (Doc 4444)
Procedures for Air Navigation Services – Training (Doc 9868)
Quality Assurance Manual for Flight Procedure Design (Doc 9906)
Safety Management Manual (SMM) (Doc 9859) – free e-book version and practical examples available on
the Safety Management Implementation website at: www.icao.int/SMI

This manual is a freely available electronic document downloadable from the website above. An official print version of the
electronic document is also available for minimal cost at: https://store.icao.int/.
A-1
A-2 Human Performance (HP) Manual for Regulators
OTHER REFERENCES
Other documents referenced in the body of this document are listed below.
Human Factors and Ergonomics Society, 2008 at: https://www.hfes.org/resources/educational-and-

professional-resources/new-item
ISO 9241-210: 2010, Ergonomics of Human-System Interaction – Part 201: Human-Centred Design for
Interactive Systems (First Edition) at: https://www.iso.org/standard/52075.html
Billings, C. E. (1997) Aviation automation: The search for a human-centered approach. Mahwah, NJ:
Lawrence Erlbaum Associates, Inc.
APPENDIX B HP WEB LINKS
The links below provide access to further information on various HP topics. These are widely available and include
materials published by ICAO and various regulatory authorities. The references listed in this appendix does not infer
endorsement and exclusion does not infer the opposite; they represent only a small subset of the numerous HP
reference materials available and are subject to change.
GENERAL HP
a) Civil Aviation Authorities
EASA – Domains
Domains | EASA (europa.eu)
Transport Canada – Human Factors

Human Factors - Brochure (canada.ca)
UK CAA – Human Factors

Human factors | UK Civil Aviation Authority (caa.co.uk)
Federal Aviation Administration – Human Factors

FAA Human Factors Division
Human Factors in Aviation Safety (AVS) (faa.gov)
Australian Government CASA – Human Factors

Human factors | Civil Aviation Safety Authority (casa.gov.au)
b) Other
 Global Aviation Safety Network (GAIN) - Flight Safety Foundation

 Toolkits & Resources - Flight Safety Foundation
 Skybrary: Operational Issues: Portal: Operational Issues - SKYbrary Aviation Safety
 NASA Human Systems Integration Division: Human Systems Integration Division @ NASA Ames -
Publications
B-1
B-2 Human Performance (HP) Manual for Regulators
DESIGN
a) Airspace Design and Flight Procedures Development
 EUROCONTROL Manual for Airspace Planning Volume 2 - Common Guidelines: Microsoft Word - 2nd
Eurocontrol APM V2_Ed-2_Released Issue_22-10-03.doc (icao.int)
 EUROCONTROL Level Bust Toolkit: Level Bust - SKYbrary Aviation Safety
b) Checklists
 CAP 676 Guidelines for the Design and Presentation of Emergency and Abnormal Checklists, UK CAA, August
2006: CAP 676: Guidelines for the Design and Presentation of Emergency and Abnormal Checklist
(caa.co.uk)
 CAP 708 Guidance on the Design and Presentation of Electronic Checklists, UK CAA, March 2005: CAP 708:
Guidance on the Design, Presentation and Use of Electronic Checklists (caa.co.uk)
 Human Performance Considerations in the Use and Design of Aircraft Checklists, FAA, Jan 1995: Microsoft
Word - SE21_Output3_FAA Checklist Report.doc (skybrary.aero)
 HF of Flight-Deck Checklists: The Normal Checklist, A Degani, E Wiener, NASA Report 177549, May 1990:
Human Factors of Flight-Deck Checklists: The Normal Checklist (nasa.gov)
 EASA Research Project.2013.01 Checklist Memory Items: Checklist Memory Items (e uropa.eu)
 NASA – Designing Flightdeck Procedures. 2016: Barshi_Procedure_Checklist_Design_NASA_TM_2016.pdf
 NASA – Designing Flightdeck Procedures: Literature Resources. 2017: NASA Technical Reports Server
(NTRS)
c) Other
 Guidelines for Auditory Warning Systems on Civil Aircraft, CAA Paper 82017, UK CAA, Nov 1982: Guidelines
for Auditory Warning Systems on Civil Aircraft. | National Technical Reports Library - NTIS
 Human Factors Considerations in the Design and Evaluation of Flight Deck Displays and Controls: Version
2.0. FAA & Volpe Dec 2016: Welcome to ROSA P | (bts.gov)
 Operational Use of Flight Path Management Systems: Final Report of the Performance-based operations
Aviation Rulemaking Committee/Commercial Aviation Safety Team Flight Deck Automation Working Group,
Sept 2013: Human Factors in Aviation Safety (AVS) (faa.gov)
HP Web Links B-3
SAFETY MANAGEMENT SYSTEMS (SMS)
 ICAO Safety Management Implementation website: Safety Management Implementation - Overview

(unitingaviation.com)
 EASA Management System Assessment Tool, providing a common approach to management system
assessment and continuous improvement of SMS: Management System Assessment Tool | EASA
(europa.eu)
 CAP 795 CAA Safety Management Systems Guidance Material, UK CAA 2015: CAP 795: Safety Management
Systems - Guidance to Organisations (caa.co.uk)
 EASA practical guide Management of Hazards Related to New Business Models of Commercial Air Transport
Operators: Management of hazards related to new business models of commercial air transport operators |
EASA (europa.eu)
FATIGUE MANAGEMENT
 ICAO Fatigue Management website: Fatigue Management (icao.int)

 CASA Fatigue management website: Fatigue management | Civil Aviation Safety Authority (casa.gov.au)
 Transport Canada. Fatigue risk management system toolbox for Canadian aviation: Fatigue risk management
system toolbox for Canadian aviation (canada.ca)
 FAA Fatigue Risk Management website: Fatigue Risk Management (faa.gov)
AVIATION MEDICINE
 EASA guidance on use of medication in the aviation environment: Use of Medication in the Aviation
Environment | EASA (europa.eu)
 EASA guidance for Aeromedical Examiners: AME Working Relations | EASA (europa.eu)
TRAINING
 Teaching and assessing non-technical skills for single-pilot operations, Advisory Circular 61-08, Civil Aviation
Safety Authority of Australia: AC 61-08 v1.0 - Teaching and assessing non-technical skills for single-pilot
operations (casa.gov.au)
 Flight Examiner Handbook (2018), Civil Aviation Safety Authority of Australia: Flight Examiner Handbook
(casa.gov.au)
 EASA CRM Training implementation, sharing recommended practices and information on CRM: Helicopter
Flight Instructor Guide | EASA (europa.eu)
 European Helicopter Safety Team Helicopter Flight Instructor Guide: Helicopter Flight Instructor Guide | EASA
(europa.eu)
B-4 Human Performance (HP) Manual for Regulators
ACCIDENT ANALYSIS
 EASA Annual Safety Reviews, published annually since 200524: General publications | EASA (europa.eu)
 EASA Annual Safety Recommendations Review, published annually since 2007: General publications | EASA
(europa.eu)
OPERATIONAL PERSONNEL
a) Air Traffic Controllers
 Human Factors Design Standard (DOT/FAA/HF-STD-001B). FAA, 2016: FAA Human Factors (ANG-E25)
2016-12-human-factors-design-standard
 CANSO Human Performance Standards of Excellence. CANSO Standard of Excellence in Human
Performance Management | CANSO
 ATM Automation: Guidance on human-technology integration CAP1377 2016 Civil Aviation Authority: CAP
1377 final Mar 2016.pdf (caa.co.uk)
b) Pilots
 Operator’s Flight Safety Handbook, GAIN, 2000: Global Aviation Safety Network (GAIN) - Flight Safety
Foundation
 Propulsion System Malfunction and Inappropriate Crew Response, Flight Safety Digest Nov-Dec 1999, Flight
Safety Foundation: Flight Safety Digest November-December 1999
 Safety behaviours human factors: Resource guide for pilots (2nd Edition) 2019: Safety behaviours: human
factors for pilots 2nd edition | Civil Aviation Safety Authority (casa.gov.au)
c) Maintenance Personnel
 FAA Human Factors in Aviation Maintenance: Human Factors in Aviation Maintenance (faa.gov)
 Safety Behaviours – Human Factors Resource Guide for Engineers, Civil Aviation Safety Authority of
Australia, 2019: Safety Behaviours: Human Factors for Engineers resource kit | Civil Aviation Safety
Authority (casa.gov.au)
 Aviation Maintenance Human Factors (EASA-145). Civil Aviation Authority of United Kingdom, Dec 2003:
CAP 716: Aviation Maintenance Human Factors (EASA Part-145) (caa.co.uk)
d) Cabin Crew
 Cabin Safety Compendium, GAIN, 2001: Cabin Safety Compendium (flightsafety.org)
24Note that every EASA Member State is required to publish a safety review, at least annually, to inform the public about levels
of aviation safety. These reviews should be available at national level on the website of either the national aviation authority or
the safety investigation authority.

Icao 10151 Human Performance Manual Jun 2021

Uploaded by

Copyright:

Available Formats

Icao 10151 Human Performance Manual Jun 2021

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Icao 10151 Human Performance Manual Jun 2021

Uploaded by

Copyright:

Available Formats

Doc 10151

Manual on Human Performance (HP)

Approved by and published under the authority of the Secretary General

INTERNATIONAL CIVIL AVIATION ORGANIZATION

Approved by and published under the authority of the Secretary General

INTERNATIONAL CIVIL AVIATION ORGANIZATION

For ordering information and for a complete listing of sales agents

First Edition — 2021

ICAO Doc 10151, Human Performance (HP) Manual for Regulators

All rights reserved. No part of this publication may be reproduced, stored in a

Amendments are announced in the supplements to the Products

RECORD OF AMENDMENTS AND CORRIGENDA

No. Date Entered by No. Date Entered by

Appendix O: Human performance

The Assembly resolves that:

TABLE OF CONTENTS ...........................................................................................................................................v

ACRONYMS ....................................................................................................................................................... vii

Purpose of this Manual ................................................................................................................................. ix

Structure of this Manual .................................................................................................................................. x

PART 1. UNDERSTANDING HP ...................................................................................................................... 1-1

1.1 Human Performance, Human Factors or Ergonomics? ......................................................................1-2

1.2 A Human-Centred Design Process ....................................................................................................1-3

1.2.1 Examples of the use of the HCD Process ............................................................................................................... 1-7

1.3 Systems Thinking .............................................................................................................................1-9

1.4 HP Principles.................................................................................................................................. 1-11

PART 2. HP IMPLICATIONS FOR REGULATORY ACTIVITIES ............................................................................. 2-1

2.1 Collecting and Analysing Data ..........................................................................................................2-2

2.1.1 Sources and Types of Data..................................................................................................................................... 2-3

2.1.2 HP Taxonomies ...................................................................................................................................................... 2-4

2.1.3 In-Depth Analysis of a Single Occurrence .............................................................................................................. 2-6

2.1.4 Analysis of Aggregated Data .................................................................................................................................. 2-9

2.2 Developing Regulatory Material.......................................................................................................2-9

2.3 Evaluating, Accepting and Approving ............................................................................................. 2-10

2.3.1 Equipment ........................................................................................................................................................... 2-11

2.3.2 Organizations, Management Systems, Processes and Procedures ...................................................................... 2-18

2.3.3 Personnel Training and Licensing ........................................................................................................................ 2-25

2.4 Providing Ongoing Surveillance ...................................................................................................... 2-33

2.4.1 Safety Reporting Systems .................................................................................................................................... 2-34

2.4.2 Safety Risk Assessment ........................................................................................................................................ 2-35

2.4.4 Fatigue Management........................................................................................................................................... 2-37

2.4.5 Training Activities ................................................................................................................................................ 2-38

2.4.6 Management of Change ...................................................................................................................................... 2-39

2.5 Promoting Safety ........................................................................................................................... 2-41

APPENDIX A REFERENCES ........................................................................................................................... A-1

APPENDIX B HP WEB LINKS ........................................................................................................................ B-1

ASBU Aviation system block upgrades

PURPOSE OF THIS MANUAL

This manual complements the following:

 Human Factors Training Manual (Doc 9683); and

 Human Factors Guidelines for Aircraft Maintenance Manual (Doc 8824)

This manual is comprised of two parts.

Historically, thinking about the human contribution to the aviation

 human performance, human factors or ergonomics;

1.1 HUMAN PERFORMANCE, HUMAN FACTORS OR ERGONOMICS?

1.2 A HUMAN-CENTRED DESIGN PROCESS

b) users are involved throughout design and development stages;

How can understanding human-centred design help

“Design” can relate to the development of anything, whether a piece of equipment, a

 Does it imply a change in task by a user or affected others?