Shared Mental Model

The operator’s picture of what the machine is doing matches what it’s actually doing.

Asiana Airlines Flight 214 at San Francisco

July 6, 2013 · San Francisco, California

On a clear-weather approach to San Francisco, the crew of a Boeing 777 believed the autothrottle was managing their airspeed. It wasn’t. An earlier action had left it in a hold mode, where it would no longer add power on its own. The change was displayed at the top of both pilots’ main flight displays, but none of the three pilots in the cockpit recalled seeing it. The airspeed dropped steadily while the crew watched their path, and by the time they noticed, it was too late to recover. The airplane struck the seawall short of the runway; three passengers died and 49 people were seriously injured.5

Anti-pattern: Divergent Models

The crew and the airplane each had a picture of who was controlling airspeed, and the pictures didn’t match. Nothing showed them the gap until the airspeed did.

Shared Mental Model

Therefore: Make the machine’s current mode, and what that mode will and won’t do, unmistakable at the moment it matters.

Without

Approach

Airspeed

137 kt

Target 137 kt

Autothrottle

SPD

Press Play, then keep the dot on the line. The autothrottle has the speed.

With the pattern

Approach

Airspeed

137 kt

Target 137 kt

Autothrottle

SPD

Press Play, then keep the dot on the line. The autothrottle has the speed.

Each side can anticipate the other, so they share a workspace safely.

The mechanism

machine state → resync

  1. 01Machine stateMode, intent, next move
  2. 02ExternalizeDisplay, light, sound, motion cue
  3. 03Human beliefBelieved state, predicted move
  4. 04 · Key momentDetect driftBelief ≠ actual state
  5. 05ResyncCorrect, then confirm alignment

At 02: Show intent before motion: where the machine will go next, not only where it is now.

At 04: Drift is caught both ways: the machine also models what the human expects it to do.

On this page

Sources

Showing the current state is not enough on its own, because an operator working alongside a machine is always predicting its next move.3 Signal intent before the motion starts, so that prediction has something to work from.2 The sync runs both ways as well: a machine with no model of what the operator expects it to do cannot tell when that expectation has gone wrong.

  1. How in the World Did We Ever Get into That Mode? Mode Error and Awareness in Supervisory ControlNadine B. Sarter and David D. Woods · 1995Paper
  2. Ten Challenges for Making Automation a “Team Player” in Joint Human-Agent ActivityGary Klein, David D. Woods, Jeffrey M. Bradshaw, Robert R. Hoffman and Paul J. Feltovich · 2004Paper
  3. Toward a Theory of Situation Awareness in Dynamic SystemsMica R. Endsley · 1995Paper
  4. Shared Mental Models in Expert Team Decision MakingJanis A. Cannon-Bowers, Eduardo Salas and Sharolyn Converse · 1993Book
  5. Descent Below Visual Glidepath and Impact With Seawall, Asiana Airlines Flight 214, Boeing 777-200ER, HL7742, San Francisco, California, July 6, 2013National Transportation Safety Board · 2014Incident