Handbook of Human-Computer Interaction

M. Helander (ed.)
© Ehevier Science Publishers B. V. (North-Holland), 1988

Chapter 1

Cognitive Systems Engineering

D.D. Woods & E.M. Roth1 1.1 Introduction

Westinghouse Research & Development Center
Pittsburgh, Pennsylvania Why is there talk of a cognitive engineering? Most
simply put, both opportunity and need have con­
tributed. But what is cognitive engineering? What
1.1 Introduction 3 should it be? What can it do? What problems does
it confront? We will explore these questions in this
1.2 What is Cognitive Engineering 5 chapter. As with any nascent and interdisciplinary
field, there can be very different perspectives about
1.3 The Cognitive System Triad 8 what it is and how it will develop over time. You will
Demand Characteristics of Problem find other perspectives in some of the other chapters
Solving Habitats 8 in this handbook. The most complete and coherent
Mismatches in the Cognitive System expression of the possible content and scope of a field
Triad: Getting Lost 10 of cognitive engineering is Jens Rasmussen's Informa­
tion Processing and Human-Machine Interaction: An
1.4 A Sample of Critical Issues in Cognitive Approach to Cognitive Engineering. While it is only
Engineering 11 a single perspective, its comprehensive treatment of
What is Expertise and Skill 11 a large range of important issues - knowledge repre­
Exploration Training 13 sentation, cognitive analysis, human error, and aiding
Human Error and Person-Machine Mis­ problem solving - makes it the best place to begin
matches 14 to understand the field. Another single volume that
Brittle Problem Solvers and Unex­ encompasses a large amount of the territory of cogni­
pected Variability 17 tive engineering is Norman & Draper's User Centered
System Design.
1.5 Towards Effective Decision Support 18
What is Good Advice? 19 Interestingly, the same phenomenon has produced
Cognitive Tools 21 both the opportunity and the need for a cognitve engi­
Conceptualization Aids 25 neering. With the rapid advances and dramatic reduc­
tions in the cost of computational power, computers
1.6 External Representations and Human have become ubiquitous in modern life. In addition to
Problem Solving 26 traditional ofi&ce applications (e.g., word-processing;
Fixed and Adaptive Collections 27 accounting; information systems), computers increas­
Analogical Representations 29 ingly dominate a broad range of work environments
Integral Displays 30 (e.g., industrial process control; air traffic control; hos­
Multiple Representations 32 pital emergency rooms; robotic factories). The need
A Case in Representation Design . . . . 33 for a cognitive engineering occurs because the intro­
duction of computerization often radically changes the
1.7 Summary 34 work environment and the cognitive demands placed
on the worker. For example, increased automation
1.8 References 34 in process control applications has resulted in a shift
in the human role from a controller to a supervi­
1
D. D Woods is now at the Department of Industrial and Systems
sor, who monitors and manages semi-autonomous re­
Engineering, Ohio State University and E. M. Roth is at the depart­ sources. While this change reduces people's physical
ment of Engineering and Public Policy, Carnegie-Mellon University workload, mental load often increases as the human

3
4 CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
role emphasizes monitoring and compensating for fail­
ures. Thus, computerization creates a larger and larger
world of cognitive tasks to be performed. More and
more, we create or design cognitive environments.
The opportunity for a cognitive engineering arises
because computational technology also offers new
kinds and degrees of machine power that greatly ex­
pand the potential to assist and augment human cogni­
tive activities in complex problem solving worlds, e.g.,
monitoring, problem formulation, plan generation and
adaptation, fault management. This is a highly cre­
ative time where people are exploring and testing what
can be created with the new machine power - displays
with multiple windows and even "rooms" (Henderson
and Card, 1986). The new capabilities have led to
large amounts of activity on building new and more
powerful tools - how to build better performing ma­
chine problem solvers. The question that we continue
to face is how should we deploy the power available
through new capabilities for tool building to assist hu­
man performance, i.e., the problem of how to provide
intelligent, or more properly, effective decision sup­
port (IDS). The application of these tools creates new
challenges about how to "couple" human intelligence
and machine power in a single integrated system that
maximizes overall performance.
The capability to build more powerful machines
does not in itself guarantee effective performance, as
witnessed by early attempts to develop computerized
alarm systems in process control (Pope, 1978) and at­
tempts to convert paper-based procedures to a com­
puterized form (Elm & Woods, 1985). The condi­
tions under which the machine will be exercised and
the human's role in problem solving affect the qual­
ity of performance. This means that factors related
to tool usage can and should affect the very nature
of the tools to be used. This observation is not new
- in actual work contexts, performance breakdowns
have been observed repeatedly with support systems,
constructed in a variety of media and technologies in­
cluding current AI tools, when issues of tool use were
not considered (cf., Roth, Bennett & Woods, 1987).
This is the dark side: the capability to do more am­
plifies the potential magnitude of both our successes
and our failures. Careful examination of past shifts in
technology reveals that new difficulties (new types of
errors or accidents) are created when the shift in ma­
chine power has changed the entire human-machine
system in unforeseen ways (e.g., Hoogovens Report,
1976; Noble, 1984; Hirschhorn, 1984; Wiener, 1985).
The problem of providing effective decision sup­
port will hinge on how the designer decides what
will be useful in a particular application, that is, a
problem-driven, rather than a technology-driven, ap­
proach where the requirements and bottlenecks in cog­
nitive task performance drive the development of tools
to support the human problem solver. Can researchers
provide designers with concepts and techniques to de­
termine what will be useful or are we condemned to
simply build what can be built practically and wait
for the judgement of experience? Is principle-driven
design possible?
While our ability to build more powerful machine
cognitive systems has grown and promulgated rapidly,
our ability to understand how to use these capabili­
ties has not kept pace. Today we can describe cog­
nitive tools in terms of the tool building technologies
(e.g., tiled or overlapping windows). The impediment
to systematic provision of effective decision support
is the lack of an adequate cognitive language of de­
scription (Rasmussen, 1986a; Clancey, 1985). What
are the cognitive implications of some application's
task demands and of the aids and interfaces avail­
able to the people in that domain? How do people
behave/perform in the cognitive situations defined by
these demands and tools? Because this independent
cognitive description has been missing, an uneasy mix­
ture of other types of description of a complex situation
has been substituted - descriptions in terms of the ap­
plication itself (e.g., internal medicine or power plant
thermodynamics), descriptions in terms of the imple­
mentation technology of the interfaces/aids, descrip­
tions in terms of the user's physical activities or user
psychometrics. This view of cognitive technology as
complementary to computational technology is in stark
contrast to another view which defines the former as
the handmaiden of the latter - acquiring the knowl­
edge fuel necessary to run the computational engines
of today and tomorrow.
Too often, research questions are posed and gener­
alizations attempted in terms of the language of the
technology of the day. Examples include the count­
less studies that compare menu vs. command language
interfaces, or the more recent debate over the relative
merits of tile vs. overlapping window systems (e.g.,
Bly & Rosenberg, 1986). Any guidance generated by
this approach is bound to be outpaced by advances
in technology and is consequently doomed to obso­
lescence. For example, context free comparisons of
menus vs. command languages provide little insight
or guidance on the use of "soft keys" or windows.
One of the main tenets of cognitive systems en­
gineering is that for broad applicability, generaliza-
12. WHAT IS COGNITIVE ENGINEERING
tions need to be expressed at the level of a cognitive
language (Hollnagel & Woods, 1983). Tasks are an­
alyzed with respect to cognitive processing require­
ments (Card, Moran, & Newell, 1983; Kieras & Pol-
son, 1985; Johnson & Payne, 1985). For example,
the question of menus versus command languages or
different menu systems is reformulated into questions
about memory requirements and questions about com­
petition between cognitive activity devoted to option
selection versus cognitive activity devoted to carrying
out domain tasks. Can the person see all currently
available or meaningful options or must he/she recall
them or where to find them from memory? - are op­
tions and domain task information presented in parallel
or do options replace domain data? This allows con­
clusions to be drawn that have direct applicability to
the evaluation and design of systems that employ dif­
ferent implementation technology to perform the same
cognitive function.
1.2 What is Cognitive Engineering
There has been growing recognition of this need
to develop an applied cognitive science that draws
on knowledge and techniques of cognitive psychol­
ogy and related disciplines to provide the basis for
principle-driven design (Norman, 1981b; Newell &
Card, 1985; Brown & Newman, 1985). In this
section, we will examine some of the characteristics
of cognitive technologies or cognitive engineering or
whatever moniker you prefer (cognitive factors, cog­
nitive ergonomics, knowledge engineering). The per­
spective for this exposition is that of cognitive sys­
tems engineering (Hollnagel & Woods, 1983; Woods,
1986).
Cognitive engineering is about human behavior in
complex worlds. Studying human behavior in com­
plex worlds (and designing support systems) is one
case of people engaged in problem solving in a com­
plex world, analogous to the task of other human prob­
lem solvers (e.g., operators, troubleshooters) who con­
front complexity in the course of their daily tasks. Not
surprisingly, the strategies researchers and designers
use to cope with complexity are similar as well. For
example, bounding the world to be considered is a
standard tactic to manage complexity. Thus, one might
address only a single time slice of a dynamic pro­
cess or only a subset of the interconnections between
parts. This strategy is limited because it is not clear
whether the relevant aspects of the whole have been
captured. First, parts of the problem solving process
may be missed or their importance underestimated and,
5
second, some aspects of problem solving may only
emerge when more complex situations are directly ex­
amined. For example, the role of problem formulation
and re-formulation in effective performance is often
overlooked. Reducing the complexity of design or
research questions by bounding the world to be con­
sidered merely displaces the complexity to the person
in the operational world, rather than provide a strategy
to cope with the true complexity of the actual prob­
lem solving context. It is one major source of fail­
ure in IDS. For example, the designer of a machine
problem solver may assume that only one failure is
possible to be able to completely enumerate possible
solutions and to make use of classification problem
solving techniques (Clancey, 1985); however, the ac­
tual problem solver must cope with the possibility of
multiple failures, misleading signals, interacting dis­
turbances (e.g., Pople, 1985; Woods & Roth, 1986).
The result is that we need, particularly in this time of
advancing machine power, to understand human be­
havior in complex situations. What makes problem
solving complex? How does complexity affect the per­
formance of human and of machine problem solvers?
How can problem solving performance in complex
worlds be improved and deficiencies avoided? (See
Dorner, 1983; Selfridge et al., 1984; Montmollin &
De Keyser, 1985; Rasmussen, 1986a; Fischhoffet al.,
1986; Klein et al., 1986 for other discussions on the
nature of complexity in problem solving.) Understand­
ing the factors that produce complexity, the cognitive
demands that they create, and some of the cognitive
failure forms that emerge when these demands are not
met is essential if advances in machine power will lead
to new cognitive tools that actually enhance problem
solving performance.
Cognitive engineering is ecological It is about mul­
tidimensional, open worlds and not about the artifi­
cially bounded closed worlds typical of the laboratory
or the engineer's desktop (e.g., Funder, 1987)2. An
example of the ecological perspective is the need to
study humans solving problems with tools (i.e., sup­
port systems) as opposed to laboratory research which
continues, for the most part, to examine human per­
formance stripped of any tools. Cognitive engineering
is sine qua non for this - how to put effective cognitive
tools into the hands of practitioners. From this view­
point, quite a lot could be learned from examining the
nature of the tools that people spontaneously create to
work more effectively in some problem solving envi-
2
Of course virtually all of the worlds that we might be interested
in are man-made. The point is that these worlds encompass more
than the design intent - they exist in the world.
6 CHAPTER I. COGNITIVE SYSTEMS ENGINEERING
ronment, or examining how pre-existing mechanisms
are adapted to serve as tools as occurred in Roth et
al. (1987), or examining how tools provided for a
practitioner are really put to use by practitioners. The
studies by De Keyser (1986) are extremely unique with
respect to the latter.
In reducing the target world to a tractable labo­
ratory or desktop world in search of precise results,
we run the risk of eliminating the critical features of
the world that drive behavior. This creates the prob­
lem of deciding what counts as an effective stimulus
(as Gibson has pointed out in ecological perception)
or, to use an alternative terminology, deciding what
counts for a symbol. To decide this question, Gib­
son (1979) and Dennett (1982), among others, have
pointed out the need for a semantic and pragmatic
analysis of environment-cognitive agent relationships
with respect to the goals/resources of the agent and the
demands/constraints in the environment. As a result,
one has to pay very close attention to what people ac­
tually do in a problem solving world, given the actual
demands that they face (Woods, Roth & Pople, 1987).
Principle-driven design of support systems begins with
understanding what are the difficult aspects of a prob­
lem solving situation (e.g., Rasmussen, 1986a; Woods
& Hollnagel, 1987).
A corollary to the above is that cognitive engineer­
ing must address the contents or semantics of a domain
(e.g., Coombs, 1986). Purely syntactic and exclusively
tool-driven approaches to develop support systems are
vunerable to the error of the third kind - solving the
wrong problem. The danger is to fall into the psy­
chologist's fallacy of William James, where the psy­
chologist's reality is confused with the psychological
reality of the human practitioner in his or her prob­
lem solving world. To guard against this danger, the
psychologist or cognitive engineer must start with the
working assumption that practitioner behavior is rea­
sonable and attempt to understand how this behav­
ior copes with the demands and constraints imposed
by the problem solving world in question. For ex­
ample, the initial introduction of computerized alarm
systems into power plant control rooms inadvertantly
undermined the strategies operational personnel used
to cope with some problem solving demands so badly
that it had to be removed and the previous kind of
alarm system restored. The question is not why peo­
ple failed to accept a useful technology, but rather how
the original alarm system supported and the new sys­
tem failed to support operator strategies to cope with
the world's problem solving demands. This is not to
say that the current strategies are optimal or produce
acceptable levels of performance, but only that under­
standing how they function in the current cognitive
environment is a starting point to develop truely ef­
fective support systems.
Semantic approaches, on the other hand, are vul­
nerable to myopia. If each world is seen as com­
pletely unique and must be investigated 'tabula rasa,'
then cognitive engineering can be no more than a set
of techniques that are used to investigate every world
anew. If this were the case, it would impose strong
practical constraints on principle-driven development
of support systems, restricting it to cases where the
consequences of poor performance are extremely high.
To achieve relevance to specific worlds and gener-
alizability across worlds, the cognitive language must
be able to escape the language of particular worlds,
as well as the language of particular computational
mechanisms, and identify pragmatic reasoning situa­
tions, after Cheng & Holyoak (1985) and Cheng et
al. (1986). These reasoning situations are abstract
relative to the language of the particular application
in question and therefore transportable across worlds,
but they are also pragmatic because the reasoning in­
volves knowledge of the things being reasoned about.
More ambitious, are attempts to build a formal cogni­
tive language, for example, Coombs & Hartley (1987)
through their work on coherence in model generative
reasoning.
Cognitive engineering is not just about the contents
of a world; it is about changing behavior/performance
in that world. This is both a practical consideration -
improving performance or reducing errors justifies the
investment from the point of view of the world in ques­
tion, and a theoretical consideration - the ability to pro­
duce practical changes in performance is the criterion
for demonstrating an understanding of the factors in­
volved. Basic concepts are only confirmed when they
generate treatments (aiding either online or offline)
that make a difference in the target world. Cheng's
concepts about human deductive reasoning (Cheng &
Holyoak, 1985; Cheng et al., 1986) generated treat­
ments that produced very large performance changes
both absolutely and relative to the history of rather
ineffectual alternative treatments to human biases in
deductive reasoning.
Cognitive engineering is about systems. One source
of tremendous confusion has been an inability to
clearly define the "systems" of interest. From one
point of view the computer program being executed is
the end application of concern. In this case, one often
speaks of the interface, the tasks performed within the
syntax of the interface, and human users of the inter-
12. WHAT IS COGNITIVE ENGINEERING
face. Notice that the application world (what the inter­
face is used for) is de-emphasized. The bulk of work
on human-computer interaction takes this perspective.
Issues of concern include designing for learnability
(e.g., Brown & Newman, 1985; Carroll & Carrithers,
1984; Kieras & Poison, 1985), and designing for ease
and pleasureableness of use (Norman, 1983; Malone,
1983; Shneiderman, 1984; 1986). Many of the chap­
ters in this volume are directed at these concerns.
A second perspective is to distinguish the inter­
face from the application world (Miyata & Norman,
1986; Stefik, Foster, Bobrow, Kahn, Lanning, & Such-
man, 1985; Rasmussen, 1986a; Hollnagel, Mancini &
Woods, 1986; Mancini, Woods & Hollnagel, in press).
For example, text editing tasks are performed only in
some larger context such as transcription, data entry,
composition, or one must know about air travel in
order to design or understand an airline reservation
interface. The interface is an external representation
of an application world, that is, a medium through
which agents come to know and act on the world -
troubleshooting electronic devices (Davis, 1983), lo­
gistic maintenance systems, managing data commu­
nication networks, managing power distribution net­
works, medical diagnosis (Gadd & Pople, 1987; Cohen
et al., 1987) aircraft and helicopter flightdecks (Pew
et al., 1986), air traffic control systems, process con­
trol accident response (Woods, Roth & Pople, 1987),
command and control of a battlefield (Fischhoff et al.,
1986). Tasks are properties of the world in question,
although performance of these fundamental tasks (i.e.,
demands) are affected by the design of the external
representation (e.g., Mitchell & Saisi, 1987). The hu­
man is not a passive user of a computer program, but
is an active problem solver in some world. Therefore,
we will generally refer to people as domain agents or
actors or problem solvers and not as users. In this
view, one can generalize across application worlds via
the basic cognitive demands. For example, Rasmussen
(1986b) brings briningle set of cognitive engineering
concepts (from Rasmussen, 1986a) to bear on five dif­
ferent worlds - process control, emergency manage­
ment, CAD/CAM, office systems, library systems.
In part, the difference in the above two views can
be traced to differences in the cognitive complexity of
the domain task being supported. Research on person-
computer interaction has typically dealt with office ap­
plications (e.g., word-processors for document prepa­
ration or copying machines for duplicating material)
where the goals to be accomplished (e.g., replace word
1 with word 2) and the steps required to accomplish
them are relatively straightforward. These applications
7
fall at one extreme of the cognitive complexity space.
In contrast, there are many decision making and su­
pervisory environments (e.g., military situation assess­
ment; medical diagnosis) where problem formulation,
situation assessment, goal definition, plan generation,
and plan monitoring and adaptation are significantly
more complex. It is in designing interfaces and aids
for these applications where it is essential to distin­
guish the world to be acted on, from the interface or
window on the world (how one comes to know that
world), and from agents who can act directly or indi­
rectly on the world.
A large number of the worlds that cognitive en­
gineering should be able to address contain multiple
agents who can act on the world in question (e.g.,
command and control, process control, data commu­
nication networks). Not only do we need to be clear
about where systemic boundaries are drawn with re­
spect to the application world and interfaces to or rep­
resentations of the world, we also need to be clear
about the different agents who can act directly or in­
directly on the world. Cognitive engineering must be
able to address systems with multiple cognitive agents.
This applies to multiple human cognitive systems (of­
ten called distributed decision making, e.g., Schum,
1980; Einhorn & Hogarth, 1985; Fischhoff et al.,
1986; Fischhoff, 1986; March & Weisinger-Baylon,
1986). It also applies io joint human-machine cogni­
tive systems because changes in computational power
have increased the frequency of partially autonomous
machine agents (Woods, 1986). When a system in­
cludes these machine agents, the human role is not
eliminated, but shifted. This means that changes in
automation are changes in the joint human-machine
cognitive system. Design and research then should
center on what are effective architectures of multiple
cognitive agents (Sheridan & Hennessy, 1984; Sorkin
& Woods, 1985; Woods, Roth & Bennett, in press;
Sorkin et al., in press; Sheridan, 1988).
Cognitive engineering is problem-driven, tool-
constrained. This means cognitive engineering must
be able to analyze a problem solving context and un­
derstand the sources of both good and poor perfor­
mance, i.e., the cognitive problems to be solved or
challenges to be met (e.g., Rasmussen, 1986a; Woods
& Hollnagel, 1987). The results from this analysis are
used to define the kind of solutions that are needed
to enhance successful performance - to meet cogni­
tive demands of the world, to help the human func­
tion more expertly, to eliminate or mitigate error prone
points in the total cognitive system (demand-resource
mismatches). The results of this process then can be
8 CHAPTER!.
deployed in many possible ways as constrained by tool
building limitations and tool building possibilities -
exploration training worlds, new information, repre­
sentation aids, advisory systems, or machine problem
solvers. The cognitive system approach can address
existing cognitive systems in order to identify defi­
ciencies that cognitive system redesign can correct and
prospective cognitive systems as a design tool dur­
ing the allocation of cognitive tasks and the develop­
ment of an effective joint architecture (e.g., Pew et al.,
1986).
1.3 The Cognitive System Triad
One can think of problem solving situations in terms of
interactions among a set of three mutually constrained
factors (Figure 1): the world to be acted on, the agent
or agents who act on the world, and the external rep­
resentations through which the agent experiences that
world. Each of these factors contributes to the per­
formance of the agent in the relevant domain (cf., von
Winterfeldt & Edwards, 1986, p. 669-677 for a partic­
ularly engaging discussion of the interaction of these
factors). When we better understand the interactions
among these factors in a broad sample of natural prob­
lem solving habitats we will be better able to support
and improve performance, i.e., establish a flourishing
cognitive engineering.
Starting from the apex of the world itself, the char­
acteristics of that world contribute various kinds of
cognitive demands that must be handled to adequately
perform domain tasks. There are four dimensions of
problem solving worlds that define its cognitive de­
mands: dynamism, the number of parts and the ex-
tensiveness of interconnections between the parts or
variables, uncertainty, and risk (Woods, 1988). The
position of a domain along these dimensions deter­
mines the cognitive demands and the cognitive situ­
ations that problem solvers can face in the world in
question. These demands can strongly affect what are
effective or sensible reasoning strategies to adopt and
the cognitive failure forms that will occur. The diffi­
culty of meeting these demands varies depending on
the processing characteristics of the relevant cognitive
agents, the architecture of the various cognitive agents
(Sorkin & Woods, 1985; Fischhoffet al., 1986; Roth et
al., in press; Muir, in press) and on the representation
of the world that is provided to the problem solving
agent (Rasmussen & Lind, 1981; Rasmussen, 1986).
The external representation apex captures the fact
that a particular problem representation affects prob­
lem solving by making certain information or manipu­
COGNITIVE SYSTEMS ENGINEERING
lations of information explicit at the expense of other
information or manipulations which are pushed into
the background (e.g., Janvier, 1987). A simple exam­
ple is notational systems such as numeral systems -
try multiplication and division in the Roman numeral
system. The effect of a representation then depends on
the cognitive demands imposed by the world and on
the processing characteristics of the relevant cognitive
agent.
The third apex addresses the problem solver or
solvers themselves - their processing resources and
the architecture of multiple agents. What mechanisms
and resources affect monitoring the behavior of the
world over time, recognizing undesirable situations,
explaining unexpected behavior, selecting or adapting
responses to cope with these situations (cf., Woods et
al., 1987).
One example of the interaction of the three apices is
Fischhoff et al. (1986) who discuss how risk interacts
strongly with multi-agent architectures to influence the
level of risk acceptance of the joint cognitive system
and therefore the quality of problem solving behavior.
Furthermore, they show how changes in the power
and scope of centralized information systems (a change
on the representation apex) can change the distributed
decision architecture and strongly affect risk taking
behavior, i.e., the decision criteria on the willingness
to innovate or depart from doctrine at various levels
of a hierarchical organization.
Errors emerge when there is a mismatch among the
elements of the triad in a kind of demand-resource re­
lation. For example, a narrow field of attention (low
resources) can lead to errors only if the world in ques­
tion produces situations where a wide field of view is
needed for timely detection of important system be­
haviors.
Demand Characteristics of Problem Solving Habi­
tats
To briefly illustrate the cognitive triad as an heuristic
to help establish an independent cognitive description
of a world, let us consider the factors that modulate a
world's cognitive demands (cf., Woods, Roth & Pople,
1987 for a description of an AI-based modeling envi­
ronment where variations along the three apices of the
cognitive triad can be simulated to investigate the po­
tential for cognitive failures in particular worlds).
When a world is dynamic, problem solving incidents
unfold in time and are event-driven, that is, events can
happen at indeterminate times and the nature of the
problem to be solved can change (e.g., multiple fail-
13. THE COGNITIVE SYSTEM TRIAD 9

AGENT
Multiple Agents
Joint Cognitive Systems

WORLD
Dynamism
Many Highly Inter
Uncertainty
Risk

REPRESENTATION
Collection: Fixed or Adaptive
Integration: Computational or Analogical

Figure 1: Factors that contribute to the complexity and difficulty of problem solving. (From Woods, 1988)

ures). The result is cognitive demands associated with
anticipation or prediction of the behavior of the world
and the need to be able to revise one's assessment of
the state of the world and therefore one's tactical or
strategic response (cf., Montmollin & De Keyser, 1985
for one treatment of how dynamism affects cognitive
demands). Failures to revise are one source of fixation
errors (Woods, Woods et al., 1987).
When a world is made up of a large number of
highly interconnected parts (cf., Perrow, 1984; Ras-
mussen, 1986; Dorner, 1983; Woods & Hollnagel,
1987), one failure can have multiple consequences
(produce multiple disturbances); a disturbance could
be due to multiple potential causes and can have multi­
ple potential fixes; there can be multiple relevant goals
which can compete with or constrain each other; there
can be multiple ongoing tasks at different time spans.
In addition, the parts of the world can be complex
objects in their own right. One typical error form is
failures to consider side effects, requirements, or post­
conditions (Dorner, 1983). Another problem solving
error that occurs when a world is high on this dimen­
sion of complexity (particularly when it is simplified to
cope with the complexity) is to mistake one factor re­
lated to the state of the world as the single explanation
for that state - premature localization. This becomes
an error when the attribution to a single factor de­
lays or prevents identification of the set of factors that
actually contribute to the observed situation (Bechtel,
1982).
When data are uncertain, an inferential process is
needed to go from data to answers about the state of
the world. When uncertainty is high, some data al­
ways fail to fit together into the correct assessment due
to red herrings, sensor failures, human reported data,
perceptual judgements, irrelevant factors, or multiple
failures. Not only does the inferential value of differ­
ent data vary, the inferential value of a single set of
data can vary with context. Furthermore, data gath­
ering to reduce uncertainty can become necessary and
can interact with effort and risk. A typical cognitive
failure form is over-reliance on familiar signs (Ras-
mussen, 1986). See Cohen et al. (1987), Coombs &
Hartley (1987), Schum (1980), Garbolino (1987) and
Dubois (1987) for some treatments of different aspects
of uncertainty and its consequences for problem solv­
ing demands and activities.
When there is risk, possible outcomes of choices
can have large costs. The presence of risk means
that one must be concerned with the rare but catas-
10
trophic situations as well as with more frequent but
less costly situations. When uncertainty is coupled
with risk, situations of choice under uncertainty and
risk arise. Current knowledge about human perfor­
mance in risky decision making indicates that gener­
alizations from research with non-risky tasks to risky
tasks must be made very cautiously.
To illustrate how interactions among these dimen­
sions affect cognitive demands, consider a world that
has high evidential uncertainty. When a world is both
uncertain and dynamic, strategies for acquiring data
become important. All evidence is not available at
once because it comes in over time or because it must
be actively acquired with associated costs (effort and
risk). As a result, situation assessment and evidence
gathering interact, e.g., the information value of the
data to be collected can interact with the effort that
must be expended in order to collect it (e.g., Moray,
1984; Johnson & Payne, 1985), especially when there
is a high workload. Uncertainty and risk interact when
data gathering can be an action in the world of inter­
est with attendant consequences for parts of the world.
For example, medical tests can have negative conse­
quences that must be balanced with gain of information
(Cohen et al., 1987) or obtaining data from a loca­
tion involves danger such as radiation exposure or fire
(Klein et al., 1986). A common strategy in research
and in building machine experts (Mycin) is to con­
sider situation assessment/diagnosis independent from
data gathering. However, this simplification obscures
the interaction between these two and the cognitive
demands generated by that interaction when evidence
comes in over time or has associated costs. It is one
example of failing to take the perspective of the prob­
lem solver in the situation when mapping cognitive
demands.
The need to know when and where to look for evi­
dence results in the demand for control of attention
- the need to focus in on the significant subset of
data for the current problem context, given a large
amount of potentially relevant data (Woods & Roth,
1986; Woods, Roth & Pople, 1987). In this case,
the problem solver must decide what data are rele­
vant to consider in determining a solution; thus, it
is part of problem formulation. A large category of
errors in worlds high on the dimensions of complex­
ity can be described as failures of attention (Woods,
1984a), in that, from hindsight, data from which the
solution could have been extracted were available but
were not attended to or looked for at the right time or in
conjunction with the appropriate set of data, given an
erroneous assessment of the situation or an erroneous
CHAPTER I. COGNITIVE SYSTEMS ENGINEERING
approach to the utilization of evidence. From the point
of view of problem formulation, these attention fail­
ures are seen as errors of solving the wrong problem.
Examples of breakdowns in this cognitive demand in­
clude disturbance management in process control ac­
cidents with conventional alarm systems (e.g., Lees,
1983; Woods, Elm & Easter, 1986) and intelligence
failures in military history (e.g., Shlaim, 1976).
Mismatches in the Cognitive System Triad: Getting
Lost
Mismatches among the elements of the triad produce
global human-machine performance problems even
when the "knobs and dials" level of human factors is
well handled. One example of this in human-computer
interaction is the getting lost phenomenon in large dis­
play networks (Woods, 1984b).
In a particularly pointed case, a data-base system
was designed to computerize paper-based instructions
for nuclear power plant emergency operation (Elm
& Woods, 1985). The system was built based on a
human-computer interface "shell" (issues, it was pos­
sible to create the computerized system simply by en­
tering domain knowledge (i.e., the current instructions
as implemented for the paper medium) into the inter­
face and network data base framework provided by the
shell.
The system contained two kinds of frames: menu
frames that served to point to other frames, and content
frames that contained instructions from the paper pro­
cedures (generally one procedure step per frame). In
preliminary tests of the system, it was found that peo­
ple uniformly failed to complete recovery tasks with
procedures computerized in this way. They became
disoriented or "lost": unable to keep procedure steps
in pace with plant behavior, unable to determine where
they were in the network of frames, unable to decide
where to go next, or unable even to find places where
they knew they should be (i.e., they diagnosed the sit­
uation, knew the appropriate responses as trained op­
erators, yet could not find the relevant procedural steps
in the network). These results were found with peo­
ple experienced with the paper-based procedures and
plant operations as well as with people knowledgeable
in the frame-network software package and how the
procedures were implemented within it.
What was the source of the disorientation prob­
lem? It resulted from a failure to analyze the cog­
nitive demands associated with using procedures in an
externally-paced world. For example, in using the pro­
cedures the operator often is required to interrupt one
1.4. A SAMPLE OF CRITICAL ISSUES IN COGNITIVE ENGINEERING
activity and transition to another step in the procedure
or to a different procedure depending on plant con­
ditions and plant responses to operator actions. As a
result, operators need to be able to rapidly transition
across procedure boundaries and to return back to in­
complete steps. Because of the size of a frame, there
was a very high proportion of menu frames relative to
content frames and the content frames provided a nar­
row window on the world. This structure made it dif­
ficult to read ahead to anticipate instructions, to mark
steps pending completion and return to them easily, to
see the organization of the steps, or to mark a "trail" of
activities carried out during the recovery. Many activ­
ities that are inherently easy to perform in a physical
book turned out to be very difficult to carry out, e.g.,
read ahead. The result was a mismatch between user
information processing activities during domain tasks
and the structure of the interface as a representation of
the world of recovery from abnormalities.
These results triggered a full design cycle that be­
gan with a cognitive analysis to determine the user in­
formation handling activities needed to effectively ac­
complish recovery tasks in emergency situations. Fol­
lowing procedures was not simply a matter of linear,
step by step execution of instructions, rather it required
the ability to maintain a broad context of the purpose
and relationships among the elements in the procedure
(cf. Brown et al., 1982; Roth et al., 1987). Operators
needed to maintain awareness of the global context
(i.e., how a given step fits into the overall plan), to
anticipate the need for actions by looking ahead, and
to monitor for changes in plant state that would require
adaptation of the current response plan.
A variety of cognitive engineering techniques were
utilized in a new interface design to support the de­
mands. First, a spatial metaphor was used to make the
system more like a physical book. Second, display
selection/movement options were presented in paral­
lel, rather than sequentially, with procedural informa­
tion (defining two types of windows in the interface).
Transition options were presented at several grains of
analysis to support moves from step to step as eas­
ily as moves across larger units in the structure of the
procedure system. In addition, incomplete steps were
automatically tracked and those steps were made di­
rectly accessible (e.g., electronic bookmarks or place­
holders).
To provide the global context within which the cur­
rent procedure step occurs, the step of interest is pre­
sented in detail, and it is embedded in a skeletal struc­
ture of the larger response plan of which it is a part
(Woods, 1984b; Furnas, 1986). Context sensitivity
11
was supported by displaying the rules for possible
adaptation or shifts in the current response plan that are
relevant to the current context in parallel with current
relevant options and the current region of interest in
the procedures (a third window). Note how the cogni­
tive analysis of the domain defined what types of data
needed to be seen effectively in parallel, which then
determined the number of windows required. Also
note that the cognitive engineering re-design was, with
a few exceptions, directly implementable within the
base capabilities of the interface shell.
As the example above saliently demonstrates, there
can be severe penalties for failing to adequately map
the cognitive demands of the environment. However,
if we understand the cognitive requirements imposed
by the domain, then a variety of techniques can be
employed to build support systems for those functions.
The remainder of this chapter will address a sample
of critical issues in cognitive engineering. The topics
include what is expertise and skill, the problem of hu­
man error, the problem of brittle problem solvers, what
is good advice, cognitive tools, and representation aid­
ing. The topics are not meant to be exhaustive of the
scope of cognitive engineering, rather they represent a
range of the research activities that are relevant to the
problem of improving human performance.
1.4 A Sample of Critical Issues in Cogni­
tive Engineering
What is Expertise and Skill
One of the major challenges in cognitive engineering is
being able to specify the basis for expert performance
(Gitomer & Glaser, 1987). First, there is a need for a
theory of cognitive task performance that illuminates
the cognitive skills and the nature of the internal repre­
sentation of the domain which contribute to proficient
performance (Gitomer & Glaser, 1987). Second, there
is a need to specify how best to deliver that knowledge
in an operational environment. Knowledge can be de­
ployed internal to people (inherent capabilities, educa­
tion, training, experience) or in external form (encoded
in different media and organized for retrieval in differ­
ent ways) and the knowledge can be available during
task performance (via memory, another person, or a
knowledge delivery system) or on call (e.g., a human
specialist). Third, there is a need for pedagologicial
theory for the development of expert knowledge and
skill.
There is an extensive body of research in cogni­
tive science that examines differences between expert
12
and novices (cf., Lesgold, 1984; Chi, Glasser & Farr,
1986). Studies have been conducted in a wide variety
of domains including chess playing (Chase & Simon,
1973; DeGroot, 1965), physics problem-solving (Chi,
Feltovich & Glaser, 1981; Chi, Glaser & Rees, 1982;
Larkin, McDermott, & Simon, 1980; McCloskey,
Caramazza, & Green, 1980), medical and clinical diag­
nosis (Lesgold, Rubinson, Feltovich, Glaser, Klopfer,
& Wang, 1986; Kuipers & Kassiner, 1984; Cantor,
Smith, French & Mezzich, 1980),computer program­
ming (Adelson, 1984), electronics (Egan & Schwartz,
1979) and process control. The results of this research
have uniformly shown that experts perform better due
to differences in the nature and organization of specific
domain knowledge as opposed to more global differ­
ences in problem solving skills.
Experts possess richer domain knowledge with more
structure and interconnections. Their knowledge tend
to be organized both taxonomically, in terms of classes
and subclasses of events (e.g., kinds of diseases) and
in relation to theories and causal models within the
domain. This allows them to identify a productive
problem representation more readily, leading to more
efficient solution. For example physicists classify me­
chanics problems according to the underlying laws and
principles that apply, whereas physics students focus
on surface similarities of problems (Chi, Glaser &
Rees, 1982). Similar results are obtained with pro­
grammers (Adelson, 1981) and electronics technicians
(Egan & Schwartz, 1979).
The different organization of knowledge in experts
not only leads to more efficient solution of routine
problems, but also provides for more flexibility in
problem representation and solution strategy. One of
the hallmarks of skilled performance is flexibility, e.g.,
being able to handle special cases or exceptions and to
use reasoning shortcuts or more thorough processing
in different contexts (Clancey, 1985; Lesgold et al.,
1986). Part of cognitive skill is the ability to rec­
ognize when assumptions for routine processing are
violated and when to switch to other more elaborated
processing, e.g., take more factors into account.
A particularly clear example of this in machine cog­
nitive agents is the evolution of the "black teeth" rule
from the Mycin system for medical problem solving.
In the original system the knowledge is encoded only
as a routine shortcut (implemented just as an if-then
rule). In the Neomycin system (Clancey, 1983) back­
ground knowledge about the basis for this reasoning
shortcut (the if-then rule) is available as an "expla­
nation," if requested by the human problem solver.
Finally, Langlotz et al. (1986) articulate the complete
CHAPTER I. COGNITIVE SYSTEMS ENGINEERING
cognitive situation and place the if-then rule in this
context. The original Mycin rule is a reasoning short­
cut based on frequency of occurrence through a choice
under uncertainty and risk cognitive situation. In this
representation both efficiency and sensitivity to excep­
tions can be achieved.
Human experts seem able to use shortcut rules to
achieve cognitive economy and to be sensitive to situ­
ations that suggest utilizing more knowledge or more
elaborate strategies (or acquiring these from other re­
lated experts). One of the challenges facing cogni­
tive engineering and cognitive science in general, is to
account for the cognitive flexibility displayed by ex­
perts in shifting from routine shortcuts to more elab­
orated knowledge. Most of the psychological the­
ories that address expert performance have empha­
sized how knowledge organization changes over time
through processes such as "automatization" or "com­
pilation" of knowledge as routine problems are solved
more efficiently with increasing expertise (Anderson,
1983; Schneider & Fisk, 1983). There has yet to be
an adequate theoretical account for the cognitive flex­
ibility that allows experts to "switch frameworks" to
deal with exceptional cases or to revise interpretation
in light of new information (or the failure to revise -
fixation errors).
A related issue is the question of how knowledge
is activated and utilized in the actual problem solv­
ing environment (e.g., Cheng et al., 1986; Bransford,
Sherwood, Vye, and Rieser, 1986). Studies of edu­
cation and training often show that students success­
fully acquire knowledge that is potentially relevant to
solving domain problems, but that they often fail to
exhibit skilled performance, e.g., differences in solv­
ing mathematical exercises versus word problems (cf.,
Gentner & Stevens, 1983 for examples). The fact that
people possess relevant knowledge does not guaran­
tee that that knowledge will be activated and utilized
when needed in the actual problem solving environ­
ment. Does the problem solver know what is the re­
lationship between two domain entities? Does he/she
know that it is relevant to the problem at hand? Does
he/she know how to utilize this knowledge in problem
solving? This is the issue of expression of knowledge.
Education and training tends to assume that, if a per­
son can be shown to possess a piece of knowledge in
any circumstance, then this knowledge should be ac­
cessible under all conditions where it might be useful.
In contrast, a variety of research has revealed dissocia­
tion effects where knowledge accessed in one context
remains inert in another (Cheng et al., 1986; Brans-
ford et al., 1986). For example, Gick and Holyoak
1.4. A SAMPLE OF CRITICAL ISSUES IN COGNITIVE ENGINEERING
(1980) found that, unless explicitly prompted, people
will fail to apply a recently learned problem solution
strategy to an isomorphic problem (cf. also, Kotovsky
et al., 1985). Thus, the fact that people possess rel­
evant knowledge does not guarantee that this knowl­
edge will be activated when needed. The critical ques­
tion is not to show that the problem solver possesses
domain knowledge, but rather the more stringent cri­
terion that situation relevant knowledge is accessible
under the conditions in which the task is performed.
This has been called the problem of inert knowledge -
knowledge that is accessed only in a restricted set of
contexts.
The general conclusion of studies on the problem of
inert knowledge is that teaching the relevant domain
knowledge or strategies by themselves is not sufficient
to ensure that this knowledge will be accessed in new
contexts. Offline training experiences need to promote
an understanding of how the concepts and procedures
can function as tools for solving relevant problems
(Bransford et al., 1986; Brown, Bransford, Ferrara &
Campione, 1983; Brown & Campione, 1986). Train­
ing has to be about more than just student knowledge
acquisition; it must also enhance the expression of
knowledge by condiüonalizing knowledge to its use
via information about "triggering conditions" and con­
straints (Glaser 1984).
Similarly, online representations of the world can
help or hinder problem solvers recognize what in­
formation or strategies are relevant to the problem
at hand. For example, Fischhoff et al. (1978) and
Kruglanski et al. (1984) found that judgemental biases
(e.g., representativeness) were greatly reduced or elim­
inated when aspects of the situation cued the relevance
of statistical information and reasoning. Thus, one di­
mension along which representations vary is their abil­
ity to provide prompts to the knowledge relevant in a
given context.
The challenge for cognitive engineering is to study
and develop ways to enhance the expression of knowl­
edge and to avoid inert knowledge. What training con­
tent and experiences are necessary to develop condi-
tionalized knowledge - knowledge that includes infor­
mation about "triggering conditions" aionsonstraints
on its use (Anderson, 1983; Glaser 1984; Sternberg
& Caruso, 1985)? This last question is particularly
important for worlds where it is difficult to anticipate
all of the situations to be faced by domain actors, for
example, highly variable worlds or worlds where rare
events are important (high risk).
13
Exploration Training
Practice is essential to achieve condite colized knowl­
edge, but practice alone is not enough. One possibility
to enhance the expression of knowledge is exploration
training, the most notable example of which is the
STEAMER system (Hollan, Hutchins, & Weitzman,
1984)3. Exploratory learning utilizes a manipulable
representation of the subject matter (this usually means
at least a partially graphic or analogical representation
of the domain, interactive capabilities, and an underly­
ing simulation of the behavior of the domain) to sup­
port student explorations of how the world in question
works. One part of exploration training is the abil­
ity to experiment with possible situations and options.
Another part of exploration training is the ability to vi­
sualize the abstract or what is normally uninspectable.
The student is able to directly manipulate the model
world (for example, systematically changing one vari­
able while holding other variables constant and run­
ning the simulation to see the resulting changes in the
behavior of the system, or exploring the relationship
between two variables that interact by simultaneously
varying both). The student also must be able to see the
effects of manipulations on system behavior. This can
be done via representations that reveal aspects of the
semantics of the world (see the section on external rep­
resentations and problem solving). Wiecha and Hen-
rion (1986) contains a case where an interactive mod­
eling capability was underutilized until a graphic rep­
resentation of domain semantics was provided. Thus,
exploration training relies heavily on analogical repre­
sentation (Woods, 1986) and direct manipulation tech­
niques (Hutchins, Hollan & Norman, 1985).
Lesh (1987) developed an exploration learning en­
vironment which was combined with an instructional
strategy about how to guide student explorations. He
compared the performance of students taught with this
exploration learning environment and students taught
in a conventional instructional process for the same
material. Students who used the exploration learn­
ing environment significantly outperformed the other
group on a later test. Furthermore, some of the explo­
ration learning students (but none of the other group)
discovered domain principles that applied across prob­
lems which were not explicitly addressed in the mate­
rial or in any single exercise or problem.
The exploration approach to training raises several
questions that have only begun to be investigated.
What aspects of a world should be explorable or made
3
Exploration training is the offline application of conceptualiza­
tion aiding, cf., the section on conceptualization aids.
14
visible to enhance skill acquisition? It is critical to
understand where and why performance bottlenecks
occur in order to select what aspects of the domain
need to be captured in the exploratory world. What
instructional strategies apply to exploratory learning
contexts (e.g., should the student develop his/her own
experiments; can they discover all of the relevant space
of possible situations on their own)? What role does
coaching play in exploratory learning environments
(should coaching consist of illustrations followed by
free-exploration; should coaching include ordering ex­
periments in some way; does the role of coaching vary
with types of learners)? Will all learners benefit from
this approach (some evidence suggests that exploratory
training environments will not be effective for poor
learners without coaching, e.g., Hasselbring, Goin &
Bransford, 1985 and Gopher, Weil, & Siegel 1986; in
press).
How is progress measured? If performance is poor,
what remedial or corrective strategies apply (what ex­
periences or representations of the world will remedy
bugs in a student's knowledge)? There is also the
problem of how to develop capabilities for skilled dis­
criminations in a problem solving world: how to en­
hance differentiation of relevant from irrelevant parts
of a problem situation (Gaeth & Shanteau, 1984; Lit-
tlefield & Rieser, 1985). Note that this applies to
problem formulation stages in many worlds, not just
perceptual worlds such as radiography (Lesgold et al.,
1986).
There is the need to develop new instructional strate­
gies that are coherent with the exploration approach.
For example, what is advice during online task perfor­
mance can be coaching offline. A coach can affect the
experience base the student receives by choosing or
introducing circumstances that force the student into
difficult areas. Coaches can teach response strategies
explicitly via the exploratory trainer by showing stu­
dents why a situation is difficult or undesirable, show­
ing how to avoid getting into that situation given other
constraints, and showing how to navigate or escape
from difficult situations. For example, Lesh (1987)
initially used an exploration learning environment to
step students through problem solutions. Second, stu­
dents were shown cases and asked to critique perfor­
mance. In the third phase the students explored sit­
uations on their own. The result is the kind of in­
formed training suggested by Bransford et al. (1986;
cf. Brown & Campione, 1986) where students are
helped to understand when and why to use various
strategies and where students are provided opportu­
nities to practice strategies and monitor their effects.
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
This approach may help students "conditionalize" their
knowledge and develop knowledge organizations that
increase the probability that relevant information will
be accessed when needed.
There are many other important questions about the
acquisition of expertise. Developmental psychologists
(and more recently studies of how information pro­
cessing changes with aging) emphasize that cognitive
processes are not givens but change as a function of
age, experience, training. Thus, simple categorizations
of novice and expert may not be very useful to cogni­
tive engineers interested in enhancing the acquisition
of expertise. Generally, training focuses on identify­
ing knowledge and processing strategies utilized by
experts and then directly exposing novices to these
strategies (e.g., Clancey, 1986). However, we may
need to understand the evolution from lesser to greater
degrees of expertise and then assist the learner through
these stages or steps in the evolution of their own ex­
pertise (Lesgold, 1984; White & Frederiksen, 1986).
Human Error and Person-Machine Mismatches
Questions about human error - what it is, what factors
produce it, what forms does it take, how to measure the
potential for error, how to predict its form or frequency
or timing, where is a task vulnerable to error - are
essential topics for a cognitive engineering if it is to
impact on performance. The level of effort devoted to
these questions has accelerated recently (e.g., Moray &
Senders, in preparation; Rasmussen, Duncan & Leplat,
1987).
There are several common themes in the recent work
on human error (e.g., Rasmussen, 1986a; Rasmussen
et al., 1987; Reason & Embrey, 1985). First, there
is a distinction between error forms, the likelihood of
different kinds of errors given that an error occurs,
and error emission patterns, the statistics of how of­
ten inadequate performance will occur. Researchers
have generally focused on the systematic error forms
because these suggest potentially identifiable and cor­
rectable underlying factors.
Research on error today assumes error is the result
of limited rationality - people are doing reasonable
things given their knowledge, their objectives, their
point of view and limited resources, e.g., time or work­
load (Reason & Mycielska, 1982; Montmollin & De
Keyser, 1985; Woods et al., 1987) - and that error
analysis consists of tracing the problem solving pro­
cess to identify points where rationality breaks down.
This has been called an assumption of imperfect ra­
tionality or a cognitive existence theorem - there is
1.4. A SAMPLE OF CRITICAL ISSUES IN COGNITIVE ENGINEERING
some cognitive system which can be postulated which
would rationally, i.e., within its knowledge and infor­
mation processing capability, exhibit the behavior that
has been observed.
A third theme derives from studies of actual inci­
dents (e.g., Pew et al., 1981; Reason & Mycielska,
1982; Woods, 1982; Perrow, 1984; Montmollin & De
Keyser,1985; Wagenaar & Groeneweg, 1987).Wagen-
nar, W. A. These studies reveal that there are a set of
individually necessary but only jointly sufficient con­
ditions for a disaster to occur, therefore, labeling any
one the cause requires additional information to distin­
guish it from the background causal field. For exam­
ple, in an actual train derailment leading to a two train
crash, one can refer to a large number of conditions
but for which the accident would not have occurred
- such as, the information processing demands placed
on the driver, the change in habits due to the end of
the holiday period schedule, the speed of the train, the
proximity of another track at the site of the derailment,
the timing that another train was on this other track at
nearly the same time, etc.
This observation has led to general agreement
among the research community (but not necessarily
in particular application communities) that it is more
fruitful to think about person-machine system flaws
than human errors (e.g., Perrow, 1983; Rasmussen,
1986). The label "human error" is often used as
a residual category; it tends to imply responsibility
and blame (punishment); it focuses changes on lo­
cal, incident-specific responses (different people, bet­
ter motivation). Error attribution is an exercise in
hindsight judgement (a two state discrete dimension);
whereas prior to the outcome there are only degrees of
performance (a continuous dimension) and factors that
make it more or less difficult to perform well. In the
train crash example, all the trains that day went too
fast through the section of the track where the derail­
ment occurred. Thus, once performance deviates from
its target, it has the potential to be labelled erroneous.
Whether it will lead to negative consequences depends
on the presence of other necessary factors.
A more productive alternative is to focus on the fac­
tors that produce the behaviors underlying the disaster
(as Perrow 1983 puts it, what forced the erroneous be­
haviors). For example, an airplane crash into a moun­
tain on a clear day was originally labeled "crew error."
However, further investigation revealed that this seem­
ingly irrational incident was actually the product of
the interaction of a set of factors - the flight computer
course had been changed without notifying the pilot,
the new course was visually quite similar to the old,
15
and a dry air whiteout made the mountain invisible
to the pilots (Mahon, 1981). Identifying how a set of
factors converge in the genesis of a disaster leads to an
emphasis on demand/resource mismatches, the perfor­
mance of the total person-machine system, the inter­
action of multiple contributors to an accident, multiple
ways to improve the systems involved in the accident,
and failures as potential learning experiences. From
this perspective we need to understand the relation­
ship between human processing mechanisms (e.g., von
Winterfeldt & Edwards, 1986) and the demands and
resources actually present in complex problem solving
situations such as flightdeck operations, emergency re­
sponse in nuclear power plants, or marine safety. For
example, one position is that human processing con­
sists of relatively simple but normally quite effective
mechanisms. Performance failures occur when design­
ers unintentionally create excessively harsh cognitive
environments due to the demands of the world itself
and due to the primitive representations available (Per­
row, 1984; Reason, 1986; 1987).
One path to approach questions about human er­
ror is to examine criteria for skilled or expert perfor­
mance. One often noted aspect of skill or expertise is
the ability to adapt one's response in light of changing
circumstances in pursuit of a goal (Brown et al., 1982;
Bainbridge, 1984; Woods & Roth, 1986). Adaptability
depends on abilities to predict or anticipate the behav­
ior of the world and to be sensitive to what might
happen next (e.g., the field of attention). This defi­
nition emphasizes the ability of the skilled performer
to compensate for environmental variability or distur­
bances. Error then becomes a breakdown in one's
resistence to variability or disturbances, either failures
to recognize the need to adapt (behavior persists in
one path in the face of changing circumstances that
demanded a shift in response) or erroneous adaptation
(the need for adaptation was recognized but the at­
tempted adaptation was inadequate due to incomplete
knowledge). This view emphasizes the active role of
any cognitive agent or set of cognitive agents in con­
trolling a world and the need to treat performance fail­
ures through changes in the capabilities, resources and
architecture within the cognitive systems triad. This
suggests that human participation often prevents the
propagation of errors or usually works around error
prone points (flaws) due to the flexibility, adaptability,
"intelligence" of the human in the loop. For example,
it is ironic that decision automation is often justified
on the grounds of human incompetence, however it is
the same person who must compensate for the "brittle-
ness" typically exhibited by machine agents in the face
16
of unexpected situations (Roth et al. 1987). Note the
stark contrast between this view and another point of
view that sees the human as an independent source or
contributor of errors, where system failures in which
human actions played a role should be treated by in­
creasing the role of machine cognitive agents in order
to eliminate or reduce the human's role.
One source of mismatches within the cognitive sys­
tem triad has been purely technology-driven deploy­
ment of new automation capabilities. When this oc­
curs, there are frequently unintended and unforseen
negative consequences. Examples of this include:
• cases of shifts from manual to supervisory con­
trol in process control where productivity actually
fell from previous levels when there was a failure
to support the new supervisory control demands
(Hoogovens Report, 1976);
• cases of automation related disasters in aviation
(e.g., Wiener, 1985);
• a shift in power plant control rooms from tile an­
nunciator alarm systems to computer based alarm
systems that eventually collapsed and forced a
return to the older technology because strategies
to meet the cognitive demands of fault manage­
ment that were implicitly supported by the old
representation were undermined in the new rep­
resentation (Pope, 1978);
• shifts from paper based procedures to comput­
erized procedures that have also collapsed due
to disorientation problems again as a result of a
failure to anticipate the cognitive reverberations
of technological changes (Elm & Woods, 1985).
Consider a simple example of automation. You have
a portable cassette tape recorder to record letters. In
the manual recorder you must switch from one side of
the tape to the other when you have filled one side.
Now you purchase a new, more technologically so­
phisticated recorder that has an automatic reverse -
when you reach the end of one side, the machine au­
tomatically begins to record on the other side of the
tape. You no longer have to take out the tape, reverse
it, and reload it. Automation has produced positive
impact, especially if you frequently record while your
hands are busy at some other activity like driving a
car. However, there are other consequences or effects
of the new automation that introduce possibilities for
new kinds of errors/inadequate outcomes if not ad­
dressed. In our automated recorder example, consider
what happens if on one day you record enough to fill
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
the first side of a tape and part of the second. On the
next day you want to add additional material to the
tape; in other words, you want to resume recording
where you left off the previous day. Notice what can
happen. You do not remember where you left off - on
side A or on side B and there is no cue in the configu­
ration of the device to tell you which (because the tape
is always in the machine on the same side - the ma­
chine switches for you). Thus there is the possibility
that you will simply initiate the record mode and begin
to speak without the second command needed to start
on side B. As a result, a portion of the material you had
recorded the previous day will be erased and recorded
over. Note that this is a new error form/negative out­
come; it is impossible with the manual machine - one
always begins to record where one left off previously.
The point is that new automation aids can have mul­
tiple effects within the cognitive triad and that some of
these effects can be negative. In other words, there are
post-conditions associated with new automation that
must be met otherwise errors/negative outcomes can
occur - in this example, some way to keep track of
which side of the tape is unrecorded (a display or mem­
ory aid) or for the machine to be capable of resum­
ing to record from the place where previous record­
ing stopped (further automation). The point is not
that new technology should be avoided - because the
automation does make possible significant improve­
ments. Similarly, the point is not that new technology
is always beneficial - because there are post-conditions
associated with its introduction that must be satisfied
in order for the potential to be achieved and for unde­
sirable consequences to be avoided or mitigated. Fur­
thermore, these post-conditions can strongly influence
the way the technology is used (or even the type of
technology used). One example of this has ocurred
in marine transportation (Perrow, 1984). Technology-
only driven increases in the machine power devoted
to navigation and collision avoidance did not signifi­
cantly reduce marine accidents (Gaffhey, 1982). This
spurred the U.S. marine community to continue to in­
crease levels of automation. However, the existence
of automation related accidents triggered the European
community to look at what we have called here the
cognitive system and to use machine power to enhance
total system performance (e.g., to reduce fixation er­
rors by encouraging communication of task relevant
information across cognitive agents).
There are several specific recent bodies of research
on human error. One rather well developed example
addresses slips in the execution of highly skilled rou­
tines or what have been often referred to as capture or
1.4. A SAMPLE OF CRITICAL ISSUES IN COGNITIVE ENGINEERING
substitution errors (Norman, 1981; Norman & Shal-
lice, 1980; Reason & Mycielska, 1982; Broadbent et
al., 1982). In slips the intention to act is correct;
the breakdown occurs in carrying out the intention.
Note that this body of research only addresses highly
practiced tasks.
Other bodies of work are focused on errors in inten­
tion formation. One of these - buggy models - attempts
to account for errors by inexperienced domain prob­
lem solvers (Brown & Burton, 1978; Brown & Van-
Lehn, 1980; Caramazza, McCloskey & Green, 1981;
McCloskey, 1983). Buggy models provide a spec­
ification of the knowledge structures (e.g., incomplete
or erroneous knowledge) and processes that are pos­
tulated to produce the pattern of errors and correct re­
sponses that characterize the performance of particular
individuals. These buggy models are typically embod­
ied as a computer program, and constitute a "theory"
of what these individuals "know" (including miscon­
ceptions) and how they utilize the knowledge. They
are a good example of the focus on limited rationality,
and the emphasis on analyzing and accounting for sys­
tematic error patterns that characterize recent trends
in error research. This contrasts with previous ap­
proaches to human performance that focused on more
global measures (e.g., percent correct). By providing a
micro-analysis of the misconceptions that lead to error-
ful performance, analyses of "buggy" knowledge open
the door for much more pointed achievement testing
(Gitomer & Glaser, in press) and more highly tailored
instruction than was previously possible. Buggy mod­
els are often incorporated as part of intelligent tutoring
systems (Sleeman & Brown, 1982; Anderson, Boyle
& Reiser, 1985). The major limitations of this ap­
proach has been that it requires a large amount of very
domain specific investigation to identify the range and
distribution of "buggy" models that arise in the domain
of interest (e.g., McCloskey, 1983). Further, the re­
sults have tended to remain highly context bound with
little transfer of insight from one domain to the next.
Brittle Problem Solvers and Unexpected Variability
One way that people behave in managing com­
plex technologies can be termed coordination by pre­
planned routines. In this mode of problem solving,
knowledge is packaged in terms of what situations are
to be recognized, what evidence signals that these sit­
uations have arisen, and what response should follow
(Rasmussen's rule based behavior, e.g., Rasmussen,
1986a). This knowledge is delivered in the form of ed­
ucation about the routines, training (exercise and drill)
17
in carrying out the recognitions and responses, and on­
line systems to help prompt and retrieve the guidance
(either paper or computer based). When human be­
havior is to be guided by pre-planned routines, human
performance aiding is to teach the person about the
knowledge encoded, especially the background for the
routines (Brown, Moran & Williams, 1982), to prac­
tice the person on the routines, and to provide retrieval
aids so that the person uses the correct guidance for
the current situation.
However, coordination by pre-planned routines is
inherently "brittle" (e.g., Brown et al., 1982; Roth et
al., 1987; Herry, 1986; Fischhoff et al., 1986). Be­
cause of both pragmatic and theoretical constraints, it
is difficult to build mechanisms into pre-planned rou­
tines that cope with novel situations, adapt to special
conditions or contexts, or recover from plan break­
downs. When the pre-planned routines are rotely in­
voked and followed, performance breaks down in the
face underspecified instructions, violations of bound­
ary conditions, or impasses (where the plan's assump­
tions about the world are not true), human execution
errors, bugs in the plan, multiple failures, and novel
situations (incidents not planned for). This is the prob­
lem of unanticipated variability.
While some types of worlds or parts of worlds are
more prone to these factors than others and the quality
of the pre-planning effects the frequency with which
these arise in particular worlds, research in a variety
of worlds consistently has shown that these factors
can never be completely eliminated by expanding and
refining pre-planned routines (for both pragmatic and
theoretical reasons) and that these factors are ubiqui­
tous in actual serious accidents in risky technologies
(Pew et al., 1981; Rasmussen et al., 1987; Hirshhorn,
1984; Perrow, 1984). The potential for unanticipated
variability in a problem solving world is higher for
worlds that are highly dynamic and highly coupled,
when the degree of uncertainty is high and when there
are significant consequence to potential outcomes. In
worlds where all of these factors are high, such as nu­
clear power plants control rooms, commentators like
Perrow (1984) and Reason (1987) have likened the
cognitive environment to a "minefield of human er­
ror."
Usually, people think that the only alternative to co­
ordination by pre-planned routines is creative problem
solving, but that practitioners are rarely selected for
capabilities in this area. As Reason (1987) points out,
people are rarely good or reliable enough at creative
problem solving for this to be an acceptable mode of
problem solving in risky worlds. However, there is
18
an alternative type of problem solving behavior which
effective practitioners employ. In coordination by re­
source management, an actor on the scene does more
than deploy pre-planned strategies; he or she also mon­
itors and adapts plan execution. The world's responses
are monitored to see if it is behaving as expected (e.g.,
are the relevant goals met? has an execution error oc­
curred? have systems performed as demanded?). De­
partures from plan signal that more knowledge needs
to be brought to bear to adapt or fill in pre-planned
responses given the unusual situation. What happens
is that there is a gradual unfolding of more and more
of the background knowledge behind the pre-planned
material or specialist knowledge about the unusual sit­
uation. In some cases, the relevant knowledge is po­
tentially available if a delivery path is known, i.e.,
the practitioner must know enough to ask the right
question and they must know where or who can pro­
vide relevant information or answers. There have been
many incidents where, with hindsight, the appropriate
guidance was available although not activated in the
context of the actual incident (Woods, 1984a). In other
cases, knowledge about how to adapt the plan must be
generated. This involves conceptual knowledge about
the domain (Hiebert & Lefevre, 1986), e.g., knowledge
about relevant goals and means and about constraints
(side effects, pre-conditions, post-conditions), and of­
ten the interaction of several sources of knowledge or
points of view (e.g., Coombs & Hartley's examples of
model generative reasoning).
Aiding human performance in coordination by re­
source management addresses recognizing departures
from plan, deciding what additional knowledge is
needed, and how to call on that knowledge - plan mon­
itoring, plan adaptation, plan repair. It is interesting
that Roth et al. (1987) found that the human's ac­
tual role is to amplify the machine expert's ability to
cope with unanticipated variety in the world and in the
problem solving process.
In virtually every significant disaster or near dis­
aster in risky technologies, there has been some point
where knowledge beyond the pre-planned routines was
needed. Furthermore, this point often involves multi­
ple people in multiple locations with only partial infor­
mation about the state of the system. This means the
need to think about the problem solving organization,
about how knowledge is tunneled to the operational
staff, about who has responsibility and authority for
what decisions (see van Creveld, 1985 and Fischhoff
et al., 1986 for examples of failures in problem solving
organizations in military command and control).
Both kinds of coordination are necessary for effec­
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
tive human performance at the operational front lines:
expanding and refining available guidance expands the
amount of routine problem solving; supporting coor­
dination by resource management addresses situations
that have not been or cannot be completely anticipated
- a kind of cognitive defense in depth. This is a critical
challenge to cognitive engineering - how to avoid brit-
tleness in the face of unanticipated variability. Design
to manage trouble as well as design to prevent trouble
is needed for effective problem solving systems (Ack-
off, 1981; Brown & Newman, 1985). Reason (1987)
points out the difficulties of this challenge, especially
in risky technologies: significant events in natural sys­
tems almost always involve novel or unexpected fea­
tures; how then do we prepare or support practitioners
to recognize and cope with these unanticipated situa­
tions?
1.5 Towards Effective Decision Support
Given that one can characterize agent-environment re­
lationships in problem solving worlds, the question for
cognitive engineering is how to enhance overall per­
formance. In principle, there are degrees of freedom
in adjusting any of the three elements in the cogni­
tive system triad to produce a better demand-resource
match. The problem solving world itself can be re­
designed. For example, the degree of coupling in a
highly coupled world can be reduced if errors that
arise from this dimension (e.g., missing side effects)
are a problem. Or a world with multiple modes can
be re-designed (since people are prone to mode errors)
so that there is only a single mode. But usually, the
designer has the greatest latitude to enhance perfor­
mance by varying the online or offline representations
by which the agents come to know the problem solv­
ing world or by varying the presence and architecture
of multiple, especially machine, cognitive agents.
How does one use machine resources to enhance
overall performance? In the next sections we will ex­
amine some of the research on this question, first, from
the point of view of decision aids as semi-autonomous
cognitive agents - the problem of interfacing human
and machine cognitive agents or joint human-machine
cognitive systems (Woods, 1986; Woods et al., in
press). This includes questions about what is good ad­
vice between cooperative problem solving agents and
what are effective cognitive tools. In the subsequent
sections, we will examine work on another approach to
improve human problem solving - representation aids.
Because of the expansions in computational powers,
the machine element can be thought of as a partially
I5. TOWARDS EFFECTIVE DECISION SUPPORT
autonomous cognitive agent in its own right. But this
is a case with which we have little experience, and it
raises the problem of how to build a cognitive system
that combines both human and machine cognitive sys­
tems or, in other words, joint cognitive systems (Holl-
nagel, Mancini & Woods, 1986; Mancini, Woods &
Hollnagel, in press).
One metaphor that is often invoked to guide our
thinking about how to utilize intelligent machine re­
sources is based on an analogy to human-human coop­
erative problem solving. Because the machine element
can be considered as a semi-autonomous cognitive sys­
tem, we can begin to understand human interaction
with a machine cognitive agent by transposing how
two people interact during problem solving. Follow­
ing this metaphor leads Muir (1987) to raise the ques­
tion of the role of "trust" between man and machine
in effective performance. For example, how does one
come to know another's range of competence. This
metaphor also suggests that machine and human cog­
nitive agents might sucessfully interact by paralleling
how one person advices another during problem solv­
ing.
A second metaphor that is frequently invoked is su­
pervisory control (Sheridan & Hennessy, 1984; Ras-
mussen, 1986a; Sheridan, 1988). Again, the machine
element is thought of as a semi-autonomous cognitive
system, but in this case, it is a lower-order subor­
dinate, albeit partially autonomous. The human su­
pervisor generally has a wider range of responsibility,
and he or she possesses ultimate responsibility and au­
thority. Boy (1987) uses this metaphor to guide the
development of assistant systems built from AI tech­
nology. In order for a supervisory control architecture
between human and machine agents to function effec­
tively there are several requirements to be met which,
as Woods (1986) has pointed out, are often overlooked
when tool-driven constraints dominate design. First,
the supervisor must be able to re-direct the lower or­
der machine cognitive system. Second, in order to be
able to supervise another agent, there is need for a
common or shared representation of the state of the
world and of the state of the problem solving pro­
cess. Otherwise, communication between the agents
will break down (e.g., Suchman, 1987).
A third metaphor is to consider the new machine
capabilities as extentions and expansions along a di­
mension of machine power. In this metaphor, ma­
chines are tools; people are tool builders and tool users.
Technological development has moved from physical
tools (tools that magnify man's capacity for physical
work), to perceptual tools (extentions to man's per-
19
ceptual apparatus such as medical imaging), and now,
with the arrival of AI technology, cognitive tools (al­
though this type of tool has a much longer history,
e.g., aide-memoires or decision analysis, AI has cer­
tainly increased the interest and capability to provide
cognitive tools).
What is Good Advice?
Human-human advisory encounters have been exam­
ined in a number of different contexts including face-
to-face advice on using a local computer system (Alty
& Coombs, 1980; Coombs & Alty, 1980; McKendree
& Carroll, 1986) and radio talk show "call in" advice
on finance management (Pollack et al, 1982). The
results uniformly indicate that good advice is more
than recommending a solution. Good advisory inter­
actions involve cooperative problem solving. The ad­
visor does not merely respond to the immediate request
of the user, rather he/she aids the user in problem for­
mulation and plan generation (especially with regard
to obstacles, side effects, interactions and tradeoffs).
The advisory encounter aids the user to determine the
right questions to ask; how to look for or evaluate pos­
sible answers; and how to develop or debug a plan of
action to achieve his goals (Jackson & Lefrere, 1984,
p. 63).
For example, Alty and Coombs (1980; Coombs &
Alty, 1980), who examined consulting interactions on
the use of a local computer, found that in more suc­
cessful advisory interactions, two partial experts (expe­
rienced computer user with a domain task to be accom­
plished and a specialist in the local computer system)
cooperated in the problem solving process. Control
of the interaction was shared in the process of iden­
tifying the important facts and using them to better
define the problem. In this process each participant
stepped outside of his own domain to help develop a
better understanding of the problem and, as a conse­
quence, appropriate solution methods. In another case,
Perkins & Martin (1986) found that one third of the
errors made by student programmers were corrected
with general hints that did not require knowledge of
the solution to the problem or the specific bug.
In contrast, Alty and Coombs found that unsatisfac­
tory human-human advisory encounters were strongly
controlled by the advisor. The advisor asked the user
to supply some specific information, mulled over the
situation, and offered a solution with little feedback
about how the problem was solved. While a prob­
lem was usually solved, it was often some proximal
form of the user's real problem (i.e., the advisor was
20
guilty of a form of solving the wrong problem: solving
a proximal case of the user's fundamental problem).
The advisor provided little help in problem definition.
Analyses of human-human advisory interaction
clearly reveal the elements of good advice, and point to
the features required for effective joint cognitive sys­
tems. Machine decision support must be more than a
solution plus justification; it must be structured around
the problem solving process and involve close coop­
eration with the user in formulating the problem, and
identifying and evaluating solution paths (Perkins &
Martin, 1986). The function of an "advisor" (man or
machine) is to broaden the user's horizons; to raise and
help answer questions like (e.g., Woods et al., in press;
Woods & Hollnagel, 1987): What would happen if?
Are there side effects to this response? How do x and
y interact? What are the pre-conditions (requirements)
and post-conditions for a particular response (given the
response, what consequences must be handled)? Is the
world heading towards undesirable states? How can
these states be avoided? How can one escape from
an undesirable state without triggering negative out­
comes?
The common assumption is that reflection
generates dialogue, when, in fact, it is di-
alouge that generates reflection. Very often
when people engage in dialogue with one an­
other, they are compelled to reflect, to con­
centrate, to consider alternatives, to listen
closely, to give careful attention to defini­
tions and meanings, to recognize previously
unthought of options, ... Lipman, Sharp &
Oscanyan, 1980, p. 22.
Studies of human-human advisory interactions re­
veal another important characteristic of joint cognitive
systems: the relationship between the kinds of skills
and knowledge represented in the human and in the
machine. The human user of decision tools is rarely
incompetent in the problem domain. Even when the
design intent is to reduce human skill and knowledge
requirements, significant amounts of domain knowl­
edge are required for minimal capabilities to under­
stand and execute machine instructions (Roth et al.,
1987). The relation of human to machine is not one
of novice to expert; instead, the human and machine
elements contain partial and overlapping expertise that,
if integrated, can result in better joint system perfor­
mance than is possible by either element alone. To­
day, no one expert in any field can keep up with the
amount or rate of change of information. The result
is the generalist- specialist problem. To cope with this
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
complexity an individual brings a single point of view
on the actual domain or bounds the domain. One ma­
jor source of unanticipated variability arises when the
different points of view must be combined or when the
bounded domain confronts the actual context. Thus,
naturally ocurring problems more and more require the
integration of different specialities, each of which con­
tributes a unique point of view (e.g., Hawkins, 1983;
Coombs & Alty, 1984; Coombs, 1986; Gadd & Pople,
1987). One kind of expertise is the ability to evalu­
ate and integrate specialist knowledge in some real
problem context. As a result, the designer of a joint
cognitive system must address the question of what is,
or what should be, the relationship between machine
expertise and human expertise in a given domain: is
the person a generalist who manages and integrates in­
put from various machine implementations of special­
ist knowledge? is the human one specialist interacting
with the knowledge of other specialists to deal with
a problem at the junction of two fields? Effective in­
teractions between these kinds of partial, overlapping
experts (which we suspect will be a prevalent type of
joint cognitive system) requires that knowledge from
different viewpoints is integrated during the decision
process, including problem formulation and plan mon­
itoring/adaptation. For example, Pople (1985) models
an IDS system on the interactions between multiple
medical specialists that occur, often informally, when
one of them encounters a difficult problem.
How can the IDS designer package and deliver "ef­
fective advice" to domain practitioners? Too often
and in contrast to the above results, designers of con­
sultant systems implicitly assume that "advice" is syn­
onymous with outputing an answer, that is, solving the
problem for the practitioner. For example, Zisner &
Henneman (1988), and Resnick et al.,(1987) contain
examples of laboratory based machine advisors which
simply recommended a solution to the human problem
solver were ignored.
There are several challenges in formulating and
delivering advice. What is the appropriate level of
context-sensitivity and specificity to aim for in gener­
ating advice? Should the system attempt to generate
advice under all conditions or only for those situa­
tions where the appropriateness of the advice can be
assured? Should the system generate highly specific
micro-reponses or should it generate more global in­
formation leaving the operator degrees of freedom in
deciding how to instantiate the advice? While good
micro-advice may be the ideal, there are a host of as­
sociated problems in achieving this.
Accurate judgment of the most appropriate specific
1.5. TOWARDS EFFECTIVE DECISION SUPPORT
response is often very difficult because the "best" re­
sponse depends on extensive context-specific informa­
tion and because of the danger of providing inapropri-
ate advice. Micro-advice is antithetical to the formu­
lation of flexible, adaptive responses to unanticipated
variability that characterizes skilled performance, be­
cause it provides no context or rationale for the advice
provided (what process state is the advice a response
to? what is the expected outcome of this response?).
This applies both with respect to inhibiting the ability
of the practitioner to formulate an adaptive response
to an unanticipated situation at a given point in time
and with respect to the ability of the practitioner to
develop adaptive skill over time. Micro-advice is also
deficient when the practitioner's role demands paral­
lel processing of multiple tasks. In order to resolve
goal competition that can arise in this kind of situ­
ation, good performance requires formulating global
control strategies or plans of action and changing level
of abstraction during plan adaptation and repair (Ras-
mussen, 1986a; Alterman, 1986). The global strategic
response to whole situations is missing from micro-
advice.
In contrast, global advice is likely to be more robust,
in the sense that the advice will be correct, but it risks
the danger of being vague or stating the obvious. The
problem is how to define a level of advice that is spe­
cific enough to be useful without being over-specific
and risking the danger of brittleness - incorrect advice
due to a failure to consider all the relevant contextual
variables.
In dynamic worlds one can take advantage of the
fact that as the situation worsens the degree of poten­
tial ambiguity about what are appropriate responses
decreases. Thus, the machine advisor can be quies­
cent when the system is relatively stable or normal
and gradually output stronger and more specific re­
sponse advice as the situation worsens. This approach
to interfacing advisor and domain actor balances sev­
eral constraints on what is good advice: deh ver advice
in those situations where one can generate clearly ap­
propriate information, but interject advice only when it
is needed (which implies an understanding of the state
and likely future course of the problem solving pro­
cess and which tends to be an inverse function of how
easy it is to generate relevant advice), and preserve
the operator's initiative and flexibility in responding
to situations beyond the capacity of the advisor (cf.,
Roth et al., in press).
Another challenge in characterizing an advisory sys­
tem is defining the scope of the advice - what is the
breadth of problems for which advice can be provided.
21
There are strong pressures to bound the problem nar­
rowly to ensure completeness of coverage (to get a
machine advisor to generate any kind of output). How­
ever, in trying to keep the scope bounded there is a
danger of taking an overly narrow perspective (e.g.,
focusing on single fault problems in troubleshooting
domains or on a very narrow subspecialty in medical
diagnosis) and producing a support system that is not
useful to practitioners. Narrowly conceived advisors
typically handle too little of the range of challeng­
ing cases actually encountered or the advice offered
is unrealistic, a nuisance or erroneous4. The bound­
ing problem is particularly challenging in the case of
highly coupled worlds.
Advice should be presented in the context of the as­
sessment of current (and future) state of the world to
create a shared frame of reference for the person and
machine (Woods and Roth, 1988). By having access to
the same information as the machine expert, the prac­
titioner is in a better position to evaluate the soundness
of the state assessment that served as input to the ma­
chine expert's decisions. This, combined with explicit
statement of intended objectives of recommended re­
sponses, allows the practitioner to follow the line of
reasoning and evaluate the quality of the advice. This
common frame of reference concept for explaining the
behavior of intelligent machines is designed to avoid
the ubiquitous problems associated with opaque advice
(Roth et al., 1987; Suchman, 1987).
Cognitive Tools
What are cognitive tools and how should they be de­
ployed? One approach often adopted implicitly or ex­
plicitly is to design IDS systems as prostheses - a re­
placement or remedy for a deficiency. In one sense
all tool use implies a human deficiency with respect to
some goal - if we had hard hands, we would not need
hammers. Most current expert systems are cognitive
tools in this sense. In the cognitive tool as prosthesis
paradigm, the primary design focus is to apply compu­
tational technology to develop a stand-alone machine
expert that offers some form of problem solution. The
"technical" performance of this system is judged in
terms of whether the solutions offered are "usually"
correct (e.g., Yu et al., 1979). This paradigm empha­
sizes tool building over tool use. Questions about how
to interface human to machine are secondary to the
primary design task of building a machine that usually
4
A common pitfall of intelligent systems is that the range of
problems it can solve is nearly isomorphic to the range of problems
the target user is able to solve for him or herself.
22
produces correct decisions. A typical encounter with
an "intelligent" computer consultant developed in this
fashion consists of the following scenario: the user
initiates a session; the machine controls data gather­
ing; the machine offers a solution; the user may ask
for "explanation" if some capability exists; the user
accepts (acts on) or overrides the machine's solution
(Woods, 1986).
What is the joint cognitive system architecture im­
plicit in this paradigm? The primary focus is to apply
computational technology to develop the machine ex­
pert. In practice, putting the machine expert to work
requires communication with the environment - data
must be gathered and decisions implemented Rather
than automate these activities they are typically left for
the human (Figure 2). Thus, questions about support
for the human portion of the ensemble become not so
much how to interface the machine to the human, but
rather, how to use the human as an interface between
the machine and its environment. As a result, locus
of control resides with the machine portion of the en­
semble, and human-machine interface design focuses
on features to aid the person's role as data gatherer
(e.g., Mulsant et al., 1983) and on features to help the
user accept the machine's solution.
The passive role assigned to the human in the
machine-as-prosthesis paradigm echoes the description
of unsatisfactory advisory encounters found in empir­
ical studies of human to human interactions described
earlier. The results of that empirical literature fore­
shadow the critical flaws in the joint cognitive system
implicit in the prosthesis approach to decision aiding
(Woods, 1986; Roth et al., 1987), i.e., breakdown in
the face of unanticipated variability.
An alternative approach to IDS is to conceive of
decision aids as instruments, that is, a means for ef­
fecting something in the hands of a competent prac-
tioner (cf., von Winterfeldt & Edwards, 1986). People
are a generalized species - we work fairly well in a
wide range of environments (almost all man-made to­
day). It is the ability to develop, adapt and utilize
tools that supports specialization in any particular en­
vironment - if we had hard hands, we might make
good carpenters, but we would be poor pianists. From
this vantage point, our tool building/using skills are
resource utilization in the pursuit of a goal. For exam­
ple, when I am working to repair my car and I see that
I need to manipulate something around a comer where
my hand cannot reach, I then look for an instrument
that affords manipulation around an angle - perhaps a
flexible manipulator is nearby or perhaps I can bend
an extra pair of needle nose pliers. The point is that
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
Machine Expert
A
Human
Solution Data
Filter Gatherer
Y
Environment
Figure 2: The architecture of the joint human-machine
cognitive system implicit in the prosthesis approach to
cognitive tools (From Woods, 1986).
tool use involves an active role for the tool wielder
in some instrumental context, whereas the cognitive
tool as prosthesis view leaves the tool user with a pas­
sive role. Anyone who has worked with practitioners
in some field has seen the tools that the practitioners
fashion to help them carry out their jobs, even tools to
help them work around the hindrances often created
by the "tools" that they are given or to make these
"aids" actually useful.
Fundamentally, the difference between the cognitive
tools as prosthesis approach and the cognitive tools as
instrument approach to joint cognitive system design
is a difference in the answer to the question "what is
a consultant." One definition of a consultant is some
one (thing) called in to solve a problem for another, on
the asssumption that the problem was beyond the skill
of the original agent. Given this definition, the impor­
tant issues for building decision aids is to build better
automated problem solvers and to get people to call
on these automated problem solvers (the acceptance
problem). The instrumental perspective, on the other
hand, defines a consultant as a reference or source
of information for the problem solver. The problem
I.5. TOWARDS EFFECTIVE DECISION SUPPORT
solver is in charge; the consultant functions more as
a staff member. As a result, this view of joint cog­
nitive systems stresses the need to use computational
technology to aid the user in the process of solving
his problem. The human's role is primarily to achieve
total system performance objectives as a manager of
knowledge resources that can vary in kind and amount
of "intelligence" or power.
In order to put more knowledge in the hands of
the human problem solver, first, raw domain data can
be massaged into forms that more directly answer the
questions the human problem solver must face as prob­
lems unfold. Machine resources can compute such in­
formation as, when is a domain goal violated, when
one alternative is prefered over others, are there al­
ternative response strategies, what data are potentially
relevant, what are the post-conditions that follow from
a strategy, what are the preconditions that must be met
before a strategy can be implemented (e.g., Woods &
Hollnagel, 1987). This means that knowledge about
what the computations carried out by the machine sig­
nify about the domain (i.e., the domain's semantic
structure) must be used explicitly or implicitly to struc­
ture machine power for human utilization. Second, the
human problem solver must have capabilities to utilize
and direct these computational resources. To build
human-machine cognitive systems of this type, there
is a need for techniques and concepts to determine
what knowledge resources are needed by a domain
problem solver and how to integrate and communicate
these results as appropriate during the problem solving
encounter.
The instrumental view of tools emphasizes the role
of adaptability in intelligent behavior. Research on
human performance reveals that skill is the capability
to adapt behavior to changing circumstances in pursuit
of a goal (e.g., Woods, 1984a), and some philosophers
argue that rationality is intellectual adaptability (Toul­
min, 1972). This means that the power or intelligence
of an IDS system is related to its ability to increase
the human problem solver's adaptability to the kinds
of problems that could arise in the pursuit of domain
goals. While a large amount of research on intelligent
interfaces focuses on building interfaces that adapt to
different users independent of a problem world, for
example, adapting to different user styles or to differ­
ent stages of learning, the above suggests that research
should focus more on increasing the range of problems
solvable by the human-machine ensemble.
Psychologists are fond of discovering biases in hu­
man decision making. One judgemental bias is the
overconfidence bias where people at all levels of ex­
23
pertise overestimate how much they know (e.g., Wa-
genaar, 1986). However, we sometimes forget that
these biases can apply to the designers of machines
as well as to the users of machines. This means that
the designer of an IDS system is likely to overesti­
mate his/her ability to capture all relevant aspects of
the actual problem solving situation in the behavior of
the machine expert. This result has often happened
with other forms of automation and support systems
- the designer of the system fails to appreciate all of
the variability and complexities of the operational set­
ting so that the system fails to support or even hin­
ders the human problem solver in achieving his/her
goals. For example, operators quickly learn the sig­
natures of automatic controllers - when they are so
unreliable that the task must be performed manually,
when they are highly sensitive to disruptions and must
be very closely monitored, when they are adequate
to the task and require little supervision (e.g., Roths
and Woods, 1988). The result, in accordance with
Ashby's law of requisite variety, is that as automation
increases, the human's role is increasingly to amplify
the machine's ability to cope with the unanticipated
variety in the world or in the problem solving process.
(Note the irony that increased automation is often jus­
tified on grounds of human incompetence, yet in prac­
tice it is often that same person who must now help
the machine to cope with disturbances beyond its de­
sign range, c.f.e.g., NUREG-1154 for one real world
example from nuclear power plants emergencies; the
Hoogovens Report for a case in the automatization of
a rolling mill; Hirschhorn, 1984 for examples from
manufacturing technologies; Noble, 1984 for exam­
ples from numerical control; and Perrow, 1984).
A study reported in Roth, Bennett & Woods, (1987)
makes salient the need for adaptive problem solving
and the brittleness of response inherent in the prosthe­
sis approach to decision aiding. The study examined
actual technicians attempting to troubleshooting real
devices with the aid of an expert system built within
the decision-aid-as-prosthesis paradigm. They were
able to observe human-machine interaction in the face
of unanticipated variability because novel situations
arose (problems outside the machine's competence),
adaptation to special conditions was required, instruc­
tions were underspecified, and recovery from human
or machine errors was demanded.
The expert system was designed under the assump­
tion that the user would be assigned a passive role of
basically following instruction. In fact technicians var­
ied in the degree to which they were willing to fit that
mold, with some asserting a more active role in the
24
problem solving process. The opportunity to observe
both passive and active human problem solvers inter­
act with a machine expert in the face of unanticipated
variability revealed how the prosthesis approach to de­
cision aiding leads to an impoverished joint cognitive
system and its consequences for joint system perfor­
mance. Contrary to the assumptions underlying the
prosthesis approach to decision aiding, troubleshooters
actively and substantially contributed to the diagnostic
process. The more the human functioned as a passive
data gatherer for the machine, the more joint system
performance was degraded. Those who passively fol­
lowed the directives of the machine expert dwelled on
unproductive paths and reached dead-ends more often
than participants who took a more active role. Further­
more, because comprehension of instructions depends
on active participation (Bransford & Johnson, 1983;
Britton & Black, 1985; Smith & Goodman, 1984),
the passive troubleshooters made more errors that con­
tributed to unproductive paths.
In contrast, active human participation in the prob­
lem solving process led to more successful and rapid
solutions. The active technicians attempted to cope
with unexpected conditions, to monitor machine be­
havior, to recognize unproductive directions, and to
redirect the machine to more productive paths (within
the limited means available) based on activities and
judgements formed outside of the machine's direction.
However, the prosthesis design of the machine expert
not only failed to support an active human role, it ac­
tually retarded technicians from taking or carrying out
an active role. The machine expert provided few cues
as to its intentions in pursuing a line of diagnosis and
little possibilities for redirecting its resources. This in­
hibited the human problem solver in his role as a man­
ager of a semi-autonomous resource - to monitor the
performance of the subordinate agent in order to detect
when it is offtrack and to redirect it (again, the same
result has occurred with the introduction of other forms
of automation when the human's supervisory role has
been ignored, e.g., the Hoogovens Report, 1976).
When the technician reached a point where the line
of questioning seemed to be focused in an unproduc­
tive direction or the system generated a hypothesis that
was suspect, the technician had to decide whether the
machine expert was still on track or not. The tech­
nician did not have access to the machine's percep­
tions of current world state nor to its troubleshoot­
ing strategy. Consequently, he had no way of know­
ing whether the system was systematically working
through hypotheses and would eventually reach the
correct one, whether the machine expert misperceived
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
the state of the device, possibly because of an input
error on the technicians part, or whether the system
was beyond its boundery of competence and respond­
ing erratically. Failing to find an input error, the only
basis for evaluating whether the system was on track
was to judge the plausibility of the line of reasoning
based on his own perceptions of device state and his
assessment of plausible lines for diagnosis and tenable
hypotheses under those conditions. Thus, he is forced
to work through the diagnosis process independently
and in parallel rather than build on top of the informa­
tion processing work carried out by the machine.
These results illustrate many of the issues that arise
when machine power is deployed in actual work con­
texts. The capability to build more powerful machines
does not in itself guarantee effective performance. The
conditions under which the machine will be exercised
and the human's role in problem solving affect the
quality of performance. This means that factors related
to tool usage can and should affect the very nature of
the tools to be used.
The breakdowns observed in human interaction
with an "intelligent" machine do not reflect prob­
lems unique to dealing with "intelligent" systems.
They are ubiquitous to systems in a variety of media
and technologies, built according to the machine-as-
prosthesis philosophy (e.g., Smith & Goodman, 1984;
Hoogovens Report, 1976; Suchman, 1987). One of the
main sources of problem is the reliance on pre-planned
solution paths which inevitably fail in the face of the
unanticipated variability (e.g., Fischhoff et al., 1986;
Brown et al., 1982).
Domain actors do more than deploy pre-planned
strategies; they also monitor the response for viola­
tions of expectation (e.g., are the relevant goals met?).
Departures from plan (from expectation) signal that
more knowledge needs to be brought to bear on the
problem. Computational power can be used to gather
and deliver the resources needed to recognize cases
beyond the boundaries of pre-planned material, and
to unfold or deliver additional knowledge to modify
plans in light of changing circumstances.
There are several simple steps that can be taken
to convert the power of the machine expert into a
more instrumental form. One is to make the ma­
chine's knowledge about the state of the device, viable
hypotheses, and diagnostic directions available to the
human (Roth, Butterworth, & Loftus, 1985; Fitter &
Sime, 1980). This means that these aspects of ma­
chine knowledge must be represented explicitly (e.g.,
the shift from Mycin to Neomycin, cf., Clancey, 1983;
cf. also, Gruber & Cohen, 1987). Another step is to
1.5. TOWARDS EFFECTIVE DECISION SUPPORT
provide more capabilities for human control of the ma­
chine's reasoning. This includes mechanisms for the
human problem solver to add to or change the infor­
mation or knowledge that the machine is using about
the state of the device and regions where the fault may
lie (Roth, Elias, Mauldin & Ramage, 1985). Moie am­
bitious use of machine power can provide the human
with facilities to explicitly manipulate the attention of
the machine expert. For example, Pople (1985) has
developed mechanisms to allow users to direct the di­
agnostic path pursued by the Caduceus expert system
for internal medicine.
Conceptualization Aids
How can we avoid the deficiencies of the prosthesis
approach? Consider what kinds of power cognitive
tools could provide. Physical tools magnify the user's
capacity for physical work; perceptual tools extend
the user's perceptual range. For knowledge environ­
ments, tools can provide calculation power (the origi­
nal use of computer technology), search and deductive
inference power5 (support for more complete utiliza­
tion of available evidence), economy of representation
through frame-based representation technology (e.g.,
Walker & Stevens, 1986), and an extended ability to
conceive of both the problem to be solved and possible
paths to solutions, i.e., conceptualization power.
Both the designer of IDS systems (really any ma­
chine) and the target users of IDS systems face a com­
plex, ill defined problem solving task: how to cope
with unanticipated variability and avoid brittleness?
The best help we can provide to people engaged in
these tasks may be conceptualization power through
• enhancing their ability to experiment with possi­
ble worlds or possible strategies (e.g., Pew et al.,
1986; Woods et al., 1987; Wiecha and Henrion,
1987),
• enhancing their ability to visualize, or make con­
crete, the abstract or uninspectable (analogous to
perceptual tools) in order to:
- better see the implications of a concept or
change in the world (Hutchins, Hollan & Nor­
man, 1985; Mitchell & Saisi, 1987),
- help one restructure his view of the problem
(e.g., Pople, 1985; Coombs & Hartley, 1987),
5
But there are other forms of reasoning that people may and
should be using, e.g., Cheng et al., 1986; as Mill commented, "Logic
neither observes, nor invents, nor discovers."
25
• to enhance error tolerance by providing better
feedback about the effects/results of actions (not
that errors are not made but that error detection
and correction is enhanced so that errors do not
propagate; e.g., Rasmussen, 1986a; Perkins &
Martin, 1986; Rizzo et al., in press).
The most important contribution of AI technology
to decision support in the long run may well be in
cognitive tools that amplify human powers of concep­
tualization.
The critical importance of conceptualization power
(which could be amplified by appropriate tools) in
effective problem solving performance is often over­
looked because the part of the problem solving process
that it most crucially effects, problem formulation, is
often left out of studies of problem solving. We study
diagnosis independent of evidence gathering or plan
generation independent of plan monitoring and adap­
tation or diagnosis only when possible categories have
been completely enumerated (converting the problem
to one of classification; e.g., Clancey, 1985; Nickles,
1980). The problem formulation aspect can be neatly
finessed in the design world by establishing bounding
constraints on the problem. For example, the designer
of a machine problem solver may assume that only
one failure is possible in order to completely enumer­
ate possible solutions and, therefore, use classifica­
tion problem solving techniques. However, the actual
problem solver must cope with possibility of multiple
failures, misleading signals, interacting disturbances
(e.g., Pople, 1985; Woods & Roth, 1986). In this ex­
ample note that the difficulty arises, in part, because
the designer defines the design problem to be solved
in terms of the tools available to him or her. The
cost of underemphasizing the role of problem formu­
lation and reformulation is particularly high if more
adaptive behavior is required to improve performance,
for example how to adapt a plan given non-success
on an element of the original plan (Alterman, 1986)
or how to revise one's situation assessment in a dy­
namic, event-driven world (Woods & Roth, 1986).
Conceptualization power as an aid to problem for­
mulation and as a means to cope with unanticipated
variability suggests several kinds of IDS systems. One
approach is to deploy machine power in the form of an
agent who comments or critiques human problem solv­
ing (e.g., Coombs & Alty, 1984; Langlotz & Shoit-
liffe, 1983; Miller, 1983). Systems built in this mold
consist of a core automated problem solver plus other
modules that use knowledge about the automated prob­
lem solver's solution and solution path, knowledge of
the state of the user-computer interaction, and knowl-
26
edge of the user's plans/goals in order to warn the
user, to remind him of potentially relevant data, and
to suggest alternatives.
A similar approach is to help the human problem
solver construct and evaluate alternative world views
that could explain the available data (Pople, 1985).
The problem becomes better understood and a solution
emerges as the user directs the machine's attention to
different subsets of the data, different domain issues,
and different hypotheses much as one person with a
difficult problem will bounce data, interpretations, and
issues off of colleagues to help refine his understand­
ing of the problem. Coombs (1986) and Coombs &
Hartley (1987) are working to develop model gener­
ative reasoning techniques for machine problem solv­
ing where the machine itself builds alternative models
based on available evidence and then manipulates and
evaluates the models to generate possible solutions.
Another path is representation aids that use direct
manipulation and graphic techniques to help the human
problem solver find the relevant data in a dynamic
environment, visualize the semantics of the domain
(that is, make concrete the abstract), and restructure
his view of the problem. In this approach, machine
power is used to create and manipulate representations
of the target world, rather than to create autonomous
machine problem solvers.
1.6 External Representations and Hu­
man Problem Solving
A basic fact in cognitive science is that the repre­
sentation of the world provided to a problem solver
can affect his/her/its problem solving performance (see
Mayer, 1983, Fischhoff, 1978, or Lenat & Brown,
1984 which is a particularly poignant example of this
in machine problem solving).
A compelling example of how different represen­
tations of a problem can affect user performance is
provided by Cole (1986). The example is a classic
problem in diagnostic inference (Casscells, Schoen-
berger, and Grayboys, 1978):
As part of a general physical examination, an
asymptomatic 35 year old woman is given a
test for breast cancer and the test comes back
positive. This test has certain known charac­
teristics, namely that people with the disease
have a 95% probability of a positive test re­
sult and people without the disease have a
90% probability of a negative result. The
prevalence of breast cancer in 35 year old
CHAPTER I. COGNITIVE SYSTEMS ENGINEERING
SYM PTOM
DISEASE S no S
D .95 .05 1
noD 99.90 899.10 999
899.15 1000
Figure 3: Data for a case in cancer risk assesment in
contingency table form. From Cole (1986) and repro­
duced by permission.
women is one in 1000. Based solely on this
information, how likely is it that the woman
does in fact have breast cancer?
The most common response by both laymen and
physicians is 95%, yet the normative answer is less
than 1%. The rationale for such a low probability
becomes apparent if elements of the problem are pre­
sented in the form of a contingency table enumerat­
ing how 1000 people would fall into the four possible
logical categories (Figure 3). In Figure 3, the test's
sensitivity is .95 (95 of 100 people with the disease
will test positive); its specificity is .90 (10 of 100 peo­
ple people without the disease will test positive); the
cancer probability for a patient of this age is .001 (the
base rate or prevalence is 1 in 1000 people).
This representation of the problem makes more
salient the importance of the base rate information,
specifically it highlights that of those individuals show­
ing the symptom, there will be 100 (99.9) women
without the disease (false alarms) for every one (.95)
woman with the disease. As Cole points out, the con­
tingency table representation is superior to the lin­
guistic description as an aid to problem formulation
in several respects. Most importantly, it provides a
model for structuring the problem. The four slots in
the contingency table provides a template for the sorts
of calculations needed to think the problem through.
In addition, by filling in the slots in the table, it unbur­
dens the user from having to make those calculations,
and provides an external memory aid for the results
of the partial calculations. Performance can be im­
proved even more dramatically by the use of an ana­
logical representation that makes visually apparent the
relationship between false alarms (test results positive
without the disease - 100 in this case, coded by cells
marked with an S) and hits (test results positive with
the disease - 1 in this case, coded by darkened cells).
1.6. EXTERNAL REPRESENTATIONS AND HUMAN PROBLEM SOLVING
(Figure 4).
The representation makes visually apparent the re­
lationship between false alarms (test results positive
without the disease, coded by cells marked with an S)
and hits (test results positive with the disease, coded
by darkened cells). This representation of the problem
visually highlights the fact that of those individuals
showing the symptom, there will be 100 (99.90 with­
out the disease (false alarms) for every one (.95) with
the disease.
s conditions (Lees, 1983; Kragt & Bonten, 1983). When
ssssssssss
s sssssssss
s sssssssss
s sssssssss
s sssssssss
s sssssssss
s sssssssss
s ssssssss s
ssssssssss
■ ssssssss s
Figure 4: Data for the case shown in Figure 3. repre­
sented as a probability map (sensitivity = .95, speci­
ficity = .90, prevalence = .001). From Cole (1986) and
reproduced by permission.
As this example illustrates, one can re-interpret
questions about the display of data through a medium
as questions about how types of representations vary in
their effect on the problem solver's information pro­
cessing activities and problem solving performance.
Shifting questions about display/interface design to
questions about representation design allows one to
have independent but inter-related descriptions of the
displays/interface in terms of implementation technol­
ogy - hardwired control boards, semi-graphic display
technology, full graphic technology, or bit-mapped
graphics; full screen displays (no windows), tiled win­
dows, or overlapping windows - and in terms of di­
mensions of problem representations.
The perspective of representation design is im­
27
portant because there are many cases in the history
of person-machine systems where technology choices
contained serendipitous relationships between the form
and content of a representation (serendipitous in the
sense that the relationships were not intentional design
choices) were noticed and utilized by the human prob­
lem solver. For example in a process control applica­
tion, the position of a device usually controlled by an
automatic system was indicated via digital hardwired
counters. These counters happened to make clearly
audible clicks when device position changed. Opera­
tors were able to make use of the clicking sounds to
monitor this system because the clicks and click rate
contained information about the behavior of the au­
tomatic controller. Similarly, there are many cases
where changes in technology hindered user perfor­
mance because these serendipitous relationships dis­
appeared and no functional alternative was provided.
One example is tile annunciator based alarm systems
in process control plants and initial attempts to shift
to computer based chronological lists. Recent studies
have shown that the spatially distributed characteris­
tic of tile system supports operator extraction of many
forms of information about normal and abnormal plant
the tile technology was replaced with chronological
listing of the same data on abnormal conditions, the
shift from a spatial to a temporal organization that oc­
curred removed the serendipitous benefits provided by
the spatial organization inherent in the tile medium.
Because of this, the change in media collapsed, forc­
ing a return to the tile system (Pope, 1978).
The question for cognitive engineering is what are
the important dimensions of problem representations.
We will examine several issues in this area: fixed and
adaptive collection of basic data elements, analogical
representations, object displays, and multiple represen­
tations.
Fixed and Adaptive Collections
In complex worlds, a large amount of data is made
available through some medium (e.g., hardwired in­
struments, sets of VDU displays) to people who are re­
sponsible to control, troubleshoot and supervise these
worlds. The base from which representations of a
world can be constructed ultimately consists of directly
measured quantities. Subsets of these elemental data
must be gathered and processed to answer questions
during the problem solving process such as situation
assessment, disturbance/fault identification, goal set­
ting, response planning (cf., Woods & Roth, 1986).
28
The available data can be thought of as the evidence
the problem solver uses to answer questions, and usu­
ally there is a many to many mapping between the
available evidence and the questions to be answered.
Traditionally, human-computer interaction has fo­
cused on how to design for data availability - is the
available data legible and accessible. It is the domain
actor's task to use the available data to answer ques­
tions and detect and solve problems. Take the case of a
datum about a thermodynamic system which indicates
that valve x is closed. Most simply the message sig­
nals a component status. If the domain actor knows
that valve x should be open in the current context,
then the datum signifies a misaligned component. Or
the datum could signify that, with valve x closed, the
capability to supply material to resevoir H via path
A is compromised. Or given additional knowledge,
it could signify that the process to supply material to
resevoir H is disturbed (low flow or no flow). Fur­
thermore the significance of any of the above inter­
pretations depends upon the state of other parts of the
world (is an alternative available? is resevoir H inven­
tory important in the current context) and the person's
expectations about the world. To determine the sig­
nificance of the incoming datum, the problem solver
must collect and integrate other data. The perspective
of representation design shifts emphasis away from the
display of available data as signals to be interpreted to­
wards a focus on communicating what is signified by
the data. There are no a priori neutral representations
in this process; how data are collected and organized
can have significant positive and negative performance
consequences.
Data will be collected into groups given the char­
acteristics of the implementation technology (e.g.,
screens or windows within screens) and some type
of criterion such as device geography, physical sys­
tem boundaries, time (e.g., chronological lists of mes­
sages) and occaisionally domain goals to be achieved
or the function performed by parts of the device. The
collection of data into groups affects user informa­
tion processing depending on whether the collection
boundaries are fixed or adaptive, on the criterion used
to set the boundaries, and on the characteristics of the
problems the world poses. [Note that there also can
be collections of collections. As a result, users of­
ten have an information processing task at the level
of collecting collections of data as when the user has
available two or more independent VDUs or can as­
sign data to multiple independent windows. Moray
(1986) contains an example where a significant error
occurred in domain task performance due to the user's
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
decision about how to collect data collections.]
When the representation designer pre-selects fixed
collections of data, the effect of a particular definition
of collection boundaries on user performance depends
on the amount of across-predefined boundary search
that results. This quantity is a function of three factors:
(1) the degree to which the designer's choice of cri­
terion for collecting data anticipates the questions that
must be answered to perform domain tasks (a cogni­
tive demand-representation interaction factor), (2) the
characteristics of the representation in which the search
occurs that affect search performance across the pre­
defined boundaries, such as the issues associated with
parallel versus serial display (a representation- cog­
nitive agent interaction factor), and (3) the degree to
which the links between data sets and domain ques­
tions vary with context for a particular world and for
a particular collection criterion (a cognitve demand-
representation interaction factor).
The first factor is the degree to which the designer's
choice of criterion for collecting data anticipates the
questions that must be answered to perform domain
tasks. An example is that collecting data along physi­
cal system boundaries will not support collecting data
to answer questions about the status of a function
when the domain contains a many-to-many mapping
between systems and functions. There are two paths
that can be followed to match collection boundaries to
meaningful questions. One is an empirical path, as in
Henderson & Card (1986), where you look for pat­
terns in the data search behavior of people performing
the task and then use those patterns (a "locality prin­
ciple") to define collections (in Henderson & Card's
system this is rooms, i.e., collections of windows).
An alternative path is to analyze the domain problem
solving demands to determine what issues must be ad­
dressed or what questions must be answered and then
to collect the data that is relevant to that issue or ques­
tion (e.g., Goodstein, 1983; Mitchell & Miller, 1986;
Woods, 1986).
The second factor is the characteristics of the repre­
sentation in which the search occurs that affects search
performance across the predefined boundaries. An ex­
ample of this is the changes in search performance
(e.g., getting lost, keyhole effects, cognitive tunnel vi­
sion) that occur depending on the availability of spa­
tial cues to provide a link between data collections
(Woods, 1984b; Mitchell, 1985 and personal commu­
nication; Elm & Woods, 1985). This is the issue of
parallel versus serial display as it is called in dynamic
worlds (and is one of the important cognitive issues
behind the medium question of window management
I.6. EXTERNAL REPRESENTATIONS AND HUMAN PROBLEM SOLVING
tactics such as tiled versus overlapping windows). The
question is, given that there is too much data too be
seen at once (note that physically parallel display does
not mean all the data can be taken in one glance),
how can the representation design be manipulated to
help the problem solver find the right set of data at
the right time. Woods (1984b) extensively discusses
this issue and proposes a variety of techniques to aid
search across fixed collection boundaries (cf. also,
K. Norman et al., 1986), and empirical results that
indicate the utility of these techniques include Elm
& Woods (1985), Mitchell (1985, personal communi­
cation), Mitchell & Saisi (1987); Wiecha & Henrion
(1987a); Vicente (1987).
The third factor is the degree to which the links be­
tween data sets and questions vary with context for
a particular world and for a particular collection cri­
terion. An example of this factor occurs when the
data relevant to answer a question changes depending
on the state of the world (such as, the data used to
answer the question is there adequate material inven­
tory inside a container may depend upon whether the
material is in a liquid state or a gas/liquid mixture).
This is one factor that leads to the need for adaptive
collection.
Frequently, what data are relevant depends on the
state of the domain or the intentions of the problem
solver. In these cases, effective decision support can
be based on adaptive collection. In adaptive collec­
tion, how data are collected into groups is a parameter
that changes as a function of the state of the world
in question or as a function of inferred user intent.
Machine power is applied to manipulate the represen­
tation as a function of the semantics of the world. Ex­
amples include automatic blowup/suppression of detail
(e.g., Furnas, 1986), dynamic menus, adaptive collec­
tion of relevant sets of data as a function of device
state such as adaptive presentation of a subset of the
possible side effects of a course of action (e.g., Miller,
1983) and adaptive collection of relevant sets of data
as a function of inferred user domain intent such as the
RABBIT system for data base query (Williams, 1985).
Adaptive collection marks one kind of application
of machine power behind the representation. This can
be algorithmic machine power where the designer de­
termines in advance the conditional relationships be­
tween data collections and the states of the world or
"intelligent" machine power where the designer pro­
vides a description of the functional possibilities which
the machine uses to infer the particular data subset to
gather in a particular situation (e.g., Miller, 1983 or
RABBIT).
29
Analogical Representations
A second dimension along which representations can
vary is whether the information is presented as de­
scription (i.e., linguistic or digital form) or as depic­
tion (graphic or analog form). Visualization can be
a powerful aid to comprehension and conceptualiza­
tion. The priority of space as an organizing princi­
ple is so compelling that non-spatial data are often
given a spatial representation to improve comprehen­
sion (e.g. Haber, 1981). For example, people use
Venn diagram representations to assist syllogistic rea­
soning (Johnson-Laird, 1983), and the implications of
a set of data are found more easily in a cartesian plot
or other graphic form than in a data table (Cole, 1986).
Similarly, showing how some device or system works
(not how it looks) can aid a person to control or trou-
bleshoot that device (e.g., Lieberman, 1985).
Based on this observation one approach is to build
representations that directly encode higher order se­
mantic properties of the domain, that is, there is some
degree of analogical relation between the representa­
tion and the underlying world. In analogical repre­
sentation the structure and behavior of the representa­
tion (symbol) is related to the structure and behavior
of what is represented (referent). This means that per­
ceptions about the form of representation correspond to
judgements about the underlying semantics, for exam­
ple, a relationship between two elements of the repre­
sentation corresponds to a relational semantic property
of the world.
Because the symbol and referent are not related on
all dimensions, the difficult and critical design prob­
lem with this kind of integration is what is a useful
partial isomorphism between the form and the content
of a representation. To accomplish this the designer
first must determine what constraints between the sym­
bol and what is symbolized should be established, and
what techniques for analyzing the domain semantics
can specify these constraints (e.g., Miller & Mitchell,
1986; Woods & Hollnagel, 1987). A second design
problem is how to map the chosen aspects of domain
structure and behavior into characteristics of the rep­
resentation so that the domain semantics are directly
visible to the problem solver. This includes issues of
selecting, scaling and assigning lower order data to
characteristics of the representation. Finally, there is
the question of what amount and type of training and
experience with the representation as window on the
domain is needed.
Analogical representation produces economies of
processing in problem solving by reducing memory,
referencing and computational demands:
30
• If A is an analogy of S, then relationships within
S are represented in A without being explicitly
named in A. Thus, modifying a diagram also
and automatically changes the relationship be­
tween the modified object and all other objects
in the picture. The effects or consequences of the
change do not have to be calculated; they can be
directly observed.
• Using a map one can get to all of the relation­
ships involving a certain place through a single
access point; by contrast, each part of the region
would have to be referred to many times, in a
large number of statements, if the same data set
was expressed as a description (where the struc­
ture of the representation is independent of the
structure of what is represented). As a result, it
is easier with a map to access any part of a mu­
tually relevant data set given any one element of
the set.
• In good analogical representations, non-useful
possibilities are inherently difficult to follow and
useful possibilities are easy to follow (for exam­
ple, it is harder to invent a drawing of an impos­
sible object than it is to describe an impossible
object) because constraints in the semantics of the
domain (including causal and consequential rela­
tions) are expressed as constraints in the syntax
and allowable transformations of the representa­
tion.
• All of the above help reduce the dependence of
performance on user working memory capacity
because the analogical representation acts as an
external memory or provides the contextual re-
treival cues (e.g., Norman & Bobrow, 1979).
The weak form of analogical representation is to
provide structure among the elements of a collection.
Not any structure counts (if the representation is to
be more than a pictograph; Berlin, 1974), the visual
structure must be related to domain semantics. The
strong form of analogical representation uses machine
power to manipulate the behavior of the representation
in ways that directly correspond to domain semantics
(e.g., browsers, direct manipulation interfaces). Note
that in strong analogical integration, as in adaptive
collections, machine power is used to manipulate the
representation.
The power of analogical representation undoubtedly
contributes significantly to the appeal and effectiveness
of direct manipulation interfaces (Hutchins, Hollan &
Norman, 1986; Shneiderman, 1984). By presenting a
CHAPTER I. COGNITIVE SYSTEMS ENGINEERING
visual model of the world being acted upon, direct ma­
nipulation interfaces provide a concrete framework on
which the user can operate. As example, in the Pin-
bal Construction Set program (Budge, 1983) the com-
pononents for "building" a Pinball machine are visu­
ally displayed and can be manipulated at will to create
different Pinball games. As a result viable configura­
tions can be more quickly conceived and tested, and
impossible configurations become more readily appar­
ent.
Integral Displays
One of the strong forms of analogical representation
is the use of integral or object graphic forms. Inte­
gral displays have been developed for static worlds
such as statistics to represent the results of multivari-
ate analyses (e.g., Chernoff, 1973; Kleiner & Harti-
gan, 1981; Becker & Cleveland, 1984) as well as
dynamic worlds such as flightdecks (e.g., contact ana­
log displays; Roscoe & Eisele, 1976), in medicine to
aid patient monitoring (e.g., Siegel et al., 1971), and
in process control to aid monitoring of system status
(e.g., Woods et al., 1981; Goodstein, 1981).
In integral displays higher order properties are repre­
sented by depicting the relationships among the lower
order data that define the property. Instead of directly
noting the value of the higher order property, it is
represnted as an emergent feature of the structure and
behavior of the representation of the lower order data.
Figure 5 contains an example of one kind of integral
display (a geometric pattern format originally proposed
by Coekin, 1969) that was developed to depict the
overall safety status of a nuclear reactor (Woods et al.,
1981). The different spokes are dynamically scaled
so that a regular polygon always represents normal
conditions, while distortions in the figure represent a
developing abnormality. This integral display was de­
veloped in 1980 and is in use today in several power
plant control rooms.
Integral displays have many potential advantages for
improved user information extraction. Wickens (1984)
contains an overview of the psychological basis for
this philosophy for the display of data, and Jacob et
al. (1976), Goldsmith & Schvaneveldt (1984), Wick­
ens et al., (1984), and Carswell & Wickens (1984)
are empirical studies that confirm the theoretical anal­
ysis. For example, Wickens et al. (1984) examined
the role of integral display of data in user informa­
tion processing via a fault detection task on a simple
dynamic system. The data available on system perfor­
mance was interrelated through the dynamics of the
1.6. EXTERNAL REPRESENTATIONS AND HUMAN PROBLEM SOLVING
system, and this data needed to be integrated in or­
der to determine if the system was disturbed and the
source of the disturbance. They found that there was a
significant advantage with an integral display (a geo­
metric pattern format similar to Figure 5) over separate
display of the data (individual bars).
Different representational forms can vary in what
information (and how much information or "richness")
can be directly read out, how directly this information
specifies actions in the world, how broad or narrow
are the uses that the directly available information can
be put to. The evidence from several studies suggests
that properly designed integral displays can support
human performance by providing more direct read out
of more useful information.
Representations can support effective performance
in more ways than just the direct read out of signifi­
cant information - how easily can one read out of the
representation other, not directly available, informa­
tion (i.e., how well it supports the observer in going
beyond the information given). General attributes of
skill can be affected as well. For example, an essential
attribute of skill is the flexibility to adapt strategies and
resources to a changing world in the pursuit of goals.
Some representations may support the flexibility of
skilled performance better than others, even when both
directly provide useful information. Lesh (1987) sug­
gests (and illustrates) that the power of a representation
is a function of the ability of agents using it to go be­
yond the information given in the sense of discovering
new relationships or generating significant new ques­
tions or solving new sophisticated problems (i.e., those
which require more than simple read out of the infor­
mation available in the representation). This attribute
is particularly important for problem solving in worlds
where not all cases can be enumerated in advance and
in using representations offline to enhance skill acqui­
sition. Many people suspect that integral display is a
powerful type of representation in this sense.
Given that integral displays can support improved
performance, how does one create an effective inte­
gral display or, more generally, an effective represen­
tation for a domain? Representational form is defined
in terms of how data on the state and semantics of the
domain is mapped into the syntax and dynamics of
visual forms in order to produce information transfer
to the agent using the representation. It is indiffer­
ent to the visual form per se. Bar charts, trends and
other visual forms can be used to create the same rep­
resentational form (or variants on a representational
theme). Conversely, the visual appearence alone does
not define the representational form so that a single
31
visual format such as a bar chart can be used in many
representational forms.
The design challenge for creating effective repre­
sentations, such as integral displays, is to set up this
mapping so that the task-meaningful semantics are di­
rectly visible to the observer (what Becker & Cleve­
land, 1984 call the decoding problem, i.e., domain data
may be cleverly encoded into the attributes of a visual
form, but unless observers can effectively decoded the
representation to extract relevant information the rep­
resentation will fail to support the user). In the case of
integral displays, this requires the designer to confront
the question of scaling the chosen data so that the ob­
server can see the desired patterns. This includes prob­
lems of making disparate data comparable (e.g., how
to integrate data from two different physical dimen­
sions or how to combine a continuous and a discrete
dimension), setting scale resolution, and, most criti­
cally, identifying the reference normal and boundary
conditions as a function of the context. For example,
the display in Figure 5 can be seen as a dynamic likeli­
hood alarm that shows continuous variations between
target and limit conditions with respect to the health
of a nuclear reactor (Sorkin et al., in press).
The designer must also decide how to assign data to
the characteristics of the object format selected (e.g.,
to the spokes of the geometric figure). Careful assign­
ment of data is necessary because there are inherent
relationships in the graphic format that must be related
to (or at least not conflict with) the data relationships
to be portrayed. For example, Brown (1985) found
that in the faces object display form the data mapped
into the mouth feature dominated the data represented
on the other facial features. In Figure 5, the pres­
sure and temperature scales together define subcooling
(temperature at high limit marker and pressure at low
limit marker); placing these data on adjacent scales
emphasizes this underlying relationship.
These problems of selecting, scaling, and assign­
ing data to the visual form are critical for constructing
an effective example of the class of integral displays
because they affect not just how the domain seman­
tics are mapped into the the graphic form, but also
how visible they are to the user. For example, Kleiner
and Hartigan (1981, and the accompanying commen­
tary by Wainer) contains three different solutions to
these problems for a single integral format (faces) that
visibly change the salience of a single underlying data
pattern. On the other hand, irrelevant characteristics or
behavior of the graphic form (irrelevant to the designer
in the sense that domain information is not mapped
into these characteristics or behaviors of the graphic
32
1TL2 WID RNG 24FEB81 00 00 00
CORE EXIT
618/618°F
33 SUBCOOL
WID RCS PRESS STARTUP
2235/2235 PSIG 0 0 DPM
250 MCP
PRZR LEV CNTMT PRESS
60/60% l· ί 0 PSIG
RV LEV RAD CNTMT
100% SEC
OTHER
WID SG LEV Ip2
50/50%
Figure 5: One example of integral displays. A regular polygon represents normal conditions (Panel A), while
distortions in the polygon represent a developing abnormality (Panel B). (Copyright 1980 Westinghouse Electric
Corporation, and reproduced by permission
form) can be interpreted as carrying domain informa­
tion by the user and interfere with extraction (decod­
ing) of the relevant domain information. This over-
interpretation is one kind penalty that can occur with
analogical representations in general (Naveh-Benjamin
& Pachella, 1982; Halasz & Moran, 1982), e.g., the
unintentional from the designer's perspective domi­
nance of the mouth feature in the faces object display
(Brown, 1985). Additional challenges arise in design­
ing integral displays for dynamic applications. Not
only must the designer be concerned with the relation­
ship between domain semantics and the characteristics
of the integral display form he must also take into ac­
count how the behavior of the domain issue of interest
maps into the dynamic behavior of the graphic form.
Very little attention has been paid to dynamic symbol-
referent relationships to provide a source of guidance
for designers. However, studies of movement per­
ception show that a great deal of information unavail­
able (or available only with great difficulty) from static
representations is immediately extracted from dynamic
stimuli (Johansson, 1975). The power of the dynamic
element was often apparent in the work with the ge­
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
1TL2 WID RN
G 24FEB81 00 00 00
CORE EXIT
579/422° F
0 SUBCOOL
WID RCS PRESS STARTUP
1265/2235 PSIG 0 0 DPM
768 MOP
PRZR LEV CNTMT PRESS
0/41 o/o l· i 15 PSIG
RV LEV RAD CNTMT
70% SEC
OTHER
WID SG LEV Ip 2
39/50%
ometric pattern display in Figure 5. It was frequently
described by operational people who monitored simu­
lated plant conditions as providing a "heartbeat" for the
plant. Furthermore, plant behavior that was reflected
in characteristic behavior (not a single state) of the
graphic form was immediately apparent to operational
personel (e.g., the occurrence of a reactor shutdown
and whether it is a normal shutdown or whether some
underlying disturbance persists). Another example of
the power of dynamic symbolization is Cleveland's
interactive environment (Becker & Cleveland, 1984)
- brushing the scatterplot matrix - where an integral
graphic for analyzing multi-variate data is made in­
teractive As a result some statistical analyses become
visible dynamic patterns (e.g., autocorrelation).
Multiple Representations
One possibility is that effective problem solving per­
formance is best achieved by providing multiple rep­
resentations. Rasmussen (1986a) explicitly character­
izes different levels of representation and calls for de-
cison Support/interface design that provides multiple
1.6. EXTERNAL REPRESENTATIONS AND HUMAN PROBLEM SOLVING
representations for the human problem solver such as
views that contain information about the physical de­
vice and views that contain information about the func­
tions performed by the different physical parts (cf.
also, Davis, 1983 who addresses the role of multi­
ple representations in machine problem solving). Sys­
tems have begun to emerge that provide the user with
multiple views of a domain such as PECAN (Reiss,
1985). Goodstein (1983) and Woods (1986) describe
programs underway to define what would be useful
multiple perspectives in process control applications
based on analyses of the semantic structure of these
types of worlds. Specific multiple representation in­
terfaces based on these concepts are being developed
and tested. The question for cognitive engineering is
not how to provide computational facilities that allow
multiple representations but to study how multiple rep­
resentations can be used to aid performance.
For example, the significance of a given data point
varies with the observer's point of view, and a per­
spective is a description of an event or device from a
particular viewpoint. A representation system can be
organized around these semantically relevant perspec­
tives rather than around implementation concepts of
screens or windows (Williams, 1984; Woods, 1986).
The concept of multiple perspectives is based on a
metaphor that examining a data base is like a person
standing at some point in a topology. The portion of
the data topology that is viewable from a user specified
vantage point corresponds to the data of high potential
relevance given the user's interest (as expressed by
the requested vantage point). This field of attention
is constructed and manipulated through horizon lim­
its, landmarks, height of vantage point (level of sum­
mation), granularity of the view. The use of multiple
perspectives depends on the analysis of domain objects
and relations in order to define what perspectives are
meaningful and what portion of the topology is of high
potential relevance in that context, e.g., from the per­
spective of some goal of interest, data about goal sat­
isfaction, inter-goal constraints, process performance,
process availability form data subsets of high poten­
tial relevance. The user can then recognize interesting
or important conditions within this data field to focus
on or pursue. The display of the potentially relevant
data set helps the user progressively refine and focus
in on the important data for the current context (e.g.,
Norman & Bobrow, 1979).
Display selection now becomes a process of select­
ing an object and selecting a perspective or context.
Conceiving of data selection in terms of objects and
perspectives helps build interface transparency because
33
the user's data queries are formulated in terms that
are meaningful relative to his/her domain tasks rather
than in terms unique to the interface itself. Because
perspectives act as filters about what is relevant or ir­
relevant given a vantage point, they provide implicit
control over the portion of the database available to
the user at any time (from the data base point of view,
the problem of how much and what kind of data to
present to the user of large, heterogeneous data bases
or, from a psychological viewpoint, the problem of
specifying the user's normative field of attention in
varying contexts, Moray, 1981).
A Case in Representation Design
The most complete extant case of representation de­
sign (including both a new design and experimental in­
vestigation of the results) is Mitchell & Saisi (1987).
The application world was NASA satellite commu­
nications ground control centers. This is a complex
problem solving world (cf., Woods, 1988) in that it
is dynamic (event based), there are significant inter­
actions between parts of the world, it is large enough
that workload can play a significant role, and avail­
able evidence is uncertain. In the existing computer
based display and control system (what is in use in
actual centers) design for data availability dominated:
whatever is measurable is available to be displayed
(e.g., data block counts), for the most part what can
be examined is raw data, and the collection principle
is primarily by data type. Three VDU screens were
available to the users to call up display pages of data
to inspect in parallel.
Mitchell & Saisi developed a new design that re­
versed the emphasis from the display of data as signals
to be processed by the operators to display organized
to enhance communication of what is signified by the
available data. To accomplish this, they began with a
formal analysis of the domain semantics to identify the
demands on and activities of the operator as domain
problem solver (cf., Mitchell & Miller, 1986;). Based
on these results a new control center was designed.
First, data were collected based on operator functions
and information processing activities. Second, adap­
tive collection was introduced through automatic dis­
play of relevant data (via window management) given
the operator's expression of an area of interest and
the current state of the world (based on the seman­
tic analysis). This was accomplished through modi­
fications to an off the shelf window manager. Note
that the design developed by Mitchell & Saisi was not
directed by computational mechanisms (windows or
34
no windows, the three VDUs in the original system
constituted "windows;" or which window manager to
choose); instead, the design was directed by the se­
mantic analysis and then by a search for implemen­
tation techniques that could accomplish the cognitive
objectives constrained by cost, availability, etc. Third,
analogical representations were introduced through in­
tegral display graphics to communicate the state of
higher order domain properties directly. Note that this
means that the contents of collections were sometimes
analogically represented integrations of raw data rather
than raw data itself.
Mitchell & Saisi investigated the performance of
moderately trained subjects (five and one half hours)
on both the original support system and the new de­
sign. Performance with the new design showed large
and significant improvements over a wide range of per­
formance criteria, including workload, task execution,
fault compensation, plan revision given new events in
the world (e.g., unscheduled satellite transmissions).
One objection to "strong" representations such as
above is that they require an analytical or empirical
model of problem demands and user information pro­
cessing activities. Inadequacies in this model, as the
argument goes, will introduce new difficulties. One
way to deal with this objection has to do with robust
techniques for mapping cognitive demands and activ­
ities in complex worlds - one major topic for a viable
cognitive engineering. Second, the mapping from data
to what is signified by the data has to be done in order
to carry out domain tasks. This can be done on the fly
with no support for the domain actor, or offline anal­
ysis and investigation of the problem domain-current
representation-cognitive agents triad can be done in
advance to identify ways to produce a better match.
Third, representational techniques such as adaptive
collection and analogical representation are effective
in part because they are robust in that they leave the
domain actor in control (cf., Woods, 1986). For exam­
ple in the Mitchell & Saisi design, adaptive collection
is based on the user's expression of a region of inter­
est. Given an area or topic of interest, constraints in
the semantics of the domain are used to narrow the set
of potentially relevant data. Fourth, the results should
always be subject to testing. In Mitchell & Saisi's ex­
periment, deficiencies in the model were identified in a
few places. Using a model of cognitive demands and
activities helps identify model inadequacies because it
makes explicit the representation design.
CHAPTER I. COGNITIVE SYSTEMS ENGINEERING
1.7 Summary
To build a cognitive description of a problem solving
world one must understand how representations of the
world interact with different cognitive demands im­
posed by the application world in question and with
characteristics of the cognitive agents, both for exist­
ing and prospective changes in the world. Building a
cognitive description is part of a problem driven ap­
proach to the application of computational power. In
tool driven approaches, knowledge acquisition focuses
on describing domain knowledge in terms of the syn­
tax of computational mechanisms, i.e., the language of
implementation is used as a cognitive language. Se­
mantic questions are displaced either to whomever se­
lects the computational mechanisms or to the domain
expert who enters knowledge. The alternative is to
provide an umbrella structure of domain semantics that
organizes and makes explicit what particular pieces of
knowledge mean about problem solving in the domain.
There is a clear trend in this direction in order
to achieve more effective decision support and less
brittle machine problem solvers (e.g., Clancey, 1985;
Coombs, 1986; Gruber & Cohen, 1987). Acquiring
and using a domain semantics is essential to be ca­
pable of avoiding potential errors and specifying per­
formance boundaries when building "intelligent" ma­
chines (Roth et al., 1987). Techniques for analyzing
cognitive demands not only help characterize a partic­
ular world, they also help to build a repertoire of gen­
eral cognitive situations, that is, abstract and therefore
transportable reasoning situations which are domain
relevant because they use knowledge of the world be­
ing reasoned about. A cognitive description character­
izes what knowledge of the world is needed and how
this knowledge can be used to achieve effective perfor­
mance. It helps to identify places where performance
is more likely to go wrong (e.g., situations where state
dependent side effects become relevant or where a rea­
soning shortcut coded in a rule is not valid). Both of
these types of information about problem solving in
a domain can be used to specify what cognitive tools
are needed by cognitive agents and what kinds of com­
putational mechanisms are capable of providing such
tools.
1.8 References
Ackoff, R. L. The art and science of mess manage­
ment. Interfaces, 1981, 11, 20-26.
1.8. REFERENCES
Adelson, B. When novices surpass experts: the diffi­
culty of a task may increase with expertise. Journal
of Experimental Psychology: Learning, Memory and
Cognition, 483-495, 10(3), 1984.
Adelson, B. Problem solving and the development of
abstract categories in programming languages. Mem­
ory and Cognition, 1981, 9, 422-433.
Alterman, R. An adaptive planner. In Proceedings of
theAAAI. AAAI, 1986.
Alty, J. L. & Coombs, M. J. Face-to-face guidance of
university computer users-I: A study of advisory ser­
vices. International Journal of Man-Machine Studies,
1980, 12, 390-406.
Amendola, A., Bersini, IL, Cacciabue, P. & Manicni,
G. Modelling Operators in Accident Conditions: Ad­
vances and Perspectives on a Cognitive Model. Inter­
national Journal of Man-Machine Studies, 27, 1982.
(Also in G. Mancini, D. Woods & E. Hollnagel (Eds.)
Cognitive Engineering in Dynamic Worlds, London:
Academic Press.
Anderson, J.R. The Architecture of Cognition. Cam­
bridge, MA: Harvard University Press, 1983.
Anderson, J. R. , Boyle, C. F. & Reiser, B. J. In­
telligent Tutoring Systems. Science, April 1985, 228,
456-457.
Bainbridge, L. Diagnostic skill in process operation.
In M. L. Matthews & R. D. G. Webb (Eds.), Pro­
ceedings of International Conference on Occupational
Ergonomics. Toronto, Canada: , 1984.
Bechtel, W. Functional localization assumptions as im­
pediments to clinical research. In L. R. Troncale (Ed.),
A General Survey of Systems Methodolgy, Vol. 2. Mon­
terey, CA: Intersystems Publications, 1982.
Becker, R. A. & Cleveland, W. S. Brushing the Scat-
terplot Matrix: High-Interaction Graphical Methods
for Analyzing Multidimensional Data (Tech. Rep.).
AT&T Bell Laboratories Technical Memorandum,
1984.
Bly, S. A. & Rosenberg, J. K. A comparison of tiled
and overlapping windows. In M. Man tei & P. Orbe-
ton (Ed.), Human Factors in Computing Systems. New
York: Association for Computing Machinery, 1986.
(CHT86).
Bobrow, D. G. (ed.). Qualitative Reasoning About
Physical Systems. Cambridge, Mass.: The MET Press,
1985.
35
Boy, G. A. Operator Assistant Systems. International
Journal of Man-Machine Studies , 27, 1987. (Also in
G. Mancini, D. Woods & E. Hollnagel (Eds.) Cogni­
tive Engineering in Dynamic Worlds, London: Aca­
demic Press.
Bransford, J. D. & Johnson, M. K. Considerations of
some problems of comprehension. In Chase, W. G.
(Ed.), Visual Information Processing. Hillsdale, N. J.:
Lawrence Erlbaum Assoc, 1983.
Bransford, J., Sherwood, R., Vye, N. & Rieser, J.
Teaching and problem solving: Research foundations.
American Psychologist, 1986, 41, 1078-1089.
Britton, B. K. & Black, J. B. Understanding Exposi-
tory Text. Hillsdale, N. J.: Lawrence Erlbaum Asso­
ciates, 1985.
Broadbent, D.E., Cooper, P. E., Fitzgerald, P. &
Parkes, K. R. Cognitive Failures Questionnaire (CFQ)
and its Correlates. British Journal of Clinical Psychol-
ogy, 1982, 21, 1-16.
Brown, A.L., Bransford, J. D., Ferrara, R. A. &
Campione, J. C. Learning, remembering, and unde-
standing. In Flavell, J. H., & Markman, E. M. (Ed.),
CarmichaeVs manual of child psychology. New York:
Wiley, 1983.
Brown, A. L. & Campione, J. C. Psychological the­
ory and the study of learning disabilities. American
Psychologist, 1986, 41(10), 1059-1068.
Brown, J. S. & Burton, R. R. Diagnostic models for
procedural bugs in basic mathematical skills. Cognitive
Science, 1978, 2, 155-192.
Brown, J. S., Moran, T. P. & Williams, M. D. The
Semantics of Procedures (Tech. Rep.). Xerox Palo Alto
Research Center, 1982.
Brown, J. S. & Newman, S. E. Issues in cognitive
and social ergonomics: from our house to bauhaus.
Human-Computer Interaction, 1985, 1, 359-391.
Brown, J.S., & VanLehn, K. Repair theory: A gen­
erative theory of bugs in procedural skills. Cognitive
Science, 1980, 4, 379-426.
Brown, R. L. Methods for graphic representation of
systems of simulated data. Ergonomics, 1985, 28,
1439-1454.
Budge, B. Pinball construction set. (Computer pro­
gram). San Mateo, CA: Electronic Arts, 1983.
36
Cantor, N., Smith, E. E., French, R., & Mezzich,
J. Psychiatric diagnosis as prototype categorization.
Journal of Abnormal Psychology, 1980, 89, 181-193.
Caramazza, A., McCloskey, M., & Green, B. F. Naive
beliefs in sophisticated subjects: Misconceptions about
trajectories of objects. Cognition, 1981, 9, 117-128.
Card, S. K., Moran, T. P. & Newell, A. The Psychol­
ogy of Human-Computer Interaction. Hillsdale, N.J.:
Lawrence Erlbaum Associates, 1983.
Carroll, J. M. & Carrithers, C. Training wheels in a
user interface. Communications oftheACM, 1984, 27,
800-806.
Carswell, C. M. & Wickens, C. D. Stimulus integral­
ity in displays of system input-output relationships: a
failure detection study. In Proceedings of the Human
Factors Society. 28th Annual Meeting, 1984.
Casscells, W., Shoenberger, A. & Grayboys, T. Inter­
pretation by physicians of clinical laboratory results.
New England Journal of Medicine, 1978, 299, 999-
1000.
Chambers, J. M., Cleveland, W. S., Kleiner, P. A. &
Tukey, P. A. Graphical Methods for Data Analysis.
Belmont, CA: Wads worth, 1983.
Chase, W. & Simon, H. A. Perception in chess. Cog­
nitive Psychology, 1973, 4, 55-81.
Cheng, P. W. & Holyoak, K. J. Pragmatic reasoning
schémas. Cognitive Psychology, 1985, 17, 391-416.
Cheng, P. W., Holyoak, K., Nisbett, R. & Oliver,
L. Pragmatic versus syntactic approaches to training
deductive reasoning. Cognitive Psychology, 1986, 18,
293-328.
Chernoff, H. The use of faces to represent points in
k-dimensional space graphically. Journal of the Amer­
ican Statistical Association, 1973, 68, 361-368.
Chi, M. T. H., Feltovich, P. J. & Glaser, R. Cate-
gorizaton and representation of physics knowledge by
experts and novices. Cognitive Science, 1981, 5, 121-
152.
Chi, M. T., Glaser, R. and Rees, E. Expertise in
problem solving. In R. Sternberg (Ed.), Advances in
the Psychology of Human Intelligence. Hillsdale, N.J.: ing in Dynamic
Lawrence Erlbaum Assoc, 1982.
Chi, M., Glaser, R., & Farr. The Nature of Expertise. tronic troubleshooting. International Journal of Man-
Hillsdale, NJ: Erlbaum, 1986.
CHAPTER I. COGNITIVE SYSTEMS ENGINEERING
Clancey, W. J. The epistemology of a rule-based ex­
pert system - a framework for explanation. Artificial
Intelligence, 1983, 20, 215-251.
Clancey, W. J. Heuristic Classification. Artificial In­
telligence, 1985, 27, 289-350.
Cleveland, W. S. The Elements of Graphing Data.
Monterey, California: Wadsworth Advanced Books
and Software, 1985.
Cleveland, W. S. & McGill, R. Graphical perception:
Theory, experimentation, and application to the devel­
opment of graphical methods. Journal of the American
Statistical Association, 1984, 79, 531-554.
Coekin, J. A. A versatile presentation of parameters for
rapid recognition of total state. In International Sym­
posium on Man-Machine Systems. IEEE Conference
Record 69, 1969. (58-MMS 4).
Cohen, P. et al. Management of uncertainty in
medicine. In (Ed.), IEEE Conference on Computers
and Communications. IEEE, 1987. (Also University
of Massachusetts COINS Technical Report 86-12).
Cole, W. G. Medical Cognitive Graphics. In Chi'86
Conference Proceedings. ACM, 1986.
Coombs, M. J. Artificial Intelligence and Cognitive
Technology: Foundations and Perspectives. In Holl-
nagel, E., Mancini, G. & Woods, D. D. (Eds.), Intelli­
gent Decision Support in Process Environments. New
York: Springer-Verlag, 1986.
Coombs, M. J. & Alty, J. L. Face-to-face guidance of
university computer users-H: Characterising advisory
interactions. International Journal of Man-Machine
Studies, 1980, 12, 407-429.
Coombs, M. J. & Alty, J. L. Expert systems: An
alternative paradigm. International Journal of Man-
Machine Studies, 1984, 20, 21-43.
Coombs, M. J. & Hartley, R. T. The MGR Algo­
rithm and Its Application to the Generation of Ex­
planations for Novel Events. International Journal of
Man-Machine Studies, 27, 1987. (Also in G. Mancini,
D. Woods & E. Hollnagel (Eds.) Cognitive Engineer­
Worlds, London: Academic Press.
Davis, R. Reasoning from first principles in elec­
Machine Studies, 1983, 19, 403-423.
1.8. REFERENCES
De Keyser, V. Les Interactions Hommes-Machine:
Caractéristiques et utilisations des different supports
d'information par les operateurs. Rapport Politique
Scientifique/FAST n8.: Psychologie du Travail, Uni­
versite de l'Etat a Liege, 1986.
de Groot, A. Thought and Choice in Chess. The Hague:
Mouton, 1965.
Dorner, D. Heuristics and cognition in complex sys­
tems. In R. Groner, M. Groner & W. F. Bischof (Eds.),
Methods of Heuristics. Erlbaum, 1983.
Dubois, D. & Prade, H. A Tentative Comparison of
Numerical Approximate ReasoningMethodologies. In­
ternational Journal of Man-Machine Studies, 27, 1987.
(Also in G. Mancini, D. Woods & E. Hollnagel (Eds.)
Cognitive Engineering in Dynamic Worlds, London:
Academic Press.
Egan, D. & Schwartz, B. Chunking in recall of sym­
bolic drawings. Memory and Cognition, 1979, 7, 149-
158.
Ehn, P. & Kyng, M. A tool perspective on design
of interactive computer support for skilled workers.
Unpublished manuscript, Swedish Center for Working
Life, Stockholm, 1984.
Einhorn, H. J. & Hogarth, R. M. Ambiguity and Un­
certainty in Probabilistic Inference. Psychological Re­
view, 1985, 92, 433-461.
Elm, W. C. & Woods, D. D. Getting lost: A case
study in interface design. In Proceedings of the Human
Factors Society. 29th Annual Meeting, 1985.
Fischhoff, B. Decision Making in Complex Systems.
In Hollnagel, E., Mancini, G. & Woods, D. D. (Eds.),
Intelligent Decision Support. Germany: Springer-
Verlag, 1986.
Fischhoff, B., Slovic, P. & Lichtenstein, S. Fault trees:
Sensitivity of estimated failure probabilities to prob­
lem representation. Journal of Experimental Psychol­
ogy: Human Perception and Performance, 1978, 4,
330-344.
Fischhoff, B., Slovic, P. & Lichtenstein, S. Improv­
ing intuitive judgement by subjective sensitivity analy­
sis. Organizational Behavior and Human Performance,
1979, 23, 339-359.
Fischhoff, B., Lanir, Z., & Johnson, S. Military Risk
Taking and Modern C I (Tech. Rep. 86-2). Portland,
Oregon. Decision Research, 1986.
37
Fitter, M. J. & Sime, M. E. Responsibility and shared
decision making. In H. T. Smith & T. R. G. Green
(Eds.), Human Interaction with Computers. London:
Academic Press, 1980.
Funder, D. C. Errors and mistakes: Evaluating the
accuracy of social judgements. Psychological Bulletin,
1987, 101, 75-90.
Furnas, G. W. Generalized Fisheye Views. In Chi'86
Conference Proceedings. ACM, 1986.
Gadd, C. S. & Pople, H. E. An interpretation synthe­
sis model of medical teaching rounds discourse: Im­
plications for expert system interaction. International
Journal of Educational Research, 1, 1987.
Gaeth, G. J. & Shanteau, J. Reducing the influ­
ence of irrelevant information on experienced decision
makers. Organizational Behavior and Human Perfor­
mance, 1984, 33, 263-282.
Gaffhey, M. E. Bridge simulation: Trends and com­
parisons. Washington D. C : Maritime Transportation
Research Board, National Academy of Sciences, 1982.
unpublished report.
Garbolino, P. Bayesian Theory and Artificial Intelli­
gence: The Quarrelsome Marriage. International Jour­
nal of Man-Machine Studies, 27, 1987. (Also in G.
Mancini, D. Woods & E. Hollnagel (Eds.) Cognitive
Engineering in Dynamic Worlds, London: Academic
Press.
Gentner, D. & Stevens, A. L. (Eds.). Mental Models.
Hillsdale, NJ: Lawrence Erlbaum Associates, 1983.
Gibson, J. J. The Ecological Approach to Visual Per­
ception. Boston: Houghton Miffiin, 1979.
Gick, M. L., & Holy oak, K. J. Schema induction and
analogical transfer. Cognitive Psychology, 1983, 15,
1-38.
Gitomer, D. H. & Glaser, R. Knowledge, self-
regulation, and instruction: If you don't know it, work
on it. In R. E. Snow, & M. J. Farr (Eds.) (Ed.), Apti­
tude, Learning and Instruction (Vol. 3). Hillsdale, NJ:
Erlbaum, 1987.
Glaser, R. Education and thinking: The role of knowl­
edge. American Psychologist, 1984, 39, 93-104.
Goldsmith, T. E. & Schvaneveldt, R. W. Facilitating
Multiple-Cue Judgements with Integral Information
Displays. In J. C. Thomas & M. L. Schneider (Eds.),
Human Factors in Computer Systems. Norwood, NJ:
Ablex Publishing, 1984.
38
Goodstein, L. Discriminative Display Support for Pro­
cess Operators. In J. Rasmussen & W. B. Rouse (Eds.),
Human Detection and Diagnosis of System Failures.
New York: Plenum Press, 1981.
Goodstein, L. An integrated display set for process
operators. In G. Johannsen & J. E. Rijnsdorp (Eds.).
Analysis, Design and Evaluation of Man-Machine Sys­
tems. Pergamon Press, 1983.
Gopher, D. & Weil, M. & Siegel, D. Is it only a
game? Using videogames as surrogate instructors for
the training of complex skills. In 1986 IEEE Proceed­
ings. IEEE, 1986.
Gopher, D., Weil, M. & Siegel, D. Practice under
changing priorities: An approach to training of com­
plex skills. (Tech. Rep.) in press.
Gruber, T. & Cohen, P. Design for Acquisition:
Principles of knowledge system design to facilitate
knowledge acquisition. International Journal of Man-
Machine Studies, 26, 143-159. 1987, (Special Issue
on Knowledge Acquisition for Knowledge Based Sys­
tems).
Haber, R. N. The power of visual perceiving. Journal
of Mental Imagery, 1981, 5, 1-40.
Halasz, F. & Moran, T. Analogy considered harmful.
In Human Factors in Computer Systems. Gaithersburg,
MD: Chi 82, 1982.
Hasselbring, T., Goin, L., & Bransford, J. Dynamic
assessment and mathematics learning. Paper presented
at the 109th Annual Meeting of the American Associa­
tion of Mental Deficiency, Philadelphia, PA, 1985.
Hawkins, D. An analysis of expert thinking. Interna­
tional Journal of Man-Machine Studies, 1983, 18, 1-
47.
Henderson, A. & Card, S. Rooms: The use of multi­
ple virtual workspaces to reduce space contention in
a window-based graphical user interface (Tech. Rep.).
Xerox PARC, 1986.
Herry, N. Errors in the execution of prescribed instruc­
tions. In J. Rasmussen, K. Duncan & J. Leplat (Eds.),
New Technology and Human Error. Chichester: John
Wiley & Sons, 1987.
Hiebert, J. & Lefevre, P. Conceptual and procedu­
ral knowledge in mathematics. In J. Hiebert (Ed.),
Conceptual and Procedural Knowledge: The Case of
Mathematics. Hillsdale, NJ: Erlbaum, 1986.
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
Hirschhorn, L. Beyond Mechanization: Work and
Technology in a Postindustrial Age. Cambridge, MA:
MIT Press, 1984.
Hollan, J., Hutchins, E. & Weitzman, L. Steamer: An
interactive inspectable simulation based training sys­
tem. AI Magazine, 1984, 4, 15-27.
Hollnagel, E. & Woods, D. D. Cognitive Systems En­
gineering: New wine in new bottles. International
Journal of Man-Machine Studies, 1983, 18, 583-600.
HoUnagel, E., Mancini, G. & Woods, D. D. (Eds.).
Intelligent Decision Support in Process Environments.
New York: Springer-Verlag, 1986.
Hoogovens Report. Human factors evaluation:
Hoogovens No. 2 hot strip mill (Tech. Rep. FR251).
London: British Steel Corporation/Hoogovens, 1976.
Hutchins, E., Hollan, J. & Norman, D. A. Direct Ma­
nipulation Interfaces. Human-Computer Interaction, 1,
311-338, 1988.
Jackson, P. & Lefrere, P. On the application of rule-
based techniques to the design of advice giving sys­
tems. International Journal of Man-Machine Studies,
1984, 20, 63-86.
Jacob, R., Egeth, H. & Bevan, W. The face as a data
display. Human Factors, 1976, 18, 189-200.
Janvier, C. (ed.). Problems of Representation in the
Teaching and Learning of Mathematics. Hillsdale, NJ:
Erlbaum, 1987.
Johansson, G. Visual motion perception. Scientific
American, June 1975, pp. 76-88.
Johnson, E. & Payne, J. W. Effort and accuracy in
choice. Management Science, 1985, 31, 395-414.
Johnson-Laird, P. N. Mental Models: towards a cogni­
tive science of language, inference, and consciousness.
Cambridge, MA: Harvard University Press, 1983.
Kieras, D. E., & Poison, P. G. An approach to the for­
mal analysis of user complexity. International Journal
of Man-Machine Studies, 1985, 22, 365-394.
Klein, G. A., Calderwood, R. & Clinton-Cixocco, A.
Rapid decision making on the fire ground. In Proceed­
ings of the Human Factors Society. 30th Annual Meet­
ing, 1986.
Kleiner, B. & Hartigan, J. A. Representing points in
many dimensions by trees and castles. Journal of the
American Statistical Association, 1981, 76, 260-269.
1.8. REFERENCES
Kleinmuntz, D. N. Cognitive heuristics and feedback
in a dynamic decision environment. Management Sci­
ence, 1985, 31, 680-702.
Kotovsky, K., Hayes, J. R. & Simon, H. A. Why are
some problems hard? Evidence from Tower of Hanoi.
Cognitive Psychology, 1985, 17, 248-294.
Kragt, H. & Bonten, J. Evaluation of a conven­
tional process-alarm system in a fertilizer plant. IEEE
Transactions on Systems, Man, and Cybernetics, 1983,
SMC-13, 586-600.
Kruglanski, A., Friedland, N. & Farkash, E. Lay per­
sons' sensitivity to statistical information: The case
of high perceived applicability. Journal of Personality
and Social Psychology, 1984, 46, 503-518.
Kuipers, B & Kassirer, J. P. Causal reasoning in
medicine: Analysis of a protocol. Cognitive Science,
1984, 8, 363-385.
Langlotz, C. P. & Shortliffe, E. H. Adapting a con­
sultation system to critique user plans. International
Journal of Man-Machine Studies, 1983, 19, 479-496.
Langlotz, C , Shortliffe, E. & Fagan, L. Using decision
theory to justify heuristics. In Proceedings of AAAI.
AAAI, 1986.
Larkin, J., McDermott, D. P., & Simon, H. A. Expert
and novice performance in solving physics problems.
Science, 1980, 208, 1335-1342.
Lees, F. P. Process computer alarm and disturbance
analysis: Review of the state of the art. Computers
and Chemical Engineering, 1983, 7, 669-694.
Lenat, D. B. & Brown, J. S. Why AM and Eurisko
appear to work. Artificial Intelligence, 1984, 23, 269-
294.
Lesgold, A. M. Acquring expertise. In Anderson, J.
R. & Kosslyn, S. M. (Ed.), Tutorials in Learning and
Memory: Essays in Honor of Gordon Bower. San Fran-
scisco: W. H. Freeman, 1984.
Lesgold, A. M., Rubinson, H.,Feltovich, P., Glaser,
R., Klopfer, D., & Wanfg, Y. Expertise in a complex
skill: Diagnosing X-ray pictures. In Chi, M. T. H.,
Glaser, R., & Farr, M. (Ed.), The Nature of Expertise.
Hillsdale, NJ: Erlbaum, 1986.
Lesh, R. The evolution of problem representations in
the presence of powerful conceptual amplifiers. In C.
Janvier (Ed.), Problems of Representation in the Teach­
ing and Learning of Mathematics. Hillsdale, NJ: Erl­
baum, 1987.
39
Lieberman, H. Seeing what your programs are doing.
International Journal of Man-Machine Studies, 1984,
21,311-331.
Mahon, P. T. Report of the Royal Commission to In­
quire into the Crash on Mount Erebus, Antarctica of a
DC 10 Aircraft Operated by Air New Zealand. Welling­
ton, New Zealand: Government Printers, 1981.
Malone, T. W. How do people organize their desks:
Implications for designing office automation systems.
ACM Transactions on Office Information Systems,
1983, 1, 99-112.
Malone, T. W., Grant, K. R., & Turbak, F. A.
The Information Lens: An Intelligent System for
Information Sharing in Organizations. In Marilyn
Mantei and Peter Orbeton (Eu.)JtIuman factors in
Computing Systems: CHV86 Conference Proceedings.
ACM/SIGCHI, 1986.
Mancini, G., Woods, D. D. & Hollnagel, E.
(Eds.).Cognitive Engineering in Dynamic Worlds. Aca­
demic Press: London, in press. (Special Issue of In­
ternational Journal of Man-Machine Studies.).
March, J. G. & Weissinger-Baylon, R. (Eds.). Ambigu­
ity and Command. Marshfield, MA: Pitman Publishing,
1986.
McCloskey, M. & Caramazza, A. & Green, B. F.
Curvilinear motion with absence of external forces:
Naive beliefs about the motion of objeccts. Science,
1980,210, 1139-1141.
McCloskey, M. Naive Theories of Motion. In Gentner,
D. & Stevens, A. L. (Ed.), Mental Models. Hillsdale,
N. J.: Erlbaum, 1983.
McKendree, J. & Carroll, J. M. Advising roles
of a computer consultant. In Marilyn Mantei
and Peter Orbeton (Ed.), Human factors in Com­
puting Systems: CHF86 Conference Proceedings.
ACM/SIGCHI, 1986.
Miller, P. L. ATTENDING: Critiquing a physician 's
management plan. IEEE Transactions on Pattern Anal­
ysis and Machine Intelligence, 1983, PAMI-5, 449-
461.
Mitchell, C. & Miller, R. A. A discrete control model
of operator function: A methodology for information
display design. IEEE Systems, Man, and Cybernetics,
1986, SMC-16, 343-357.
40
Mitchell, C. & Saisi, D. Use of model-based qual­
itative icons and adaptive windows in workstations
for supervisory control systems. IEEE Transactions on
Systems, Man, and Cybernetics, 1987.
Miyata, Y. & Norman, D. A. Psychological Issues
in Support of Multiple Activities. In Norman, D. A.
& Draper, S. W. (Ed.), User Centered System De­
sign: New Perspectives on Human-Computer interac­
tion. Hillsdale, New Jersey: Lawrence Erlbaum Asso­
ciates, 1986.
Montmollin, M. de & De Keyser, V. Expert Logic
vs Operator Logic. In G. Johannsen, G. Mancini &
L. Martensson (Eds.), Analysis, Design, and Evalua­
tion of Man-Machine Systems. CEC-JRC Ispra, Italy:
IFAC, 1985.
Moray, N. The Role of Attention in the Detection of
Errors and the Diagnosis of Failures in Man-Machine
Systems. In J. Rasmussen & W. B. Rouse (Eds.), Hu­
man Detection and Diagnosis of System Failures. New
York: Plenum Press, 1981.
Moray, N. Attention to dynamic visual displays in
man-machine systems. In Parasuraman, R. and Davies,
D. R. (Ed.), Varieties of Attention. Academic Press,
1984.
Moray, N. Modelling Cognitive Activities: Human
Limitations in Relation to Computer Aids. In Hollan-
gel, E., Mancini, G. & Woods, D. D. (Eds.), Intelligent
Decision Support in Process Environments. New York:
Springer-Verlag, 1986.
Moray, N. & Senders, J. (Eds.). Human Error, in
preparation.
Muix, B. Trust between Humans and Machines. In­
ternational Journal of Man-Machine Studies, 1987.
(Also in G. Mancini, D. Woods & E. Hollnagel
(Eds.) Cognitive Engineering in Dynamic Worlds, Lon-
don:Academic Press.
Mulsant, B. & Servan-Schreiber, D. Knowledge En­
gineering: A daily activity on a hospital ward (Tech.
Rep. STAN-CS-82-998). Stanford University, 1983.
Naveh-Benjamin, M. & Pachella, R. G. The effect of
complexity on interpreting 'ChernofP faces. Human
Factors, 1982, 24, 11-18.
Newell, A. The knowledge level. Artificial Intelli­
gence, 1982, 18, 87-127.
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
Newell, A. & Card, S. K. The prospects for psycholog­
ical science in human-computer interaction. Human-
Computer Interaction, 1985, 1, 209-242.
Nickles, T. Scientific discovery and the future of phi­
losophy of science. In T. Nickles (Ed.), Scientific Dis­
covery, Logic, and Rationality. Dordrecht, Holland: D.
Reidel, 1980.
Noble, D. F. Forces of Production: A Social History of
Industrial Automation. New York: Alfred A. Knopf,
1984.
Norman, D. A. Categorization of action slips. Psycho­
logical Review, 1981, 88, l-15.(a).
Norman, D. A. Steps towards a cognitive engineering
(Tech. Rep.). University of California at San Diego,
Program in Cognitive Science, 1981. (b).
Norman, D. A. Design rules based on analyses of hu­
man error. Communications of the ACM, 1983, 26,
254-258.
Norman, D. A., & Draper, S. W., (Eds). User Cen­
tered System Design: New Perspectives on Human-
Computer Interaction. Hillsdale, NJ: Lawrence Erl­
baum Asciates, Inc., 1986.
Norman, D. A. & Bobrow, D. G. Descriptions: An
intermediate stage in memory retrieval. Cognitive Psy­
chology, 1979, 11, 107-123.
Norman, D. A. & Shallice, T. Attention to Action:
Willed and Automatic Control of Behavior (Tech. Rep.
8006). University of California, San Diego, 1980.
Norman, K. L., Weldon, L. & Shneiderman, B. Cog­
nitive layouts of windows and multiple screens for
user interfaces. International Journal of Man-Machine
Studies, 1986, 25, 229-248.
Perkins, D. & Martin, F. Fragile Knowledge and
Neglected Strategies in Novice Programmers. In E.
Soloway & S. Iyengar (Eds.), Empirical Studies of Pro­
grammers. Norwood, NJ: Ablex, 1986.
Perrow, C. The organizational context of human fac­
tors engineering. Administrative Science Quarterly,
1983, 28, 521-541.
Perrow, C. Normal Accidents. New York: Basic
Books, 1984.
Pew, R. W. et al. Cockpit Automation Technology
(Tech. Rep. 6133). BBN Laboratories Incorporated,
1986.
1.8. REFERENCES
Pew, R. W., Miller, D. C. & Feehrer, C. E. Evalua­
tion of Proposed Control Room Improvements Through
Analysis of Critical Operator Decisions. Palo Alto,
CA: Electric Power Research Institute, 1981. (NP-
1982).
Pollack, M. E., Hirschberg, J. & Webber, B. User par­
ticipation in the reasoning processes of expert systems.
In Proceedings of the National Conference on Artificial
Intelligence. 1982.
Pope, R. H. Power station control room and desk
design: alarm system and experience in the use of
CRT displays. In International Symposium on Nuclear
Power Plant Control and Instrumentation. Cannes,
France, 1978.
Pople, H. Jr. Evolution of an Expert System: from In­
ternist to Caduceus. In I. De Lotto and M. Stefanelli
(Ed.), Artificial Intelligence in Medicine. Elsevier Sci­
ence Publishers B. V. (North-Holland), 1985.
Rasmussen, J. Information Processing and Human-
Machine Interaction: An Approach to Cognitive En­
gineering. New York: North-Holland, 1986a.
Rasmussen, J. A cognitive engineering approach to
the modelling of decision making (Tech. Rep. Riso-
M-2589). Riso National Laboratory, 1986b.
Rasmussen, J. & Lind, M. Coping with complexity. In
H. G. Stassen (Ed.), First European Annual Confer­
ence on Human Decision Making and Manual Control.
New York: Plenum Press, 1981.
Rasmussen, J., Duncan, K. & Leplat, J. New Tech­
nology and Human Error. Chichester: John Wiley &
Sons, 1987.
Reason, J. & Embrey, D. E. Human Factors Principles
Relevant to the Modelling of Human Errors in Abnor­
mal Conditions (Tech. Rep. EC1-1164-B7221-84-UK).
European Atomic Energy Community, 1985.
Reason, J. Recurrent errors in process environments:
Some implications for the design of intelligent deci­
sion support systems. In Hollnagel, E., Mancini, G.
& Woods, D. D. (Eds.), Intelligent Decision Support.
Germany: Springer-Verlag, 1986.
Reason, J. Cognitive under-specification: Its varieties
and consequences. In B. Baars (Ed.), The Psychology
of Error: A window on the mind. New York: Plenum,
in press.
41
Reason, J. Cognitive Aids in Process Environments:
Prostheses or Tools? International Journal of Man-
Machine Studies, 27, 1987. (Also in G. Mancini, D.
Woods & E. Hollnagel (Eds.) Cognitive Engineering
in Dynamic Worlds, London: Academic Press.
Reason, J. & Mycielska, K. Absent Minded? The Psy­
chology of Mental Lapses and Everyday Errors. Engle-
wood Cliffs, NJ: Prentice-Hall, 1982.
Resnick, D. E., Mitchell, C. M. & Govindraj, T. An
embedded computer-based training system for rhino
robot operators. IEEE Control Systems Magazine, May
1987, pp. 3-8.
Rizzo, A., Bagnara, S. & Visciola, M. Human Er­
ror Detection Processes. International Journal of Man-
Machine Studies, 27, 1987. (Also in G. Mancini, D.
Woods & E. Hollnagel (Eds.) Cognitive Engineering
in Dynamic Worlds, London: Academic Press.
Robertson, G., McCracken, D. & Newell, A. The
ZOG approach to man-machine communication. In­
ternational Journal of Man-Machine Studies, 1981, 14,
461-488.
Roscoe, S. N. & Eisele, J. E. Integrated computer-
generated cockpit displays. In T. B. Sheridan & G.
Johannsen (Eds.), Monitoring Behavior and Supervi­
sory Control. New York: Plenum Press, 1976.
Roth, E. M., Butterworth, G., ΠΙ, & Loftus, M. J. The
Problem of Explanation: Placing Computer Generated
Answers in Context. In Proceedings of the Human Fac­
tors Society. 29th Annual Meeting, 1985. Vol. II.
Roth, E. M., Elias, G. S., Mauldin, M. L., & Ram­
age, W. W. Toward Joint Person-Machine Cognitive
Systems: A Prototype Expert System for Electronics
Troubleshooting. In Proceedings of the Human Factors
Society. 29th Annual Meeting, 1985. Vol. I.
Roth, E., Bennett, K. & Woods D. D. Human Interac­
tion with an 'Intelligent' Machine. International Jour­
nal of Man-Machine Studies, 27, 1987. (Also in G.
Mancini, D. Woods & E. Hollnagel (Eds.) Cognitive
Engineering in Dynamic Worlds, London: Academic
Press.
Roth, E. & Woods, D. D. Aiding human performance:
I. Cognitive analysis. Le Travail Humain, 51(1), 39-
64, 1988.
Schneider, W. & Fisk, A. D. Attention theory and
mechanisms for skilled performance. In Magill, R. A.
(Ed.), Memory and Control of Motor Behavior. Ams­
terdam: North Holland, 1983.
42
Schum, D. A. Current Developments in Research on
Cascaded Inference. In T. S. Wallstein (Ed.), Cognitive
Processes in Decision and Choice Behavior. Hillsdale,
NJ: Lawrence Erlbaum Associates, 1980.
Selfridge, O. G., Rissland, E. L. & Arbib, M. A. Adap­
tive Control of Ill-Defined Systems. New York: Plenum
Press, 1984.
Sheridan, T. Human and Computer Roles in Super­
visory Control and Telerobotics. In L. P. Goodstein,
H. B. Andersen & S. E. Olsen (Eds.), Mental Models,
Tasks and Errors. London: Taylor & Francis, 1980.
Sheridan, T. & Hennessy, R. (eds.). Research and
Modeling of Supervisory Control Behavior. Washing­
ton D. C : National Academy Press, 1984.
Shlaim, A. Failures in national intelligence estimates:
The case of the Yom Kippur War. World Politics, 1976,
28, 348-380.
Shneiderman, B. The future of interactive systems and
the emergence of direct manipulation. In Y. Vassiliou
(Ed.), Human Factors and Interactive Computer Sys­
tems. Norwood, NJ: Ablex, 1984.
Shneiderman, B. Seven plus or minus two central is­
sues in human-computer interaction. In Mantei, M.
and Orbeton, P. (Ed.), Human Factors in Comput­
ing Systems: CHI'86 Conference Proceedings. Boston:
ACM/SIGCHI, 1986.
Siegel, T., Goldwyn, R. & Friedman, H. Pattern
and process of the evolution of human septic shock.
Surgery, 1971, 70, 232-245.
Sleeman, D. & Brown, J. S. (eds.). Intelligent Tutoring
Systems. NY: Academic Press, 1982.
Smith, E. E. & Goodman, L. Understanding written
instructions: The role of an explanatory schema. Cog­
nition and Instruction, 1984, 1, 359-396.
Sorkin, R. D. & Woods, D. D. Systems with hu­
man monitors: A signal detection analysis. Human-
Computer Interaction, 1985, 1, 49-75.
Sorkin, R. D., Kantowitz, B. & Kantowitz, S. Likeli­
hood alarm displays. Human Factors, in press.
Stefik, M., Foster, G., Bobrow, D., Kahn, K., Lanning,
S. and Suchman, L. Beyond the chalkboard: using
computers to support collaboration and problem solv­
ing in meetings (Tech. Rep.). Intelligent Systems Lab­
oratory, Xerox Palo Alto Research Center, September
1985.
CHAPTER 1. COGNITIVE SYSTEMS ENGINEERING
Sternberg, R.J., & Caruso, D. R. Practical modes of
knowing. In Eisner, E. & Rehage, K. J. (Ed.), Learning
and teaching: The Ways of Knowing. Chicago: Univer­
sity of Chicago Press, 1985.
Suchman, L. A. Plans and situated actions: The prob­
lem of human-machine communication. Cambridge,
England: Cambridge University Press, 1987.
Toulmin, S. Human Understanding. Princeton NJ:
Princeton University Press, 1972.
U. S. Nuclear Regulatory Commission. Loss of Main
and Auxiliary Feedwater at the Davis-Besse Plant on
June 9,1985. Springfield, VA: National Technical In­
formation Service, 1985. (NUREG-1154).
van Creveld, M. Command in War. Cambridge, MA:
Harvard University Press, 1985.
von Winterfeldt, D. & Edwards, W. Decision Analy­
sis and Behavioral Research. New York: Cambridge
University Press, 1986.
Wagenaar, W. A. Does the Expert Know? The Reli­
ability of Predictions and Confidence Ratings of Ex­
perts. In Hollnagel, E., Mancini, G. & Woods, D. D.
(Eds.), Intelligent Decision Support in Process Envi­
ronments. New York: Springer-Verlag, 1986.
Wagenaar, W. & Groeneweg, J. Accidents at Sea:
Multiple Causes and Impossible Consequences. Inter­
national Journal of Man-Machine Studies, 27, 1987.
(Also in G. Mancini, D. Woods & E. Hollnagel (Eds.)
Cognitive Engineering in Dynamic Worlds, London:
Academic Press.
Walker, E. & Stevens, A. Human and Machine Knowl­
edge in Intelligent Systems. In Hollnagel, E., Mancini,
G. & Woods, D. D. (Eds.), Intelligent Decision Support
in Process Environments. New York: Springer-Verlag,
1986.
White, B. Y., & Frederiksen, J. R. Intelligent tutoring
systems based upon qualitative model evolutions. In
AAAI-86: Proceedings of the Fifth National Confer­
ence on Artificial Intelligence. American Association
for Artificial Intelligence, 1986.
Wickens, C. D. Engineering Psychology and Hu­
man Performance. Columbus, OH: Charles E. Merrill,
1984.
Wickens, C. The object display: Principles and a re­
view of experimental findings (Tech. Rep. CPL 86-6).
Army Research Institute, 1986.
1.8. REFERENCES
Wickens, C. D., Boles, D„ Tsang, P. & Carswell, M.
The limits of multiple resource theory in display for­
matting: Effects of task integration. Springfield, VA:
National Technical Information Service, 1984. (AD-
POOS 321).
Wiecha, C & Henrion, M. Linking multiple program
views using a visual cache. In Proceedings of Interact-
87. Stockholm, Sweden, 1987.
Wiecha, C. & Henrion, M. A graphical tool for struc­
turing and understand quantitative decision models. In
Proceedings of Workshop on Visual Lamguages. EEEE
Computer Society, 1987. 1987.
Wiener, E. Beyond the sterile cockpit. Human Factors,
1985, 27, 75-90.
Williams, M. D. What makes RABBIT run? Inter­
national Journal of Man-Machine Studies, 1984, 21,
333-352.
Williams, M. D., Hollan, J. D., & Stevens, A. L.
Human reasoning about a simple physical system: a
first pass. In D. Gentner & A. S. Stevens (Ed.), Men­
tal models. Hillsdale, N.J.: Lawrence Erlbaum Asso­
ciates, 1983.
Woods, D. D. Operator decision making behavior dur­
ing the steam generator tube rupture at the Ginna nu­
clear power station. In W. Brown & R. Wyrick (Eds.),
Analysis of Steam Generator Tube Rupture Events at
Oconee and Ginna. Institute of Nuclear Power Opera­
tions, 1982. (Also Westinghouse Research and Devel­
opment Center Report: 82-1C57-CONRM-R2).
Woods, D. D. Some results on operator performance
in emergency events. In D. Whitfield (Ed.), Ergonomie
Problems in Process Operations. Inst Chem. Eng.
Symp. Ser. 90, 1984.
Woods, D. D. Visual Momentum: A concept to im­
prove the cognitive coupling of person and computer.
International Journal of Man-Machine Studies , 1984,
21, 229-244.
Woods, D. D. Paradigms for Intelligent Decision Sup­
port. In Hollnagel, E., Mancini, G. & Woods, D. D.
(Eds.), Intelligent Decision Support in Process Envi­
ronments. New York: Springer-Verlag, 1986.
Woods, D. D. Coping with Complexity: The Psychol­
ogy of Human Behavior in Complex Systems. In L.
P. Goodstein, H. B. Andersen & S. E. Olsen (Eds.),
Mental Models, Tasks and Errors: London: Taylor &
Francis, 1988.
43
Woods, D. D., Elm, W. C. & Easter, J. R. The Distur­
bance Board Concept for Intelligent Support of Fault
Management Tasks. In Proceedings of the Interna­
tional Topical Meeting on Advances in Human Factors
in Nuclear Power. , 1986.
Woods, D. D. & Hollnagel, E. Mapping Cognitive
Demands in Complex Problem Solving Worlds. Inter­
national Journal of Man-Machine Studies, 1987, 26,
(Special Issue on Knowledge Acquisition for Knowl­
edge Based Systems).
Woods, D. D. & Roth, E. Models of cognitive Behavior
in Nuclear Power Plant Personnel. Washington D. C :
U. S. Nuclear Regulatory Commission, in preparation.
(NUREG-CR-4532).
Woods, D. D. & Roth, E. Aiding human performance:
II. From cognitive analysis to support systems. Le Tra­
vail Humain, 1988, 51(2), 139-171.
Woods, D. D., Roth, E. & Pople, H. Cognitive En­
vironment Simulation :An Artificial Intelligence Sys­
tem for Human Performance Assessment. Washington
D. C : U. S. Nuclear Regulatory Commission, 1987.
(NUREG-CR-4862).
Woods, D. D., Roth, E. M. & Bennett, K. B. Explo­
rations in Joint Human-Machine Cognitive Systems.
In W. Zachary, S. Robertson & J. Blach(Eds.), Cog­
nition, Computing and Cooperation. Norwood, NJ:
Ablex Publishing, in press.
Woods, D. D., Wise, J. A. & Hanes, L. F. An evalu­
ation of nuclear power plant safety parameter display
systems. In Proceedings of the Human Factors Society.
25th Annual Meeting, 1981.
Young, R. N. The machine inside the machine: user's
models of pocket calculators. International Journal of
Man-Machine Studies, 1981, 15, 51-85.
Yu, V. et al. Antimicrobial selection by a computer.
Journal of the American Medical Association, 1979,
242, 1279-1282.
Zachary, W. A cognitively based functional taxonomy
of decision support techniques. Human-Computer In­
teraction, 1986, 2, 25-63.
Zisner, K. & Henneman, R. L. Development and eval­
uation of a model of human performance in a large-
scale system. IEEE Transactions on Systems, Man and
Cybernetics, 1988, in press.