General

This chapter presents an overview of the principles of human interface design appropriate to the design and use of ship navigation bridges. These principles are applicable to the design of displays, controls and the bridge workspace for persons on watch duty who must conduct and monitor operations and respond to ambient and operational conditions. Applying these principles to bridge design will lead to interfaces and work environments that simplify bridge operations, reduce human error, are maintainable and limit the physical demands imposed on persons on watch duty and other bridge personnel. The following eight principles are discussed:

  • Principle 1—Defining the roles and responsibilities of the bridge personnel.

  • Principle 2—Designing for human limitations, capabilities and expectations.

  • Principle 3—Arrangement of bridge devices, controls and displays to maximise access.

  • Principle 4—Design of displays consistent with task requirements.

  • Principle 5—Designing simple, direct and easy to use inputs and controls.

  • Principle 6—Designing for productive performance and reduction in human error.

  • Principle 7—Provision of job aids and training.

  • Principle 8—Performance of testing.

Terminology

Achromatic: Designating colour perceived to have zero saturation and therefore no hue, such as neutral greys, white or black.

Alarm: A visual and/or audible signal indicating an abnormal situation.

Annunciation: An audible signal indicating a condition or system state (usually of an emergency or off-normal nature) via audible signals.

Expectation: A belief about or mental picture of the future. In ergonomic contexts, an expectation is a belief concerning the effect of an action, especially a control action.

Function: The appropriate action of any special components or part of a system to meet some defined purpose or objective; specific occupation or role; an assigned duty or activity.

Habituation: The reduction of a task performance likelihood following repeated false exposures to the stimulus (e.g., an oft repeated false alarm will reduce its ability to command a timely response).

Human task: A piece of work performed as part of one’s duties; a function performed; an objective.

Perception: The process of becoming aware of the immediate environment through any of the senses.

Situation awareness: The degree of accuracy by which one’s perception of the current environment mirrors reality.

Warning: A cautionary or deterrent indication of an impending abnormal situation.

Principles of Ergonomic Design

Principle 1—Defining the roles and responsibilities of the bridge personnel

For any given bridge design activity, the relative roles and responsibilities of humans and hardware/software need to be defined. Roles and responsibilities will vary depending on vessel trade, owner/operator objectives and processes, level of vessel automation and other factors. Whatever the specific contexts, the roles and responsibilities of the bridge personnel should be clearly identified. The design process presented in Chap. 13, “Ergonomic Design and Evaluation Process” provides a method to identify bridge design requirements based on human–machine functional allocation. The following provides general guidance on defining roles and responsibilities for bridge personnel. Identifying bridge functions and conduct requirements analysis. Identify specific functions that bridge systems (including personnel) need to perform. These should include not only those functions performed by equipment (e.g., depth sounding), but also those that are essentially human (e.g., visual lookout, route planning). The objective of this is to completely characterise what has to be accomplished from the bridge, in terms of:

  • Functions (e.g., sea surveillance).

  • Means to perform or support the function (e.g., radar sets, binoculars).

  • Requirements of functions (e.g., detect target presence, determine range and bearing, determine course and speed, compute closest point of approach, etc.).

For each function, requirements are further analysed to identify (or define by allocation) the specific roles of bridge personnel. Each human role/function will have associated human tasks that need to be identified and listed. Generation of task-based requirements. Identify bridge personnel tasks and the objectives of those tasks. Examine each task to determine information requirements, control requirements, as well as the skill and knowledge required to the perform tasks. Identification of task overlap. Identify, based on contextual and environmental factors, which tasks may overlap in time or bridge location. Examine the relationship between tasks and the subsequent prioritisation of tasks. Specification of system failure procedures. Consider what information and control provisions must be available from the bridge in case of a loss of automated functions. As far as possible, bridge systems should “fail-safe” (meaning that they do not fail leaving the systems in a hazardous or risky condition). Soliciting of bridge personnel inputs to requirements. Solicit experienced bridge personnel to identify and verify human tasks, as well as associated information, displays and controls required to perform those tasks. Designing for efficiency and the control of personnel workloads. Select and arrange bridge equipment and design jobs and tasks so that bridge personnel:

  • Can reliably perform their functions.

  • Are productive.

  • Are not overloaded with work.

Principle 2—Designing for human limitations, capabilities and expectations

Humans and machines have, of course, very different capabilities. Humans are creative, can make decisions in the face of uncertainty, are highly mobile, learn rapidly, can generalise knowledge to novel situations, are communicative and have massive sensing and sensory processing capability. Machines can exert great force for sustained periods, can do repetitive work flawlessly for long periods, can withstand a wide range of physical environments and do not get bored, complacent, forgetful, tired or angry. The objective in bridge design is to take full advantage of the relative capabilities and limitations of humans and machines. In the broadest sense, humans should be involved in vessel management and planning activities and should communicate those plans and activities to the machines that perform the work (without a sense of tedium). Humans also monitor machinery and intervene when plans are not followed and perform replanning as needed when the environment or material condition of the equipment changes. In other words, humans plan and decide and machines implement the outcomes of those decisions at the bidding of the human. Guidance related to design of navigation bridges consistent with human capability is presented below.

Limiting human data processing. The design of interfaces should be compatible with human capabilities and limitations as information processors. Where possible, machines should perform data manipulation and present the result to the human for decision-making. A common example is the ARPA radar that computes the CPA to other vessels. The human uses that result in the context of knowledge-based decision making (e.g., applying the Rules-of-the-Road, negotiating passing plans and replanning ship’s course and speed). Machines should be used for such tasks as storing masses of information or performing complex calculations. Humans should be used as sensors, planners and deciders and monitors of machine performance. Organising human machine interfaces in harmony with physical layouts. Where appropriate, control and display layouts representing equipment arrangement (e.g., thruster orientations, ballast tank arrangements, navigation light control panels) should mimic the spatial and functional relationships of the equipment monitored and controlled. Where possible, mimic lines should be used to show the physical relationships (e.g., lines connecting pumps and valves) of the components.

Accommodation of human expectations. Experience influences how humans interpret a display or operate a control. Equipment design should be consistent with those expectations. Design of control actions and display response (directions of movement) should be consistent across workstations. Be concerned where different vendors are used to select/assemble bridge hardware and software (vendors may have designed to different expectations) or where different teams generate designs for different interfaces. Standardisation of display characteristics. Display characteristics should be consistent among locations (or computer display pages):

  • Colours should have the same meaning across all displays.

  • Schematics should have similar formats (e.g., process flow is normally from left to right) to maintain, when possible, an exact spatial mapping of one display onto another.

  • Computer display and panel display information layouts should be spatially compatible with one another.

Facilitation of human attention. Matching the task to the attention strengths and capabilities of the human can mitigate possible errors due to distraction, complacency, habituation and high workload:

  • Avoid distractions or requirements to perform meaningless tasks (at least during a watch).

  • Place frequently used and important displays (e.g., navigation, helm control, radar) in a central viewing area.

  • Ensure alarms are not so frequent that they cease to have an attention-getting effect.

  • Use meaningful information groupings so that bridge personnel will be able to easily deal with a large amount of information.

  • Avoid tasks that compete for attention (e.g., paperwork that is not related to standing watch and keeping a proper lookout).

  • Define clear task priorities.

Designing within physical and perceptual limits. These guidelines address the compatibility of equipment design within the limits of humans to exert force, reach and manipulate objects and sense the physical environment:

  • Controls should be placed within easy reach and adjacent to related displays.

  • Displays that are viewed from a nominal position should be:

  • Easy to read (e.g., character size compatible with viewing distance)

  • Within an immediate field of view (directly in front of the viewer) and not obscured

  • Provided sufficient colour, brightness and contrast

  • Large enough to be seen from expected viewing distances and under expected ambient environments (day/night and weather conditions).

  • Control the physical environment so that ambient conditions do not interfere with visual or audible signals.

  • Guard against inadvertent control operation.

  • Arrange the bridge so that objects can be easily and readily reached and manipulated.

Limiting memory requirements. Human memory is limited in capacity, is often unreliable (i.e., error prone) and can be affected significantly by factors such as fatigue, stress and physical health.

  • Provide efficient methods of calling up display of important or changing information.

  • Avoid having to page through several displays to access frequently used or critical information – it should be possible to display time critical information immediately.

  • Avoid the need to cross-reference between information displays.

  • Clearly identify all controls and displays.

  • Use simple and memorable codes that are easily distinguishable.

  • Include rapid information updating so that bridge personnel do not have to wait.

  • Provide obvious, ongoing display of automated system status (e.g., to indicate when automatic processes have been manually overridden, disabled or failed).

Use of colour coding to simplify information search and interpretation. Where carefully applied, colour can be very effective in reducing visual search, simplifying interpretation of displayed information, reducing ambiguity in decision making and reducing requirements to recall information from memory. Inappropriate use of colour can lead to confusion and error. When designing colour codes, consider the following:

  • Add colour only after the effectiveness of an interface has been maximised in an achromatic format.

  • Do not use colour as the sole coding mechanism to convey information. Colour coding should be redundant to some other coding mechanism (such as symbols or text).

  • The use of colour should not reduce readability of displays, labels, maps, etc.

  • Colour should be applied to avoid or minimise difficulties for personnel having impaired colour vision.

  • Where colour coding is employed to denote discrete conditions (e.g., auto-pilot on/off, pump is running, in standby or off, etc.), no more than seven different colours and associated meaning should be used. If similar hues are used, they should be used only with logically related information.

Principle 3—Arrangement of bridge devices, controls and displays to maximise access

Component grouping to minimise bridge traffic. Group components, consoles and devices according to frequency, importance and sequence of use. Arrange bridge components to minimise the need for the persons on watch duty to move to alternative positions on the bridge. For example, locate vessel-to-vessel communications devices adjacent to radar displays and manoeuvring stations. Arrange components on the bridge to facilitate unobstructed external visibility, especially forward-looking. Ensure that any task (or several tasks that need to be performed simultaneously) can be performed from a single standing or seated position. Arrangement of displays by task association. When possible, group all the information relating to a particular task together in one place.

  • Locate related information together.

  • Locate related items such that they are easy to associate.

  • Locate displays close to (or on) other displays and controls with which they are associated.

Centralise important information. Centralise important information to allow actions to be prioritised. Optimisation of arrangements. Optimise arrangements to support time and safety critical tasks. Layouts should emphasise ease and reliability of performance of safety critical tasks, such as collision avoidance, tug interface, piloting and berthing. Group information to support operations. Bridge personnel should not have to page through computer displays to collect information required for a particular operation.

Principle 4—Design of displays consistent with task requirements

Provision of external and internal consistency. Coding should be consistent among software displays, hardware displays, written documentation and job aids. For example, when designing symbols used to represent equipment (e.g., pumps, thrusters, sea chests, impellers) use the same symbols that bridge personnel are familiar with from drawings, labels, procedures, national and industry standards or training materials. Provision of situation awareness displays. Provide situation awareness displays to keep a summary check on the whole of the system and environment for which bridge personnel have responsibility. Ensure sufficient time to refresh situation awareness at the following times:

  • Watch turnovers.

  • When additional staffing must be used (e.g., in emergencies, port approaches and departures).

  • Following changes in the use of automation (e.g., changing from auto to manual steering or transitioning to bridge monitoring of engineering functions during times when engine rooms are unattended).

  • As changes in requirements for surveillance, navigation and piloting occur (e.g., due to increased sea-lane occupancy, weather changes or system failures).

Base display design on information requirements. Design displays based on the requirements of the task. Avoid prior (hardware or software) display formats as a sole basis for the design of computer displays or back-up hard wired displays:

  • Involve bridge personnel in the identification of interface requirements (be advised that their understanding of requirements may be based on prior designs and practices that may have been clumsy).

  • Involve bridge personnel in the usability evaluation of interfaces under development.

Provision of sufficiently accurate and precise information. Provide information to the level necessary for accuracy and precision required by the task. For example, if a task requires information display only in whole units, do not present decimal values in displays (e.g., DEPTH UNDER KEEL 12 FEET, versus DEPTH UNDER KEEL 12.214 FEET). Information accuracy and precision includes how current (up to date) information is (as it changes with the passage of time). Limit display complexity. The contents of a display should provide all of the information required to perform tasks in a simple, directly usable form (e.g., without having to transform or extrapolate the information). Display actual equipment status. Display equipment status (e.g., valve status or rudder position) directly from the actual equipment and not from the demanded control setting (e.g., actual rudder angle as opposed to ordered angle). Group information to support task performance. Group information to make it easy to make data comparisons, discern cause and effect relationships, identify time lags and assess rates of change in processes such as changing vessel course against other targets’ movements. Prioritise alarms and audible indicators. An alarm is a visual and/or audible signal typically indicating an abnormal situation demanding human attention and response (e.g., a depth under keel alarm). An audible indication is usually a display of status or vessel condition (e.g., tones that indicate a telephone or radio call is incoming or that an equipment function has failed). Priorities of alarms and audible indicators should be clearly coded. Prioritise alarms to allow quick assessment of the importance of simultaneous alarms. Prioritisation schemes include:

  • Sequencing alarms in a way that enables the development of abnormal events to be better understood.

  • Separating critical alarm information from information or status indications.

  • Using dedicated computerised alarm displays.

  • Provision of distinct audible indicators (being separate from alarms) that indicate automatic or semi-automatic actions of the system (e.g., transitioning from autopilot to manual steering). If a failure by the persons on watch duty to notice the occurrence of an audible indicator can lead to unsafe conditions (e.g., failure to notice that the vessel’s gyro has failed or low lube oil pressure in the steering gear) then that condition should be considered an alarm condition and should not be designed as a simple audible indication.

Avoid nuisance alarms. Alarms are used to signify urgent events and conditions. When alarms are presented, only to be discovered as false or of no real importance, subsequent alarms can tend to be regarded as unimportant, to the point of being dismissed (not investigated) entirely. It is important that audible and visual alarms consistently signify events or conditions that require immediate action. This can be accomplished by the following:

  • Use audible alarms for abnormal or emergency conditions only.

  • Do not use alarms to indicate equipment status or normal conditions (e.g., watertight doors closed, running lights on, control valve position, etc.).

  • It should be possible for every bridge alarm to gain immediate attention (even if personnel are not able to deal with the condition immediately).

Acknowledging alarms. It should not be possible to dismiss critical alarms until the initiating condition is resolved. Locate acknowledgement devices such that audible components of alarms can be acknowledged while allowing alarm information to be read. It should be possible to silence an audible alarm only when that does not cause a loss of alarm information (e.g., visual display of the alarmed parameters). Avoid alarm ambiguity. Alarms should have a unique code (audible signal) if a unique type of response is required. Colour should not be the only means of distinguishing between alarm and non-alarm conditions. Labelling and other information should obviously associate the alarm indicator with the equipment or condition about which the alarm was triggered.

Principle 5—Designing simple, direct and easy to use inputs and controls

Provide direct human control. Design the system interaction such that bridge personnel pace the tempo of operations. Ensure that the human controls the pace of control entries by explicit actions and that such entries occur through explicit human actions. This includes the actions of automated systems by allocating to the human the function of determining and inputting plans and activities for automated system performance (such as voyage plans) and by providing the human with the ability to intervene in automatic system performance and functioning. Clearly identify control modes. Automated, aided or manual control modes (e.g., auto-pilot steering vs. manual control of the steering wheel) should be clearly indicated by a display associated in close proximity to the controlled component. Operating mode changes are indicated and annunciated. When transitioning between control modes (e.g., from manual to auto-pilot steering or transitioning control of the propulsion system from engineering spaces to the bridge), ensure that:

  • Positive action on the part of bridge personnel is required (e.g., by positioning a control or issuing a computer command).

  • At the time of transfer, associated displays need to indicate the current, actual control mode and then announce the transfer, with an audible signal that sounds at each affected workstation.

  • In the case of the steering wheel, if transfer of helm control to the steering wheel (or joystick or thruster control) is accomplished solely by motion of the device (e.g., a helmsman assumes manual control by directly manipulating the wheel) a positive indication of the mode of control should be provided by conspicuous visual and audible displays.

Provide guidance for human intervention in automated systems. Guidance (in the form of written procedures or placards) for when human invention is needed should be explicit for the following conditions:

  • When to take over from automatic functions or control.

  • When and how to hand over control from a local control space to another location.

  • When to shut down equipment or systems.

Provide direct and immediate feedback for control actions. When possible, locate controls and displays (related by action and effect/feedback) together. All the effects of an action or command on the process should be simultaneously observable on associated displays. If equipment of system response time is slow, feedback should be provided indicating the action has been initiated and is progressing (e.g., rudder position and rate of turn indicators). If more than one person controls the action of a bridge (or related) system, all relevant information should be simultaneously available to the person responsible for coordinating the task. When possible, supply all the necessary information simultaneously (e.g., in parallel rather than sequentially) that is needed for a diagnosis or a control decision. Provide simple computerised display navigation. Navigation through computer displays should not require that bridge personnel remember paths to information. Rather, they should be led to the information through recognition techniques (e.g., by use of pop-up menus, navigational maps or navigation palettes). Help bridge personnel not to get lost when navigating among windows. Limit the depth of window and menu hierarchies to no more than three levels. Provide maps or other cues to provide awareness of “where they are” in the interface. Response latency and visibility of system status. Where system responses to control actions are slow or delayed, provide intermediate indications of system response. For example, an indication of a ship’s speed of course change can be provided by a Rate of Turn indicator for a ship with a wide turn radius and slow vessel response. This allows the helmsman and deck officer to more immediately verify system response to the control order.

Principle 6—Designing for productive performance and reduction in human error

Provide error prevention and tolerance. To the extent possible, equipment should safeguard against human error. In other words, actions that could directly lead to damage to the vessel, people or the environment should be provided guarded controls or in the case of software, potentially dangerous actions should require a confirmatory action (e.g., click CONTINUE to confirm that all watertight doors are to be opened or click CANCEL to exit.). Further, and where possible, software should be able to monitor and advise on the safety of human actions. An example of this is a radar system that computes a CPA to a navigational hazard or other vessels navigating in the near vicinity after a change in helm order and alerts the persons on watch duty if there is a danger of collision. Consider task communication needs. Communication systems should be designed to:

  • Avoid requiring personnel to frequently move to different locations on the bridge to access communications equipment.

  • Consider using portable or wearable, as well as fixed, communication equipment, where the first point above, is considered difficult to comply with.

Avoid control conflict. Avoid simultaneous control of systems or equipment from different workstations. Avoid two or more people being able to simultaneously influence the same part of a process from different control and display locations (e.g., controlling engine speed from an engineering station and from the bridge). In other words, do not require ship personnel to compete for control of a system. Compatibility of bridge staffing with operational requirements. The following principles should be applied to ensure compatibility among the bridge staffing complement; the tasks to be performed; the environment (time of day, weather conditions, congestion of waterways, etc.); and the bridge design and its automation. Determine staffing for all modes of operation, based on high workload operations. Consider whether staffing levels, skills and experience will be sufficient for all known operational and failure conditions. Consider staffing implications for worst-case scenarios. Consider staffing for normal conditions. Allocate tasks according to skills and experience.

Principle 7—Provision of job aids and training

Identify required knowledge, skills and abilities. Know what bridge personnel have to do and provide the training to perform the required tasks. Performing a task analysis (refer to Chap. 29, Ergonomic bridge design) is sufficient to identify bridge personnel task requirements. Identify training needs and requirements. Define training needs specific to a given bridge design and specific automated functions:

  • Identify automated functions and what interventions may be necessary by bridge personnel.

  • Identify the conditions dictating automated or human task performance.

  • Provide training involving vessel control when automated control functions or information is unavailable.

  • Provide training for conditions where important tasks compete for attention.

  • Provide hands-on training in transitioning between automatic and manual control functions.

Provide procedures. Provide available written or on-line procedures to guide and document infrequent, complex or safety critical operations. Through procedures, indicate appropriate human actions in case of particular alarm conditions (scenarios), rather than cluttering displays with instructions. Provide procedures to address infrequent or postulated conditions. Provide on-line help. Provide adequate labels and warnings. Provide standardised, durable, readable, usable labels for all equipment and components. Labels and marking should be consistent in terms of:

  • Coding and colours used.

  • Mounting location.

  • Language and nomenclature.

  • Stylistic design.

Principle 8—Performance of testing

Verify functionality. Verify that the identified functional requirements of the bridge are correctly implemented. Perform usability testing. Observe bridge personnel using hardware and software. Simulate infrequent, uncommon, hazardous and unpredictable tasks. During testing take note of:

  • Any observed confusing or error-inducing design aspects.

  • Bridge personnel observations (Masters, Mates, lookouts, etc.).

  • Unnecessary work or task activities.

  • Observed or reported errors in task performance.

  • Bridge persons on watch duty comments on the usability of components, tasks or arrangement of components.

Usability testing should occur throughout the design cycle of the bridge and at every instance of bridge equipment modification or upgrade.